[Security][High] Disable debug-tracer API in archive node chain configurations

[numbers-official]

Summary

Archive node chain configurations expose the debug-tracer Ethereum API, which allows external callers to trace transaction execution and extract internal EVM state. This API should not be enabled on production or public-facing archive nodes.

Affected Files

• avalanchego/configs/chains/2PDRxzc6jMbZSTLb3sufkVszgQc2jtDnYZGtDTAAfom1CTwPsE/config.json (Line 13)
• avalanchego/configs/chains/2oo5UvYgFQikM7KBsMXFQE3RQv3xAFFc8JY2GEBNBF1tp4JaeZ/config.json (Line 13)

Current Configuration

"eth-apis": [
    "eth",
    "eth-filter",
    "debug-tracer"
]

Security Impact

• Transaction tracing: Attackers can replay any transaction with full internal state visibility
• Smart contract reverse engineering: Internal call traces expose contract logic and state transitions
• Resource exhaustion: Debug tracing is computationally expensive and can be used for DoS attacks
• Information disclosure: Exposes internal EVM execution details not meant for public consumption

Suggested Fix

Remove debug-tracer from eth-apis in both chain config files. If debug tracing is needed for development, it should only be enabled on non-public nodes with access controls:

"eth-apis": [
    "eth",
    "eth-filter"
]

If debug access is required for specific use cases, add it behind authentication or restrict to localhost-only access.

Generated by Health Monitor with Omni

[numbers-official]

已修復：debug-tracer 已從兩個 archive node chain config.json 移除，直接在 repo 實作。