[KSlashh]

Audit item M16. Open against dev.

Gateway.postPeginData deducts minPeginFeeSats + amount * peginFeeRate / 10000 and reverts with FeeTooHigh when that fee is not below the peg-in amount. Neither the node nor postPeginRequest checks this up front. So a request too small for the fee went through the whole flow (answer, graphs, Peg-In-Confirm), and only the final postPeginData failed. That failure is permanent, and the BTC stays in the n-of-n Connector-0.

Before answering, a committee node now reads both fee parameters from the Gateway and refuses a request whose amount does not exceed the fee. The refusal is an invalid peg-in request: the answer job records it as rejected with a warning and does not retry. Without enough committee answers, the request expires as usual.

Review notes

• The fee is computed in u128 with the contract's formula, so an extreme amount cannot overflow on the node.
• The parameters are read at answer time. A fee change between answer and postPeginData is still caught by the existing rejection alert (M15).

Tests: the fee matches the Gateway formula, including the rounding and overflow edge cases. Node tests, workspace clippy with -D warnings and fmt pass.

The test coverage and validation notes above are from the zkm PR notes. Branch scope and diff formatting were checked locally; builds and tests were not rerun during publication.