Skip to content

[#4046] Merge upstream revm v120 (revm 43.0.3) and port the fork's changes - #90

Open
isaacdoidge wants to merge 572 commits into
feature/revm-43-syncfrom
task/issue-4046-merge-v120
Open

isaacdoidge wants to merge 572 commits into
feature/revm-43-syncfrom
task/issue-4046-merge-v120

Conversation

@isaacdoidge

@isaacdoidge isaacdoidge commented Nov 13, 2026 •

Copy link
Copy Markdown
Collaborator

Tracking issue: Entropy-Foundation/smr-moonshot#4046.

Merges upstream revm v120 (revm 43.0.3) into feature/revm-43-sync and ports the fork's changes to the upstream API. The spec stays OSAKA.

Merge this PR with "Create a merge commit". Squash or rebase merging drops the merge commit's v120 parent, and the branch would no longer contain upstream's history.

feature/revm-43-sync was cut from feature/evm_automation at 271b6a44. Work on feature/evm_automation continues, and later fork PRs are merged into this branch in separate PRs.

Commits

89984467 is the merge commit. It resolves the 36 conflicts only and does not build. Where upstream restructured code that carries Supra behaviour, it takes upstream's code, and the commits after it re-apply the behaviour:

Commit Change
1452585f Restores the bincode workspace dependency, which upstream removed and revm-supra-extension uses.
f566f541 is_state_mutating covers upstream's NonceBump and ExtensionChange entries; HaltReason::ReservedAddressTarget gets a Display arm.
69dd25c4 The TX_HASH precompile uses the new precompile function signature.
72b37891 Caller validation and fee deduction follow the execution mode: EIP-3607 only where the mode enforces it, nonce check and bump only where the mode updates the nonce, no fee in a mode that charges no gas. Both auth-list paths skip Supra reserved addresses and the EIP-2935 system address as authorities.
348c6c53 The call frame refuses value transfers to reserved addresses unless a precompile there accepts value, refuses code execution from a reserved address and through a delegation to one, and gives the TX_HASH precompile the transaction hash as input.
b603ab51, 6111bdfb A mode that charges no gas skips post-execution, in the handler and the inspector handler. Its ResultGas is built from the frame's gas with no EIP-7623 floor, so it reports the gas the execution used, as before the sync.
5a72702d Ports the fork's tests to the new API; the state-test TxEnv sets tx_hash.
4330bbe2 Moves the fork's alloy, alloy-contract and alloy-serde to 2.x, so one copy of each alloy crate is linked.
10642fce The multi-transaction create snapshot expects the fork's account status (see below).
99de9839, 02b3beb7, c9d75cb7, f70fd99c, bf2eed9c, f0b8b76b const fn under upstream's missing_const_for_fn lint, a no_std import, rustfmt, comments and a doc link, the fork's .github configuration.
3cb8aec2 Corrects the comment on the gas result of modes that charge no gas (spent less the uncapped refund, no floor), moves the reserved and system authority skip into one helper, is_refused_authority, and marks is_supra_reserved and is_vm_signer #[inline].

Behaviour now provided by upstream

The fork had its own fixes for these. Upstream has equivalents, and the merge keeps upstream's:

  • reverting a code change restores the previous code and code hash (EIP-7702 re-delegation);
  • an account loaded from the database carries the current transaction id;
  • coinbase, precompile and access-list addresses start each transaction warm;
  • a storage slot's original value is re-baselined at each transaction boundary;
  • the caller's touch is journaled only when the account is not already touched, and a balance change is journaled only when the balance changes;
  • EIP-7702 delegation is journaled through the account handle.

The fork's tests for each of these pass unchanged.

Differences from upstream that are intended

  • An account created and self-destructed earlier in the same journal has its self-destruct and created flags cleared when a later transaction loads it (since Entropy-Foundation/smr-moonshot#3113). Upstream's multi_tx_create snapshot expects the flags to remain, so the snapshot carries the fork's expectation, as the JSON fixture it replaces did.
  • The self-destruct burn total counts a self-targeted destruction before Amsterdam. From Amsterdam (EIP-8246) a self-targeted destruction keeps its balance, and nothing is counted.
  • PrecompileId::mainnet_address, which upstream removed, is not restored. The call frame compares against TX_HASH_ADDRESS.

Upstream changes a consumer of the fork sees

These come from upstream between v29 and v43 and change what smr-moonshot observes at OSAKA. They are handled when smr-moonshot is moved to this branch.

  • A transaction that calls a precompile directly (journal depth 1) and halts for a reason other than out-of-gas reports HaltReason::PrecompileErrorWithContext(String) instead of PrecompileError.
  • HaltReason gained PrecompileErrorWithContext before NonceOverflow, so the serialized index of every variant from NonceOverflow on, including ReservedAddressTarget, is one higher.
  • ExecutionResult::{Success, Revert, Halt} carry gas: ResultGas in place of gas_used/gas_refunded, and Revert and Halt carry the logs emitted before the revert or halt.
  • CfgEnv::new_with_spec defaults tx_chain_id_check to true (it was false).
  • Handler::post_execution returns the ResultGas, built after the refund and before the EIP-7623 floor check, and execution_result takes it as an argument.

Follow-ups

Raised in review and left out of this PR because they change behaviour or performance beyond the sync, or predate it:

  • Entropy-Foundation/smr-moonshot#5002: apply the EIP-7623 floor rule for modes that charge no gas in validation as well as in the result.
  • Entropy-Foundation/smr-moonshot#5003: check delegations into the reserved range where the delegation is resolved, not with a lookup on every call frame.
  • Entropy-Foundation/smr-moonshot#5004: decide the gas settlement of modes that charge no gas in one place.
  • Entropy-Foundation/smr-moonshot#5005: set the spec in the fork's tests through the constructors that also set the gas parameters.

Not adopted

  • crates/op-revm is removed, as upstream removed it.
  • The fork keeps its own GitHub configuration (bf2eed9c). Upstream's workflow changes, including its third-party actions and its pr-audit and scan-github-actions workflows, are not adopted, and neither is upstream's SECURITY.md, which directs reports to upstream's maintainer. The only change in .github is ci.yml's no_std and feature-check matrices, which follow upstream's feature set (kzg-rs removed, account-ext added).

Verification

All 20 CI checks pass on 3cb8aec2, including clippy, docs, test --all-features, forge-tests, genesis bytecode checks and the ethtests run.

Locally, on f70fd99c with rustc 1.99.1:

  • cargo clippy --workspace --all-targets --all-features -- -D warnings and the same without --all-features: clean.
  • cargo nextest run --workspace: 667 passed at c9d75cb7. With --all-features: 680 passed at f70fd99c, including gas_floor_is_not_reported_for_modes_that_charge_no_gas, which fails without 6111bdfb.
  • cargo check --target riscv32imac-unknown-none-elf --no-default-features, and the same with -p revm-database: pass.
  • cargo fmt --all --check: clean.
  • ./scripts/run-tests.sh --keep-going cargo ethtests at c9d75cb7 on the main, devnet and legacy fixtures: all state tests pass, and 61,606 blockchain tests pass with 0 failures, including the fork_Osaka variants.

smr-moonshot is not built against this branch yet. That is the next step on Entropy-Foundation/smr-moonshot#4046.

🤖 Generated with Claude Code

rakita and others added 30 commits March 13, 2026 12:31
…loy#3498)

The debug_failed_test function was printing state from an inspector
run, which can differ from a plain transact run. Now it runs the
inspector for tracing output first, then does a separate transact
run whose state is used for the "State after" print.
…bluealloy#3503)

Co-authored-by: DaniPopes <57450786+DaniPopes@users.noreply.github.com>
…oy#3507)

* feat: add crate-level re-exports for all revm-* dependencies

Re-export all revm-* dependencies as modules via `pub use crate_name;`
in each crate's lib.rs, making them transitively accessible
(e.g., `handler::context::...`, `interpreter::primitives::...`).

Note: in inspector, `handler` crate is re-exported as `evm_handler`
to avoid conflict with the local `pub mod handler`.

