Enforce EIP-7825 per-tx gas cap on settlement by 0xDevNinja · Pull Request #4371 · cowprotocol/services

0xDevNinja · 2026-04-30T14:02:22Z

Description

The driver caps a settlement's gas estimate at half the block gas limit (e.g. 60M on a 120M block). Fusaka introduced the EIP-7825 per-transaction gas cap of 2^24 - 1 = 16,777,215 on Mainnet; any tx exceeding this is rejected by the mempool. Without this check a solution above the cap can still be returned by /solve and forwarded to /settle, where it could never be mined. The cap is already enforced on the quote-verification path (#4261) but was never ported to settlement submission.

Note: EIP-7825 is L1 Fusaka-only and other chains pick their own per-tx limits (e.g. Arbitrum One uses 32M), so the driver reuses the existing tx_gas_limit config knob (#3780) rather than hardcoding a single value. Operators set the per-chain ceiling — 16,777,215 on Mainnet Fusaka, higher elsewhere — and Gas::new enforces min(block_limit / 2, tx_gas_limit).

Changes

Plumb the tx_gas_limit config value through infra::blockchain::Ethereum (new tx_gas_limit() accessor).
In Gas::new, cap the per-settlement maximum at min(block_limit / 2, tx_gas_limit) so over-sized solutions fail fast through the existing GasLimitExceeded error.
Chains with a block gas limit below 2 * tx_gas_limit keep the tighter half-block behaviour.
Add unit tests covering the configured-cap path, the boundary case (asserting both estimate and the clamped limit), the small-block-limit path, and the non-Fusaka case where the half-block cap binds.

How to test

cargo nextest run -p driver settlement::tests

All four new tests pass; existing driver tests are unchanged.

Fixes #4368

github-actions · 2026-04-30T14:02:35Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

0xDevNinja · 2026-04-30T14:07:46Z

I have read the CLA Document and I hereby sign the CLA

0xDevNinja · 2026-04-30T14:07:53Z

recheck

gemini-code-assist

Code Review

This pull request implements the EIP-7825 per-transaction gas cap (2^24 - 1) within the settlement domain. The Gas::new function now caps the maximum gas by taking the minimum of half the block limit and this new constant, preventing the creation of solutions that would be rejected by the mempool. Unit tests have been added to verify the cap's behavior in both large and small block limit scenarios. I have no feedback to provide.

AryanGodara

I think the PR is good to merge, just left some small follow-up questions

AryanGodara · 2026-05-04T12:21:40Z

+
+    #[test]
+    fn rejects_solution_above_eip_7825_cap() {
+        // 120M block (well above the EIP-7825 cap of 16,777,215). Half the


nit: can we rewrite this comment, so it reads more clearly.
it can be structured a little bit better 😅

Reworded in 2e4268b.

- Make EIP_7825_TX_GAS_CAP private; no external callers. - Reword test comment for clarity.

Replace the hardcoded EIP-7825 constant in Gas::new with the existing per-driver tx_gas_limit config knob. Operators set the cap per chain (EIP-7825's 16,777,215 on Fusaka chains, higher elsewhere) so non-Fusaka chains aren't over-restricted by an L1-only fork rule.

EIP-7825 chose 2^24-1 for Mainnet's Fusaka hardfork; other chains pick their own per-tx limits (e.g. Arbitrum One uses 32M). Reword comments and rename the test const to make the Mainnet scope explicit.

0xDevNinja · 2026-05-04T18:18:28Z

@jmg-duarte, Addressed all three suggestions in 20dba82:

Reworded comment at Gas::new to read "EIP-7825's 16,777,215 cap on Mainnet Fusaka".
Updated test const doc to mention Mainnet's Fusaka hardfork explicitly.
Renamed test const EIP_7825_TX_GAS_CAP → EIP_7825_MAINNET_TX_GAS_CAP.

Good to know about Arb1 picking 32M — that's exactly why the cap is now driven by the per-chain tx_gas_limit config knob rather than a hardcoded value.

AryanGodara

Nit: description claims hardcoded const EIP_7825_TX_GAS_CAP but that is no longer true, as it uses tx_gas_limit plumbing.
Update body to reflect the pivot.

squadgazzz

Two minor follow-ups, neither blocking.

