chore: merge #353

aljo242 · 2025-07-24T19:58:45Z

Description

Closes: #XXXX

Author Checklist

All items are required. Please add a note to the item if the item is not applicable and
please add links to any relevant follow up issues.

I have...

tackled an existing issue or discussed with a team member
left instructions on how to review the changes
targeted the main branch

Reviewers Checklist

All items are required.
Please add a note if the item is not applicable
and please add your handle next to the items reviewed
if you only reviewed selected items.

I have...

added a relevant changelog entry to the Unreleased section in CHANGELOG.md
confirmed all author checklist items have been addressed
confirmed that this PR does not change production code
reviewed content
tested instructions (if applicable)
confirmed all CI checks have passed

sherlock-audit/2025-05-interchain-labs-evm-update-may-19th#550

Fixed based on standard OZ convention: "the return value is optional (in rare cases), but if data is returned, it must not be false". Requiring the Transfer event to be emitted in these cases, since we can scan and check for that.

- remove estimation on internal calls - use max limit on internal calls - set refund quotient to 1 on internal calls - consume gas on CallEVMWithData - consume full gas on CallEVMWithData failures to match EVM standard

* add to invalid block params case * add test for filter error case * lint fix

* edit configs * lint-fix * fix * nl * to * to * cache * fix * fix * stupid * attempt fix flake test --------- Co-authored-by: Tyler <[email protected]>

) This reverts commit 6ddc28d. Co-authored-by: Vlad J <[email protected]>

chore: merge backport pr #62

…dit/all

aljo242 · 2025-07-24T20:01:38Z

contracts/solidity/precompiles/erc20/testdata/ERC20TestCaller.sol


 /// @title ERC20TestCaller
-/// @author Evmos Core Team
+/// @author Erric


rpc/backend/chain_info.go

+		if err != nil {
+			return nil, err
+		}
+		blockEnd = int64(blockNumber) //#nosec G115 -- checked for int overflow already


To fix the issue, we need to add an explicit bounds check before converting the uint64 value to int64. Specifically:

Ensure that the value is less than or equal to math.MaxInt64 (2^63 - 1) before performing the conversion.

If the value exceeds this limit, return an appropriate error or handle the case gracefully.

The changes will be made in the rpc/backend/chain_info.go file where the conversion occurs. Additionally, we will ensure that the strconv.ParseUint usage in rpc/backend/blocks.go is consistent with this fix.

rpc/namespaces/ethereum/debug/api.go

@@ -5,7 +5,7 @@
 	"errors"
 	"io"
 	"os"
-	"runtime" // #nosec G702
+	"runtime"


tests/integration/x/erc20/test_dynamic_precompiles.go

@@ -22,6 +26,7 @@
 		nonce         uint64 = 10
 		balance              = uint256.NewInt(100)
 		emptyCodeHash        = crypto.Keccak256(nil)
+		totalBalance         = math.NewInt(100)


To fix the issue, the unused variable totalBalance should be removed from the code. This involves deleting its definition on line 29. No additional changes are required, as the variable is not referenced elsewhere in the provided snippet.

evmd/cmd/evmd/config/config.go

aljo242 · 2025-07-24T20:03:39Z

contracts/solidity/WATOM.sol

+        (bool success, ) = payable(msg.sender).call{value: amount}("");
+        require(success, "failed to withdraw to sender");


Is this correct?

looks like it: https://github.com/cosmos/evm-internal/pull/35/files

aljo242 · 2025-07-24T20:05:32Z

evmd/tests/ibc/ics20_precompile_transfer_test.go

@@ -301,6 +301,7 @@ func (suite *ICS20TransferTestSuite) TestHandleMsgTransfer() {
 			suite.Require().ErrorContains(err, vm.ErrExecutionReverted.Error())
 			revertErr := chainutil.DecodeRevertReason(*evmRes)
 			suite.Require().Contains(revertErr.Error(), "invalid denom trace hash")
+			ctxB.GasMeter().RefundGas(ctxB.GasMeter().Limit(), "refund after error")


is this correct?

aljo242 · 2025-07-24T20:05:49Z

evmd/tests/ibc/v2_ics20_precompile_transfer_test.go

@@ -307,6 +307,7 @@ func (suite *ICS20TransferV2TestSuite) TestHandleMsgTransfer() {
 			suite.Require().ErrorContains(err, vm.ErrExecutionReverted.Error())
 			revertErr := chainutil.DecodeRevertReason(*evmRes)
 			suite.Require().Contains(revertErr.Error(), "invalid denom trace hash")
+			ctxB.GasMeter().RefundGas(ctxB.GasMeter().Limit(), "refund after error")


is this correct?

ibc/utils.go

rpc/backend/blocks.go

aljo242 · 2025-07-24T20:12:11Z

rpc/backend/chain_info.go

-					return
-				}
+	// fetch block
+	for blockID := blockStart; blockID <= blockEnd; blockID++ {


unsure which one to accept here

aljo242 · 2025-07-24T20:13:00Z

rpc/backend/tx_info.go

@@ -147,13 +153,13 @@ func (b *Backend) GetTransactionReceipt(hash common.Hash) (map[string]interface{
 	res, err := b.GetTxByEthHash(hash)
 	if err != nil {
 		b.Logger.Debug("tx not found", "hash", hexTx, "error", err.Error())
-		return nil, nil
+		return nil, err


@vladjdk @technicallyty should we be returning errors in this file or should we just exit?

returning errors is fine

@vladjdk Isn't this the one that was supposed to have been reverted as it was breaking things?'

we should not return an error when that call fails. this breaks compatibility with how Geth handles this case. https://github.com/ethereum/go-ethereum/blob/615d29f7c2d5aed84cf8c7ec952d9f9a9f706e4b/internal/ethapi/api.go#L1376-L1384

changing it to return an error also breaks solidity tests.

aljo242 · 2025-07-24T20:15:49Z

rpc/namespaces/ethereum/eth/filters/filters.go

-	from, err := resolveSpecial(f.criteria.FromBlock.Int64())
-	if err != nil {
-		return nil, err
+	head := header.Number.Int64()


is this the right diff to accept?

seems need resolveSpecial?

aljo242 · 2025-07-24T20:18:28Z

server/config/config.go

+	// DefaultBatchRequestLimit is the default maximum batch request limit.
+	DefaultBatchRequestLimit = 1000
+
+	// DefaultBatchResponseMaxSize is the default maximum batch response size.
+	DefaultBatchResponseMaxSize = 25 * 1000 * 1000


do these need to be configurable via the toml template?

yes, it's better to be configurable in toml or via flag

technicallyty · 2025-07-25T19:25:20Z

x/vm/keeper/grpc_query.go

+	if len(req.Predecessors) > maxTracePredecessors {
+		return nil, status.Errorf(codes.InvalidArgument, "too many predecessors, got %d: limit %d", len(req.Predecessors), maxTracePredecessors)
+	}
+


this is not the right fix, the final result was limiting gas. see here: https://github.com/cosmos/evm-internal/pull/43

vladjdk and others added 30 commits June 2, 2025 15:21

Fix downcasts and use string

f776785

sherlock-audit/2025-05-interchain-labs-evm-update-may-19th#550

Error out if overrides provided in call query

9d88786

add address field to submitEvidence

77cc6a8

Fix empty erc20 return values

03e3572

Fixed based on standard OZ convention: "the return value is optional (in rare cases), but if data is returned, it must not be false". Requiring the Transfer event to be emitted in these cases, since we can scan and check for that.

fix unmarshalling of uint64 for "0x..." strings

fb46bea

lint fix

85c5abf

Merge branch 'audit/584' into audit/586

fb1ecc1

gas limits on evm calls

96126ed

Consume gas when EVM is called internally

72b035b

gas optimizations

d1a82a7

- remove estimation on internal calls - use max limit on internal calls - set refund quotient to 1 on internal calls - consume gas on CallEVMWithData - consume full gas on CallEVMWithData failures to match EVM standard

revert gas cap changes (out of scope)

6ed2a4b

fix error

9ec3aac

lints

2c46a2a

lints

053ec9d

rm (#16)

990189b

Add support for tracing node

df85a1f

Add flag

4815a99

Set traces in the config

7ad1902

fix(rpc): return error when block params are invalid (#25)

6ddc28d

* add to invalid block params case * add test for filter error case * lint fix

chore: fix lint (#31)

ed7916c

* edit configs * lint-fix * fix * nl * to * to * cache * fix * fix * stupid * attempt fix flake test --------- Co-authored-by: Tyler <[email protected]>

Revert "fix(rpc): return error when block params are invalid (#25)" (#33

79d4d5b

) This reverts commit 6ddc28d. Co-authored-by: Vlad J <[email protected]>

wip: use spendable balances

f77468d

can transfer tests

5e566a1

test gas ante

39759f8

test deleting accounts

d19e3a5

rename types

4263c52

refactor

aa5435b

clean

dfd69ee

add-limit

d66898f

add-test

66aa4e3

Eric-Warehime and others added 19 commits July 14, 2025 09:53

Merge branch 'audit/all' into merge-backport-pr-62

5b353e2

Merge pull request #66 from cosmos/merge-backport-pr-62

f8ae0f0

chore: merge backport pr #62

add comment

1043830

Speed up solidity test chain blocks

e46988c

Add timeout

58b0a82

Merge remote-tracking branch 'origin/audit/550' into audit/all

4c90dd2

Merge remote-tracking branch 'origin/audit/609' into audit/all

3d52ad8

Merge remote-tracking branch 'origin/audit/545' into audit/all

b9c1e67

Fix lints, mockgen

8a3a66c

Merge remote-tracking branch 'origin/audit/548' into audit/all

c832b1c

Merge remote-tracking branch 'origin/audit/552' into audit/all

36b6f4a

Merge remote-tracking branch 'origin/audit/586+588' into audit/all

dec2611

Merge remote-tracking branch 'origin/audit/576' into audit/all

ed37ee8

Merge remote-tracking branch 'origin/543-dos' into audit/all

e56f0d5

fix copy typo

14b0dab

Merge remote-tracking branch 'origin/582-dynamic-precompiles' into au…

6da42bf

…dit/all

Update bloom from post tx logs

cb6564d

Fix lint

c4e5233

Merge branch 'main' into merch3

9bed699

aljo242 changed the title ~~Merch3~~ chore: merge Jul 24, 2025

aljo242 commented Jul 24, 2025

View reviewed changes

github-advanced-security bot found potential problems Jul 24, 2025

View reviewed changes

aljo242 commented Jul 24, 2025

View reviewed changes

Merge branch 'main' into merch3

0ad4df7

aljo242 requested review from Eric-Warehime, technicallyty, vladjdk and almk-dev July 24, 2025 20:25

fix conflicts

f26cbfa

technicallyty reviewed Jul 25, 2025

View reviewed changes

@@ -158,3 +158,6 @@
             		}
-            		blockEnd = int64(blockNumber) //#nosec G115 -- checked for int overflow already
+            		if blockNumber > math.MaxInt64 {
+            			return nil, fmt.Errorf("block number %d exceeds maximum value for int64", blockNumber)
+            		}
+            		blockEnd = int64(blockNumber)
             	}

@@ -46,2 +46,8 @@
             	}
+            	if height > math.MaxInt64 {
+            		return 0, fmt.Errorf("block height %d exceeds maximum value for int64", height)
+            	}
+            	if err != nil {
+            		return 0, fmt.Errorf("failed to parse block height: %w", err)
+            	}

		(bool success, ) = payable(msg.sender).call{value: amount}("");
		require(success, "failed to withdraw to sender");

chore: merge #353

Are you sure you want to change the base?

chore: merge #353

Uh oh!

Conversation

aljo242 commented Jul 24, 2025

Description

Author Checklist

Reviewers Checklist

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Check failure

Uh oh!

Copilot Autofix

Check notice

Check warning

Copilot Autofix

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

almk-dev Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

technicallyty Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

technicallyty Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

almk-dev Jul 25, 2025 •

edited

Loading

technicallyty Jul 25, 2025 •

edited

Loading

technicallyty Jul 25, 2025 •

edited

Loading