Two-tier finality (Nova = local majority accept, drives VM.Accept; Quasar =
⅔-by-stake export) requires that NO export surface ever names a block above the
served accept tip. RED's final pass approved SHIP with three LOW items to close
first.
LOW-1 — DRY the accept-tip clamp into ONE place. New eth.Ethereum.ClampedQuasarHeight()
= min(LastQuasarHeight, LastAccepted.Number) is the single clamp; BOTH export
surfaces read it: EthAPIBackend.quasarHeight() (RPC finalized/safe) and
warpBlockClient.LastQuasarHeight() (warp export gate, via the BlockClient
interface). Removes the second inlined clamp copy that could drift. LastQuasarHeight()
is documented as RAW (node boot re-seed only, where reconcile has already run).
LOW-2 — exactly ONE admin_importChain. Deleted the eth-package AdminAPI.ImportChain
(which neither reconciled the export height nor skipped <=head blocks); the plugin VM's
(plugin/evm/admin_api.go) is the sole one — it runs under vmLock and calls
reconcileQuasarWithAccept after each SetLastAcceptedBlockDirect. Left a NOTE so it is
not re-added and reopens the rewind hole. Dropped the now-unused rlp import.
LOW-3 — exclude concurrent export-height writers + prove the real boot wiring.
SetLastQuasarFinalized now takes vmLock (the same lock reconcileQuasarWithAccept's
admin_importChain caller holds), so the observer callback's durable Put+Store can never
interleave with a re-import's Reset(0)+Delete on the same key. Fixed a boot ordering
gap: the startup auto-import (importBlocksFromFile) runs AFTER initializeChain's
reconcile, so a --import-chain-data rewind could leave a stale export height — added a
reconcile right after the auto-import. New eth.NewTestEthereum test-support ctor.
Tests (all green): eth -race adds TestClampedQuasarHeight_RealRewind (genuine
SetLastAcceptedBlockDirect rewind; belt clamps finalized/safe to the rewound tip while
raw is unchanged); plugin/evm adds TestBootReconcile_RealLastAccepted_ClearsStaleQuasarOnRewind
(drives the REAL restored LastAcceptedBlock through belt + suspenders) and
TestSetLastQuasarFinalized_LockedAgainstReconcile (concurrency: durable key <-> in-mem
always consistent). gofmt/vet/ontology clean.
Co-authored-by: Hanzo Dev <[email protected]>
Follow-up to the export-boundary re-point, closing RED's re-review MEDIUM (a finality-safety hole
reachable via our own EVM-rewind→re-import restore runbook) and LOW.
MEDIUM — the rewind path. A rewind / RLP re-import (SetLastAcceptedBlockDirect) can lower the accept
tip BELOW the persisted EXPORT-FINAL (Quasar) height; the monotone SetLastQuasarHeight + advance-only
SyncQuasarFrontier then keep it stuck high, and after the chain rebuilds past that height with a
DIFFERENT canonical, `finalized` would name a block that was NEVER ⅔-certified — reported export-final
to every bridge/DEX consumer. Two parts, both needed:
- Belt: api_backend quasarHeight() resolves finalized/safe at min(LastQuasarHeight, LastAccepted) —
finalized/safe can NEVER exceed the served accept tip, even with a stale-high durable key.
- Suspenders: VM.reconcileQuasarWithAccept clears the durable quasarHeightKey + the in-mem height
(eth.ResetLastQuasarHeight, bypassing the monotone guard) when the accept tip is below the export
height — the ONE legal regression of the otherwise-irreversible frontier. Conservative reset to 0
(nothing export-final until the rebuilt chain re-certifies). Called on boot (against the restored
accept tip — catches an offline rewind) and after admin_importChain (the live re-import). On the
next boot the node re-seeds consensus' export frontier from the cleared (0) height, so the
advance-only SyncQuasarFrontier yields to the rewind without touching the four shipped fixes.
LOW — SetLastQuasarFinalized now PERSISTS the durable key BEFORE advancing the in-mem height, so the
durable key is the source of truth: a crash between the two can only leave in-mem at/behind the
durable value on boot, never ahead of it (no monotonicity dip). A persist failure does not advance.
Tests: augmented TestFinalizedSafeResolveToQuasarNeverAboveIt with the belt case (seed export height
ABOVE the accept tip → finalized CLAMPS to the tip — the case RED flagged as false confidence, now
ENFORCED); new TestReconcileQuasarWithAccept_ClearsStaleHeightOnRewind (durable key + in-mem cleared
on an accept regression) and TestSetLastQuasarFinalized_PersistsBeforeAdvancing (persist-first,
no-advance-on-failure). eth suite green under -race.
Co-authored-by: Hanzo Dev <[email protected]>
The two-tier consensus (v1.36) advances VM.Accept at a BARE MAJORITY (Nova), which is reorgable
and can fork under f=1 equivocation. The Ethereum `finalized`/`safe` tags and warp cross-chain
exports were still reading the accept tip — the "semantic collapse" the split exists to prevent.
Re-point every EXPORT surface onto the export-final (Quasar, ⅔-by-stake) frontier consensus
already exposes.
#1 CRITICAL — eth `finalized`/`safe` tags:
- eth.Ethereum gains a DURABLE, monotone lastQuasarHeight (SetLastQuasarHeight/LastQuasarHeight),
pushed by consensus strictly AFTER accept. The plugin VM's SetLastQuasarFinalized persists it to
acceptedBlockDB and reloads it on boot (readLastQuasarHeight), so the export surface never
regresses on restart.
- api_backend HeaderByNumber/BlockByNumber resolve Finalized(-3)/Safe(-4) to GetBlockByNumber(
LastQuasarHeight) BEFORE the IsAccepted() catch-all — NEVER a block above the Quasar height.
