@@ -1167,6 +1167,8 @@ State overrides are bounded in size. `max_state_override_accounts` (`evm.max_sta
 
 **Sei-specific behavior:** Available over HTTP only, because the debug namespace is not registered on the WebSocket server. Supports geth tracers: callTracer, prestateTracer, flatCallTracer, and the struct (opcode) logger. TraceBaker pre-bakes and caches the results of callTracer, prestateTracer, and flatCallTracer. Requires trace-enabled or archive state for the target height.
 
+**Tracer gating.** Caller-supplied `TraceConfig.Tracer` names are gated by `[evm]` config in `app.toml` (#3618). Only native tracer names listed in `trace_allowed_tracers` (`evm.trace_allowed_tracers`, default `["callTracer", "prestateTracer", "flatCallTracer", "4byteTracer", "noopTracer", "muxTracer"]`) may be requested; a name that is not in the list is rejected. Request-supplied JavaScript tracer source is rejected unless `trace_allow_js_tracers` (`evm.trace_allow_js_tracers`, default `false`) is enabled, and enabling it does not widen the native allowlist. When `muxTracer` is requested, its nested tracer names are validated recursively (bounded depth of 16). Omitting `tracer` uses the default struct logger, which is always available. This gating applies consistently across `debug_traceTransaction`, `debug_traceCall`, `debug_traceBlockByNumber`, `debug_traceBlockByHash`, and `debug_traceTransactionProfile`.
+
 The max block lookback guard (`max_trace_lookback_blocks`) applies. If a request's target block is older than the configured lookback, the request is rejected with an error of the form `block number X is beyond max lookback of Y`. Each such request increments the `evmrpc_historical_debug_trace_attempts_total` metric. This guard applies consistently across all `debug_trace*` endpoints.
 
 **Parameters:**
 
@@ -447,6 +447,26 @@ These `[evm]` fields in `app.toml` control trace baking:
 
 
 
+## Tracer allowlist
+
+Caller-supplied `tracer` values on the `debug_trace*` endpoints are gated by `[evm]` config in `app.toml`. By default, only a fixed set of native geth tracers may be requested, and request-supplied JavaScript tracer source is rejected. This deviates from upstream geth, which accepts JavaScript tracers by default. The gate applies to `debug_traceCall`, `debug_traceTransaction`, `debug_traceBlockByNumber`/`debug_traceBlockByHash`, and `debug_traceTransactionProfile`. When no `tracer` is supplied, the default struct logger remains available.
+
+| Field | Default | Description |
+| ----- | ------- | ----------- |
+| `trace_allowed_tracers` | `["callTracer", "prestateTracer", "flatCallTracer", "4byteTracer", "noopTracer", "muxTracer"]` | Native debug tracer names that callers may request via `TraceConfig.Tracer`. Validated native-only at startup — a non-native or misspelled name fails startup. Set to `[]` to disable all named tracers. Request-supplied JavaScript tracer source can never be enabled through this list. |
+| `trace_allow_js_tracers` | `false` | Opts in to request-supplied JavaScript tracer source in `TraceConfig.Tracer`. This executes untrusted code in-process; keep disabled on public/default RPC nodes. Enabling it does **not** widen `trace_allowed_tracers`: native tracer names must still be listed there to be usable. |
+
+Behavior notes:
+
+- A tracer name that is not listed in `trace_allowed_tracers` is rejected, unless it is JavaScript source and `trace_allow_js_tracers` is enabled.
+- JavaScript tracer source is rejected unless `trace_allow_js_tracers` is set to `true`.
+- When `muxTracer` is requested, its nested tracer names are validated recursively against the same allowlist, with a bounded nesting depth of 16.
+- `trace_bake_tracers` names are held to the same native-only rule and validated at startup, so a non-native or misspelled baked tracer fails startup instead of being evaluated as JavaScript source on every block.
+
+<Note>The `trace_bake_tracers` note above that eligible values are standard named tracers is subsumed by this native-only startup validation: entries must be native tracer names such as `callTracer`, `prestateTracer`, or `flatCallTracer`.</Note>
+
+
+
 ## Struct-logger output cap
 
 The default `debug_trace*` endpoints (`debug_traceCall`, `debug_traceTransaction`, and `debug_traceBlockByNumber`/`debug_traceBlockByHash`) use the built-in struct logger when no custom tracer is supplied. Traces that read many distinct storage slots can retain large amounts of output, so the node bounds the retained struct-logger output per traced transaction.
 
