feat(cketh): read EIP-7702 delegations of deposit addresses in one eth_call

Adds a third deployless batcher program next to the ERC-20 and ETH balance
batchers: it copies the first code word of each address with EXTCODECOPY and
returns one word per address, which classifies the address as not delegated,
delegated to a given delegate, or holding other code.

The tests could not be committed ahead of the implementation: every one of them
names an item introduced here, so the test-only commit would not compile.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X44H4nAU65nAexEUvG15MK

Author: gregorydemay

rs/ethereum/cketh/minter/src/balance_scan/batcher/mod.rs

@@ -53,7 +53,8 @@ const MAX_CODE_SIZE: usize = 24_576;
 /// [EIP-3860]: https://eips.ethereum.org/EIPS/eip-3860
 const MAX_INITCODE_SIZE: usize = 2 * MAX_CODE_SIZE;
 
-/// Maximum number of balance reads in a single deployless-batcher `eth_call`, for both batchers.
+/// Maximum number of entries in a single deployless-batcher `eth_call`, shared by all three
+/// batcher programs.
 ///
 /// A create-style `eth_call` is bounded at both ends: the initcode it carries is rejected beyond
 /// [`MAX_INITCODE_SIZE`] (EIP-3860), and the blob the program `RETURN`s is rejected beyond
@@ -74,11 +75,13 @@ const MAX_INITCODE_SIZE: usize = 2 * MAX_CODE_SIZE;
 /// whole-call failure re-does that chunk on the next tick — and a chunk that always exceeds a
 /// provider limit fails *every* time, permanently stalling its pairs.
 ///
-/// The value is derived from the ERC-20 encoding, yet it caps [`ETH_BATCHER_INITCODE`] batches
-/// too, with margin on both ends. The returned-blob term is shared — both programs return one
-/// word per entry — so the cap can never exceed `MAX_CODE_SIZE / WORD`; and the ETH initcode
-/// side is far looser than the ERC-20 one (one word per entry after a 78-byte program, so 1532
-/// reads) and never binds. `full_batch_of_eth_balance_reads_fits_both_node_limits` pins this.
+/// The value is derived from the ERC-20 encoding, yet it caps [`ETH_BATCHER_INITCODE`] and
+/// [`DELEGATION_BATCHER_INITCODE`] batches too, with margin on both ends. The returned-blob term
+/// is shared — all three programs return exactly one word per entry — so the cap can never
+/// exceed `MAX_CODE_SIZE / WORD`; and both single-word-argument programs have a far looser
+/// initcode side than the ERC-20 one (one word per entry after a 78- resp. 81-byte program, so
+/// 1532 entries) that never binds. `full_batch_of_eth_balance_reads_fits_both_node_limits` and
+/// `full_batch_of_delegation_reads_fits_both_node_limits` pin this.
 pub const MAX_CALLS_PER_BATCH: usize = {
     let by_initcode_size = (MAX_INITCODE_SIZE - BATCHER_INITCODE.len() - WORD) / (2 * WORD);
     let by_returned_code_size = MAX_CODE_SIZE / WORD;
@@ -109,6 +112,38 @@ pub const ETH_BATCHER_INITCODE: [u8; 78] = [
     0x61, 0x00, 0x0d, 0x56, 0x5b, 0x60, 0x00, 0x51, 0x60, 0x20, 0x02, 0x60, 0x60, 0xf3,
 ];
 
+/// Deployless delegation-batcher creation bytecode.
+///
+/// The sibling of [`ETH_BATCHER_INITCODE`] reading code instead of balances, executed the same
+/// way (create-style `eth_call`, `to` omitted). It reads its inputs from the calldata appended
+/// right after this bytecode (`[n][ address x n ]`, one 32-byte word each) and, for each address,
+/// copies the first 32 bytes of its code with `EXTCODECOPY` — which zero-pads beyond the code
+/// size, so every entry is a full word whether the account holds no code, an EIP-7702 designator
+/// (23 bytes) or a contract. No sub-calls, so like the ETH batcher nothing here can fail and the
+/// program has no revert path. It returns the prefixes as a flat `n x 32`-byte array (no ABI
+/// array header), classified positionally by [`decode_delegation_batch`].
+///
+/// The program is fixed regardless of `n` (only the appended args grow). It was assembled from
+/// the opcode listing in `delegation_initcode_matches_readable_assembly` and validated against a
+/// live anvil node; see `rs/ethereum/cketh/minter/tests/deposit_from_cex.rs`.
+pub const DELEGATION_BATCHER_INITCODE: [u8; 81] = [
+    0x60, 0x20, 0x61, 0x00, 0x51, 0x60, 0x00, 0x39, 0x60, 0x00, 0x60, 0x20, 0x52, 0x5b, 0x60, 0x00,
+    0x51, 0x60, 0x20, 0x51, 0x10, 0x15, 0x61, 0x00, 0x47, 0x57, 0x60, 0x20, 0x60, 0x20, 0x51, 0x60,
+    0x20, 0x02, 0x61, 0x00, 0x71, 0x01, 0x60, 0x40, 0x39, 0x60, 0x20, 0x60, 0x00, 0x60, 0x20, 0x51,
+    0x60, 0x20, 0x02, 0x60, 0x60, 0x01, 0x60, 0x40, 0x51, 0x3c, 0x60, 0x20, 0x51, 0x60, 0x01, 0x01,
+    0x60, 0x20, 0x52, 0x61, 0x00, 0x0d, 0x56, 0x5b, 0x60, 0x00, 0x51, 0x60, 0x20, 0x02, 0x60, 0x60,
+    0xf3,
+];
+
+/// Prefix of the code an EIP-7702 delegation designator installs at an authority, per
+/// [EIP-7702]: the code of a delegated account is exactly `0xef0100 || delegate`.
+///
+/// [EIP-7702]: https://eips.ethereum.org/EIPS/eip-7702
+const DELEGATION_DESIGNATOR_PREFIX: [u8; 3] = [0xef, 0x01, 0x00];
+
+/// Length of an EIP-7702 delegation designator: its 3-byte prefix plus the 20-byte delegate.
+const DELEGATION_DESIGNATOR_LEN: usize = DELEGATION_DESIGNATOR_PREFIX.len() + 20;
+
 /// Function selector for `balanceOf(address)`, i.e. `keccak256("balanceOf(address)")[..4]`.
 /// Embedded in [`BATCHER_INITCODE`] right after its leading `PUSH32` opcode; asserted by tests.
 #[cfg(test)]
@@ -179,6 +214,80 @@ pub fn decode_balance_batch(ret: &[u8], n: usize) -> Result<Vec<Erc20Value>, Bat
     Ok(balances)
 }
 
