@morpho-org/evm-simulation 4.0.1 → 4.1.2

package/lib/cjs/simulate/backends/eth-simulate-v1.d.ts

@@ -6,14 +6,13 @@ import type { RawSimulationResult, SimulationTransaction } from "../../types.js"
  * Uses stateOverride to set the user's ETH balance high enough to avoid
  * false "insufficient balance for gas" reverts.
  *
- * Derives `assetChanges` (net per-token deltas grouped by account) from the
- * emitted transfer logs, plus native ETH from each transaction's top-level
- * `value` (payer debited, recipient credited, under viem's `ethAddress`).
- *
- * Coverage on this path is therefore narrower than the Tenderly backend:
- * native ETH moved through internal calls (e.g. a `WETH.withdraw` refund, a
- * swap that pays out ETH) emits no log and is not reflected in `value`, so it
- * is not captured. For full native-ETH accounting use Tenderly.
+ * Runs with `traceTransfers` enabled, so the node synthesizes native-ETH moves
+ * (the top-level `value` *and* ETH moved through internal calls — e.g. a
+ * `WETH.withdraw` refund or a swap that pays out ETH) as `Transfer` events from
+ * the native sentinel. Derives `assetChanges` (net per-token deltas grouped by
+ * account) entirely from the emitted transfer logs, with native ETH normalized
+ * to viem's `ethAddress`. Top-level `value` is intentionally *not* added on top:
+ * `traceTransfers` already logs it, so adding it would double-count.
  */
 export declare function simulateV1(params: {
     rpcUrl: string;

package/lib/cjs/simulate/backends/eth-simulate-v1.js

@@ -11,14 +11,13 @@ const index_js_1 = require("../parsing/index.js");
  * Uses stateOverride to set the user's ETH balance high enough to avoid
  * false "insufficient balance for gas" reverts.
  *
- * Derives `assetChanges` (net per-token deltas grouped by account) from the
- * emitted transfer logs, plus native ETH from each transaction's top-level
- * `value` (payer debited, recipient credited, under viem's `ethAddress`).
- *
- * Coverage on this path is therefore narrower than the Tenderly backend:
- * native ETH moved through internal calls (e.g. a `WETH.withdraw` refund, a
- * swap that pays out ETH) emits no log and is not reflected in `value`, so it
- * is not captured. For full native-ETH accounting use Tenderly.
+ * Runs with `traceTransfers` enabled, so the node synthesizes native-ETH moves
+ * (the top-level `value` *and* ETH moved through internal calls — e.g. a
+ * `WETH.withdraw` refund or a swap that pays out ETH) as `Transfer` events from
+ * the native sentinel. Derives `assetChanges` (net per-token deltas grouped by
+ * account) entirely from the emitted transfer logs, with native ETH normalized
+ * to viem's `ethAddress`. Top-level `value` is intentionally *not* added on top:
+ * `traceTransfers` already logs it, so adding it would double-count.
  */
 async function simulateV1(params) {
     const { rpcUrl, transactions, blockNumber, signal } = params;
@@ -53,9 +52,17 @@ async function simulateV1(params) {
             account: sender,
             calls,
             ...blockParam,
+            // Synthesize native-ETH moves (top-level value + internal calls) as
+            // Transfer logs from the native sentinel, so `parseTransfers` captures
+            // ETH that emits no real log (e.g. a WETH.withdraw refund).
+            traceTransfers: true,
             // Inflate sender ETH balance to prevent false "insufficient gas" reverts.
             // Without this, valid ERC20 flows fail when the sender has low ETH.
-            stateOverrides: [{ address: sender, balance: viem_1.maxUint256 }],
+            // Use half of uint256 (not the ceiling) so the override leaves headroom
+            // for inbound native ETH — e.g. a WETH.withdraw refund or a swap payout
+            // would overflow the recipient balance and revert the value transfer if
+            // the sender were pinned at maxUint256.
+            stateOverrides: [{ address: sender, balance: viem_1.maxUint256 / 2n }],
         });
         const results = simulationResult.results;
         if (!Array.isArray(results)) {
@@ -77,10 +84,7 @@ async function simulateV1(params) {
         }));
         return {
             calls: rawCalls,
-            assetChanges: toAssetChanges({
-                transfers: (0, index_js_1.parseTransfers)(rawCalls),
-                transactions,
-            }),
+            assetChanges: toAssetChanges((0, index_js_1.parseTransfers)(rawCalls)),
         };
     }
     catch (error) {
@@ -92,20 +96,13 @@ async function simulateV1(params) {
     }
 }
 /**
- * Reduce parsed transfer logs and top-level transaction values to net per-token
- * balance changes grouped by account. Native ETH is taken from the top-level
- * `value`s (payer debited, recipient credited — internal moves are not logged,
- * see `simulateV1` for the coverage caveat).
+ * Reduce parsed transfer logs to net per-token balance changes grouped by
+ * account. With `traceTransfers` enabled, native ETH (top-level and internal)
+ * arrives as transfer logs under viem's `ethAddress`, so no separate top-level
+ * `value` accounting is needed — doing so would double-count.
  */
-function toAssetChanges(params) {
-    const { transfers, transactions } = params;
+function toAssetChanges(transfers) {
     const entries = [];
-    for (const tx of transactions) {
-        if (!tx.value)
-            continue;
-        entries.push({ account: tx.from, token: viem_1.ethAddress, diff: -tx.value });
-        entries.push({ account: tx.to, token: viem_1.ethAddress, diff: tx.value });
-    }
     for (const { token, from, to, amount } of transfers) {
         entries.push({ account: to, token, diff: amount });
         entries.push({ account: from, token, diff: -amount });

package/lib/cjs/simulate/backends/tenderly-rpc.js

@@ -156,7 +156,11 @@ function buildCall(tx) {
     };
 }
 function buildStateOverrides(sender) {
-    return { [sender]: { balance: (0, viem_1.numberToHex)(viem_1.maxUint256) } };
+    // Half of uint256 (not the ceiling) so the override leaves headroom for
+    // inbound native ETH — a WETH.withdraw refund or swap payout would overflow
+    // the recipient balance and revert the value transfer if the sender were
+    // pinned at maxUint256.
+    return { [sender]: { balance: (0, viem_1.numberToHex)(viem_1.maxUint256 / 2n) } };
 }
 function encodeBlock(blockNumber) {
     if (blockNumber === undefined)

package/lib/cjs/simulate/parsing/transfers.d.ts

@@ -14,6 +14,15 @@ export declare const DEPOSIT_TOPIC = "0xe1fffcc4923d04b559f4d29a8bfc6cda04eb5b0d
  * ERC1155 transfer events are **not** parsed — consumers with NFT flows will
  * see an incomplete transfer list.
  *
+ * **Native ETH (`eth_simulateV1` + `traceTransfers`).** When the backend runs
+ * `eth_simulateV1` with `traceTransfers` enabled, native-ETH moves — including
+ * those made through internal calls (e.g. a `WETH.withdraw` refund) — are
+ * synthesized as `Transfer` events emitted from the native sentinel
+ * `0xeee…eee`. These are parsed like any ERC20 transfer, with `token`
+ * collapsed to viem's `ethAddress` so native deltas key consistently across
+ * backends. Tenderly does not emit these synthetic logs (it derives native ETH
+ * separately), so this path is inert there.
+ *
  * **WETH9 dedup assumption — canonical atomic emission.** Dedup is scoped to
  * the same tx: a zero-address `Transfer` is suppressed only if its paired
  * `Deposit`/`Withdrawal` appears in the same `calls[txIdx].logs` slice. This

package/lib/cjs/simulate/parsing/transfers.js

@@ -23,6 +23,15 @@ const UINT256_HEX_LENGTH = 66; // "0x" + 32 bytes
  * ERC1155 transfer events are **not** parsed — consumers with NFT flows will
  * see an incomplete transfer list.
  *
+ * **Native ETH (`eth_simulateV1` + `traceTransfers`).** When the backend runs
+ * `eth_simulateV1` with `traceTransfers` enabled, native-ETH moves — including
+ * those made through internal calls (e.g. a `WETH.withdraw` refund) — are
+ * synthesized as `Transfer` events emitted from the native sentinel
+ * `0xeee…eee`. These are parsed like any ERC20 transfer, with `token`
+ * collapsed to viem's `ethAddress` so native deltas key consistently across
+ * backends. Tenderly does not emit these synthetic logs (it derives native ETH
+ * separately), so this path is inert there.
+ *
  * **WETH9 dedup assumption — canonical atomic emission.** Dedup is scoped to
  * the same tx: a zero-address `Transfer` is suppressed only if its paired
  * `Deposit`/`Withdrawal` appears in the same `calls[txIdx].logs` slice. This
@@ -132,7 +141,7 @@ function parseTransfers(calls, logger) {
                             }
                         }
                         transfers.push({
-                            token: (0, viem_1.getAddress)(log.address),
+                            token: normalizeTransferToken(log.address),
                             from: (0, viem_1.getAddress)(`0x${fromTopic.slice(26)}`),
                             to: (0, viem_1.getAddress)(`0x${toTopic.slice(26)}`),
                             amount: BigInt(log.data),
@@ -153,6 +162,21 @@ function parseTransfers(calls, logger) {
     }
     return sortTransfers(transfers);
 }
+/**
+ * Normalize a `Transfer` log's emitting address into a transfer `token`.
+ *
+ * `eth_simulateV1` with `traceTransfers` enabled synthesizes native-ETH moves
+ * (including internal calls) as `Transfer` events emitted from the native
+ * sentinel `0xeee…eee`. The rest of the SDK keys native ETH by viem's
+ * `ethAddress` constant, so we collapse the sentinel to that exact value rather
+ * than the checksummed form `getAddress` would produce — keeping native deltas
+ * on a single map key across backends. Real ERC20 tokens are checksummed.
+ */
+function normalizeTransferToken(address) {
+    return address.toLowerCase() === viem_1.ethAddress
+        ? viem_1.ethAddress
+        : (0, viem_1.getAddress)(address);
+}
 function isTopicHex(value) {
     return typeof value === "string" && value.length === TOPIC_HEX_LENGTH;
 }

package/lib/cjs/simulate/pipeline/bundler-retention.d.ts

@@ -1,7 +1,8 @@
-import type { SimulationLogger, Transfer } from "../../types.js";
+import type { AccountAssetChanges, SimulationLogger, Transfer } from "../../types.js";
 interface AssertNoBundlerRetentionParams {
     chainId: number;
     transfers: Transfer[];
+    assetChanges: readonly AccountAssetChanges[];
     logger?: SimulationLogger;
 }
 /**
@@ -10,10 +11,25 @@ interface AssertNoBundlerRetentionParams {
  * Uses net flow (inbound minus outbound) per (bundler address, token) pair.
  * Bundler3 legitimately receives tokens as an intermediary (user → bundler3 →
  * vault), so gross inbound would fire false positives. We only block positive
- * net flow above `DUST_THRESHOLD` — tokens stuck in a bundler address. Negative
+ * net flow above `DUST_THRESHOLD` — value stuck in a bundler address. Negative
  * net flow means the simulated bundle sweeps a pre-existing or state-overridden
  * bundler balance. That is useful telemetry, but not current-bundle retention,
  * so it is warned instead of raising a blacklist violation.
+ *
+ * **Two flow sources, one per asset class.** ERC20 / WETH9 retention is read
+ * from parsed `transfers` (log-derived, identical across backends). Native ETH
+ * emits no event log, so it can never appear in `transfers` on the Tenderly
+ * primary backend — Tenderly derives native moves into `assetChanges` instead.
+ * Native ETH is therefore read from `assetChanges`, the cross-backend source of
+ * truth for native value: Tenderly derives it from its trace, and
+ * `eth_simulateV1` derives it from the synthetic `traceTransfers` logs. Without
+ * this, native ETH stuck in bundler3 would pass the guard undetected on the
+ * Tenderly path (Cantina finding 1440).
+ *
+ * To avoid double-counting native ETH on `eth_simulateV1` — where the same
+ * native move exists both as a synthetic `ethAddress` transfer log *and* in the
+ * `assetChanges` derived from it — native transfer logs are only used as a
+ * fallback for bundler addresses that carry no native `assetChanges` entry.
  */
 export declare function assertNoBundlerRetention(params: AssertNoBundlerRetentionParams): void;
 export {};

package/lib/cjs/simulate/pipeline/bundler-retention.js

@@ -48,13 +48,28 @@ function getBundlerAddresses(chainId, logger) {
  * Uses net flow (inbound minus outbound) per (bundler address, token) pair.
  * Bundler3 legitimately receives tokens as an intermediary (user → bundler3 →
  * vault), so gross inbound would fire false positives. We only block positive
- * net flow above `DUST_THRESHOLD` — tokens stuck in a bundler address. Negative
+ * net flow above `DUST_THRESHOLD` — value stuck in a bundler address. Negative
  * net flow means the simulated bundle sweeps a pre-existing or state-overridden
  * bundler balance. That is useful telemetry, but not current-bundle retention,
  * so it is warned instead of raising a blacklist violation.
+ *
+ * **Two flow sources, one per asset class.** ERC20 / WETH9 retention is read
+ * from parsed `transfers` (log-derived, identical across backends). Native ETH
+ * emits no event log, so it can never appear in `transfers` on the Tenderly
+ * primary backend — Tenderly derives native moves into `assetChanges` instead.
+ * Native ETH is therefore read from `assetChanges`, the cross-backend source of
+ * truth for native value: Tenderly derives it from its trace, and
+ * `eth_simulateV1` derives it from the synthetic `traceTransfers` logs. Without
+ * this, native ETH stuck in bundler3 would pass the guard undetected on the
+ * Tenderly path (Cantina finding 1440).
+ *
+ * To avoid double-counting native ETH on `eth_simulateV1` — where the same
+ * native move exists both as a synthetic `ethAddress` transfer log *and* in the
+ * `assetChanges` derived from it — native transfer logs are only used as a
+ * fallback for bundler addresses that carry no native `assetChanges` entry.
  */
 function assertNoBundlerRetention(params) {
-    const { chainId, transfers, logger } = params;
+    const { chainId, transfers, assetChanges, logger } = params;
     const bundlerAddresses = getBundlerAddresses(chainId, logger);
     if (bundlerAddresses.size === 0)
         return;
@@ -71,10 +86,29 @@ function assertNoBundlerRetention(params) {
             flow.set(key, { address, token, netChange: delta });
         }
     };
+    // Native ETH from `assetChanges` (authoritative, cross-backend). Track which
+    // bundlers already have a native entry here so the transfer-log pass below
+    // does not re-add the same native move on `eth_simulateV1`.
+    const nativeFromAssetChanges = new Set();
+    for (const { account, changes } of assetChanges) {
+        if (!bundlerAddresses.has(account))
+            continue;
+        for (const change of changes) {
+            if (change.token !== viem_1.ethAddress)
+                continue;
+            recordFlow(account, viem_1.ethAddress, change.diff);
+            nativeFromAssetChanges.add(account.toLowerCase());
+        }
+    }
+    // ERC20 / WETH9 retention from transfer logs. Native ETH transfers (the
+    // `eth_simulateV1` synthetic sentinel) only backfill a bundler endpoint that
+    // is absent from `nativeFromAssetChanges`, so native is never summed on top
+    // of the `assetChanges` value already recorded for that address.
+    const usesAssetChangeNative = (t, addr) => t.token === viem_1.ethAddress && nativeFromAssetChanges.has(addr.toLowerCase());
     for (const t of transfers) {
-        if (bundlerAddresses.has(t.to))
+        if (bundlerAddresses.has(t.to) && !usesAssetChangeNative(t, t.to))
             recordFlow(t.to, t.token, t.amount);
-        if (bundlerAddresses.has(t.from))
+        if (bundlerAddresses.has(t.from) && !usesAssetChangeNative(t, t.from))
             recordFlow(t.from, t.token, -t.amount);
     }
     const entries = [...flow.values()];

package/lib/cjs/simulate/simulate.js

@@ -80,6 +80,7 @@ async function simulate(config, params) {
     (0, index_js_2.assertNoBundlerRetention)({
         chainId: params.chainId,
         transfers,
+        assetChanges: result.assetChanges,
         logger: config.logger,
     });
     return {

package/lib/cjs/types.d.ts

@@ -82,10 +82,10 @@ export interface AssetChange {
  * alike (the zero address is kept for mints/burns). Accounts and their `changes`
  * are sorted by address for deterministic, cross-backend output.
  *
- * Native-ETH coverage differs by backend: Tenderly reports the full net ETH
- * delta (including ETH moved via internal calls), while the `eth_simulateV1`
- * fallback derives native ETH only from the top-level transaction `value`s —
- * ETH moved internally (e.g. a `WETH.withdraw` refund) is not captured there.
+ * Both backends report the full net native-ETH delta, including ETH moved via
+ * internal calls (e.g. a `WETH.withdraw` refund): Tenderly derives it from its
+ * trace, and the `eth_simulateV1` fallback runs with `traceTransfers` so the
+ * node synthesizes native moves as transfer logs under viem's `ethAddress`.
  */
 export interface AccountAssetChanges {
     readonly account: Address;

package/lib/esm/simulate/backends/eth-simulate-v1.d.ts

@@ -6,14 +6,13 @@ import type { RawSimulationResult, SimulationTransaction } from "../../types.js"
  * Uses stateOverride to set the user's ETH balance high enough to avoid
  * false "insufficient balance for gas" reverts.
  *
- * Derives `assetChanges` (net per-token deltas grouped by account) from the
- * emitted transfer logs, plus native ETH from each transaction's top-level
- * `value` (payer debited, recipient credited, under viem's `ethAddress`).
- *
- * Coverage on this path is therefore narrower than the Tenderly backend:
- * native ETH moved through internal calls (e.g. a `WETH.withdraw` refund, a
- * swap that pays out ETH) emits no log and is not reflected in `value`, so it
- * is not captured. For full native-ETH accounting use Tenderly.
+ * Runs with `traceTransfers` enabled, so the node synthesizes native-ETH moves
+ * (the top-level `value` *and* ETH moved through internal calls — e.g. a
+ * `WETH.withdraw` refund or a swap that pays out ETH) as `Transfer` events from
+ * the native sentinel. Derives `assetChanges` (net per-token deltas grouped by
+ * account) entirely from the emitted transfer logs, with native ETH normalized
+ * to viem's `ethAddress`. Top-level `value` is intentionally *not* added on top:
+ * `traceTransfers` already logs it, so adding it would double-count.
  */
 export declare function simulateV1(params: {
     rpcUrl: string;

