feat(ntx-builder): bundle and execute sponsorship and feature notes by igamigo · Pull Request #2514 · 0xMiden/node

igamigo · 2026-08-24T23:03:27Z

Summary

Part 2 for #2327, and alternative take on #2499

Fixes the poisoning denial of service by adding many more manual VM checks (see Make NoteConsumptionChecker bundle-aware protocol#3710 for more information)
Removes GroupIndex and the re-pairing logic. The reasoning here is that if the checker returns succesful notes, they would have been sponsored correctly and so there is never need of re-pairing
Removes the require_sponsorship CLI/config flag.
Always considers unsponsored feature notes.
Removes random sponsorship selection and the rand dependency.
Caps sponsorships at three. This was mostly to simplify for now but we can roll it back (not sure if the operator has a good way of tuning it in a way that helps the service).
Uses the actual transaction arguments when checking consumability. This can also be rolled back as it's very optional, but it feels a bit more correct (maybe it was a deliberate optimization).

Changelog

[[entry]]
scope       = "ntx-builder"
impact      = "added"
description = "Network transactions now bundle each feature note with the `FEE_SPONSORSHIP` notes that pay its fee, so a network note whose fee a sponsor covers is executed rather than left pending."

SantiagoPittella

Overall looks good, thanks for the improvements. We need to modify the changelog entry in the PR description to remove the "--require-sponsorship" flag.

Left some comments, mostly nits and could be addressed in a followup pR

SantiagoPittella · 2026-08-25T18:26:41Z

+            };
+            // Prefer the largest fee contributions both when applying the cap and when filtering
+            // later walks down successively smaller sponsorship prefixes.
+            group.sort_sponsorships_by_amount();


The thing with this sort is that someone could create a faucet and create 3 sponsorship notes for the feature note using an amount that will always "win" the 3 slots, and then fail at execution since we aren't checking the asset ID, right?

Yeah, that's true. We can read the storage slot and use that to retain "valid" sponsorship notes, or we can remove the ordering altogether and make it random or arbitrary in some other way. I went with the first approach but perhaps for simplicity we should do the latter approach?

I prefer the first approach 👍🏼

At the moment we should only accept fees in the native asset - everything else is invalid/unaccepted atm.

Do you mean the network's native token? Or native as in native to the network faucet? Because I believe nothing enforces anything related to this at the moment

I might be misunderstanding, but I don't think we need to support multiple token types - we can't even compare/sort them by value yet.

The protocol forces the sponsorship asset to match the network account configures in its fee policy, but I think that it does not forces a match with the native token

I might be misunderstanding, but I don't think we need to support multiple token types - we can't even compare/sort them by value yet.

I think nothing forces network account developers to be paid in a specific token (like the native one). AFAICT, they can decide to charge fees from a random asset ID. Obviously these are different than the network fees, which are currently only payable in the native token. Whether this is a problem or not, I'm not sure, but with my comment I mostly wanted to make sure assumptions are aligned.

Right you are; I was confused

I ended up re-adding the sort with the filter of expected assets.

Mirko-von-Leipzig

Approving though I'm unsure if all the complexity in searching/grouping is required i.e. could we simplify by taking only the single most valuable sponsor note per feature note and call it a day.

Mirko-von-Leipzig · 2026-08-25T12:40:15Z

+/// without every selected sponsorship when its required fee is otherwise covered. A group with no
+/// sponsorships is a plain network note.
+#[derive(Clone, Debug)]
+pub struct NoteGroup {


Perhaps

Suggested change

pub struct NoteGroup {

pub struct SponsoredFeatureNote {

I suggested that in the original PR as well. I think it works except it implies the note is always sponsored which is not really the case (0 fees is possible and no note is required). I might still change it

Ended up doing the rename

igamigo · 2026-08-26T19:44:32Z

@Mirko-von-Leipzig I think we are ready to merge the stack

igamigo marked this pull request as ready for review August 25, 2026 04:02

igamigo requested a review from Mirko-von-Leipzig August 25, 2026 04:03

igamigo changed the title ~~Igamigo exec sponsorship notes~~ feat(ntx-builder): execute sponsorship and feature notes Aug 25, 2026

igamigo changed the title ~~feat(ntx-builder): execute sponsorship and feature notes~~ feat(ntx-builder): bundle and execute sponsorship and feature notes Aug 25, 2026

igamigo mentioned this pull request Aug 25, 2026

chore(ntx-builder): selection and execution of sponsorship notes #2499

Closed

igamigo force-pushed the igamigo-exec-sponsorship-notes branch from b0fae0b to fd9bf91 Compare August 25, 2026 16:51

SantiagoPittella approved these changes Aug 25, 2026

View reviewed changes

Mirko-von-Leipzig approved these changes Aug 26, 2026

View reviewed changes

SantiagoPittella and others added 14 commits August 26, 2026 16:44

chore(ntx-builder): selection and execution of sponsorship notes

90afcad

refactor(ntx-builder): remove GroupIndex re-pairing

f3f08a3

refactor(ntx-builder): remove the require-sponsorship flag

dbb6f83

refactor(ntx-builder): drop random sponsorship subset selection

11b2b6e

refactor(ntx-builder): make the sponsorships-per-note cap a constant

9f9ab25

feat(ntx-builder): re-check dropped note groups before failing them

9965188

fix(ntx-builder): recover consumable note groups

0256ed1

test(ntx-builder): remove redundant recovery tests

ba814ab

chore: lints

e0c808d

chore: improve comments

1a87a24

fix(ntx-builder): adapt sponsorship helpers to base API

610145a

reviews: use only one query, read fee asset id

8be35c6

chore: lints

30c9bae

reviews: inlist::tovalues

c06ab01

igamigo force-pushed the igamigo-exec-sponsorship-notes branch from 9e077f0 to c06ab01 Compare August 26, 2026 19:44

Mirko-von-Leipzig merged commit b809ca1 into next Aug 27, 2026
28 checks passed

Mirko-von-Leipzig deleted the igamigo-exec-sponsorship-notes branch August 27, 2026 08:38

Uh oh!

Conversation

igamigo commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changelog

Uh oh!

SantiagoPittella left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Mirko-von-Leipzig left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

igamigo commented Aug 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

igamigo commented Aug 24, 2026 •

edited

Loading