fix: cap the gas a gasless tx may declare, as a governance parameter (F-2026-18144) (#350)

Fee-paying txs are self-limiting: the ante handler requires
ceil(minGasPrice * gasLimit), so an absurd gas limit costs absurd money.
Gasless txs pay nothing, so nothing bounded the gas they declared, while that
declared gas was still added to the fee market's cumulative gas wanted for the
block. Under max_gas: -1 the per-tx block-limit check is inert, so two gasless
txs each declaring MaxInt64 sum past what EndBlock can convert to int64 - an
error that surfaces through FinalizeBlock after the block is decided.

New uexecutor param max_gasless_tx_gas (default 100,000,000), enforced by
GaslessGasLimitDecorator on the existing txpolicy.IsGaslessTx predicate,
before NewGasWantedDecorator accumulates the declaration. A parameter and not
a constant because "too low" stops the universal validators voting and must be
fixable by proposal in minutes. Zero is rejected at genesis and on update, and
an unreadable or unset parameter falls back to the default rather than to
"no cap".

universalClient/pushsigner declares 100,000,000 instead of 500,000,000. Live
donut data: gas_wanted median/max 500,000,000 against a gas_used max of
5,011,877 - the largest real consumer used 1.0024% of what it declared.

Author: 0xNilesh

api/uexecutor/v1/types.pulsar.go

@@ -37,6 +37,10 @@ func NewCosmosAnteHandler(ctx sdk.Context, options HandlerOptions) sdk.AnteHandl
 		),
 
 		ante.NewSetUpContextDecorator(),
+		// Gasless txs pay no fee, so the fee is not a bound on the gas they
+		// declare. Cap it explicitly, before NewGasWantedDecorator adds the
+		// declared gas to the block's cumulative gas wanted.
+		NewGaslessGasLimitDecorator(options.UexecutorKeeper),
 		wasmkeeper.NewLimitSimulationGasDecorator(options.WasmConfig.SimulationGasLimit), // after setup context to enforce limits early
 		wasmkeeper.NewCountTXDecorator(options.TXCounterStoreService),
 		wasmkeeper.NewGasRegisterDecorator(options.WasmKeeper.GetGasRegister()),

