fix: ensure gas drip covers signed reads

.env.machine-funding.example

@@ -6,7 +6,7 @@ INTERNAL_FUNDING_PRIVATE_KEY=0xreplace-with-dedicated-machine-key
 INTERNAL_FUNDING_ADDRESS=0xreplace-with-address-derived-from-machine-key
 FAUCET_ADDRESS=0xreplace-with-existing-susdc-faucet
 INTERNAL_FUNDING_MAX_SUSDC_AMOUNT=250000000
-INTERNAL_FUNDING_GAS_SUSDC_AMOUNT=10000
+INTERNAL_FUNDING_GAS_SUSDC_AMOUNT=100000
 INTERNAL_FUNDING_GLOBAL_SUSDC_BUDGET=1000000000
 INTERNAL_FUNDING_GLOBAL_GAS_SUSDC_BUDGET=10000000
 

.env.machine-funding.sample

@@ -4,7 +4,7 @@ INTERNAL_FUNDING_PRIVATE_KEY=""
 INTERNAL_FUNDING_ADDRESS=""
 INTERNAL_FUNDING_CHAIN_ID="5124"
 INTERNAL_FUNDING_MAX_SUSDC_AMOUNT="250000000"
-INTERNAL_FUNDING_GAS_SUSDC_AMOUNT="10000"
+INTERNAL_FUNDING_GAS_SUSDC_AMOUNT="100000"
 INTERNAL_FUNDING_GLOBAL_SUSDC_BUDGET="1000000000"
 INTERNAL_FUNDING_GLOBAL_GAS_SUSDC_BUDGET="10000000"
 INTERNAL_FUNDING_RATE_LIMIT="10"

machine-funding-server/src/config.rs

@@ -12,6 +12,7 @@ const DEFAULT_LOCK_WAIT_MS: u64 = 5_000;
 pub const DEFAULT_REQUEST_TIMEOUT_MS: u64 = 45_000;
 pub const MAX_REQUEST_TIMEOUT_MS: u64 = 45_000;
 const MINIMUM_TOKEN_LENGTH: usize = 32;
+const MINIMUM_GAS_SUSDC_AMOUNT: u64 = 100_000;
 const MAX_REDIS_INTEGER: u64 = i64::MAX as u64;
 
 #[derive(Clone)]
@@ -86,6 +87,8 @@ pub enum ConfigError {
     Invalid(&'static str),
     #[error("{0} must be at least {1} characters")]
     TooShort(&'static str, usize),
+    #[error("{0} must be at least {1}")]
+    BelowMinimum(&'static str, u64),
     #[error("single-transfer amount exceeds its global budget")]
     BudgetBelowTransfer,
 }
@@ -115,6 +118,12 @@ impl Config {
             required("INTERNAL_FUNDING_GAS_SUSDC_AMOUNT")?,
             "INTERNAL_FUNDING_GAS_SUSDC_AMOUNT",
         )?;
+        if gas_susdc_amount < U256::from(MINIMUM_GAS_SUSDC_AMOUNT) {
+            return Err(ConfigError::BelowMinimum(
+                "INTERNAL_FUNDING_GAS_SUSDC_AMOUNT",
+                MINIMUM_GAS_SUSDC_AMOUNT,
+            ));
+        }
         let global_susdc_budget = parse_u256(
             required("INTERNAL_FUNDING_GLOBAL_SUSDC_BUDGET")?,
             "INTERNAL_FUNDING_GLOBAL_SUSDC_BUDGET",
@@ -328,7 +337,10 @@ mod tests {
                 "0x0000000000000000000000000000000000000001".into(),
             ),
             ("INTERNAL_FUNDING_MAX_SUSDC_AMOUNT", "250000000".into()),
-            ("INTERNAL_FUNDING_GAS_SUSDC_AMOUNT", "10000".into()),
+            (
+                "INTERNAL_FUNDING_GAS_SUSDC_AMOUNT",
+                MINIMUM_GAS_SUSDC_AMOUNT.to_string(),
+            ),
             ("INTERNAL_FUNDING_GLOBAL_SUSDC_BUDGET", "1000000000".into()),
             (
                 "INTERNAL_FUNDING_GLOBAL_GAS_SUSDC_BUDGET",
@@ -440,6 +452,19 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn rejects_gas_drips_too_small_for_a_signed_read() {
+        let mut values = valid_env();
+        values.insert("INTERNAL_FUNDING_GAS_SUSDC_AMOUNT", "99999".into());
+        assert!(matches!(
+            Config::from_lookup(|key| values.get(key).cloned()),
+            Err(ConfigError::BelowMinimum(
+                "INTERNAL_FUNDING_GAS_SUSDC_AMOUNT",
+                MINIMUM_GAS_SUSDC_AMOUNT
+            ))
+        ));
+    }
+
     #[test]
     fn rejects_non_loopback_bind_and_oversized_request_timeout() {
         let mut values = valid_env();

machine-funding-server/tests/redis_semantics.rs

@@ -226,7 +226,7 @@ fn config(redis_url: String) -> Config {
         funding_address: Address::from_str("0x19E7E376E7C213B7E7e7e46cc70A5dD086DAff2A").unwrap(),
         faucet_address: Address::with_last_byte(1),
         max_susdc_amount: U256::from(250_000_000u64),
-        gas_susdc_amount: U256::from(10_000u64),
+        gas_susdc_amount: U256::from(100_000u64),
         global_susdc_budget: U256::from(1_000_000_000u64),
         global_gas_susdc_budget: U256::from(10_000_000u64),
         erc20_usdc: Erc20UsdcActivation::Disabled,