@@ -5,6 +5,16 @@ keywords: ['javascript tracers', 'custom tracers', 'evm debugging', 'tracer opti
 ---
 JavaScript tracers let you create custom debugging logic to analyze EVM transactions on Sei. You can use them for more complex analysis than the built-in tracers support.
 
+
+
+<Warning>
+  **JavaScript tracers are disabled by default on Sei.** Unlike upstream geth, Sei does not accept request-supplied JavaScript tracer source on `debug_trace*` endpoints unless a node operator explicitly opts in. To enable them, set `trace_allow_js_tracers = true` under the `[evm]` section of `app.toml`.
+
+  This is a deliberate security hardening: a JavaScript tracer executes caller-supplied code in-process on the node, so it should only be enabled on trusted or private RPC nodes — never on public/default RPC infrastructure. Enabling `trace_allow_js_tracers` does **not** widen the native tracer allowlist (`trace_allowed_tracers`); the two settings are independent.
+
+  If `trace_allow_js_tracers` is `false` (the default), any request supplying JavaScript tracer source to `debug_traceCall`, `debug_traceTransaction`, `debug_traceBlockBy*`, or `debug_traceTransactionProfile` is rejected before any tracer is constructed. If you only need standard analysis, prefer the built-in native tracers (`callTracer`, `prestateTracer`, `flatCallTracer`, `4byteTracer`, `noopTracer`, `muxTracer`), which require no opt-in.
+</Warning>
+
 ## Interface overview
 
 Every JavaScript tracer has this structure:
 
@@ -142,6 +142,35 @@ This guide covers common issues with EVM transaction tracing on Sei and gives pr
 
 ### 4. Network and connection issues
 
+
+
+#### Tracer not allowed / JavaScript tracers disabled
+
+**Error**: `debug tracer "..." is not allowed; JavaScript tracers are disabled and only native tracers listed in evm.trace_allowed_tracers may be used`
+
+**Cause**: Sei gates which tracers callers may request through `TraceConfig.Tracer` on the `debug_traceCall`, `debug_traceTransaction`, `debug_traceBlockByNumber`, `debug_traceBlockByHash`, and `debug_traceTransactionProfile` endpoints. By default only the native tracers listed in the `[evm]` `trace_allowed_tracers` config are accepted, and request-supplied JavaScript tracer source is rejected. This deviates from upstream geth, which accepts JavaScript tracers by default.
+
+**Solutions**:
+
+- Use one of the allowlisted native tracers. The shipped default allowlist is:
+
+  ```toml
+  [evm]
+  trace_allowed_tracers = ["callTracer", "prestateTracer", "flatCallTracer", "4byteTracer", "noopTracer", "muxTracer"]
+  ```
+
+- If you are an operator and need to permit a native tracer that is not listed, add its name to `trace_allowed_tracers`. Only native geth tracer names are accepted here; a typo or JavaScript source causes the node to fail at startup. Setting the list to `[]` disables all named tracers.
+- To allow request-supplied JavaScript tracer source, an operator must explicitly opt in:
+
+  ```toml
+  [evm]
+  trace_allow_js_tracers = true
+  ```
+
+  This executes untrusted code in-process and should be kept disabled on public/default RPC nodes. Enabling it does **not** widen `trace_allowed_tracers`: native tracer names must still be listed there to be usable.
+
+<Note>When using `muxTracer`, the nested tracer names in `TracerConfig` are validated recursively against the same allowlist, with a bounded nesting depth of 16. A nested name that is not allowlisted produces a `nested debug tracer "..." is not allowed` error. Also note that `trace_bake_tracers` names are validated as native-only at startup, so a non-native or mistyped name there will fail node startup rather than being evaluated as JavaScript.</Note>
+
 **Error**: `connection refused` or `network timeout`
 
 **Solutions**: