Access controller: short-form package address in move-call-package-address crashes the station at startup

[Zertruermmerdog]

Summary

If an access-controller rule uses the short form of a system package address (e.g. "0x2") in move-call-package-address, the station panics at startup and the container crash-loops. The full 32-byte form works.

Reproduction

config.yaml (generated via generate-sample-config, then rules added):

access-controller:
  access-policy: deny-all
  rules:
    - sender-address: "*"
      move-call-package-address: "0x2"   # <- short form
      transaction-gas-budget: "<=50000000"
      ptb-command-count: "<=1"
      action: allow

Start the station (docker compose). Result:

thread 'main' panicked at /iota/src/command.rs:62:64:
Failed to load config file: access-controller.rules[0].move-call-package-address:
Invalid value was given to the function at line 23 column 34

Expected

Either accept short-form addresses (normalize like the SDKs do) or fail with a clear message such as "package address must be a full 32-byte hex address (got 0x2)". The current panic points at a line/column but not at the actual problem, which makes it easy to lose time on YAML quoting instead of address length.

Workaround

Use the full-length address:

move-call-package-address: "0x0000000000000000000000000000000000000000000000000000000000000002"

Environment

• Image: iotaledger/gas-station:latest, version 0.5.2-8544e55
• Deployment: docker compose from the repo's docker/ directory (testnet config)
• Context: community pilot https://github.com/Zertruermmerdog/iota-gas-station-pilot (live at https://doggy-dex.com)