fix: bump cosmos/evm fork to v0.6.2-august-2026-hotfix-xrplevm.2

[AdriaCarrera]

Bumps the cosmos/evm fork pin to v0.6.2-august-2026-hotfix-xrplevm.2, which carries the port of cosmos/evm#1107 (xrplevm/evm-ghsa-aug-2026#1).

Target for the v10.2.1 release.

Why

The bug this picks up is currently being triggered on mainnet. Ripple reported a recurring alert on the mainnet RPC endpoint (chainId 1440000); these blocks return, permanently:

failed to get rpc block from comet block: failed to get receipts from comet block:
failed to convert tx result to eth receipt: invalid message index: 0

Affected so far: 7702162, 7702575, 7702970, 7703783, 7704455, 7704803, 7704933 — all carrying the same failing tx, which sends non-zero native value to the erc20 module account.

An EVM tx that moves a non-zero native amount to a module account is rejected at stateDB.Commit(), so the Cosmos tx fails with code: 4 and, having failed at commit, carries no response payload (data: null). The RPC layer still admitted that class of tx into the Ethereum view of the block, then tried to decode logs out of the empty payload — invalid message index: 0. That error is fatal for the whole block, so every block-level RPC method at that height fails permanently on an unpatched node, breaking indexers, explorers, subgraphs and bridges.

Read-path only: no state migration, no resync, no consensus impact. Safe to roll out to RPC/full nodes without validator coordination.

The change

go.mod (the replace directive) and the two corresponding go.sum lines. No code changes.

-github.com/cosmos/evm => github.com/xrplevm/evm-ghsa-aug-2026 v0.6.2-august-2026-hotfix-xrplevm.1
+github.com/cosmos/evm => github.com/xrplevm/evm-ghsa-aug-2026 v0.6.2-august-2026-hotfix-xrplevm.2

Verification

Confirmed the tag actually contains the fix rather than trusting the name — in the resolved module under GOMODCACHE:

• TxSucessOrExpectedFailure is now res.Code == 0 || TxExceedBlockGasLimit(res), with the TxStateDBCommitError clause gone.
• No StateDBCommitError references remain in rpc/ or indexer/ outside tests.
• The regression test (anchored to the literal CometBFT log from the real failing tx) ships with it.

go build ./... is clean and go mod tidy is a no-op. Test suite left to CI.

After this merges

Cut v10.2.1 and deploy to the mainnet RPC/full nodes. Note the public testnet RPC (rpc.testnet.xrplevm.org) is still on v11.1.0 and also unpatched — only the full-history node got v11.1.1.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 04fb22cf-9dbf-408b-b64f-d4f23c68e35c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}