mirror of
https://github.com/luxfi/evm.git
synced 2026-09-24 00:27:44 +00:00
zeekay
7e079e9ac1
Task 2 (Red H2): StrictPQTimestamp was wired from config.PQ (vm.go) but the gate was unproven inert. The canonical lux-mainnet config already sets pq:true and upgrade.json sets strictPQTimestamp=Quasar-TS; added behavioral tests proving NetworkUpgrades.IsStrictPQ activates (genesis when pq:true -> StrictPQTimestamp=0; at the timestamp on running chains; Override carries it). GUARDRAIL fix: vm.Initialize installed gethvm.AllForbidden() (=pq.Strict), which forbids the standard bn256 precompiles 0x06-0x08 — breaking Ethereum-compat dapps. Now installs the EVM-owned LuxStrictPQ() projection (pq_profile.go): every classical family forbidden EXCEPT bn256. Lux's security-critical pairing/DLOG is in CUSTOM precompiles (0x0900, 0x22 Pedersen, zkvm verifiers) + the consensus cert, each gated by the SAME profile bit (config.PQ also pins StrictPQTimestamp=0 -> RefuseUnderStrictPQ). Tests (b): IsStrictPQ true on a prod strict chain (genesis + timestamp + Override paths), false when nil. (f): LuxStrictPQ admits bn256 0x06-0x08 and still refuses every other family; differs from AllForbidden only by bn256.