tapimo 0.15.0 → 0.18.0

package/src/apps/data/routes/fee-amm.ts

@@ -1,5 +1,6 @@
 import { Hono, type Context } from 'hono'
 import { AbiEvent, AbiParameters, Hash, type Hex } from 'ox'
+import { zeroAddress } from 'viem'
 import { Abis, Addresses } from 'viem/tempo'
 import * as z from 'zod/mini'
 
@@ -7,6 +8,7 @@ import type * as App from '../../../App.js'
 import * as Auth from '../../../internal/Auth.js'
 import * as Cache from '../../../internal/Cache.js'
 import * as Cursor from '../../../internal/Cursor.js'
+import type * as Log from '../../../internal/Log.js'
 import * as OpenApi from '../../../internal/OpenApi.js'
 import * as Response from '../../../internal/Response.js'
 import * as Schema from '../../../internal/Schema.js'
@@ -319,7 +321,15 @@ export function feeAmm() {
   return new Hono<App.Environment>()
     .get(
       '/v1/fee-amm/pools',
-      Auth.policy({ apiKey: { scopes: ['data:read'] }, mpp: true, public: true }),
+      Auth.policy({
+        apiKey: {
+          bucket: 'fee-amm-pools',
+          rateLimit: { limit: 1, period: 'minute' },
+          scopes: ['data:read'],
+        },
+        mpp: { bucket: 'fee-amm-pools', rateLimit: { limit: 1, period: 'minute' } },
+        public: { bucket: 'fee-amm-pools', rateLimit: { limit: 1, period: 'minute' } },
+      }),
       OpenApi.validate('query', schema.getFeeAmmPools.Query, {
         code: 'query_invalid',
         message: 'Invalid query parameters',
@@ -344,7 +354,7 @@ export function feeAmm() {
         tags: ['Fee AMM'],
       }),
       Cache.response<App.Environment>({
-        cacheControl: Cache.policies.state,
+        cacheControl: Cache.policies.noStore,
         name: 'tempo-api:fee-amm-pools:v2',
         key: (c) => Cache.urlKey(c, schema.getFeeAmmPools.Query),
       }),
@@ -687,35 +697,16 @@ declare namespace listPools {
   }
 }
 
-/**
- * The set of token addresses usable to pay transaction fees on a chain: the
- * curated verified tokens that have at least one Fee AMM pool (i.e. appear as a
- * `userToken` / topic2 in the FeeManager's `Mint` logs), plus the protocol
- * default fee token (`pathUSD`), which pays fees without needing a pool.
- * Addresses are lowercased to match the indexer's stored casing.
- *
- * The set is intentionally gated to the verified list rather than every pooled
- * token: anyone can mint a single-mint spam pool, so the raw set of pool
- * `userToken`s is unbounded (tens of thousands on busy chains) and those
- * liquidity-less pools can't actually settle fees. Restricting to verified
- * tokens keeps the set small (a handful of USD stablecoins), bounds the scan
- * (the `topic2 IN (…)` candidate list is the verified list), and matches the
- * tokens fees are realistically paid in.
- *
- * Memoized per chain and verified-snapshot version (the only inputs), so
- * callers — e.g. the address balances endpoint — can flag which holdings are
- * fee-usable without a second `/fee-amm/pools` query.
- */
+/** Returns lowercased verified tokens currently usable for transaction fees. The protocol default (`pathUSD`) is always included. */
 export async function feeTokenSet(
   c: Context<App.Environment>,
   chainId: z.output<typeof Schema.ChainId>,
 ): Promise<Set<string>> {
   const store = c.get('store')
-  const tidx = c.get('getTidx')(chainId)
   const snapshot = await VerifiedTokens.snapshot(c, chainId)
   // pathUSD is always fee-usable; the verified tokens are the only other
   // candidates we probe for a pool. With no verified candidates there is
-  // nothing to query — pathUSD stands alone.
+  // nothing to query, so pathUSD stands alone.
   const candidates = snapshot.list.map((token) => token.address.toLowerCase())
   if (candidates.length === 0) return new Set([pathUsd])
 
@@ -725,36 +716,106 @@ export async function feeTokenSet(
     Store.memoize(
       async () => {
         const tokens = new Set<string>([pathUsd])
-        // PostgreSQL's `topic2` index proves negative lookups without scanning
-        // FeeManager history. Probe serially so an uncapped verified list
-        // cannot fan out indexer load.
-        for (const address of candidates) {
-          const topic = padTopic(address as `0x${string}`)
-          const result = await tidx.fetch({
-            chainId,
-            engine: 'postgres',
-            query: `
-              SELECT 1 AS present
-              FROM logs
-              WHERE address = '${feeManager}' AND selector IN ('${mintTopic}', '${legacyMintTopic}')
-                AND topic2 = '${topic}'
-              LIMIT 1
-            ` as string,
+        const validatorTokens = await getValidatorTokens(c, { chainId })
+        // Verified candidates prevent permissionless spam pools from expanding
+        // the lookup. Small batches also bound RPC fan-out for Zone clients.
+        const probes = candidates
+          .filter((address) => {
+            if (!validatorTokens.includes(address)) return true
+            tokens.add(address)
+            return false
           })
-          if (result.rows.length > 0) tokens.add(address)
+          .flatMap((userToken) =>
+            validatorTokens.map((validatorToken) => ({ userToken, validatorToken })),
+          )
+        const unresolved = new Map<string, unknown>()
+        for (let index = 0; index < probes.length; index += 8) {
+          const group = probes.slice(index, index + 8)
+          const results = await Promise.allSettled(
+            group.map(({ userToken, validatorToken }) =>
+              readPoolReserves(c, {
+                chainId,
+                userToken: userToken as z.output<typeof Schema.Address>,
+                validatorToken: validatorToken as z.output<typeof Schema.Address>,
+              }),
+            ),
+          )
+          for (const [offset, result] of results.entries()) {
+            const userToken = group[offset]!.userToken
+            if (result.status === 'rejected') {
+              unresolved.set(userToken, result.reason)
+              continue
+            }
+            if (BigInt(result.value.userToken) > 0n && BigInt(result.value.validatorToken) > 0n) {
+              tokens.add(userToken)
+              unresolved.delete(userToken)
+            }
+          }
         }
+        const failure = Array.from(unresolved).find(([address]) => !tokens.has(address))
+        if (failure) throw failure[1]
         return Array.from(tokens)
       },
       {
-        key: `feeamm:v2:${chainId}:fee-token-set:v:${snapshot.version}`,
+        key: `feeamm:v3:${chainId}:fee-token-set:v:${snapshot.version}`,
         store,
-        ttl: Ttl.minutes(5),
+        ttl: Ttl.seconds(30),
       },
     ),
-  )
+  ).catch((cause) => {
+    const failure = {
+      chainId,
+      failure: 'unknown',
+      id: 'rpc',
+      operation: 'feeTokenSet',
+    } satisfies Log.ProviderFailure
+    c.set('providerFailures', [...(c.get('providerFailures') ?? []), failure])
+    throw cause
+  })
   return new Set(addresses)
 }
 
+/** Resolves the distinct fee tokens preferred by active validators. */
+async function getValidatorTokens(
+  c: Context<App.Environment>,
+  options: getValidatorTokens.Options,
+) {
+  const { chainId } = options
+  const client = c.get('getClient')(chainId)
+  const validators = await client.readContract({
+    abi: Abis.validatorConfig,
+    address: Addresses.validator,
+    functionName: 'getValidators',
+  })
+  const active = validators.filter((validator) => validator.active)
+  if (active.length === 0) return [pathUsd]
+  const preferred = await Promise.all(
+    active.map((validator) =>
+      client.readContract({
+        abi: Abis.feeManager,
+        address: Addresses.feeManager,
+        args: [validator.validatorAddress],
+        functionName: 'validatorTokens',
+      }),
+    ),
+  )
+  return Array.from(
+    new Set(
+      preferred.map((address) =>
+        address.toLowerCase() === zeroAddress ? pathUsd : address.toLowerCase(),
+      ),
+    ),
+  )
+}
+
+declare namespace getValidatorTokens {
+  /** Options for resolving active validators' preferred fee tokens. */
+  type Options = {
+    /** Chain whose validator preferences should be read. */
+    chainId: z.output<typeof Schema.ChainId>
+  }
+}
+
 /**
  * Reads a pool's current on-chain reserves via `FeeManager.getPool`, memoized
  * briefly per pool. Reserves are best-effort decoration on the pool listing:
@@ -767,28 +828,37 @@ function getPoolReserves(
   options: getPoolReserves.Options,
 ): Promise<getPoolReserves.Reserves | null> {
   const { chainId, userToken, validatorToken } = options
-  const client = c.get('getClient')(chainId)
   const store = c.get('store')
 
