mirror of
https://github.com/luxfi/evm.git
synced 2026-09-24 00:27:44 +00:00
zeekayandHanzo Dev
bdebad3632
Follow-up to the export-boundary re-point, closing RED's re-review MEDIUM (a finality-safety hole reachable via our own EVM-rewind→re-import restore runbook) and LOW. MEDIUM — the rewind path. A rewind / RLP re-import (SetLastAcceptedBlockDirect) can lower the accept tip BELOW the persisted EXPORT-FINAL (Quasar) height; the monotone SetLastQuasarHeight + advance-only SyncQuasarFrontier then keep it stuck high, and after the chain rebuilds past that height with a DIFFERENT canonical, `finalized` would name a block that was NEVER ⅔-certified — reported export-final to every bridge/DEX consumer. Two parts, both needed: - Belt: api_backend quasarHeight() resolves finalized/safe at min(LastQuasarHeight, LastAccepted) — finalized/safe can NEVER exceed the served accept tip, even with a stale-high durable key. - Suspenders: VM.reconcileQuasarWithAccept clears the durable quasarHeightKey + the in-mem height (eth.ResetLastQuasarHeight, bypassing the monotone guard) when the accept tip is below the export height — the ONE legal regression of the otherwise-irreversible frontier. Conservative reset to 0 (nothing export-final until the rebuilt chain re-certifies). Called on boot (against the restored accept tip — catches an offline rewind) and after admin_importChain (the live re-import). On the next boot the node re-seeds consensus' export frontier from the cleared (0) height, so the advance-only SyncQuasarFrontier yields to the rewind without touching the four shipped fixes. LOW — SetLastQuasarFinalized now PERSISTS the durable key BEFORE advancing the in-mem height, so the durable key is the source of truth: a crash between the two can only leave in-mem at/behind the durable value on boot, never ahead of it (no monotonicity dip). A persist failure does not advance. Tests: augmented TestFinalizedSafeResolveToQuasarNeverAboveIt with the belt case (seed export height ABOVE the accept tip → finalized CLAMPS to the tip — the case RED flagged as false confidence, now ENFORCED); new TestReconcileQuasarWithAccept_ClearsStaleHeightOnRewind (durable key + in-mem cleared on an accept regression) and TestSetLastQuasarFinalized_PersistsBeforeAdvancing (persist-first, no-advance-on-failure). eth suite green under -race. Co-authored-by: Hanzo Dev <[email protected]>