The primary-network chains answer to either case; one spelling beats two.
/v1/chain/c/rpc, /v1/chain/p, /v1/chain/x across the estate.
Co-authored-by: Hanzo Dev <[email protected]>
luxd serves chain APIs under one segment from constants.ChainAliasPrefix
(constants v1.6.4, node v1.36.181):
/v1/bc/<alias>/... -> /v1/chain/<alias>/...
/ext/bc/<alias>/... -> /v1/chain/<alias>/...
Observations keep their original addresses: a dated note or a recorded status
code is a fact about when it was written, not an instruction to follow.
LP-4835 now specifies 0x012220, so the STARK-FRI slot is allocated
rather than a placeholder, and 0x012205 next door verifies the P3Q
threshold-signature family. The 0x999x constants were labelled with LP
numbers that were never issued; only LP-9999 exists, and its address
table specifies the family.
Both sides carried work. Ours is the security pass: the stableswap amp=0
and empty-pool halts, the wei-per-swap leak, uint256 truncation in math,
three verifiers that returned a verdict without verifying, the cgo/non-cgo
consensus split in cggmp21, and the starkfri soundness floor. Theirs is
the fhe parameter set, the mldsa crafted-length refusal, and the naming
sweep.
Resolved per hunk rather than by side. Where both fixed one defect the
better fix survives alone, never two guards for one bug.
The D-Chain, hook and market surfaces had behaviour no test observed. e2e/clob
moves to the module versions this repo builds against. LLM.md records the two
orthogonal calldata bounds — Cursor for how many bytes, Unsigned/Signed for
which values — and why hand-writing either is the bug they exist to close.
Corona is a Module-LWE threshold signature (Ringtail/Raccoon line,
ePrint 2024/1113; module dims M=8, N=7 over Z_q[X]/(X^256+1), rank>1).
Pulsar is Module-LWE (FIPS-204 ML-DSA). Neither is Ring-LWE; the "M"
in ML-KEM/ML-DSA is Module.
Fixes the 0x012206 slot-map comments (p3q, magnetar, starkfri,
modules/registerer), the Corona precompile doc comments, the registry
CORONA description string, and the README/LLM/corona-README docs.
Comments, strings, and docs only — no identifier, precompile address,
selector, gas value, or on-chain digest changed.
Corona is a Module-LWE threshold signature (Ringtail/Raccoon line,
ePrint 2024/1113; module dims M=8, N=7 over Z_q[X]/(X^256+1), rank>1).
Pulsar is Module-LWE (FIPS-204 ML-DSA). Neither is Ring-LWE; the "M"
in ML-KEM/ML-DSA is Module.
Fixes the 0x012206 slot-map comments (p3q, magnetar, starkfri,
modules/registerer), the Corona precompile doc comments, the registry
CORONA description string, and the README/LLM/corona-README docs.
Comments, strings, and docs only — no identifier, precompile address,
selector, gas value, or on-chain digest changed.
Follow-up to the main rename: caught README/PRIMER/LLM/MDX/Sol that survived
the first pass. Live source greps clean now (audit output:
/private/tmp/.../tasks/bs3iodq61.output → only build artifacts +
vendor/ + binaries remain, which auto-regenerate).
SLH-DSA (FIPS 205) is hash-based: WOTS+ one-time signatures, FORS few-time
trees, hypertree Merkle authentication. There is no NTT, no module-lattice
math, and no relationship to Dilithium other than both being PQ schemes.
The verifySLHDSAGPU path called lattice.DilithiumVerify(msg, sig, pk) on
the SLH-DSA inputs and returned that boolean to the caller. On every node
with a GPU backend this silently replaced the SLH-DSA verifier with the
Dilithium verifier — a different algorithm checking different invariants
against the same bytes. The 'verify' result was effectively meaningless;
the precompile became a forgery/oracle hazard the moment accel was wired.
CPU fallback (luxfi/crypto/slhdsa.PublicKey.VerifySignatureCtx) was only
reached when GPU was unavailable, so the bug never surfaced on dev boxes
without GPU.
Fix: rip the GPU path entirely. SLH-DSA goes CPU-only until accel ships a
real SLH-DSA WOTS+/FORS/Merkle kernel. CPU verifier is constant-time and
FIPS 205 compliant.
LLM.md updated to document the removal and the underlying mismatch.
* precompile: pulsar threshold ML-DSA at LP-4200 0x012204
Adds the Pulsar precompile slot for threshold ML-DSA verification.
Pulsar's wire format is byte-equal to FIPS 204 ML-DSA (Class N1
manifesto), so the verification op dispatches to luxfi/crypto/mldsa
under a Pulsar-specific domain-separation context.
- Address: 0x0000000000000000000000000000000000012204 (LP-4200 unified
PQCrypto block; companion to ML-KEM 0x012201, ML-DSA 0x012202,
SLH-DSA 0x012203).
- Three modes: Pulsar-44 / Pulsar-65 / Pulsar-87 mirroring ML-DSA
Categories 2 / 3 / 5. Production target is Pulsar-65.
- Gas: per-mode base + 10/byte (matches ML-DSA precompile tier).
- Context: lux-evm-precompile-pulsar-v1 to keep on-chain transcripts
unambiguous vs. single-party ML-DSA at 0x012202.
Tests: 5 passing (address pin, gas table, round-trip across 3 modes,
tampered-signature rejection, invalid-mode rejection). GOWORK=off
go test -count=1 ./pulsar/... is green.
Imports github.com/luxfi/pulsar-m (pre-rename); will be retargeted to
github.com/luxfi/pulsar when the cross-repo move lands.
* precompile/LLM.md: mark Pulsar 0x012204 as IMPLEMENTED
Pulsar precompile now lives in precompile/pulsar/ and dispatches to
luxfi/crypto/mldsa under a Pulsar-specific context. Update the
LP-4200 canonical note to reflect deployment status alongside the
other three PQCrypto slots.
* precompile/zk: rip classical pairing-based opcodes (PQ-only)
Shor breaks Groth16/PLONK/fflonk/Halo2/KZG/IPA/Bulletproofs.
The 0x0900 EVM precompile now exposes only the PQ-safe ops:
hash-based nullifiers (0x21) and Merkle commitment inclusion (0x22).
PQ STARK verification is dispatched via the Z-Chain envelope path
(consensus/protocol/zchain/verify.go), not from this precompile.
* precompile/kzg4844: retire BLS12-381 KZG blob-opening precompile
KZG point-evaluation verifies via the BLS12-381 pairing
e(C - [y]G1, G2) == e(W, [tau - z]G2). The discrete-log assumption
that anchors BLS12-381's security is broken by Shor's algorithm, so
EIP-4844-style blob commitments give zero soundness against a future
quantum adversary. The Lux EVM is PQ-only.
Strip the implementation (gokzg4844, accel GPU MSM, all CPU opcodes).
The module still registers the address 0xB002 so the precompile
registry numbering stays stable, but every call to the precompile
returns the new contract.ErrClassicalForbiddenInPQ sentinel. The
minimum 21000 gas is deducted on every call to prevent the retired
address being used as a zero-cost probe.
Blob availability on the Lux EVM is now provided by hash-based
commitments (Blake3 / Poseidon2) and STARK-validated state roots.
* precompile/zk: strip Go-level classical pairing SNARK verifiers
The Run() path of the 0x0900 ZK precompile only exposes hash-based
nullifier checks and Merkle commitment inclusion, both PQ-safe. The
remaining Go-level methods on ZKVerifier (VerifyGroth16, VerifyPlonk,
VerifyFflonk, VerifyKZG, VerifyRangeProof, VerifyRollupBatch and
their helpers) all dispatched through a BN254 pairing check or a
BLS12-381 KZG opening, both broken by Shor's algorithm.
Strip those methods, their bn256 / kzg4844 / accel-MSM dependencies,
and the rollup-batch types (RollupBatch, RollupConfig, StateTransition,
KZGSetup, BN254P) that only existed to feed the pairing verifier.
Update verifier_test.go to cover only the PQ-safe surface that
remains: NewZKVerifier, RegisterVerifyingKey (Go-side bookkeeping),
nullifier check/spend, confidential pool create/add-commitment,
hash-based Merkle inclusion.
PQ STARK verification continues to be handled by the P3Q backend on
the Z-chain envelope path (consensus/protocol/zchain/verify.go); it
was never wired through this Go struct.
* precompile/babyjubjub: retire BN254-companion twisted Edwards curve
Baby Jubjub is the ZK-friendly twisted Edwards curve aligned to BN254's
scalar field (used by circom / iden3 / Polygon zkEVM / Semaphore /
RLN / EdDSA-on-BN254). Its security reduces to discrete-log on a curve
of BN254 scalar order; Shor breaks that in poly time. Every consumer
of Baby Jubjub is a classical pairing-based SNARK gadget with no PQ
analogue, so the Lux EVM retires the precompile rather than offer a
quantum-broken primitive.
Strip the gnark-crypto twisted-edwards implementation. The module
still registers address 0x0500..0007 so the precompile registry
numbering stays stable, but every call returns
contract.ErrClassicalForbiddenInPQ with 21000 minimum gas deducted.
* precompile/pedersen: retire BN254 Pedersen commitment precompile
The implementation built homomorphic Pedersen commitments over BN254 G1
(C = v*G + r*H, plus a 32-slot vector commitment). Both binding and
hiding reduce to the discrete-log assumption on BN254, which Shor's
algorithm breaks. The Lux EVM is PQ-only and retires the precompile
rather than offer a quantum-broken commitment.
Strip the gnark-crypto BN254 implementation and the 34 deterministic
generators. The module still registers address 0x0500..0006 so the
precompile registry numbering stays stable, but every call returns
contract.ErrClassicalForbiddenInPQ with the 21000 minimum gas
deducted.
PQ-safe commitment schemes on the Lux EVM use hash-based primitives
(Blake3 0x3202, Poseidon2 0x3201) and STARK gadgets on Z-chain.
* Revert "precompile/pedersen: retire BN254 Pedersen commitment precompile"
This reverts commit cc0db71edf.
* Revert "precompile/babyjubjub: retire BN254-companion twisted Edwards curve"
This reverts commit e666729d6b.
* Revert "precompile/zk: strip Go-level classical pairing SNARK verifiers"
This reverts commit 92e5ac182b.
* Revert "precompile/kzg4844: retire BLS12-381 KZG blob-opening precompile"
This reverts commit 5786c8f57e.
* Revert "precompile/zk: rip classical pairing-based opcodes (PQ-only)"
This reverts commit 555a9b68ff.
* precompile: profile gate + P3Q + classical-primitive integration
Strict-PQ gate (contract.RefuseUnderStrictPQ) at the top of every
classical pairing/DLOG precompile's Run() refuses the call when the
chain's ChainConfig implements StrictPQReporter and reports true at
the current timestamp. Non-Lux chains that integrate Lux precompiles
without wiring StrictPQReporter see the classical primitives execute
normally -- forward perfection on Lux, full compatibility elsewhere.
Wired into kzg4844, zk (classical opcodes only -- Nullifier and
Merkle Commitment stay open), babyjubjub, pedersen, pasta.
P3Q strict-PQ STARK verifier at LP-4200 0x012205. Plonky3 fork with
cSHAKE256 Merkle / Goldilocks field / FRI low-degree test. Verifier
callback registered at node startup; default returns
ErrVerifierNotRegistered. 8 tests pass.
Gate semantics:
RefuseUnderStrictPQ(nil) → nil (test-permissive)
ChainConfig without StrictPQReporter → nil (non-Lux chains)
StrictPQReporter false → nil (pre-strict-PQ activation timestamp)
StrictPQReporter true → ErrClassicalForbiddenInPQ
Composable, orthogonal, complete. One and only one way.
* precompile: gate every classical Run() via contract.RefuseUnderStrictPQ
Decomplect: profile-gating logic stays in one place (contract.RefuseUnderStrictPQ);
each classical precompile calls it once at the top of Run() and otherwise stays in
its lane. Quasar/P3Q/Pulsar/ML-KEM/ML-DSA/SLH-DSA/Corona/X-Wing/FHE precompiles
are post-quantum and skip the gate.
Wired into:
bls12381 (7 EIP-2537 ops: G1/G2 add/mul/MSM + pairing)
ed25519 (signature verify)
cggmp21 (ECDSA threshold)
frost (Schnorr threshold)
ring (LSAG classical schemes; lattice scheme stays open)
vrf (ECVRF EDWARDS25519)
sr25519 (Schnorrkel/Ristretto255)
x25519 (DH)
curve25519 (raw Edwards25519 ops)
hpke (classical KEMs; Kyber/X-Wing hybrid stays open)
blake3 (classical hash)
poseidon (BN254 algebraic hash)
Already gated upstream: kzg4844, zk (classical opcodes), babyjubjub, pedersen, pasta.
secp256r1 uses the non-stateful Run([]byte) interface (EIP-7212 standard).
Gating that precompile requires hooking the geth EVM precompile overrider, not
this package -- left for the LuxPrecompileOverrider follow-up.
Tests pass across all twelve gated dirs plus contract/.
Per LP-4200 unified PQCrypto block:
- ML-KEM 0x012201 (was 0x0200...0007)
- ML-DSA 0x012202 (was 0x0200...0006)
- SLH-DSA 0x012203 (was 0x0600...0001)
- Corona 0x012204 (was 0x0200...000B)
Adds LP-12xxx range (0x012000-0x012FFF) to modules/registerer
whitelist so the new block validates as in-range.
LLM.md updated to mark legacy 0x0600 / 0x0800 ranges as superseded
by the unified block.
Solidity callers updated in luxfi/standard (#59).
Spec docs reconciled in lp-3500/lp-3520 (#61).
zeekayandHanzo Dev