Skip to content

[WIP] Backport upstream changes#2

Draft
maxim-inj wants to merge 341 commits into
InjectiveLabs:developfrom
crypto-org-chain:develop
Draft

[WIP] Backport upstream changes#2
maxim-inj wants to merge 341 commits into
InjectiveLabs:developfrom
crypto-org-chain:develop

Conversation

@maxim-inj

@maxim-inj maxim-inj commented Sep 7, 2024

Copy link
Copy Markdown

Need to evaluate and backport some or all fixes from the upstream.

  • Problem: gasWanted is not aligned for process proposal mode (#773438) ⚠️
  • Problem: no way to disable nonce checking in benchmark (#f9cd15)
  • Problem: no MaxTx set from config for mempool (#e5b222)
  • Problem: insufficient invalid value check in eth transaction (#45ac08)
  • Problem: incarnation cache not enabled (#9c959a)
  • Problem: no overflow check when add gasLimit to gasWanted (#d874df) ⚠️
  • Problem: invalid chain id for signer (#f3e62c) ⚠️
  • Problem: benchmark logic don't increase nonce (#350955)
  • Problem: cometbft not up to date (#c36b26)
  • Problem: disable of create vesting account messages are not complete (#b0022e)
  • Optimize AnteHandle method to skip checks if disabledMsgs is empty (#ff4caa)
  • Problem: vote_extensions is not disabled in test (#0e0baa)
  • Problem: no debug files uploaded when timeout in ci (#e3b813)
  • Problem: nondeterministic account set occurs with more stm workers (#7ef8af)
  • Problem: unnecessary GetAccount in ante handlers (#fe3f4f)
  • Problem: handle for integer overflow is messy (#d26ada) ⚠️
  • Problem: method eth_chainId crashed occasionally(#452b0c) ⚠️
  • Problem: hash in subscribe newHeads differs from eth_getBlockByNumber (#3fabdbe) ⚠️
  • Problem: block-stm tx executor bad worst case performance (#79bb39e)
  • Problem: pre-estimation don't run in parallel (#56f8a5)
  • Problem: tx evm raw doesn't work under offline (#dbc7eb4)
  • Problem: get unnecessary block result when only need header (#7e30762)
  • Problem: trace block gas refund change not committed (#bcac9e2) ⚠️
  • Problem: db is double closed when shutdown (#f2a562b) ⚠️
  • Problem: no time in Transaction (#9755333) ⚠️
  • Problem: multisig account failed on threshold encode after send tx #33e3cc6
  • Problem: dependencies are outdated #5acb559
  • Problem: get unnecessary block result in header related api call #b16b489
  • Problem: unsuppored sign mode SIGN_MODE_TEXTUAL in bank transfer #c4cef0f
  • Problem: validation broke after transaction conversion with raw field #617eac9
  • Problem: opBlockhash broke after sdk50 #853e1e5 ⚠️
  • Problem: default headerHashNum is too large #580ce6e ⚠️
  • Problem: no header hash from fallback historicalInfo #a2ad87c ⚠️
  • Problem: node can't quit by signal #816389c ⚠️

Additional issues

  • Problem: reverted Evm call doesn't revert Tx, other msgs in Tx still execute ⚠️
  • Problem: fee collector account failed to refund fees: the check always considers that 100% of gas is refundable
  • Problem: need to support eth_getBlockReceipts see Get receipts by block number ethereum/go-ethereum#19634 ⚠️

@maxim-inj maxim-inj self-assigned this Sep 7, 2024
@coderabbitai

coderabbitai Bot commented Sep 7, 2024

Copy link
Copy Markdown

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b07fddf2-d22e-44cb-9f83-c00178bd6cbf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@maxim-inj maxim-inj changed the title Backport upstream changes [WIP] Backport upstream changes Sep 7, 2024
dependabot Bot and others added 27 commits June 17, 2025 14:14
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4 to 5.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/stale](https://github.com/actions/stale) from 8 to 9.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](actions/stale@v8...v9)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* build(deps): bump actions/dependency-review-action from 3 to 4

Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 3 to 4.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@v3...v4)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* ci: remove dependabot reviewers

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Xinyu Zhao <xinyu.zhao@crypto.com>
* feat: add support for eth_getBlockReceipts (#629)

* add support for eth_getblockreceipts

* update changelog

* Update rpc/backend/blocks.go

Co-authored-by: Xinyu <91446598+XinyuCRO@users.noreply.github.com>
Signed-off-by: Thomas Nguy <81727899+thomas-nguy@users.noreply.github.com>

* fix lint

* optimization

* remove empty space

* add test case

* fix length and add test

* return err details

* fix tests

* fix lint

* fix tests

---------

Signed-off-by: Thomas Nguy <81727899+thomas-nguy@users.noreply.github.com>
Co-authored-by: Xinyu <91446598+XinyuCRO@users.noreply.github.com>

* update changelog

---------

Signed-off-by: Thomas Nguy <81727899+thomas-nguy@users.noreply.github.com>
Co-authored-by: Xinyu <91446598+XinyuCRO@users.noreply.github.com>
Bumps [sigs.k8s.io/yaml](https://github.com/kubernetes-sigs/yaml) from 1.4.0 to 1.5.0.
- [Release notes](https://github.com/kubernetes-sigs/yaml/releases)
- [Changelog](https://github.com/kubernetes-sigs/yaml/blob/master/RELEASE.md)
- [Commits](kubernetes-sigs/yaml@v1.4.0...v1.5.0)

---
updated-dependencies:
- dependency-name: sigs.k8s.io/yaml
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the go_modules group with 1 update: [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure).


Updates `github.com/go-viper/mapstructure/v2` from 2.2.1 to 2.3.0
- [Release notes](https://github.com/go-viper/mapstructure/releases)
- [Changelog](https://github.com/go-viper/mapstructure/blob/main/CHANGELOG.md)
- [Commits](go-viper/mapstructure@v2.2.1...v2.3.0)

---
updated-dependencies:
- dependency-name: github.com/go-viper/mapstructure/v2
  dependency-version: 2.3.0
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas Nguy <81727899+thomas-nguy@users.noreply.github.com>
Signed-off-by: Thomas Nguy <81727899+thomas-nguy@users.noreply.github.com>
…updates (#640)

Bumps the npm_and_yarn group with 2 updates in the /tests/integration_tests/hardhat directory: [@openzeppelin/contracts-upgradeable](https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable) and [pbkdf2](https://github.com/crypto-browserify/pbkdf2).
Bumps the npm_and_yarn group with 1 update in the /tests/solidity directory: [pbkdf2](https://github.com/crypto-browserify/pbkdf2).


Updates `@openzeppelin/contracts-upgradeable` from 4.9.5 to 4.9.6
- [Release notes](https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/releases)
- [Changelog](https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/blob/master/CHANGELOG.md)
- [Commits](OpenZeppelin/openzeppelin-contracts-upgradeable@v4.9.5...v4.9.6)

Updates `pbkdf2` from 3.1.2 to 3.1.3
- [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md)
- [Commits](browserify/pbkdf2@v3.1.2...v3.1.3)

Updates `pbkdf2` from 3.1.2 to 3.1.3
- [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md)
- [Commits](browserify/pbkdf2@v3.1.2...v3.1.3)

---
updated-dependencies:
- dependency-name: "@openzeppelin/contracts-upgradeable"
  dependency-version: 4.9.6
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: pbkdf2
  dependency-version: 3.1.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: pbkdf2
  dependency-version: 3.1.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas Nguy <81727899+thomas-nguy@users.noreply.github.com>
Bumps the npm_and_yarn group with 1 update in the /tests/solidity directory: [tiny-secp256k1](https://github.com/bitcoinjs/tiny-secp256k1).


Updates `tiny-secp256k1` from 1.1.6 to 1.1.7
- [Commits](bitcoinjs/tiny-secp256k1@v1.1.6...v1.1.7)

---
updated-dependencies:
- dependency-name: tiny-secp256k1
  dependency-version: 1.1.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: JayT106 <JayT106@users.noreply.github.com>
Bumps [github.com/cosmos/cosmos-db](https://github.com/cosmos/cosmos-db) from 1.1.1 to 1.1.3.
- [Changelog](https://github.com/cosmos/cosmos-db/blob/main/CHANGELOG.md)
- [Commits](cosmos/cosmos-db@v1.1.1...v1.1.3)

---
updated-dependencies:
- dependency-name: github.com/cosmos/cosmos-db
  dependency-version: 1.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [cosmossdk.io/x/upgrade](https://github.com/cosmos/cosmos-sdk) from 0.1.4 to 0.2.0.
- [Release notes](https://github.com/cosmos/cosmos-sdk/releases)
- [Changelog](https://github.com/cosmos/cosmos-sdk/blob/v0.2.0/CHANGELOG.md)
- [Commits](cosmos/cosmos-sdk@x/upgrade/v0.1.4...v0.2.0)

---
updated-dependencies:
- dependency-name: cosmossdk.io/x/upgrade
  dependency-version: 0.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fix(grpc): add sanity check in TraceTx and TraceCall (#657)

* fix(grpc): add sanity check in Trace_Tx follow up

* update changelog

* update changelog
* chore: move app/ante to ante

* changelog
Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.15.0 to 0.16.0.
- [Commits](golang/sync@v0.15.0...v0.16.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sync
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.41.0 to 0.42.0.
- [Commits](golang/net@v0.41.0...v0.42.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* chore: rename app to evmd to enhance maintainability

* changelog

* update default.nix

* fix test

* update Makefile

* update broken-ethermintd.path

* fix comment
* Problem: no max gas cap for grpc eth_call (#586)

* add max gas cap in eth_call

* move logic

* add changelog
* Fix bugs in RPC utils (#178)

* changelog

* remove empty space

---------

Co-authored-by: Not Jeremy Liu <31809888+NotJeremyLiu@users.noreply.github.com>
Bumps alpine from 3.22.0 to 3.22.1.

---
updated-dependencies:
- dependency-name: alpine
  dependency-version: 3.22.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.73.0 to 1.74.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.73.0...v1.74.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.74.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the npm_and_yarn group with 1 update in the /tests/integration_tests/hardhat directory: [form-data](https://github.com/form-data/form-data).


Updates `form-data` from 4.0.0 to 4.0.4
- [Release notes](https://github.com/form-data/form-data/releases)
- [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md)
- [Commits](form-data/form-data@v4.0.0...v4.0.4)

---
updated-dependencies:
- dependency-name: form-data
  dependency-version: 4.0.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.74.0 to 1.74.2.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.74.0...v1.74.2)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.74.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
XinyuCRO and others added 30 commits June 30, 2026 03:40
* fix(rpc): align eth_getStorageAt storage key parsing

* doc:
…thorization list is provided. (#1029)

* fix(evm): allow access list creation without gas

* doc:

---------

Signed-off-by: Xinyu <91446598+XinyuCRO@users.noreply.github.com>
* feat(rpc): add eth_baseFee method

* doc: changelog

* feat: eth_baseFee

* fix: review
…tes (#1032)

Bumps the gh-actions group with 2 updates in the / directory: [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) and [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action).


Updates `aws-actions/configure-aws-credentials` from 6.2.0 to 6.2.1
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](aws-actions/configure-aws-credentials@e7f100c...254c19b)

Updates `anthropics/claude-code-action` from 1.0.157 to 1.0.160
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@428971d...4633baf)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.159
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gh-actions
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gh-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…1011)

* feat(mempool): add EVM sig pre-verifier and registry in appmempool

Move the stateless EVM signature pre-check into appmempool as
NewEVMSigPreVerifier (was a standalone ante helper) and add
PreVerifierRegistry so modules can contribute pre-verifiers that the app
composes on the mempool admission path. First rejection wins; nil defers
to the locked path.

* chore: concise function comments

* refactor(mempool): drop PreVerifierRegistry from appmempool

The registry is an app-level composition concern; ethermint ships only the
stateless EVM verifier. Remove the unused registry and its test per review
(#1011) — it moves to the app layer in cronos.
NewEVMSigPreVerifier stays, covered by evmd/ante/preverify_test.go.

* test(mempool): move EVMSigPreVerifier test to appmempool package

---------

Co-authored-by: Thomas <81727899+thomas-nguy@users.noreply.github.com>
* feat:
feat(rpc): default Block param to latest on state methods.

* test:

* deps:
* test: add specs

* feat: align eth_getStorageAt

* add eth-rpc-check.md

* fix: create access list without gas should success

* test: patch test input for ethermint(simulateV1)

* fix: json number

* test: eth_getBalance testcase patch for ethermint

* test: exclude past fork cases for eth_getBlockByNumber

* test: normalize local eth_getBlockReceipts schema fixtures

* test: eth_getProof, eth_getLogs

* test: receipt differences

* fix: tests

* fix: review

* test:

* test: split file

* test: fix RPC schema lint

* test: sync execution-apis fixtures before schema test

* test: sync spec fixtures from upstream

* feat: eth_baseFee

* fix: tests

* doc:

* test: rm unused specs

* doc: comments

* test:

* fix: lint

* fix: review

* fix: gomod2nix

* test: rename spec into execution-api

* test: rm simulate, already tested in schema tests

* revert: changes in sub pr

* fix: review

* test: whitelist decimal block number request

---------

Co-authored-by: songgaoye <217724508+songgaoye@users.noreply.github.com>
Bumps the gh-actions group with 1 update in the / directory: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action).


Updates `anthropics/claude-code-action` from 1.0.160 to 1.0.162
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@4633baf...6c0083b)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.161
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gh-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the gomod-minor-patch group with 1 update in the / directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go).


Updates `google.golang.org/grpc` from 1.81.1 to 1.82.0
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.81.1...v1.82.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.82.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JayT106 <JayT106@users.noreply.github.com>
* feat(rpc): gate direct app-mempool insert + rename to InsertMempoolTx

The #1003 MempoolTxInserter interface used a method named InsertTx, which
collides with baseapp.BaseApp.InsertTx (the ABCI gossip-insert handler some
SDK forks add) — its incompatible signature would be promoted onto the app,
so such apps cannot satisfy the interface.

Rename the method to InsertMempoolTx and add MempoolInsertEnabled() bool;
StartJSONRPC now registers the inserter only when MempoolInsertEnabled()
returns true. Apps with the default flood mempool (no app-side pool) keep the
unchanged BroadcastTx submission path instead of routing to a no-op inserter.

* simplify comments

* chore(changelog): update PR number to #1016

* refactor(rpc): drop MempoolInsertEnabled; decline via nil response

Single-method MempoolTxInserter interface: the app returns (nil, nil) to decline
(app mempool off) and broadcastTx falls back to BroadcastTx, instead of a separate
MempoolInsertEnabled() predicate gating registration. Rename the registration
helpers to carry the InsertMempoolTx naming.

* remove wordy comments

* chore(changelog): fix #1016 entry to match actual changes

* chore(changelog): simplify #1016 entry

* refactor(rpc): replace mempool-inserter global with APIOptions

Move the inserter contract into a new appmempool package and thread it
through GetRPCAPIsWithOptions instead of the package-global
RegisterMempoolTxInserter. StartJSONRPC casts the app to
appmempool.Inserter once; the public APICreator signature stays frozen
for downstream-registered namespaces.

* feat(appmempool): add InserterProvider for apps that can't host InsertMempoolTx

Some apps cannot implement Inserter directly because the InsertMempoolTx method
would clash with an embedded type (e.g. a BaseApp fork that promotes its own
InsertTx). InserterProvider lets such an app return the component that does
implement Inserter. StartJSONRPC prefers a direct Inserter, then falls back to the
provider — mirroring the existing ReaderProvider handling.

* chore: concise function comments

* refactor(rpc): consolidate mempool insert into a single MempoolClient

Replace the Inserter/InserterProvider interfaces, the APIOptions struct, and
the backend TxInserter func with one MempoolClient handle the app exposes
(directly or via MempoolClientProvider). PendingTxs is declared now so the
txpool read path in the stacked PR shares the same contract; this PR wires the
InsertTx (write) side.

- appmempool: MempoolClient{PendingTxs;InsertTx} + MempoolClientProvider.
- backend: WithMempoolClient replaces WithTxInserter.
- rpc: GetRPCAPIsWithMempool replaces GetRPCAPIsWithOptions; APIOptions dropped.
- server: one client cast wires the JSON-RPC layer.

* refactor(rpc): concise mempool client comments; rename appmempool.go to mempoolclient.go

* update changelog

* chore: update PR #1016 title and changelog to 'refactor(rpc): support mempool insertion from api'

* refactor(rpc): address PR review — move InsertTx comment, remove GetRPCAPIs

- Move InsertTx description from interface godoc to above the method
- Remove GetRPCAPIs; callers use GetRPCAPIsWithMempool(nil) for same behavior
- Add API Breaking changelog entry for GetRPCAPIs removal

* chore: revert changelog API breaking entry for GetRPCAPIs removal

* refactor(appmempool): PendingTxs return []sdk.Tx, drop evmtypes dep; remove redundant comment

* refactor(server): pass MempoolClient explicitly to StartJSONRPC, drop runtime type assertions

Remove MempoolClientProvider and the app type-assertion block; callers
pass the client directly (nil for internal/test paths).

* refactor(server): pass MempoolClient explicitly to StartJSONRPC, drop runtime type assertions

StartJSONRPC takes mempoolClient explicitly; startJSONRPCServer extracts
it via MempoolClientProvider for apps (e.g. cronos) whose embedded BaseApp
promotes InsertTx and can't implement MempoolClient directly.

* refactor(server): merge PendingTxListener+MempoolClient into AppServices interface

Replace PendingTxListener with AppServices which combines
RegisterPendingTxListener and MempoolClient(). Eliminates
MempoolClientProvider — apps implement MempoolClient() directly,
returning nil if they don't use direct mempool insertion.

* fix(evmd): sort appmempool import to satisfy gofumpt

---------

Signed-off-by: JayT106 <JayT106@users.noreply.github.com>
Co-authored-by: Thomas <81727899+thomas-nguy@users.noreply.github.com>
The [tls] certificate-path / key-path config was only consumed by the
WebSocket server. The main JSON-RPC HTTP server always called httpSrv.Serve(ln)
with no TLS wrapping, so an operator who configured a certificate and bound to
a non-loopback address would unknowingly serve all JSON-RPC traffic in
cleartext.

When both tls.certificate-path and tls.key-path are set, the JSON-RPC server
now serves via httpSrv.ServeTLS(...), matching the WebSocket server.

Addresses security-audit finding SRV-01.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…#1039)

GetLogs/GetFilterLogs route any non-nil BlockHash to NewBlockFilter, which
leaves FromBlock/ToBlock nil. Filter.Logs only took the singleton block-hash
branch when the hash was also non-zero, so a request carrying a zero hash
(e.g. {"blockHash":"0x00..00"}) fell through to the range path and
dereferenced the nil FromBlock, panicking.

Filter.Logs now takes the block-hash branch for any non-nil BlockHash
(matching api.go routing; a zero hash returns a clean "unknown block" error)
and nil-guards FromBlock/ToBlock in the range path as defense-in-depth.

Addresses security-audit finding RPC-01.

Signed-off-by: Thomas <81727899+thomas-nguy@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
blockCount is bounded by FeeHistoryCap, but len(rewardPercentiles) was never
bounded — validation only checked the [0,100] range and non-decreasing order
(duplicates allowed). A single request could therefore grow the
blocks x len(percentiles) *big.Int reward matrix without limit.

Reject requests whose rewardPercentiles length exceeds a fixed geth-style cap
(maxFeeHistoryRewardPercentiles = 100) before any allocation.

Addresses security-audit finding RPC-02.

Signed-off-by: Thomas <81727899+thomas-nguy@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…1041)

RPCFilterCap bounds HTTP filters, but WebSocket eth_subscribe does not go
through that map. Each subscribe stored a per-connection entry and spawned a
streaming goroutine (newHeads / logs / pendingTransactions) with no limit, so
a single allowed-origin client could open unbounded subscriptions and exhaust
node memory.

Enforce maxSubscriptionsPerConn (1000) active subscriptions per connection;
further eth_subscribe calls return an error response until existing
subscriptions are released.

Addresses security-audit finding RPC-04.

Signed-off-by: Randy <randy.ang@cronoslabs.org>
Signed-off-by: Thomas <81727899+thomas-nguy@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Randy <randy.ang@cronoslabs.org>
* feat(rpc): add `debug_getRawReceipts`

# Conflicts:
#	CHANGELOG.md

* test:

* test: rm debug_getRawReceipts from whitelist

* fix: gomod2nix

* refac: extract common logic

* doc: comment

* Update rpc/backend/tx_info.go

Co-authored-by: Thomas <81727899+thomas-nguy@users.noreply.github.com>
Signed-off-by: Xinyu <91446598+XinyuCRO@users.noreply.github.com>

---------

Signed-off-by: Xinyu <91446598+XinyuCRO@users.noreply.github.com>
Co-authored-by: Thomas <81727899+thomas-nguy@users.noreply.github.com>
* feat(rpc): add `eth_getStorageValues` JSON-RPC method

* Update CHANGELOG.md

Signed-off-by: Xinyu <91446598+XinyuCRO@users.noreply.github.com>

* fix: review

* fix: lint

* fix: review

* Revert "fix: review"

This reverts commit d3fc146.

---------

Signed-off-by: Xinyu <91446598+XinyuCRO@users.noreply.github.com>
#1045)

* fix(server): fix JSON-RPC goroutine leak and surface WS startup errors

* add changelog

* fix leak

* shutdown gracefully

* fix(rpc,server): tie WS server into shutdown lifecycle and surface all WS startup errors

---------

Co-authored-by: Thomas <81727899+thomas-nguy@users.noreply.github.com>
…up (#1042)

Bumps the gh-actions group with 1 update: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action).


Updates `anthropics/claude-code-action` from 1.0.162 to 1.0.163
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@6c0083b...769e3bd)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.163
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gh-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Thomas <81727899+thomas-nguy@users.noreply.github.com>
* feat(rpc): add `debug_getRawHeader

* fix: review
* feat(rpc): add `debug_getRawBlock`

* doc:

---------

Co-authored-by: Thomas <81727899+thomas-nguy@users.noreply.github.com>
Bumps the docker group with 1 update: golang.


Updates `golang` from 1.26.4-alpine to 1.27rc2-alpine

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.27rc2-alpine
  dependency-type: direct:production
  dependency-group: docker
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the gh-actions group with 2 updates: [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) and [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action).


Updates `aws-actions/configure-aws-credentials` from 6.2.1 to 6.2.2
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](aws-actions/configure-aws-credentials@254c19b...517a711)

Updates `anthropics/claude-code-action` from 1.0.163 to 1.0.168
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@769e3bd...ba0aafd)

---
updated-dependencies:
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: 6.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gh-actions
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.168
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gh-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JayT106 <JayT106@users.noreply.github.com>
* fix(deps): bump Go to 1.25.11 to resolve stdlib vulnerabilities

govulncheck flagged two standard-library vulnerabilities:
- GO-2026-5039 (net/textproto) — reached via client.KeyCommands
- GO-2026-5037 (crypto/x509)   — reached via the websocket upgrader and
  x509 hostname error handling

Both are fixed in go1.25.11. Since govulncheck derives the stdlib version
from the toolchain that runs it, bumping the pinned Go version across CI
workflows (and the local devnet Dockerfile) clears both findings.

