token-price-oracle/config/config.go (1)

88-91: Consider validating that GasFeeCap >= GasTipCap when both are set.

EIP-1559 requires gasFeeCap >= gasTipCap. When both fixed values are provided, an invalid combination (e.g., GasTipCap > GasFeeCap) would produce a transaction that gets rejected at submission time with a potentially confusing error. A quick check in LoadConfig would surface this early.

Suggested validation in LoadConfig (after line 120)

// Add after loading GasFeeCap and GasTipCap (around line 121)
if cfg.GasFeeCap > 0 && cfg.GasTipCap > 0 && cfg.GasTipCap > cfg.GasFeeCap {
    return nil, fmt.Errorf("gas tip cap (%d) must not exceed gas fee cap (%d)", cfg.GasTipCap, cfg.GasFeeCap)
}

token-price-oracle/client/l2_client.go (2)

156-162: Shared *big.Int reference assigned to opts — callers could inadvertently mutate internal state.

c.gasFeeCap is assigned directly to opts.GasFeeCap without copying. If any downstream code (e.g., the bind package or gas estimation) mutates the *big.Int in-place, it would corrupt the fixed cap for all subsequent transactions. This is a defensive concern given current callers don't appear to mutate, but worth protecting.

Suggested defensive copy

 	if c.gasFeeCap != nil {
-		opts.GasFeeCap = c.gasFeeCap
+		opts.GasFeeCap = new(big.Int).Set(c.gasFeeCap)
 	}
 	if c.gasTipCap != nil {
-		opts.GasTipCap = c.gasTipCap
+		opts.GasTipCap = new(big.Int).Set(c.gasTipCap)
 	}

---

190-199: Same shared-pointer concern applies to the accessors.

GetFixedGasFeeCap() and GetFixedGasTipCap() return the internal *big.Int directly. If sign.go (or a future caller) mutates the returned value, it corrupts the L2Client's state. Returning a copy would be safer.

Suggested defensive copy

 func (c *L2Client) GetFixedGasFeeCap() *big.Int {
+	if c.gasFeeCap == nil {
+		return nil
+	}
-	return c.gasFeeCap
+	return new(big.Int).Set(c.gasFeeCap)
 }

 func (c *L2Client) GetFixedGasTipCap() *big.Int {
+	if c.gasTipCap == nil {
+		return nil
+	}
-	return c.gasTipCap
+	return new(big.Int).Set(c.gasTipCap)
 }

token-price-oracle/client/sign.go (1)

104-108: Potential aliasing with internal client state in gas cap assignments.

The GetFixedGasTipCap() and GetFixedGasFeeCap() methods return direct references to the client's internal *big.Int fields (gasTipCap and gasFeeCap). This creates aliasing when assigned via tip = maxTip (line 104) and gasFeeCap = maxFeeCap (line 131), where local variables reference the client's state.

While the current code only reads these variables after assignment (no in-place mutations), this pattern is fragile and may lead to subtle bugs if future changes add arithmetic operations on tip or gasFeeCap after these assignments.

Use defensive copies to prevent aliasing:

Line 104

 	if maxTip := client.GetFixedGasTipCap(); maxTip != nil {
 		if tip.Cmp(maxTip) > 0 {
 			log.Debug("Applying gas tip cap limit", "dynamic", tip, "cap", maxTip)
-			tip = maxTip
+			tip = new(big.Int).Set(maxTip)
 		}

Line 131

 	if maxFeeCap := client.GetFixedGasFeeCap(); maxFeeCap != nil {
 		if gasFeeCap.Cmp(maxFeeCap) > 0 {
 			log.Debug("Applying gas fee cap limit", "dynamic", gasFeeCap, "cap", maxFeeCap)
-			gasFeeCap = maxFeeCap
+			gasFeeCap = new(big.Int).Set(maxFeeCap)
 		}

token-price-oracle/client/l2_client.go (1)

183-191: Accessors return internal *big.Int — callers can mutate shared state.

GetMaxGasFeeCap() and GetMaxGasTipCap() return the internal pointer directly. Any caller that performs in-place operations (e.g., result.Mul(...)) would silently corrupt L2Client's state. tx_manager.go copies before use, but sign.go does not (see separate comment there). A defensive copy here would eliminate the class of bugs entirely.

♻️ Suggested defensive copy

 // GetMaxGasFeeCap returns the max gas fee cap (nil if not configured)
 func (c *L2Client) GetMaxGasFeeCap() *big.Int {
+	if c.gasFeeCap == nil {
+		return nil
+	}
-	return c.gasFeeCap
+	return new(big.Int).Set(c.gasFeeCap)
 }

 // GetMaxGasTipCap returns the max gas tip cap (nil if not configured)
 func (c *L2Client) GetMaxGasTipCap() *big.Int {
+	if c.gasTipCap == nil {
+		return nil
+	}
-	return c.gasTipCap
+	return new(big.Int).Set(c.gasTipCap)
 }

token-price-oracle/client/sign.go (1)

85-172: Gas cap logic is duplicated between CreateAndSignTx and TxManager.applyGasCaps.

The tip-fetch → clamp → header-fetch → feeCap-compute → clamp sequence is nearly identical in both sign.go:CreateAndSignTx (lines 99-134) and tx_manager.go:applyGasCaps (lines 204-251). This duplication means any fix (e.g., the gasTipCap ≤ gasFeeCap invariant) must be applied in two places. Consider extracting a shared helper, e.g., computeGasCaps(ctx, client) (tip, feeCap *big.Int, err error), and calling it from both paths.