mirror of
https://github.com/luxfi/evm.git
synced 2026-09-24 00:27:44 +00:00
The two-tier consensus (v1.36) advances VM.Accept at a BARE MAJORITY (Nova), which is reorgable and can fork under f=1 equivocation. The Ethereum `finalized`/`safe` tags and warp cross-chain exports were still reading the accept tip — the "semantic collapse" the split exists to prevent. Re-point every EXPORT surface onto the export-final (Quasar, ⅔-by-stake) frontier consensus already exposes. #1 CRITICAL — eth `finalized`/`safe` tags: - eth.Ethereum gains a DURABLE, monotone lastQuasarHeight (SetLastQuasarHeight/LastQuasarHeight), pushed by consensus strictly AFTER accept. The plugin VM's SetLastQuasarFinalized persists it to acceptedBlockDB and reloads it on boot (readLastQuasarHeight), so the export surface never regresses on restart. - api_backend HeaderByNumber/BlockByNumber resolve Finalized(-3)/Safe(-4) to GetBlockByNumber( LastQuasarHeight) BEFORE the IsAccepted() catch-all — NEVER a block above the Quasar height. `latest`/`pending` stay on the accept tip (correct — not finality tags). - Test: TestFinalizedSafeResolveToQuasarNeverAboveIt proves finalized == the Quasar height, monotone, and never above the accepted tip. #2 HIGH — warp cross-chain export double-spend: - warp.verifyBlockMessage now requires the block be EXPORT-final (height ≤ BlockClient. LastQuasarHeight), so a validator signs a block hash only at Quasar finality, never on a reorgable Nova accept (two conflicting Nova forks could otherwise each aggregate a valid export). - WarpQuorumNumeratorMinimum floored 33 → 67 (⅔): any warp message needs ≥⅔ stake to verify, so at most one of two conflicting exports can validate (two ⅔ sets intersect on >⅓ honest stake) — restoring the ⅔-accept safety the pre-split accept tier gave for free. The consensus engine pushes the frontier via NetworkConfig.QuasarObserver; the node bridges it into the VM (separate node commit). Nova-only chains (no export surface) are unaffected. Co-authored-by: Hanzo Dev <[email protected]>