@ledgerhq/coin-tezos 10.2.4 → 10.2.6

package/src/api/index.ts

@@ -20,7 +20,6 @@ import type {
 import { rejectBalanceOptions } from '@ledgerhq/coin-module-framework/api/getBalance/rejectBalanceOptions'
 import { IncorrectTypeError } from '@ledgerhq/coin-module-framework/api/index'
 import { craftTransactionData } from '@ledgerhq/coin-module-framework/logic/craftTransactionData'
-import { getRevealFee } from '@taquito/taquito'
 import { getPkhfromPk, validatePublicKey, ValidationResult } from '@taquito/utils'
 import {
   broadcast,
@@ -37,6 +36,7 @@ import {
   rawEncode,
   validateIntent,
 } from '../logic'
+import { getRevealFeeForEstimation } from '../logic/estimateFees'
 import { getTezosToolkit } from '../logic/tezosToolkit'
 import { validateAddress } from '../logic/validateAddress'
 import { hasManagerKey } from '../network/types'
@@ -107,6 +107,27 @@ function isTezosTransactionType(
 ): type is 'send' | 'delegate' | 'undelegate' | 'stake' | 'unstake' | 'finalize_unstake' {
   return ['send', 'delegate', 'undelegate', 'stake', 'unstake', 'finalize_unstake'].includes(type)
 }
+/**
+ * Whether a failed estimation is the `contract.manager.inconsistent_hash` case that the
+ * keyless retry exists for. Taquito surfaces it as an HTTP error whose body carries the
+ * protocol error id.
+ */
+function isInconsistentHashError(error: unknown): boolean {
+  if (typeof error !== 'object' || error === null) {
+    return false
+  }
+  const parts: unknown[] = []
+  if ('message' in error) {
+    parts.push(error.message)
+  }
+  if ('body' in error) {
+    parts.push(error.body)
+  }
+  return parts.some(
+    (part) => typeof part === 'string' && part.includes('contract.manager.inconsistent_hash')
+  )
+}
+
 async function craft(
   context: TezosContext,
   transactionIntent: TransactionIntent,
@@ -160,25 +181,24 @@ async function craft(
   const needsReveal = hasManagerKey(senderApiAcc) && !senderApiAcc.revealed
   const totalFee = Number(fee.fees || '0')
 
-  const feesConfig = config.fees
   const revealFeeForSplit = needsReveal
-    ? Math.max(feesConfig.minFees ?? 0, getRevealFee(transactionIntent.sender))
+    ? getRevealFeeForEstimation(config, transactionIntent.sender)
     : 0
 
-  let txFee: number
-  if (customFees) {
-    txFee = needsReveal ? Math.max(totalFee - revealFeeForSplit, 0) : totalFee
-  } else if (estimation.parameters?.txFee !== undefined) {
-    txFee = Number(estimation.parameters.txFee)
-  } else {
-    txFee = needsReveal ? Math.max(totalFee - revealFeeForSplit, 0) : totalFee
-  }
+  // The device compares the sum of the batch fees against the single total it was handed, so the
+  // split has to close exactly.
+  const desiredTxFee =
+    !customFees && estimation.parameters?.txFee !== undefined
+      ? Number(estimation.parameters.txFee)
+      : totalFee - revealFeeForSplit
+  const txFee = Math.min(Math.max(desiredTxFee, 0), totalFee)
+  const revealFee = totalFee - txFee
 