PR description note: the Changes list still says the cap is exposed as Gas::EIP_7825_TX_GAS_CAP for callers and tests to share, but the final code keeps the constant private to the test module and the per-tx ceiling now comes from the existing tx_gas_limit config knob, not a hardcoded constant. Worth tightening before squash so the commit message reflects what shipped.

squadgazzz · 2026-05-05T16:05:43Z

+        let block_limit = gas(120_000_000);
+        let tx_gas_limit = gas(EIP_7825_MAINNET_TX_GAS_CAP);
+        let result = Gas::new(tx_gas_limit, block_limit, tx_gas_limit).unwrap();
+        assert_eq!(result.estimate, tx_gas_limit);


The boundary test only asserts estimate, but limit is what flows downstream into required_balance and the submitted tx's gas field. With estimate == tx_gas_limit, the 2.0× buffer would compute estimate_with_buffer = 2 * tx_gas_limit, and the min(max_gas, ...) clamp is what keeps the limit at the cap. Worth locking that in.

Suggested change

assert_eq!(result.estimate, tx_gas_limit);

assert_eq!(result.estimate, tx_gas_limit);

assert_eq!(result.limit, tx_gas_limit);

Good catch — applied in 78cbd3b. Locks in that the 2x estimate buffer can't leak past the configured cap.

When estimate == tx_gas_limit, the 2x estimate buffer would otherwise set limit to 2 * tx_gas_limit; the min(max_gas, ...) clamp pins it back to the configured cap. Lock that contract in.

0xDevNinja · 2026-05-06T06:31:45Z

Updated the PR description to reflect the pivot — the cap now reads from the existing tx_gas_limit config knob, no hardcoded constant exposed. Also tightened the accepts_solution_at_tx_gas_limit test in 78cbd3b per @squadgazzz's suggestion.

Enforce EIP-7825 per-tx gas cap on settlement

33161cf

0xDevNinja requested a review from a team as a code owner April 30, 2026 14:02

gemini-code-assist Bot reviewed Apr 30, 2026

View reviewed changes

github-actions Bot added a commit that referenced this pull request Apr 30, 2026

@0xDevNinja has signed the CLA in #4371

0aa06cb

jmg-duarte approved these changes May 4, 2026

View reviewed changes

AryanGodara reviewed May 4, 2026

View reviewed changes

0xDevNinja added 2 commits May 4, 2026 19:26

Address review on EIP-7825 gas cap

2e4268b

- Make EIP_7825_TX_GAS_CAP private; no external callers. - Reword test comment for clarity.

jmg-duarte requested changes May 4, 2026

View reviewed changes

Clarify Mainnet-specific framing of EIP-7825 cap

20dba82

EIP-7825 chose 2^24-1 for Mainnet's Fusaka hardfork; other chains pick their own per-tx limits (e.g. Arbitrum One uses 32M). Reword comments and rename the test const to make the Mainnet scope explicit.

0xDevNinja requested review from AryanGodara and jmg-duarte May 4, 2026 18:19

jmg-duarte approved these changes May 5, 2026

View reviewed changes

AryanGodara mentioned this pull request May 5, 2026

Add pr-context-synthesis skill #4374

Open

AryanGodara approved these changes May 5, 2026

View reviewed changes

squadgazzz reviewed May 5, 2026

View reviewed changes

Assert clamped limit at tx_gas_limit boundary

78cbd3b

When estimate == tx_gas_limit, the 2x estimate buffer would otherwise set limit to 2 * tx_gas_limit; the min(max_gas, ...) clamp pins it back to the configured cap. Lock that contract in.

0xDevNinja requested a review from squadgazzz May 6, 2026 06:33

	assert_eq!(result.estimate, tx_gas_limit);
	assert_eq!(result.estimate, tx_gas_limit);
	assert_eq!(result.limit, tx_gas_limit);

Conversation

0xDevNinja commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changes

How to test

Uh oh!

github-actions Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

0xDevNinja commented Apr 30, 2026

Uh oh!

0xDevNinja commented Apr 30, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

AryanGodara left a comment

Choose a reason for hiding this comment

Uh oh!

AryanGodara May 4, 2026

Choose a reason for hiding this comment

Uh oh!

0xDevNinja May 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

0xDevNinja commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AryanGodara left a comment

Choose a reason for hiding this comment

Uh oh!

squadgazzz left a comment

Choose a reason for hiding this comment

Uh oh!

squadgazzz May 5, 2026

Choose a reason for hiding this comment

Uh oh!

0xDevNinja May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

0xDevNinja commented May 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

0xDevNinja commented Apr 30, 2026 •

edited

Loading

github-actions Bot commented Apr 30, 2026 •

edited

Loading

0xDevNinja commented May 4, 2026 •

edited

Loading

0xDevNinja May 6, 2026 •

edited

Loading