feat(cketh): sign the authorizations a batched sweep needs

[gregorydemay]

Why

• The attestations the previous layer signs name the account a sweep credits, but nothing yet lets the delegate move the funds: a deposit address only executes the sweeper contract's code once it has signed an EIP-7702 authorization delegating to it.

What

• Each deposit address in a batch signs the tuple delegating its code to the configured sweeper contract.
• The tuple carries nonce 0 whatever nonce the address actually holds. A deposit address is at nonce 0 exactly while it has never been delegated, so the authorization either installs the delegation or is skipped — both correct, in any ordering of the sweeps carrying them. That is what lets a sweep authorize every address it touches without tracking which ones are already delegated, at the price of a skipped tuple's intrinsic gas.
• Signatures are recorded through the event log, keyed by what was signed, so a later sweep of the same address reuses one rather than paying for another threshold-ECDSA signature. Keying by the request rather than the account is what makes that safe: re-pointing the minter at another sweeper contract changes the tuple, so it misses the cache and is signed afresh instead of reusing one that delegates the old contract.
• Attestations and authorizations are signed independently. A deposit needs both before it can be swept, but neither signature depends on the other, so authorizing an address whose attestation failed costs nothing: the tuple is recorded and reused once the attestation lands.
• Recording the tuple is a shortcut: it saves the signature but not the gas, since an address that is already delegated still gets sent a tuple the chain skips. Recording that the address is delegated, rather than what it signed, would save both — left for a later layer.

Candid compatibility

• Needs the CI_OVERRIDE_DIDC_CHECK label: get_events returns a variant, and AuthorizedDepositAddress adds a case to it. A variant with more cases is not a Candid subtype of one with fewer, so the check against the merge base rejects it, exactly as it did for the attestation event in feat(cketh): remember the attestations the minter has signed #11319.
• The case is additive: no existing case changes shape, so every event emitted so far decodes as before. Only a client reading an event of the new kind needs to know it.

[Copilot]

Pull request overview

Adds EIP-7702 authorization signing for attested ckERC20 deposit addresses.

Changes:

• Signs nonce-0 delegation authorizations in batches.
• Adds signing expectations and coverage for authorization tuples.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
sweep/mod.rs	Implements batched authorization signing.
sweep/tests.rs	Tests authorization digest, path, and signature count.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 4c36bb1.

Security Overview

• 🔎 Scanned files: 14 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/783a9bd4-fb4e-4e10-ab3c-c2fb2ddfb92f?scanId=fa8f0e02-a1ad-48b4-bbba-d4d7e937b914&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► rs/ethereum/cketh/minter/src/endpoints.rs      AuthorizedDepositAddress field added to Event types
Enhancement	► rs/ethereum/cketh/minter/src/main.rs      Handle AuthorizedDepositAddress event type in get_events mapping      Expose stored_authorizations gauge      Add authorization-related data extraction from events
Enhancement	► rs/ethereum/cketh/minter/src/state.rs      Add authorization_requests method to generate AuthorizationRequest objects
Enhancement	► rs/ethereum/cketh/minter/src/state/audit.rs      Handle AuthorizedDepositAddress in apply_state_transition
Enhancement	► rs/ethereum/cketh/minter/src/state/audit/tests.rs      Update tests to include AuthorizedDepositAddress event and related authorization logic
Enhancement	► rs/ethereum/cketh/minter/src/state/automatic_deposits/mod.rs      Add authorization map with record_authorization and related accessors      Expose authorizations_len
Enhancement	► rs/ethereum/cketh/minter/src/state/event.rs      Add AuthorizedDepositAddress variant to EventType enum with corresponding payload fields
Enhancement	► rs/ethereum/cketh/minter/src/sweep/mod.rs      Import AuthorizationRequest and related changes; adjust sweeper request flow to include authorization handling      Add batching for sign_authorizations_batch and integrate into sweep creation
Enhancement	► rs/ethereum/cketh/minter/src/tx/eip_7702.rs      Introduce AuthorizationRequest struct and related methods (account, derivation_path, authorization, signed_with) for authorization handling
Enhancement	► rs/ethereum/cketh/minter/src/tx/mod.rs      Expose AuthorizationRequest and Authorized types in tx module; adjust imports
Enhancement	► rs/ethereum/cketh/minter/tests/deposit_from_cex_demo.rs      Add tests for zero-nonce authorization re-delegation and related behavior

[mbjorkqvist]

Thanks @gregorydemay!

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.