Skip to content

reject empty SetCode auth list#3528

Open
codchen wants to merge 1 commit into
mainfrom
codex/reject-empty-setcode-auth-list
Open

reject empty SetCode auth list#3528
codchen wants to merge 1 commit into
mainfrom
codex/reject-empty-setcode-auth-list

Conversation

@codchen
Copy link
Copy Markdown
Collaborator

@codchen codchen commented Jun 1, 2026

Summary

Reject SetCode transactions with nil or empty authorization lists during Sei EVM tx validation, so CheckTx no longer accepts transactions that DeliverTx later rejects through Geth's EIP-7702 stateless checks.

The same guard is mirrored in the Giga EVM tx-type copy to keep validation behavior aligned.

Root Cause

SetCodeTx.Validate() delegated to validateAuthList(), which iterated over the list but treated nil and empty lists as valid. CheckTx runs Sei's stateless validation path without Geth StateTransition.StatelessChecks(), preserving pending-nonce mempool behavior, so the empty auth-list invariant was missed before mempool admission. DeliverTx invokes the Geth stateless check and rejects the same tx with ErrEmptyAuthList, wrapped as ErrWrongSequence.

Tests

go test ./x/evm/types ./x/evm/types/ethtx ./app/ante ./giga/deps/xevm/types/ethtx

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Jun 1, 2026

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

BuildFormatLintBreakingUpdated (UTC)
✅ passed✅ passed✅ passed✅ passedJun 1, 2026, 4:02 AM

@codchen codchen changed the title [codex] reject empty SetCode auth list reject empty SetCode auth list Jun 1, 2026
@codchen codchen marked this pull request as ready for review June 1, 2026 04:01
@cursor
Copy link
Copy Markdown

cursor Bot commented Jun 1, 2026

PR Summary

Low Risk
Tightens validation for invalid SetCode txs only; no changes to execution, auth, or fee logic beyond rejecting previously accepted invalid payloads.

Overview
SetCode (EIP-7702) txs with nil or empty AuthList are now rejected during Sei EVM semantic validation via validateAuthList, so CheckTx (EvmStatelessChecks) and DeliverTx agree with Geth’s empty-auth-list rule instead of admitting txs that fail later.

The same guard is applied in giga/deps/xevm/types/ethtx. Tests cover SetCodeTx.Validate, the ante stateless path, and happy-path SetCode behavior.

Reviewed by Cursor Bugbot for commit 8e60340. Bugbot is set up for automated code reviews on this repo. Configure here.

@codecov
Copy link
Copy Markdown

codecov Bot commented Jun 1, 2026

Codecov Report

❌ Patch coverage is 50.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 58.27%. Comparing base (1b322f0) to head (8e60340).
⚠️ Report is 8 commits behind head on main.

Files with missing lines Patch % Lines
giga/deps/xevm/types/ethtx/semantic_validation.go 0.00% 2 Missing ⚠️
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #3528      +/-   ##
==========================================
- Coverage   59.04%   58.27%   -0.77%     
==========================================
  Files        2199     2129      -70     
  Lines      182096   173925    -8171     
==========================================
- Hits       107510   101353    -6157     
+ Misses      64935    63558    -1377     
+ Partials     9651     9014     -637     
Flag Coverage Δ
sei-chain-pr 62.57% <50.00%> (?)
sei-db 70.41% <ø> (ø)
sei-db-state-db ?

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
x/evm/types/ethtx/semantic_validation.go 42.22% <100.00%> (+9.66%) ⬆️
giga/deps/xevm/types/ethtx/semantic_validation.go 31.11% <0.00%> (-1.45%) ⬇️

... and 74 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants