From 46da2bdeb17935b19f68525f1fcca838514731f4 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Tue, 22 Sep 2026 06:28:34 -0700 Subject: [PATCH] fix(kms): read each auth-eth decision from a single block The allow check and gatewayAppId were read at latest in separate calls, so one decision could mix blocks. Pin both to the same block number. --- dstack/kms/auth-eth/src/ethereum.ts | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/dstack/kms/auth-eth/src/ethereum.ts b/dstack/kms/auth-eth/src/ethereum.ts index 2715d5024..ebd655140 100644 --- a/dstack/kms/auth-eth/src/ethereum.ts +++ b/dstack/kms/auth-eth/src/ethereum.ts @@ -50,14 +50,16 @@ export class EthereumBackend { tcbStatus: bootInfo.tcbStatus, advisoryIds: bootInfo.advisoryIds }; + // Read the whole decision from one block. + const blockTag = await this.provider.getBlockNumber(); let response; if (isKms) { - response = await this.kmsContract.isKmsAllowed(bootInfoStruct); + response = await this.kmsContract.isKmsAllowed(bootInfoStruct, { blockTag }); } else { - response = await this.kmsContract.isAppAllowed(bootInfoStruct); + response = await this.kmsContract.isAppAllowed(bootInfoStruct, { blockTag }); } const [isAllowed, reason] = response; - const gatewayAppId = await this.kmsContract.gatewayAppId(); + const gatewayAppId = await this.kmsContract.gatewayAppId({ blockTag }); return { isAllowed, reason,