Skip to content

fix(revm): validate fee token registration in simulation paths - #182

Open
panos-xyz wants to merge 2 commits into
mainfrom
fix/estimate-gas-unregistered-token
Open

fix(revm): validate fee token registration in simulation paths#182
panos-xyz wants to merge 2 commits into
mainfrom
fix/estimate-gas-unregistered-token

Conversation

@panos-xyz

@panos-xyz panos-xyz commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Closes #181

Summary

Fixes an issue where eth_estimateGas (and eth_call) incorrectly returned 0x5208 (21000) for transactions specifying an unregistered or inactive feeTokenID (e.g. 65535) instead of rejecting them.

Root Cause

In crates/revm/src/handler.rs, validate_and_deduct_token_fee handles simulation paths where cfg.is_fee_charge_disabled() is true. It previously short-circuited at the entry of the function and returned Ok(()), skipping the L2 Token Registry checks (TokenFeeInfo::load_for_caller and token_fee_info.is_active). Upstream reth's is_basic_transfer optimization then executed a trial with MIN_TRANSACTION_GAS (21000), which succeeded and returned 0x5208.

Changes

  1. Move L2 Token Registry existence and active checks in validate_and_deduct_token_fee before the is_fee_charge_disabled() short-circuit.
  2. In simulation paths, after validating that the token is registered and active, nonce is bumped for calls and execution returns early without deducting token fees.
  3. Added unit tests in morph-revm:
    • validate_and_deduct_token_fee_rejects_unregistered_token_in_simulation
    • validate_and_deduct_token_fee_rejects_inactive_token_in_simulation
  4. Added end-to-end RPC test in crates/node/tests/it/rpc.rs:
    • estimate_gas_rejects_unregistered_fee_token

Summary by CodeRabbit

  • Bug Fixes

    • Gas estimation and transaction simulation now reject unregistered or inactive fee tokens with the appropriate registration error.
    • Both gas estimation and contract calls validate fee-token registration before proceeding.
    • Simulations continue to skip fee deduction and nonce updates while avoiding unnecessary fee-token contract lookups.
  • Tests

    • Added coverage for invalid fee-token requests across gas estimation and contract-call simulations.

Simulation paths (eth_call / eth_estimateGas) with is_fee_charge_disabled()
previously short-circuited validate_and_deduct_token_fee before checking
whether the specified fee_token_id was registered and active in the L2 Token
Registry. This caused eth_estimateGas to incorrectly return 21000 for
unregistered fee tokens like 65535 instead of rejecting the transaction.

Move the token registration and active checks prior to the simulation
short-circuit so that invalid tokens are rejected consistently across both
execution and simulation paths.
@panos-xyz panos-xyz self-assigned this Sep 4, 2026
@coderabbitai

coderabbitai Bot commented Sep 4, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 9248387f-357f-462a-90f6-3e360552fde2

📥 Commits

Reviewing files that changed from the base of the PR and between a5cc281 and 0a35f7b.

📒 Files selected for processing (3)
  • crates/node/tests/it/rpc.rs
  • crates/revm/src/handler.rs
  • crates/revm/src/token_fee.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

Simulation paths now validate that fee tokens are registered and active before skipping fee deduction. Unit and RPC integration tests verify rejection of unregistered and inactive tokens.

Changes

Fee token validation

Layer / File(s) Summary
Simulation token validation
crates/revm/src/handler.rs
The fee-charge-disabled return now occurs after token registration and activity checks.
Invalid token test coverage
crates/revm/src/handler.rs, crates/node/tests/it/rpc.rs
Tests verify rejection of unregistered token 65535 and inactive token 42, including through eth_estimateGas.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 0a35f

Simulation RPCs now reject unregistered or inactive fee-token IDs before skipping fee deduction, while preserving balance-free simulation behavior for valid tokens. The implementation and coverage support merge readiness.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 59.09% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 22 functions across 3 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: validating fee-token registration during simulation paths.
Linked Issues check ✅ Passed The PR satisfies issue #181. Simulation paths validate that fee tokens are registered and active before the simulation short-circuit. Tests cover unregistered and inactive tokens for eth_call and eth_…
Out of Scope Changes check ✅ Passed The changes remain within scope. The token-loading refactor, validation ordering, access-tracking helpers, and tests directly support simulation validation and avoiding fee-token balance queries.
  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/estimate-gas-unregistered-token

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

…ookup

Decouple fee-token registry metadata loading into TokenRegistryEntry so
simulation paths (eth_call / eth_estimateGas) only validate token existence
and active status without reading the caller's token balance or invoking
balanceOf. Move the caller balance lookup and fee deduction to non-simulation
execution only, and verify that simulation paths never touch fee-token contract
storage.

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Claude Code Review

Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.

Tip: disable this comment in your organization's Code Review settings.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(revm): eth_estimateGas incorrectly succeeds for unregistered feeTokenID

1 participant