   const txForCraft = {
     type: mappedType,
     recipient: transactionIntent.recipient,
     amount: amountToUse,
-    fee: { ...fee, fees: txFee.toString() },
+    fee: { ...fee, fees: txFee.toString(), revealFees: revealFee.toString() },
     ...(tokenCraftInfo && {
       contractAddress: tokenCraftInfo.contractAddress,
       tokenId: tokenCraftInfo.tokenId,
@@ -304,6 +324,13 @@ async function estimate(
       // it's not clear why this happens, it couldn't be further investigated
       // so we fallback to make an estimation without the public key
       // there is a test that covers this, see "fallback to an estimation without the public key" index-mainnet.integ.test.ts
+      //
+      // A token estimate retries only for that error. Otherwise the keyless retry throws
+      // PublicKeyNotFoundError, and the native-transfer fallback answering it under-provisions
+      // the FA2 transfer. Other modes still depend on reaching that fallback.
+      if (tezosModeForEstimate === 'send_token' && !isInconsistentHashError(error)) {
+        throw error
+      }
       context.logger('estimate-error', 'error estimating fees, trying without pubkey', { error })
       estimation = await logicEstimate()
     }
@@ -325,6 +352,14 @@ async function estimate(
   } catch (error: unknown) {
     // Handle PublicKeyNotFoundError
     if (error instanceof Error && error.message.includes('Public key not found')) {
+      // Everything below describes a native tez transfer. An FA2 transfer costs several times
+      // more gas and the amounts vary per contract, so these values silently under-provision
+      // it: the operation is crafted correctly and the chain rejects it with gas_exhausted,
+      // charging the fee.
+      if (tezosModeForEstimate === 'send_token') {
+        throw error
+      }
+
       const apiAccount = await api.getAccountByAddress(transactionIntent.recipient)
       const storageLimit =
         !hasEmptyBalance(apiAccount) || transactionIntent.type === 'stake' ? 0n : 277n
@@ -350,11 +385,11 @@ async function estimate(
       } catch {
         // When estimation fails because the sender is unrevealed (PublicKeyNotFoundError),
         // fallback to a conservative gas value suitable for typical new-account XTZ transfers.
-        // This buffer (~2500 gas) is more than enough for a standard transfer that actually uses ~1420 gas.
+        // A standard transfer consumes about 2169 gas, so 2500 leaves a small margin.
         // The fee is computed according to Taquito's calculation so it will satisfy the Tezos prefilter rule:
         //   total_fees >= ceil(100 + 0.1*total_gas + op_size)
         // We use a base of 120 instead of 100 to mimic Taquito and minimize rejected low-fee ops.
-        const SAFE_FALLBACK_GAS = 2500 // covers typical new-account transfer (~1420) with buffer
+        const SAFE_FALLBACK_GAS = 2500
         const FALLBACK_OP_SIZE_BYTES = 154 // typical forged size for a simple XTZ transfer
         txGasLimit = BigInt(SAFE_FALLBACK_GAS)
         baseTxFee = BigInt(
@@ -366,7 +401,7 @@ async function estimate(
       }
 
       const revealFee = needsReveal
-        ? BigInt(Math.max(config.fees.minFees ?? 0, getRevealFee(transactionIntent.sender)))
+        ? BigInt(getRevealFeeForEstimation(config, transactionIntent.sender))
         : 0n
       const totalFee = baseTxFee + revealFee
 

package/src/logic/craftRawOperations.ts

@@ -232,9 +232,8 @@ async function estimateOperations(
       `craftRawOperations: expected ${expected} estimate(s) for ${operations.length} operation(s), got ${estimates.length}`
     )
   }
-  // Keep the trailing N estimates, dropping a prepended reveal estimate if present. The
-  // REVEAL op itself uses estimateRevealLimits (config-clamped, consistent with
-  // craftTransaction) rather than this batch-prepended value, which is discarded.
+  // Keep the trailing N estimates, dropping a prepended reveal estimate if present. The REVEAL
+  // op itself uses the config-clamped estimateRevealLimits value, not this one.
   return estimates.slice(estimates.length - operations.length)
 }
 

package/src/logic/craftTransaction.test.ts

@@ -177,6 +177,36 @@ describe('craftTransaction', () => {
     ])
   })
 
+  it('stamps the reveal fee the caller supplies, not the node estimate', async () => {
+    // The device asserts that the batch fees sum to the single total the caller reported, which a
+    // reveal priced from the node would break.
+    mockTezosToolkit.rpc.getContract.mockResolvedValue({ counter: '1' })
+    mockTezosToolkit.estimate.reveal.mockResolvedValue({
+      gasLimit: 271,
+      storageLimit: 0,
+      suggestedFeeMutez: 310,
+    })
+    currentConfig = {
+      ...mockConfig,
+      fees: { ...mockConfig.fees, minFees: 0, minRevealGasLimit: 0 },
+    }
+
+    const account = { address: 'tz1...' }
+    const transaction: TransactionInput = {
+      type: 'send',
+      recipient: 'tz2...',
+      amount: BigInt(1000),
+      fee: { fees: '100', gasLimit: '200', storageLimit: '300', revealFees: '334' },
+    }
+    const publicKey = { publicKey: 'publicKey', publicKeyHash: 'publicKeyHash' }
+
+    const result = await craftTransaction(context, account, transaction, publicKey)
+
+    expect(result.contents[0]).toEqual(
+      expect.objectContaining({ kind: OpKind.REVEAL, fee: '334', gas_limit: '271' })
+    )
+  })
+
   describe('when suggested fee is above or below minFees floor', () => {
     it('craft transaction when default estimation is greater than minFees', async () => {
       mockTezosToolkit.rpc.getContract.mockResolvedValue({ counter: '1' })

package/src/logic/craftTransaction.ts

@@ -13,6 +13,12 @@ export type TransactionFee = {
   fees?: string
   gasLimit?: string
   storageLimit?: string
+  /**
+   * Fee to stamp on the leading reveal operation. The caller sets it so the batch fees sum to the
+   * total it already reported. Without it the reveal keeps its own node estimate, which that
+   * total never accounted for.
+   */
+  revealFees?: string
 }
 export type TransactionType =
   | 'OUT'
@@ -76,7 +82,7 @@ export async function craftTransaction(
 
     contents.push({
       kind: OpKind.REVEAL,
-      fee: reveal.fee.toString(),
+      fee: transaction.fee.revealFees ?? reveal.fee.toString(),
       gas_limit: reveal.gasLimit.toString(),
       storage_limit: reveal.storageLimit.toString(),
       source: publicKey.publicKeyHash,

package/src/logic/estimateFees.test.ts

@@ -54,9 +54,19 @@ describe('estimateFees', () => {
     contract: {
       at: jest.fn(),
     },
+    rpc: {
+      getConstants: jest.fn(),
+    },
     setProvider: jest.fn(),
   }
 
+  // Mainnet values; the two are equal, which is what makes a reveal + operation batch
+  // overflow the block limit unless the operation's gas is capped.
+  const MAINNET_GAS_CONSTANTS = {
+    hard_gas_limit_per_operation: 1040000,
+    hard_gas_limit_per_block: 1040000,
+  }
+
   let currentConfig: TezosCoinConfig
   const context: TezosContext = {
     config: async () => currentConfig,
@@ -72,6 +82,7 @@ describe('estimateFees', () => {
     jest
       .mocked<DeepPartialReturn<typeof getTezosToolkit>>(getTezosToolkit)
       .mockReturnValue(mockTezosToolkit)
+    mockTezosToolkit.rpc.getConstants.mockResolvedValue(MAINNET_GAS_CONSTANTS)
     currentConfig = mkConfig(defaultFeesConfig)
   })
 
@@ -779,6 +790,95 @@ describe('estimateFees', () => {
     expect(result.amount).toBe(100n)
   })
 
+  it('send_token unrevealed caps gas so the reveal batch fits the block limit', async () => {
+    const { transfer } = setupFa2ContractMock()
+    mockTezosToolkit.contract.at.mockResolvedValue({ methods: { transfer } })
+    mockTezosToolkit.estimate.transfer.mockResolvedValue({
+      suggestedFeeMutez: 600,
+      gasLimit: 4000,
+      storageLimit: 0,
+      burnFeeMutez: 0,
+      opSize: 250,
+    })
+
+    await estimateFees(context, {
+      account: unrevealedAccount,
+      transaction: {
+        mode: 'send_token',
+        recipient: 'tz1VSUr8wwNhLAzempoch5d6nLRSNtxK8LBr',
+        amount: BigInt(100),
+        contractAddress: 'KT1CpeSQKdkhWi4pinYcseCFKmDhs5M74BkU',
+        tokenId: 0,
+      },
+    })
+
+    // min(1040000, 1040000 / 3): leaves room for the reveal Taquito prepends, so the
+    // simulation does not overflow hard_gas_limit_per_block.
+    expect(mockTezosToolkit.estimate.transfer).toHaveBeenCalledWith(
+      expect.objectContaining({ gasLimit: 346666 })
+    )
+  })
+
+  it('send_token derives the gas cap from protocol constants', async () => {
+    mockTezosToolkit.rpc.getConstants.mockResolvedValue({
+      hard_gas_limit_per_operation: 900000,
+      hard_gas_limit_per_block: 2400000,
+    })
+    const { transfer } = setupFa2ContractMock()
+    mockTezosToolkit.contract.at.mockResolvedValue({ methods: { transfer } })
+    mockTezosToolkit.estimate.transfer.mockResolvedValue({
+      suggestedFeeMutez: 600,
+      gasLimit: 4000,
+      storageLimit: 0,
+      burnFeeMutez: 0,
+      opSize: 250,
+    })
+
+    await estimateFees(context, {
+      account: unrevealedAccount,
+      transaction: {
+        mode: 'send_token',
+        recipient: 'tz1VSUr8wwNhLAzempoch5d6nLRSNtxK8LBr',
+        amount: BigInt(100),
+        contractAddress: 'KT1CpeSQKdkhWi4pinYcseCFKmDhs5M74BkU',
+        tokenId: 0,
+      },
+    })
+
+    // min(900000, 2400000 / 3): the block-derived bound is the tighter one here.
+    expect(mockTezosToolkit.estimate.transfer).toHaveBeenCalledWith(
+      expect.objectContaining({ gasLimit: 800000 })
+    )
+  })
+
+  it('send_token revealed passes no gas cap', async () => {
+    const { transfer } = setupFa2ContractMock()
+    mockTezosToolkit.contract.at.mockResolvedValue({ methods: { transfer } })
+    mockTezosToolkit.estimate.transfer.mockResolvedValue({
+      suggestedFeeMutez: 600,
+      gasLimit: 4000,
+      storageLimit: 0,
+      burnFeeMutez: 0,
+      opSize: 250,
+    })
+
+    await estimateFees(context, {
+      account: revealedAccount,
+      transaction: {
+        mode: 'send_token',
+        recipient: 'tz1VSUr8wwNhLAzempoch5d6nLRSNtxK8LBr',
+        amount: BigInt(100),
+        contractAddress: 'KT1CpeSQKdkhWi4pinYcseCFKmDhs5M74BkU',
+        tokenId: 0,
+      },
+    })
+
+    // No reveal is prepended, so the batch cannot overflow and Taquito keeps its own default.
+    const params = mockTezosToolkit.estimate.transfer.mock.calls.at(-1)?.[0]
+    expect(params).not.toHaveProperty('gasLimit')
+    expect(mockTezosToolkit.rpc.getConstants).not.toHaveBeenCalled()
+  })
+
   it('send_token unrevealed adds reveal fee to estimatedFees', async () => {
     const { transfer } = setupFa2ContractMock()
     mockTezosToolkit.contract.at.mockResolvedValue({ methods: { transfer } })

package/src/logic/estimateFees.ts

@@ -190,9 +190,13 @@ export async function estimateFees(
             },
           ])
           .toTransferParams({ mutez: true })
+        const revealBatchGasLimit = account.revealed
+          ? undefined
+          : await gasLimitForRevealBatch(tezosToolkit)
         estimate = await tezosToolkit.estimate.transfer({
           ...transferParams,
           source: account.address,
+          ...(revealBatchGasLimit !== undefined && { gasLimit: revealBatchGasLimit }),
         })
         break
       }
@@ -405,7 +409,35 @@ function protocolErrorIds(text: string): string[] {
   }
 }
 
-function getRevealFeeForEstimation(config: TezosCoinConfig, address: string): number {
+/**
+ * Gas limit to hand Taquito when the source account is unrevealed.
+ *
+ * Taquito prepends a reveal to any operation from an unrevealed account, then gives the
+ * operation itself `hard_gas_limit_per_operation` for the simulation. Mainnet sets
+ * `hard_gas_limit_per_block` to that same value, so the reveal's own gas tips the batch past
+ * the block limit and the node answers HTTP 500 `gas_exhausted.block`. Without a cap the
+ * estimation fails and the caller falls back to native-transfer constants, which are far too
+ * small for an FA2 transfer.
+ *
+ * Mirrors Taquito's own batch adjustment, `min(perOperation, perBlock / (opCount + 1))`, so
+ * the value tracks the protocol rather than a hardcoded figure.
+ */
+async function gasLimitForRevealBatch(
+  tezosToolkit: ReturnType<typeof getTezosToolkit>
+): Promise<number> {
+  const constants = await tezosToolkit.rpc.getConstants()
+  const perOperation = Number(constants.hard_gas_limit_per_operation)
+  const perBlock = Number(constants.hard_gas_limit_per_block)
+  const REVEAL_PLUS_OPERATION = 2
+  return Math.floor(Math.min(perOperation, perBlock / (REVEAL_PLUS_OPERATION + 1)))
+}
+
+/**
+ * Reveal fee the estimation reports as part of the total, derived from Taquito's static per-curve
+ * table rather than a node estimate. The account is unrevealed and the public key is often absent
+ * at estimation time, so `estimate.reveal()` is not reliably available here.
+ */
+export function getRevealFeeForEstimation(config: TezosCoinConfig, address: string): number {
   const minFees = config.fees.minFees ?? 0
   return Math.max(minFees, getRevealFee(address))
 }