app/ante/ante_cosmos.go

@@ -0,0 +1,79 @@
+package ante
+
+import (
+	"context"
+
+	errorsmod "cosmossdk.io/errors"
+
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	sdkerrors "github.com/cosmos/cosmos-sdk/types/errors"
+	txpolicy "github.com/pushchain/push-chain-node/app/txpolicy"
+	uexecutortypes "github.com/pushchain/push-chain-node/x/uexecutor/types"
+)
+
+// GaslessParamsKeeper reads the module parameters that bound fee-exempt txs.
+type GaslessParamsKeeper interface {
+	GetParams(ctx context.Context) (uexecutortypes.Params, error)
+}
+
+// GaslessGasLimitDecorator caps the gas limit a fee-exempt (gasless) tx may
+// declare.
+//
+// A fee-paying tx is bounded by its own fee: the ante handler requires
+// ceil(minGasPrice * gasLimit), so an absurd gas limit costs an absurd amount
+// of tokens. A gasless tx pays nothing, so nothing bounds the gas it declares
+// while that declared gas is still added to the block's cumulative gas wanted.
+// Enough of them, or few enough with a large enough declaration, push the
+// cumulative total past what the fee market can represent.
+//
+// CONTRACT: must run before the EVM GasWantedDecorator, which is what
+// accumulates the declared gas into the fee market transient store.
+type GaslessGasLimitDecorator struct {
+	paramsKeeper GaslessParamsKeeper
+}
+
+func NewGaslessGasLimitDecorator(pk GaslessParamsKeeper) GaslessGasLimitDecorator {
+	return GaslessGasLimitDecorator{paramsKeeper: pk}
+}
+
+func (ggd GaslessGasLimitDecorator) AnteHandle(ctx sdk.Context, tx sdk.Tx, simulate bool, next sdk.AnteHandler) (sdk.Context, error) {
+	if !txpolicy.IsGaslessTx(tx) {
+		return next(ctx, tx, simulate)
+	}
+
+	feeTx, ok := tx.(sdk.FeeTx)
+	if !ok {
+		return ctx, errorsmod.Wrap(sdkerrors.ErrTxDecode, "Tx must be a FeeTx")
+	}
+
+	maxGas := ggd.maxGaslessTxGas(ctx)
+	if gas := feeTx.GetGas(); gas > maxGas {
+		ctx.Logger().Debug("gasless gas limit decorator: declared gas over cap",
+			"gas", gas,
+			"max_gas", maxGas,
+		)
+		return ctx, errorsmod.Wrapf(sdkerrors.ErrInvalidGasLimit,
+			"gasless tx gas limit %d exceeds the maximum allowed %d", gas, maxGas)
+	}
+
+	return next(ctx, tx, simulate)
+}
+
+// maxGaslessTxGas resolves the governance-controlled cap, falling back to the
+// default when it cannot be read or was never set. The fallback is deliberate:
+// a missing parameter must not mean "no cap".
+func (ggd GaslessGasLimitDecorator) maxGaslessTxGas(ctx sdk.Context) uint64 {
+	params, err := ggd.paramsKeeper.GetParams(ctx)
+	if err != nil {
+		ctx.Logger().Error("gasless gas limit decorator: failed to read uexecutor params, using default cap",
+			"error", err,
+		)
+		return uexecutortypes.DefaultMaxGaslessTxGas
+	}
+
+	if params.MaxGaslessTxGas == 0 {
+		return uexecutortypes.DefaultMaxGaslessTxGas
+	}
+
+	return params.MaxGaslessTxGas
+}

app/ante/gasless_gas_limit.go

@@ -0,0 +1,235 @@
+package ante_test
+
+import (
+	"context"
+	"errors"
+	"math"
+	"testing"
+
+	codectypes "github.com/cosmos/cosmos-sdk/codec/types"
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	sdkerrors "github.com/cosmos/cosmos-sdk/types/errors"
+	"github.com/cosmos/cosmos-sdk/x/authz"
+	banktypes "github.com/cosmos/cosmos-sdk/x/bank/types"
+	"github.com/stretchr/testify/require"
+
+	"github.com/pushchain/push-chain-node/app/ante"
+	uexecutortypes "github.com/pushchain/push-chain-node/x/uexecutor/types"
+)
+
+// ---------------------------------------------------------------------------
+// GaslessGasLimitDecorator — F-2026-18144
+//
+// Gasless txs pay no fee, so the fee is not a bound on the gas they declare,
+// and the declared gas is what accumulates into the block's cumulative gas
+// wanted. These tests pin the cap that replaces the missing economic bound.
+// ---------------------------------------------------------------------------
+
+// mockGaslessParamsKeeper satisfies ante.GaslessParamsKeeper.
+type mockGaslessParamsKeeper struct {
+	params uexecutortypes.Params
+	err    error
+	calls  int
+}
+
+func (m *mockGaslessParamsKeeper) GetParams(_ context.Context) (uexecutortypes.Params, error) {
+	m.calls++
+	if m.err != nil {
+		return uexecutortypes.Params{}, m.err
+	}
+	return m.params, nil
+}
+
+func paramsWithCap(cap uint64) *mockGaslessParamsKeeper {
+	return &mockGaslessParamsKeeper{params: uexecutortypes.Params{SomeValue: true, MaxGaslessTxGas: cap}}
+}
+
+// gaslessTx returns a tx whose only msg is on the IsGaslessTx allowlist.
+func gaslessTx(gas uint64) mockFeeTx {
+	return mockFeeTx{
+		msgs:     []sdk.Msg{&uexecutortypes.MsgVoteInbound{}},
+		gas:      gas,
+		fee:      sdk.NewCoins(),
+		feePayer: sdk.AccAddress([]byte("payer")),
+	}
+}
+
+// runDecorator returns (nextCalled, err).
+func runDecorator(t *testing.T, pk ante.GaslessParamsKeeper, tx sdk.Tx, simulate bool) (bool, error) {
+	t.Helper()
+	ggd := ante.NewGaslessGasLimitDecorator(pk)
+	ctx := newAnteTestCtx(t, false)
+	nextCalled := false
+	_, err := ggd.AnteHandle(ctx, tx, simulate, func(ctx sdk.Context, tx sdk.Tx, simulate bool) (sdk.Context, error) {
+		nextCalled = true
+		return ctx, nil
+	})
+	return nextCalled, err
+}
+
+// TestGaslessGasLimit_AboveDefaultCapRejected is the core regression: a gasless
+// tx declaring more than the cap must not reach the rest of the ante chain, so
+// its declared gas is never added to the block's cumulative gas wanted.
+func TestGaslessGasLimit_AboveDefaultCapRejected(t *testing.T) {
+	pk := paramsWithCap(uexecutortypes.DefaultMaxGaslessTxGas)
+
+	nextCalled, err := runDecorator(t, pk, gaslessTx(uexecutortypes.DefaultMaxGaslessTxGas+1), false)
+
+	require.False(t, nextCalled, "over-cap gasless tx must not reach the next decorator")
+	require.Error(t, err)
+	require.True(t, sdkerrors.ErrInvalidGasLimit.Is(err), "expected ErrInvalidGasLimit, got: %v", err)
+	require.Contains(t, err.Error(), "100000001")
+	require.Contains(t, err.Error(), "100000000")
+}
+
+// TestGaslessGasLimit_AtCapAccepted pins the boundary: exactly the cap passes.
+func TestGaslessGasLimit_AtCapAccepted(t *testing.T) {
+	pk := paramsWithCap(uexecutortypes.DefaultMaxGaslessTxGas)
+
+	nextCalled, err := runDecorator(t, pk, gaslessTx(uexecutortypes.DefaultMaxGaslessTxGas), false)
+
+	require.True(t, nextCalled, "gasless tx at exactly the cap must be accepted")
+	require.NoError(t, err)
+}
+
+// TestGaslessGasLimit_BelowCapAccepted covers the ordinary case.
+func TestGaslessGasLimit_BelowCapAccepted(t *testing.T) {
+	pk := paramsWithCap(uexecutortypes.DefaultMaxGaslessTxGas)
+
+	nextCalled, err := runDecorator(t, pk, gaslessTx(200_000), false)
+
+	require.True(t, nextCalled)
+	require.NoError(t, err)
+}
+
+// TestGaslessGasLimit_MaxInt64Rejected is the shape from the finding: two txs
+// each declaring MaxInt64 sum past what the fee market EndBlock can convert.
+func TestGaslessGasLimit_MaxInt64Rejected(t *testing.T) {
+	pk := paramsWithCap(uexecutortypes.DefaultMaxGaslessTxGas)
+
+	nextCalled, err := runDecorator(t, pk, gaslessTx(math.MaxInt64), false)
+
+	require.False(t, nextCalled, "MaxInt64 gasless tx must not reach the next decorator")
+	require.Error(t, err)
+	require.True(t, sdkerrors.ErrInvalidGasLimit.Is(err), "expected ErrInvalidGasLimit, got: %v", err)
+}
+
+// TestGaslessGasLimit_NonGaslessTxNotCapped proves the cap is scoped to
+// fee-exempt txs: a fee-paying tx is bounded by its own fee, not by this cap,
+// and the params are not even read for it.
