[mswilkison]

This draft now reflects the verified live beacon wiring and the supplied Sepolia test report. WalletRegistry uses uncapped RandomBeaconChaosnet (0xF23fc18EcE6Afe7fb57ba59979e8600bb4B0294a), following a January 2023 update. The earlier capped-beacon fixture assigned synthetic provider storage and did not reproduce that live path. The claimed mainnet wallet-creation blocker is withdrawn. The proposed callback-default increase and automatically generated callback-update calls are removed; historical defaults are preserved.

The unsupported 450k beacon / 500k wallet reimbursement defaults are also withdrawn. For a 100-member WalletRegistry result with 100 signatures and no misbehaved members, both submission and approval have 13,412-byte calldata and an Amsterdam transaction floor of 873,368 gas. This settlement floor is invisible to gasleft() even below 2^24; a two-slot cost delta is insufficient. The proposed 920k wallet allowance remains a benchmark candidate for a measured path, not a deployment recommendation. Verify the target implementation and actual ETH reimbursement: covering gas units can still leave a shortfall when submission and approval effective prices differ. RandomBeacon needs its own benchmark.

Remaining changes clamp execution-gas reimbursement deltas and the negative DKG-timeout offset to zero without storage-layout changes; no ordinary production transaction has been demonstrated to trigger underflow. Saturation is defensive and does not solve calldata-floor or reservoir reimbursement. A read-only preparation script displays the registry's actual provider and current parameters at a pinned block; it generates refund-update calls only for explicit benchmarked environment inputs, with no signing or broadcasting. Existing governance setters can adjust refunds without an implementation upgrade.

Validation on this correction: both packages freshly compile using official solc-js 0.8.17/0.8.9; 29 targeted ECDSA tests and 142 RandomBeacon group-creation/reimbursement tests pass. The generator passes offline checks for inspection-only output, provider distinction, selected-target calldata, and six malformed/overflowing inputs. Scoped ESLint/formatting and the explicitly hypothetical EELS assertions pass. Temporary local compiler/test harnesses are not committed.

All current-head CI checks pass at 996bbef, including contract tests/lint/Slither/deployment dry runs and the longer replay/client jobs. Existing CI repairs and the measured approval gas snapshot correction are retained; refund assertions use the original surplus bounds without normalization for provisional increases. The final change clarifies that gas-unit coverage does not guarantee full ETH reimbursement.

Draft gates: independent receipt-backed DKG submission/approval reimbursement benchmarks; final fork specification and offset checks; current-head CI; review any separately approved governance inputs and pending values. There is no demonstrated requirement to upgrade the live mainnet contracts from the callback analysis.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn