feat(cketh): install a deposit address' delegation with its first sweep

[gregorydemay]

Part of DEFI-2917 (deposit-from-CEX), on master now that #11144 has landed.

Why

• A deposit address holds ERC-20 tokens but no code, so it cannot sweep itself.
• The minter delegates it to the sweeper contract with an EIP-7702 authorization.
• The cheapest carrier for that authorization is the sweep that needs it: the first sweep touching an address installs the delegation on the way.
• The delegation persists, so every later sweep of that address is a plain EIP-1559 transaction.
• deposit_from_cex_demo measures 94'932 gas for the first sweep of an address against 63'252 for the next.

What

• The sweeper lane sends either transaction type, and a sweep carries the signed authorizations it must install.
• Two no-op refactorings come first: finalizing and fee-bumping stop being EIP-1559-only.
• That is also what gives EIP-7702 fee-bumping for free, with no machinery of its own.
• Authorizations are held in the request rather than derived while the transaction is built, so no replay and no fee bump ever re-signs one.
• An authorization covers the chain, the delegate and the authority's nonce — nothing of the outer transaction.
• A single place decides which type a sweep becomes, from whether anything is left to install.

Scope

• Nothing enqueues a sweep yet, so nothing builds an authorization in production.
• Choosing which addresses still need delegating belongs to the sweep-queue source, along with reading each address' delegation from the chain.
• Hence the request carries signed authorizations rather than a "needs delegation" flag.
• The batch-dependent gas limit a delegating sweep needs is deferred with it: feat(cketh): drive the sweeper transaction pipeline from its own timer task #11237's flat 100'000 does not cover one.

Candid compatibility

• Needs the CI_OVERRIDE_DIDC_CHECK label.
• Two sweeper event cases change the type of their transaction field, and a third gains a required field.
• Neither is a Candid subtype on a returned variant.
• Those cases only reached the interface with feat(cketh): give the sweeper address its own transaction pipeline #11144 and have never been released, so no deployed canister has emitted them and no client can be reading them.

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[Copilot]

Pull request overview

Adds EIP-7702 delegation installation to first-time ckETH deposit-address sweeps while generalizing transaction pipeline mechanics.

Changes:

• Introduces EIP-1559/EIP-7702 sweep transactions.
• Generalizes finalization and fee resubmission.
• Extends audit events and Candid types with signed authorizations.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/dump_stable_memory.rs	Maps new sweep events.
src/tx/tests.rs	Tests sweep encoding and signing.
src/tx/sweep.rs	Defines variant sweep transactions.
src/tx/signed.rs	Expands the signable transaction interface.
src/tx/mod.rs	Generalizes fee resubmission.
src/tx/finalized.rs	Adds generic finalized transactions.
src/tx/eip_7702.rs	Enables EIP-7702 fee bumps.
src/tx/eip_1559.rs	Adopts generic transaction machinery.
src/state/transactions/tests.rs	Tests delegating sweep pipelines.
src/state/transactions/request.rs	Creates the appropriate sweep variant.
src/state/transactions/mod.rs	Generalizes transaction pipelines.
src/state/event.rs	Stores sweep transaction variants.
src/state/audit/tests.rs	Updates event replay mapping.
src/main.rs	Exposes authorization data in events.
src/endpoints.rs	Adds Candid-facing sweep types.
cketh_minter.did	Updates the public Candid interface.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated no new comments.

Suppressed comments (2)

rs/ethereum/cketh/minter/tests/dump_stable_memory.rs:193

• Delegating sweeps are signed type-0x04 transactions, but this path always calls an EIP-1559-only decoder and then constructs SweepTransaction::Eip1559. Once a signed delegating sweep appears in get_events, decode_signed_transaction rejects it at its TypedTransaction::Eip1559 match, so stable-memory dumping cannot process the new event. Decode type 0x04 (including its authorization list) and construct the matching sweep variant.

fn map_signed_sweep_transaction(raw_transaction: &str) -> SignedSweepTransaction {
    let (transaction, signature) = decode_signed_transaction(raw_transaction);
    SignedSweepTransaction::from((SweepTransaction::Eip1559(transaction), signature))

rs/ethereum/cketh/minter/src/state/audit/tests.rs:250

• This replay mapper still accepts only TypedTransaction::Eip1559 and unconditionally rebuilds the signed sweep as that variant. A signed first sweep is type 0x04, so refreshing/replaying events after delegating sweeps begin will panic instead of reconstructing state. Decode EIP-7702 raw transactions and preserve their authorization list here.

        fn map_signed_sweep_transaction(raw_transaction: &str) -> SignedSweepTransaction {
            let (transaction, signature) = decode_signed_transaction(raw_transaction);
            SignedSweepTransaction::from((SweepTransaction::Eip1559(transaction), signature))

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated no new comments.

Suppressed comments (1)

rs/ethereum/cketh/minter/src/tx/eip_7702.rs:287

• decode can panic on a malformed type-0x04 payload with an empty authorization list. Self::from immediately computes the hash, which calls Eip7702TransactionRequest::rlp_inner and triggers its non-empty-list assertion. Since this decoder returns Result and documents malformed payloads as errors, reject the empty list before constructing Signed.

            authorization_list: decode_list(&rlp, 9)?
                .iter()
                .map(|item| {
                    Ok(SignedAuthorization {
                        chain_id: decode_val(item, 0)?,
                        delegate: decode_address(item, 1)?,
                        nonce: decode_amount(item, 2)?,
                        y_parity: decode_val(item, 3)?,
                        r: decode_u256(item, 4)?,
                        s: decode_u256(item, 5)?,
                    })
                })
                .collect::<Result<_, String>>()?,

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 2ca527d.

Security Overview

• 🔎 Scanned files: 17 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/783a9bd4-fb4e-4e10-ab3c-c2fb2ddfb92f?scanId=c25ce34d-2028-41f1-96e6-e1ae36d0d3c5&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type

Relevant files

Enhancement

► rs/ethereum/cketh/minter/src/endpoints.rs     Add SignedAuthorization and UnsignedSweeperTransaction types ► rs/ethereum/cketh/minter/src/state/event.rs     Update EventType variants to use SweepTransaction and SignedSweepTransaction ► rs/ethereum/cketh/minter/src/state/transactions/mod.rs     Introduce generic transaction types for sweeps and signed transactions; adjust TransactionPipeline generics and related types ► rs/ethereum/cketh/minter/src/state/transactions/request.rs     Make Transaction type generic (Transaction: SignableTransaction) for PipelineRequest; adjust methods to use generic Transaction ► rs/ethereum/cketh/minter/src/state/transactions/tests.rs     Update tests to reflect new generic transaction types and SignedAuthorization/SweepTransaction handling ► rs/ethereum/cketh/minter/src/main.rs     Adapt imports and mappings to new SignedAuthorization and UnsignedSweeperTransaction usage ► rs/ethereum/cketh/minter/cketh_minter.did     Update DID to include new SignedAuthorization and UnsignedSweeperTransaction definitions and usages