Require native-asset fee notes when fees are enabled

crates/block-producer/src/domain/transaction.rs

@@ -1,36 +1,38 @@
-use miden_protocol::Word;
+use miden_protocol::asset::AssetId;
 use miden_protocol::block::FeeParameters;
-use miden_protocol::transaction::ProvenTransaction;
+use miden_protocol::transaction::{OutputNote, ProvenTransaction};
 use miden_standards::note::TxFeeNote;
 
 use crate::errors::MempoolSubmissionError;
 
-/// Ensures that a transaction pays a non-zero fee when fees are enabled.
+/// Requires a fee note when the reference block's verification base fee is nonzero.
+/// Every fee note must contain exactly one asset with the specified native asset ID.
 ///
-/// A zero verification base fee disables this check. Otherwise, the transaction must contain a
-/// canonical fee output note with at least one non-zero asset. Validating that the amount is
-/// sufficient for the transaction's execution cost is handled separately.
+/// This check does not validate that the fee is sufficient for the transaction execution cost.
 pub fn ensure_transaction_has_fee(
     tx: &ProvenTransaction,
+    fee_asset_id: AssetId,
     fee_parameters: &FeeParameters,
 ) -> Result<(), MempoolSubmissionError> {
-    if fee_parameters.verification_base_fee() == 0 {
-        return Ok(());
+    let fee_script_root = TxFeeNote::script_root();
+    let mut contains_fee = false;
+    for note in tx.output_notes().iter() {
+        let OutputNote::Public(note) = note else {
+            continue;
+        };
+        if note.recipient().script().root() != fee_script_root {
+            continue;
+        }
+        if !matches!(note.assets().as_slice(), [asset] if asset.id() == fee_asset_id) {
+            return Err(MempoolSubmissionError::InvalidFeeAsset {
+                transaction_id: tx.id(),
+                fee_asset_id,
+            });
+        }
+        contains_fee = true;
     }
 
-    let fee_script_root = TxFeeNote::script_root();
-    let contains_fee = tx.output_notes().iter().any(|note| {
-        let has_fee_script = note
-            .recipient()
-            .is_some_and(|recipient| recipient.script().root() == fee_script_root);
-        let has_non_zero_asset = note.assets().is_some_and(|assets| {
-            assets.iter().any(|asset| asset.to_value_word() != Word::empty())
-        });
-
-        has_fee_script && has_non_zero_asset
-    });
-
-    if contains_fee {
+    if contains_fee || fee_parameters.verification_base_fee() == 0 {
         Ok(())
     } else {
         Err(MempoolSubmissionError::MissingFee { transaction_id: tx.id() })
@@ -42,8 +44,10 @@ mod tests {
     use assert_matches::assert_matches;
     use miden_node_proto::{BuildUnchecked, DecodeMessage};
     use miden_protocol::Word;
-    use miden_protocol::asset::FungibleAsset;
+    use miden_protocol::asset::{Asset, AssetId, FungibleAsset};
     use miden_protocol::block::FeeParameters;
+    use miden_protocol::note::{Note, NoteAssets};
+    use miden_protocol::testing::account_id::ACCOUNT_ID_PUBLIC_FUNGIBLE_FAUCET_1;
     use miden_protocol::transaction::{OutputNote, ProvenTransaction, PublicOutputNote};
     use miden_standards::note::TxFeeNote;
 
@@ -63,55 +67,104 @@ mod tests {
         assert_eq!(decoded, transaction);
     }
 
-    fn fee_parameters(verification_base_fee: u32) -> FeeParameters {
-        FeeParameters::new(verification_base_fee)
+    fn transaction_with_fee_amount(amount: u64) -> ProvenTransaction {
+        MockProvenTxBuilder::with_account_index(1)
+            .output_notes(vec![fee_output_note(
+                &[FungibleAsset::new(FungibleAsset::mock_issuer(), amount).unwrap().into()],
+                1,
+            )])
+            .build()
     }
 
