Summary

Entrypoint scripts use set -eu and then validate vars with -z "$VAR".
With set -u, an unset var is expanded before the [[ ... ]] condition can be evaluated, so validation logic can be bypassed by a shell error.

Example

In ./op-node-entrypoint:

if [[ -z "$OP_NODE_NETWORK" && -z "$OP_NODE_ROLLUP_CONFIG" ]]; then

This check does not behave as intended under set -u:

If OP_NODE_NETWORK is unset and OP_NODE_ROLLUP_CONFIG is set and non-empty
the script still crashes on unbound OP_NODE_NETWORK expansion, instead of evaluating the condition correctly.

So the intended logic (which I interpret as "fail only if both are missing") is not reliably enforced.

Affected files

./op-node-entrypoint

if [[ -z "$OP_NODE_NETWORK" && -z "$OP_NODE_ROLLUP_CONFIG" ]]; then

nethermind/nethermind-entrypoint

if [[ -z "$OP_NODE_NETWORK" ]]; then
if [[ -z "$OP_NODE_L2_ENGINE_AUTH_RAW" ]]; then

Proposed fix

Use unset-safe expansions in checks, e.g. ${OP_NODE_NETWORK:-} / ${OP_NODE_ROLLUP_CONFIG:-}, while keeping set -u.
I can create a PR for this if needed.
Thank you!