feat(runtime): restrict creation of Ethereum address on NEAR

chain/chain/src/tests/simple_chain.rs

@@ -48,7 +48,7 @@ fn build_chain() {
     //     cargo insta test --accept -p near-chain --features nightly -- tests::simple_chain::build_chain
     let hash = chain.head().unwrap().last_block_hash;
     if cfg!(feature = "nightly") {
-        insta::assert_display_snapshot!(hash, @"GargNTMFiuET32KH5uPLFwMSU8xXtvrk6aGqgkPbRZg8");
+        insta::assert_display_snapshot!(hash, @"CwaiZ4AmfJSnMN9rytYwwYHCTzLioC5xcjHzNkDex1HH");
     } else {
         insta::assert_display_snapshot!(hash, @"712T4sPbJhNWWN3bWweccECGYWbnUmGpqpKW2SJpb2k5");
     }
@@ -78,7 +78,7 @@ fn build_chain() {
 
     let hash = chain.head().unwrap().last_block_hash;
     if cfg!(feature = "nightly") {
-        insta::assert_display_snapshot!(hash, @"2aurKZqRfPkZ3woNjA7Kf79wq5MYz98AohTYWoBFiG7o");
+        insta::assert_display_snapshot!(hash, @"Dn18HUFm149fojXpwV1dYCfjdPh56S1k233kp7vmnFeE");
     } else {
         insta::assert_display_snapshot!(hash, @"GUAPgvPQQmhumyuFzPusg3BKtRkVLpCw4asTAWgdTLq6");
     }

core/primitives-core/Cargo.toml

@@ -36,12 +36,14 @@ protocol_feature_fix_staking_threshold = []
 protocol_feature_fix_contract_loading_cost = []
 protocol_feature_reject_blocks_with_outdated_protocol_version = []
 protocol_feature_simple_nightshade_v2 = []
+protocol_feature_restrict_tla = []
 
 nightly = [
   "nightly_protocol",
   "protocol_feature_fix_contract_loading_cost",
   "protocol_feature_fix_staking_threshold",
   "protocol_feature_reject_blocks_with_outdated_protocol_version",
+  "protocol_feature_restrict_tla",
   "protocol_feature_simple_nightshade_v2",
 ]
 

core/primitives-core/src/version.rs

@@ -120,6 +120,8 @@ pub enum ProtocolFeature {
     RejectBlocksWithOutdatedProtocolVersions,
     #[cfg(feature = "protocol_feature_simple_nightshade_v2")]
     SimpleNightshadeV2,
+    #[cfg(feature = "protocol_feature_restrict_tla")]
+    RestrictTLA,
 }
 
 impl ProtocolFeature {
@@ -173,6 +175,8 @@ impl ProtocolFeature {
             ProtocolFeature::RejectBlocksWithOutdatedProtocolVersions => 132,
             #[cfg(feature = "protocol_feature_simple_nightshade_v2")]
             ProtocolFeature::SimpleNightshadeV2 => 135,
+            #[cfg(feature = "protocol_feature_restrict_tla")]
+            ProtocolFeature::RestrictTLA => 139,
         }
     }
 }
@@ -185,7 +189,7 @@ const STABLE_PROTOCOL_VERSION: ProtocolVersion = 63;
 /// Largest protocol version supported by the current binary.
 pub const PROTOCOL_VERSION: ProtocolVersion = if cfg!(feature = "nightly_protocol") {
     // On nightly, pick big enough version to support all features.
-    138
+    139
 } else {
     // Enable all stable features.
     STABLE_PROTOCOL_VERSION

core/primitives/Cargo.toml

@@ -45,15 +45,27 @@ near-vm-runner.workspace = true
 [features]
 sandbox = []
 dump_errors_schema = ["near-rpc-error-macro/dump_errors_schema"]
-protocol_feature_fix_staking_threshold = ["near-primitives-core/protocol_feature_fix_staking_threshold"]
-protocol_feature_fix_contract_loading_cost = ["near-primitives-core/protocol_feature_fix_contract_loading_cost"]
-protocol_feature_reject_blocks_with_outdated_protocol_version = ["near-primitives-core/protocol_feature_reject_blocks_with_outdated_protocol_version"]
-protocol_feature_simple_nightshade_v2 = ["near-primitives-core/protocol_feature_simple_nightshade_v2"]
+protocol_feature_fix_staking_threshold = [
+  "near-primitives-core/protocol_feature_fix_staking_threshold",
+]
+protocol_feature_fix_contract_loading_cost = [
+  "near-primitives-core/protocol_feature_fix_contract_loading_cost",
+]
+protocol_feature_reject_blocks_with_outdated_protocol_version = [
+  "near-primitives-core/protocol_feature_reject_blocks_with_outdated_protocol_version",
+]
+protocol_feature_simple_nightshade_v2 = [
+  "near-primitives-core/protocol_feature_simple_nightshade_v2",
+]
+protocol_feature_restrict_tla = [
+  "near-primitives-core/protocol_feature_restrict_tla",
+]
 nightly = [
   "nightly_protocol",
   "protocol_feature_fix_contract_loading_cost",
   "protocol_feature_fix_staking_threshold",
   "protocol_feature_reject_blocks_with_outdated_protocol_version",
+  "protocol_feature_restrict_tla",
   "protocol_feature_simple_nightshade_v2",
   "near-fmt/nightly",
   "near-primitives-core/nightly",

integration-tests/Cargo.toml

@@ -80,11 +80,13 @@ protocol_feature_reject_blocks_with_outdated_protocol_version = [
 protocol_feature_simple_nightshade_v2 = [
   "near-primitives/protocol_feature_simple_nightshade_v2",
 ]
+protocol_feature_restrict_tla = ["nearcore/protocol_feature_restrict_tla"]
 
 nightly = [
   "nightly_protocol",
   "protocol_feature_fix_contract_loading_cost",
   "protocol_feature_reject_blocks_with_outdated_protocol_version",
+  "protocol_feature_restrict_tla",
   "protocol_feature_simple_nightshade_v2",
   "near-actix-test-utils/nightly",
   "near-async/nightly",

integration-tests/src/tests/client/process_blocks.rs

@@ -2296,10 +2296,11 @@ fn test_data_reset_before_state_sync() {
     let signer = InMemorySigner::from_seed("test0".parse().unwrap(), KeyType::ED25519, "test0");
     let genesis_block = env.clients[0].chain.get_block_by_height(0).unwrap();
     let genesis_hash = *genesis_block.hash();
+    let new_account_id: AccountId = "test_account.test0".parse().unwrap();
     let tx = SignedTransaction::create_account(
         1,
         "test0".parse().unwrap(),
-        "test_account".parse().unwrap(),
+        new_account_id.clone(),
         NEAR_BASE,
         signer.public_key(),
         &signer,
@@ -2322,7 +2323,7 @@ fn test_data_reset_before_state_sync() {
             &head.prev_block_hash,
             &head.last_block_hash,
             head_block.header().epoch_id(),
-            &QueryRequest::ViewAccount { account_id: "test_account".parse().unwrap() },
+            &QueryRequest::ViewAccount { account_id: new_account_id.clone() },
         )
         .unwrap();
     assert_matches!(response.kind, QueryResponseKind::ViewAccount(_));
@@ -2336,7 +2337,7 @@ fn test_data_reset_before_state_sync() {
         &head.prev_block_hash,
         &head.last_block_hash,
         head_block.header().epoch_id(),
-        &QueryRequest::ViewAccount { account_id: "test_account".parse().unwrap() },
+        &QueryRequest::ViewAccount { account_id: new_account_id },
     );
     // TODO(#3742): ViewClient still has data in cache by current design.
     assert!(response.is_ok());

integration-tests/src/tests/client/state_dump.rs

@@ -229,7 +229,7 @@ fn run_state_sync_with_dumped_parts(
                 let tx = SignedTransaction::create_account(
                     1,
                     "test0".parse().unwrap(),
-                    "test_account".parse().unwrap(),
+                    "test_account.test0".parse().unwrap(),
                     NEAR_BASE,
                     signer.public_key(),
                     &signer,
@@ -256,7 +256,7 @@ fn run_state_sync_with_dumped_parts(
                 &head.prev_block_hash,
                 &head.last_block_hash,
                 head_block.header().epoch_id(),
-                &QueryRequest::ViewAccount { account_id: "test_account".parse().unwrap() },
+                &QueryRequest::ViewAccount { account_id: "test_account.test0".parse().unwrap() },
             )
             .unwrap();
         assert_matches!(response.kind, QueryResponseKind::ViewAccount(_));
@@ -360,7 +360,7 @@ fn run_state_sync_with_dumped_parts(
             &synced_block_tip.prev_block_hash,
             &synced_block_tip.last_block_hash,
             synced_block_header.epoch_id(),
-            &QueryRequest::ViewAccount { account_id: "test_account".parse().unwrap() },
+            &QueryRequest::ViewAccount { account_id: "test_account.test0".parse().unwrap() },
         );
 
