fix: estimate a request even when the site sends its gas limit (closes #554)

ethers asks the node for a gas estimate only when the request has no gas
limit, and that estimate is the wallet's only check that a transaction
does not revert. Since a site's `gas` became the gas limit, a reverting
request carrying one opened the approval window and could be signed and
mined to fail. Such a request is now estimated first, with the site's
limit and under the same timeout; a failure goes back to the site with no
window, and the site's gas limit is still the one shown and signed. A
limit too low for the call now fails the same way.

Model: opus-5-5

README.md

@@ -347,12 +347,6 @@ are outside `make check`. Neither opens the popup from the toolbar button: both
 load its page in an ordinary tab, so what the toolbar popup itself adds, its
 size and its closing when it loses focus, is covered by neither.
 
-Each run builds its image under a tag of its own, `autistmask-e2e-chrome:` or
-`autistmask-e2e-firefox:` followed by twelve random hex digits, and removes that
-image when it exits, an interrupt included. Two clones can therefore run the
-same suite at once without one build taking the other's image away, and no run
-leaves an image behind.
-
 ### Chrome (`make test-e2e`)
 
 `make test-e2e` builds `dist/chrome/` and drives the **real popup in a real
@@ -2081,7 +2075,11 @@ view would leave a wallet one click from deletion.
   artifact can be compared with it field for field. A nonce the site supplies is
   ignored: the nonce is always the account's next nonce from the node, so a site
   cannot replace one of the user's pending transactions or leave this one stuck
-  behind a gap. A request that cannot be populated — unreachable node, reverting
+  behind a gap. A gas limit the site supplies, as `gas` or `gasLimit`, is the
+  one shown and signed in place of the node's estimate, but the node still
+  estimates the transaction with that limit, as the check that it neither
+  reverts nor runs out of gas; a request that gives both with different values
+  is refused. A request that cannot be populated — unreachable node, reverting
   gas estimate — opens no window and is failed back to the site. Only one
   transaction approval exists at a time: populating fixes the nonce, so a second
   `eth_sendTransaction` arriving while one is unanswered is refused with

script/test-e2e

@@ -22,18 +22,13 @@ set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
-# Each run builds, runs and then removes an image under a tag of its own.
-# Under one tag shared by every run, a second clone's build moves the tag
-# off this run's image, and the image store can then delete that untagged
-# image before or while this run uses it. The tag is random rather than
-# $$ because CI jobs share one docker daemon, but each job's container
-# numbers its processes from scratch.
-IMAGE="$("$SCRIPT_DIR/projectname")-e2e-chrome:$(od -An -N6 -tx1 /dev/urandom | tr -d ' \n')"
+IMAGE="$("$SCRIPT_DIR/projectname")-e2e-chrome"
+
+IIDFILE=""
 
 cleanup() {
-    # No image to remove when the build failed or was interrupted.
-    if docker image inspect "$IMAGE" >/dev/null 2>&1; then
-        docker image rm "$IMAGE" >/dev/null
+    if [ -n "$IIDFILE" ]; then
+        rm -f "$IIDFILE"
     fi
 }
 
@@ -45,15 +40,22 @@ main() {
         exit 1
     fi
 
+    IIDFILE="$(mktemp)"
     trap cleanup EXIT
     trap 'cleanup; exit 130' INT TERM
 
     echo "Building the Chrome e2e image (extension included)..."
     # --no-cache: the image build runs make build and its checks, and a
     # cached layer is a check that did not run.
-    docker build --no-cache -t "$IMAGE" -f tests/e2e/Dockerfile .
+    docker build --no-cache --iidfile "$IIDFILE" -t "$IMAGE" \
+        -f tests/e2e/Dockerfile .
 
     echo "Running e2e suite in the pinned Playwright container..."
+    # The image is run by ID, not by tag: where two clones of this repo run
+    # the suite at once, the other build can move the tag between this
+    # build and this run, and the suite would then silently test the other
+    # checkout.
+    #
     # --ipc=host: Chromium's shared-memory needs more than the default
     #   64MB /dev/shm or renderers crash.
     # HOME=/tmp: the image's root home is not a reliable place for the
@@ -77,7 +79,7 @@ main() {
         -e HOME=/tmp \
         -e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
         -e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
-        "$IMAGE" \
+        "$(cat "$IIDFILE")" \
         node tests/e2e/run.js
 
