feat: Add more protection

Author: howjmay

packages/evm/jsonrpc/jsonrpctest/jsonrpc_test.go

@@ -1380,7 +1380,7 @@ func TestEIP1559DynamicFeeTransaction(t *testing.T) {
 
 	// Common setup for both test approaches
 	maxFeePerGas := new(big.Int).Mul(env.MustGetGasPrice(), big.NewInt(2)) // 2x base fee
-	maxPriorityFeePerGas := big.NewInt(1000000000)                         // 1 Gwei tip
+	maxPriorityFeePerGas := big.NewInt(10000000000)                        // 1 Gwei tip
 
 	t.Run("native geth type", func(t *testing.T) {
 		// Test using eth_sendRawTransaction with manually constructed DynamicFeeTx
@@ -1458,7 +1458,7 @@ func TestEIP1559DynamicFeeTransactionWithAccessList(t *testing.T) {
 	require.NoError(t, err)
 
 	maxFeePerGas := new(big.Int).Mul(env.MustGetGasPrice(), big.NewInt(2))
-	maxPriorityFeePerGas := big.NewInt(1000000000)
+	maxPriorityFeePerGas := big.NewInt(10000000000)
 	accessList := types.AccessList{{Address: contractAddr, StorageKeys: []common.Hash{common.HexToHash("0x0")}}}
 
 	t.Run("native geth type", func(t *testing.T) {
@@ -1550,7 +1550,7 @@ func TestEIP4844BlobTransaction(t *testing.T) {
 	blobHashes := sidecar.BlobHashes()
 
 	maxFeePerGas := new(big.Int).Mul(env.MustGetGasPrice(), big.NewInt(2))
-	maxPriorityFeePerGas := big.NewInt(1000000000)
+	maxPriorityFeePerGas := big.NewInt(10000000000)
 	blobFeeCap := maxFeePerGas // Same as maxFeePerGas for simplicity
 
 	t.Run("native geth type", func(t *testing.T) {
@@ -1565,7 +1565,7 @@ func TestEIP4844BlobTransaction(t *testing.T) {
 			Value:      uint256.NewInt(2000),
 			BlobFeeCap: uint256.MustFromBig(maxFeePerGas),
 			BlobHashes: blobHashes,
-			Sidecar:    sidecar,
+			// Sidecar:    sidecar, // includes sidecar will make the blob tx exceeds tx size limit
 		}
 
 		signedBlobTx, err := types.SignTx(types.NewTx(blobTx), env.Signer(), from)
@@ -1669,10 +1669,280 @@ func TestInvalidGasPriceConfiguration(t *testing.T) {
 		GasPrice:             (*hexutil.Big)(env.MustGetGasPrice()),
 		Value:                (*hexutil.Big)(big.NewInt(1000)),
 		MaxFeePerGas:         (*hexutil.Big)(env.MustGetGasPrice()),
-		MaxPriorityFeePerGas: (*hexutil.Big)(big.NewInt(1000000000)),
+		MaxPriorityFeePerGas: (*hexutil.Big)(big.NewInt(10000000000)),
 	}
 
 	_, err := env.SendTransaction(args)
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "both gasPrice and (maxFeePerGas or maxPriorityFeePerGas) specified")
 }
+
+// TestSendRawTransactionValidation tests the security validations in SendRawTransaction
+func TestSendRawTransactionValidation(t *testing.T) {
+	env := newSoloTestEnv(t)
+
+	t.Run("empty transaction data", func(t *testing.T) {
+		var txHash common.Hash
+		err := env.RawClient.Call(&txHash, "eth_sendRawTransaction", hexutil.Bytes{})
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "empty transaction data")
+	})
+
+	t.Run("oversized transaction data", func(t *testing.T) {
+		// Create a transaction larger than 128KB
+		oversizedData := make([]byte, 130*1024)
+		var txHash common.Hash
+		err := env.RawClient.Call(&txHash, "eth_sendRawTransaction", hexutil.Bytes(oversizedData))
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "transaction size")
+		require.Contains(t, err.Error(), "exceeds maximum")
+	})
+
+	t.Run("invalid transaction encoding", func(t *testing.T) {
+		// Invalid RLP/binary data
+		invalidData := []byte{0xff, 0xff, 0xff}
+		var txHash common.Hash
+		err := env.RawClient.Call(&txHash, "eth_sendRawTransaction", hexutil.Bytes(invalidData))
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid transaction encoding")
+	})
+
+	t.Run("dynamic fee transaction validation", func(t *testing.T) {
+		from, fromAddr := env.NewAccountWithL2Funds()
+		env.accountManager.Add(from)
+		_, toAddr := env.NewAccountWithL2Funds()
+
+		// Create a dynamic fee transaction with zero gas limit (invalid)
+		dynamicTx := &types.DynamicFeeTx{
+			ChainID:   big.NewInt(int64(env.ChainID)),
+			Nonce:     env.NonceAt(fromAddr),
+			GasFeeCap: big.NewInt(10000000000),
+			GasTipCap: big.NewInt(500000000),
+			Gas:       0, // Invalid: zero gas limit
+			To:        &toAddr,
+			Value:     big.NewInt(1000),
+		}
+
+		signedTx, err := types.SignTx(types.NewTx(dynamicTx), env.Signer(), from)
+		require.NoError(t, err)
+
+		rawBytes, err := signedTx.MarshalBinary()
+		require.NoError(t, err)
+
+		var txHash common.Hash
+		err = env.RawClient.Call(&txHash, "eth_sendRawTransaction", hexutil.Bytes(rawBytes))
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "transaction gas limit cannot be zero")
+	})
+
+	t.Run("blob transaction validation", func(t *testing.T) {
+		from, fromAddr := env.NewAccountWithL2Funds()
+		env.accountManager.Add(from)
+
+		// Create a blob transaction with no blobs (invalid)
+		_, toAddr := env.NewAccountWithL2Funds()
+		blobTx := &types.BlobTx{
+			ChainID:    uint256.NewInt(uint64(env.ChainID)),
+			Nonce:      env.NonceAt(fromAddr),
+			GasFeeCap:  uint256.NewInt(2000000000),
+			GasTipCap:  uint256.NewInt(10000000000),
+			Gas:        21000,
+			To:         toAddr,
+			Value:      uint256.NewInt(1000),
+			BlobFeeCap: uint256.NewInt(10000000000),
+			BlobHashes: []common.Hash{}, // Invalid: blob tx must contain at least one blob
+		}
+
+		signedTx, err := types.SignTx(types.NewTx(blobTx), env.Signer(), from)
+		require.NoError(t, err)
+
+		rawBytes, err := signedTx.MarshalBinary()
+		require.NoError(t, err)
+
+		var txHash common.Hash
+		err = env.RawClient.Call(&txHash, "eth_sendRawTransaction", hexutil.Bytes(rawBytes))
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "blob transaction must contain at least one blob")
+	})
+}
+
+// TestSendRawTransactionSecurityHardening tests advanced security validations
+func TestSendRawTransactionSecurityHardening(t *testing.T) {
+	env := newSoloTestEnv(t)
+
+	t.Run("malformed RLP structure", func(t *testing.T) {
+		// Create deeply nested RLP structure to test complexity validation
+		malformedRLP := []byte{0xc0} // Empty list
+		for i := 0; i < 20; i++ {    // Create deep nesting
+			malformedRLP = append([]byte{0xc1}, malformedRLP...)
+		}
+
+		var txHash common.Hash
+		err := env.RawClient.Call(&txHash, "eth_sendRawTransaction", hexutil.Bytes(malformedRLP))
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "RLP structure too deep")
+	})
+
+	t.Run("invalid transaction type", func(t *testing.T) {
+		// Test unsupported transaction type
+		invalidTypeData := []byte{0x7f}                                 // Unsupported type 0x7f
+		invalidTypeData = append(invalidTypeData, make([]byte, 100)...) // Add some payload
+
+		var txHash common.Hash
+		err := env.RawClient.Call(&txHash, "eth_sendRawTransaction", hexutil.Bytes(invalidTypeData))
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "unsupported transaction type: 0x7f")
+	})
+
+	t.Run("malicious legacy type as typed", func(t *testing.T) {
+		// Test invalid typed transaction with legacy type 0x00
+		maliciousData := []byte{0x00, 0xc0} // Type 0x00 with empty payload
+
+		var txHash common.Hash
+		err := env.RawClient.Call(&txHash, "eth_sendRawTransaction", hexutil.Bytes(maliciousData))
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "invalid typed transaction: legacy type 0x00")
+	})
+
+	t.Run("extremely large gas limit", func(t *testing.T) {
