Bug: access pass has duplicates and missing validators

[bgm-malbeclabs]

access pass returns duplicated validator ids and has missing validator ids compared to @nihar-dz's fees list. We should figure out why

[martinsander00]

hi @bgm-malbeclabs would like to work on this one if possible. This is what I have found:

1. AccessPass PDA Generation is not Keyed by Validator Identity

Location: smartcontract/programs/doublezero-serviceability/src/pda.rs:65-79

The PDA is derived from client_ip and user_payer only:

pub fn get_accesspass_pda(
    program_id: &Pubkey,
    client_ip: &Ipv4Addr,      // ← Different IPs = Different PDAs
    user_payer: &Pubkey,        // ← Part of seed
) -> (Pubkey, u8) {
    Pubkey::find_program_address(
        &[
            SEED_PREFIX,
            SEED_ACCESS_PASS,
            &client_ip.octets(),    // ← Creates unique PDA per IP
            &user_payer.to_bytes(),
        ],
        program_id,
    )
}

2. No Uniqueness Constraint for Validator IDs

Location: smartcontract/programs/doublezero-serviceability/src/processors/accesspass/set.rs:50-221

When creating an AccessPass, there's no check preventing multiple AccessPasses with:

• Same AccessPassType::SolanaValidator(VAL_ID)
• Same user_payer
• Different client_ip values

Example: A single validator can have multiple valid AccessPass accounts:

AccessPass #1: PDA(0.0.0.0, user_A)       → contains validator_id: VAL123
AccessPass #2: PDA(192.168.1.1, user_A)   → contains validator_id: VAL123  
AccessPass #3: PDA(10.0.0.5, user_A)      → contains validator_id: VAL123

All three are separate on-chain accounts with different addresses, but all reference the same validator.

3. Dynamic IP Mechanism Allows Multiple AccessPasses

Location: smartcontract/programs/doublezero-serviceability/src/processors/user/create.rs:90-126

let (accesspass_pda, _) = get_accesspass_pda(program_id, &value.client_ip, payer_account.key);
let (accesspass_dynamic_pda, _) =
    get_accesspass_pda(program_id, &Ipv4Addr::UNSPECIFIED, payer_account.key);

// Accept EITHER specific IP or dynamic IP AccessPass
assert!(
    accesspass_account.key == &accesspass_pda
        || accesspass_account.key == &accesspass_dynamic_pda,
    "Invalid AccessPass PDA",
);

// Lock dynamic IP on first use (lines 116-118)
if accesspass.is_dynamic() && accesspass.client_ip == Ipv4Addr::UNSPECIFIED {
    accesspass.client_ip = value.client_ip;
}

This design allows:

• A dynamic AccessPass with client_ip = 0.0.0.0 (locked on first connection)
• Specific IP AccessPasses created separately for different IPs

Both can exist simultaneously for the same validator.

4. ListAccessPassCommand Returns ALL PDAs Without Deduplication

Location: smartcontract/sdk/rs/src/commands/accesspass/list.rs:14-27

pub fn execute(
    &self,
    client: &dyn DoubleZeroClient,
) -> eyre::Result<HashMap<Pubkey, AccessPass>> {
    client
        .gets(AccountType::AccessPass)?  // Returns ALL AccessPass PDAs
        .into_iter()
        .map(|(k, v)| match v {
            AccountData::AccessPass(access_pass) => Ok((k, access_pass)),
            _ => Err(DoubleZeroError::InvalidAccountType.into()),
        })
        .collect()
}

This returns every AccessPass PDA without deduplication. If validator VAL123 has 3 AccessPass PDAs, it appears 3 times in the results.

5. Mismatch with Fees List

The fees CSV tracks unique validators by identity/vote key:

"pubkey","votekey","dz_fee_lamports_859",...
"12i8gndWWWMTRzJBFhnYkobNgZB3XMUUJq75HeUrshrk","Cw2b2ng2fa78ndCXHcJMT1pqvdGxUHu5EBEB8KBshrk",9612799,...

Each validator appears once in the fees list.

But ListAccessPassCommand returns all AccessPass PDAs, resulting in:

• Multiple entries per validator (if they have multiple IPs)
• No entries for validators who haven't created an AccessPass yet

Proposed Solutions for deduplication

Option 1:

We could avoid the duplicate validator id's return from ListAccessPass command by adding a filter in the command, the question here what do we filter by (last_access_epoch, connection_count, etc)? We could also do an rpc request to solana to get the latest slot and show the highest entry.

Proposed Solutions for missing entries

I'm not quite sure why there are some validators missing when calling ListAccessPassCommand that do appear in the document. Still trying to check why.

I do have a question, how is the fees_and_payments.csv file generated? where does the list come from?

[bgm-malbeclabs]

thanks! sorry missed this somehow. That'd be great to work on.

I do have a question, how is the fees_and_payments.csv file generated? where does the list come from?

this comes from a bucket. Let me check and get back to you on what the bucket's name is

[martinsander00]

@bgm-malbeclabs thanks! that would be great. Also is the code for generating the entries in the csv private? I would like to understand what exactly is the UFC fetching to then upload to the bucket.