magnetar forges under a single reverted read, measured: declare 7924 bytes,
put the true final byte in the spare capacity, and the precompile answers
verdict word 1 over 7925 bytes. len=7924 cap=8181, no panic, no error. That
is what a missing bound costs when the input is a window into EVM memory
rather than a copy.
ring does not forge on one reverted read, and the reason is structural rather
than lucky: every length-bearing field is followed by another bound, and the
trailing open field is s[low:], which bounds against len even when the read
before it walked into cap. So the over-read lands as a halt instead. Recorded
as a halt, not a forgery.
magnetar's exact framing survives as End(); deleting only that term accepts a
single trailing byte, which would let one signature ride many calldatas.
zk: plonkVerify reads its nine points and six evaluations through the cursor.
Two floors in verifyPLONK and verifyFflonk survived deletion because the only
thing they protected was the KEYED path — with a key registered, a short proof
must come back malformed rather than merely false, and nothing went down that
path. That distinction now has a test. parseFflonkProof's floor was redundant
against its own reads and is gone.
Removed in ring: a nil check on a slice make() cannot return nil, left over
from the GPU batch path deleted under M-06.
ring's lsagVerify halted the chain from calldata. A scalar of 0 or >= N makes
ScalarMult return a nil point and curve.Add dereferences it; geth's dispatch
has no recover, so one transaction stops every validator. Its parser also left
scalars unvalidated, and the two builds disagree about them -- cgo refuses an
out-of-range scalar, pure-Go reduces it silently -- so the same calldata
produced different verdicts depending on how the node was compiled.
frost's Schnorr check was a total forgery. An unliftable x-only key fell
through to the identity, collapsing z*G == R + c*Y to z*G == R, so choosing any
z and publishing R = z*G verifies under every off-curve x. cggmp21 forges the
same way if either coordinate comparison is dropped: one coordinate does not
identify a secp256k1 point, since (P, -P) share x and (P, lambda*P,
lambda^2*P) share y through the GLV endomorphism.
pulsar returned the full supplied gas on four exits -- work done, nothing
billed -- and ring had three arms returning zero. Corona quoted base + n*10000
with n an unbounded uint32 off the wire, up to 4.29e13 gas. Capping the charger
alone would have left the exported EstimateGas disagreeing with the fee, so
quote and charge are now one function.
corona's deserializePoly ignored the count from bytes.Reader.Read, which
returns a short read with a nil error, so a truncated blob was zero-filled and
fabricated coefficients were accepted as signed material. Its exported
ExpectedSignatureSize said 4096 against a real 163840 -- it omitted the A
matrix and bTilde that its own parser reads -- so any caller sizing calldata by
it built a call that could only be rejected.
Per-party gas prices nothing: corona's verifier never referenced t or n (dead
parameters, now gone), and frost and cggmp21 use totalSigners only for a
structural check. All three charge a variable fee for constant work. The cap
contains it; the schedule is consensus-visible and left alone.
Vectors are frozen hex with the generators deleted, because a fresh-key round
trip passes when signer and verifier are uniformly wrong together. Each carries
a genuine signature by the same key over the same message under a sibling
slot's context, which must be refused -- domain separation tested against a
real signature rather than corrupted bytes.
189 mutations, one at a time with restore-and-reverify. Five survivors, each
proven equivalent by a downstream check reaching the identical verdict.
Public permissionless launch policy: enable basically every precompile for
builder convenience, ESPECIALLY wallet-curve VERIFY so users sign natively on
Lux from other chains (ed25519=Solana, sr25519=Polkadot, secp256r1=WebAuthn,
secp256k1/ecrecover=Ethereum). Disable ONLY actual security risks. Lux's own
consensus and identity stay PQ (quasar/p3q) — enforced in the consensus
layer, never by refusing an EVM verifier a dapp asked for.
Two layers, decomplected:
- builder EVM precompile surface : enable-all-verify (this change)
- chain consensus / finality : PQ-strict (consensus module, untouched)
Removed the RefuseUnderStrictPQ gate from 17 verify-only / key-safe custom
precompiles: ed25519, sr25519, secp256r1, bls12381 (EIP-2537, x7 ops),
kzg4844 (EIP-4844), blake3, poseidon, pedersen, babyjubjub, pasta, ring,
vrf, hpke, curve25519, x25519, cggmp21, frost, and the classical SNARK
verifiers in zk (Groth16/PLONK/Halo2/KZG/IPA/range/batch/commitment).
zk fflonk (0x03) stays DISABLED — but on its OWN forge-bug mechanism
(ErrFflonkDisabled, returned at dispatch), NOT strict-PQ: verifyFflonk has a
nil-vk soundness hole that forges any statement. Security disable, fully
PQ-independent.
The RefuseUnderStrictPQ helper + ErrClassicalForbiddenInPQ + StrictPQReporter
had zero remaining code callers (evm uses a local structural interface) —
deleted contract/strict_pq.go and its test. Rewrote zk's gate test to assert
the new policy (classical ops enabled, fflonk disabled). Removed the now-
orphaned isPedersenCommitment; fixed stale comments referencing deleted symbols.
Build: full module green. Tests: contract + zk + all 17 edited packages pass.
NOTE: the STANDARD eth precompiles (ecrecover, p256Verify, sha256, ripemd160,
blake2f, bls12381, kzg) are still refused by LuxStrictPQ() in the evm plugin —
a follow-up commit flips that to Permissive so ecrecover (every Ethereum dapp)
works at launch.
* precompile: pulsar threshold ML-DSA at LP-4200 0x012204
Adds the Pulsar precompile slot for threshold ML-DSA verification.
Pulsar's wire format is byte-equal to FIPS 204 ML-DSA (Class N1
manifesto), so the verification op dispatches to luxfi/crypto/mldsa
under a Pulsar-specific domain-separation context.
- Address: 0x0000000000000000000000000000000000012204 (LP-4200 unified
PQCrypto block; companion to ML-KEM 0x012201, ML-DSA 0x012202,
SLH-DSA 0x012203).
- Three modes: Pulsar-44 / Pulsar-65 / Pulsar-87 mirroring ML-DSA
Categories 2 / 3 / 5. Production target is Pulsar-65.
- Gas: per-mode base + 10/byte (matches ML-DSA precompile tier).
- Context: lux-evm-precompile-pulsar-v1 to keep on-chain transcripts
unambiguous vs. single-party ML-DSA at 0x012202.
Tests: 5 passing (address pin, gas table, round-trip across 3 modes,
tampered-signature rejection, invalid-mode rejection). GOWORK=off
go test -count=1 ./pulsar/... is green.
Imports github.com/luxfi/pulsar-m (pre-rename); will be retargeted to
github.com/luxfi/pulsar when the cross-repo move lands.
* precompile/LLM.md: mark Pulsar 0x012204 as IMPLEMENTED
Pulsar precompile now lives in precompile/pulsar/ and dispatches to
luxfi/crypto/mldsa under a Pulsar-specific context. Update the
LP-4200 canonical note to reflect deployment status alongside the
other three PQCrypto slots.
* precompile/zk: rip classical pairing-based opcodes (PQ-only)
Shor breaks Groth16/PLONK/fflonk/Halo2/KZG/IPA/Bulletproofs.
The 0x0900 EVM precompile now exposes only the PQ-safe ops:
hash-based nullifiers (0x21) and Merkle commitment inclusion (0x22).
PQ STARK verification is dispatched via the Z-Chain envelope path
(consensus/protocol/zchain/verify.go), not from this precompile.
* precompile/kzg4844: retire BLS12-381 KZG blob-opening precompile
KZG point-evaluation verifies via the BLS12-381 pairing
e(C - [y]G1, G2) == e(W, [tau - z]G2). The discrete-log assumption
that anchors BLS12-381's security is broken by Shor's algorithm, so
EIP-4844-style blob commitments give zero soundness against a future
quantum adversary. The Lux EVM is PQ-only.
Strip the implementation (gokzg4844, accel GPU MSM, all CPU opcodes).
The module still registers the address 0xB002 so the precompile
registry numbering stays stable, but every call to the precompile
returns the new contract.ErrClassicalForbiddenInPQ sentinel. The
minimum 21000 gas is deducted on every call to prevent the retired
address being used as a zero-cost probe.