     # Where chrome.storage.local lives, and what moves it: two unpacked loads
@@ -93,7 +95,7 @@ main() {
     docker run --rm \
         --ipc=host \
         -e HOME=/tmp \
-        "$IMAGE" \
+        "$(cat "$IIDFILE")" \
         node tests/e2e/storagePartition.js
 }
 

script/test-e2e-firefox

@@ -21,13 +21,13 @@ set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
-# A tag of this run's own, as in script/test-e2e, which says why.
-IMAGE="$("$SCRIPT_DIR/projectname")-e2e-firefox:$(od -An -N6 -tx1 /dev/urandom | tr -d ' \n')"
+IMAGE="$("$SCRIPT_DIR/projectname")-e2e-firefox"
+
+IIDFILE=""
 
 cleanup() {
-    # No image to remove when the build failed or was interrupted.
-    if docker image inspect "$IMAGE" >/dev/null 2>&1; then
-        docker image rm "$IMAGE" >/dev/null
+    if [ -n "$IIDFILE" ]; then
+        rm -f "$IIDFILE"
     fi
 }
 
@@ -39,15 +39,22 @@ main() {
         exit 1
     fi
 
+    IIDFILE="$(mktemp)"
     trap cleanup EXIT
     trap 'cleanup; exit 130' INT TERM
 
     echo "Building the pinned Firefox e2e image (extension included)..."
     # --no-cache: the image build runs make build and its checks, and a
     # cached layer is a check that did not run.
-    docker build --no-cache -t "$IMAGE" -f tests/e2e/firefox/Dockerfile .
+    docker build --no-cache --iidfile "$IIDFILE" -t "$IMAGE" \
+        -f tests/e2e/firefox/Dockerfile .
 
     echo "Running the Firefox e2e suite..."
+    # The image is run by ID, not by tag: where two clones of this repo run
+    # the suite at once, the other build can move the tag between this
+    # build and this run, and the suite would then silently test the other
+    # checkout.
+    #
     # --shm-size=1g: Firefox needs more than the default 64MB /dev/shm.
     # --network none: the suite stubs nothing, so this is what keeps the
     #   run offline and deterministic. The extension swallows its own
@@ -65,7 +72,7 @@ main() {
         --shm-size=1g \
         --network none \
         -e HOME=/tmp \
-        "$IMAGE" \
+        "$(cat "$IIDFILE")" \
         node tests/e2e/firefox/run.js dist/firefox
 
     # The install/uninstall/re-install property, against the packaged XPI
@@ -78,7 +85,7 @@ main() {
         --shm-size=1g \
         --network none \
         -e HOME=/tmp \
-        "$IMAGE" \
+        "$(cat "$IIDFILE")" \
         node tests/e2e/firefox/reinstall.js
 }
 

src/shared/approvalTx.js

@@ -1,13 +1,14 @@
 // Preparation of the transaction an approval screen displays.
 //
-// A dApp's eth_sendTransaction normally fixes only `to`, `value` and `data`.
-// The nonce, the gas limit and the fees have to be filled in from the network
-// before anything can be signed, and whoever fills them in decides what the
-// user is shown. That work used to happen in the popup, after the user had
-// already approved: the numbers on the approval screen came from the popup and
-// were compared against nothing, so a compromised popup could display one fee
-// and sign another, and the ceilings in approvalVerify.js were all that stood
-// between the user and a fee that hands the validator the balance.
+// A dApp's eth_sendTransaction normally fixes `to`, `value` and `data`, and
+// sometimes the gas limit. The nonce, the fees, and the gas limit when the
+// site gives none have to be filled in from the network before anything can
+// be signed, and whoever fills them in decides what the user is shown. That
+// work used to happen in the popup, after the user had already approved: the
+// numbers on the approval screen came from the popup and were compared against
+// nothing, so a compromised popup could display one fee and sign another, and
+// the ceilings in approvalVerify.js were all that stood between the user and a
+// fee that hands the validator the balance.
 //
 // So it happens here instead, in the background, before the approval window is
 // opened. The background populates the transaction, shows that object, and
@@ -31,6 +32,7 @@ const {
     VoidSigner,
     accessListify,
     getAddress,
+    getBigInt,
     getBytes,
     hexlify,
     toQuantity,
@@ -47,10 +49,11 @@ const {
 // minutes long, which is not a wait anyone will sit through.
 const POPULATE_TIMEOUT_MS = 20000;
 
