fix(standards): pin the fee payment to the native asset at 1-to-1 rate - #3808
Merged
Conversation
`fee::pay_fee` built the TX_FEE note from a caller-supplied conversion info word and paid `ceil(fee_amount * rate_num / rate_den)` of the named faucet's asset, checking neither the faucet nor the rate. Nothing downstream re-checks the fee note either - the transaction epilogue and the batch and block kernels contain no fee logic - so the authentication procedure is the only place the paid amount is decided, and any authorized transaction could move an arbitrary amount of an arbitrary fungible asset out of the vault as a fee. The conversion has nothing to convert: the computed fee is always denominated in the chain's single native fee asset (`ProtocolConfig`, verified against the reference block), and `verification_base_fee` is a per-network constant copied from the parent block, so there is no dynamic pricing either. Every production call site already commits `FeeConversionInfo::one_to_one`. `pay_fee` now asserts that the committed conversion info equals `native_conversion_info`, which pins the payment faucet and the rate together and makes the paid amount exactly the computed fee. `convert_amount` stays public and keeps its coverage, moved to direct invocation from a transaction script now that `pay_fee` only ever calls it at 1/1. Closes #3763. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0186Lb3N8KP4N75jFtWab3X6
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0186Lb3N8KP4N75jFtWab3X6
mmagician
commented
Sep 4, 2026
Co-authored-by: Marti <marcin.gorny.94@protonmail.com>
mmagician
changed the title
mmagician
marked this pull request as ready for review
September 4, 2026 15:15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3763, and replaces the bound-based approach of #3797 / #3798 / #3802 with a one-line assert.
Until we have support for fees in multiple tokens, this is approach fixes the issue. Once we have this support, the multisig fee payment would need refactoring anyway - so let's stick with the simplest approach now.