+/// What the code at a deposit address says about its EIP-7702 delegation.
+#[derive(Clone, Copy, Eq, PartialEq, Debug)]
+pub enum Delegation {
+    /// The address holds no code, so no delegation is installed.
+    NotDelegated,
+    /// The address holds an EIP-7702 delegation designator naming this delegate.
+    Delegated(Address),
+    /// The address holds code that is not a delegation designator, i.e. a deployed contract.
+    /// Such an address must never be swept: a tuple cannot be applied to it.
+    Other,
+}
+
+/// Build the create-call `input` for a batch of delegation reads:
+/// `DELEGATION_BATCHER_INITCODE ++ [n] ++ [ address x n ]`, every value a 32-byte word.
+pub fn encode_delegation_batch(addresses: &[DepositAddress]) -> Vec<u8> {
+    let mut out =
+        Vec::with_capacity(DELEGATION_BATCHER_INITCODE.len() + WORD * (1 + addresses.len()));
+    out.extend_from_slice(&DELEGATION_BATCHER_INITCODE);
+    out.extend_from_slice(&word_from_usize(addresses.len()));
+    for address in addresses {
+        out.extend_from_slice(&left_padded_address(address.as_address()));
+    }
+    out
+}
+
+/// Decode the flat `n x 32`-byte return blob of [`DELEGATION_BATCHER_INITCODE`] into `n`
+/// delegations, in call order.
+///
+/// Each word is the first 32 bytes of an account's code, zero-padded beyond its size, which
+/// classifies the account unambiguously:
+/// * an all-zero word means no code at all, since [EIP-3541] forbids deploying code starting
+///   with `0xef` and a shorter non-empty code would still carry a non-zero first byte;
+/// * `0xef0100 || delegate || 9 zero bytes` is a code of exactly 23 bytes whose only possible
+///   origin is an applied [EIP-7702] authorization tuple — again because EIP-3541 keeps every
+///   deployed contract out of the `0xef` space;
+/// * anything else is deployed contract code.
+///
+/// Returns `Err` if the blob length is not exactly `n` words; never panics.
+///
+/// [EIP-3541]: https://eips.ethereum.org/EIPS/eip-3541
+/// [EIP-7702]: https://eips.ethereum.org/EIPS/eip-7702
+pub fn decode_delegation_batch(
+    ret: &[u8],
+    n: usize,
+) -> Result<Vec<Delegation>, BatcherDecodeError> {
+    let expected = n * WORD;
+    if ret.len() != expected {
+        return Err(BatcherDecodeError::WrongLength {
+            expected,
+            got: ret.len(),
+        });
+    }
+    Ok(ret
+        .chunks_exact(WORD)
+        .map(|word| classify_code_prefix(word.try_into().expect("BUG: chunk is exactly one word")))
+        .collect())
+}
+
+fn classify_code_prefix(prefix: &[u8; WORD]) -> Delegation {
+    if prefix.iter().all(|byte| *byte == 0) {
+        return Delegation::NotDelegated;
+    }
+    let (designator, padding) = prefix.split_at(DELEGATION_DESIGNATOR_LEN);
+    let is_designator = designator.starts_with(&DELEGATION_DESIGNATOR_PREFIX)
+        && padding.iter().all(|byte| *byte == 0);
+    if !is_designator {
+        return Delegation::Other;
+    }
+    let delegate: [u8; 20] = designator[DELEGATION_DESIGNATOR_PREFIX.len()..]
+        .try_into()
+        .expect("BUG: a designator holds exactly 20 address bytes");
+    Delegation::Delegated(Address::new(delegate))
+}
+
 fn left_padded_address(address: &Address) -> [u8; WORD] {
     let mut word = [0_u8; WORD];
     word[WORD - 20..].copy_from_slice(address.as_ref());

rs/ethereum/cketh/minter/src/balance_scan/batcher/tests.rs

@@ -118,6 +118,193 @@ fn eth_initcode_matches_readable_assembly() {
     assert_eq!(FIRST_HOLDER, ARGS_START + WORD as u16);
 }
 
