Quasar Edition rip: there is one and only one upgrade-key namespace.
The strict decoder forces parse-time failure on any unknown field —
which catches typos and stale aliases (e.g. etnaTimestamp) at config
roll instead of silently muting forks at activation.
Why this matters: encoding/json by default ignores unknown JSON keys
and zero-initializes the corresponding struct fields. After the
EtnaTimestamp → QuasarTimestamp rename, any deployed upgrade.json
still carrying etnaTimestamp would parse cleanly with the new field
left nil, and the fork would never activate. The strict decoder
turns that silent-disable failure mode into a loud boot-time error.
Pairs with: luxfi/genesis kill-etna sweep + node v1.28.22 plugin bump.
On lux-mainnet 2026-06-02 every newly-created L2 EVM chain (hanzo, zoo,
spc, pars) panicked at chain create with:
panic in eth.New: unable to commit genesis block to statedb:
triedb parent [0x56e81f17171bcc55a6ff8345e692c0f86e5b48e01b996cadc001622fb5e363b421] layer missing
Root cause: the operator does not specify state-scheme in chain config, so
vm.ethConfig.StateScheme = "" enters eth.New. backend.go then calls
customrawdb.ParseStateSchemeExt("", chainDb) which delegates to
geth/rawdb.ParseStateScheme — upstream returns PathScheme as the implicit
default for any database with no stored scheme (every fresh L2). That
silently re-enables path mode even though vm.go's preflight at the top
of Initialize hard-refuses it. Genesis commit then runs through pathdb's
Update with parentRoot=EmptyRootHash and dies the moment the layer tree
is consulted.
Fix: extract the scheme normalisation into resolveStateScheme() and lock
the empty-string default to HashScheme here, before backend.go can inherit
geth's path-by-default. Path explicit is still refused as before, so this
is purely an operator-default fix.
Adds:
- plugin/evm/vm_statescheme_test.go: TestResolveStateScheme covering all
four input cases (empty→hash, hash passthrough, path refused, custom
passthrough).
- core/genesis_pathdb_test.go: TestGenesisCommit_PathDB_{FreshDB,
SetupGenesisBlock_FreshDB} document the upstream pathdb genesis-commit
invariant on a fresh in-memory DB so future drift here is caught
immediately.
Also bumps compatibility.json to register v0.18.4-v0.18.18 with the
existing RPC chain VM protocol (42); restores TestCompatibility (which
was failing on main since v0.18.4 because the table was never updated).
Version: v0.18.17 -> v0.18.18.
luxfi/genesis is now indirect (no direct EVM imports), but tidy pulled in
fresher minimum versions of its transitive deps:
- constants v1.5.2 -> v1.5.7
- crypto v1.19.6 -> v1.19.15
- metric v1.5.1 -> v1.5.5
- precompile v0.5.23 -> v0.5.27
- otel v1.42.0 -> v1.43.0
Plus drops StephenButtolph/canoto, fatih/structtag, grpc-prometheus from
indirect block (no longer transitively required).
No functional changes; this is purely the dependency cleanup that follows
the luxfi/genesis v1.13.8 bump.
Bug fix (closure-swarm v1.28.15 boot blocker):
PQ gate at plugin/evm/vm.go was setting vm.chainConfig.PQ BEFORE
vm.chainConfig was assigned from g.Config — chainConfig was nil at
that point, panic on dereference. Moved the gate AFTER assignment.
Repro: fresh-PVC bootstrap with chain-config.json pq:true caused
"runtime error: invalid memory address or nil pointer dereference"
in the EVM ZAP plugin → C-Chain never bootstraps. Discovered during
localnet 1337 bring-up against v1.28.15.
Fix: move the gate to AFTER `vm.chainConfig = g.Config`. PQ profile
is now correctly installed on a non-nil chainConfig.
Added:
- cmd/rlp-verify/main.go — decodes C-Chain RLP export, verifies
genesis hash matches genesis JSON, each block's ParentHash chains
cleanly. What admin.importChain does sans state execution; sufficient
proof that an RLP+genesis pair is wireable to a luxd boot.
Indirect dep bumps:
- github.com/ChainSafe/go-schnorrkel v1.1.0 (sr25519Verify precompile)
- github.com/cosmos/go-bip39 v1.0.0 (bridgeRegistrarConfig precompile)
- github.com/luxfi/ai v0.1.0 (aiMiningConfig precompile)
Build tag: drop `gpu` tag on darwin gpu_bridge.go (parallel/gpu is one
concept; the darwin gpu bridge always compiles when cgo+darwin).
The original tests called precompile.Run() directly and expected the
PQ refusal to happen inside the precompile body. That contract no
longer holds: after CR-1, every classical precompile's Run() body is
strict-PQ-agnostic — the gate lives in (*EVM).runPrecompile and reads
the per-chain Profile from ChainConfig.PQ.
This rewrite tests the two contracts the plugin layer is actually
responsible for:
1. AllForbidden() == pq.Strict() (Hash() identity check) — every
classical primitive family flagged.
2. (*Profile).RefuseUnder(op) returns the family-specific sentinel
error for every op a strict-PQ chain must refuse.
3. nil profile (the default for non-PQ chains) admits every op.
Cross-precompile integration coverage (the strict-PQ chain runs an
EVM that actually refuses ecrecover at the boundary) lives in
geth/core/vm/pq_gate_test.go — closer to the dispatch chokepoint and
not duplicated here.
Closes CR-2 from the cross-stack adversarial audit: PQ posture on
multi-chain hosts moves from a process-global to a per-chain
ChainConfig setting. A strict-PQ subnet and a permissive L1 in the
same node process now refuse / admit classical primitives correctly,
independent of which subnet last initialised.
Surface:
- NetworkUpgrades.StrictPQTimestamp *uint64 (json:"strictPQTimestamp")
nil = chain is classical-permissive (default for non-Lux integrators)
0 = strict-PQ from genesis (set by plugin/evm when config.PQ=true)
- NetworkUpgrades.IsStrictPQ(time uint64) bool — fork rule
- chainConfigAdapter.IsStrictPQ — bridges params/extras into the
contract.StrictPQReporter contract that stateful precompiles call.
- extChainConfigBridge.IsStrictPQ — type-asserts via a local
interface so non-Lux chains integrating Lux precompiles remain
classical-permissive (no contract widening forced on them).
- plugin/evm: when config.PQ=true, vm.chainConfig.PQ is installed
(covers 0x01..0x0a standard precompiles via runPrecompile gate) AND
extras.StrictPQTimestamp is set to genesis (covers Lux stateful
precompiles — KZG, Groth16, PLONK, fflonk, Halo2, BN254-Pedersen,
BabyJubJub, Pallas/Vesta — via contract.RefuseUnderStrictPQ).
Module bumps:
- github.com/luxfi/geth v1.16.91
(bundles MLDSATxType (0x42) + per-chain PQ profile gate)
- github.com/luxfi/pq v1.0.1-0.20260512064747-3d4c9414e15e
(RefuseUnder promoted to method on *Profile)
No semantic change for chains that do not opt into PQ:
StrictPQTimestamp is nil, IsStrictPQ returns false, every classical
primitive admits, gas accounting unchanged.
Config field LuxStrictPQ -> PQ (JSON key "pq", was "lux-strict-pq").
VM.Initialize now calls gethvm.SetPQProfile(gethvm.AllForbidden()) when
config.PQ is true, refusing every classical precompile family
(ecrecover, sha256/ripemd/blake2F, alt_bn128, BLS12-381, KZG) at the
EVM gate — not just ecrecover.
Test file renamed lux_strict_pq_test.go -> pq_test.go. Covers the
strict-PQ path, classical-compat path, and a cross-family refusal
matrix asserting AllForbidden() turns on every Forbid* flag.
VM.Initialize installs the chain-wide strict-PQ posture into the
go-ethereum precompile layer when Config.LuxStrictPQ is true. The
ecrecover precompile at 0x01 then returns ErrClassicalAuthForbidden
(gas is still charged per EIP-150) and never produces a recovered
address.
Default (LuxStrictPQ=false) preserves classical-compat semantics
required by legacy chains and the Lux-Permissive profile.
Mirrors the coreth wire-up; the gate itself lives in luxfi/geth
(commit 738ecc775, tag v1.16.88) and is single-implementation. Bumps
luxfi/geth pre-release v1.16.86-0.20260413… → v1.16.88 to pull in
the gate; transitive deps (luxfi/accel v1.0.7→v1.0.8, luxfi/consensus
v1.22.70→v1.22.84, luxfi/precompile v0.5.12→v0.5.14) update as
required by geth v1.16.88's own go.mod.
Tests:
TestEcrecoverStrictPQ_Forbidden — strict-PQ returns the error
TestEcrecoverClassicalCompat_Works — nil profile keeps upstream path
Adds three RPC methods under the "lux" namespace:
- lux_evmBackend: returns current active backend (gevm/revm/cevm)
- lux_evmBackends: returns all available backends + active
- lux_setEvmBackend: switches backend at runtime (admin-only)
- block_builder.go: drain buffered tx events, build blocks until pool empty
- vm.go: force CancunTime=0 if nil during genesis init
- go.mod: replace github.com/luxfi/geth with local patched fork (65k MaxCodeSize)
- sync/client: hardcode 65536 code size limit
Note: Cancun opcodes (MCOPY, TSTORE) still not activating at runtime.
The genesis parsing path may not reach the force-enable code.
Needs investigation of the ZAP plugin's genesis flow.
- admin_api.go: add afterCommit callback to importBlocksFromFile so
acceptedBlockDB is updated atomically with each state commit,
eliminating the crash window between state persist and DB update
- admin_api.go: resume import from current head (skip already-imported
blocks) for restart-safety after partial imports
- vm.go: simplify readLastAccepted to return genesis on ErrNotFound
without recovery hacks
- consensus.go: simplify Cancun/beacon validation — Lux networks do
not use Ethereum beacon chain; only reject non-zero BlobGasUsed
- blockchain.go: chunked batch deletes in reorg to avoid BadgerDB
ErrTxnTooBig on large chains
- blockchain.go: tolerate "not supported" from snapshot flatten
(pathdb backend) instead of log.Crit crash
- genesis.go: fix duplicate comment
When enable-automining is set in config (dev mode), skip the empty block
validation to allow anvil-like behavior with instant block production
even when there are no pending transactions.
This fixes the infinite loop error when running luxd --dev:
"syntactic block verification failed: empty block"
Updates dependencies:
- github.com/luxfi/vm v1.0.22 → v1.0.23 (adds ZAP transport Serve)
- github.com/luxfi/log v1.3.0 → v1.4.1 (fixes module path declaration)
- github.com/luxfi/consensus v1.22.53 → v1.22.56
- github.com/luxfi/crypto v1.17.39 → v1.17.40
- github.com/luxfi/database v1.17.38 → v1.17.39
- github.com/luxfi/geth v1.16.69 → v1.16.73
- github.com/luxfi/p2p v1.18.7 → v1.18.8
- github.com/luxfi/warp v1.18.4 → v1.18.5
The vm package now provides a ZAP-based Serve function by default,
eliminating the need for the grpc build tag for VM plugins.
Also includes various improvements to validators, warp service,
and precompile interfaces.
The needToBuild() function was using a MinTip filter that rejected
all pending legacy transactions without GasTipCap set, causing block
production to stall at height 0.
Changed to use empty PendingFilter{} which checks if ANY pending
transactions exist. The miner applies proper fee filters when
building blocks anyway.
- Enable FHE precompile from standalone precompiles package
- Rename luxRulesHook to precompileHook for clarity
- DEX precompiles to be imported from standalone precompiles package
- Clean up debug logging from vm.go
The FHE precompile uses pure Go TFHE implementation from
github.com/luxfi/fhe for on-chain homomorphic encryption.
- Call versiondb.Sync() after Commit() in admin.ImportChain
- Ensures imported blocks persist across network restarts
- Critical for admin_importChain when using badgerdb with async writes
- Update database to v1.2.17 with Syncer interface
- Add AdminAPI struct for geth RPC server registration
- Enable admin_importChain alongside admin.importChain (dot notation)
- Register admin API with geth RPC handler for underscore-style calls
- Supports importing RLP chain data via JSON-RPC
- Remove luxWarp alias, use warp package directly
- Remove AppSender indirection, use p2p.Sender directly
- Update warptypes alias where local warp package conflicts
- Update node to v1.22.43, warp to v1.16.39
- Rename plugin/evm/upgrade/subnetevm package to feewindow
- Rename SubnetEVMTimestamp to EVMTimestamp (JSON: evmTimestamp)
- Rename IsSubnetEVM method to IsEVM
- Rename SubnetEVMDefaultChainConfig to EVMDefaultChainConfig
- Rename TestSubnetEVMChainConfig to TestEVMChainConfig
- Rename TestPreSubnetEVMChainConfig to TestPreEVMChainConfig
- Rename ethclient/subnetevmclient to ethclient/evmclient
- Update VM factory ID from "subnetevm" to "evm"
- Remove all backward compatibility aliases
- Update all documentation and comments
Breaking change: This removes all SubnetEVM naming - only "EVM" is supported.
No backward compatibility maintained as per user requirement.
The hasAllBlocks check was skipping InsertChain entirely when blocks
existed in the database. This prevented full transaction re-execution
and state regeneration. InsertChain already handles ErrKnownBlock
properly and still re-executes transactions.
Also removes unused hasAllBlocks function from plugin/evm/admin.go.
zeekay