Harden EVM field-bloat validation

app/ante/evm_checktx.go

@@ -75,45 +75,11 @@ func EvmCheckTxAnte(
 }
 
 func EvmStatelessChecks(ctx sdk.Context, tx sdk.Tx, chainID *big.Int) error {
-	txBody, ok := tx.(TxBody)
-	if ok {
-		body := txBody.GetBody()
-		if body.Memo != "" {
-			return sdkerrors.Wrap(sdkerrors.ErrInvalidRequest, "memo must be empty for EVM txs")
-		}
-		if body.TimeoutHeight != 0 {
-			return sdkerrors.Wrap(sdkerrors.ErrInvalidRequest, "timeout_height must be zero for EVM txs")
-		}
-		if len(body.ExtensionOptions) > 0 || len(body.NonCriticalExtensionOptions) > 0 {
-			return sdkerrors.Wrap(sdkerrors.ErrInvalidRequest, "extension options must be empty for EVM txs")
-		}
-	}
-
-	txAuth, ok := tx.(TxAuthInfo)
-	if ok {
-		authInfo := txAuth.GetAuthInfo()
-		if len(authInfo.SignerInfos) > 0 {
-			return sdkerrors.Wrap(sdkerrors.ErrInvalidRequest, "signer_infos must be empty for EVM txs")
-		}
-		if authInfo.Fee != nil {
-			if len(authInfo.Fee.Amount) > 0 {
-				return sdkerrors.Wrap(sdkerrors.ErrInvalidRequest, "fee amount must be empty for EVM txs")
-			}
-			if authInfo.Fee.Payer != "" || authInfo.Fee.Granter != "" {
-				return sdkerrors.Wrap(sdkerrors.ErrInvalidRequest, "fee payer and granter must be empty for EVM txs")
-			}
-		}
+	if err := evmante.ValidateNoCosmosTxFields(tx); err != nil {
+		return err
 	}
-
-	txSig, ok := tx.(TxSignaturesV2)
-	if ok {
-		sigs, err := txSig.GetSignaturesV2()
-		if err != nil {
-			return sdkerrors.Wrap(sdkerrors.ErrInvalidRequest, "could not get signatures")
-		}
-		if len(sigs) > 0 {
-			return sdkerrors.Wrap(sdkerrors.ErrInvalidRequest, "signatures must be empty for EVM txs")
-		}
+	if err := evmante.ValidateNoOuterEVMMsgFields(tx); err != nil {
+		return err
 	}
 
 	if len(tx.GetMsgs()) != 1 {

app/ante/evm_checktx_test.go

@@ -0,0 +1,52 @@
+package ante
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	codectypes "github.com/sei-protocol/sei-chain/sei-cosmos/codec/types"
+	sdk "github.com/sei-protocol/sei-chain/sei-cosmos/types"
+	txtypes "github.com/sei-protocol/sei-chain/sei-cosmos/types/tx"
+	authtx "github.com/sei-protocol/sei-chain/sei-cosmos/x/auth/tx"
+	evmtypes "github.com/sei-protocol/sei-chain/x/evm/types"
+	"github.com/sei-protocol/sei-chain/x/evm/types/ethtx"
+)
+
+func TestEvmStatelessChecksRejectsRawSignatures(t *testing.T) {
+	msg, err := evmtypes.NewMsgEVMTransaction(&ethtx.AssociateTx{})
+	require.NoError(t, err)
+	msgAny, err := codectypes.NewAnyWithValue(msg)
+	require.NoError(t, err)
+
+	protoTx := &txtypes.Tx{
+		Body: &txtypes.TxBody{Messages: []*codectypes.Any{msgAny}},
+		AuthInfo: &txtypes.AuthInfo{
+			Fee: &txtypes.Fee{},
+		},
+		Signatures: [][]byte{{0x1}},
+	}
+
+	err = EvmStatelessChecks(sdk.Context{}, authtx.WrapTx(protoTx).GetTx(), nil)
+	require.ErrorContains(t, err, "signatures must be empty")
+}
+
+func TestEvmStatelessChecksRejectsWrappedMemo(t *testing.T) {
+	msg, err := evmtypes.NewMsgEVMTransaction(&ethtx.AssociateTx{})
+	require.NoError(t, err)
+	msgAny, err := codectypes.NewAnyWithValue(msg)
+	require.NoError(t, err)
+
+	protoTx := &txtypes.Tx{
+		Body: &txtypes.TxBody{
+			Messages: []*codectypes.Any{msgAny},
+			Memo:     "field bloat",
+		},
+		AuthInfo: &txtypes.AuthInfo{
+			Fee: &txtypes.Fee{},
+		},
+	}
+
+	err = EvmStatelessChecks(sdk.Context{}, authtx.WrapTx(protoTx).GetTx(), nil)
+	require.ErrorContains(t, err, "memo must be empty")
+}

app/app.go

@@ -1435,7 +1435,7 @@ func (app *App) ProcessTxsSynchronousGiga(ctx sdk.Context, txs [][]byte, typedTx
 		}
 
 		// Execute EVM transaction through giga executor
-		result, execErr := app.executeEVMTxWithGigaExecutor(ctx, evmMsg, cache)
+		result, execErr := app.executeEVMTxWithGigaExecutor(ctx, typedTxs[i], evmMsg, cache)
 		if execErr != nil {
 			// Check if this is a fail-fast error (Cosmos precompile interop detected)
 			if gigautils.ShouldExecutionAbort(execErr) {
@@ -1756,7 +1756,26 @@ func (app *App) ProcessBlock(ctx sdk.Context, txs [][]byte, req BlockProcessRequ
 
 // executeEVMTxWithGigaExecutor executes a single EVM transaction using the giga executor.
 // The sender address is recovered directly from the transaction signature - no Cosmos SDK ante handlers needed.
-func (app *App) executeEVMTxWithGigaExecutor(ctx sdk.Context, msg *evmtypes.MsgEVMTransaction, cache *gigaBlockCache) (*abci.ExecTxResult, error) {
+func (app *App) executeEVMTxWithGigaExecutor(ctx sdk.Context, tx sdk.Tx, msg *evmtypes.MsgEVMTransaction, cache *gigaBlockCache) (*abci.ExecTxResult, error) {
+	if err := evmante.ValidateNoCosmosTxFields(tx); err != nil {
+		return &abci.ExecTxResult{
+			Code: 1,
+			Log:  err.Error(),
+		}, nil
+	}
+	if err := evmante.ValidateNoOuterEVMMsgFields(tx); err != nil {
+		return &abci.ExecTxResult{
+			Code: 1,
+			Log:  err.Error(),
+		}, nil
+	}
+	if err := msg.ValidateBasic(); err != nil {
+		return &abci.ExecTxResult{
+			Code: 1,
+			Log:  err.Error(),
+		}, nil
+	}
+
 	// Get the Ethereum transaction from the message
 	ethTx, txData := msg.AsTransaction()
 	if ethTx == nil || txData == nil {
@@ -2091,7 +2110,7 @@ func (app *App) makeGigaDeliverTx(cache *gigaBlockCache) func(sdk.Context, abci.
 			return abci.ResponseDeliverTx{Code: 1, Log: "not an EVM transaction"}
 		}
 
-		result, err := app.executeEVMTxWithGigaExecutor(ctx, evmMsg, cache)
+		result, err := app.executeEVMTxWithGigaExecutor(ctx, tx, evmMsg, cache)
 		if err != nil {
 			// Check if this is a fail-fast error (Cosmos precompile interop detected)
 			if gigautils.ShouldExecutionAbort(err) {

app/app_test.go

@@ -8,6 +8,7 @@ import (
 	"math/big"
 	"reflect"
 	"regexp"
+	"strings"
 	"testing"
 	"time"
 
@@ -23,6 +24,7 @@ import (
 	"github.com/sei-protocol/sei-chain/app"
 	"github.com/sei-protocol/sei-chain/sei-cosmos/crypto/keys/secp256k1"
 	sdk "github.com/sei-protocol/sei-chain/sei-cosmos/types"
+	txtypes "github.com/sei-protocol/sei-chain/sei-cosmos/types/tx"
 	banktypes "github.com/sei-protocol/sei-chain/sei-cosmos/x/bank/types"
 	abci "github.com/sei-protocol/sei-chain/sei-tendermint/abci/types"
 	"github.com/sei-protocol/sei-chain/sei-tendermint/proto/tendermint/types"
@@ -512,6 +514,90 @@ func TestGetDeliverTxEntry(t *testing.T) {
 	require.NotNil(t, ap.GetDeliverTxEntry(ctx, 0, bz, nil))
 }
 
+func TestProcessTxsSynchronousGigaRejectsWrappedMemo(t *testing.T) {
+	tm := time.Now().UTC()
+	valPub := secp256k1.GenPrivKey().PubKey()
+	testWrapper := app.NewGigaTestWrapper(t, tm, valPub, false, false)
+
+	txBuilder := buildSignedLegacyEvmTxBuilder(t, testWrapper)
+	protoTx := txBuilder.GetTx().(interface{ GetProtoTx() *txtypes.Tx }).GetProtoTx()
+	protoTx.Body.Memo = "field bloat"
+
+	txBytes, err := testWrapper.App.GetTxConfig().TxEncoder()(txBuilder.GetTx())
+	require.NoError(t, err)
+
+	typedTxs := testWrapper.App.DecodeTransactionsConcurrently(testWrapper.Ctx, [][]byte{txBytes})
+	results := testWrapper.App.ProcessTxsSynchronousGiga(testWrapper.Ctx, [][]byte{txBytes}, typedTxs)
+
+	require.Len(t, results, 1)
+	require.Equal(t, uint32(1), results[0].Code)
+	require.Contains(t, results[0].Log, "memo must be empty")
+}
+
+func TestProcessTxsSynchronousGigaRejectsPaddedToField(t *testing.T) {
+	tm := time.Now().UTC()
+	valPub := secp256k1.GenPrivKey().PubKey()
+	testWrapper := app.NewGigaTestWrapper(t, tm, valPub, false, false)
+
+	chainID := sdk.NewInt(1)
+	gasTipCap := sdk.NewInt(1)
+	gasFeeCap := sdk.NewInt(1)
+	msg, err := evmtypes.NewMsgEVMTransaction(&ethtx.DynamicFeeTx{
+		ChainID:   &chainID,
+		GasTipCap: &gasTipCap,
+		GasFeeCap: &gasFeeCap,
+		GasLimit:  21000,
+		To:        "0x" + strings.Repeat("00", 20) + strings.Repeat("11", 20),
+	})
+	require.NoError(t, err)
+
+	txBuilder := testWrapper.App.GetTxConfig().NewTxBuilder()
+	require.NoError(t, txBuilder.SetMsgs(msg))
+	txBytes, err := testWrapper.App.GetTxConfig().TxEncoder()(txBuilder.GetTx())
+	require.NoError(t, err)
+
+	typedTxs := testWrapper.App.DecodeTransactionsConcurrently(testWrapper.Ctx, [][]byte{txBytes})
+	results := testWrapper.App.ProcessTxsSynchronousGiga(testWrapper.Ctx, [][]byte{txBytes}, typedTxs)
+
+	require.Len(t, results, 1)
+	require.Equal(t, uint32(1), results[0].Code)
+	require.Contains(t, results[0].Log, "invalid to address")
+}
+
+func buildSignedLegacyEvmTxBuilder(t *testing.T, testWrapper *app.TestWrapper) client.TxBuilder {
+	t.Helper()
+
+	privKey := testkeeper.MockPrivateKey()
+	testPrivHex := hex.EncodeToString(privKey.Bytes())
+	key, err := crypto.HexToECDSA(testPrivHex)
+	require.NoError(t, err)
+
+	to := new(common.Address)
+	copy(to[:], []byte("0x1234567890abcdef1234567890abcdef12345678"))
+	txData := ethtypes.LegacyTx{
+		Nonce:    1,
+		GasPrice: big.NewInt(10),
+		Gas:      1000,
+		To:       to,
+		Value:    big.NewInt(1000),
+		Data:     []byte("abc"),
+	}
+	chainCfg := evmtypes.DefaultChainConfig()
+	ethCfg := chainCfg.EthereumConfig(big.NewInt(config.DefaultChainID))
+	signer := ethtypes.MakeSigner(ethCfg, big.NewInt(1), uint64(123))
+	tx, err := ethtypes.SignTx(ethtypes.NewTx(&txData), signer, key)
+	require.NoError(t, err)
+
+	ethtxdata, err := ethtx.NewTxDataFromTx(tx)
+	require.NoError(t, err)
+	msg, err := evmtypes.NewMsgEVMTransaction(ethtxdata)
+	require.NoError(t, err)
+
+	txBuilder := testWrapper.App.GetTxConfig().NewTxBuilder()
+	require.NoError(t, txBuilder.SetMsgs(msg))
+	return txBuilder
+}
+
 func isSwaggerRouteAdded(router *mux.Router) bool {
 	var isAdded bool
 	err := router.Walk(func(route *mux.Route, router *mux.Router, ancestors []*mux.Route) error {

giga/deps/xevm/types/ethtx/access_list_tx.go

@@ -179,6 +179,18 @@ func (tx AccessListTx) Validate() error {
 			return errors.New("invalid to address")
 		}
 	}
+	if err := validateAccessList(tx.Accesses); err != nil {
+		return err
+	}
+	if err := validateSignatureValue("v", tx.V, 32); err != nil {
+		return err
+	}
+	if err := validateSignatureValue("r", tx.R, 32); err != nil {
+		return err
+	}
+	if err := validateSignatureValue("s", tx.S, 32); err != nil {
+		return err
+	}
 
 	chainID := tx.GetChainID()
 

giga/deps/xevm/types/ethtx/associate_tx.go

@@ -37,7 +37,18 @@ func (tx *AssociateTx) GetRawSignatureValues() (v, r, s *big.Int) {
 func (tx *AssociateTx) SetSignatureValues(_, _, _, _ *big.Int) { panic("not implemented") }
 
 func (tx *AssociateTx) AsEthereumData() ethtypes.TxData { panic("not implemented") }
-func (tx *AssociateTx) Validate() error                 { panic("not implemented") }
+func (tx *AssociateTx) Validate() error {
+	if err := validateSignatureValue("v", tx.V, 32); err != nil {
+		return err
+	}
+	if err := validateSignatureValue("r", tx.R, 32); err != nil {
+		return err
+	}
+	if err := validateSignatureValue("s", tx.S, 32); err != nil {
+		return err
+	}
+	return nil
+}
 
 func (tx *AssociateTx) Fee() *big.Int  { panic("not implemented") }
 func (tx *AssociateTx) Cost() *big.Int { panic("not implemented") }

giga/deps/xevm/types/ethtx/blob_tx.go

@@ -228,6 +228,18 @@ func (tx BlobTx) Validate() error {
 			return errors.New("invalid to address")
 		}
 	}
+	if err := validateAccessList(tx.Accesses); err != nil {
+		return err
+	}
+	if err := validateSignatureValue("v", tx.V, 32); err != nil {
+		return err
+	}
+	if err := validateSignatureValue("r", tx.R, 32); err != nil {
+		return err
+	}
+	if err := validateSignatureValue("s", tx.S, 32); err != nil {
+		return err
+	}
 
 	chainID := tx.GetChainID()
 

giga/deps/xevm/types/ethtx/dynamic_fee_tx.go

@@ -196,6 +196,18 @@ func (tx DynamicFeeTx) Validate() error {
 			return errors.New("invalid to address")
 		}
 	}
+	if err := validateAccessList(tx.Accesses); err != nil {
+		return err
+	}
+	if err := validateSignatureValue("v", tx.V, 32); err != nil {
+		return err
+	}
+	if err := validateSignatureValue("r", tx.R, 32); err != nil {
+		return err
+	}
+	if err := validateSignatureValue("s", tx.S, 32); err != nil {
+		return err
+	}
 
 	chainID := tx.GetChainID()
 

giga/deps/xevm/types/ethtx/legacy_tx.go

@@ -169,6 +169,15 @@ func (tx *LegacyTx) Validate() error {
 			return errors.New("invalid to address")
 		}
 	}
+	if err := validateSignatureValue("v", tx.V, 32); err != nil {
+		return err
+	}
+	if err := validateSignatureValue("r", tx.R, 32); err != nil {
+		return err
+	}
+	if err := validateSignatureValue("s", tx.S, 32); err != nil {
+		return err
+	}
 
 	chainID := tx.GetChainID()