-    fn transaction_with_fee_amount(amount: u64) -> ProvenTransaction {
-        let fee_note = TxFeeNote::builder()
+    fn fee_asset_id() -> AssetId {
+        AssetId::new_fungible(FungibleAsset::mock_issuer())
+    }
+
+    fn fee_output_note(assets: &[Asset], serial: u32) -> OutputNote {
+        let template: Note = TxFeeNote::builder()
             .sender(mock_account_id(1))
-            .serial_number(Word::from([1u32, 2, 3, 4]))
-            .asset(FungibleAsset::new(FungibleAsset::mock_issuer(), amount).unwrap())
+            .serial_number(Word::from([serial, 2, 3, 4]))
+            .asset(FungibleAsset::new(FungibleAsset::mock_issuer(), 1).unwrap())
             .build()
             .unwrap()
             .into();
-
-        MockProvenTxBuilder::with_account_index(1)
-            .output_notes(vec![OutputNote::Public(PublicOutputNote::new(fee_note).unwrap())])
-            .build()
+        let note = Note::new(
+            NoteAssets::new(assets.to_vec()).unwrap(),
+            *template.metadata().partial_metadata(),
+            template.recipient().clone(),
+        );
+        OutputNote::Public(PublicOutputNote::new(note).unwrap())
     }
 
     #[test]
     fn transaction_fee_requires_the_canonical_note_script() {
         let tx = transaction_with_fee_amount(1);
 
-        ensure_transaction_has_fee(&tx, &fee_parameters(1)).unwrap();
+        ensure_transaction_has_fee(&tx, fee_asset_id(), &FeeParameters::new(1)).unwrap();
     }
 
     #[test]
-    fn transaction_without_fee_is_rejected_when_fees_are_enabled() {
+    fn transaction_without_fee_is_rejected() {
         let tx = MockProvenTxBuilder::with_account_index(1).build();
 
         assert_matches!(
-            ensure_transaction_has_fee(&tx, &fee_parameters(1)),
+            ensure_transaction_has_fee(&tx, fee_asset_id(), &FeeParameters::new(1)),
             Err(MempoolSubmissionError::MissingFee { transaction_id }) if transaction_id == tx.id()
         );
     }
 
     #[test]
-    fn transaction_with_zero_fee_asset_is_rejected_when_fees_are_enabled() {
+    fn transaction_without_fee_is_accepted_when_fees_are_zero() {
+        let tx = MockProvenTxBuilder::with_account_index(1).build();
+
+        ensure_transaction_has_fee(&tx, fee_asset_id(), &FeeParameters::new(0)).unwrap();
+    }
+
+    #[test]
+    fn transaction_with_zero_fee_asset_is_accepted() {
         let tx = transaction_with_fee_amount(0);
 
-        assert_matches!(
-            ensure_transaction_has_fee(&tx, &fee_parameters(1)),
-            Err(MempoolSubmissionError::MissingFee { transaction_id }) if transaction_id == tx.id()
-        );
+        ensure_transaction_has_fee(&tx, fee_asset_id(), &FeeParameters::new(1)).unwrap();
     }
 
     #[test]
-    fn transaction_without_fee_is_accepted_when_fees_are_disabled() {
-        let tx = MockProvenTxBuilder::with_account_index(1).build();
+    fn fee_notes_must_contain_only_the_native_asset() {
+        let native = FungibleAsset::new(FungibleAsset::mock_issuer(), 1).unwrap().into();
+        let foreign_faucet = ACCOUNT_ID_PUBLIC_FUNGIBLE_FAUCET_1.try_into().unwrap();
+        let foreign = FungibleAsset::new(foreign_faucet, 1).unwrap().into();
+        let zero_foreign = FungibleAsset::new(foreign_faucet, 0).unwrap().into();
+        for assets in [vec![], vec![foreign], vec![zero_foreign], vec![native, foreign]] {
+            let tx = MockProvenTxBuilder::with_account_index(1)
+                .output_notes(vec![fee_output_note(&assets, 1)])
+                .build();
+            for base_fee in [0, 1] {
+                assert_matches!(
+                    ensure_transaction_has_fee(&tx, fee_asset_id(), &FeeParameters::new(base_fee)),
+                    Err(MempoolSubmissionError::InvalidFeeAsset { transaction_id, .. })
+                        if transaction_id == tx.id()
+                );
+            }
+        }
+    }
 
-        ensure_transaction_has_fee(&tx, &fee_parameters(0)).unwrap();
+    #[test]
+    fn native_fee_note_does_not_allow_other_fee_notes_with_foreign_assets() {
+        let native = FungibleAsset::new(FungibleAsset::mock_issuer(), 1).unwrap().into();
+        let foreign =
+            FungibleAsset::new(ACCOUNT_ID_PUBLIC_FUNGIBLE_FAUCET_1.try_into().unwrap(), 1)
+                .unwrap()
+                .into();
+        for assets in [[native, foreign], [foreign, native]] {
+            let tx = MockProvenTxBuilder::with_account_index(1)
+                .output_notes(vec![
+                    fee_output_note(&assets[..1], 1),
+                    fee_output_note(&assets[1..], 2),
+                ])
+                .build();
+            assert_matches!(
+                ensure_transaction_has_fee(&tx, fee_asset_id(), &FeeParameters::new(1)),
+                Err(MempoolSubmissionError::InvalidFeeAsset { .. })
+            );
+        }
     }
 }

crates/block-producer/src/errors.rs

@@ -11,6 +11,7 @@ use miden_node_store::{
 };
 use miden_protocol::Word;
 use miden_protocol::account::AccountId;
+use miden_protocol::asset::AssetId;
 use miden_protocol::block::BlockNumber;
 use miden_protocol::crypto::utils::DeserializationError;
 use miden_protocol::errors::{ProposedBatchError, ProposedBlockError, ProvenBatchError};
@@ -76,7 +77,7 @@ pub enum MempoolSubmissionError {
     #[error("the mempool is at capacity")]
     CapacityExceeded,
 
-    #[error("transaction {transaction_id} does not contain a non-zero TX_FEE output note")]
+    #[error("transaction {transaction_id} does not contain a canonical TX_FEE output note")]
     MissingFee { transaction_id: TransactionId },
 
     #[error("transaction {transaction_id} consumes in-flight TX_FEE notes: {note_ids:?}")]
@@ -88,6 +89,14 @@ pub enum MempoolSubmissionError {
     #[error("mempool lock is poisoned")]
     #[grpc(internal)]
     MempoolPoisoned(#[source] MempoolPoisonError),
+
+    #[error(
+        "transaction {transaction_id} must use only the native asset {fee_asset_id} in each TX_FEE output note"
+    )]
+    InvalidFeeAsset {
+        transaction_id: TransactionId,
+        fee_asset_id: AssetId,
+    },
 }
 
 // Mempool submission conflicts with current state

crates/rpc/src/server/api/submit_auth_tx.rs

@@ -5,7 +5,7 @@ use miden_node_proto::{DecodeMessageExt, generated as proto};
 use miden_node_tracing::ErrorReport;
 use tonic::Status;
 
-use super::{SequencerInternalService, get_block_header_error_to_status};
+use super::{SequencerInternalService, get_block_header_error_to_status, load_protocol_config};
 
 #[tonic::async_trait]
 impl sequencer_api::SubmitAuthenticatedTx for SequencerInternalService {
@@ -54,8 +54,13 @@ impl sequencer_api::SubmitAuthenticatedTx for SequencerInternalService {
             )));
         }
 
-        ensure_transaction_has_fee(tx.raw_proven_transaction(), reference_header.fee_parameters())
-            .map_err(Status::from)?;
+        let protocol_config = load_protocol_config(&self.state.view(), &reference_header).await?;
+        ensure_transaction_has_fee(
+            tx.raw_proven_transaction(),
+            protocol_config.fee_asset_id(),
+            reference_header.fee_parameters(),
+        )
+        .map_err(Status::from)?;
 
         self.block_producer
             .submit_authenticated_tx(tx)

crates/rpc/src/server/api/submit_proven_tx.rs

@@ -15,7 +15,7 @@ use miden_protocol::transaction::{
 };
 use tonic::{Request, Status};
 
-use super::{COMPONENT, RpcBackend, RpcService, submit_tx_to_validators};
+use super::{COMPONENT, RpcBackend, RpcService, load_protocol_config, submit_tx_to_validators};
 use crate::LOG_TARGET;
 
 #[tonic::async_trait]
@@ -76,7 +76,13 @@ impl proto::server::rpc_api::SubmitProvenTx for RpcService {
         let reference_header = self
             .verify_reference_commitment(tx.ref_block_num(), tx.ref_block_commitment())
             .await?;
-        ensure_transaction_has_fee(&tx, reference_header.fee_parameters()).map_err(Status::from)?;
+        let protocol_config = load_protocol_config(&self.state.view(), &reference_header).await?;
+        ensure_transaction_has_fee(
+            &tx,
+            protocol_config.fee_asset_id(),
+            reference_header.fee_parameters(),
+        )
+        .map_err(Status::from)?;
 
         // Rebuild a new ProvenTransaction with decorators removed from output notes
         let account_update = TxAccountUpdate::new(

crates/rpc/src/server/api/submit_proven_tx_batch.rs

@@ -76,7 +76,7 @@ impl proto::server::rpc_api::SubmitProvenTxBatch for RpcService {
             }
         }
 
-        // Verify the reference block is actually part of the chain.
+        // Verify that the reference block is part of the chain.
         self.verify_reference_commitment(
             proven_batch.reference_block_num(),
             proven_batch.reference_block_commitment(),