fix(evm): Truncate leaked SDK events on VM error failed EVM txs (#2543)

* fix(evm): Truncate leaked SDK events on VM error failed EVM txs

* ci: Use pinned version, v1.64.0, for Buf CLI

Author: Unique-Divine

internal/cosmos-sdk/types/events.go

@@ -32,6 +32,28 @@ func NewEventManager() *EventManager {
 
 func (em *EventManager) Events() Events { return em.events }
 
+// Len returns the number of events currently stored in the manager.
+func (em *EventManager) Len() int { return len(em.events) }
+
+// TruncateEvents keeps only the first "mark" events and drops all later events.
+//
+// Bounds behavior:
+//   - mark <= 0: clear all events
+//   - mark >= Len(): no-op
+//
+// The return value is the resulting event length after truncation.
+func (em *EventManager) TruncateEvents(mark int) int {
+	switch {
+	case mark <= 0:
+		em.events = EmptyEvents()
+	case mark >= len(em.events):
+		// no-op
+	default:
+		em.events = em.events[:mark]
+	}
+	return len(em.events)
+}
+
 // EmitEvent stores a single Event object.
 // Deprecated: Use EmitTypedEvent
 func (em *EventManager) EmitEvent(event Event) {

internal/cosmos-sdk/types/events_test.go

@@ -86,6 +86,38 @@ func (s *eventsTestSuite) TestEventManager() {
 	s.Require().Equal(em.Events(), events.AppendEvent(event))
 }
 
+func (s *eventsTestSuite) TestEventManagerLenAndTruncateEvents() {
+	em := sdk.NewEventManager()
+	e1 := sdk.NewEvent("e1", sdk.NewAttribute("k", "v1"))
+	e2 := sdk.NewEvent("e2", sdk.NewAttribute("k", "v2"))
+	e3 := sdk.NewEvent("e3", sdk.NewAttribute("k", "v3"))
+	em.EmitEvents(sdk.Events{e1, e2, e3})
+
+	s.Require().Equal(3, em.Len())
+
+	newLen := em.TruncateEvents(2)
+	s.Require().Equal(2, newLen)
+	s.Require().Equal(sdk.Events{e1, e2}, em.Events())
+	s.Require().Equal(2, em.Len())
+
+	// Out-of-range marks above Len are no-op.
+	newLen = em.TruncateEvents(100)
+	s.Require().Equal(2, newLen)
+	s.Require().Equal(sdk.Events{e1, e2}, em.Events())
+
+	// Full clear on zero.
+	newLen = em.TruncateEvents(0)
+	s.Require().Equal(0, newLen)
+	s.Require().Equal(0, em.Len())
+	s.Require().Equal(sdk.EmptyEvents(), em.Events())
+
+	// Negative marks are treated as clear-all for safety.
+	em.EmitEvent(e1)
+	newLen = em.TruncateEvents(-1)
+	s.Require().Equal(0, newLen)
+	s.Require().Equal(0, em.Len())
+}
+
 func (s *eventsTestSuite) TestEmitTypedEvent() {
 	s.Run("deterministic key-value order", func() {
 		for i := 0; i < 10; i++ {

x/evm/const.go

@@ -43,6 +43,7 @@ const (
 	CtxKeyEvmSimulation            contextKey = "evm_simulation"
 	CtxKeyGasEstimateZeroTolerance contextKey = "gas_estimate_zero_tolerance"
 	CtxKeyZeroGasMeta              contextKey = "zero_gas_meta"
+	CtxKeyEvmEventTruncationMark   contextKey = "evm_event_truncation_mark"
 )
 
 // GetZeroGasMeta returns the ZeroGasMeta stored under CtxKeyZeroGasMeta, or nil if not set or type assertion fails.
@@ -56,6 +57,12 @@ func IsZeroGasEthTx(ctx sdk.Context) bool {
 	return GetZeroGasMeta(ctx) != nil
 }
 
+// GetEvmEventTruncationMark returns the mark to use for truncating events.
+func GetEvmEventTruncationMark(ctx sdk.Context) (mark int, ok bool) {
+	mark, ok = ctx.Value(CtxKeyEvmEventTruncationMark).(int)
+	return mark, ok
+}
+
 // BASE_FEE_MICRONIBI is the global base fee value for the network. It has a
 // constant value of 1 unibi (micronibi) == 10^12 wei.
 var (

x/evm/evmante/evmante_emit_event.go

@@ -37,5 +37,17 @@ func AnteStepEmitPendingEvent(
 		),
 	)
 
