Skip to content

fix(crosschain): reject paused zrc20 v2 inbounds #4588

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alan747271363-art wants to merge 2 commits into
base: main
Choose a base branch
from
+65 −0
Open

fix(crosschain): reject paused zrc20 v2 inbounds #4588

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9ee66a6
fix(crosschain): reject paused zrc20 v2 inbounds
alan747271363-art May 13, 2026
21d1c72
test(crosschain): align paused zrc20 fixtures
alan747271363-art May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions x/crosschain/keeper/v2_zevm_inbound.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,6 +265,13 @@ func (k Keeper) getZRC20InboundDetails(
ctx.Logger().Info(fmt.Sprintf("cannot find foreign coin associated to the zrc20 address %s", zrc20.Hex()))
return InboundDetails{}, nil
}
if foreignCoin.Paused {
return InboundDetails{}, errorsmod.Wrapf(
fungibletypes.ErrPausedZRC20,
"zrc20 %s is paused",
zrc20.Hex(),
)
}

receiverChain, found := k.zetaObserverKeeper.GetSupportedChainFromChainID(ctx, foreignCoin.ForeignChainId)
if !found {
Expand Down
58 changes: 58 additions & 0 deletions x/crosschain/keeper/v2_zevm_inbound_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,6 +254,35 @@ func TestKeeper_GetErc20InboundDetails(t *testing.T) {
require.Empty(t, result)
})

t.Run("fail when foreign coin is paused", func(t *testing.T) {
// ARRANGE
k, ctx, _, _ := keepertest.CrosschainKeeperWithMocks(t, keepertest.CrosschainMockOptions{
UseFungibleMock: true,
})

zrc20 := sample.EthAddress()
callEvent := false

fungibleMock := keepertest.GetCrosschainFungibleMock(t, k)
foreignCoin := fungibletypes.ForeignCoins{
Zrc20ContractAddress: zrc20.Hex(),
Asset: "USDT",
ForeignChainId: 1,
CoinType: coin.CoinType_ERC20,
Paused: true,
}
Comment on lines +257 to +273

@greptile-apps greptile-apps Bot May 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 In both new paused-coin tests, foreignCoin.Zrc20ContractAddress is a freshly-sampled random address that differs from the zrc20 variable passed as input. In production, GetForeignCoins(ctx, zrc20.Hex()) returns the coin whose Zrc20ContractAddress equals zrc20.Hex(). Using zrc20.Hex() for this field aligns the test fixture with the real data shape, making it immediately clear to a reader that the coin belongs to the same address under test.

Suggested change
t.Run("fail when foreign coin is paused", func(t *testing.T) {
// ARRANGE
k, ctx, _, _ := keepertest.CrosschainKeeperWithMocks(t, keepertest.CrosschainMockOptions{
UseFungibleMock: true,
})
zrc20 := sample.EthAddress()
callEvent := false
fungibleMock := keepertest.GetCrosschainFungibleMock(t, k)
foreignCoin := fungibletypes.ForeignCoins{
Zrc20ContractAddress: sample.EthAddress().Hex(),
Asset: "USDT",
ForeignChainId: 1,
CoinType: coin.CoinType_ERC20,
Paused: true,
}
t.Run("fail when foreign coin is paused", func(t *testing.T) {
// ARRANGE
k, ctx, _, _ := keepertest.CrosschainKeeperWithMocks(t, keepertest.CrosschainMockOptions{
UseFungibleMock: true,
})
zrc20 := sample.EthAddress()
callEvent := false
fungibleMock := keepertest.GetCrosschainFungibleMock(t, k)
foreignCoin := fungibletypes.ForeignCoins{
Zrc20ContractAddress: zrc20.Hex(),
Asset: "USDT",
ForeignChainId: 1,
CoinType: coin.CoinType_ERC20,
Paused: true,
}
Prompt To Fix With AI 
This is a comment left during a code review.
Path: x/crosschain/keeper/v2_zevm_inbound_test.go
Line: 257-273

Comment:
In both new paused-coin tests, `foreignCoin.Zrc20ContractAddress` is a freshly-sampled random address that differs from the `zrc20` variable passed as input. In production, `GetForeignCoins(ctx, zrc20.Hex())` returns the coin whose `Zrc20ContractAddress` equals `zrc20.Hex()`. Using `zrc20.Hex()` for this field aligns the test fixture with the real data shape, making it immediately clear to a reader that the coin belongs to the same address under test.

```suggestion
	t.Run("fail when foreign coin is paused", func(t *testing.T) {
		// ARRANGE
		k, ctx, _, _ := keepertest.CrosschainKeeperWithMocks(t, keepertest.CrosschainMockOptions{
			UseFungibleMock: true,
		})

		zrc20 := sample.EthAddress()
		callEvent := false

		fungibleMock := keepertest.GetCrosschainFungibleMock(t, k)
		foreignCoin := fungibletypes.ForeignCoins{
			Zrc20ContractAddress: zrc20.Hex(),
			Asset:                "USDT",
			ForeignChainId:       1,
			CoinType:             coin.CoinType_ERC20,
			Paused:               true,
		}
```

How can I resolve this? If you propose a fix, please make it concise.

@alan747271363-art alan747271363-art May 19, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed on the current branch: the paused-coin test now sets Zrc20ContractAddress: zrc20.Hex(), matching the lookup key used by GetForeignCoins(ctx, zrc20.Hex()).

fungibleMock.On("GetForeignCoins", ctx, zrc20.Hex()).Return(foreignCoin, true)

// ACT
result, err := k.GetERC20InboundDetails(ctx, zrc20, callEvent)

// ASSERT
require.Error(t, err)
require.ErrorIs(t, err, fungibletypes.ErrPausedZRC20)
require.Contains(t, err.Error(), "zrc20 "+zrc20.Hex()+" is paused")
require.Empty(t, result)
})

t.Run("fail when chain is not supported", func(t *testing.T) {
// ARRANGE
k, ctx, _, _ := keepertest.CrosschainKeeperWithMocks(t, keepertest.CrosschainMockOptions{
Expand Down Expand Up @@ -322,6 +351,35 @@ func TestKeeper_GetErc20InboundDetails(t *testing.T) {
require.Contains(t, err.Error(), "gas limit query failed")
})

t.Run("fail when foreign coin is paused for call event", func(t *testing.T) {
// ARRANGE
k, ctx, _, _ := keepertest.CrosschainKeeperWithMocks(t, keepertest.CrosschainMockOptions{
UseFungibleMock: true,
})

zrc20 := sample.EthAddress()
callEvent := true

fungibleMock := keepertest.GetCrosschainFungibleMock(t, k)
foreignCoin := fungibletypes.ForeignCoins{
Zrc20ContractAddress: zrc20.Hex(),
Asset: "USDT",
ForeignChainId: 1,
CoinType: coin.CoinType_ERC20,
Paused: true,
}
Comment on lines +354 to +370

@greptile-apps greptile-apps Bot May 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Same Zrc20ContractAddress mismatch in the call-event paused test. Using zrc20.Hex() matches the real data shape where GetForeignCoins(zrc20.Hex()) returns a coin whose own Zrc20ContractAddress equals the lookup key.

Suggested change
t.Run("fail when foreign coin is paused for call event", func(t *testing.T) {
// ARRANGE
k, ctx, _, _ := keepertest.CrosschainKeeperWithMocks(t, keepertest.CrosschainMockOptions{
UseFungibleMock: true,
})
zrc20 := sample.EthAddress()
callEvent := true
fungibleMock := keepertest.GetCrosschainFungibleMock(t, k)
foreignCoin := fungibletypes.ForeignCoins{
Zrc20ContractAddress: sample.EthAddress().Hex(),
Asset: "USDT",
ForeignChainId: 1,
CoinType: coin.CoinType_ERC20,
Paused: true,
}
t.Run("fail when foreign coin is paused for call event", func(t *testing.T) {
// ARRANGE
k, ctx, _, _ := keepertest.CrosschainKeeperWithMocks(t, keepertest.CrosschainMockOptions{
UseFungibleMock: true,
})
zrc20 := sample.EthAddress()
callEvent := true
fungibleMock := keepertest.GetCrosschainFungibleMock(t, k)
foreignCoin := fungibletypes.ForeignCoins{
Zrc20ContractAddress: zrc20.Hex(),
Asset: "USDT",
ForeignChainId: 1,
CoinType: coin.CoinType_ERC20,
Paused: true,
}
Prompt To Fix With AI 
This is a comment left during a code review.
Path: x/crosschain/keeper/v2_zevm_inbound_test.go
Line: 354-370

Comment:
Same `Zrc20ContractAddress` mismatch in the call-event paused test. Using `zrc20.Hex()` matches the real data shape where `GetForeignCoins(zrc20.Hex())` returns a coin whose own `Zrc20ContractAddress` equals the lookup key.

```suggestion
	t.Run("fail when foreign coin is paused for call event", func(t *testing.T) {
		// ARRANGE
		k, ctx, _, _ := keepertest.CrosschainKeeperWithMocks(t, keepertest.CrosschainMockOptions{
			UseFungibleMock: true,
		})

		zrc20 := sample.EthAddress()
		callEvent := true

		fungibleMock := keepertest.GetCrosschainFungibleMock(t, k)
		foreignCoin := fungibletypes.ForeignCoins{
			Zrc20ContractAddress: zrc20.Hex(),
			Asset:                "USDT",
			ForeignChainId:       1,
			CoinType:             coin.CoinType_ERC20,
			Paused:               true,
		}
```

How can I resolve this? If you propose a fix, please make it concise.

@alan747271363-art alan747271363-art May 19, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed on the current branch as well: the call-event paused test now uses Zrc20ContractAddress: zrc20.Hex() so the fixture matches the production data shape.

fungibleMock.On("GetForeignCoins", ctx, zrc20.Hex()).Return(foreignCoin, true)

// ACT
result, err := k.GetERC20InboundDetails(ctx, zrc20, callEvent)

// ASSERT
require.Error(t, err)
require.ErrorIs(t, err, fungibletypes.ErrPausedZRC20)
require.Contains(t, err.Error(), "zrc20 "+zrc20.Hex()+" is paused")
require.Empty(t, result)
})

t.Run("success with call event (NoAssetCall)", func(t *testing.T) {
// ARRANGE
k, ctx, _, _ := keepertest.CrosschainKeeperWithMocks(t, keepertest.CrosschainMockOptions{
Expand Down
Loading