fix(cketh): provision sweep gas out of the sweeper balance bound by gregorydemay · Pull Request #11342 · dfinity/ic

gregorydemay · 2026-08-27T06:59:57Z

Why

The funding task decides whether to top the sweeper address up from a lower bound on its ETH balance, tracked from the minter's own events (feat(cketh): sweeper fee-funding task, with an end-to-end test #11086). Nothing debited that bound, which was true while nothing spent from the sweeper address — and the layers below connect the sweep queue to the pipeline that does.
Without a debit the bound only ever grows: fundings top the sweeper up once, sweeps spend the gas, and every counter still reports a full sweeper — amount_due declines fundings the sweeper actually needs, and sweeping stalls while looking healthy.

What

An accepted sweep provisions the most it can cost the sweeper address: its fee ceiling, the same ceiling every resubmission is checked against. A sweep moves its ERC-20 through call data and sends no ETH — settlement reads the finalized transaction and its receipt, asserts exactly that, hands back the fee the sweep did not pay, and records the fee it did.
A sweep is only accepted while the bound covers its ceiling, so every hold is backed by delivered gas. That lets the balance be checked like the main address' EthBalance instead of floored at zero: provisioning beyond deliveries is a bug to surface, not a state to tolerate (no deployed minter ever wrote a sweep event, so there is no legacy log to indulge).
Provisioning at acceptance rather than debiting at spend keeps the bound erring low while sweeps are in flight: a sweep whose finalization is never observed brings a funding forward rather than letting the minter believe in gas that is gone. Acceptance also happens exactly once per sweep, where a signature happens once per resubmission.
The holds stay out of cumulative_spent — that ETH was counted there when the funding delivered it, and counting it twice would trip the burn-first invariant (R14).
The sweep e2e now funds the sweeper the way production does — ckETH burned from the fee account, delivered and finalized by the funding pipeline — since a minter that trusts only its own accounting no longer sweeps on gas credited behind its back.

This is #11329 (thanks @mbjorkqvist), integrated on top of the sweep stack per the hand-off on DEFI-2933: rebased onto the sweep-queue lifecycle, whose deposit release now lives in the same finalization transition the refund settles in.

Copilot

Pull request overview

Updates ckETH sweeper funding accounting so in-flight and finalized sweep costs correctly reduce the tracked balance lower bound.

Changes:

Provision accepted sweeps against the sweeper balance bound.
Refund unused fees and failed transfer values upon finalization.
Add lifecycle tests, shared fixtures, and updated documentation.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`rs/ethereum/cketh/minter/src/test_fixtures.rs`	Adds a reusable sweep request fixture.
`rs/ethereum/cketh/minter/src/state/transactions/tests.rs`	Reuses the shared sweep fixture.
`rs/ethereum/cketh/minter/src/state/sweeper_funding/tests.rs`	Tests provisioning, refunds, accounting invariants, and flooring.
`rs/ethereum/cketh/minter/src/state/sweeper_funding.rs`	Tracks provisioned and refunded sweep costs.
`rs/ethereum/cketh/minter/src/state/audit.rs`	Wires accounting into sweep lifecycle events.
`rs/ethereum/cketh/minter/src/state.rs`	Settles sweeper balance accounting at acceptance and finalization.
`rs/ethereum/cketh/docs/deposit_from_cex.md`	Documents the revised lower-bound calculation.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

The funding decision reads a lower bound on the sweeper address' balance, tracked from the minter's own events. Nothing debited it, which was true while nothing spent from that address — and the layers below have since landed the pipeline that does. With those in place the bound only ever grows: fundings top the sweeper up once, sweeps spend the gas, and the bound still reports a full sweeper, so `amount_due` declines every later funding. The sweeper drains, sweeping stalls, and every counter says it is funded. An accepted sweep now provisions the most it can cost that address — its fee ceiling, which caps every resubmission the pipeline makes for it — and gets back the fee it did not pay when it finalizes. An ERC-20 sweep moves its tokens through call data and carries no ETH value of its own, so the fee is the whole of what it can cost, and a reverted sweep is charged for its gas like any other. Provisioning at acceptance rather than debiting at spend is what keeps this a bound while sweeps are in flight. Gas a committed sweep will pay stops counting as available immediately, and a sweep whose finalization is never observed leaves the bound too low — which delays a funding — rather than too high, which would let the minter believe in gas that is gone. It is the discipline the withdrawal pipeline already applies to its own fees. The counters are kept out of `cumulative_spent`: this ETH was counted there once already, when the funding that delivered it finalized, and counting it twice would make spend overtake burn and trip the burn-first invariant. The bound floors at zero rather than trapping, since an upgrade that starts the counters from zero — or a sweeper funded before it was tracked — can legitimately leave provisioning above deliveries, and trapping in a state transition would take the replay of every later event with it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YK3ggw1xtE3HZTGGBu66oD

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YK3ggw1xtE3HZTGGBu66oD

…prepaid gas Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YK3ggw1xtE3HZTGGBu66oD

…line Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ2pJpCcJWSmYfrhLjmUZ8

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ2pJpCcJWSmYfrhLjmUZ8

…r it Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ2pJpCcJWSmYfrhLjmUZ8

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ2pJpCcJWSmYfrhLjmUZ8

zeropath-ai · 2026-08-31T13:34:42Z

✅ No security or compliance issues detected. Reviewed everything up to 1835071.

