Skip to content

fix(transaction): copy AwaitingFeePayer in Tx.Clone()#65

Closed
CrytoInsight wants to merge 2 commits into
tempoxyz:mainfrom
CrytoInsight:fix/clone-awaiting-feepayer
Closed

fix(transaction): copy AwaitingFeePayer in Tx.Clone()#65
CrytoInsight wants to merge 2 commits into
tempoxyz:mainfrom
CrytoInsight:fix/clone-awaiting-feepayer

Conversation

@CrytoInsight

Copy link
Copy Markdown
Contributor

fix(transaction): copy AwaitingFeePayer in Tx.Clone()

Summary

Tx.Clone() copied every field of the transaction except AwaitingFeePayer. For
sponsored (fee-payer) transactions this silently changes the bytes the sender signs,
so a signature produced over a clone never verifies on chain.

Root cause

SerializeForSigning branches on AwaitingFeePayer:

skipFeeToken := opts.ForSigning && opts.Format == FormatNormal &&
    (tx.AwaitingFeePayer || tx.FeePayerSignature != nil)

When the flag is true the signing payload (a) skips fee_token and (b) writes the
0x00 fee-payer marker in field 11. Clone() left the flag at its zero value
(false), so the clone serialized to the non-sponsored form instead.

Impact

  • Severity: high
  • A clone of a sponsored tx is signed over a different payload than the original.
  • The sender signature fails verification once a fee payer sponsors it — funds path
    for sponsored transactions is broken, and the failure is silent until broadcast.
  • Clone() is explicitly documented for producing transaction variations, so this is
    on the happy path.

Fix

Add the missing field to the struct literal in Clone():

AwaitingFeePayer: tx.AwaitingFeePayer,

Verification

TestClonePreservesAwaitingFeePayer asserts the original and the clone produce an
identical signing hash. Fails before the change, passes after. go test ./pkg/transaction/
is green.

@brendanjryan

Copy link
Copy Markdown
Collaborator

Thanks for the PR! Rolled fwd with your commits in the linked PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants