From 6d4a1a3ccfb296af9d920ab5e5f1c90eaa61d2d7 Mon Sep 17 00:00:00 2001
From: leniram159 <leniram159@gmail.com>
Date: Fri, 12 Sep 2025 10:40:17 +0200
Subject: [PATCH] chore: use decode_2718_exact for recover raw txs (#18381)

---
 crates/optimism/payload/src/payload.rs  | 9 +--------
 crates/rpc/rpc-eth-types/src/utils.rs   | 9 ++++++---
 crates/transaction-pool/src/maintain.rs | 9 +++++----
 3 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/crates/optimism/payload/src/payload.rs b/crates/optimism/payload/src/payload.rs
index c84e9c70ec..388c950e0b 100644
--- a/crates/optimism/payload/src/payload.rs
+++ b/crates/optimism/payload/src/payload.rs
@@ -91,14 +91,7 @@ impl<T: Decodable2718 + Send + Sync + Debug + Unpin + 'static> PayloadBuilderAtt
             .unwrap_or_default()
             .into_iter()
             .map(|data| {
-                let mut buf = data.as_ref();
-                let tx = Decodable2718::decode_2718(&mut buf).map_err(alloy_rlp::Error::from)?;
-
-                if !buf.is_empty() {
-                    return Err(alloy_rlp::Error::UnexpectedLength);
-                }
-
-                Ok(WithEncoded::new(data, tx))
+                Decodable2718::decode_2718_exact(data.as_ref()).map(|tx| WithEncoded::new(data, tx))
             })
             .collect::<Result<_, _>>()?;
 
diff --git a/crates/rpc/rpc-eth-types/src/utils.rs b/crates/rpc/rpc-eth-types/src/utils.rs
index 33616679dd..69f9833af5 100644
--- a/crates/rpc/rpc-eth-types/src/utils.rs
+++ b/crates/rpc/rpc-eth-types/src/utils.rs
@@ -9,14 +9,17 @@ use std::future::Future;
 /// This is a helper function that returns the appropriate RPC-specific error if the input data is
 /// malformed.
 ///
-/// See [`alloy_eips::eip2718::Decodable2718::decode_2718`]
-pub fn recover_raw_transaction<T: SignedTransaction>(mut data: &[u8]) -> EthResult<Recovered<T>> {
+/// This function uses [`alloy_eips::eip2718::Decodable2718::decode_2718_exact`] to ensure
+/// that the entire input buffer is consumed and no trailing bytes are allowed.
+///
+/// See [`alloy_eips::eip2718::Decodable2718::decode_2718_exact`]
+pub fn recover_raw_transaction<T: SignedTransaction>(data: &[u8]) -> EthResult<Recovered<T>> {
     if data.is_empty() {
         return Err(EthApiError::EmptyRawTransactionData)
     }
 
     let transaction =
-        T::decode_2718(&mut data).map_err(|_| EthApiError::FailedToDecodeSignedTransaction)?;
+        T::decode_2718_exact(data).map_err(|_| EthApiError::FailedToDecodeSignedTransaction)?;
 
     SignedTransaction::try_into_recovered(transaction)
         .or(Err(EthApiError::InvalidTransactionSignature))
diff --git a/crates/transaction-pool/src/maintain.rs b/crates/transaction-pool/src/maintain.rs
index 9f48590d9d..4bebe454cd 100644
--- a/crates/transaction-pool/src/maintain.rs
+++ b/crates/transaction-pool/src/maintain.rs
@@ -628,10 +628,11 @@ where
             tx_backups
                 .into_iter()
                 .filter_map(|backup| {
-                    let tx_signed = <P::Transaction as PoolTransaction>::Consensus::decode_2718(
-                        &mut backup.rlp.as_ref(),
-                    )
-                    .ok()?;
+                    let tx_signed =
+                        <P::Transaction as PoolTransaction>::Consensus::decode_2718_exact(
+                            backup.rlp.as_ref(),
+                        )
+                        .ok()?;
                     let recovered = tx_signed.try_into_recovered().ok()?;
                     let pool_tx =
                         <P::Transaction as PoolTransaction>::try_from_consensus(recovered).ok()?;