-  return Store.memoize(
-    async () => {
-      const pool = await client.readContract({
-        abi: Abis.feeAmm,
-        address: Addresses.feeManager,
-        args: [userToken, validatorToken],
-        functionName: 'getPool',
-      })
-      return {
-        userToken: pool.reserveUserToken.toString(),
-        validatorToken: pool.reserveValidatorToken.toString(),
-      }
-    },
-    {
-      key: `feeamm:v1:${chainId}:pool:${userToken}:${validatorToken}:reserves`,
-      store,
-      ttl: Ttl.seconds(30),
-    },
-  ).catch(() => null)
+  return Store.memoize(() => readPoolReserves(c, { chainId, userToken, validatorToken }), {
+    key: `feeamm:v1:${chainId}:pool:${userToken}:${validatorToken}:reserves`,
+    store,
+    ttl: Ttl.seconds(30),
+  }).catch(() => null)
+}
+
+/** Reads a pool's current on-chain reserves and propagates RPC failures. */
+async function readPoolReserves(
+  c: Context<App.Environment>,
+  options: readPoolReserves.Options,
+): Promise<getPoolReserves.Reserves> {
+  const { chainId, userToken, validatorToken } = options
+  const client = c.get('getClient')(chainId)
+  const pool = await client.readContract({
+    abi: Abis.feeAmm,
+    address: Addresses.feeManager,
+    args: [userToken, validatorToken],
+    functionName: 'getPool',
+  })
+  return {
+    userToken: pool.reserveUserToken.toString(),
+    validatorToken: pool.reserveValidatorToken.toString(),
+  }
+}
+
+declare namespace readPoolReserves {
+  /** Options for reading one fee pool. */
+  type Options = getPoolReserves.Options
 }
 
 declare namespace getPoolReserves {

package/src/apps/data/routes/receipts.test.ts

@@ -346,18 +346,30 @@ async function findRecentTransactionHash() {
 }
 
 describe('GET /transactions/receipts?address=…', () => {
-  test('returns receipts involving an address', async () => {
+  let account: string
+
+  beforeAll(async () => {
     const client = TestApp.client()
-    // Seed a real sender from the global receipt feed.
-    const seedResponse = await client.v1.transactions.receipts.$get(
-      { query: { limit: '5' } },
-      TestApp.auth,
+    // A replica can briefly return an empty head page. Require an indexed receipt before testing address filters.
+    account = await vi.waitFor(
+      async () => {
+        const response = await client.v1.transactions.receipts.$get(
+          { query: { limit: '5' } },
+          { headers: { ...TestApp.auth.headers, 'cache-control': 'no-store' } },
+        )
+        const body = await TestApp.json(response, Receipts.schema.getReceipts.Response)
+        expect(response.status).toBe(200)
+        expect(body.data.length).toBeGreaterThan(0)
+        const sender = body.data[0]!.sender
+        expect(sender).toMatch(/^0x[0-9a-f]{40}$/)
+        return sender
+      },
+      { interval: 1_000, timeout: 30_000 },
     )
-    const seed = await TestApp.json(seedResponse, Receipts.schema.getReceipts.Response)
-    expect(seedResponse.status).toBe(200)
-    const account = seed.data[0]!.sender
-    expect(account).toMatch(/^0x[0-9a-f]{40}$/)
+  })
 
+  test('returns receipts involving an address', async () => {
+    const client = TestApp.client()
     const baseResponse = await client.v1.transactions.receipts.$get(
       { query: { address: account, limit: '5' } },
       TestApp.auth,
@@ -390,15 +402,6 @@ describe('GET /transactions/receipts?address=…', () => {
 
   test('narrows receipts by execution status', async () => {
     const client = TestApp.client()
-    const seedResponse = await client.v1.transactions.receipts.$get(
-      { query: { limit: '5' } },
-      TestApp.auth,
-    )
-    const seed = await TestApp.json(seedResponse, Receipts.schema.getReceipts.Response)
-    expect(seedResponse.status).toBe(200)
-    const account = seed.data[0]!.sender
-    expect(account).toMatch(/^0x[0-9a-f]{40}$/)
-
     const response = await client.v1.transactions.receipts.$get(
       { query: { address: account, limit: '5', status: 'success' } },
       TestApp.auth,

package/src/apps/data/routes/rpc.test.ts

@@ -144,6 +144,38 @@ describe('POST /rpc', () => {
     }
   })
 
+  test('rejects oversized anonymous requests before proxying upstream', async () => {
+    const requests: Request[] = []
+    const server = await Relay.createServer(
+      RequestListener.fromFetchHandler((request) => {
+        requests.push(request)
+        return Response.json({ id: 1, jsonrpc: '2.0', result: '0x1' })
+      }),
+    )
+
+    try {
+      const app = TestApp.create({ rpc: { url: server.url } })
+      const request = new Request('http://tempo-api.test/rpc', {
+        body: JSON.stringify({
+          id: 1,
+          jsonrpc: '2.0',
+          method: 'eth_call',
+          params: [`0x${'ab'.repeat(32_768)}`, 'latest'],
+        }),
+        method: 'POST',
+      })
+      expect(request.headers.get('content-length')).toBeNull()
+
+      const response = await app.fetch(request)
+
+      expect(response.status).toBe(413)
+      expect(await response.json()).toMatchObject({ error: { code: 'payload_too_large' } })
+      expect(requests).toHaveLength(0)
+    } finally {
+      await server.closeAsync()
+    }
+  })
+
   test('routes by principal: a resolver sees the request principal and routes accordingly', async () => {
     const fetch = mockRpc()
     // A resolver that routes API-key principals to the private upstream and
@@ -1198,7 +1230,7 @@ describe('POST /rpc', () => {
         {
           "error": {
             "code": "api_key_forbidden",
-            "message": "API key missing required scope",
+            "message": "API key is missing required permissions: data:read. Use an API key with these scopes.",
           },
         }
       `)
@@ -1499,7 +1531,7 @@ describe('POST /rpc/relay', () => {
       {
         "error": {
           "code": "api_key_forbidden",
-          "message": "API key missing required scope",
+          "message": "API key is missing required permissions: rpc-relay:read. Use an API key with these scopes.",
         },
       }
     `)

package/src/apps/data/routes/rpc.ts

@@ -278,9 +278,8 @@ async function handleRpc(c: Context<App.Environment>) {
   const zoneToken = getZoneToken(c)
   const apiKeyRequired = requiresApiKey(c)
   const inspectBody = apiKeyRequired || Boolean(zone)
-  const inspection = inspectBody ? await inspectRpcBody(c.req.raw) : undefined
+  const inspection = inspectBody ? await inspectRpcRequest(c.req.raw) : undefined
   if (inspection && inspection.result === undefined) {
-    await inspection.body?.cancel()
     return Response.error(c, {
       code: 'payload_too_large',
       message: 'RPC requests requiring method inspection must not exceed 64 KiB.',
@@ -469,6 +468,38 @@ async function inspectNotificationOnly(request: Request): Promise<boolean> {
   }
 }
 
+async function inspectRpcRequest(request: Request): Promise<RpcInspection> {
+  const contentLength = Number(request.headers.get('content-length'))
+  if (Number.isFinite(contentLength) && contentLength > maxRpcInspectionBytes) {
+    await request.body?.cancel()
+    return { body: null, result: undefined }
+  }
+  if (!request.body) return { body: null, result: { empty: true, ok: false } }
+
+  const reader = request.body.getReader()
+  const chunks: Uint8Array<ArrayBuffer>[] = []
+  let size = 0
+  while (size <= maxRpcInspectionBytes) {
+    const read = await reader.read()
+    if (read.done) break
+    size += read.value.byteLength
+    if (size > maxRpcInspectionBytes) {
+      await reader.cancel()
+      return { body: null, result: undefined }
+    }
+    chunks.push(read.value)
+  }
+
+  const bytes = joinChunks(chunks, size)
+  const body = new ReadableStream<Uint8Array<ArrayBuffer>>({
+    start(controller) {
+      controller.enqueue(bytes)
+      controller.close()
+    },
+  })
+  return { body, result: parseRpcBody(bytes) }
+}
+
 function hasZoneWriteScope(c: Context<App.Environment>, chainId: number): boolean {
   const principal = Auth.getPrincipal(c)
   if (principal?.type !== 'api_key') return false
@@ -712,20 +743,26 @@ async function inspectRpcBody(response: Request | globalThis.Response): Promise<
   })
   if (!complete || size > maxRpcInspectionBytes) return { body, result: undefined }
 
+  const bytes = joinChunks(chunks, size)
+  return { body, result: parseRpcBody(bytes) }
+}
+
+function joinChunks(chunks: readonly Uint8Array<ArrayBuffer>[], size: number) {
   const bytes = new Uint8Array(size)
   let offset = 0
   for (const chunk of chunks) {
     bytes.set(chunk, offset)
     offset += chunk.byteLength
   }
-  const result = (() => {
-    try {
-      return { ok: true as const, value: JSON.parse(new TextDecoder().decode(bytes)) as unknown }
-    } catch {
-      return { empty: size === 0, ok: false as const }
-    }
-  })()
-  return { body, result }
+  return bytes
+}
+
+function parseRpcBody(bytes: Uint8Array<ArrayBuffer>): RpcInspection['result'] {
+  try {
+    return { ok: true, value: JSON.parse(new TextDecoder().decode(bytes)) as unknown }
+  } catch {
+    return { empty: bytes.byteLength === 0, ok: false }
+  }
 }
 
 function rpcProviderFailure(cause: unknown, chainId: number): Log.ProviderFailure {

package/src/apps/data/routes/tokens.provenance.test.ts

@@ -0,0 +1,157 @@
+import * as fs from 'node:fs'
+import {
+  GenericContainer,
+  Network,
+  type StartedNetwork,
+  type StartedTestContainer,
+  Wait,
+} from 'testcontainers'
+import { encodeAbiParameters, encodeEventTopics, parseAbi, zeroAddress, zeroHash } from 'viem'
+
+import * as TestApp from '../../../../test/App.js'
+import * as Runtime from '../../../../test/runtime.js'
+import * as Tokens from './tokens.js'
+
+const abi = parseAbi([
+  'event TokenCreated(address indexed token, string name, string symbol, string currency, address quoteToken, address admin, bytes32 salt)',
+])
+const attacker = '0x1111111111111111111111111111111111111111'
+const token = '0x20c0000000000000000000000000000000000001'
+
+let url: string
+
+describe.runIf(Runtime.get().mode === 'testnet')('Token provenance', () => {
+  let app: ReturnType<typeof TestApp.create>
+  let clickhouse: StartedTestContainer
+  let indexer: StartedTestContainer
+  let network: StartedNetwork
+  let postgres: StartedTestContainer
+
+  beforeAll(async () => {
+    const compose = fs.readFileSync(
+      new URL('../../../../docker-compose.yml', import.meta.url),
+      'utf8',
+    )
+    const image = compose.match(/TEMPO_API_TIDX_IMAGE:-([^}]+)}/)?.[1]
+    const image_clickhouse = compose.match(/TEMPO_API_CLICKHOUSE_IMAGE:-([^}]+)}/)?.[1]
+    const image_postgres = compose.match(/TEMPO_API_POSTGRES_IMAGE:-([^}]+)}/)?.[1]
+    if (!image || !image_clickhouse || !image_postgres)
+      throw new Error('Missing pinned database images.')
+    network = await new Network().start()
+    postgres = await new GenericContainer(image_postgres)
+      .withEnvironment({ POSTGRES_PASSWORD: 'postgres' })
+      .withNetwork(network)
+      .withNetworkAliases('postgres')
+      .withExposedPorts(5432)
+      .withWaitStrategy(Wait.forLogMessage(/database system is ready to accept connections/, 2))
+      .start()
+    clickhouse = await new GenericContainer(image_clickhouse)
+      .withEnvironment({ CLICKHOUSE_PASSWORD: 'clickhouse', CLICKHOUSE_USER: 'clickhouse' })
+      .withNetwork(network)
+      .withNetworkAliases('clickhouse')
+      .withExposedPorts(8123)
+      .withWaitStrategy(Wait.forHttp('/ping', 8123))
+      .start()
+    url = `http://${clickhouse.getHost()}:${clickhouse.getMappedPort(8123)}`
+    indexer = await new GenericContainer(image)
+      .withPlatform('linux/amd64')
+      .withNetwork(network)
+      .withCopyContentToContainer([
+        {
+          content: `
+[http]
+enabled = true
+port = 8080
+bind = "0.0.0.0"
+[prometheus]
+enabled = false
+[[chains]]
+name = "token-provenance"
+chain_id = 42431
+rpc_url = "http://127.0.0.1:1"
+pg_url = "postgres://postgres:postgres@postgres:5432/postgres"
+backfill = false
+[chains.clickhouse]
+enabled = true
+url = "http://clickhouse:8123"
+user = "clickhouse"
+password_env = "CLICKHOUSE_PASSWORD"
+repair_derived_on_startup = false
+`,
+          target: '/tmp/config.toml',
+        },
+      ])
+      .withEnvironment({ CLICKHOUSE_PASSWORD: 'clickhouse' })
+      .withCommand(['up', '--config', '/tmp/config.toml'])
+      .withExposedPorts(8080)
+      .withWaitStrategy(Wait.forListeningPorts())
+      .withStartupTimeout(120_000)
+      .start()
+    await vi.waitFor(
+      async () => {
+        const response = await query(
+          "SELECT count() FROM system.tables WHERE database = 'tidx_42431' AND name = 'logs'",
+        )
+        expect(response.trim()).toBe('1')
+      },
+      { timeout: 60_000 },
+    )
+    app = TestApp.create({
+      auth: false,
+      cache: { edge: false },
+      rpc: { url: 'http://127.0.0.1:1' },
+      tidx: { baseUrl: `http://${indexer.getHost()}:${indexer.getMappedPort(8080)}` },
+    })
+  })
+
+  afterAll(async () => {
+    await indexer?.stop()
+    await clickhouse?.stop()
+    await postgres?.stop()
+    await network?.stop()
+  })
+
+  test('excludes TokenCreated logs from non-factory emitters', async () => {
+    await insertForgedToken()
+
+    const response = await app.request('/v1/tokens?chainId=42431&limit=5')
+    expect(response.status, await response.clone().text()).toBe(200)
+    const body = await TestApp.json(response, Tokens.schema.getTokens.Response)
+    expect(body).toEqual({ data: [], nextCursor: null })
+  })
+})
+
+async function query(sql: string) {
+  const response = await fetch(url, {
+    body: sql,
+    headers: { Authorization: `Basic ${btoa('clickhouse:clickhouse')}` },
+    method: 'POST',
+  })
+  const body = await response.text()
+  if (!response.ok) throw new Error(body)
+  return body
+}
+
+async function insertForgedToken() {
+  const [selector, topic1] = encodeEventTopics({
+    abi,
+    args: { token },
+    eventName: 'TokenCreated',
+  })
+  if (typeof selector !== 'string' || typeof topic1 !== 'string')
+    throw new Error('Invalid TokenCreated event topics.')
+  const data = encodeAbiParameters(
+    [
+      { type: 'string' },
+      { type: 'string' },
+      { type: 'string' },
+      { type: 'address' },
+      { type: 'address' },
+      { type: 'bytes32' },
+    ],
+    ['Forged USD', 'FUSD', 'USD', zeroAddress, attacker, zeroHash],
+  )
+  await query(`INSERT INTO tidx_42431.logs
+    (block_num, block_timestamp, log_idx, tx_idx, tx_hash, address, selector, topic0, topic1, data)
+    VALUES (100, '2026-01-01 00:00:00', 0, 0, '${zeroHash}', '${attacker}', '${selector}', '${selector}', '${topic1}', '${data}')`)
+}

package/src/apps/data/routes/tokens.test.ts

@@ -19,7 +19,7 @@ function app(options: TestApp.create.Options = {}) {
   return TestApp.client({ db, ...options })
 }
 
-const verifiedTokenCount = 6
+const verifiedTokenCount = 7
 
 describe('getTokenMetadata', () => {
   const address = '0x20c0000000000000000000000000000000000001'
@@ -914,14 +914,14 @@ describe('GET /tokens?verified=true', () => {
 
   test('paginates the verified list via limit + cursor', async () => {
     const client = app({ assetsPath: false })
-    // Full list for comparison (6 verified tokens on the test chain).
+    // Full list for comparison (7 verified tokens on the test chain).
     const full = await TestApp.json(
       await client.v1.tokens.$get({ query: { verified: 'true' } }, TestApp.auth),
       Tokens.schema.getTokens.Response,
     )
 
     // First page: a bounded slice with a cursor to the next page (`minLimit` is
-    // 5, and the test chain has 6 verified tokens, so a page of 5 leaves 1).
+    // 5, and the test chain has 7 verified tokens, so a page of 5 leaves 2).
     const first = await TestApp.json(
       await client.v1.tokens.$get({ query: { verified: 'true', limit: '5' } }, TestApp.auth),
       Tokens.schema.getTokens.Response,
@@ -937,7 +937,7 @@ describe('GET /tokens?verified=true', () => {
       ),
       Tokens.schema.getTokens.Response,
     )
-    expect(second.data.length).toBe(1)
+    expect(second.data.length).toBe(verifiedTokenCount - 5)
     expect(second.nextCursor).toBeNull()
 
     // The two pages reconstruct the full list in order, with no overlap.