Security Overview

🔎 Scanned files: 11 changed file(s)
🔗 Scan Link: https://zeropath.com/app/repositories/783a9bd4-fb4e-4e10-ab3c-c2fb2ddfb92f?scanId=165193b9-b45c-43e1-8938-4c93d33fcf7d&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► rs/ethereum/cketh/minter/src/state.rs Add record_finalized_sweeper_transaction method ► rs/ethereum/cketh/minter/src/state.rs Add update_sweeper_balance_upon_accepted_sweep method ► rs/ethereum/cketh/minter/src/state/audit.rs Call update_sweeper_balance_upon_accepted_sweep during sweep event processing ► rs/ethereum/cketh/minter/src/state/automatic_deposits/mod.rs Expose processed_sweep_request method
Enhancement	► rs/ethereum/cketh/minter/src/state/sweeper_funding.rs Introduce SweeperBalance and SweeperBalance handling (credit/debit, add_error checks) ► rs/ethereum/cketh/minter/src/state/sweeper_funding.rs Extend SweeperFundingAccounting with sweeper_balance, new methods record_accepted_sweep, record_finalized_sweep, total_effective_sweep_fees, sweeper_balance_lower_bound
Enhancement	► rs/ethereum/cketh/minter/src/sweep/mod.rs Prevent creating pending sweeps when sweeper balance cannot cover max_transaction_fee
Enhancement	► rs/ethereum/cketh/minter/src/sweep/tests.rs Add tests for sweeper balance behavior: should_not_accept_a_sweep_the_sweeper_gas_cannot_pay_for, should_record_the_fees_sweeps_paid, and support for finalized sweeps with replacements
Enhancement	► rs/ethereum/cketh/minter/src/test_fixtures.rs Add PREPAID_SWEEP_GAS constant, prepay_sweep_gas, and state_with_enqueued_sweep helpers; extend fixtures with sweep-related setup
Enhancement	► rs/ethereum/cketh/minter/tests/deposit_from_cex.rs Adjust test setup to use new sweep funding flow and dynamic funded gas amount
Enhancement	► rs/ethereum/cketh/test_utils/src/live.rs Update live test setup to reflect new sweep funding semantics and include TransactionStatus in events
Enhancement	► rs/ethereum/cketh/test_utils/src/live.rs Refactor new_sweep to initialize via new approach and adjust funding flow for tests
Enhancement	► rs/ethereum/cketh/minter/src/sweep/tests.rs Add tests for not accepting sweeps when gas cannot be covered, and related fixtures for state with enqueued sweeps

mbjorkqvist

LGTM, thanks @gregorydemay!

Master's #11342 gives the funding accounting a sweeper balance that sweeps debit; this branch gives it the per-outcome funding counters and the eager burn-first check. Both sides are kept. `record_finalized_funding` keeps the status-aware signature, credits the sweeper balance with what the transfer delivered, and then checks the invariant through `checked_burned_not_yet_spent`. Master's `let _ = burned_not_yet_spent()` would no longer trap there, since this branch makes that getter saturate for the query surfaces. Regenerate the canbench baseline for master's replay changes.

gregorydemay changed the title ~~greg/DEFI 2933 provision sweep gas~~ fix(cketh): provision sweep gas out of the sweeper balance bound Aug 27, 2026

gregorydemay requested a balanced review from Copilot August 27, 2026 07:00

github-actions Bot added the fix label Aug 27, 2026

Copilot started reviewing on behalf of gregorydemay August 27, 2026 07:00

View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

gregorydemay force-pushed the greg/DEFI-2933-provision-sweep-gas branch from 63a865b to 928e0c0 Compare August 27, 2026 07:56

gregorydemay requested a balanced review from Copilot August 27, 2026 08:04

Copilot started reviewing on behalf of gregorydemay August 27, 2026 08:05

View session

Copilot AI reviewed Aug 27, 2026

View reviewed changes

This was referenced Aug 28, 2026

feat(cketh): enqueue the sweep a signed batch has become #11362

Merged

test(cketh): credit twenty CEX deposits through one EIP-7702 sweep per token #11363