         if is_final_block_in_new_epoch {

integration-tests/src/tests/runtime/test_evil_contracts.rs

@@ -21,16 +21,17 @@ fn setup_test_contract(wasm_binary: &[u8]) -> RuntimeNode {
     let transaction_result = node_user
         .create_account(
             account_id,
-            "test_contract".parse().unwrap(),
+            "test_contract.alice.near".parse().unwrap(),
             node.signer().public_key(),
             TESTING_INIT_BALANCE / 2,
         )
         .unwrap();
     assert_eq!(transaction_result.status, FinalExecutionStatus::SuccessValue(Vec::new()));
     assert_eq!(transaction_result.receipts_outcome.len(), 2);
 
-    let transaction_result =
-        node_user.deploy_contract("test_contract".parse().unwrap(), wasm_binary.to_vec()).unwrap();
+    let transaction_result = node_user
+        .deploy_contract("test_contract.alice.near".parse().unwrap(), wasm_binary.to_vec())
+        .unwrap();
     assert_eq!(transaction_result.status, FinalExecutionStatus::SuccessValue(Vec::new()));
     assert_eq!(transaction_result.receipts_outcome.len(), 1);
 
@@ -51,7 +52,7 @@ fn test_evil_deep_trie() {
             .user()
             .function_call(
                 "alice.near".parse().unwrap(),
-                "test_contract".parse().unwrap(),
+                "test_contract.alice.near".parse().unwrap(),
                 "insert_strings",
                 input_data.to_vec(),
                 MAX_GAS,
@@ -72,7 +73,7 @@ fn test_evil_deep_trie() {
             .user()
             .function_call(
                 "alice.near".parse().unwrap(),
-                "test_contract".parse().unwrap(),
+                "test_contract.alice.near".parse().unwrap(),
                 "delete_strings",
                 input_data.to_vec(),
                 MAX_GAS,
@@ -94,7 +95,7 @@ fn test_evil_deep_recursion() {
             .user()
             .function_call(
                 "alice.near".parse().unwrap(),
-                "test_contract".parse().unwrap(),
+                "test_contract.alice.near".parse().unwrap(),
                 "recurse",
                 n_bytes.clone(),
                 MAX_GAS,
@@ -116,7 +117,7 @@ fn test_evil_abort() {
         .user()
         .function_call(
             "alice.near".parse().unwrap(),
-            "test_contract".parse().unwrap(),
+            "test_contract.alice.near".parse().unwrap(),
             "abort_with_zero",
             vec![],
             MAX_GAS,

integration-tests/src/tests/standard_cases/mod.rs

@@ -665,6 +665,44 @@ pub fn test_create_account_failure_already_exists(node: impl Node) {
     );
 }
 
+#[cfg(feature = "protocol_feature_restrict_tla")]
+pub fn test_create_top_level_account(node: impl Node) {
+    let account_id = &node.account_id().unwrap();
+    let node_user = node.user();
+    let top_level_accounts = [
+        "0x06012c8cf97bead5deae237070f9587f8e7a266d",
+        "0x5e97870f263700f46aa00d967821199b9bc5a120",
+        "0x0000000000000000000000000000000000000000",
+        "alice",
+        "thisisaveryverylongtoplevelaccount",
+    ];
+    for (_, id) in top_level_accounts.iter().enumerate() {
+        let new_account_id = id.parse::<AccountId>().unwrap();
+        let transaction_result = node_user
+            .create_account(
+                account_id.clone(),
+                new_account_id.clone(),
+                node.signer().public_key(),
+                0,
+            )
+            .unwrap();
+        assert_eq!(
+            transaction_result.status,
+            FinalExecutionStatus::Failure(
+                ActionError {
+                    index: Some(0),
+                    kind: ActionErrorKind::CreateAccountOnlyByRegistrar {
+                        account_id: new_account_id,
+                        registrar_account_id: "registrar".parse().unwrap(),
+                        predecessor_id: account_id.clone()
+                    }
+                }
+                .into()
+            )
+        );
+    }
+}
+
 pub fn test_swap_key(node: impl Node) {
     let account_id = &node.account_id().unwrap();
     let signer2 = InMemorySigner::from_random("test".parse().unwrap(), KeyType::ED25519);

integration-tests/src/tests/standard_cases/runtime.rs

@@ -344,3 +344,10 @@ fn test_storage_read_write_costs_runtime() {
     let runtime_config = node.client.as_ref().read().unwrap().runtime_config.clone();
     test_storage_read_write_costs(node, runtime_config);
 }
+
+#[test]
+#[cfg(feature = "protocol_feature_restrict_tla")]
+fn test_create_top_level_account_runtime() {
+    let node = create_runtime_node();
+    test_create_top_level_account(node);
+}

nearcore/Cargo.toml

@@ -84,15 +84,13 @@ harness = false
 [features]
 default = ["json_rpc", "rosetta_rpc"]
 