-// The request fields taken from the page. Anything else is dropped rather than
-// passed to ethers: the object is page-controlled, and a future ethers that
-// learns to carry a new transaction field must not start picking one up out of
-// it without this module knowing.
+// The request fields taken from the page, plus `gas`, which requestFrom()
+// takes as the gas limit. Anything else is dropped rather than passed to
+// ethers: the object is page-controlled, and a future ethers that learns to
+// carry a new transaction field must not start picking one up out of it
+// without this module knowing.
 //
 // The nonce is not taken from the page; it is always the account's next nonce
 // from the network. A page that chose it could replace one of the user's
@@ -84,6 +87,16 @@ function present(v) {
     return v !== null && v !== undefined && v !== "";
 }
 
+// Whether two quantities from the page are the same number. One that is not a
+// number matches nothing.
+function sameQuantity(a, b) {
+    try {
+        return getBigInt(a) === getBigInt(b);
+    } catch {
+        return false;
+    }
+}
+
 // These strings reach the user through the requesting page, so they are full
 // sentences even when the tail of one came from ethers or from the node.
 function sentence(text) {
@@ -111,6 +124,20 @@ function requestFrom(txParams, from) {
     for (const key of REQUEST_FIELDS) {
         if (present(txParams[key])) request[key] = txParams[key];
     }
+    // JSON-RPC calls the gas limit `gas`, and that is the name sites send.
+    // ethers only reads `gasLimit`: left as `gas` it would be dropped and an
+    // estimate signed in its place.
+    if (present(txParams.gas)) {
+        if (
+            present(request.gasLimit) &&
+            !sameQuantity(request.gasLimit, txParams.gas)
+        ) {
+            throw fail(
+                "The site asked for two different gas limits for this transaction.",
+            );
+        }
+        request.gasLimit = txParams.gas;
+    }
     if (
         present(request.type) &&
         !ALLOWED_TX_TYPES.includes(Number(request.type))
@@ -174,6 +201,7 @@ async function prepareApprovalTx(provider, from, txParams) {
         throw fail("There is no active address to send this transaction from.");
     }
     const request = requestFrom(txParams || {}, from);
+    const signer = new VoidSigner(getAddress(from), provider);
 
     let populated;
     try {
@@ -181,10 +209,20 @@ async function prepareApprovalTx(provider, from, txParams) {
         // nonce, gas, fee and chain id are populated exactly as they were when
         // the popup did this. VoidSigner cannot sign, which is the point: the
         // background prepares, the popup signs.
+        //
+        // ethers asks the node for a gas estimate only when the request has
+        // no gas limit, and that estimate is the only check that the
+        // transaction does not revert. So a request carrying the site's gas
+        // limit is estimated first, with that limit: one that reverts, or
+        // needs more gas than the site gave it, fails here as well. The
+        // site's gas limit is still the one populated.
         populated = await withTimeout(
-            new VoidSigner(getAddress(from), provider).populateTransaction(
-                request,
-            ),
+            (async () => {
+                if (present(request.gasLimit)) {
+                    await signer.estimateGas(request);
+                }
+                return signer.populateTransaction(request);
+            })(),
             POPULATE_TIMEOUT_MS,
             "The transaction could not be prepared: the network did not answer in time.",
         );

tests/approvalTx.test.js

@@ -9,7 +9,7 @@
 // requesting page or the RPC node can say turns it into an approval that
 // should never have been raised.
 
