clawbot
33fa25adca
The two per-field ceilings in approvalVerify.js were checked independently, but the fee a validator is paid is gasLimit × fee per gas: a gas limit and a fee each under their own ceiling still multiply to thousands of ETH, which a gas-consuming contract really collects. assertWithinCeilings now also bounds that product against MAX_TOTAL_FEE (1 ETH), so both callers — populating the dApp transaction and verifying the signed artifact — refuse it with a full sentence naming the fee and the limit. The wallet's own send in confirmTx.js pinned no fee fields, so ethers filled them from the node with no bound; it now populates the transaction and runs the same check before signing, showing the same error in the confirmation screen's reserved errors box so nothing on screen moves. Model: opus-4-8
101 lines
3.9 KiB
JavaScript
101 lines
3.9 KiB
JavaScript
// The wallet's OWN send path enforces the same combined fee bound the dApp
|
|
// path does (https://git.eeqj.de/sneak/AutistMask/issues/399).
|
|
//
|
|
// The send in src/popup/views/confirmTx.js pins no fee fields, so ethers fills
|
|
// maxFeePerGas and the gas limit from whatever the configured RPC node
|
|
// answers. Nothing bounded that: a hostile node could report a fee whose
|
|
// product with the gas limit is thousands of ETH, and it would be both
|
|
// displayed and signed. populateVerifyAndSend() populates the transaction and
|
|
// runs assertWithinCeilings() on the populated fees before signing, so an
|
|
// over-bound send is refused before anything is broadcast.
|
|
//
|
|
// The check is driven here with a fake connected signer rather than a real
|
|
// one: populateTransaction() returns the fees the node would have produced,
|
|
// and sendTransaction() records whether the send actually happened. The real
|
|
// DOM path around it — reading the fee error into the reserved errors box — is
|
|
// covered by the Chrome e2e suite.
|
|
|
|
globalThis.chrome = {
|
|
storage: { local: { get: async () => ({}), set: async () => {} } },
|
|
};
|
|
|
|
global.fetch = jest.fn(() => {
|
|
throw new Error("tests must not perform network requests");
|
|
});
|
|
|
|
const { populateVerifyAndSend } = require("../src/popup/views/confirmTx");
|
|
const {
|
|
MAX_FEE_PER_GAS,
|
|
MAX_TOTAL_FEE,
|
|
} = require("../src/shared/approvalVerify");
|
|
|
|
const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
|
|
|
|
// A signer whose populateTransaction() fills in the fees a node quoted and
|
|
// whose sendTransaction() records the call, so a test can assert whether the
|
|
// send was reached at all.
|
|
function fakeSigner(fees) {
|
|
const sent = [];
|
|
return {
|
|
sent,
|
|
populateTransaction: async (request) => ({
|
|
...request,
|
|
from: RECIPIENT,
|
|
nonce: 0,
|
|
type: 2,
|
|
chainId: 1n,
|
|
gasLimit: fees.gasLimit,
|
|
maxFeePerGas: fees.maxFeePerGas,
|
|
maxPriorityFeePerGas: 1000000000n,
|
|
}),
|
|
sendTransaction: async (tx) => {
|
|
sent.push(tx);
|
|
return { hash: "0xabc" };
|
|
},
|
|
};
|
|
}
|
|
|
|
const ETH_SEND = { token: "ETH", to: RECIPIENT, amount: "1.0" };
|
|
|
|
describe("populateVerifyAndSend enforces the combined fee bound", () => {
|
|
// A gas limit and a fee that are each under their own field ceiling, but
|
|
// multiply to about 3,000 ETH — the combination the per-field ceilings
|
|
// cannot see.
|
|
const OVER = { gasLimit: 30000000n, maxFeePerGas: MAX_FEE_PER_GAS };
|
|
|
|
test("each field is under its ceiling but the product is over the bound", () => {
|
|
expect(OVER.maxFeePerGas).toBeLessThanOrEqual(MAX_FEE_PER_GAS);
|
|
expect(OVER.gasLimit * OVER.maxFeePerGas).toBeGreaterThan(
|
|
MAX_TOTAL_FEE,
|
|
);
|
|
});
|
|
|
|
test("refuses an over-bound send without broadcasting it", async () => {
|
|
const signer = fakeSigner(OVER);
|
|
let thrown;
|
|
try {
|
|
await populateVerifyAndSend(signer, ETH_SEND);
|
|
} catch (e) {
|
|
thrown = e;
|
|
}
|
|
expect(thrown).toBeDefined();
|
|
expect(thrown.approvalMismatch).toBe(true);
|
|
expect(thrown.message).toMatch(/^[A-Z].*\.$/);
|
|
expect(thrown.message).toContain("3000.0 ETH");
|
|
expect(thrown.message).toContain("1.0 ETH");
|
|
// The one guarantee that matters: nothing was signed or sent.
|
|
expect(signer.sent).toHaveLength(0);
|
|
});
|
|
|
|
test("broadcasts a send whose product is just under the bound", async () => {
|
|
// 21,000 gas at 40 gwei is 0.00084 ETH — an ordinary send.
|
|
const under = { gasLimit: 21000n, maxFeePerGas: 40000000000n };
|
|
expect(under.gasLimit * under.maxFeePerGas).toBeLessThan(MAX_TOTAL_FEE);
|
|
const signer = fakeSigner(under);
|
|
const tx = await populateVerifyAndSend(signer, ETH_SEND);
|
|
expect(tx.hash).toBe("0xabc");
|
|
expect(signer.sent).toHaveLength(1);
|
|
expect(signer.sent[0].gasLimit).toBe(under.gasLimit);
|
|
});
|
|
});
|