Move HashedAddressChecker to addressfilter

Author: MishkaRogachev

txfilter/hashed_filter.go address-filter/address_checker.gotxfilter/hashed_filter.go renamed to address-filter/address_checker.go

@@ -1,16 +1,14 @@
 // Copyright 2026, Offchain Labs, Inc.
 // For license information, see https://github.com/OffchainLabs/nitro/blob/master/LICENSE.md
 
-package txfilter
+package addressfilter
 
 import (
 	"sync"
 	"sync/atomic"
 
 	"github.com/ethereum/go-ethereum/common"
 	"github.com/ethereum/go-ethereum/core/state"
-
-	"github.com/offchainlabs/nitro/restrictedaddr"
 )
 
 // Default parameters for HashedAddressChecker, used in NewDefaultHashedAddressChecker
@@ -24,7 +22,7 @@ const (
 // the HashStore; this checker only manages async execution and per-tx
 // aggregation.
 type HashedAddressChecker struct {
-	store    *restrictedaddr.HashStore
+	store    *HashStore
 	workChan chan workItem
 }
 
@@ -44,7 +42,7 @@ type workItem struct {
 
 // NewHashedAddressChecker constructs a new checker backed by a HashStore.
 func NewHashedAddressChecker(
-	store *restrictedaddr.HashStore,
+	store *HashStore,
 	workerCount int,
 	queueSize int,
 ) *HashedAddressChecker {
@@ -60,7 +58,7 @@ func NewHashedAddressChecker(
 	return c
 }
 
-func NewDefaultHashedAddressChecker(store *restrictedaddr.HashStore) *HashedAddressChecker {
+func NewDefaultHashedAddressChecker(store *HashStore) *HashedAddressChecker {
 	return NewHashedAddressChecker(
 		store,
 		restrictedAddrWorkerCount,
@@ -83,11 +81,13 @@ func (c *HashedAddressChecker) worker() {
 }
 
 func (s *HashedAddressCheckerState) TouchAddress(addr common.Address) {
+	s.pending.Add(1)
 	select {
 	case s.checker.workChan <- workItem{addr: addr, state: s}:
-		s.pending.Add(1)
+		// ok
 	default:
-		// queue full: drop work conservatively
+		// queue full: drop check (fail-open, false negative possible)
+		s.pending.Done()
 	}
 }
 

txfilter/hashed_filter_test.go address-filter/address_checker_test.gotxfilter/hashed_filter_test.go renamed to address-filter/address_checker_test.go

@@ -1,7 +1,7 @@
 // Copyright 2026, Offchain Labs, Inc.
 // For license information, see https://github.com/OffchainLabs/nitro/blob/master/LICENSE.md
 
-package txfilter
+package addressfilter
 
 import (
 	"crypto/sha256"
@@ -12,8 +12,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/ethereum/go-ethereum/common"
-
-	"github.com/offchainlabs/nitro/restrictedaddr"
 )
 
 func mustState(t *testing.T, s any) *HashedAddressCheckerState {
@@ -29,10 +27,10 @@ func TestHashedAddressCheckerSimple(t *testing.T) {
 	addrFiltered := common.HexToAddress("0x000000000000000000000000000000000000dead")
 	addrAllowed := common.HexToAddress("0x000000000000000000000000000000000000beef")
 
-	store := restrictedaddr.NewHashStore()
+	store := NewHashStore()
 
-	filteredHash := sha256.Sum256(append(salt, addrFiltered.Bytes()...))
-	store.Load(salt, [][32]byte{filteredHash}, "test")
+	hash := sha256.Sum256(append(salt, addrFiltered.Bytes()...))
+	store.Load(salt, []common.Hash{hash}, "test")
 
 	checker := NewDefaultHashedAddressChecker(store)
 
@@ -80,15 +78,15 @@ func TestHashedAddressCheckerHeavy(t *testing.T) {
 
 	const filteredCount = 500
 	filteredAddrs := make([]common.Address, filteredCount)
-	filteredHashes := make([][32]byte, filteredCount)
+	filteredHashes := make([]common.Hash, filteredCount)
 
 	for i := range filteredAddrs {
 		addr := common.BytesToAddress([]byte{byte(i + 1)})
 		filteredAddrs[i] = addr
 		filteredHashes[i] = sha256.Sum256(append(salt, addr.Bytes()...))
 	}
 
-	store := restrictedaddr.NewHashStore()
+	store := NewHashStore()
 	store.Load(salt, filteredHashes, "heavy")
 
 	checker := NewDefaultHashedAddressChecker(store)

address-filter/service.go

@@ -98,3 +98,7 @@ func (s *Service) GetHashStoreDigest() string {
 func (s *Service) GetLoadedAt() time.Time {
 	return s.store.LoadedAt()
 }
+
+func (s *Service) GetStore() *HashStore {
+	return s.store
+}

execution/gethexec/node.go

@@ -18,6 +18,7 @@ import (
 	"github.com/ethereum/go-ethereum/common"
 	"github.com/ethereum/go-ethereum/core"
 	"github.com/ethereum/go-ethereum/core/rawdb"
+	"github.com/ethereum/go-ethereum/core/state"
 	"github.com/ethereum/go-ethereum/core/types"
 	"github.com/ethereum/go-ethereum/eth"
 	"github.com/ethereum/go-ethereum/eth/filters"
@@ -370,6 +371,12 @@ func CreateExecutionNode(
 		return nil, fmt.Errorf("failed to create restricted addr service: %w", err)
 	}
 
+	var addressChecker state.AddressChecker
+	if addressFilterService != nil {
+		addressChecker = addressfilter.NewDefaultHashedAddressChecker(addressFilterService.GetStore())
+		execEngine.SetAddressChecker(addressChecker)
+	}
+
 	execNode := &ExecutionNode{
 		ExecutionDB:              executionDB,
 		Backend:                  backend,

system_tests/tx_address_filter_test.go

@@ -13,9 +13,8 @@ import (
 	"github.com/ethereum/go-ethereum/common"
 	"github.com/ethereum/go-ethereum/crypto"
 
-	"github.com/offchainlabs/nitro/restrictedaddr"
+	addressfilter "github.com/offchainlabs/nitro/address-filter"
 	"github.com/offchainlabs/nitro/solgen/go/localgen"
-	"github.com/offchainlabs/nitro/txfilter"
 )
 
 func isFilteredError(err error) bool {
@@ -25,17 +24,17 @@ func isFilteredError(err error) bool {
 	return strings.Contains(err.Error(), "internal error")
 }
 
-func newHashedChecker(addrs []common.Address) *txfilter.HashedAddressChecker {
-	store := restrictedaddr.NewHashStore()
+func newHashedChecker(addrs []common.Address) *addressfilter.HashedAddressChecker {
+	store := addressfilter.NewHashStore()
 	if len(addrs) > 0 {
 		salt := []byte("test-salt")
-		hashes := make([][32]byte, len(addrs))
+		hashes := make([]common.Hash, len(addrs))
 		for i, addr := range addrs {
 			hashes[i] = sha256.Sum256(append(salt, addr.Bytes()...))
 		}
 		store.Load(salt, hashes, "test")
 	}
-	return txfilter.NewDefaultHashedAddressChecker(store)
+	return addressfilter.NewDefaultHashedAddressChecker(store)
 }
 
 func TestAddressFilterDirectTransfer(t *testing.T) {