test: end-to-end deposit-from-CEX EIP-7702 sweep demo against a local Ethereum node (#10670)

A hermetic, monorepo-native integration test that validates the "deposit
from CEX" sweep (design in `rs/ethereum/cketh/docs/deposit_from_cex.md`)
end-to-end against a local `anvil` node, through the minter's productive
EIP-7702 transaction layer (#10671).

It sweeps unfunded deposit addresses to the minter in minter-paid
EIP-7702 transactions, checks each emits the canonical deposit event
with the right IC principal, measures gas across batch sizes (1/10/20),
and covers both sweeper designs — caller-gated and
permissionless-with-minter-attestation — including rejection of
unauthorized sweeps.

foundry and solc are vendored via Bazel (no docker, IC replica, or
alloy).

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: IDX GitHub Automation <infra+github-automation@dfinity.org>

Author: 3 people

BUILD.bazel

@@ -100,6 +100,30 @@ alias(
     }),
 )
 
+### foundry (anvil) & solc, used by //rs/ethereum/cketh/minter:deposit_from_cex_demo_test
+
+alias(
+    name = "anvil",
+    actual = select({
+        "@bazel_tools//src/conditions:darwin_arm64": "@foundry_bin_darwin_arm64//:anvil",
+        "@bazel_tools//src/conditions:darwin_x86_64": "@foundry_bin_darwin_amd64//:anvil",
+        "@bazel_tools//src/conditions:linux_aarch64": "@foundry_bin_linux_arm64//:anvil",
+        "@bazel_tools//src/conditions:linux_x86_64": "@foundry_bin_linux_amd64//:anvil",
+    }),
+)
+
+# The macOS solc download is a universal (x86_64 + arm64) binary, so it serves
+# both Intel and Apple Silicon Macs natively.
+alias(
+    name = "solc",
+    actual = select({
+        "@bazel_tools//src/conditions:darwin_arm64": "@solc_0_8_35_macosx_amd64//file",
+        "@bazel_tools//src/conditions:darwin_x86_64": "@solc_0_8_35_macosx_amd64//file",
+        "@bazel_tools//src/conditions:linux_aarch64": "@solc_0_8_35_linux_arm64//file",
+        "@bazel_tools//src/conditions:linux_x86_64": "@solc_0_8_35_linux_amd64//file",
+    }),
+)
+
 genrule(
     name = "dogecoind_stub",
     outs = ["dogecoind_stub.txt"],

Cargo.lock

@@ -442,6 +442,71 @@ http_file(
     url = "https://binaries.soliditylang.org/linux-amd64/solc-linux-amd64-v0.8.18+commit.87f61d96",
 )
 
+# Latest stable solc, used by //rs/ethereum/cketh/minter:deposit_from_cex_demo_test
+# to compile the demo contracts (pinned exactly for reproducible bytecode/gas).
+# One binary per host platform; the consuming target selects the right one.
+# The macosx-amd64 download is a universal (x86_64 + arm64) Mach-O, so it runs
+# natively on both Intel and Apple Silicon Macs.
+http_file(
+    name = "solc_0_8_35_linux_amd64",
+    downloaded_file_path = "solc",
+    executable = True,
+    sha256 = "fa8ac9a32d301ad023a36ee5a29f8e291fe3200c60244e43c142539e82a617f4",
+    url = "https://binaries.soliditylang.org/linux-amd64/solc-linux-amd64-v0.8.35+commit.47b9dedd",
+)
+
+http_file(
+    name = "solc_0_8_35_linux_arm64",
+    downloaded_file_path = "solc",
+    executable = True,
+    sha256 = "4218d2936d2b582bc5751dac548f97b36a8652b21ded52b60a1c1259143ee0e4",
+    url = "https://binaries.soliditylang.org/linux-arm64/solc-linux-arm64-v0.8.35+commit.47b9dedd",
+)
+
+http_file(
+    name = "solc_0_8_35_macosx_amd64",
+    downloaded_file_path = "solc",
+    executable = True,
+    sha256 = "6e432580d973cae74c869ef4f737529e73fec5b200dce3c08d5e76c4a6b19159",
+    url = "https://binaries.soliditylang.org/macosx-amd64/solc-macosx-amd64-v0.8.35+commit.47b9dedd",
+)
+
+# foundry release binaries (anvil/cast/forge/chisel) used to run a local
+# EIP-7702-capable Ethereum node hermetically from a rust_test, without docker.
+# This release (>= v1.0) supports EIP-7702, unlike the v0.3.0 `@foundry` oci
+# image used by //rs/tests/cross_chain:ic_xc_cketh_test. One archive per host
+# platform; the consuming target selects the right one (see
+# //rs/ethereum/cketh/deposit_from_cex_demo:BUILD.bazel).
+FOUNDRY_BUILD_FILE = 'exports_files(["anvil", "cast", "forge", "chisel"])'
+
+http_archive(
+    name = "foundry_bin_linux_amd64",
+    build_file_content = FOUNDRY_BUILD_FILE,
+    sha256 = "cf7e688ed0c4c48adffca788b496076e31060b67ac5afe1e43dbb5499c20c88b",
+    url = "https://github.com/foundry-rs/foundry/releases/download/v1.7.1/foundry_v1.7.1_linux_amd64.tar.gz",
+)
+
+http_archive(
+    name = "foundry_bin_linux_arm64",
+    build_file_content = FOUNDRY_BUILD_FILE,
+    sha256 = "c8fe8fa09ae3aba2c81b510c6f9da3a9d468029b9580e690b245b3f0aea687ae",
+    url = "https://github.com/foundry-rs/foundry/releases/download/v1.7.1/foundry_v1.7.1_linux_arm64.tar.gz",
+)
+
+http_archive(
+    name = "foundry_bin_darwin_amd64",
+    build_file_content = FOUNDRY_BUILD_FILE,
+    sha256 = "c7fd1f5c9bf718d30b5cb6fc94eac605039de2aa50afc4c545a4dddc1e411acb",
+    url = "https://github.com/foundry-rs/foundry/releases/download/v1.7.1/foundry_v1.7.1_darwin_amd64.tar.gz",
+)
+
+http_archive(
+    name = "foundry_bin_darwin_arm64",
+    build_file_content = FOUNDRY_BUILD_FILE,
+    sha256 = "eacdc67718fac857cad9e19c7f6729dd80de731d09df81856391d093cfcab547",
+    url = "https://github.com/foundry-rs/foundry/releases/download/v1.7.1/foundry_v1.7.1_darwin_arm64.tar.gz",
+)
+
 # Bitcoin Adapter Mainnet Data for Integration Test
 
 # The files have been generated by syncing bitcoind client, followed

MODULE.bazel

@@ -200,7 +200,11 @@ rust_ic_test_suite(
     timeout = "long",
     srcs = glob(
         ["tests/**/*.rs"],
-        exclude = ["tests/dump_stable_memory.rs"],
+        exclude = [
+            "tests/dump_stable_memory.rs",
+            # Runs against a local foundry anvil node, not the IC test suite.
+            "tests/deposit_from_cex_demo.rs",
+        ],
     ),
     data = [
         ":cketh_minter_debug.wasm.gz",
@@ -243,6 +247,43 @@ rust_ic_test_suite(
     ],
 )
 
+rust_test(
+    name = "deposit_from_cex_demo_test",
+    size = "small",
+    srcs = ["tests/deposit_from_cex_demo.rs"],
+    data = [
+        "//:anvil",
+        "//:solc",
+        # Contract sources compiled at test time by the vendored solc.
+        "DepositHelperWithSubaccount.sol",
+        "tests/deposit_from_cex_demo/CkSweeperAttested.sol",
+        "tests/deposit_from_cex_demo/CkSweeperViaHelper.sol",
+        "tests/deposit_from_cex_demo/MockUSDT.sol",
+    ],
+    edition = "2021",
+    env = {
+        "ANVIL_BIN": "$(rootpath //:anvil)",
+        "CKDEPOSIT_SOL": "$(rootpath DepositHelperWithSubaccount.sol)",
+        "CKSWEEPER_ATTESTED_SOL": "$(rootpath tests/deposit_from_cex_demo/CkSweeperAttested.sol)",
+        "CKSWEEPER_VIA_HELPER_SOL": "$(rootpath tests/deposit_from_cex_demo/CkSweeperViaHelper.sol)",
+        "MOCKUSDT_SOL": "$(rootpath tests/deposit_from_cex_demo/MockUSDT.sol)",
+        "SOLC_BIN": "$(rootpath //:solc)",
+    },
+    deps = [
+        # Keep sorted.
+        ":minter",
+        "//packages/ic-ethereum-types",
+        "//packages/ic-secp256k1",
+        "@crate_index//:candid",
+        "@crate_index//:ethers-core",
+        "@crate_index//:ethnum",
+        "@crate_index//:hex",
+        "@crate_index//:ic-sha3",
+        "@crate_index//:reqwest",
+        "@crate_index//:serde_json",
+    ],
+)
+
 rust_binary(
     name = "cketh_minter_dump_stable_memory",
     testonly = True,

rs/ethereum/cketh/minter/BUILD.bazel

@@ -70,6 +70,7 @@ ic-state-machine-tests = { path = "../../../state_machine_tests" }
 maplit = "1"
 proptest = { workspace = true }
 rand = { workspace = true }
+reqwest = { workspace = true }
 scraper = "0.17.1"
 tempfile = { workspace = true }
 tokio = { workspace = true }