+	// Mark where execution-time events begin. On VM-level failure, EthereumTx
+	// uses this mark (see MaybeTruncateEventsForFailedEvmTx) to truncate
+	// module/precompile side-effect events emitted after ante.
+	//
+	// Context for this behavior:
+	// https://github.com/NibiruChain/nibiru/issues/2542
+	sdb.SetCtx(
+		sdb.Ctx().WithValue(
+			evm.CtxKeyEvmEventTruncationMark,
+			sdb.Ctx().EventManager().Len(),
+		))
+
 	return nil
 }

x/evm/evmante/evmante_emit_event_test.go

@@ -33,6 +33,11 @@ func (s *Suite) TestEthAnteEmitPendingEvent() {
 				attr, ok = event.GetAttribute(evm.PendingEthereumTxEventAttrIndex)
 				s.Require().True(ok, "tx index attribute not found")
 				s.Require().Equal("0", attr.Value)
+
+				// Ante stores an event truncation mark for EthereumTx failure cleanup.
+				mark, ok := evm.GetEvmEventTruncationMark(sdb.Ctx())
+				s.Require().True(ok, "evm event truncation mark not found")
+				s.Require().Equal(len(events), mark)
 			},
 		},
 	}

x/evm/evmstate/msg_ethereum_tx_test.go

@@ -21,6 +21,7 @@ import (
 
 	abci "github.com/cometbft/cometbft/abci/types"
 
+	"github.com/NibiruChain/nibiru/v2/x/evm/evmstate"
 	"github.com/NibiruChain/nibiru/v2/x/evm/evmtest"
 )
 
@@ -240,6 +241,50 @@ func (s *Suite) TestMsgEthereumTx_SimpleTransfer() {
 	}
 }
 
+func (s *Suite) TestMaybeTruncateEventsForFailedEvmTx() {
+	mkDeps := func() evmtest.TestDeps {
+		deps := evmtest.NewTestDeps()
+		deps.SetCtx(deps.Ctx().WithEventManager(sdk.NewEventManager()))
+		deps.Ctx().EventManager().EmitEvents(sdk.Events{
+			sdk.NewEvent("e1"),
+			sdk.NewEvent("e2"),
+			sdk.NewEvent("e3"),
+		})
+		deps.SetCtx(deps.Ctx().WithValue(evm.CtxKeyEvmEventTruncationMark, 2))
+		return deps
+	}
+
+	testCases := []struct {
+		name      string
+		evmResp   *evm.MsgEthereumTxResponse
+		wantTypes []string
+	}{
+		{
+			name:      "vm error truncates to mark",
+			evmResp:   &evm.MsgEthereumTxResponse{VmError: "execution reverted"},
+			wantTypes: []string{"e1", "e2"},
+		},
+		{
+			name:      "success keeps all events",
+			evmResp:   &evm.MsgEthereumTxResponse{},
+			wantTypes: []string{"e1", "e2", "e3"},
+		},
+	}
+
+	for _, tc := range testCases {
+		s.Run(tc.name, func() {
+			deps := mkDeps()
+			evmstate.MaybeTruncateEventsForFailedEvmTx(deps.Ctx(), tc.evmResp)
+
+			events := deps.Ctx().EventManager().Events()
+			s.Require().Len(events, len(tc.wantTypes))
+			for i, wantType := range tc.wantTypes {
+				s.Require().Equal(wantType, events[i].Type)
+			}
+		})
+	}
+}
+
 // The following zero-gas tests exercise only the EthereumTx msg_server. They do not
 // run the ante handler. The context is given the same zero-gas marker (CtxKeyZeroGasMeta)
 // that the ante would set in production. We verify that the msg_server skips RefundGas

x/evm/evmstate/msg_server.go

@@ -175,6 +175,7 @@ func (k *Keeper) EthereumTx(
 	}
 
 	stage = "post_execution_events_and_tx_index"
+	MaybeTruncateEventsForFailedEvmTx(rootCtxGasless, evmResp)
 	txEvents := k.GetEvmTxEvents(sdb.Ctx(), coreTx.To(), coreTx.Type(), *evmMsg, evmResp)
 
 	err = txEvents.EmitEvents(rootCtxGasless)
@@ -201,6 +202,31 @@ func (k *Keeper) EthereumTx(
 	return evmResp, nil
 }
 
+// MaybeTruncateEventsForFailedEvmTx truncates the current tx event stream to an
+// ante-computed mark when the EVM response indicates VM-level failure.
+//
+// This is part of the mitigation for leaked non-EVM module/precompile events on
+// failed EVM transactions:
+// https://github.com/NibiruChain/nibiru/issues/2542
+func MaybeTruncateEventsForFailedEvmTx(
+	ctx sdk.Context,
+	evmResp *evm.MsgEthereumTxResponse,
+) {
+	if evmResp == nil || !evmResp.Failed() {
+		return
+	}
+
+	mark, ok := evm.GetEvmEventTruncationMark(ctx)
+	if !ok {
+		return
+	}
+
+	// Keep only ante-phase events (up to mark) when the EVM execution fails.
+	// Canonical EVM metadata events are emitted immediately after this call in
+	// EthereumTx via txEvents.EmitEvents and EventTxLog.
+	ctx.EventManager().TruncateEvents(mark)
+}
+
 // NewEVM generates a go-ethereum VM.
 //
 // Args: