Bug Description
In rpc/backend/backend.go, NewBackend() converts EVMChainID (uint64) to int64 unsafely:
EvmChainID: big.NewInt(int64(appConf.EVM.EVMChainID)),
When EVMChainID > math.MaxInt64 (9223372036854775807), the uint64 wraps to a negative int64, creating a negative big.Int chain ID.
Impact
- All EIP-155 transaction signature verification fails with a negative chain ID
- Potential replay attacks if different chains end up with colliding (wrapped) chain IDs
- The config field
EVMChainID is typed as uint64, so values > MaxInt64 are valid configuration
Proposed Fix
Replace big.NewInt(int64(...)) with the safe SetUint64 method:
EvmChainID: new(big.Int).SetUint64(appConf.EVM.EVMChainID),
One-line fix, zero behavioral change for chain IDs within int64 range.