+		from, fromAddr := env.NewAccountWithL2Funds()
+		env.accountManager.Add(from)
+		_, toAddr := env.NewAccountWithL2Funds()
+
+		// Create transaction with extremely large gas limit
+		maliciousTx := &types.LegacyTx{
+			Nonce:    env.NonceAt(fromAddr),
+			GasPrice: env.MustGetGasPrice(),
+			Gas:      40000000, // 40M gas - exceeds our 30M limit
+			To:       &toAddr,
+			Value:    big.NewInt(1000),
+		}
+
+		signedTx, err := types.SignTx(types.NewTx(maliciousTx), env.Signer(), from)
+		require.NoError(t, err)
+
+		rawBytes, err := signedTx.MarshalBinary()
+		require.NoError(t, err)
+
+		var txHash common.Hash
+		err = env.RawClient.Call(&txHash, "eth_sendRawTransaction", hexutil.Bytes(rawBytes))
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "transaction gas limit")
+		require.Contains(t, err.Error(), "exceeds maximum")
+	})
+
+	t.Run("extremely large data payload", func(t *testing.T) {
+		from, fromAddr := env.NewAccountWithL2Funds()
+		env.accountManager.Add(from)
+		_, toAddr := env.NewAccountWithL2Funds()
+
+		// Create transaction with extremely large data payload
+		largeData := make([]byte, 70*1024) // 70KB data - exceeds limit
+		maliciousTx := &types.LegacyTx{
+			Nonce:    env.NonceAt(fromAddr),
+			GasPrice: env.MustGetGasPrice(),
+			Gas:      21000,
+			To:       &toAddr,
+			Value:    big.NewInt(1000),
+			Data:     largeData,
+		}
+
+		signedTx, err := types.SignTx(types.NewTx(maliciousTx), env.Signer(), from)
+		require.NoError(t, err)
+
+		rawBytes, err := signedTx.MarshalBinary()
+		require.NoError(t, err)
+
+		var txHash common.Hash
+		err = env.RawClient.Call(&txHash, "eth_sendRawTransaction", hexutil.Bytes(rawBytes))
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "transaction data size")
+		require.Contains(t, err.Error(), "exceeds maximum")
+	})
+
+	t.Run("wrong chain ID attack", func(t *testing.T) {
+		from, fromAddr := env.NewAccountWithL2Funds()
+		env.accountManager.Add(from)
+		_, toAddr := env.NewAccountWithL2Funds()
+
+		// Create transaction with correct chain ID first, then manually modify
+		maliciousTx := &types.DynamicFeeTx{
+			ChainID:   big.NewInt(int64(env.ChainID)),
+			Nonce:     env.NonceAt(fromAddr),
+			GasFeeCap: env.MustGetGasPrice(),
+			GasTipCap: big.NewInt(10000000000),
+			Gas:       21000,
+			To:        &toAddr,
+			Value:     big.NewInt(1000),
+		}
+
+		signedTx, err := types.SignTx(types.NewTx(maliciousTx), env.Signer(), from)
+		require.NoError(t, err)
+
+		// Modify the raw bytes to have wrong chain ID after signing
+		// This simulates a malicious modification attempt
+		_, err = signedTx.MarshalBinary()
+		require.NoError(t, err)
+
+		// Create a new transaction with wrong chain ID and use our validation
+		wrongChainTx := &types.DynamicFeeTx{
+			ChainID:   big.NewInt(999999), // Wrong chain ID
+			Nonce:     env.NonceAt(fromAddr),
+			GasFeeCap: env.MustGetGasPrice(),
+			GasTipCap: big.NewInt(10000000000),
+			Gas:       21000,
+			To:        &toAddr,
+			Value:     big.NewInt(1000),
+		}
+
+		// Don't sign this one, create raw bytes manually to bypass signing validation
+		// This tests our post-unmarshal validation
+		wrongTx := types.NewTx(wrongChainTx)
+		wrongRawBytes, _ := wrongTx.MarshalBinary()
+
+		var txHash common.Hash
+		err = env.RawClient.Call(&txHash, "eth_sendRawTransaction", hexutil.Bytes(wrongRawBytes))
+		require.Error(t, err)
+		// The error could be from signing validation or our chain ID validation
+		require.True(t,
+			strings.Contains(err.Error(), "transaction chain ID") ||
+				strings.Contains(err.Error(), "invalid chain id for signer"),
+			"Expected chain ID validation error, got: %s", err.Error())
+	})
+
+	t.Run("complex RLP structure attack", func(t *testing.T) {
+		// Create RLP with too many elements
+		complexRLP := make([]byte, 0, 10000)
+		complexRLP = append(complexRLP, 0xc0) // Start list
+
+		// Add many small elements to trigger complexity check
+		for i := 0; i < 1200; i++ {
+			complexRLP = append(complexRLP, 0x80) // Empty string
+		}
+
+		var txHash common.Hash
+		err := env.RawClient.Call(&txHash, "eth_sendRawTransaction", hexutil.Bytes(complexRLP))
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "RLP structure too complex")
+	})
+
+	t.Run("insufficient payload for typed transaction", func(t *testing.T) {
+		// Test typed transaction with insufficient payload
+		insufficientData := []byte{0x02} // Type 0x02 but no payload
+
+		var txHash common.Hash
+		err := env.RawClient.Call(&txHash, "eth_sendRawTransaction", hexutil.Bytes(insufficientData))
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "typed transaction missing payload")
+	})
+
+	t.Run("non-list legacy transaction", func(t *testing.T) {
+		// Test legacy transaction that's not an RLP list
+		nonListData := []byte{0x80} // RLP string, not list
+
+		var txHash common.Hash
+		err := env.RawClient.Call(&txHash, "eth_sendRawTransaction", hexutil.Bytes(nonListData))
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "legacy transaction must be RLP list")
+	})
+}