@layerzerolabs/protocol-stellar-v2 0.2.13 → 0.2.15

package/contracts/endpoint-v2/src/tests/messaging_channel/nilify.rs

@@ -1,13 +1,85 @@
-use soroban_sdk::{testutils::Address as _, Address, BytesN, IntoVal};
-
-use crate::{endpoint_v2::EndpointV2, events::PacketNilified, storage, tests::endpoint_setup::setup};
+use soroban_sdk::{testutils::Address as _, Address, BytesN};
 use utils::testing_utils::assert_event;
 
+use crate::{
+    endpoint_v2::EndpointV2, errors::EndpointError, events::PacketNilified, storage, tests::endpoint_setup::setup,
+    tests::endpoint_setup::TestSetup,
+};
+
+// Helpers
+fn nil_hash(context: &TestSetup) -> BytesN<32> {
+    let env = &context.env;
+    let endpoint_client = &context.endpoint_client;
+    env.as_contract(&endpoint_client.address, || EndpointV2::nil_payload_hash(env))
+}
+
+fn nilify_with_auth(
+    context: &TestSetup,
+    caller: &Address,
+    receiver: &Address,
+    src_eid: u32,
+    sender: &BytesN<32>,
+    nonce: u64,
+    payload_hash: &Option<BytesN<32>>,
+) {
+    context.mock_auth(caller, "nilify", (caller, receiver, &src_eid, sender, &nonce, payload_hash));
+    context.endpoint_client.nilify(caller, receiver, &src_eid, sender, &nonce, payload_hash);
+}
+
+fn try_nilify_with_auth(
+    context: &TestSetup,
+    caller: &Address,
+    receiver: &Address,
+    src_eid: u32,
+    sender: &BytesN<32>,
+    nonce: u64,
+    payload_hash: &Option<BytesN<32>>,
+) -> Result<Result<(), soroban_sdk::ConversionError>, Result<soroban_sdk::Error, soroban_sdk::InvokeError>> {
+    context.mock_auth(caller, "nilify", (caller, receiver, &src_eid, sender, &nonce, payload_hash));
+    context.endpoint_client.try_nilify(caller, receiver, &src_eid, sender, &nonce, payload_hash)
+}
+
+// Authorization (receiver or delegate(receiver) must authorize)
+#[test]
+fn test_nilify_unauthorized() {
+    let context = setup();
+    let env = &context.env;
+    let endpoint_client = &context.endpoint_client;
+
+    let receiver = Address::generate(env);
+    let unauthorized = Address::generate(env);
+    let src_eid = 2;
+    let sender = BytesN::from_array(env, &[1u8; 32]);
+    let nonce = 1u64;
+
+    // Unauthorized should fail before require_auth, so no mock_auth is needed.
+    let result = endpoint_client.try_nilify(&unauthorized, &receiver, &src_eid, &sender, &nonce, &None);
+    assert_eq!(result.err().unwrap().ok().unwrap(), EndpointError::Unauthorized.into());
+}
+
+#[test]
+#[should_panic(expected = "Error(Auth, InvalidAction)")]
+fn test_nilify_requires_auth_even_when_caller_is_receiver() {
+    let context = setup();
+    let env = &context.env;
+    let endpoint_client = &context.endpoint_client;
+
+    let receiver = Address::generate(env);
+    let src_eid = 2;
+    let sender = BytesN::from_array(env, &[1u8; 32]);
+    let nonce = 1u64;
+
+    // No mock_auth here: require_oapp_auth passes the (caller == receiver) check,
+    // then panics at caller.require_auth().
+    endpoint_client.nilify(&receiver, &receiver, &src_eid, &sender, &nonce, &None);
+}
+
+// Successful nilify with stored (verified) payload hash (state update + event emission)
 #[test]
 fn test_nilify_success_with_stored_payload() {
-    let test_setup = setup();
-    let env = &test_setup.env;
-    let endpoint_client = &test_setup.endpoint_client;
+    let context = setup();
+    let env = &context.env;
+    let endpoint_client = &context.endpoint_client;
 
     let receiver = Address::generate(env);
     let src_eid = 2;
@@ -15,31 +87,17 @@ fn test_nilify_success_with_stored_payload() {
     let nonce = 1;
     let payload_hash = BytesN::from_array(env, &[0xabu8; 32]);
 