`latest`/`pending` stay on the accept tip (correct — not finality tags).
- Test: TestFinalizedSafeResolveToQuasarNeverAboveIt proves finalized == the Quasar height,
monotone, and never above the accepted tip.
#2 HIGH — warp cross-chain export double-spend:
- warp.verifyBlockMessage now requires the block be EXPORT-final (height ≤ BlockClient.
LastQuasarHeight), so a validator signs a block hash only at Quasar finality, never on a
reorgable Nova accept (two conflicting Nova forks could otherwise each aggregate a valid export).
- WarpQuorumNumeratorMinimum floored 33 → 67 (⅔): any warp message needs ≥⅔ stake to verify, so at
most one of two conflicting exports can validate (two ⅔ sets intersect on >⅓ honest stake) —
restoring the ⅔-accept safety the pre-split accept tier gave for free.
The consensus engine pushes the frontier via NetworkConfig.QuasarObserver; the node bridges it into
the VM (separate node commit). Nova-only chains (no export surface) are unaffected.
Co-authored-by: Hanzo Dev <[email protected]>
The 0x9999 DEX value path is identity-gated: the asset resolver refuses to
admit a market unless the running chain's identity matches. core.NewBlockChain
re-executes accepted blocks during construction (loadLastState recovery /
populateMissingTries backfill), but the identity was only bound onto the chain
AFTER eth.New returned (vm.go SetConsensusContext) — so an unclean restart after
a 0x9999 swap re-executed that block with networkID 0 / C-Chain Empty, reverted
the committed swap, failed ValidateState, and the node could not boot.
Fix is purely timing: hand NewBlockChain the *runtime.Runtime the VM already
holds (eth.Settings.ChainRuntime -> core.NewBlockChain) and bind the consensus
context BEFORE reprocess. No new identity type — networkID/chainID already live
on runtime.Runtime; the context is just the last-mile transport to geth's
ConsensusContext API. stdlib runtime aliased stdruntime in blockchain.go.
- Rename plugin/evm/upgrade/subnetevm package to feewindow
- Rename SubnetEVMTimestamp to EVMTimestamp (JSON: evmTimestamp)
- Rename IsSubnetEVM method to IsEVM
- Rename SubnetEVMDefaultChainConfig to EVMDefaultChainConfig
- Rename TestSubnetEVMChainConfig to TestEVMChainConfig
- Rename TestPreSubnetEVMChainConfig to TestPreEVMChainConfig
- Rename ethclient/subnetevmclient to ethclient/evmclient
- Update VM factory ID from "subnetevm" to "evm"
- Remove all backward compatibility aliases
- Update all documentation and comments
Breaking change: This removes all SubnetEVM naming - only "EVM" is supported.
No backward compatibility maintained as per user requirement.
- Change Go version from 1.24.6 to 1.22.8 (stable version)
- Ensure all build scripts have executable permissions
- Fix covdata issue by using stable Go version
- CI should now pass all checks
- Updated go:generate comments to use luxfi/geth instead of ethereum/go-ethereum
- Fixed GitHub issue/PR references to point to luxfi repositories
- Updated comments referencing the Lux geth fork
- Part of the migration to unified EVM architecture with Lux consensus
- Update imports from luxdefi/node to luxfi/node
- Replace libevm interfaces with direct go-ethereum imports
- Add placeholder interface files for missing dependencies
- Update go.mod to use local luxfi/node path
- Fix merge conflicts in multiple files
- Create stub implementations for missing packages
This allows the project structure to align with v0.7.5 requirements
but the build still needs additional work to be fully functional.
Updated all copyright headers from "Lux Partners Limited" to "Lux Industries Inc" and updated the year to 2025 to reflect the new holding company structure.
Complete the transition of `core/types` to upstream code.
Note that the previous commit results in _all_ upstream types / vars / consts being in the `imports.go` file. This results in a strict partition of upstream and local identifiers so it is safe to simply change import paths.
1. Globally change all imports from `subnet-evm/core/types` to `libevm/core/types`;
2. Rename all `subnet-evm/core/types` imports to `customtypes` for ease of review here;
3. Dot import `libevm/core/types` in tests only to avoid hundreds of noisy changes.
See original PR https://github.com/ava-labs/coreth/pull/875
- default behavior for pruning mode to reject blocks before the 32 blocks preceding the last accepted block
- default behavior for archive mode to reject blocks before ~24h worth of blocks preceding the last accepted block
- archive mode new option `historical-proof-query-window` to customize the blocks window, or set it to 0 to accept any block number
See https://github.com/ava-labs/coreth/pull/719
* use less blocks to gen
* avoid relying on rand.Seed for deterministic results (#535)
* disable blobpool (#536)
* add matrix and race to UTs (#530)
* add matrix and race to UTs
* remove unnecessary runners
* clean script
* lazy read bonus blocks
* increase timeout
* increase frequency
* apply fix fow windows
* increase timeout
* disable fail fast
* increase frequency and timeout
* use latest
* fix coma
* better log
* fix require
* Fix formatting
* fix eventually formats
* test out new wg
* Revert "test out new wg"
This reverts commit 5d4a0a8a17bf78751163e948a6a65dd241b057aa.
* check tx indexes after each block accept
* mark as flaky
* disable blobpool
* add IsSubscribed for testing
* remove subscribed when return
* use atomic bool
* attempt to fix flaky indexing test
* use matrix for UTs
* return if sub nil
* add beacon root checks
* fix test
* return if sub nil
---------
Co-authored-by: Darioush Jalali <[email protected]>
zeekayandHanzo Dev