zeekayandGitHub f69b524211 precompile: decomplect strict-PQ gate across every classical Run() (#2)
* precompile: pulsar threshold ML-DSA at LP-4200 0x012204

Adds the Pulsar precompile slot for threshold ML-DSA verification.
Pulsar's wire format is byte-equal to FIPS 204 ML-DSA (Class N1
manifesto), so the verification op dispatches to luxfi/crypto/mldsa
under a Pulsar-specific domain-separation context.

- Address: 0x0000000000000000000000000000000000012204 (LP-4200 unified
  PQCrypto block; companion to ML-KEM 0x012201, ML-DSA 0x012202,
  SLH-DSA 0x012203).
- Three modes: Pulsar-44 / Pulsar-65 / Pulsar-87 mirroring ML-DSA
  Categories 2 / 3 / 5. Production target is Pulsar-65.
- Gas: per-mode base + 10/byte (matches ML-DSA precompile tier).
- Context: lux-evm-precompile-pulsar-v1 to keep on-chain transcripts
  unambiguous vs. single-party ML-DSA at 0x012202.

Tests: 5 passing (address pin, gas table, round-trip across 3 modes,
tampered-signature rejection, invalid-mode rejection). GOWORK=off
go test -count=1 ./pulsar/... is green.

Imports github.com/luxfi/pulsar-m (pre-rename); will be retargeted to
github.com/luxfi/pulsar when the cross-repo move lands.

* precompile/LLM.md: mark Pulsar 0x012204 as IMPLEMENTED

Pulsar precompile now lives in precompile/pulsar/ and dispatches to
luxfi/crypto/mldsa under a Pulsar-specific context. Update the
LP-4200 canonical note to reflect deployment status alongside the
other three PQCrypto slots.

* precompile/zk: rip classical pairing-based opcodes (PQ-only)

Shor breaks Groth16/PLONK/fflonk/Halo2/KZG/IPA/Bulletproofs.
The 0x0900 EVM precompile now exposes only the PQ-safe ops:
hash-based nullifiers (0x21) and Merkle commitment inclusion (0x22).
PQ STARK verification is dispatched via the Z-Chain envelope path
(consensus/protocol/zchain/verify.go), not from this precompile.

* precompile/kzg4844: retire BLS12-381 KZG blob-opening precompile

KZG point-evaluation verifies via the BLS12-381 pairing
e(C - [y]G1, G2) == e(W, [tau - z]G2). The discrete-log assumption
that anchors BLS12-381's security is broken by Shor's algorithm, so
EIP-4844-style blob commitments give zero soundness against a future
quantum adversary. The Lux EVM is PQ-only.

Strip the implementation (gokzg4844, accel GPU MSM, all CPU opcodes).
The module still registers the address 0xB002 so the precompile
registry numbering stays stable, but every call to the precompile
returns the new contract.ErrClassicalForbiddenInPQ sentinel. The
minimum 21000 gas is deducted on every call to prevent the retired
address being used as a zero-cost probe.

Blob availability on the Lux EVM is now provided by hash-based
commitments (Blake3 / Poseidon2) and STARK-validated state roots.

* precompile/zk: strip Go-level classical pairing SNARK verifiers

The Run() path of the 0x0900 ZK precompile only exposes hash-based
nullifier checks and Merkle commitment inclusion, both PQ-safe. The
remaining Go-level methods on ZKVerifier (VerifyGroth16, VerifyPlonk,
VerifyFflonk, VerifyKZG, VerifyRangeProof, VerifyRollupBatch and
their helpers) all dispatched through a BN254 pairing check or a
BLS12-381 KZG opening, both broken by Shor's algorithm.

Strip those methods, their bn256 / kzg4844 / accel-MSM dependencies,
and the rollup-batch types (RollupBatch, RollupConfig, StateTransition,
KZGSetup, BN254P) that only existed to feed the pairing verifier.
Update verifier_test.go to cover only the PQ-safe surface that
remains: NewZKVerifier, RegisterVerifyingKey (Go-side bookkeeping),
nullifier check/spend, confidential pool create/add-commitment,
hash-based Merkle inclusion.

PQ STARK verification continues to be handled by the P3Q backend on
the Z-chain envelope path (consensus/protocol/zchain/verify.go); it
was never wired through this Go struct.

* precompile/babyjubjub: retire BN254-companion twisted Edwards curve

Baby Jubjub is the ZK-friendly twisted Edwards curve aligned to BN254's
scalar field (used by circom / iden3 / Polygon zkEVM / Semaphore /
RLN / EdDSA-on-BN254). Its security reduces to discrete-log on a curve
of BN254 scalar order; Shor breaks that in poly time. Every consumer
of Baby Jubjub is a classical pairing-based SNARK gadget with no PQ
analogue, so the Lux EVM retires the precompile rather than offer a
quantum-broken primitive.

Strip the gnark-crypto twisted-edwards implementation. The module
still registers address 0x0500..0007 so the precompile registry
numbering stays stable, but every call returns
contract.ErrClassicalForbiddenInPQ with 21000 minimum gas deducted.

* precompile/pedersen: retire BN254 Pedersen commitment precompile

The implementation built homomorphic Pedersen commitments over BN254 G1
(C = v*G + r*H, plus a 32-slot vector commitment). Both binding and
hiding reduce to the discrete-log assumption on BN254, which Shor's
algorithm breaks. The Lux EVM is PQ-only and retires the precompile
rather than offer a quantum-broken commitment.

Strip the gnark-crypto BN254 implementation and the 34 deterministic
generators. The module still registers address 0x0500..0006 so the
precompile registry numbering stays stable, but every call returns
contract.ErrClassicalForbiddenInPQ with the 21000 minimum gas
deducted.

PQ-safe commitment schemes on the Lux EVM use hash-based primitives
(Blake3 0x3202, Poseidon2 0x3201) and STARK gadgets on Z-chain.

* Revert "precompile/pedersen: retire BN254 Pedersen commitment precompile"

This reverts commit cc0db71edf.

* Revert "precompile/babyjubjub: retire BN254-companion twisted Edwards curve"

This reverts commit e666729d6b.

* Revert "precompile/zk: strip Go-level classical pairing SNARK verifiers"

This reverts commit 92e5ac182b.

* Revert "precompile/kzg4844: retire BLS12-381 KZG blob-opening precompile"

This reverts commit 5786c8f57e.

* Revert "precompile/zk: rip classical pairing-based opcodes (PQ-only)"

This reverts commit 555a9b68ff.

* precompile: profile gate + P3Q + classical-primitive integration

Strict-PQ gate (contract.RefuseUnderStrictPQ) at the top of every
classical pairing/DLOG precompile's Run() refuses the call when the
chain's ChainConfig implements StrictPQReporter and reports true at
the current timestamp. Non-Lux chains that integrate Lux precompiles
without wiring StrictPQReporter see the classical primitives execute
normally -- forward perfection on Lux, full compatibility elsewhere.

Wired into kzg4844, zk (classical opcodes only -- Nullifier and
Merkle Commitment stay open), babyjubjub, pedersen, pasta.

P3Q strict-PQ STARK verifier at LP-4200 0x012205. Plonky3 fork with
cSHAKE256 Merkle / Goldilocks field / FRI low-degree test. Verifier
callback registered at node startup; default returns
ErrVerifierNotRegistered. 8 tests pass.

Gate semantics:
  RefuseUnderStrictPQ(nil) → nil  (test-permissive)
  ChainConfig without StrictPQReporter → nil  (non-Lux chains)
  StrictPQReporter false → nil  (pre-strict-PQ activation timestamp)
  StrictPQReporter true → ErrClassicalForbiddenInPQ

Composable, orthogonal, complete. One and only one way.

* precompile: gate every classical Run() via contract.RefuseUnderStrictPQ

Decomplect: profile-gating logic stays in one place (contract.RefuseUnderStrictPQ);
each classical precompile calls it once at the top of Run() and otherwise stays in
its lane. Quasar/P3Q/Pulsar/ML-KEM/ML-DSA/SLH-DSA/Corona/X-Wing/FHE precompiles
are post-quantum and skip the gate.

Wired into:
  bls12381 (7 EIP-2537 ops: G1/G2 add/mul/MSM + pairing)
  ed25519 (signature verify)
  cggmp21 (ECDSA threshold)
  frost (Schnorr threshold)
  ring (LSAG classical schemes; lattice scheme stays open)
  vrf (ECVRF EDWARDS25519)
  sr25519 (Schnorrkel/Ristretto255)
  x25519 (DH)
  curve25519 (raw Edwards25519 ops)
  hpke (classical KEMs; Kyber/X-Wing hybrid stays open)
  blake3 (classical hash)
  poseidon (BN254 algebraic hash)

Already gated upstream: kzg4844, zk (classical opcodes), babyjubjub, pedersen, pasta.

secp256r1 uses the non-stateful Run([]byte) interface (EIP-7212 standard).
Gating that precompile requires hooking the geth EVM precompile overrider, not
this package -- left for the LuxPrecompileOverrider follow-up.

Tests pass across all twelve gated dirs plus contract/.
2026-05-11 15:10:04 -07:00
2026-03-02 10:46:24 +00:00

Lux Precompiled Contracts

Native EVM precompiles for the Lux blockchain. Each precompile is a Go package that implements contract.StatefulPrecompiledContract and registers via modules.RegisterModule() in its init().

Geth provides NewPrecompileAdapter() to wrap these into geth-compatible precompiles. L1 chains select which precompiles to enable via PrecompileOverrider.

Precompiles

Post-Quantum Cryptography (baseline — all Lux chains)

Package Address Description Gas
mldsa 0x0200...0006 ML-DSA-65 signature verify (FIPS 204) 100k + 10/byte
slhdsa 0x0600...0001 SLH-DSA signature verify (FIPS 205) 15k–250k by mode
mlkem 0x0200...0007 ML-KEM-768 encapsulate/decapsulate 50k base
xwing 0x2221 X-Wing hybrid KEM (X25519 + ML-KEM-768) 40k

Threshold Signatures

Package Address Description Gas
frost 0x0800...0002 FROST Schnorr threshold verify (secp256k1/Ed25519) 50k + 5k/signer
cggmp21 0x0800...0003 CGGMP21 threshold ECDSA verify (secp256k1) 75k + 10k/signer
corona 0x0200...000B Ring-LWE lattice threshold verify (post-quantum) 150k + 10k/party

Curves & Signatures

Package Address Description Gas
sr25519 0x0A00...0001 Schnorrkel verify for Substrate→EVM migration 9k + 3/byte
ed25519 0x3211...0000 Ed25519 signature verify 3k
secp256r1 0x0100 P-256 ECDSA verify (WebAuthn/passkeys) 3.5k

Hashing

Package Address Description Gas
blake3 0x0500...0004 Blake3 hash, Merkle root, KDF, XOF 100 + 3–5/word
kzg4844 0xB002 KZG polynomial commitment (EIP-4844) 50k

Privacy & ZK

Package Address Description Gas
zk 0x0900 ZK proof verification (Groth16, PLONK, fflonk, Halo2) 180k–500k
fhe — Fully homomorphic encryption ops variable
ring 0x9202 Ring signature verification variable
ecies 0x9201 ECIES encryption/decryption variable
hpke 0x9200 Hybrid public key encryption variable

DEX

Package Address Description Gas
dex 0x0400...0000 Native DEX (PoolManager, Router, Hooks, Lending) variable

Infrastructure

Package Address Description Gas
ai 0x0300...0000 AI mining (ML-DSA verify, TEE attestation, rewards) variable
quasar — Hybrid consensus certificate verification variable
dead 0x0000...0000 Dead address interceptor minimal
graph — GraphQL query precompile variable
bridge — Cross-chain bridge verification variable
attestation 0x0300...0001-05 TEE/GPU attestation (NVTrust, TPM, SGX/SEV/TDX) 25k–75k
anchor 0x0700...0010 Cross-chain state anchoring 2.6k–25k
vrf 0x3213 ECVRF verify (RFC 9381) 20k
compute 0x0300...0010 AI compute attestation variable

Support Packages

Package Purpose
contract Core interfaces (StatefulPrecompiledContract, AccessibleState)
modules Module registration system and reserved address ranges
precompileconfig Config interfaces (Upgrade, Timestamp, IsDisabled)
registry Address-to-LP mapping

Structure

Each precompile follows this pattern:

<name>/
├── contract.go        # Run(), RequiredGas(), Address()
├── contract_test.go   # Tests with known vectors
├── module.go          # init() → modules.RegisterModule()
└── I<Name>.sol        # Solidity interface (optional)

Adding a Precompile

  1. Pick an address in a reserved range
  2. Implement contract.StatefulPrecompiledContract
  3. Register via modules.RegisterModule() in init()
  4. Add tests (valid, invalid, gas, edge cases)
  5. Wire into your L1 via PrecompileOverrider or geth's LuxPrecompiles()

Building

go build ./...
go test ./...
go test -bench=. ./sr25519/  # benchmark a specific package

CGO is required for sr25519 (sr25519-donna C library). All other packages are pure Go.

License

Copyright (C) 2025, Lux Industries, Inc. All rights reserved.

ZK-Friendly Curves (0x0500)

Package Address Description Gas
poseidon 0x0500..05 Poseidon/Poseidon2 hash (ZK-optimized, PQ-safe) 800
pedersen 0x0500..06 Pedersen commitment (legacy, NOT PQ-safe) 6,000
babyjubjub 0x0500..07 Baby Jubjub curve (BN254 scalar field, zkEVM) 3,000
pasta 0x0500..08 Pallas + Vesta curves (Halo2 proving) 5,000

Symmetric & Key Exchange

Package Address Description Gas
aes 0x9210 AES-256-GCM authenticated encryption 5,000
chacha20 0x9211 ChaCha20-Poly1305 stream cipher 4,000
x25519 0x9203 X25519 Diffie-Hellman key exchange 10,000
xwing 0x0200..0C X-Wing hybrid KEM (X25519 + ML-KEM-768) 50,000
curve25519 0x9204 Raw Curve25519 point operations 5,000

Math (0x0450)

Package Address Description Gas
math 0x0450 MulDiv, Sqrt, Log2, Exp, Pow (fixed-point) 50 + 5/word

Saves ~2000 gas per MulDiv vs Solidity. Used by every DeFi calculation.

StableSwap (0x0460)

Package Address Description Gas
stableswap 0x0460 Curve-style constant-sum AMM 5,000

10x gas savings vs Solidity StableSwap. For pegged-asset pools (LUSD/USDC, LETH/stETH).

Compute Market (0x0310)

Package Address Description Gas
compute 0x0310 AI compute marketplace 10,000-50,000

Integrates with A-Chain TEE attestation. Register GPU providers, submit jobs, verify compute, claim $AI rewards.

S
Description
Lux EVM Precompiles for AI Mining, Teleport, and Quantum Signatures
Readme
42 MiB
Languages
Go 88.7%
C 7.3%
Solidity 3.1%
eC 0.7%
Rust 0.1%