-    // Store a payload hash first
-    env.as_contract(&endpoint_client.address, || {
-        EndpointV2::inbound(env, &receiver, src_eid, &sender, nonce, &payload_hash)
-    });
+    // Store a payload hash first.
+    context.inbound_as_verified(&receiver, src_eid, &sender, nonce, &payload_hash);
 
-    // Verify payload hash is stored
-    let stored_hash = env.as_contract(&endpoint_client.address, || {
-        storage::EndpointStorage::inbound_payload_hash(env, &receiver, src_eid, &sender, nonce)
-    });
-    assert_eq!(stored_hash, Some(payload_hash.clone()));
-
-    // Nilify the payload
-    endpoint_client
-        .mock_auths(&[soroban_sdk::testutils::MockAuth {
-            address: &receiver,
-            invoke: &soroban_sdk::testutils::MockAuthInvoke {
-                contract: &endpoint_client.address,
-                fn_name: "nilify",
-                args: (&receiver, &receiver, &src_eid, &sender, &nonce, &Some(payload_hash.clone())).into_val(env),
-                sub_invokes: &[],
-            },
-        }])
-        .nilify(&receiver, &receiver, &src_eid, &sender, &nonce, &Some(payload_hash.clone()));
-
-    // Verify PacketNilified event was emitted
+    // Verify payload hash is stored.
+    assert_eq!(endpoint_client.inbound_payload_hash(&receiver, &src_eid, &sender, &nonce), Some(payload_hash.clone()));
+
+    // Nilify the payload.
+    let payload_hash_opt = Some(payload_hash.clone());
+    nilify_with_auth(&context, &receiver, &receiver, src_eid, &sender, nonce, &payload_hash_opt);
+
+    // Verify PacketNilified event was emitted.
     assert_event(
         env,
         &endpoint_client.address,
@@ -52,63 +110,132 @@ fn test_nilify_success_with_stored_payload() {
         },
     );
 
-    // Verify payload hash was replaced with nil hash
-    let nilified_hash = env.as_contract(&endpoint_client.address, || {
-        storage::EndpointStorage::inbound_payload_hash(env, &receiver, src_eid, &sender, nonce)
-    });
-    let expected_nil_hash = env.as_contract(&endpoint_client.address, || EndpointV2::nil_payload_hash(env));
+    // Verify payload hash was replaced with nil hash.
+    let nilified_hash = endpoint_client.inbound_payload_hash(&receiver, &src_eid, &sender, &nonce);
+    let expected_nil_hash = nil_hash(&context);
     assert_eq!(nilified_hash, Some(expected_nil_hash));
 }
 
+// Successful nilify with None (non-verified nonce) when nonce > lazy nonce
 #[test]
 fn test_nilify_success_with_empty_payload() {
-    let test_setup = setup();
-    let env = &test_setup.env;
-    let endpoint_client = &test_setup.endpoint_client;
+    let context = setup();
+    let env = &context.env;
+    let endpoint_client = &context.endpoint_client;
 
     let receiver = Address::generate(env);
     let src_eid = 2;
     let sender = BytesN::from_array(env, &[1u8; 32]);
     let nonce = 2;
 
-    // Set lazy nonce to 1 so nonce 2 is greater than lazy nonce
+    // Set lazy nonce to 1 so nonce 2 is greater than lazy nonce.
     env.as_contract(&endpoint_client.address, || {
         storage::EndpointStorage::set_lazy_inbound_nonce(env, &receiver, src_eid, &sender, &1)
     });
 
-    // Nilify with None
-    endpoint_client
-        .mock_auths(&[soroban_sdk::testutils::MockAuth {
-            address: &receiver,
-            invoke: &soroban_sdk::testutils::MockAuthInvoke {
-                contract: &endpoint_client.address,
-                fn_name: "nilify",
-                args: (&receiver, &receiver, &src_eid, &sender, &nonce, &None::<BytesN<32>>).into_val(env),
-                sub_invokes: &[],
-            },
-        }])
-        .nilify(&receiver, &receiver, &src_eid, &sender, &nonce, &None);
-
-    // Verify PacketNilified event was emitted
+    // Nilify with None.
+    nilify_with_auth(&context, &receiver, &receiver, src_eid, &sender, nonce, &None);
+
+    // Verify PacketNilified event was emitted.
     assert_event(
         env,
         &endpoint_client.address,
         PacketNilified { src_eid, sender: sender.clone(), receiver: receiver.clone(), nonce, payload_hash: None },
     );
 
-    // Verify payload hash was set to nil hash
-    let nilified_hash = env.as_contract(&endpoint_client.address, || {
-        storage::EndpointStorage::inbound_payload_hash(env, &receiver, src_eid, &sender, nonce)
-    });
-    let expected_nil_hash = env.as_contract(&endpoint_client.address, || EndpointV2::nil_payload_hash(env));
+    // Verify payload hash was set to nil hash.
+    let nilified_hash = endpoint_client.inbound_payload_hash(&receiver, &src_eid, &sender, &nonce);
+    let expected_nil_hash = nil_hash(&context);
     assert_eq!(nilified_hash, Some(expected_nil_hash));
 }
 
+// Nilify with None counts as "verified" for inbound_nonce (but does not change lazy nonce)
+#[test]
+fn test_nilify_with_none_advances_inbound_nonce_without_changing_lazy_nonce() {
+    let context = setup();
+    let env = &context.env;
+    let endpoint_client = &context.endpoint_client;
+
+    let receiver = Address::generate(env);
+    let src_eid = 2;
+    let sender = BytesN::from_array(env, &[1u8; 32]);
+
+    // Initial state.
+    assert_eq!(endpoint_client.lazy_inbound_nonce(&receiver, &src_eid, &sender), 0);
+    assert_eq!(endpoint_client.inbound_nonce(&receiver, &src_eid, &sender), 0);
+
+    // Nilify nonce 1 with None (non-verified nonce).
+    nilify_with_auth(&context, &receiver, &receiver, src_eid, &sender, 1, &None);
+
+    // Nilify writes a payload hash, so inbound_nonce can now advance to 1.
+    assert_eq!(endpoint_client.inbound_nonce(&receiver, &src_eid, &sender), 1);
+
+    // But nilify does not update lazy_inbound_nonce.
+    assert_eq!(endpoint_client.lazy_inbound_nonce(&receiver, &src_eid, &sender), 0);
+}
+
+// Nilify is allowed when nonce <= lazy nonce if a payload hash exists
+#[test]
+fn test_nilify_allows_when_nonce_is_checkpointed_if_payload_exists() {
+    let context = setup();
+    let env = &context.env;
+    let endpoint_client = &context.endpoint_client;
+
+    let receiver = Address::generate(env);
+    let src_eid = 2;
+    let sender = BytesN::from_array(env, &[1u8; 32]);
+    let nonce = 5u64;
+    let payload_hash = BytesN::from_array(env, &[0xabu8; 32]);
+
+    // Checkpoint past the target nonce.
+    env.as_contract(&endpoint_client.address, || {
+        storage::EndpointStorage::set_lazy_inbound_nonce(env, &receiver, src_eid, &sender, &10)
+    });
+    assert_eq!(endpoint_client.lazy_inbound_nonce(&receiver, &src_eid, &sender), 10);
+
+    // Store a verified payload hash at nonce 5.
+    context.inbound_as_verified(&receiver, src_eid, &sender, nonce, &payload_hash);
+    assert_eq!(endpoint_client.inbound_payload_hash(&receiver, &src_eid, &sender, &nonce), Some(payload_hash.clone()));
+
+    // Even though nonce <= lazy_nonce, this should succeed because a payload hash exists.
+    let payload_hash_opt = Some(payload_hash.clone());
+    nilify_with_auth(&context, &receiver, &receiver, src_eid, &sender, nonce, &payload_hash_opt);
+    assert_eq!(endpoint_client.inbound_payload_hash(&receiver, &src_eid, &sender, &nonce), Some(nil_hash(&context)));
+}
+
+// Nilify is idempotent if the caller passes the current stored payload hash (including nil hash)
+#[test]
+fn test_nilify_allows_repeated_call_when_already_nilified() {
+    let context = setup();
+    let env = &context.env;
+    let endpoint_client = &context.endpoint_client;
+
+    let receiver = Address::generate(env);
+    let src_eid = 2;
+    let sender = BytesN::from_array(env, &[1u8; 32]);
+    let nonce = 1u64;
+    let payload_hash = BytesN::from_array(env, &[0xabu8; 32]);
+
+    // First nilify: verified payload hash -> nil hash.
+    context.inbound_as_verified(&receiver, src_eid, &sender, nonce, &payload_hash);
+    let payload_hash_opt = Some(payload_hash);
+    nilify_with_auth(&context, &receiver, &receiver, src_eid, &sender, nonce, &payload_hash_opt);
+
+    let nil = nil_hash(&context);
+    assert_eq!(endpoint_client.inbound_payload_hash(&receiver, &src_eid, &sender, &nonce), Some(nil.clone()));
+
+    // Second nilify: passing the current stored nil hash should succeed.
+    let nil_opt = Some(nil.clone());
+    nilify_with_auth(&context, &receiver, &receiver, src_eid, &sender, nonce, &nil_opt);
+    assert_eq!(endpoint_client.inbound_payload_hash(&receiver, &src_eid, &sender, &nonce), Some(nil));
+}
+
+// Delegate authorization (delegate(receiver) is allowed)
 #[test]
 fn test_nilify_with_delegate() {
-    let test_setup = setup();
-    let env = &test_setup.env;
-    let endpoint_client = &test_setup.endpoint_client;
+    let context = setup();
+    let env = &context.env;
+    let endpoint_client = &context.endpoint_client;
 
     let receiver = Address::generate(env);
     let delegate = Address::generate(env);
@@ -117,28 +244,17 @@ fn test_nilify_with_delegate() {
     let nonce = 1;
     let payload_hash = BytesN::from_array(env, &[0xcdu8; 32]);
 
-    // Set delegate for receiver
+    // Set delegate for receiver.
     env.as_contract(&endpoint_client.address, || storage::EndpointStorage::set_delegate(env, &receiver, &delegate));
 
-    // Store a payload hash first
-    env.as_contract(&endpoint_client.address, || {
-        EndpointV2::inbound(env, &receiver, src_eid, &sender, nonce, &payload_hash)
-    });
+    // Store a payload hash first.
+    context.inbound_as_verified(&receiver, src_eid, &sender, nonce, &payload_hash);
 
-    // Delegate can nilify on behalf of receiver
-    endpoint_client
-        .mock_auths(&[soroban_sdk::testutils::MockAuth {
-            address: &delegate,
-            invoke: &soroban_sdk::testutils::MockAuthInvoke {
-                contract: &endpoint_client.address,
-                fn_name: "nilify",
-                args: (&delegate, &receiver, &src_eid, &sender, &nonce, &Some(payload_hash.clone())).into_val(env),
-                sub_invokes: &[],
-            },
-        }])
-        .nilify(&delegate, &receiver, &src_eid, &sender, &nonce, &Some(payload_hash.clone()));
-
-    // Verify PacketNilified event was emitted
+    // Delegate can nilify on behalf of receiver.
+    let payload_hash_opt = Some(payload_hash.clone());
+    nilify_with_auth(&context, &delegate, &receiver, src_eid, &sender, nonce, &payload_hash_opt);
+
+    // Verify PacketNilified event was emitted.
     assert_event(
         env,
         &endpoint_client.address,
@@ -151,19 +267,18 @@ fn test_nilify_with_delegate() {
         },
     );
 
-    // Verify payload hash was replaced with nil hash
-    let nilified_hash = env.as_contract(&endpoint_client.address, || {
-        storage::EndpointStorage::inbound_payload_hash(env, &receiver, src_eid, &sender, nonce)
-    });
-    let expected_nil_hash = env.as_contract(&endpoint_client.address, || EndpointV2::nil_payload_hash(env));
+    // Verify payload hash was replaced with nil hash.
+    let nilified_hash = endpoint_client.inbound_payload_hash(&receiver, &src_eid, &sender, &nonce);
+    let expected_nil_hash = nil_hash(&context);
     assert_eq!(nilified_hash, Some(expected_nil_hash));
 }
 
+// Nilify affects only the targeted nonce (multiple nonces stay independent)
 #[test]
 fn test_nilify_multiple_payloads() {
-    let test_setup = setup();
-    let env = &test_setup.env;
-    let endpoint_client = &test_setup.endpoint_client;
+    let context = setup();
+    let env = &context.env;
+    let endpoint_client = &context.endpoint_client;
 
     let receiver = Address::generate(env);
     let src_eid = 2;
@@ -173,59 +288,34 @@ fn test_nilify_multiple_payloads() {
     let nonce1 = 1;
     let nonce2 = 2;
 
-    // Store multiple payload hashes
-    env.as_contract(&endpoint_client.address, || {
-        EndpointV2::inbound(env, &receiver, src_eid, &sender, nonce1, &payload_hash1)
-    });
-    env.as_contract(&endpoint_client.address, || {
-        EndpointV2::inbound(env, &receiver, src_eid, &sender, nonce2, &payload_hash2)
-    });
+    // Store multiple payload hashes.
+    context.inbound_as_verified(&receiver, src_eid, &sender, nonce1, &payload_hash1);
+    context.inbound_as_verified(&receiver, src_eid, &sender, nonce2, &payload_hash2);
 
-    // Nilify first payload
-    endpoint_client
-        .mock_auths(&[soroban_sdk::testutils::MockAuth {
-            address: &receiver,
-            invoke: &soroban_sdk::testutils::MockAuthInvoke {
-                contract: &endpoint_client.address,
-                fn_name: "nilify",
-                args: (&receiver, &receiver, &src_eid, &sender, &nonce1, &Some(payload_hash1.clone())).into_val(env),
-                sub_invokes: &[],
-            },
-        }])
-        .nilify(&receiver, &receiver, &src_eid, &sender, &nonce1, &Some(payload_hash1.clone()));
-
-    // Nilify second payload
-    endpoint_client
-        .mock_auths(&[soroban_sdk::testutils::MockAuth {
-            address: &receiver,
-            invoke: &soroban_sdk::testutils::MockAuthInvoke {
-                contract: &endpoint_client.address,
-                fn_name: "nilify",
-                args: (&receiver, &receiver, &src_eid, &sender, &nonce2, &Some(payload_hash2.clone())).into_val(env),
-                sub_invokes: &[],
-            },
-        }])
-        .nilify(&receiver, &receiver, &src_eid, &sender, &nonce2, &Some(payload_hash2.clone()));
-
-    // Verify both payload hashes were replaced with nil hash
-    let expected_nil_hash = env.as_contract(&endpoint_client.address, || EndpointV2::nil_payload_hash(env));
-
-    let nilified_hash1 = env.as_contract(&endpoint_client.address, || {
-        storage::EndpointStorage::inbound_payload_hash(env, &receiver, src_eid, &sender, nonce1)
-    });
-    let nilified_hash2 = env.as_contract(&endpoint_client.address, || {
-        storage::EndpointStorage::inbound_payload_hash(env, &receiver, src_eid, &sender, nonce2)
-    });
+    // Nilify first payload.
+    let payload_hash1_opt = Some(payload_hash1.clone());
+    nilify_with_auth(&context, &receiver, &receiver, src_eid, &sender, nonce1, &payload_hash1_opt);
+
+    // Nilify second payload.
+    let payload_hash2_opt = Some(payload_hash2.clone());
+    nilify_with_auth(&context, &receiver, &receiver, src_eid, &sender, nonce2, &payload_hash2_opt);
+
+    // Verify both payload hashes were replaced with nil hash.
+    let expected_nil_hash = nil_hash(&context);
+
+    let nilified_hash1 = endpoint_client.inbound_payload_hash(&receiver, &src_eid, &sender, &nonce1);
+    let nilified_hash2 = endpoint_client.inbound_payload_hash(&receiver, &src_eid, &sender, &nonce2);
 
     assert_eq!(nilified_hash1, Some(expected_nil_hash.clone()));
     assert_eq!(nilified_hash2, Some(expected_nil_hash));
 }
 
+// Path isolation (receiver/src_eid/sender are isolated)
 #[test]
 fn test_nilify_different_paths() {
-    let test_setup = setup();
-    let env = &test_setup.env;
-    let endpoint_client = &test_setup.endpoint_client;
+    let context = setup();
+    let env = &context.env;
+    let endpoint_client = &context.endpoint_client;
 
     let receiver1 = Address::generate(env);
     let receiver2 = Address::generate(env);
@@ -236,89 +326,115 @@ fn test_nilify_different_paths() {
     let nonce = 1;
     let payload_hash = BytesN::from_array(env, &[0xefu8; 32]);
 
-    // Store payload hashes for different paths
-    env.as_contract(&endpoint_client.address, || {
-        EndpointV2::inbound(env, &receiver1, src_eid1, &sender1, nonce, &payload_hash)
-    });
-    env.as_contract(&endpoint_client.address, || {
-        EndpointV2::inbound(env, &receiver2, src_eid1, &sender1, nonce, &payload_hash)
-    });
-    env.as_contract(&endpoint_client.address, || {
-        EndpointV2::inbound(env, &receiver1, src_eid2, &sender1, nonce, &payload_hash)
-    });
-    env.as_contract(&endpoint_client.address, || {
-        EndpointV2::inbound(env, &receiver1, src_eid1, &sender2, nonce, &payload_hash)
-    });
+    // Store payload hashes for different paths.
+    context.inbound_as_verified(&receiver1, src_eid1, &sender1, nonce, &payload_hash);
+    context.inbound_as_verified(&receiver2, src_eid1, &sender1, nonce, &payload_hash);
+    context.inbound_as_verified(&receiver1, src_eid2, &sender1, nonce, &payload_hash);
+    context.inbound_as_verified(&receiver1, src_eid1, &sender2, nonce, &payload_hash);
 
-    // Nilify for different receivers
-    endpoint_client
-        .mock_auths(&[soroban_sdk::testutils::MockAuth {
-            address: &receiver1,
-            invoke: &soroban_sdk::testutils::MockAuthInvoke {
-                contract: &endpoint_client.address,
-                fn_name: "nilify",
-                args: (&receiver1, &receiver1, &src_eid1, &sender1, &nonce, &Some(payload_hash.clone())).into_val(env),
-                sub_invokes: &[],
-            },
-        }])
-        .nilify(&receiver1, &receiver1, &src_eid1, &sender1, &nonce, &Some(payload_hash.clone()));
-
-    endpoint_client
-        .mock_auths(&[soroban_sdk::testutils::MockAuth {
-            address: &receiver2,
-            invoke: &soroban_sdk::testutils::MockAuthInvoke {
-                contract: &endpoint_client.address,
-                fn_name: "nilify",
-                args: (&receiver2, &receiver2, &src_eid1, &sender1, &nonce, &Some(payload_hash.clone())).into_val(env),
-                sub_invokes: &[],
-            },
-        }])
-        .nilify(&receiver2, &receiver2, &src_eid1, &sender1, &nonce, &Some(payload_hash.clone()));
-
-    // Nilify for different src_eids
-    endpoint_client
-        .mock_auths(&[soroban_sdk::testutils::MockAuth {
-            address: &receiver1,
-            invoke: &soroban_sdk::testutils::MockAuthInvoke {
-                contract: &endpoint_client.address,
-                fn_name: "nilify",
-                args: (&receiver1, &receiver1, &src_eid2, &sender1, &nonce, &Some(payload_hash.clone())).into_val(env),
-                sub_invokes: &[],
-            },
-        }])
-        .nilify(&receiver1, &receiver1, &src_eid2, &sender1, &nonce, &Some(payload_hash.clone()));
-
-    // Nilify for different senders
-    endpoint_client
-        .mock_auths(&[soroban_sdk::testutils::MockAuth {
-            address: &receiver1,
-            invoke: &soroban_sdk::testutils::MockAuthInvoke {
-                contract: &endpoint_client.address,
-                fn_name: "nilify",
-                args: (&receiver1, &receiver1, &src_eid1, &sender2, &nonce, &Some(payload_hash.clone())).into_val(env),
-                sub_invokes: &[],
-            },
-        }])
-        .nilify(&receiver1, &receiver1, &src_eid1, &sender2, &nonce, &Some(payload_hash.clone()));
-
-    // Verify all paths have been nilified independently
-    let expected_nil_hash = env.as_contract(&endpoint_client.address, || EndpointV2::nil_payload_hash(env));
-
-    let nilified_hash1 = env.as_contract(&endpoint_client.address, || {
-        storage::EndpointStorage::inbound_payload_hash(env, &receiver1, src_eid1, &sender1, nonce)
-    });
-    let nilified_hash2 = env.as_contract(&endpoint_client.address, || {
-        storage::EndpointStorage::inbound_payload_hash(env, &receiver2, src_eid1, &sender1, nonce)
-    });
-    let nilified_hash3 = env.as_contract(&endpoint_client.address, || {
-        storage::EndpointStorage::inbound_payload_hash(env, &receiver1, src_eid2, &sender1, nonce)
-    });
-    let nilified_hash4 = env.as_contract(&endpoint_client.address, || {
-        storage::EndpointStorage::inbound_payload_hash(env, &receiver1, src_eid1, &sender2, nonce)
-    });
+    // Nilify for different receivers.
+    let payload_hash_opt = Some(payload_hash.clone());
+    nilify_with_auth(&context, &receiver1, &receiver1, src_eid1, &sender1, nonce, &payload_hash_opt);
+
+    nilify_with_auth(&context, &receiver2, &receiver2, src_eid1, &sender1, nonce, &payload_hash_opt);
+
+    // Nilify for different src_eids.
+    nilify_with_auth(&context, &receiver1, &receiver1, src_eid2, &sender1, nonce, &payload_hash_opt);
+
+    // Nilify for different senders.
+    nilify_with_auth(&context, &receiver1, &receiver1, src_eid1, &sender2, nonce, &payload_hash_opt);
+
+    // Verify all paths have been nilified independently.
+    let expected_nil_hash = nil_hash(&context);
+
+    let nilified_hash1 = endpoint_client.inbound_payload_hash(&receiver1, &src_eid1, &sender1, &nonce);
+    let nilified_hash2 = endpoint_client.inbound_payload_hash(&receiver2, &src_eid1, &sender1, &nonce);
+    let nilified_hash3 = endpoint_client.inbound_payload_hash(&receiver1, &src_eid2, &sender1, &nonce);
+    let nilified_hash4 = endpoint_client.inbound_payload_hash(&receiver1, &src_eid1, &sender2, &nonce);
 
     assert_eq!(nilified_hash1, Some(expected_nil_hash.clone()));
     assert_eq!(nilified_hash2, Some(expected_nil_hash.clone()));
     assert_eq!(nilified_hash3, Some(expected_nil_hash.clone()));
     assert_eq!(nilified_hash4, Some(expected_nil_hash));
 }
+
+// Failure if payload_hash does not match the stored value
+#[test]
+fn test_nilify_payload_hash_not_found_when_mismatch() {
+    let context = setup();
+    let env = &context.env;
+
+    let receiver = Address::generate(env);
+    let src_eid = 2;
+    let sender = BytesN::from_array(env, &[1u8; 32]);
+    let nonce = 1u64;
+    let payload_hash = BytesN::from_array(env, &[0xabu8; 32]);
+    let wrong_payload_hash = BytesN::from_array(env, &[0x11u8; 32]);
+
+    // Store a payload hash first.
+    context.inbound_as_verified(&receiver, src_eid, &sender, nonce, &payload_hash);
+
+    // Attempt nilify with wrong expected hash.
+    let wrong_payload_hash_opt = Some(wrong_payload_hash.clone());
+    let result = try_nilify_with_auth(&context, &receiver, &receiver, src_eid, &sender, nonce, &wrong_payload_hash_opt);
+    assert_eq!(result.err().unwrap().ok().unwrap(), EndpointError::PayloadHashNotFound.into());
+}
+
+#[test]
+fn test_nilify_payload_hash_not_found_when_expected_some_but_storage_none() {
+    let context = setup();
+    let env = &context.env;
+
+    let receiver = Address::generate(env);
+    let src_eid = 2;
+    let sender = BytesN::from_array(env, &[1u8; 32]);
+    let nonce = 1u64;
+    let expected_hash = BytesN::from_array(env, &[0xabu8; 32]);
+
+    // Storage has no payload hash for (receiver, src_eid, sender, nonce).
+    let expected_hash_opt = Some(expected_hash);
+    let result = try_nilify_with_auth(&context, &receiver, &receiver, src_eid, &sender, nonce, &expected_hash_opt);
+    assert_eq!(result.err().unwrap().ok().unwrap(), EndpointError::PayloadHashNotFound.into());
+}
+
+#[test]
+fn test_nilify_payload_hash_not_found_when_none_but_payload_exists() {
+    let context = setup();
+    let env = &context.env;
+    let endpoint_client = &context.endpoint_client;
+
+    let receiver = Address::generate(env);
+    let src_eid = 2;
+    let sender = BytesN::from_array(env, &[1u8; 32]);
+    let nonce = 1u64;
+    let payload_hash = BytesN::from_array(env, &[0xabu8; 32]);
+
+    // Store a payload hash first.
+    context.inbound_as_verified(&receiver, src_eid, &sender, nonce, &payload_hash);
+    assert_eq!(endpoint_client.inbound_payload_hash(&receiver, &src_eid, &sender, &nonce), Some(payload_hash));
+
+    // Calling nilify with None should fail, because payload_hash must match the stored value.
+    let result = try_nilify_with_auth(&context, &receiver, &receiver, src_eid, &sender, nonce, &None);
+    assert_eq!(result.err().unwrap().ok().unwrap(), EndpointError::PayloadHashNotFound.into());
+}
+
+// Failure when nonce is already checkpointed and there is no stored payload hash
+#[test]
+fn test_nilify_invalid_nonce_when_already_checkpointed_without_payload() {
+    let context = setup();
+    let env = &context.env;
+    let endpoint_client = &context.endpoint_client;
+
+    let receiver = Address::generate(env);
+    let src_eid = 2;
+    let sender = BytesN::from_array(env, &[1u8; 32]);
+    let nonce = 1u64;
+
+    // Set lazy nonce to 1 and ensure there is NO payload for nonce 1.
+    env.as_contract(&endpoint_client.address, || {
+        storage::EndpointStorage::set_lazy_inbound_nonce(env, &receiver, src_eid, &sender, &1)
+    });
+
+    let result = try_nilify_with_auth(&context, &receiver, &receiver, src_eid, &sender, nonce, &None);
+    assert_eq!(result.err().unwrap().ok().unwrap(), EndpointError::InvalidNonce.into());
+}