ckETH’s Maintenance Week: Recovery Paths, Safer Decoding, and Visible Funding

The most consequential Chain Fusion work in dfinity/ic this week was operational rather than expansive: four feature commits tightened how ckETH handles deposits, sweep transactions, funding, and ledger storage.

The clearest user-facing change is support for plain ETH sent to delegated deposit addresses. The new CkSweeperAttested delegate accepts payable transfers and adds attestation-gated sweepEth and sweepEthBatch entry points. Those methods forward the balance through the Ethereum helper’s depositEth path, turning a previously unrecoverable wrong-asset transfer into a recoverable deposit flow. The implementation also guards the delegate’s implementation address, where ETH could not be recovered through attestation.

That change matters because ckETH deposits normally use the shared Ethereum helper contract, which emits deposit events that the minter observes before minting ckETH to an ICP account. The official developer guide still advises builders to verify the helper address through get_minter_info before constructing a deposit transaction.

A second ckETH commit removes a hand-written EIP-7702 decoder and routes replay decoding through Alloy’s TxEnvelope::decode_2718. More importantly, it adds an independent check that compares the payload to sign, the broadcast payload, and the transaction hash. This reduces the amount of bespoke transaction parsing in the minter while strengthening the verification path around delegated-account sweep transactions.

The week’s observability commit addresses a different failure mode: a sweeper can stop receiving gas, and a stuck funding operation can starve later sweeps without an obvious external symptom. New metrics expose burned ckETH, ETH spent, finalized funding outcomes, the amount burned but not yet spent, gas balance, configured thresholds, and the age of any in-flight funding. A dashboard section also identifies sweeper funding inside the withdrawal view, so an operator can distinguish it from an ordinary user withdrawal.

Finally, the ledger-suite orchestrator now sets the archive trigger threshold for newly installed ledger suites to 4_200_000_000, effectively preventing an archive canister from being spawned. The commit describes this as a stopgap until minters can safely process blocks moved to an archive. It therefore trades automatic archival behavior for a simpler block-storage surface while the downstream compatibility issue is addressed.

Taken together, the four changes describe a mature Chain Fusion priority: protect the path between an Ethereum transaction and an ICP ledger from silent loss, ambiguous parsing, invisible funding stalls, and storage behavior that dependent minters are not yet ready to consume. Caveat: These commits verify that the changes landed in the public source repository, but the reviewed sources do not establish that every change has already been deployed to production.