Blob availability on the Lux EVM is now provided by hash-based
commitments (Blake3 / Poseidon2) and STARK-validated state roots.
* precompile/zk: strip Go-level classical pairing SNARK verifiers
The Run() path of the 0x0900 ZK precompile only exposes hash-based
nullifier checks and Merkle commitment inclusion, both PQ-safe. The
remaining Go-level methods on ZKVerifier (VerifyGroth16, VerifyPlonk,
VerifyFflonk, VerifyKZG, VerifyRangeProof, VerifyRollupBatch and
their helpers) all dispatched through a BN254 pairing check or a
BLS12-381 KZG opening, both broken by Shor's algorithm.
Strip those methods, their bn256 / kzg4844 / accel-MSM dependencies,
and the rollup-batch types (RollupBatch, RollupConfig, StateTransition,
KZGSetup, BN254P) that only existed to feed the pairing verifier.
Update verifier_test.go to cover only the PQ-safe surface that
remains: NewZKVerifier, RegisterVerifyingKey (Go-side bookkeeping),
nullifier check/spend, confidential pool create/add-commitment,
hash-based Merkle inclusion.
PQ STARK verification continues to be handled by the P3Q backend on
the Z-chain envelope path (consensus/protocol/zchain/verify.go); it
was never wired through this Go struct.
* precompile/babyjubjub: retire BN254-companion twisted Edwards curve
Baby Jubjub is the ZK-friendly twisted Edwards curve aligned to BN254's
scalar field (used by circom / iden3 / Polygon zkEVM / Semaphore /
RLN / EdDSA-on-BN254). Its security reduces to discrete-log on a curve
of BN254 scalar order; Shor breaks that in poly time. Every consumer
of Baby Jubjub is a classical pairing-based SNARK gadget with no PQ
analogue, so the Lux EVM retires the precompile rather than offer a
quantum-broken primitive.
Strip the gnark-crypto twisted-edwards implementation. The module
still registers address 0x0500..0007 so the precompile registry
numbering stays stable, but every call returns
contract.ErrClassicalForbiddenInPQ with 21000 minimum gas deducted.
* precompile/pedersen: retire BN254 Pedersen commitment precompile
The implementation built homomorphic Pedersen commitments over BN254 G1
(C = v*G + r*H, plus a 32-slot vector commitment). Both binding and
hiding reduce to the discrete-log assumption on BN254, which Shor's
algorithm breaks. The Lux EVM is PQ-only and retires the precompile
rather than offer a quantum-broken commitment.
Strip the gnark-crypto BN254 implementation and the 34 deterministic
generators. The module still registers address 0x0500..0006 so the
precompile registry numbering stays stable, but every call returns
contract.ErrClassicalForbiddenInPQ with the 21000 minimum gas
deducted.
PQ-safe commitment schemes on the Lux EVM use hash-based primitives
(Blake3 0x3202, Poseidon2 0x3201) and STARK gadgets on Z-chain.
* Revert "precompile/pedersen: retire BN254 Pedersen commitment precompile"
This reverts commit cc0db71edf.
* Revert "precompile/babyjubjub: retire BN254-companion twisted Edwards curve"
This reverts commit e666729d6b.
* Revert "precompile/zk: strip Go-level classical pairing SNARK verifiers"
This reverts commit 92e5ac182b.
* Revert "precompile/kzg4844: retire BLS12-381 KZG blob-opening precompile"
This reverts commit 5786c8f57e.
* Revert "precompile/zk: rip classical pairing-based opcodes (PQ-only)"
This reverts commit 555a9b68ff.
* precompile: profile gate + P3Q + classical-primitive integration
Strict-PQ gate (contract.RefuseUnderStrictPQ) at the top of every
classical pairing/DLOG precompile's Run() refuses the call when the
chain's ChainConfig implements StrictPQReporter and reports true at
the current timestamp. Non-Lux chains that integrate Lux precompiles
without wiring StrictPQReporter see the classical primitives execute
normally -- forward perfection on Lux, full compatibility elsewhere.