Merged

gregorydemay force-pushed the greg/DEFI-2933-provision-sweep-gas branch from 0651dfc to 452ee12 Compare August 28, 2026 08:35

gregorydemay changed the base branch from greg/DEFI-2926-deposit-from-cex-e2e to gdemay/DEFI-2926-deposit-from-cex-e2e August 28, 2026 08:41

gregorydemay requested a balanced review from Copilot August 28, 2026 08:41

Copilot started reviewing on behalf of gregorydemay August 28, 2026 08:42

View session

Copilot AI reviewed Aug 28, 2026

View reviewed changes

Comment thread rs/ethereum/cketh/minter/src/state/sweeper_funding.rs Outdated

gregorydemay requested a balanced review from Copilot August 28, 2026 09:59

Copilot started reviewing on behalf of gregorydemay August 28, 2026 10:00

View session

Copilot AI reviewed Aug 28, 2026

View reviewed changes

mbjorkqvist approved these changes Aug 28, 2026

View reviewed changes

Comment thread rs/ethereum/cketh/minter/src/state/sweeper_funding.rs Outdated

Comment thread rs/ethereum/cketh/minter/src/state/sweeper_funding/tests.rs

gregorydemay force-pushed the greg/DEFI-2933-provision-sweep-gas branch from 542ceb8 to a124541 Compare August 29, 2026 10:52

gregorydemay requested a balanced review from Copilot August 29, 2026 10:53

Copilot started reviewing on behalf of gregorydemay August 29, 2026 10:53

View session

Copilot AI reviewed Aug 29, 2026

View reviewed changes

Base automatically changed from gdemay/DEFI-2926-deposit-from-cex-e2e to master August 31, 2026 10:17

gregorydemay and others added 5 commits August 31, 2026 12:17

docs(cketh): correct which way a too-low sweeper balance bound errs

b8100be

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YK3ggw1xtE3HZTGGBu66oD

test(cketh): fund the sweeper again once accepted sweeps consume its …

3111fee

…prepaid gas Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YK3ggw1xtE3HZTGGBu66oD

test(cketh): fund the sweep e2e's sweeper through the production pipe…

9d2a8ef

…line Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ2pJpCcJWSmYfrhLjmUZ8

fix(cketh): refuse a sweep the sweeper's gas cannot pay for

b254286

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ2pJpCcJWSmYfrhLjmUZ8

gregorydemay force-pushed the greg/DEFI-2933-provision-sweep-gas branch from e9dfee9 to b254286 Compare August 31, 2026 10:17

gregorydemay and others added 8 commits August 31, 2026 13:09

refactor(cketh): keep the sweeper's gas as its own checked EthBalance

bc7ce4f

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ2pJpCcJWSmYfrhLjmUZ8

refactor(cketh): hold an accepted sweep's whole cost, fee and ETH alike

6580aa6

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ2pJpCcJWSmYfrhLjmUZ8

refactor(cketh): assert a sweep sends no ETH instead of accounting fo…

d32a1bc

…r it Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ2pJpCcJWSmYfrhLjmUZ8

test(cketh): demand a successful funding and trim the sweep fixture

d4f9a66

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ2pJpCcJWSmYfrhLjmUZ8

style(cketh): drop comments on private items

f5c3ff1

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ2pJpCcJWSmYfrhLjmUZ8

style(cketh): call the test helper what it reads, the sweeper balance

1f71929

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ2pJpCcJWSmYfrhLjmUZ8

test(cketh): start the funding and sweep fixtures the same way

5046bfd

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ2pJpCcJWSmYfrhLjmUZ8

test(cketh): pin the hold per sweep and the settle on a replaced receipt

1835071

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJ2pJpCcJWSmYfrhLjmUZ8

gregorydemay marked this pull request as ready for review August 31, 2026 13:33

gregorydemay requested a review from a team as a code owner August 31, 2026 13:33

gregorydemay requested a review from mbjorkqvist August 31, 2026 13:33

github-actions Bot added the @defi label Aug 31, 2026

mbjorkqvist approved these changes Aug 31, 2026

View reviewed changes

gregorydemay added this pull request to the merge queue Aug 31, 2026

Merged via the queue into master with commit b22e4ed Aug 31, 2026
46 of 47 checks passed

gregorydemay deleted the greg/DEFI-2933-provision-sweep-gas branch August 31, 2026 15:20

Navigation Menu

Repository navigation

fix(cketh): provision sweep gas out of the sweeper balance bound - #11342

fix(cketh): provision sweep gas out of the sweeper balance bound#11342
gregorydemay merged 13 commits into
masterfrom
greg/DEFI-2933-provision-sweep-gas

gregorydemay commented Aug 27, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

zeropath-ai Bot commented Aug 31, 2026

Uh oh!

mbjorkqvist left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

gregorydemay commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

zeropath-ai Bot commented Aug 31, 2026

Uh oh!

mbjorkqvist left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gregorydemay commented Aug 27, 2026 •

edited

Loading