package/lib/esm/simulate/backends/eth-simulate-v1.js

@@ -1,4 +1,4 @@
-import { createPublicClient, ethAddress, getAddress, http, maxUint256, } from "viem";
+import { createPublicClient, getAddress, http, maxUint256, } from "viem";
 import { ExternalServiceError, SimulationRevertedError, SimulationValidationError, } from "../../errors.js";
 import { groupAssetChanges } from "../asset-changes.js";
 import { parseTransfers } from "../parsing/index.js";
@@ -8,14 +8,13 @@ import { parseTransfers } from "../parsing/index.js";
  * Uses stateOverride to set the user's ETH balance high enough to avoid
  * false "insufficient balance for gas" reverts.
  *
- * Derives `assetChanges` (net per-token deltas grouped by account) from the
- * emitted transfer logs, plus native ETH from each transaction's top-level
- * `value` (payer debited, recipient credited, under viem's `ethAddress`).
- *
- * Coverage on this path is therefore narrower than the Tenderly backend:
- * native ETH moved through internal calls (e.g. a `WETH.withdraw` refund, a
- * swap that pays out ETH) emits no log and is not reflected in `value`, so it
- * is not captured. For full native-ETH accounting use Tenderly.
+ * Runs with `traceTransfers` enabled, so the node synthesizes native-ETH moves
+ * (the top-level `value` *and* ETH moved through internal calls — e.g. a
+ * `WETH.withdraw` refund or a swap that pays out ETH) as `Transfer` events from
+ * the native sentinel. Derives `assetChanges` (net per-token deltas grouped by
+ * account) entirely from the emitted transfer logs, with native ETH normalized
+ * to viem's `ethAddress`. Top-level `value` is intentionally *not* added on top:
+ * `traceTransfers` already logs it, so adding it would double-count.
  */
 export async function simulateV1(params) {
     const { rpcUrl, transactions, blockNumber, signal } = params;
@@ -50,9 +49,17 @@ export async function simulateV1(params) {
             account: sender,
             calls,
             ...blockParam,
+            // Synthesize native-ETH moves (top-level value + internal calls) as
+            // Transfer logs from the native sentinel, so `parseTransfers` captures
+            // ETH that emits no real log (e.g. a WETH.withdraw refund).
+            traceTransfers: true,
             // Inflate sender ETH balance to prevent false "insufficient gas" reverts.
             // Without this, valid ERC20 flows fail when the sender has low ETH.
-            stateOverrides: [{ address: sender, balance: maxUint256 }],
+            // Use half of uint256 (not the ceiling) so the override leaves headroom
+            // for inbound native ETH — e.g. a WETH.withdraw refund or a swap payout
+            // would overflow the recipient balance and revert the value transfer if
+            // the sender were pinned at maxUint256.
+            stateOverrides: [{ address: sender, balance: maxUint256 / 2n }],
         });
         const results = simulationResult.results;
         if (!Array.isArray(results)) {
@@ -74,10 +81,7 @@ export async function simulateV1(params) {
         }));
         return {
             calls: rawCalls,
-            assetChanges: toAssetChanges({
-                transfers: parseTransfers(rawCalls),
-                transactions,
-            }),
+            assetChanges: toAssetChanges(parseTransfers(rawCalls)),
         };
     }
     catch (error) {
@@ -89,20 +93,13 @@ export async function simulateV1(params) {
     }
 }
 /**
- * Reduce parsed transfer logs and top-level transaction values to net per-token
- * balance changes grouped by account. Native ETH is taken from the top-level
- * `value`s (payer debited, recipient credited — internal moves are not logged,
- * see `simulateV1` for the coverage caveat).
+ * Reduce parsed transfer logs to net per-token balance changes grouped by
+ * account. With `traceTransfers` enabled, native ETH (top-level and internal)
+ * arrives as transfer logs under viem's `ethAddress`, so no separate top-level
+ * `value` accounting is needed — doing so would double-count.
  */
-function toAssetChanges(params) {
-    const { transfers, transactions } = params;
+function toAssetChanges(transfers) {
     const entries = [];
-    for (const tx of transactions) {
-        if (!tx.value)
-            continue;
-        entries.push({ account: tx.from, token: ethAddress, diff: -tx.value });
-        entries.push({ account: tx.to, token: ethAddress, diff: tx.value });
-    }
     for (const { token, from, to, amount } of transfers) {
         entries.push({ account: to, token, diff: amount });
         entries.push({ account: from, token, diff: -amount });

package/lib/esm/simulate/backends/tenderly-rpc.js

@@ -153,7 +153,11 @@ function buildCall(tx) {
     };
 }
 function buildStateOverrides(sender) {
-    return { [sender]: { balance: numberToHex(maxUint256) } };
+    // Half of uint256 (not the ceiling) so the override leaves headroom for
+    // inbound native ETH — a WETH.withdraw refund or swap payout would overflow
+    // the recipient balance and revert the value transfer if the sender were
+    // pinned at maxUint256.
+    return { [sender]: { balance: numberToHex(maxUint256 / 2n) } };
 }
 function encodeBlock(blockNumber) {
     if (blockNumber === undefined)

