PCL Policy Enforcement
How PCL validates transactions at the protocol level for both Cosmos and EVM messages.
PCL enforcement is the process by which active policies are checked against incoming transactions. This mechanism is deeply integrated into Maroo's transaction lifecycle, operating via an Ante Handler for global rules and EVM hooks for contract-specific rules, ensuring that no transaction can bypass the configured compliance checks.
Ante Handler Integration
The primary enforcement point for global policies is the
PclAnteDecorator. This is a piece of middleware that runs for every transaction submitted to a Maroo node. Before the transaction is passed to the relevant module (e.g., x/bank), the PclAnteDecorator calls pclKeeper.GlobalPolicyValidate. This function fetches the GlobalPolicyConfig, iterates through each UnitPolicy, and executes its validation logic. If any policy check fails, the decorator returns an error, and the entire transaction is rejected immediately.EVM Hooks
For transactions targeting the EVM, PCL enforcement happens in two stages. First, the transaction goes through the
PclAnteDecorator like any other, so global policies are checked. Second, if the Ante check passes, the Maroo EVM module invokes a pre-execution hook. This hook calls pclKeeper.GlobalPolicyValidateOnEVM and pclKeeper.ContractPolicyValidateOnEVM. These functions perform the same validation but are tailored for EVM-specific data types (like common.Address and *big.Int). This ensures that even internal calls between contracts could theoretically be subject to PCL rules if the EVM were configured to do so, and it provides the mechanism for contract-specific policy enforcement.The Validation Process
The core validation logic resides in the
policy_validator.go file. The validate function receives the policies and the transaction messages. It then uses a switch statement to delegate to a specific validation function based on the policy type (e.g., validateDenylistPolicy, validateEasPolicy). These functions contain the actual business logic, such as checking a sender's address against a list or making a read-only call to an EAS contract to verify an attestation.Error Handling
When a policy is violated, the PCL returns a specific, structured error. For example, if a sender is on a denylist, the validator returns an
ErrorInDenylist. If a transfer exceeds a volume limit, it returns ErrorVolumeAboveMaxLimit. These detailed errors are crucial for developers and users to understand why a transaction failed, rather than receiving a generic "transaction failed" message.