Bug: default Engine API JWT secret is hardcoded while authrpc binds to 0.0.0.0

[mssystem1]

The default node configuration includes a hardcoded BASE_NODE_L2_ENGINE_AUTH_RAW value. The Reth entrypoint writes this value into the JWT file used by --authrpc.jwtsecret, while also starting authrpc on 0.0.0.0.

This means every node using the default configuration shares the same Engine API JWT secret.

Although docker-compose.yml does not publish port 8551 by default, this is still a dangerous default for operators using host networking, Kubernetes, custom compose files, manual port mappings, or shared Docker networks. If authrpc becomes reachable, the JWT secret is already public because it is committed in the repository.

[mssystem1]

Steps:

1. Open .env.mainnet

2. Notice that BASE_NODE_L2_ENGINE_AUTH_RAW is set to a fixed hardcoded value:

   BASE_NODE_L2_ENGINE_AUTH_RAW=688f5d737bad920bdfb2fc2f488d6b6209eebda1dae949a8de91398d932c517a

3. Open reth/reth-entrypoint

4. Notice that the entrypoint writes the raw value into the JWT file:

   echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"

5. In the same file, notice that Reth starts authrpc on all interfaces:

   --authrpc.addr=0.0.0.0
   --authrpc.port="$AUTHRPC_PORT"
   --authrpc.jwtsecret="$BASE_NODE_L2_ENGINE_AUTH"

6. Run the node with default env values

7. Any deployment that exposes authrpc port 8551, uses host networking, or places untrusted services on the same network now uses a public, shared JWT secret

[mssystem1]

Expected behavior:

The Engine API JWT secret should be unique per node and should not be committed as a static default.

authrpc should bind to localhost or the internal Docker network by default, not 0.0.0.0, unless the operator explicitly opts in.

[mssystem1]

Suggested fix:

1. Do not ship a fixed BASE_NODE_L2_ENGINE_AUTH_RAW value in .env.mainnet or .env.sepolia
2. Generate a random JWT secret at startup if no secret is provided
3. Persist the generated secret under the node data directory
4. Bind authrpc to 127.0.0.1 or an internal-only interface by default
5. Add a startup warning if BASE_NODE_L2_ENGINE_AUTH_RAW is still set to the known default value

Example shell logic:

if [ -z "${BASE_NODE_L2_ENGINE_AUTH_RAW:-}" ]; then
if [ ! -f "$BASE_NODE_L2_ENGINE_AUTH" ]; then
openssl rand -hex 32 > "$BASE_NODE_L2_ENGINE_AUTH"
fi
else
echo "$BASE_NODE_L2_ENGINE_AUTH_RAW" > "$BASE_NODE_L2_ENGINE_AUTH"
fi

Also consider changing:

--authrpc.addr=0.0.0.0

to:

--authrpc.addr=127.0.0.1

or document very clearly that exposing authrpc with the default JWT is unsafe.