apollo_gateway: validate replayed txs against their source block's gas prices

[ron-starkware]

Problem

validate_tx_l2_gas_price_within_threshold compares a tx's l2 max_price_per_unit against min_gas_price_percentage of the committed tip's L2 gas price. Under replay the tip trails the block the tx came from, and mainnet's L2 price moves up to ~2% per block, so a tx mainnet accepted gets rejected here for having less headroom than the price fell in between.

That is a deadlock, not a delay. A tx in block N clears the threshold only once the tip's price drops to its cap, which in a falling market first happens at tip = N — and block N is closed by then, so the tx can never enter its own block. It is deterministic, so the retry after a resync reproduces it exactly and Echonet ends up permanently skipping a mainnet block.

Block 11926844 hit it twice this weekend:

tx      0x1549342b9b52c7d2046e604d920fd788a52afb54240ef0f904667186dbb9b3f
l2 cap  32,000,000,000        (a round bot cap)
block   11926844, price 31,507,218,957   -> only +1.56% headroom

Mainnet's price was in a five-block slide into that block (34.85e9 → 31.51e9), and 57 GAS_PRICE_TOO_LOW rejections walked the threshold from 32,093,567,243 (block 11926843) up to 34,854,264,801 (11926839) without ever dropping under the cap. Echonet built 11926844 with 1 of its 4 txs, produced the byte-identical wrong hash on the retry, and skipped the block. Block 11802770 four days earlier was the same mechanism.

Change

In BehaviorMode::Echonet, threshold against the L2 gas price of the block the tx actually came from, resolved from the recorder.

A tx mainnet included in block N necessarily paid price(N), so price(N) <= cap always holds and the tx clears on its first forward, regardless of where the tip is. The check keeps its teeth: anything that could not have paid its own block's price is still rejected. Outside Echonet mode nothing changes.

Why not the alternatives:

• validate_resource_bounds: false removes the check entirely.
• Lowering min_gas_price_percentage weakens it for everything, and no fixed percentage is safe — the required discount depends on how far the price falls.
• Thresholding on next_l2_gas_price (which is what the TODO(Arni) at that line wants, and is a genuine latent improvement) is not enough on its own: it moves the pass condition from tip = N to tip = N-1, which is only reached moments before block N is built, leaving a ~1 s race against the gateway's state-sync lag. Worth doing separately, but not as the fix for this.

Notes

• Both recorder endpoints already exist and are already relied on by the mempool in this mode (apollo_mempool/src/communication.rs), so no recorder-side change is needed — echonet/get_block_metadata already returns l2_gas_price_fri.
• Any lookup failure — endpoint down, unparsable body, zero price — logs and falls back to the committed tip's price rather than failing the tx.
• Costs two recorder round trips per tx on the validation path, both in-cluster. At Echonet's ~3 tx/s sustained that is negligible; the 2 s timeout matches the mempool's.

Testing

crates/apollo_gateway/src/source_block_gas_price_test.rs, 5 cases against a mockito recorder: resolves the real block-11926844 price from the exact payload the Python handler emits, and falls back on missing tx metadata, missing block metadata, an unparsable body, and a zero price.

cargo test -p apollo_gateway — 170 passed, 0 failed. cargo clippy -p apollo_gateway --all-targets -- -D warnings clean. scripts/rust_fmt.sh clean.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes stateful fee validation and injects recorder HTTP lookups on the add-tx path in Echonet mode. Failures fall back to committed-tip prices, so a recorder outage can still reject replayed txs rather than admit them.

Overview
Fixes an Echonet deadlock where GAS_PRICE_TOO_LOW compared a replayed tx's L2 cap to the committed tip instead of the block it came from. In a falling market the tip only drops far enough after that block is already built, so the tx can never enter and the block is skipped forever.

In BehaviorMode::Echonet, the gateway now looks up the tx's source block via the recorder (get_tx_block_metadata / get_block_metadata) and substitutes that STRK gas-price vector into both the explicit L2 threshold check and blockifier fee bounds. Lookup failures log and fall back to the committed tip. Other modes are unchanged.

Also saturates the min-price threshold on overflow instead of wrapping via num-rational.

^{Reviewed by Cursor Bugbot for commit af23ca4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[reviewable-StarkWare]

This change is 

[github-actions]

Artifacts upload workflows:

• Started at 2026-08-24T08:18:23Z
• Started at 2026-08-24T10:10:16Z
• Started at 2026-08-24T10:11:01Z
• Started at 2026-08-24T12:33:41Z
• Started at 2026-08-24T13:06:33Z

[ron-starkware]

Reworked after a code review found the first attempt did not achieve its goal. Pushed as a second commit rather than a force-push so the review's line anchors survive; the net diff against main is what matters and no longer contains the old module.

What was wrong: overriding only the explicit GAS_PRICE_TOO_LOW threshold left blockifier's check_fee_bounds (via run_validate_entry_point) still comparing the bid against the committed block's prices from the same get_block_info(). Its bound is the stricter of the two — max_price_per_unit >= actual_gas_price, no percentage — so the deadlocked tx was still rejected, just as a more confusing ValidateFailure. And it covers all three resources, so an l2-only override was too narrow regardless: seven of the nine Resource bounds were not satisfied rejections echonet logged over four days were l1_data_gas.

What changed: the source block's whole STRK price vector is now resolved once per tx and applied in a single block_info() seam that both the explicit check and blockifier's BlockContext are built from. The threshold helper and the per-call client plumbing are gone.

Also addressed from the review: resolution moved ahead of the state-snapshot pin; retry with the mempool's policy; a last-block memo so the block lookup is ~1 per block; a u64 sanity bound on recorder-supplied prices; Url::join base normalization; the stale previous_block_l2_gas_price parameter name; and a validator-level test on the replay branch, which is now trivial because the validator holds a plain Option<GasPriceVector> instead of an HTTP client.

Two review items deliberately left as follow-ups, noted in the description: no metric on the recorder dependency (needs a define_metrics! entry plus a dashboard regen), and this being a third hand-rolled copy of the recorder client (a cross-crate extraction).

One partial disagreement on the fixture finding: the previous test suite did cover tx-metadata-OK plus block-metadata-absent. It's right that 500 and unparsable on the second leg were missing and that the rstest parameter was dead — both fixed, along with the hex/decimal duplication and the hardcoded block number.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9dac5e5. Configure here.}