Wired into kzg4844, zk (classical opcodes only -- Nullifier and
Merkle Commitment stay open), babyjubjub, pedersen, pasta.
P3Q strict-PQ STARK verifier at LP-4200 0x012205. Plonky3 fork with
cSHAKE256 Merkle / Goldilocks field / FRI low-degree test. Verifier
callback registered at node startup; default returns
ErrVerifierNotRegistered. 8 tests pass.
Gate semantics:
RefuseUnderStrictPQ(nil) → nil (test-permissive)
ChainConfig without StrictPQReporter → nil (non-Lux chains)
StrictPQReporter false → nil (pre-strict-PQ activation timestamp)
StrictPQReporter true → ErrClassicalForbiddenInPQ
Composable, orthogonal, complete. One and only one way.
* precompile: gate every classical Run() via contract.RefuseUnderStrictPQ
Decomplect: profile-gating logic stays in one place (contract.RefuseUnderStrictPQ);
each classical precompile calls it once at the top of Run() and otherwise stays in
its lane. Quasar/P3Q/Pulsar/ML-KEM/ML-DSA/SLH-DSA/Corona/X-Wing/FHE precompiles
are post-quantum and skip the gate.
Wired into:
bls12381 (7 EIP-2537 ops: G1/G2 add/mul/MSM + pairing)
ed25519 (signature verify)
cggmp21 (ECDSA threshold)
frost (Schnorr threshold)
ring (LSAG classical schemes; lattice scheme stays open)
vrf (ECVRF EDWARDS25519)
sr25519 (Schnorrkel/Ristretto255)
x25519 (DH)
curve25519 (raw Edwards25519 ops)
hpke (classical KEMs; Kyber/X-Wing hybrid stays open)
blake3 (classical hash)
poseidon (BN254 algebraic hash)
Already gated upstream: kzg4844, zk (classical opcodes), babyjubjub, pedersen, pasta.
secp256r1 uses the non-stateful Run([]byte) interface (EIP-7212 standard).
Gating that precompile requires hooking the geth EVM precompile overrider, not
this package -- left for the LuxPrecompileOverrider follow-up.
Tests pass across all twelve gated dirs plus contract/.
- ecies: GPU ECDH scaffolded for secp256k1 (accel.Available check)
- hpke: GPU Kyber KEM via LatticeOps.KyberEncaps/Decaps for PQ KEMs
- ring: GPU batch SHA256 for hashToPoint precomputation in LSAG verify
All 18 precompiles now have GPU acceleration paths.
Single-operation precompiles where GPU dispatch overhead exceeds CPU
execution time. GPU acceleration applies at block level via batch
processing in parallel.BlockExecutor. Metal kernels (ec_mul_affine,
KyberEncapsBatch) support the underlying operations.
All 18/18 precompiles now GPU-documented or GPU-wired.
Replace singleton module structs with modules.RegisterModule init()
pattern for ecies, hpke, mldsa, mlkem, ring, slhdsa. Add proper
Configurator interface with Config types for each module.
Changed build tags from `//go:build cgo` to `//go:build gpu` across all
GPU-accelerated precompiles. This ensures builds don't attempt to link
against luxcpp/crypto libraries when not explicitly building with GPU.
Changes:
- ai/gpu: cgo -> gpu build tags
- blake3: gpu tag (already correct)
- ecies: fixed test address expectation (0x9201)
- fhe: added fhe_ops_stub.go for non-GPU builds, gpu tag on test
- frost: gpu tag
- hpke: fixed test address expectation (0x9200)
- kzg4844: fixed test address expectation (0xB002), gpu tag
- mldsa: gpu tag, added gpu_stub.go
- mlkem: gpu tag, added gpu_stub.go
- ring: fixed test address expectation (0x9202)
- corona: fixed address (0x...0B), gpu tag
- slhdsa: gpu tag, added gpu_stub.go
- threshold: gpu tag
- zk: gpu tag
All 23 precompile packages now build and test without GPU libraries.
BREAKING CHANGE: Module renamed from precompiles to precompile (singular)
- Remove lattice/v6 indirect dependency
- Exclude lattice/v6 versions to prevent transitive imports
- Only lattice/v7 is used now
zeekay
