Frontier template not using insecure_zero_ed

[valentinfernandez1]

I noticed that after the upgrade to polkadot v0.9.42 the insecure_zero_ed flag was set for several files like the pallet-evm

pallet-balances = { workspace = true, features = ["default", "insecure_zero_ed"] }

This feature was added after this version since setting ExistentialDepost = 0 might expose the chain to a DoS vector. But we must set it to insecure_zero_ed since is needed to maintain EVM compatibility.

I thought that this would also be implemented on the Frontier template but here the ExistentialDeposit is:

parameter_types! {
	pub const ExistentialDeposit: u128 = 500;
        ....
}

This is the value that was set initially when the repo was created, is there any reason we are using this value?

I think it would be beneficial to change it to use ED=0. This way we can maintain compatibility with the EVM. This could prevent some issues that appear when testing solidity smart contract if the is ED != 0. Also while discussing with someone from the Moonbeam team (which BTW uses ED=0), he told me that if the accounts gets removed because of the balance going under de ED, a risk of a replay attack could be introduced on the EVM.

If this was changed also the Cargo.toml files should include the insecure_zero_ed feature on the pallet balances. If this is not setup, every time we send a transaction to an account with 0 funds, the transaction will occur but the receiving account will remain at zero.

[valentinfernandez1]

The main thing we should consider is if having ED != 0 makes any sense on the Frontier template. I could see a scenario where you might not want to enforce this insecure_zero_ed to someone that is starting to use Frontier if they are not aware of the implications. But keeping it above 0 can cause other issues too.

[a-moreira]

If Frontier exists to enable Ethereum compatibility for the Polkadot ecosystem (which I think it does) then I think ED should be set to 0 in the template's runtime, or at least have a comment making it clear that this behavior differs from Ethereum.
Otherwise unaware users can be surprised.