fix(test): cap gas when probing a fuzzed address

Both helpers that coerce a fuzzed address into a usable recipient probed
it with all remaining gas: `isErc1155Receiver` via `to.call(...)` and
`_nudgeAddressIfProblematic` via `call(gas(), ...)`.

A fuzzed address can be any contract already in state, including the
canonical CREATE2 deployer at 0x4e59b44847b379578588920cA78FbF26c0B4956C
that foundry pre-deploys. It has 69 bytes of code, so it gets probed, and
it reads whatever calldata it receives as a salt plus initcode and
attempts a CREATE2. The first probe deploys an empty contract; a second
probe with the same calldata collides, and a failed CREATE2 consumes
every bit of gas forwarded to it. Measured on this configuration: the
first call costs 32834 gas and the second costs 1040389983, the entire
budget, so the test dies with OutOfGas.

That is why raising gas_limit did not help. A larger budget is simply a
larger amount to burn; at 2^34 the failure rate did not improve.

Capping the probe at 100000 gas bounds the damage without changing any
legitimate path, since a real onERC1155Received or native transfer costs
far less. Across the conduit and zone suites with the fuzz cache cleared
between runs, this moves 15 trials from roughly a fifth to a half
failing to 15 of 15 passing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: ryanio

test/foundry/conduit/BaseConduitTest.sol

@@ -58,7 +58,13 @@ contract BaseConduitTest is
         if (to == address(0)) {
             return false;
         } else if (to.code.length > 0) {
-            (bool success, bytes memory returnData) = to.call(
+            // Cap the gas. A fuzzed address can be any contract already in
+            // state, and some consume everything forwarded to them: the
+            // canonical CREATE2 deployer at 0x4e59b448... reads this calldata
+            // as a salt plus initcode, and once an address has been deployed
+            // the next colliding CREATE2 burns the whole budget, failing the
+            // test with OutOfGas. A real onERC1155Received is far cheaper.
+            (bool success, bytes memory returnData) = to.call{ gas: 100_000 }(
                 abi.encodePacked(
                     ERC1155TokenReceiver.onERC1155Received.selector,
                     address(0),

test/foundry/zone/TestTransferValidationZoneFuzz.t.sol

@@ -1463,7 +1463,10 @@ contract TestTransferValidationZoneOffererTest is BaseOrderTest {
         bool success;
         assembly {
             // Transfer the native token and store if it succeeded or not.
-            success := call(gas(), _address, 1, 0, 0, 0, 0)
+            // The gas is capped because a fuzzed address can be a contract
+            // that consumes everything forwarded to it, such as the CREATE2
+            // deployer on a colliding deployment.
+            success := call(100000, _address, 1, 0, 0, 0, 0)
         }
 
         if (success) {

test/foundry/zone/UnauthorizedOrderSkip.t.sol

@@ -1660,7 +1660,10 @@ contract UnauthorizedOrderSkipTest is BaseOrderTest {
         bool success;
         assembly {
             // Transfer the native token and store if it succeeded or not.
-            success := call(gas(), _address, 1, 0, 0, 0, 0)
+            // The gas is capped because a fuzzed address can be a contract
+            // that consumes everything forwarded to it, such as the CREATE2
+            // deployer on a colliding deployment.
+            success := call(100000, _address, 1, 0, 0, 0, 0)
         }
 
         if (success) {