-const { Network, Wallet } = require("ethers");
+const { Network, Transaction, Wallet, toQuantity } = require("ethers");
 const {
     prepareApprovalTx,
     serializeApprovedTx,
@@ -138,6 +138,49 @@ describe("prepareApprovalTx", () => {
         expect(approved.maxFeePerGas).toBe("0x12a05f200");
     });
 
+    // `gas` is the JSON-RPC name for the gas limit and the one sites send.
+    // The node is still asked for its estimate, with the site's gas limit,
+    // because the estimate is the check that the transaction does not revert.
+    // It estimates 21000; the site's 200000 is what is shown and what is
+    // signed.
+    test("uses the gas limit a site sends as gas", async () => {
+        const estimateGas = jest.fn(async () => 21000n);
+        const approved = await prepareApprovalTx(
+            providerWith({ estimateGas }),
+            signer.address,
+            { ...TX_PARAMS, gas: "0x30d40" },
+        );
+        expect(estimateGas).toHaveBeenCalledWith(
+            expect.objectContaining({ gasLimit: 200000n }),
+        );
+        expect(approved.gasLimit).toBe("0x30d40");
+        const signed = Transaction.from(
+            await signer.signTransaction({ ...approved }),
+        );
+        expect(signed.gasLimit).toBe(200000n);
+    });
+
+    test("accepts gas and gasLimit that name the same number", async () => {
+        const approved = await prepareApprovalTx(
+            providerWith(),
+            signer.address,
+            { ...TX_PARAMS, gas: "0x30d40", gasLimit: 200000 },
+        );
+        expect(approved.gasLimit).toBe("0x30d40");
+    });
+
+    test("refuses gas and gasLimit that disagree", async () => {
+        await expect(
+            prepareApprovalTx(providerWith(), signer.address, {
+                ...TX_PARAMS,
+                gas: "0x30d40",
+                gasLimit: "0x5208",
+            }),
+        ).rejects.toThrow(
+            "The site asked for two different gas limits for this transaction.",
+        );
+    });
+
     test("carries an access list the request asked for", async () => {
         const approved = await prepareApprovalTx(
             providerWith(),
@@ -212,6 +255,15 @@ describe("prepareApprovalTx", () => {
         ).rejects.toThrow(/gas limit no network this wallet supports/);
     });
 
+    test("refuses a gas limit the site sent above the ceiling", async () => {
+        await expect(
+            prepareApprovalTx(providerWith(), signer.address, {
+                ...TX_PARAMS,
+                gas: toQuantity(MAX_GAS_LIMIT + 1n),
+            }),
+        ).rejects.toThrow(/gas limit no network this wallet supports/);
+    });
+
     // The combined bound at population: a gas limit and a fee that are each
     // under their own ceiling but multiply to thousands of ETH is refused
     // before the approval window opens, so the user is never shown a
@@ -251,6 +303,22 @@ describe("prepareApprovalTx", () => {
         expect(thrown.message).toMatch(/^[A-Z].*\.$/);
     });
 
+    test("fails back a reverting request that sends its own gas limit", async () => {
+        const reverting = providerWith({
+            estimateGas: async () => {
+                throw new Error("execution reverted: ERC20: transfer amount");
+            },
+        });
+        await expect(
+            prepareApprovalTx(reverting, signer.address, {
+                ...TX_PARAMS,
+                gas: "0x30d40",
+            }),
+        ).rejects.toThrow(
+            /^The transaction could not be prepared: execution reverted/,
+        );
+    });
+
     // Without a bound, an unreachable node leaves the page's promise pending
     // with nothing on screen to explain it.
     test("gives up on a node that never answers", async () => {

tests/approvalVerify.test.js

@@ -58,7 +58,6 @@ const TX_PARAMS = {
     to: RECIPIENT,
     value: "0x2386f26fc10000",
     data: "0xdeadbeef",
-    gas: "0x5208",
 };
 
 // The values populateTransaction() fills in when the dApp fixed none of them.