The remaining GO-2026-4479 (github.com/pion/dtls/v2, pulled transitively
via go-ethereum p2p → pion/stun/v2) has no upstream v2 fix and is already
allowlisted in the dependency-review workflow.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Apply suggestion from @thomas-nguy

Signed-off-by: Thomas <81727899+thomas-nguy@users.noreply.github.com>

* update go

* update nix

* Apply suggestion from @thomas-nguy

Signed-off-by: Thomas <81727899+thomas-nguy@users.noreply.github.com>

* fix nix

---------

Signed-off-by: Thomas <81727899+thomas-nguy@users.noreply.github.com>
Signed-off-by: Xinyu <91446598+XinyuCRO@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Xinyu <91446598+XinyuCRO@users.noreply.github.com>
Co-authored-by: JayT106 <JayT106@users.noreply.github.com>
* feat(rpc): add `debug_getRawTransaction`

* test: coverage

* feat: adapt PendingTransactions with app mempool
…up (#1055)

Bumps the gh-actions group with 1 update: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action).


Updates `anthropics/claude-code-action` from 1.0.168 to 1.0.170
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@ba0aafd...536f2c3)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.170
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gh-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* feat(rpc): implement txpool namespace (content/inspect/status/contentFrom) backed by app mempool

Wire txpool_content, txpool_inspect, txpool_status, and txpool_contentFrom to
live pending EVM txs from the app mempool, using the MempoolClient from #1016.

- txpool API: PublicAPI.client MempoolClient; pending() iterates PendingTxs;
  Content/ContentFrom/Inspect/Status all delegate to pending()
- Status dedupes (sender, nonce) slots to match Content output
- All txs reported as pending; queued always empty (split not supported)
- InspectFormat falls back to GasFeeCap for EIP-1559 pending txs
- A nil client reports empty pools (apps without mempool access)

* fix(rpc/txpool): unexport inspectFormat, drop unreachable nil GasPrice guard

NewRPCTransaction always sets GasPrice (= GasFeeCap when baseFee is nil),
so the nil guard is dead code. Unexport to make the internal-only contract clear.

* fix(evmd): wire MempoolClient to the app PriorityNonceMempool

evmd.EthermintApp.MempoolClient() returned nil, so txpool_* RPC
methods never had pending txs to show. Adapt the mempool already
set via app.SetMempool() using SelectBy for safe concurrent iteration.

Also drop the stale txpool_contentFrom entry from the schema
"not implemented" whitelist now that it returns a conformant shape.

* refactor(evmd): move mempool wiring to its own file, fix changelog PR link

Addresses review: keep app.go free of mempool-specific logic and point
the changelog entry at this PR (#1051) instead of the closed #1034.

* style(rpc/txpool): fix gofmt alignment in api_test.go

* refactor(rpc/txpool): dedupe per-nonce map building, rename client field

Content/ContentFrom/Inspect each rebuilt a nonce-keyed dump map inline;
extracted into dumpNonce/dumpByAddr. Also renamed the client field/param
to mempoolClient so it stops shadowing the cosmos-sdk client package.

* perf(rpc/txpool): use mempool CountTx for Status instead of scanning pending

Status() built every pending tx into an RPCTransaction just to count them.
PriorityNonceMempool already tracks this count directly and dedupes
same-nonce replacements on insert, so expose it through MempoolClient
and use it instead.

* reduce comments

* fix(rpc/backend): implement CountTx on pendingMempoolClient test double

develop merged in a new MempoolClient test fake in tx_info_test.go that
predates the CountTx addition to the interface; implement it so the
build compiles again.
…up (#1057)

Bumps the gh-actions group with 1 update: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action).


Updates `anthropics/claude-code-action` from 1.0.170 to 1.0.171
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@536f2c3...e90deca)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.171
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gh-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps the gh-actions group with 2 updates: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) and [actions/setup-node](https://github.com/actions/setup-node).


Updates `anthropics/claude-code-action` from 1.0.171 to 1.0.173
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@e90deca...f1bd27c)

Updates `actions/setup-node` from 6 to 7
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v6...v7)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.173
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gh-actions
- dependency-name: actions/setup-node
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gh-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fix(evm): enforce EIP-7825 per-tx gas cap once Osaka activates

ApplyMessageWithConfig reimplements geth's state transition instead of
calling into it, so geth's isOsaka MaxTxGas check in preCheck never ran
here. The ante handler only caps total tx gas against the block gas
limit, not the 16,777,216 per-tx cap, so a tx exceeding it was accepted
by ethermint while canonical geth would reject it.

* fix(evm): exempt eth_call/estimateGas from MaxTxGas cap, fix test fixtures

geth's own MaxTxGas check in preCheck is skipped when SkipTransactionChecks
is set, because eth_call/eth_estimateGas deliberately probe gas limits above
the cap during binary search. The initial check didn't account for this and
broke gas estimation across several test suites. Also fixes two test
fixtures in handler_test.go that used gas limits above the new cap on a
real transaction path.

* refactor(evm): extract EIP-7825 gas cap check into preCheckMaxTxGas

Nitpick from PR review: mirror geth's preCheck architecture instead of
inlining the check in ApplyMessageWithConfig.

* fix(evm): enforce EIP-7825 MaxTxGas cap in ante handler too

Previously the cap only applied at execution time, so an oversized-gas
tx still passed CheckTx and sat in the mempool until it failed on
delivery. Extract the check into keeper.CheckMaxTxGas and call it from
CheckEthGasConsume as well, so it's rejected before mempool entry.

* revert(changelog): keep original wording for #1056 entry

* test(evm): restore block-gas-limit coverage after MaxTxGas cap fix

The MaxTxGas cap now fires before the block-gas-limit check, so the
"gas limit above block gas limit" case was silently passing on the
wrong error (single-message tx exceeded the cap first). Replace it
with a multi-message tx where each message stays under the cap but
the sum exceeds the block limit, funded to reach the message that
actually trips it. Renamed the other case whose name implied overflow
coverage it never had.

* test(evm): cover MaxTxGas cap rejection during ReCheckTx

The cap check runs before the ReCheckTx early-continue in
CheckEthGasConsume, so it should evict an oversized tx even on
re-check. Add a case asserting that.

* feat(evm): make EIP-7825 MaxTxGas cap governance-configurable

Adds a MaxTxGas param to x/evm Params (0 = use geth's protocol default),
per PR #1056 review feedback that cronos runs a different block gas limit
and may want to raise the cap. Both enforcement points (ante handler,
ApplyMessageWithConfig) read the resolved param via Params.EffectiveMaxTxGas
instead of the hardcoded constant.

* ci(proto): authenticate buf-setup-action to avoid rate limiting

Add github_token to both buf-setup-action steps in proto.yml. Unauthenticated
GitHub API calls to resolve the buf download URL were getting rate limited,
failing the Protobuf lint job intermittently.

Also trim verbose test comments added for the MaxTxGas cap coverage down to
one line each.

* revert(evm): use geth's default MaxTxGas, drop governance param

Reverts ebf0d99. EIP-7825 cap
goes back to geth's hardcoded constant instead of a governance-
configurable x/evm param.

* fix(evm): enforce MaxTxGas cap in eth_simulateV1's applyCall

applyCall mirrors ApplyMessageWithConfig's intrinsic gas and EIP-7623
floor checks but skipped the EIP-7825 MaxTxGas cap. Currently harmless
since ToSimMessage always sets SkipTransactionChecks, but keeps the two
paths in sync for any future caller that doesn't. Per review feedback
on PR #1056.

* test(evm): assert ErrGasLimitTooHigh sentinel in ante MaxTxGas cases

Adds errors.Is checks alongside the existing message-substring checks
for the three MaxTxGas-cap ante test cases, guarding against a future
refactor that changes the message but keeps the sentinel. Also documents
the debug_traceTransaction replay edge case on preCheckMaxTxGas. Per
review feedback on PR #1056.

* docs(evm): drop debug_traceTransaction replay note on preCheckMaxTxGas

---------

Co-authored-by: Thomas <81727899+thomas-nguy@users.noreply.github.com>
* fix(rpc): exclude Cosmos gas from transaction receipts

* refactor use buildReceiptFromBlock

* add changelog

* strength unit test

* fix(rpc): log unindexed-but-not-found tx at error level

---------

Co-authored-by: jay.tseng <jay.tseng@crypto.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants