fix(evm): refuse to broadcast an envelope whose anchor and delta disagree

Broadcast checked only that an envelope carried a delta at all, never
that the envelope's own anchor and the anchor baked into that delta
actually named the same transaction. Under the normal flow they always
agree, since RequestApproval and SetupPublicParams both derive the
envelope's anchor and the delta's anchor from the same value, but
Broadcast has no way to know how the envelope it was actually handed was
built.

A mismatch here is not just a theoretical validation gap. The chain only
ever looks at the delta's anchor: that is what applyStateDelta checks for
replay, what the digest covers, what StateCommitted is emitted for. The
local side tracks the transaction by the envelope's anchor instead,
finality listeners and the ttx store are keyed on it. If the two ever
diverged, the transaction would apply and commit on chain under one
anchor while everything local kept waiting on a different one, and after
the finality timeout wrongly report a transaction that actually succeeded
as failed, the same failure shape HIGH #1 fixed, just reachable through a
construction bug instead of a chain-read one.

Broadcast now parses the envelope's anchor and compares it against the
delta's before spending any gas, and refuses if they disagree.

Signed-off-by: atharrva01 <atharvaborade568@gmail.com>

Author: atharrva01

x/token/services/network/evm/network.go

@@ -248,6 +248,16 @@ func (n *Network) SetRecoveryStarter(f func(ns string) error) { n.startRecovery
 
 // Broadcast assembles the endorsed envelope into a signed transaction, sends it, and records the
 // resulting raw transaction and hash back into the envelope so the caller can follow its finality.
+//
+// It checks that the envelope's anchor and its delta's own anchor agree before spending any gas.
+// Under the normal flow they always do, since both are derived from the same anchor at the point an
+// Envelope is built (RequestApproval, SetupPublicParams), but Broadcast has no way to know how the
+// envelope it was actually handed got here, and a mismatch here is not hypothetical: it would mean
+// the local bookkeeping that tracks this transaction (finality listeners, the ttx store) is keyed on
+// one anchor while the chain applies and emits StateCommitted for a different one. A finality wait on
+// the anchor Broadcast was told about would then watch an anchor the chain never touches, and after
+// the timeout wrongly report a transaction that actually succeeded as failed, the same failure shape
+// as a persistent read error, just from a construction bug instead of a chain-connectivity one.
 func (n *Network) Broadcast(ctx context.Context, blob any) error {
 	env, ok := blob.(*Envelope)
 	if !ok {
@@ -259,6 +269,15 @@ func (n *Network) Broadcast(ctx context.Context, blob any) error {
 	if env.Delta == nil {
 		return errors.Errorf("evm network: envelope [%s] carries no state delta", env.Anchor)
 	}
+	anchor, err := keys.AnchorFromTxID(env.Anchor)
+	if err != nil {
+		return errors.Wrapf(err, "evm network: envelope carries an invalid anchor [%s]", env.Anchor)
+	}
+	if env.Delta.Anchor != anchor {
+		return errors.Errorf(
+			"evm network: envelope anchor [%s] does not match its delta's anchor [%x]; refusing to broadcast",
+			env.Anchor, env.Delta.Anchor)
+	}
 
 	rawTx, txHash, err := n.submitter.Submit(ctx, env.Delta, env.Endorsements)
 	if err != nil {

x/token/services/network/evm/network_test.go

@@ -338,6 +338,74 @@ func TestBroadcastRejectsBadInput(t *testing.T) {
 	})
 }
 
+// networkWithSubmitter returns a Network wired with a real submitter over a ready mock client, for
+// Broadcast tests that need to get past the submitter/delta checks to exercise what follows them.
+func networkWithSubmitter(t *testing.T, evm *mock.EVMClient) *Network {
+	t.Helper()
+	c := validConfig()
+	c.applyDefaults()
+	require.NoError(t, c.Validate())
+	n, err := NewNetwork("evm-net", c, evm, nil, testSubmitter(t, evm, estimateGas()), nil)
+	require.NoError(t, err)
+
+	return n
+}
+
+// TestBroadcastRejectsMismatchedAnchor is the fix for a real gap: nothing checked that an envelope's
+// anchor and its delta's own anchor actually agreed before spending gas on it. Under the normal flow
+// they always do, since RequestApproval derives both from the same anchor, but Broadcast has no way
+// to know how the envelope it was actually handed was built, and the local finality tracking is keyed
+// on the envelope's anchor while the chain applies and emits StateCommitted for the delta's: a
+// mismatch here would mean waiting on an anchor the chain never touches.
+func TestBroadcastRejectsMismatchedAnchor(t *testing.T) {
+	evm := readySubmitterClient()
+	n := networkWithSubmitter(t, evm)
+
+	elsewhere, err := keys.AnchorFromTxID(anchorHex(0xEE))
+	require.NoError(t, err)
+	delta := testDelta()
+	delta.Anchor = elsewhere
+
+	err = n.Broadcast(t.Context(), &Envelope{
+		Anchor:       anchorHex(0x01),
+		Delta:        delta,
+		Endorsements: [][]byte{make([]byte, 65)},
+	})
+	require.Error(t, err)
+	assert.Zero(t, evm.SendRawTransactionCallCount(), "a mismatched envelope must not be broadcast")
+}
+
+// TestBroadcastRejectsAnUnparsableAnchor checks the envelope's own anchor is validated before it is
+// compared against anything, rather than producing a confusing failure further down.
+func TestBroadcastRejectsAnUnparsableAnchor(t *testing.T) {
+	evm := readySubmitterClient()
+	n := networkWithSubmitter(t, evm)
+
+	err := n.Broadcast(t.Context(), &Envelope{
+		Anchor:       "not-hex",
+		Delta:        testDelta(),
+		Endorsements: [][]byte{make([]byte, 65)},
+	})
+	require.Error(t, err)
+	assert.Zero(t, evm.SendRawTransactionCallCount())
+}
+
+// TestBroadcastAcceptsAConsistentEnvelope is the positive case: an envelope whose anchor and delta
+// agree, as every normal caller produces, must still broadcast.
+func TestBroadcastAcceptsAConsistentEnvelope(t *testing.T) {
+	evm := readySubmitterClient()
+	n := networkWithSubmitter(t, evm)
+
+	delta := testDelta()
+	err := n.Broadcast(t.Context(), &Envelope{
+		Anchor:       hex.EncodeToString(delta.Anchor[:]),
+		Delta:        delta,
+		Endorsements: [][]byte{make([]byte, 65)},
+	})
+	require.NoError(t, err)
+	assert.Equal(t, 1, evm.SendRawTransactionCallCount())
+}
+
 // --- queries -------------------------------------------------------------------------------------
 
 func TestQueryTokens(t *testing.T) {