Celadon audit

.github/workflows/test.yml

@@ -38,7 +38,7 @@ jobs:
           cache-on-failure: true
 
       - name: Install nextest
-        uses: taiki-e/install-action@v2.87.5
+        uses: taiki-e/install-action@v2.87.11
         with:
           tool: cargo-nextest
 
@@ -86,7 +86,7 @@ jobs:
           cache-on-failure: true
 
       - name: Install nextest
-        uses: taiki-e/install-action@v2.87.5
+        uses: taiki-e/install-action@v2.87.11
         with:
           tool: cargo-nextest
 

bin/morph-statetest/Cargo.toml

@@ -16,6 +16,7 @@ eyre.workspace = true
 morph-chainspec.workspace = true
 morph-evm.workspace = true
 morph-revm.workspace = true
+morph-primitives.workspace = true
 revm = { workspace = true, features = ["tracer"] }
 revm-statetest-types.workspace = true
 serde.workspace = true

bin/morph-statetest/src/runner.rs

@@ -246,6 +246,15 @@ fn validation_error<E>(
 where
     E: std::fmt::Display,
 {
+    // `expectException` is checked for presence, deliberately not for its text.
+    // go-ethereum's own statetest harness does the same -- `tests/state_test.go`
+    // returns early on `len(ExpectException) > 0` under a standing
+    // "TODO check error string" -- so matching on the text here would make this
+    // runner stricter than the client the fixtures are generated from, and a
+    // fixture imported from go-ethereum could fail on wording alone. The string
+    // stays in the JSON as documentation of which failure the case is meant to
+    // provoke; the assertion is that the transaction is *rejected*, which is what
+    // both clients agree on.
     match (&test.expect_exception, exec_result) {
         (Some(_), Err(_)) => return None,
         (Some(expected), Ok(_)) => {

bin/morph-statetest/src/schema.rs

@@ -1,4 +1,5 @@
 use morph_chainspec::hardfork::MorphHardfork;
+use morph_primitives::transaction::morph_transaction::MORPH_TX_VERSION_2;
 use morph_revm::{MorphTxEnv, MorphTxExt};
 use revm::{
     context::{BlockEnv, CfgEnv, TransactionType, TxEnv},
@@ -282,6 +283,12 @@ impl MorphTransactionParts {
         let mut tx = MorphTxEnv::new(inner);
         if let Some(version) = self.version {
             tx = tx.with_version(version);
+        } else if tx.is_morph_tx() && self.authorization_list.is_some() {
+            // Only V2 may carry an `authorizationList` field, so its presence
+            // (even `[]`) selects V2 instead of leaving the version unset, which
+            // the handler would treat as V0. Presence rather than length is the
+            // same convention `tx_type` uses to select 0x04.
+            tx = tx.with_version(MORPH_TX_VERSION_2);
         }
         if let Some(fee_token_id) = self.fee_token_id {
             tx = tx.with_fee_token_id(fee_token_id);
@@ -358,7 +365,10 @@ pub fn parse_fork(name: &str) -> Result<MorphHardfork, SchemaError> {
         "morph203" | "morph-203" => Ok(MorphHardfork::Morph203),
         "viridian" | "prague" => Ok(MorphHardfork::Viridian),
         "emerald" => Ok(MorphHardfork::Emerald),
-        "jade" | "osaka" => Ok(MorphHardfork::Jade),
+        "jade" => Ok(MorphHardfork::Jade),
+        // OSAKA is the spec level of the latest Morph fork, so the generic
+        // Ethereum name maps to it (matches `MorphHardfork::from(SpecId::OSAKA)`).
+        "celadon" | "osaka" => Ok(MorphHardfork::Celadon),
         "cancun" => Ok(MorphHardfork::Morph203),
         _ => Err(SchemaError::UnknownFork(name.to_string())),
     }
@@ -487,6 +497,86 @@ mod tests {
         );
     }
 
+    #[test]
+    fn morph_tx_with_authorization_list_is_modelled_as_v2() {
+        let suite: MorphTestSuite = serde_json::from_str(
+            r#"{
+              "case": {
+                "env": {
+                  "currentChainID": "0x1",
+                  "currentCoinbase": "0x0000000000000000000000000000000000000000",
+                  "currentDifficulty": "0x0",
+                  "currentGasLimit": "0x989680",
+                  "currentNumber": "0x1",
+                  "currentTimestamp": "0x1",
+                  "currentBaseFee": "0x1"
+                },
+                "pre": {},
+                "transaction": {
+                  "type": "0x7f",
+                  "nonce": "0x0",
+                  "gasLimit": ["0x186a0"],
+                  "to": "0x00000000000000000000000000000000000000f1",
+                  "value": ["0x0"],
+                  "data": ["0x"],
+                  "accessLists": [null],
+                  "maxFeePerGas": "0x10",
+                  "maxPriorityFeePerGas": "0x1",
+                  "feeTokenID": "0x1",
+                  "feeLimit": "0x3e8",
+                  "authorizationList": [{
+                    "chainId": "0x1",
+                    "address": "0x4242424242424242424242424242424242424242",
+                    "nonce": "0x0",
+                    "yParity": "0x0",
+                    "r": "0x1",
+                    "s": "0x2"
+                  }],
+                  "secretKey": "0x45a915e4d060149eb4365960e6a7a45f334393093061116b197e3240065ff2d8"
+                },
+                "post": {
+                  "Celadon": [{
+                    "indexes": { "data": 0, "gas": 0, "value": 0 },
+                    "hash": "0x0000000000000000000000000000000000000000000000000000000000000000",
+                    "logs": "0x0000000000000000000000000000000000000000000000000000000000000000",
+                    "expectException": null
+                  }]
+                }
+              }
+            }"#,
+        )
+        .expect("suite should parse");
+
+        let unit = suite.0.values().next().unwrap();
+        let post = &unit.post["Celadon"][0];
+        let tx = unit
+            .morph_tx_env(post, MorphHardfork::Celadon)
+            .expect("tx env should build");
+
+        assert!(tx.is_morph_tx());
+        assert_eq!(tx.version, Some(MORPH_TX_VERSION_2));
+        assert_eq!(tx.fee_token_id, Some(1));
+        assert_eq!(tx.authorization_list.len(), 1);
+
+        // The fallback L1 fee bytes must be the V2 envelope (0x7f || 0x02 || rlp)
+        // and carry the authorization list: the delegate address appears verbatim.
+        let encoded = tx.rlp_bytes.expect("fallback L1 fee bytes");
+        assert_eq!(encoded[0], 0x7f);
+        assert_eq!(encoded[1], MORPH_TX_VERSION_2);
+        let delegate = [0x42u8; 20];
+        assert!(
+            encoded.windows(20).any(|window| window == delegate),
+            "L1 fee sizing bytes must include the authorization list"
+        );
+    }
+
+    #[test]
+    fn parse_fork_maps_celadon_and_osaka() {
+        assert_eq!(parse_fork("Celadon").unwrap(), MorphHardfork::Celadon);
+        assert_eq!(parse_fork("osaka").unwrap(), MorphHardfork::Celadon);
+        assert_eq!(parse_fork("jade").unwrap(), MorphHardfork::Jade);
+    }
+
     #[test]
     fn blob_tx_without_txbytes_errors_instead_of_silently_zeroing_l1_fee() {
         let suite: MorphTestSuite = serde_json::from_str(

bin/morph-statetest/tests/celadon_alt_token_refund.rs

@@ -0,0 +1,50 @@
+//! Golden roots from morph-geth 5a0d0d771 (go-ethereum#371), which reads them back
+//! from this same fixture.
+//!
+//! The fee token is registered with `priceRatio = 3` against `scale = 1`, so
+//! converting ETH to token units is inexact. Each fork runs three calldata
+//! lengths against three consecutive gas limits:
+//!
+//! - one, two and three non-zero calldata bytes cost 21_016, 21_032 and 21_048
+//!   gas, which covers every remainder of the *net* fee modulo the price ratio;
+//! - the gas limits 100_001..=100_003 cover every remainder of the *prepaid* fee.
+//!
+//! Tokens collected, per gas limit:
+//!
+//! | net gas | Emerald, Jade       | Celadon             | floor without the credit |
+//! |---------|---------------------|---------------------|--------------------------|
+//! | 21_016  | 7_005, 7_005, 7_006 | 7_006, 7_006, 7_006 | 7_006, 7_006, 7_006      |
+//! | 21_032  | 7_011, 7_010, 7_011 | 7_011, 7_011, 7_011 | 7_011, 7_011, 7_012      |
+//! | 21_048  | 7_016, 7_016, 7_016 | 7_016, 7_016, 7_016 | 7_017, 7_016, 7_017      |
+//!
+//! Celadon collects `ceil(net / 3)` on every gas limit, so it ends on one state
+//! root per calldata length. Emerald and Jade round the prepaid fee and the refund
+//! up independently and come out a token unit short on three of the nine, so the
+//! first two rows end on two roots each.
+//!
+//! The last column is why one calldata length is not enough. With a net fee of
+//! 21_016 the prepaid rounding credit never carries into the refund, so a client
+//! that rounds the refund down but drops the credit still lands on every root of
+//! that row. The other two rows are the ones that pin the credit itself.
+//!
+//! The gas figures also pin the transaction's gas: morph does not apply the
+//! EIP-7623 calldata floor, which would bill 21_040 for the first row and miss
+//! every root here.
+use morph_statetest::runner::run_suite_str;
+
+#[test]
+fn celadon_alt_token_refund_matches_geth() {
+    let outcomes = run_suite_str(include_str!("fixtures/celadon_alt_token_refund.json")).unwrap();
+    assert_eq!(
+        outcomes.len(),
+        27,
+        "3 forks × 3 calldata lengths × 3 gas limits"
+    );
+    for outcome in outcomes {
+        assert!(
+            outcome.pass,
+            "{} / {}: {}",
+            outcome.test, outcome.fork, outcome.error_msg
+        );
+    }
+}