+func TestGaslessGasLimit_NonGaslessTxNotCapped(t *testing.T) {
+	pk := paramsWithCap(uexecutortypes.DefaultMaxGaslessTxGas)
+
+	tx := mockFeeTx{
+		msgs:     []sdk.Msg{&banktypes.MsgSend{}},
+		gas:      math.MaxInt64,
+		fee:      sdk.NewCoins(sdk.NewInt64Coin("upc", 1)),
+		feePayer: sdk.AccAddress([]byte("payer")),
+	}
+
+	nextCalled, err := runDecorator(t, pk, tx, false)
+
+	require.True(t, nextCalled, "fee-paying tx must not be capped here")
+	require.Equal(t, 0, pk.calls, "params must not be read for a non-gasless tx")
+	require.NoError(t, err)
+}
+
+// TestGaslessGasLimit_AuthzExecVoteShape uses the exact wire shape the universal
+// validators send: an authz.MsgExec wrapping a vote. This is what declared the
+// hardcoded 500,000,000 on donut.
+func TestGaslessGasLimit_AuthzExecVoteShape(t *testing.T) {
+	inner, err := codectypes.NewAnyWithValue(&uexecutortypes.MsgVoteInbound{})
+	require.NoError(t, err)
+
+	execTx := func(gas uint64) mockFeeTx {
+		return mockFeeTx{
+			msgs:     []sdk.Msg{&authz.MsgExec{Grantee: "push1grantee", Msgs: []*codectypes.Any{inner}}},
+			gas:      gas,
+			fee:      sdk.NewCoins(),
+			feePayer: sdk.AccAddress([]byte("payer")),
+		}
+	}
+
+	t.Run("500M vote is rejected", func(t *testing.T) {
+		pk := paramsWithCap(uexecutortypes.DefaultMaxGaslessTxGas)
+
+		nextCalled, err := runDecorator(t, pk, execTx(500_000_000), false)
+
+		require.False(t, nextCalled, "500M MsgExec vote must not reach the next decorator")
+		require.Error(t, err)
+		require.True(t, sdkerrors.ErrInvalidGasLimit.Is(err), "expected ErrInvalidGasLimit, got: %v", err)
+	})
+
+	t.Run("100M vote is accepted", func(t *testing.T) {
+		pk := paramsWithCap(uexecutortypes.DefaultMaxGaslessTxGas)
+
+		nextCalled, err := runDecorator(t, pk, execTx(100_000_000), false)
+
+		require.True(t, nextCalled, "100M MsgExec vote must be accepted")
+		require.NoError(t, err)
+	})
+}
+
+// TestGaslessGasLimit_GovernanceParamTakesEffect proves the cap is the
+// governance parameter and not a compiled-in constant: it must bind both
+// tighter and looser than the default.
+func TestGaslessGasLimit_GovernanceParamTakesEffect(t *testing.T) {
+	t.Run("lowered cap binds below the default", func(t *testing.T) {
+		pk := paramsWithCap(30_000_000)
+
+		acceptedNext, acceptedErr := runDecorator(t, pk, gaslessTx(30_000_000), false)
+		require.True(t, acceptedNext, "tx at the lowered cap must be accepted")
+		require.NoError(t, acceptedErr)
+
+		rejectedNext, rejectedErr := runDecorator(t, pk, gaslessTx(30_000_001), false)
+		require.False(t, rejectedNext, "tx above the lowered cap must be rejected")
+		require.Error(t, rejectedErr)
+		require.Contains(t, rejectedErr.Error(), "30000000")
+	})
+
+	t.Run("raised cap admits gas the default would reject", func(t *testing.T) {
+		pk := paramsWithCap(500_000_000)
+
+		nextCalled, err := runDecorator(t, pk, gaslessTx(400_000_000), false)
+
+		require.True(t, nextCalled, "raised cap must admit 400M")
+		require.NoError(t, err)
+	})
+}
+
+// TestGaslessGasLimit_UnsetParamFallsBackToDefault: a missing parameter must
+// never mean "no cap".
+func TestGaslessGasLimit_UnsetParamFallsBackToDefault(t *testing.T) {
+	t.Run("zero param", func(t *testing.T) {
+		pk := paramsWithCap(0)
+
+		acceptedNext, acceptedErr := runDecorator(t, pk, gaslessTx(uexecutortypes.DefaultMaxGaslessTxGas), false)
+		require.True(t, acceptedNext)
+		require.NoError(t, acceptedErr)
+
+		rejectedNext, rejectedErr := runDecorator(t, pk, gaslessTx(uexecutortypes.DefaultMaxGaslessTxGas+1), false)
+		require.False(t, rejectedNext, "zero param must fall back to the default cap, not disable it")
+		require.Error(t, rejectedErr)
+	})
+
+	t.Run("params read failure", func(t *testing.T) {
+		pk := &mockGaslessParamsKeeper{err: errors.New("collections: not found")}
+
+		nextCalled, err := runDecorator(t, pk, gaslessTx(uexecutortypes.DefaultMaxGaslessTxGas+1), false)
+
+		require.False(t, nextCalled, "unreadable params must fall back to the default cap, not disable it")
+		require.Error(t, err)
+		require.True(t, sdkerrors.ErrInvalidGasLimit.Is(err), "expected ErrInvalidGasLimit, got: %v", err)
+	})
+}
+
+// TestGaslessGasLimit_SimulationIsAlsoCapped keeps simulation honest: a gas
+// estimate that would be rejected on delivery must not come back clean.
+func TestGaslessGasLimit_SimulationIsAlsoCapped(t *testing.T) {
+	pk := paramsWithCap(uexecutortypes.DefaultMaxGaslessTxGas)
+
+	nextCalled, err := runDecorator(t, pk, gaslessTx(uexecutortypes.DefaultMaxGaslessTxGas+1), true)
+
+	require.False(t, nextCalled, "simulation must apply the same cap")
+	require.Error(t, err)
+}

app/ante/gasless_gas_limit_test.go

@@ -61,6 +61,10 @@ type HandlerOptions struct {
 	FeeMarketKeeper anteinterfaces.FeeMarketKeeper
 	EvmKeeper       anteinterfaces.EVMKeeper
 
+	// UexecutorKeeper supplies the governance-controlled cap on the gas a
+	// fee-exempt (gasless) tx may declare.
+	UexecutorKeeper GaslessParamsKeeper
+
 
 	IBCKeeper     *ibckeeper.Keeper
 	CircuitKeeper *circuitkeeper.Keeper
@@ -103,6 +107,9 @@ func (options HandlerOptions) Validate() error {
 	if options.EvmKeeper == nil {
 		return errorsmod.Wrap(errortypes.ErrLogic, "evm keeper is required for AnteHandler")
 	}
+	if options.UexecutorKeeper == nil {
+		return errorsmod.Wrap(errortypes.ErrLogic, "uexecutor keeper is required for AnteHandler")
+	}
 
 	return nil
 }

app/ante/handler_options.go

@@ -1251,6 +1251,7 @@ func NewChainApp(
 		CircuitKeeper:         &app.CircuitKeeper,
 
 		EvmKeeper:              app.EVMKeeper,
+		UexecutorKeeper:        app.UexecutorKeeper,
 		ExtensionOptionChecker: antetypes.HasDynamicFeeExtensionOption,
 		SigGasConsumer:         cosmosevmante.SigVerificationGasConsumer,
 		MaxTxGasWanted:         cast.ToUint64(appOpts.Get(srvflags.EVMMaxTxGasWanted)),

app/app.go

@@ -13,6 +13,13 @@ message Params {
   option (gogoproto.goproto_stringer) = false;
 
   bool some_value = 2;
+
+  // max_gasless_tx_gas is the maximum gas limit a fee-exempt (gasless)
+  // transaction is allowed to declare. Gasless transactions pay no fee, so
+  // their declared gas is not bounded by anything the sender has to spend;
+  // this cap is the only bound on how much a single gasless transaction can
+  // contribute to the block's cumulative gas wanted.
+  uint64 max_gasless_tx_gas = 3;
 }
 
 // Signature verification types