+#[test]
+fn delegation_initcode_matches_readable_assembly() {
+    use Op::*;
+
+    // The byte-for-byte source of truth for DELEGATION_BATCHER_INITCODE, as a commented EVM
+    // assembly listing. A create-style `eth_call` runs this as init code; it reads its args
+    // appended right after the code (`[n][ address x n ]`, from code offset ARGS_START) and
+    // RETURNs the first 32 bytes of each address' code, copied with EXTCODECOPY and zero-padded
+    // beyond the code size. No sub-calls, so like the ETH batcher the program has no revert path.
+    //
+    // Memory layout (all offsets in bytes):
+    //   [0x00] n    [0x20] loop counter i    [0x40] address (rewritten per iteration)
+    //   [OUTPUT..]  returned code prefixes (n x 32 bytes)
+    const ARGS_START: u16 = 0x51; // == DELEGATION_BATCHER_INITCODE.len(): the `n` word sits right after the code
+    const FIRST_ADDRESS: u16 = 0x71; // == ARGS_START + WORD: first address word
+    const OUTPUT: u8 = 0x60; // start of the returned code prefixes in memory
+    const LOOP: u16 = 0x0d; // JUMPDEST at the top of the per-address loop
+    const DONE: u16 = 0x47; // JUMPDEST for the RETURN path
+
+    #[rustfmt::skip]
+    let program = assemble(&[
+        // mem[0x00] = n  (one word copied from code[ARGS_START])
+        Push1(0x20), Push2(ARGS_START), Push1(0x00), Codecopy,
+        // mem[0x20] = i = 0
+        Push1(0x00), Push1(0x20), Mstore,
+        Jumpdest, // LOOP
+        // if !(i < n) goto DONE
+        Push1(0x00), Mload, Push1(0x20), Mload, Lt, IsZero, Push2(DONE), Jumpi,
+        // mem[0x40] = address = code[FIRST_ADDRESS + i * 0x20]
+        Push1(0x20), Push1(0x20), Mload, Push1(0x20), Mul, Push2(FIRST_ADDRESS), Add,
+        Push1(0x40), Codecopy,
+        // EXTCODECOPY(address, dest = OUTPUT + i * 0x20, offset = 0, size = 0x20)
+        Push1(0x20), Push1(0x00),
+        Push1(0x20), Mload, Push1(0x20), Mul, Push1(OUTPUT), Add,
+        Push1(0x40), Mload, ExtCodeCopy,
+        // i += 1; goto LOOP
+        Push1(0x20), Mload, Push1(0x01), Add, Push1(0x20), Mstore, Push2(LOOP), Jump,
+        Jumpdest, // DONE: RETURN(OUTPUT, n * 0x20)
+        Push1(0x00), Mload, Push1(0x20), Mul, Push1(OUTPUT), Return,
+    ]);
+
+    assert_eq!(program, DELEGATION_BATCHER_INITCODE);
+    // Offsets baked into the code must match the actual layout.
+    assert_eq!(ARGS_START as usize, DELEGATION_BATCHER_INITCODE.len());
+    assert_eq!(FIRST_ADDRESS, ARGS_START + WORD as u16);
+}
+
+#[test]
+fn encode_delegation_single_address_golden_vector() {
+    let encoded = encode_delegation_batch(&[HOLDER0]);
+
+    assert_eq!(encoded.len(), DELEGATION_BATCHER_INITCODE.len() + 2 * WORD);
+    assert_eq!(
+        &encoded[..DELEGATION_BATCHER_INITCODE.len()],
+        &DELEGATION_BATCHER_INITCODE
+    );
+    let args = &encoded[DELEGATION_BATCHER_INITCODE.len()..];
+    assert_eq!(&args[0..32], &word(1)); // n
+    assert_eq!(&args[32..64], &left_padded_address(HOLDER0.as_address()));
+}
+
+#[test]
+fn encode_delegation_two_addresses_layout() {
+    let encoded = encode_delegation_batch(&[HOLDER0, HOLDER1]);
+
+    assert_eq!(
+        encoded.len(),
+        DELEGATION_BATCHER_INITCODE.len() + WORD * (1 + 2)
+    );
+    let args = &encoded[DELEGATION_BATCHER_INITCODE.len()..];
+    assert_eq!(&args[0..32], &word(2));
+    assert_eq!(&args[32..64], &left_padded_address(HOLDER0.as_address()));
+    assert_eq!(&args[64..96], &left_padded_address(HOLDER1.as_address()));
+}
+
+#[test]
+fn full_batch_of_delegation_reads_fits_both_node_limits() {
+    let addresses: Vec<DepositAddress> = (0..MAX_CALLS_PER_BATCH)
+        .map(|index| DepositAddress::new(Address::new([index as u8; 20])))
+        .collect();
+
+    let returned_blob_size = addresses.len() * WORD;