package/lib/esm/simulate/parsing/transfers.d.ts

@@ -14,6 +14,15 @@ export declare const DEPOSIT_TOPIC = "0xe1fffcc4923d04b559f4d29a8bfc6cda04eb5b0d
  * ERC1155 transfer events are **not** parsed — consumers with NFT flows will
  * see an incomplete transfer list.
  *
+ * **Native ETH (`eth_simulateV1` + `traceTransfers`).** When the backend runs
+ * `eth_simulateV1` with `traceTransfers` enabled, native-ETH moves — including
+ * those made through internal calls (e.g. a `WETH.withdraw` refund) — are
+ * synthesized as `Transfer` events emitted from the native sentinel
+ * `0xeee…eee`. These are parsed like any ERC20 transfer, with `token`
+ * collapsed to viem's `ethAddress` so native deltas key consistently across
+ * backends. Tenderly does not emit these synthetic logs (it derives native ETH
+ * separately), so this path is inert there.
+ *
  * **WETH9 dedup assumption — canonical atomic emission.** Dedup is scoped to
  * the same tx: a zero-address `Transfer` is suppressed only if its paired
  * `Deposit`/`Withdrawal` appears in the same `calls[txIdx].logs` slice. This

package/lib/esm/simulate/parsing/transfers.js

@@ -1,4 +1,4 @@
-import { getAddress, zeroAddress, zeroHash } from "viem";
+import { ethAddress, getAddress, zeroAddress, zeroHash, } from "viem";
 // keccak256("Transfer(address,address,uint256)") — ERC-20 transfer event
 export const TRANSFER_TOPIC = "0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef";
 // keccak256("Withdrawal(address,uint256)") — WETH9 unwrap event
@@ -19,6 +19,15 @@ const UINT256_HEX_LENGTH = 66; // "0x" + 32 bytes
  * ERC1155 transfer events are **not** parsed — consumers with NFT flows will
  * see an incomplete transfer list.
  *
+ * **Native ETH (`eth_simulateV1` + `traceTransfers`).** When the backend runs
+ * `eth_simulateV1` with `traceTransfers` enabled, native-ETH moves — including
+ * those made through internal calls (e.g. a `WETH.withdraw` refund) — are
+ * synthesized as `Transfer` events emitted from the native sentinel
+ * `0xeee…eee`. These are parsed like any ERC20 transfer, with `token`
+ * collapsed to viem's `ethAddress` so native deltas key consistently across
+ * backends. Tenderly does not emit these synthetic logs (it derives native ETH
+ * separately), so this path is inert there.
+ *
  * **WETH9 dedup assumption — canonical atomic emission.** Dedup is scoped to
  * the same tx: a zero-address `Transfer` is suppressed only if its paired
  * `Deposit`/`Withdrawal` appears in the same `calls[txIdx].logs` slice. This
@@ -128,7 +137,7 @@ export function parseTransfers(calls, logger) {
                             }
                         }
                         transfers.push({
-                            token: getAddress(log.address),
+                            token: normalizeTransferToken(log.address),
                             from: getAddress(`0x${fromTopic.slice(26)}`),
                             to: getAddress(`0x${toTopic.slice(26)}`),
                             amount: BigInt(log.data),
@@ -149,6 +158,21 @@ export function parseTransfers(calls, logger) {
     }
     return sortTransfers(transfers);
 }
+/**
+ * Normalize a `Transfer` log's emitting address into a transfer `token`.
+ *
+ * `eth_simulateV1` with `traceTransfers` enabled synthesizes native-ETH moves
+ * (including internal calls) as `Transfer` events emitted from the native
+ * sentinel `0xeee…eee`. The rest of the SDK keys native ETH by viem's
+ * `ethAddress` constant, so we collapse the sentinel to that exact value rather
+ * than the checksummed form `getAddress` would produce — keeping native deltas
+ * on a single map key across backends. Real ERC20 tokens are checksummed.
+ */
+function normalizeTransferToken(address) {
+    return address.toLowerCase() === ethAddress
+        ? ethAddress
+        : getAddress(address);
+}
 function isTopicHex(value) {
     return typeof value === "string" && value.length === TOPIC_HEX_LENGTH;
 }

package/lib/esm/simulate/pipeline/bundler-retention.d.ts

@@ -1,7 +1,8 @@
-import type { SimulationLogger, Transfer } from "../../types.js";
+import type { AccountAssetChanges, SimulationLogger, Transfer } from "../../types.js";
 interface AssertNoBundlerRetentionParams {
     chainId: number;
     transfers: Transfer[];
+    assetChanges: readonly AccountAssetChanges[];
     logger?: SimulationLogger;
 }
 /**
@@ -10,10 +11,25 @@ interface AssertNoBundlerRetentionParams {
  * Uses net flow (inbound minus outbound) per (bundler address, token) pair.
  * Bundler3 legitimately receives tokens as an intermediary (user → bundler3 →
  * vault), so gross inbound would fire false positives. We only block positive
- * net flow above `DUST_THRESHOLD` — tokens stuck in a bundler address. Negative
+ * net flow above `DUST_THRESHOLD` — value stuck in a bundler address. Negative
  * net flow means the simulated bundle sweeps a pre-existing or state-overridden
  * bundler balance. That is useful telemetry, but not current-bundle retention,
  * so it is warned instead of raising a blacklist violation.
+ *
+ * **Two flow sources, one per asset class.** ERC20 / WETH9 retention is read
+ * from parsed `transfers` (log-derived, identical across backends). Native ETH
+ * emits no event log, so it can never appear in `transfers` on the Tenderly
+ * primary backend — Tenderly derives native moves into `assetChanges` instead.
+ * Native ETH is therefore read from `assetChanges`, the cross-backend source of
+ * truth for native value: Tenderly derives it from its trace, and
+ * `eth_simulateV1` derives it from the synthetic `traceTransfers` logs. Without
+ * this, native ETH stuck in bundler3 would pass the guard undetected on the
+ * Tenderly path (Cantina finding 1440).
+ *
+ * To avoid double-counting native ETH on `eth_simulateV1` — where the same
+ * native move exists both as a synthetic `ethAddress` transfer log *and* in the
+ * `assetChanges` derived from it — native transfer logs are only used as a
+ * fallback for bundler addresses that carry no native `assetChanges` entry.
  */
 export declare function assertNoBundlerRetention(params: AssertNoBundlerRetentionParams): void;
 export {};

package/lib/esm/simulate/pipeline/bundler-retention.js

@@ -1,6 +1,6 @@
 import { getChainAddresses, UnsupportedChainIdError, } from "@morpho-org/blue-sdk";
 import { isDefined } from "@morpho-org/morpho-ts";
-import { getAddress } from "viem";
+import { ethAddress, getAddress } from "viem";
 import { BlacklistViolationError } from "../../errors.js";
 /**
  * Dust tolerance for bundler retention, in raw token units.
@@ -45,13 +45,28 @@ function getBundlerAddresses(chainId, logger) {
  * Uses net flow (inbound minus outbound) per (bundler address, token) pair.
  * Bundler3 legitimately receives tokens as an intermediary (user → bundler3 →
  * vault), so gross inbound would fire false positives. We only block positive
- * net flow above `DUST_THRESHOLD` — tokens stuck in a bundler address. Negative
+ * net flow above `DUST_THRESHOLD` — value stuck in a bundler address. Negative
  * net flow means the simulated bundle sweeps a pre-existing or state-overridden
  * bundler balance. That is useful telemetry, but not current-bundle retention,
  * so it is warned instead of raising a blacklist violation.
+ *
+ * **Two flow sources, one per asset class.** ERC20 / WETH9 retention is read
+ * from parsed `transfers` (log-derived, identical across backends). Native ETH
+ * emits no event log, so it can never appear in `transfers` on the Tenderly
+ * primary backend — Tenderly derives native moves into `assetChanges` instead.
+ * Native ETH is therefore read from `assetChanges`, the cross-backend source of
+ * truth for native value: Tenderly derives it from its trace, and
+ * `eth_simulateV1` derives it from the synthetic `traceTransfers` logs. Without
+ * this, native ETH stuck in bundler3 would pass the guard undetected on the
+ * Tenderly path (Cantina finding 1440).
+ *
+ * To avoid double-counting native ETH on `eth_simulateV1` — where the same
+ * native move exists both as a synthetic `ethAddress` transfer log *and* in the
+ * `assetChanges` derived from it — native transfer logs are only used as a
+ * fallback for bundler addresses that carry no native `assetChanges` entry.
  */
 export function assertNoBundlerRetention(params) {
-    const { chainId, transfers, logger } = params;
+    const { chainId, transfers, assetChanges, logger } = params;
     const bundlerAddresses = getBundlerAddresses(chainId, logger);
     if (bundlerAddresses.size === 0)
         return;
@@ -68,10 +83,29 @@ export function assertNoBundlerRetention(params) {
             flow.set(key, { address, token, netChange: delta });
         }
     };
+    // Native ETH from `assetChanges` (authoritative, cross-backend). Track which
+    // bundlers already have a native entry here so the transfer-log pass below
+    // does not re-add the same native move on `eth_simulateV1`.
+    const nativeFromAssetChanges = new Set();
+    for (const { account, changes } of assetChanges) {
+        if (!bundlerAddresses.has(account))
+            continue;
+        for (const change of changes) {
+            if (change.token !== ethAddress)
+                continue;
+            recordFlow(account, ethAddress, change.diff);
+            nativeFromAssetChanges.add(account.toLowerCase());
+        }
+    }
+    // ERC20 / WETH9 retention from transfer logs. Native ETH transfers (the
+    // `eth_simulateV1` synthetic sentinel) only backfill a bundler endpoint that
+    // is absent from `nativeFromAssetChanges`, so native is never summed on top
+    // of the `assetChanges` value already recorded for that address.
+    const usesAssetChangeNative = (t, addr) => t.token === ethAddress && nativeFromAssetChanges.has(addr.toLowerCase());
     for (const t of transfers) {
-        if (bundlerAddresses.has(t.to))
+        if (bundlerAddresses.has(t.to) && !usesAssetChangeNative(t, t.to))
             recordFlow(t.to, t.token, t.amount);
-        if (bundlerAddresses.has(t.from))
+        if (bundlerAddresses.has(t.from) && !usesAssetChangeNative(t, t.from))
             recordFlow(t.from, t.token, -t.amount);
     }
     const entries = [...flow.values()];

package/lib/esm/simulate/simulate.js

@@ -77,6 +77,7 @@ export async function simulate(config, params) {
     assertNoBundlerRetention({
         chainId: params.chainId,
         transfers,
+        assetChanges: result.assetChanges,
         logger: config.logger,
     });
     return {

package/lib/esm/types.d.ts

@@ -82,10 +82,10 @@ export interface AssetChange {
  * alike (the zero address is kept for mints/burns). Accounts and their `changes`
  * are sorted by address for deterministic, cross-backend output.
  *
- * Native-ETH coverage differs by backend: Tenderly reports the full net ETH
- * delta (including ETH moved via internal calls), while the `eth_simulateV1`
- * fallback derives native ETH only from the top-level transaction `value`s —
- * ETH moved internally (e.g. a `WETH.withdraw` refund) is not captured there.
+ * Both backends report the full net native-ETH delta, including ETH moved via
+ * internal calls (e.g. a `WETH.withdraw` refund): Tenderly derives it from its
+ * trace, and the `eth_simulateV1` fallback runs with `traceTransfers` so the
+ * node synthesizes native moves as transfer logs under viem's `ethAddress`.
  */
 export interface AccountAssetChanges {
     readonly account: Address;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@morpho-org/evm-simulation",
   "description": "EVM simulation engine for Morpho transactions.",
-  "version": "4.0.1",
+  "version": "4.1.2",
   "author": "Morpho Association <contact@morpho.org>",
   "contributors": [
     "Rubilmax <rmilon@gmail.com>"
@@ -19,23 +19,23 @@
   "license": "MIT",
   "type": "module",
   "sideEffects": false,
-  "main": "src/index.ts",
+  "main": "./lib/cjs/index.js",
   "files": [
     "lib"
   ],
   "dependencies": {
     "zod": "^4.4.3",
-    "@morpho-org/morpho-ts": "^2.6.0",
-    "@morpho-org/blue-sdk": "^6.2.0"
+    "@morpho-org/blue-sdk": "^6.3.1",
+    "@morpho-org/morpho-ts": "^2.8.0"
   },
   "peerDependencies": {
     "viem": "^2.0.0"
   },
   "devDependencies": {
     "typescript": "^6.0.3",
-    "viem": "2.52.2",
-    "vitest": "^4.1.8",
-    "@morpho-org/test": "^2.8.1"
+    "viem": "^2.54.2",
+    "vitest": "^4.1.9",
+    "@morpho-org/test": "^2.8.2"
   },
   "scripts": {
     "prepublish": "$npm_execpath build",
@@ -45,6 +45,7 @@
     "test": "vitest --root ../.. --project evm-simulation",
     "test:fork": "dotenv -- vitest --root ../.. --project evm-simulation-fork"
   },
+  "types": "./lib/esm/index.d.ts",
   "exports": {
     ".": {
       "types": "./lib/esm/index.d.ts",

package/src/index.ts

@@ -1,28 +0,0 @@
-// Public fns (via feature-folder barrels)
-
-// Errors (for instanceof checks by consumers)
-export {
-  BlacklistViolationError,
-  ExternalServiceError,
-  SimulationPackageError,
-  SimulationRevertedError,
-  SimulationValidationError,
-  UnsupportedChainError,
-} from "./errors.js";
-export { simulate } from "./simulate/index.js";
-// Types
-export type {
-  AccountAssetChanges,
-  AssetChange,
-  ChainSimulationConfig,
-  RawLog,
-  SimulateParams,
-  SimulationAuthorization,
-  SimulationCall,
-  SimulationConfig,
-  SimulationLogger,
-  SimulationResult,
-  SimulationTransaction,
-  TenderlyRpcConfig,
-  Transfer,
-} from "./types.js";