fix(kmsServer): address PR #111 review — L1 block client + address validation

- resolveLatestRelease fetched the release block timestamp via cc.ethclient, but
  on baseContractCaller that's the L2/Base client while the release block number
  comes from the AppController on L1 — L1/L2 heights aren't interchangeable, so
  the timestamp would be wrong or the lookup would fail. Add
  SetAppControllerBlockClient(*ethclient.Client) (concrete, not on the interface)
  to supply the L1 client; resolveLatestRelease uses it for HeaderByNumber and
  falls back to cc.ethclient for single-chain setups. main.go wires l1Client.
- main.go: validate app-controller-address with common.IsHexAddress before
  HexToAddress (which never errors and would silently use a wrong/zero address).

Author: crypt0fairy

cmd/kmsServer/main.go

@@ -539,6 +539,9 @@ func runKMSServer(c *cli.Context) error {
 	// optional config: if unset, /secrets release lookups stay disabled (e.g. for a
 	// signing-only deployment).
 	if appControllerAddr := c.String("app-controller-address"); appControllerAddr != "" {
+		if !common.IsHexAddress(appControllerAddr) {
+			l.Sugar().Fatalw("Invalid app-controller-address", "value", appControllerAddr)
+		}
 		addr := common.HexToAddress(appControllerAddr)
 		appCtrl, acErr := caller.NewAppControllerAdapter(addr, l1Client)
 		if acErr != nil {
@@ -547,6 +550,10 @@ func runKMSServer(c *cli.Context) error {
 		if acErr := baseContractCaller.SetAppController(appCtrl); acErr != nil {
 			l.Sugar().Fatalw("Failed to set AppController", "error", acErr)
 		}
+		// The AppController is on L1, so release block numbers are L1 heights; give
+		// the (L2/Base-backed) baseContractCaller the L1 client for the release
+		// block-timestamp lookup in resolveLatestRelease.
+		baseContractCaller.SetAppControllerBlockClient(l1Client)
 		l.Sugar().Infow("AppController wired for /secrets release resolution", "address", addr.Hex())
 	} else {
 		l.Sugar().Warn("KMS_APP_CONTROLLER_ADDRESS not set — /secrets on-chain release resolution disabled")

pkg/contractCaller/caller/caller.go

@@ -36,6 +36,13 @@ type ContractCaller struct {
 	releaseManager       *IReleaseManager.IReleaseManager
 	permissionController *IPermissionController.IPermissionController
 	appController        AppControllerInterface // AppController for EigenCompute apps (optional, nil until SetAppController)
+	// appControllerClient is the L1 backend the AppController is bound to. The
+	// AppController lives on L1, so its release block numbers are L1 heights — but
+	// this ContractCaller's `ethclient` may be the L2/Base client (the /secrets
+	// release lookup runs on baseContractCaller). When set, resolveLatestRelease
+	// uses this client (not `ethclient`) to fetch the release block's timestamp so
+	// it reads the correct chain. nil => fall back to `ethclient` (single-chain).
+	appControllerClient *ethclient.Client
 
 	signer transactionSigner.ITransactionSigner
 }

pkg/contractCaller/caller/eigenCompute.go

@@ -11,6 +11,7 @@ import (
 	"github.com/ethereum/go-ethereum/accounts/abi/bind"
 	"github.com/ethereum/go-ethereum/common"
 	ethTypes "github.com/ethereum/go-ethereum/core/types"
+	"github.com/ethereum/go-ethereum/ethclient"
 )
 
 // Env represents environment variables as a map
@@ -86,6 +87,16 @@ func (cc *ContractCaller) SetAppController(appController AppControllerInterface)
 	return nil
 }
 
+// SetAppControllerBlockClient sets the L1 backend used to resolve the AppController's
+// release block timestamps. Call this alongside SetAppController when this
+// ContractCaller's primary `ethclient` is on a different chain than the AppController
+// (e.g. baseContractCaller is L2/Base but the AppController is on L1). Passing nil is a
+// no-op (resolveLatestRelease then falls back to `ethclient`). Not part of
+// IContractCaller — it's only relevant to the concrete ContractCaller wiring.
+func (cc *ContractCaller) SetAppControllerBlockClient(client *ethclient.Client) {
+	cc.appControllerClient = client
+}
+
 // getAppController returns the AppController instance
 func (cc *ContractCaller) getAppController() (AppControllerInterface, error) {
 	if cc.appController == nil {
@@ -265,8 +276,16 @@ func (cc *ContractCaller) GetLatestReleaseAsRelease(ctx context.Context, appID s
 		return nil, err
 	}
 
-	// Fetch the block header to get the authoritative release timestamp
-	header, err := cc.ethclient.HeaderByNumber(ctx, new(big.Int).SetUint64(r.BlockNumber))
+	// Fetch the block header to get the authoritative release timestamp. r.BlockNumber
+	// is an AppController (L1) block height, so read it from the L1 client when one was
+	// configured via SetAppControllerBlockClient — cc.ethclient may be the L2/Base
+	// client (the /secrets release lookup runs on baseContractCaller), and L1/L2 block
+	// numbers are not interchangeable. Fall back to cc.ethclient for single-chain setups.
+	blockClient := cc.ethclient
+	if cc.appControllerClient != nil {
+		blockClient = cc.appControllerClient
+	}
+	header, err := blockClient.HeaderByNumber(ctx, new(big.Int).SetUint64(r.BlockNumber))
 	if err != nil {
 		return nil, fmt.Errorf("failed to fetch block header for timestamp: %w", err)
 	}