+
+    assert!(encode_delegation_batch(&addresses).len() <= MAX_INITCODE_SIZE);
+    assert!(returned_blob_size <= MAX_CODE_SIZE);
+}
+
+#[test]
+fn decode_delegation_empty_word_is_not_delegated() {
+    assert_eq!(
+        decode_delegation_batch(&[0_u8; WORD], 1).unwrap(),
+        vec![Delegation::NotDelegated]
+    );
+}
+
+#[test]
+fn decode_delegation_designator_is_delegated() {
+    let delegate = Address::new([0x77; 20]);
+
+    assert_eq!(
+        decode_delegation_batch(&designator_word(&delegate), 1).unwrap(),
+        vec![Delegation::Delegated(delegate)]
+    );
+}
+
+#[test]
+fn decode_delegation_designator_with_a_dirty_tail_is_other() {
+    let mut word = designator_word(&Address::new([0x77; 20]));
+    *word.last_mut().unwrap() = 0x01;
+
+    assert_eq!(
+        decode_delegation_batch(&word, 1).unwrap(),
+        vec![Delegation::Other]
+    );
+}
+
+#[test]
+fn decode_delegation_eof_code_is_other() {
+    let mut word = [0_u8; WORD];
+    word[..2].copy_from_slice(&[0xef, 0x00]);
+
+    assert_eq!(
+        decode_delegation_batch(&word, 1).unwrap(),
+        vec![Delegation::Other]
+    );
+}
+
+#[test]
+fn decode_delegation_contract_code_is_other() {
+    let word = [0x60_u8; WORD];
+
+    assert_eq!(
+        decode_delegation_batch(&word, 1).unwrap(),
+        vec![Delegation::Other]
+    );
+}
+
+#[test]
+fn decode_delegation_batch_keeps_the_call_order() {
+    let delegate = Address::new([0x88; 20]);
+    let mut ret = Vec::new();
+    ret.extend_from_slice(&[0_u8; WORD]);
+    ret.extend_from_slice(&designator_word(&delegate));
+    ret.extend_from_slice(&[0xfe_u8; WORD]);
+
+    assert_eq!(
+        decode_delegation_batch(&ret, 3).unwrap(),
+        vec![
+            Delegation::NotDelegated,
+            Delegation::Delegated(delegate),
+            Delegation::Other,
+        ]
+    );
+}
+
+#[test]
+fn decode_delegation_empty_batch_is_ok() {
+    assert_eq!(
+        decode_delegation_batch(&[], 0).unwrap(),
+        Vec::<Delegation>::new()
+    );
+    assert_eq!(
+        encode_delegation_batch(&[]).len(),
+        DELEGATION_BATCHER_INITCODE.len() + WORD
+    );
+}
+
+#[test]
+fn decode_delegation_wrong_length_is_err() {
+    let ret = vec![0_u8; WORD + 1];
+
+    assert_eq!(
+        decode_delegation_batch(&ret, 2),
+        Err(BatcherDecodeError::WrongLength {
+            expected: 2 * WORD,
+            got: WORD + 1,
+        })
+    );
+}
+
+fn designator_word(delegate: &Address) -> [u8; WORD] {
+    let mut word = [0_u8; WORD];
+    word[..3].copy_from_slice(&[0xef, 0x01, 0x00]);
+    word[3..23].copy_from_slice(delegate.as_ref());
+    word
+}
+
 #[test]
 fn encode_eth_single_holder_golden_vector() {
     let encoded = encode_eth_balance_batch(&[HOLDER0]);
@@ -258,6 +445,7 @@ enum Op {
     Eq,
     IsZero,
     Codecopy,
+    ExtCodeCopy,
     Gas,
     Mload,
     Mstore,
@@ -291,6 +479,7 @@ fn assemble(ops: &[Op]) -> Vec<u8> {
             Op::IsZero => out.push(0x15),
             Op::Balance => out.push(0x31),
             Op::Codecopy => out.push(0x39),
+            Op::ExtCodeCopy => out.push(0x3c),
             Op::Gas => out.push(0x5a),
             Op::Mload => out.push(0x51),
             Op::Mstore => out.push(0x52),

rs/ethereum/cketh/minter/src/balance_scan/mod.rs

@@ -371,7 +371,7 @@ const MIN_DEPOSITS: &[(Address, Erc20Value)] = &[
     ), // ckSepoliaPEPE
 ];
 
-fn call_args(input: Vec<u8>, block: BlockNumber) -> evm_rpc_types::CallArgs {
+pub(crate) fn call_args(input: Vec<u8>, block: BlockNumber) -> evm_rpc_types::CallArgs {
     evm_rpc_types::CallArgs {
         transaction: evm_rpc_types::TransactionRequest {
             // Create-style call (no `to`): the node runs `input` as init code and returns its