Restrict EVM access to EOAs with proven malicious activity #8272

m-Peter · 2025-12-28T20:13:46Z

This will also resume all EVM operations for the public.

coderabbitai · 2025-12-28T20:13:54Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov-commenter · 2025-12-28T20:16:54Z

Codecov Report

❌ Patch coverage is 31.81818% with 15 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
fvm/evm/emulator/emulator.go	41.17%	8 Missing and 2 partials ⚠️
fvm/evm/types/result.go	0.00%	3 Missing ⚠️
utils/unittest/execution_state.go	0.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!

peterargue · 2025-12-28T20:41:54Z

fvm/evm/stdlib/contract.cdc

-                gasLimit: gasLimit,
-                value: value.attoflow
-            ) as! Result
+            panic("EVM transactions are temporarily disabled")


this will prevent script executions from calling into EVM right?

nevermind. that uses dryCall

Yeah, we have dryCall for that. I have only updated APIs that mutate the EVM state.

peterargue · 2025-12-28T20:44:28Z

@m-Peter do we also need to disable?

depositNFT
withdrawNFT
depositTokens
withdrawTokens
createCadenceOwnedAccount

m-Peter · 2025-12-28T20:46:31Z

@peterargue All the bridge related operations, under the hood use COAs, and since we have disabled those, I think we're safe. There's no way for the bridge to mutate EVM state, all public APIs that mutate EVM state are disabled.

createCadenceOwnedAccount This is usually part of the creation of Flow accounts in wallets. Do we want to break those transactions too? I am not sure if creating COAs is problematic, because its operations are already disabled.

…mediation actions

joshuahannan · 2026-01-01T23:06:23Z

fvm/evm/stdlib/contract.cdc

+    /// This is only a temporary measure and will be removed immediately
+    /// after the remediation of the illicit tokens 
+    // in the Dec 2025 security incident is complete.
+    /// This function can only be called from the `FlowServiceAccount` contract,
+    /// and only from the holder of `FlowServiceAccount.Administrator` resource.
+    access(account)
+    fun reclaimFundsFromAttackerEOAs(from: String, to: String, amount: UInt): Result {
+        return InternalEVM.call(
+            from: EVM.addressFromString(from).bytes,
+            to: EVM.addressFromString(to).bytes,
+            data: [],
+            gasLimit: 1_000_000,
+            value: amount
+        ) as! Result
+    }
+


This should be removed, right?

I think it could be - I believe all EOAs have been reclaimed, but we can also do this bit later, not critical IMO

We can remove this, if we are not interested in claiming the 1,005 USDF from the EOA address. However, this can be done later on I think. Because we also have to update the FlowServiceAccount, it is currently referencing this function.

Suggestion to 8272: move the msg.From check to proc.run

Co-authored-by: Bastian Müller <[email protected]>

zhangchiqing · 2026-01-02T02:32:08Z

fvm/evm/emulator/restricted_eoa_test.go

+		// Ethereum addresses are case-insensitive in hex representation
+		// but gethCommon.HexToAddress normalizes to lowercase
+		addr1 := gethCommon.HexToAddress("0x2e7C4b71397f10c93dC0C2ba6f8f179A47F994e1")
+		addr2 := gethCommon.HexToAddress("0x2e7c4b71397f10c93dc0c2ba6f8f179a47f994e1")


Added some test case to double check the same address in different case format will still be rejected.

peterargue · 2026-01-02T02:46:20Z

fvm/evm/emulator/emulator.go

+		}
+
+		// Restrict access to EVM, for EOAs with proven malicious activity
+		if slices.Contains(restrictedEOAs, msg.From) {


should this check still be here now that it's done in run?

peterargue · 2026-01-02T03:01:11Z

fvm/evm/emulator/emulator.go

 	txType uint8,
 ) (*types.Result, error) {
+	// Restrict access to EVM, for EOAs with proven malicious activity
+	if isRestrictedEOA(msg.From) {


this is also called within dryRun
https://github.com/onflow/flow-go/blob/mpeter/disable-evm-state-mutation/fvm/evm/emulator/emulator.go#L351

I'm guessing that is fine, but double checking

…h-AN-compatibility-for-v0.44.13

…h-AN-compatibility-for-v0.44.14 to Restrict access to EOAs only

…y-for-v0.44.14 add AN compatibility for v0.44.14 - restrict only EOAs

m-Peter requested review from janezpodhostnik, joshuahannan, tarakby and turbolent December 28, 2025 20:13

m-Peter self-assigned this Dec 28, 2025

m-Peter requested a review from a team as a code owner December 28, 2025 20:13

m-Peter added the Flow EVM label Dec 28, 2025

m-Peter force-pushed the mpeter/disable-evm-state-mutation branch from ee53efc to baae296 Compare December 28, 2025 20:22

peterargue reviewed Dec 28, 2025

View reviewed changes

m-Peter changed the title ~~Freeze all EVM APIs that mutate state~~ Temporarily disable all EVM APIs that mutate state Dec 28, 2025

m-Peter force-pushed the mpeter/disable-evm-state-mutation branch from baae296 to 4a3ef39 Compare December 28, 2025 20:43

joshuahannan approved these changes Dec 28, 2025

View reviewed changes

turbolent approved these changes Dec 28, 2025

View reviewed changes

turbolent mentioned this pull request Dec 29, 2025

Add transaction to disable EVM operations onflow/service-account#408

Merged

m-Peter force-pushed the mpeter/disable-evm-state-mutation branch from 4a3ef39 to 11d2be4 Compare December 31, 2025 10:46

m-Peter changed the title ~~Temporarily disable all EVM APIs that mutate state~~ White-list EVM transactions to list of EOAs for remediation actions Dec 31, 2025

m-Peter changed the title ~~White-list EVM transactions to list of EOAs for remediation actions~~ White-list EVM transactions to certain EOAs for remediation actions Dec 31, 2025

This comment was marked as outdated.

Sign in to view

j1010001 changed the title ~~White-list EVM transactions to certain EOAs for remediation actions~~ Allow-list EVM transactions to certain EOAs for remediation actions Dec 31, 2025

janezpodhostnik approved these changes Dec 31, 2025

View reviewed changes

j1010001 mentioned this pull request Dec 31, 2025

add AN compatibility for v0.44.8 #8282

Closed

m-Peter force-pushed the mpeter/disable-evm-state-mutation branch from dec905a to 4ecb6fa Compare January 1, 2026 10:57

This was referenced Jan 1, 2026

add AN compatibility for v0.44.9 #8283

Closed

add AN compatibility for v0.44.10 #8284

Closed

m-Peter added 2 commits January 1, 2026 22:19

Restrict access to known EOAs that have proven malicious activity

5cdc0ba

Introduce the EVM.reclaimFundsFromAttackerEOAs function to perform re…

a797953

…mediation actions

joshuahannan reviewed Jan 1, 2026

View reviewed changes

move the msg.From check to proc.run

f67ee68

zhangchiqing mentioned this pull request Jan 2, 2026

Suggestion to 8272: move the msg.From check to proc.run #8286

Merged

zhangchiqing and others added 6 commits January 1, 2026 18:09

update execution state

4959dbb

Merge pull request #8286 from onflow/leo/check-msg-sender

046b973

Suggestion to 8272: move the msg.From check to proc.run

Apply suggestions from code review

2ea4aab

Co-authored-by: Bastian Müller <[email protected]>

add test case for restricted eoa

23f7cd7

add test case for TestIsRestrictedEOA

0b3de6a

add test case for TestIsRestrictedEOA

2b970ea

zhangchiqing reviewed Jan 2, 2026

View reviewed changes

peterargue reviewed Jan 2, 2026

View reviewed changes

add AN compatibility for v0.44.13

71f46f0

j1010001 mentioned this pull request Jan 2, 2026

add AN compatibility for v0.44.13 #8288

Merged

remove redundent check

2dd0141

peterargue reviewed Jan 2, 2026

View reviewed changes

zhangchiqing added 4 commits January 1, 2026 19:08

fix lint

39cfed4

add restrict check to proc.deployAt

31c420c

add test case to verify restrict checks has been added to proc.deployAt

a5ef155

fix the bootstrap state

979c7b0

peterargue approved these changes Jan 2, 2026

View reviewed changes

zhangchiqing and others added 5 commits January 1, 2026 19:16

fix the bootstrap state

ec83075

Merge branch 'mpeter/disable-evm-state-mutation' into jan/pr-8272-wit…

51e3bdd

…h-AN-compatibility-for-v0.44.13

Restrict access to EOAs only

c3c07a7

Merge branch 'mpeter/disable-evm-state-mutation' into jan/pr-8272-wit…

00880a9

…h-AN-compatibility-for-v0.44.14 to Restrict access to EOAs only

add AN compatibility for v0.44.14 - restrict only EOAs

381c278

peterargue approved these changes Jan 2, 2026

View reviewed changes

j1010001 mentioned this pull request Jan 2, 2026

add AN compatibility for v0.44.14 - restrict only EOAs #8289

Merged

Merge pull request #8289 from onflow/jan/pr-8272-with-AN-compatibilit…

a9d2961

…y-for-v0.44.14 add AN compatibility for v0.44.14 - restrict only EOAs

j1010001 merged commit a7bf11e into v0.44 Jan 3, 2026
57 checks passed

j1010001 deleted the mpeter/disable-evm-state-mutation branch January 3, 2026 21:05

Restrict EVM access to EOAs with proven malicious activity #8272

Restrict EVM access to EOAs with proven malicious activity #8272

Uh oh!

Conversation

m-Peter commented Dec 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Dec 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

codecov-commenter commented Dec 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

peterargue commented Dec 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

m-Peter commented Dec 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

m-Peter commented Dec 28, 2025 •

edited

Loading

coderabbitai bot commented Dec 28, 2025 •

edited

Loading

codecov-commenter commented Dec 28, 2025 •

edited

Loading

peterargue commented Dec 28, 2025 •

edited

Loading

m-Peter commented Dec 28, 2025 •

edited

Loading