test(cketh): adversarial end-to-end coverage of sweeper fee funding

rs/ethereum/cketh/minter/BUILD.bazel

@@ -209,7 +209,6 @@ rust_ic_test_suite(
             # Run against a local foundry anvil node, not the IC test suite.
             "tests/deposit_from_cex_demo.rs",
             "tests/deposit_from_cex.rs",
-            "tests/sweeper_funding.rs",
         ],
     ),
     data = [

rs/ethereum/cketh/minter/tests/deposit_from_cex.rs

@@ -6,6 +6,13 @@
 //!    whose purpose is to move the ERC-20 from the deposit address by calling the helper smart contract (DepositHelperWithSubaccount.sol),
 //!    to trigger the original deposit flow. This requires in particular the minter attesting that the given deposit address is for a given
 //!    principal and subaccount.
+//!
+//! Three further tests drive sweeper fee funding adversarially: each takes a distinct way it can go
+//! wrong through the same live pipeline and asserts the minter fails safe. Two are bounded
+//! *negative* assertions — "the minter must not do X" cannot be proven outright — so they watch
+//! across several withdrawal-timer ticks, bought by pushing the instance's clock forward. There is
+//! no live fee-spike test: that ceiling is pinned exactly by the unit tests, and reproducing it here
+//! would mean driving anvil's base fee up over several ticks for little extra signal.
 
 use assert_matches::assert_matches;
 use candid::Principal;
@@ -20,8 +27,11 @@ use ic_cketh_test_utils::anvil::{
     Anvil, DEV_ACCOUNT, SentTransaction, address_from_hex, deploy_mock_erc20,
 };
 use ic_cketh_test_utils::ckerc20::Erc20Token;
-use ic_cketh_test_utils::live::{Holding, LiveSetup, contract_address};
-use ic_cketh_test_utils::{MINTER_ADDRESS, SWEEPER_ADDRESS};
+use ic_cketh_test_utils::live::{
+    AWAIT_DEADLINE, Holding, LiveSetup, SWEEPER_BURNED_NOT_YET_SPENT, SWEEPER_ETH_SPENT,
+    SWEEPER_GAS_BALANCE, contract_address,
+};
+use ic_cketh_test_utils::{CkEthSetup, MINTER_ADDRESS, SWEEPER_ADDRESS};
 use ic_ethereum_types::Address;
 use icrc_ledger_types::icrc1::account::Account;
 use std::collections::BTreeSet;
@@ -282,6 +292,200 @@ fn should_fund_the_sweeper_address_by_burning_cketh_from_the_fee_account() {
     );
 }
 
+/// Several withdrawal-timer ticks, so a transfer that was going to happen would have — and would
+/// have had more than one chance to.
+const OBSERVATION_TICKS: u32 = 3;
+/// Sending the transaction and seeing it confirmed are separate runs of the withdrawal timer, and
+/// the minter has to observe `finalized` move past it in between. A budget rather than a cost —
+/// driving stops as soon as the row clears — so it is set well above the three ticks that suffice.
+const FINALIZATION_TICKS: u32 = 8;
+#[test]
+fn should_not_fund_when_the_fee_account_is_empty() {
+    let setup = LiveSetup::new_funding_with_empty_fee_account();
+    assert_eq!(setup.cketh_balance_of(setup.fee_account()), 0);
+
+    // Armed only now: before this the check refuses for a different reason — no deposit has been
+    // credited yet — and this test is about the burn failing, not the balance guard.
+    setup.upgrade_minter();
+    let sweeper = setup.await_sweeper_address();
+    // Asserted here rather than after the observation window: the minter's canister log is a ring
+    // buffer, and every tick that window buys makes each of the minter's periodic timers due at
+    // once, so the window ends with this line long since evicted. Read now it also says something
+    // sharper — the check ran, decided a funding was due, and reported why it could not make one.
+    setup.await_minter_log("[fund_sweeper]: SKIPPING: failed to burn");
+
+    let supply_before = setup.cketh_total_supply();
+    let minter_eth_before = setup.anvil_eth_balance(&setup.minter_address());
+
+    setup.assert_no_eth_received(&sweeper, OBSERVATION_TICKS);
+
+    assert_eq!(
+        setup.cketh_total_supply(),
+        supply_before,
+        "nothing may be burned when the fee account cannot cover the funding"
+    );
+    assert_eq!(
+        setup.anvil_eth_balance(&setup.minter_address()),
+        minter_eth_before,
+        "no ETH may leave the main address"
+    );
+}
+
+/// A sweeper that already holds plenty of gas must not be topped up again: burning ckETH for gas
+/// already in place would be pure loss.
+///
+/// Arranged by letting a real funding land, which is the only thing that moves the balance bound the
+/// decision reads — putting ETH at the address behind the minter's back would not, and that is the
+/// point of the bound.
+#[test]
+fn should_not_fund_a_sweeper_above_the_low_water_mark() {
+    let setup = LiveSetup::new_funding();
+    setup.upgrade_minter();
+    let sweeper = setup.await_sweeper_address();
+    let funded = setup.await_eth_received(&sweeper, FUNDING_TICKS);
+    // Waits for the transfer to finalize, not merely to land: the minter credits the bound when it
+    // records the finalized transaction, so before that the next check would still see zero.
+    setup.await_funding_finalized(FINALIZATION_TICKS);
+
+    // Captured before the timers are re-armed, not after: the post-upgrade check runs on a
+    // zero-delay timer and reads nothing off the chain, so a minter that wrongly funded again could
+    // burn before these queries returned, and both assertions below would then compare against an
+    // already-debited state — passing precisely when the behaviour they reject had happened.
+    let supply_before = setup.cketh_total_supply();
+    let fee_account_before = setup.cketh_balance_of(setup.fee_account());
+
+    // The next scheduled check is a whole interval away, so re-arm the timers: from here a second
+    // funding could succeed, and the point is that it declines.
+    setup.upgrade_minter();
+    // Without this the test passes for the wrong reason: a task that never ran also produces no
+    // burn. Proving it ran and *declined* is the point. Read before the observation window for the
+    // same ring-buffer reason as in the test above.
+    setup.await_minter_log("at or above the low-water mark");
+
+    // Watched by letting withdrawal-timer ticks pass rather than the wall clock: there is nothing
+    // here to poll for — only ticks to give the minter the chance to act, and the assertions below
+    // to show it did not.
+    setup.advance_ticks(OBSERVATION_TICKS);
+
+    assert_eq!(
+        setup.cketh_total_supply(),
+        supply_before,
+        "a topped-up sweeper must not trigger a second burn"
+    );
+    assert_eq!(
+        setup.cketh_balance_of(setup.fee_account()),
+        fee_account_before,
+        "the fee account must be untouched"
+    );
+    assert_eq!(
+        setup.anvil_eth_balance(&sweeper),
+        funded,
+        "the sweeper balance must be left exactly as the first funding delivered it"
+    );
+    assert!(
+        setup.metric_value(SWEEPER_GAS_BALANCE) > 0.0,
+        "the bound must carry the funding that landed, or the decision above declined for the \
+         wrong reason"
+    );
+}
+
+/// A funding transaction that fails on chain is never reimbursed. No ETH reaches the sweeper — only
+/// the gas the failed transaction still pays leaves the main address — and the ckETH stays burned,
+/// so the burn minus that gas ends up as extra backing.
+///
+/// Has to be arranged, because it is otherwise unreachable: the sweeper is a code-less EOA precisely
+/// so a bare transfer cannot fail. Placing code there leaves the 21'000 base gas with nothing to run
+/// it, so the transaction fails.
+#[test]
+fn should_not_reimburse_a_funding_transaction_that_fails_on_chain() {
+    // Starts with an empty fee account for the same reason as the test above: the sweeper cannot be
+    // arranged before the minter derives its address, and a funded fee account would let the
+    // funding it attempts right afterwards succeed while the sweeper is still a plain EOA.
+    let setup = LiveSetup::new_funding_with_empty_fee_account();
+    setup.upgrade_minter();
+    let sweeper = setup.await_sweeper_address();
+    setup.await_minter_log("[fund_sweeper]: SKIPPING: failed to burn");
+
+    // Any non-empty code does it: all 21'000 gas of a bare transfer is intrinsic, so the first
+    // opcode is already out of gas. PUSH1 0, PUSH1 0, REVERT is what is placed here, so that the
+    // call would fail on its own terms too if it were ever reached with gas to spare.
+    setup.set_code(&sweeper, &[0x60, 0x00, 0x60, 0x00, 0xfd]);
+    // Read back rather than assumed: an arrangement placed on the wrong account makes the whole
+    // test vacuous, and the transfer then simply succeeds.
+    assert!(
+        !setup.code(&sweeper).is_empty(),
+        "the code must be at {sweeper}"
+    );
+
+    // Deposited, not minted: the fee account is credited the way production credits it, which means
+    // waiting for the scrape that finds the deposit before the baseline below is taken.
+    setup.fund_fee_account();
+    let supply_before = setup.cketh_total_supply();
+    // The next scheduled check is a whole interval away, so re-arm the timers: from here the
+    // funding proceeds, and the point is what happens when its transaction fails.
+    setup.upgrade_minter();
+
+    let burned = await_burn(&setup, supply_before);
+    assert!(burned > 0, "funding must burn ckETH up front");
+
+    // Waits for the transaction to finalize rather than watching for a fixed window: without this
+    // the assertions below all hold while it is merely still in flight, which proves nothing about
+    // what happens when it fails.
+    //
+    // What the minter's status endpoint reports for the funding is deliberately not asserted: it is
+    // the ordinary pending-reimbursement state, imprecise here because nothing will ever settle it,
+    // and giving it a status of its own would mean a new `retrieve_eth_status` variant — breaking
+    // every existing client — for a state mainnet cannot reach. What matters is asserted below.
+    setup.await_funding_finalized(FINALIZATION_TICKS);
+
+    assert_eq!(
+        setup.anvil_eth_balance(&sweeper),
+        0,
+        "the transfer failed, so no ETH may have reached the sweeper"
+    );
+    assert_eq!(
+        setup.cketh_total_supply(),
+        supply_before - burned,
+        "a failed funding must NOT be reimbursed — the supply must stay reduced"
+    );
+    // Read as numbers rather than asserted non-zero: "some burn remains" would also hold if
+    // finalization had recorded no gas at all, which is the other half of what this test claims.
+    let spent = setup.metric_value(SWEEPER_ETH_SPENT);
+    let surplus = setup.metric_value(SWEEPER_BURNED_NOT_YET_SPENT);
+    assert!(
+        spent > 0.0,
+        "a failed transaction still pays its gas, so spend must be recorded"
+    );
+    assert_eq!(
+        surplus,
+        burned as f64 - spent,
+        "the burn minus that gas is what stays as backing"
+    );
+
+    // Reimbursement runs on its own timer, so "never reimbursed" is not established by looking once
+    // at finalization: a funding wrongly queued for reimbursement would mint on the next run of
+    // that timer. One tick is longer than its interval, so it has had its chance.
+    setup.advance_ticks(1);
+    assert_eq!(
+        setup.cketh_total_supply(),
+        supply_before - burned,
+        "the reimbursement timer must have found nothing to pay back"
+    );
+}
+
+/// What a funding burned, waiting for the supply to drop.
+fn await_burn(setup: &LiveSetup<CkEthSetup>, supply_before: u128) -> u128 {
+    setup.poll_until(
+        AWAIT_DEADLINE,
+        |_| "no burn observed".to_string(),
+        |setup| {
+            supply_before
+                .checked_sub(setup.cketh_total_supply())
+                .filter(|burned| *burned > 0)
+        },
+    )
+}
+
 #[test]
 fn should_credit_twenty_cex_deposits_through_one_sweep_per_token() {
     /// Ten depositors per token, so each sweep is a ten-deposit single-token batch — directly