-performance_stats = [
-  "near-performance-metrics/performance_stats",
-]
+performance_stats = ["near-performance-metrics/performance_stats"]
 c_memory_stats = ["near-performance-metrics/c_memory_stats"]
 test_features = [
   "near-client/test_features",
   "near-network/test_features",
   "near-store/test_features",
-  "near-jsonrpc/test_features"
+  "near-jsonrpc/test_features",
 ]
 expensive_tests = [
   "near-client/expensive_tests",
@@ -116,7 +114,11 @@ protocol_feature_fix_contract_loading_cost = [
   "near-vm-runner/protocol_feature_fix_contract_loading_cost",
 ]
 protocol_feature_simple_nightshade_v2 = [
-    "near-primitives/protocol_feature_simple_nightshade_v2",
+  "near-primitives/protocol_feature_simple_nightshade_v2",
+]
+protocol_feature_restrict_tla = [
+  "near-primitives/protocol_feature_restrict_tla",
+  "node-runtime/protocol_feature_restrict_tla",
 ]
 new_epoch_sync = [
   "near-client/new_epoch_sync"
@@ -127,6 +129,7 @@ nightly = [
   "nightly_protocol",
   "protocol_feature_fix_contract_loading_cost",
   "protocol_feature_fix_staking_threshold",
+  "protocol_feature_restrict_tla",
   "protocol_feature_simple_nightshade_v2",
   "serialize_all_state_changes",
   "near-async/nightly",

nearcore/src/runtime/mod.rs

@@ -1688,14 +1688,14 @@ mod test {
         );
         // test1 doubles stake and the new account stakes the same, so test2 will be kicked out.`
         let staking_transaction = stake(1, &signer, &block_producers[0], TESTING_INIT_STAKE * 2);
-        let new_account = AccountId::try_from(format!("test{}", num_nodes + 1)).unwrap();
+        let new_account: AccountId = "test.test1".parse().unwrap();
         let new_validator = create_test_signer(new_account.as_str());
         let new_signer =
             InMemorySigner::from_seed(new_account.clone(), KeyType::ED25519, new_account.as_ref());
         let create_account_transaction = SignedTransaction::create_account(
             2,
             block_producers[0].validator_id().clone(),
-            new_account,
+            new_account.clone(),
             TESTING_INIT_STAKE * 3,
             new_signer.public_key(),
             &signer,
@@ -1741,7 +1741,7 @@ mod test {
                 .iter()
                 .map(|x| (x.0.account_id().clone(), x.1))
                 .collect::<HashMap<_, _>>(),
-            vec![("test3".parse().unwrap(), false), ("test1".parse().unwrap(), false)]
+            vec![(new_account.clone(), false), ("test1".parse().unwrap(), false)]
                 .into_iter()
                 .collect::<HashMap<_, _>>()
         );
@@ -1758,7 +1758,7 @@ mod test {
             (test2_acc.amount, test2_acc.locked),
             (TESTING_INIT_BALANCE - test2_stake_amount, test2_stake_amount)
         );
-        let test3_acc = env.view_account(&"test3".parse().unwrap());
+        let test3_acc = env.view_account(&new_account);
         // Got 3 * X, staking 2 * X of them.
         assert_eq!(
             (test3_acc.amount, test3_acc.locked),

runtime/runtime/Cargo.toml

@@ -32,8 +32,13 @@ near-store.workspace = true
 near-vm-runner.workspace = true
 
 [features]
+protocol_feature_restrict_tla = [
+  "near-primitives/protocol_feature_restrict_tla",
+]
 nightly = [
   "nightly_protocol",
+  "protocol_feature_restrict_tla",
+  "protocol_feature_restrict_tla",
   "near-chain-configs/nightly",
   "near-o11y/nightly",
   "near-primitives-core/nightly",
@@ -52,10 +57,7 @@ nightly_protocol = [
 ]
 no_cpu_compatibility_checks = ["near-vm-runner/no_cpu_compatibility_checks"]
 
-no_cache = [
-  "near-vm-runner/no_cache",
-  "near-store/no_cache",
-]
+no_cache = ["near-vm-runner/no_cache", "near-store/no_cache"]
 
 sandbox = ["near-vm-runner/sandbox"]