* style: fix formatting in bytecode lib.rs
bluealloy#3502)

* refactor: use AnyError instead of String in PrecompileError::Fatal

* refactor: use AnyError instead of String in EVMError::Custom

* fix: add back impl Error for PrecompileError

* feat: implement From String and static str for AnyError

* chore: add context-interface as a dependency of precompile

* refactor: import AnyError from context-interface to precompile

* refactor: add EVMError::CustomAny variant instead of changing Custom

* refactor: add PrecompileError::FatalAny variant instead of changing Fatal

* feat: add is_fatal method to PrecompileError and apply it accordingly

* chore: remove unused import

* fix: correct imports to fix ci
…lloy#3510)

* chore: remove no-op background transition merge builder toggle

* Apply suggestion from @rakita

---------

Co-authored-by: rakita <rakita@users.noreply.github.com>
…it (bluealloy#3518)

* feat(inspector): add `frame_start` and `frame_end` to `Inspector` trait

Adds two variant-agnostic hooks to the Inspector trait:
- `frame_start`: called before call/create dispatch, can mutate FrameInput
  or return an early FrameResult to skip execution
- `frame_end`: called after call_end/create_end, can transform the FrameResult

This allows inspectors to intercept frames before the variant is known,
enabling use cases like converting a Create frame into a Call frame without implementing custom handlers.

* fix: fmt
Co-authored-by: Arsenii Kulikov <62447812+klkvr@users.noreply.github.com>
)

* refactor(precompile): take secp256r1 verify_signature args by reference

Co-Authored-By: DaniPopes <57450786+DaniPopes@users.noreply.github.com>

* refactor(precompile): take secp256k1 ecrecover_bytes args by reference

Co-Authored-By: DaniPopes <57450786+DaniPopes@users.noreply.github.com>

* refactor(precompile): take blake2 compress args by reference

Co-Authored-By: DaniPopes <57450786+DaniPopes@users.noreply.github.com>

* refactor(precompile): use into() instead of from_slice in ecrecover_bytes

Co-Authored-By: DaniPopes <57450786+DaniPopes@users.noreply.github.com>

* fix: remove needless borrow in blake2 compress

Co-Authored-By: DaniPopes <57450786+DaniPopes@users.noreply.github.com>

---------

Co-authored-by: DaniPopes <57450786+DaniPopes@users.noreply.github.com>
* Add local context accessors to CallInput

Add `as_bytes_local` and `bytes_local` methods for resolving call input
bytes from a LocalContextTr, mirroring the existing memory-based variants.
Includes unit tests.

* Refactor as_bytes/bytes to delegate to local context variants

Deduplicate logic by having `as_bytes` and `bytes` delegate to
`as_bytes_local` and `bytes_local` respectively.
…y#3550)

* refactor: deprecate `set_spec` and clean up deprecation attributes

Deprecate `CfgEnv::set_spec` in favor of `set_spec_and_mainnet_gas_params`,
clean up verbose deprecation attributes, and remove unused import.

* fix: correct deprecation note for `set_spec` to point to `set_spec_and_mainnet_gas_params`
* feat: implement EIP-8037 state gas (reservoir model)

Add state gas accounting with reservoir model across interpreter, handler,
context, and precompile crates. Includes comprehensive EIP-8037 test suite
with 35+ test vectors covering SSTORE, CALL, CREATE, SELFDESTRUCT, reservoir
refill, and gas opcode behavior.

* rm statetest jsons

* Rename spent to regular_gas_spent in ResultGas and simplify reservoir refill

- Rename ResultGas::spent to regular_gas_spent to distinguish from state gas after EIP-8037
- Add total_gas_spent() method and deprecate old spent()/set_spent()/with_spent() accessors
- Simplify reservoir refill logic: replace handler_reservoir_refill() with inline max()
- Remove unnecessary reservoir manipulation in precompile path
- Update op-revm handler to use simplified reservoir refill
- Update Cargo.lock dependencies

* Simplify EIP-8037 state gas: remove redundant fields from ResultGas and update test data

* Move EIP-7702 state gas refund split into pre_execution

Consolidate the EIP-8037 auth list refund splitting logic from
run_without_catch_error into apply_eip7702_auth_list, avoiding
duplication between handler and inspector. pre_execution now takes
init_and_floor_gas as a mutable reference and returns only the
regular refund portion.

* Add PrecompileFailure type for state gas propagation on error

Introduce PrecompileFailure wrapper that carries both the error and
an optional GasTracker, allowing precompiles that charge state gas
(EIP-8037) to propagate gas info back to the caller on failure for
proper reservoir refill.

* Convert precompile errors to PrecompileFailure via .into()

Update all precompile Err returns to use .into() for converting
PrecompileError to PrecompileFailure, enabling state gas tracking
on precompile failures.

* Fix EIP-8037 state gas accounting regression

Commit 257d261 introduced a regression in gas accounting by incorrectly
erasing both remaining and reservoir gas from total_gas_spent. The reservoir
should not be erased since it's tracked separately via state_gas_spent.

This fix reverts the erase_cost line from erase_cost(remaining + reservoir)
to erase_cost(remaining), which correctly accounts for:
- Regular gas: deducted from remaining calculation
- State gas: tracked separately in state_gas_spent field

Results:
- State test failures reduced from 20 to 4 (pre-regression count)
- All 408 workspace tests now pass
- Updated EIP-8037 test data and assertions to match correct values

* Move state gas deduction into first_frame_input

Refactor to improve code organization by moving the state gas deduction
logic from the execution method into the first_frame_input method, where
frame initialization concerns are naturally grouped together.

This keeps frame setup logic cohesive and simplifies the execution method
to focus on the execution loop rather than frame setup details.

No functional change - same gas accounting and execution behavior.

* Fix EIP-8037 gas accounting: floor gas, reservoir, inspector, validation

Four fixes for EIP-8037 state gas interactions:

1. post_execution: Fix EIP-7623 floor gas check to account for EIP-8037
   reservoir. Per EIP-8037, gas_used = tx.gas - gas_left - reservoir.
   The floor check now subtracts reservoir when computing gas used.

2. handler: Simplify reservoir handling in last_frame_result to always
   use the frame's final reservoir value directly. It already reflects
   child frame restorations via handle_reservoir_remaining_gas.

3. handler: Add EIP-8037 floor gas validation when gas_limit exceeds
   TX_MAX_GAS_LIMIT. The maximum gas_used is capped at TX_MAX_GAS_LIMIT
   since excess goes to reservoir, so floor_gas must not exceed that cap.

4. inspector: Remove double deduction of initial_state_gas in
   inspect_execution. The first_frame_input method already handles the
   deduction; the explicit deduction in the inspector was redundant.

* Fix EIP-8037 reservoir accounting: tx_gas_used, child revert refunds, and EIP-7702

- tx_gas_used now subtracts unused reservoir gas (tx.gas - gas_left - state_gas_left)
- Child revert/halt returns all state gas to parent reservoir (matching Python spec)
- EIP-7702 state gas refund goes to reservoir instead of reducing initial_state_gas
- Refund cap uses gas_used excluding reservoir
- Precompile provider preserves reservoir across gas tracker replacement
- Updated EIP-8037 test expectations and test data

* Fix CREATE/CREATE2 static call check ordering for EIP-8037 state gas recovery

Move require_non_staticcall! after gas charging in the CREATE/CREATE2
instruction handler. In the execution-specs, the static check is inside
generic_create() after all gas (including state gas) has been charged.
The previous ordering prevented state gas from being recorded on the
frame, so on child error the parent could not recover it via
handle_reservoir_remaining_gas.

* Simplify last_frame_result: remove initial_reservoir parameter and fix reservoir handling

- Remove unused `initial_reservoir` parameter from `last_frame_result` across all handlers
- Fix precompile provider to save reservoir before overwriting gas tracker
- Add deprecated `gas_used()` method on ExecutionResult pointing to `tx_gas_used()`

* Revert CREATE/CREATE2 static call check to before gas charging

Static call check doesn't need to be after gas charging - CREATE in a
static context is always an error regardless of gas accounting.

* Fix reservoir handling: restore state gas on revert/halt

On revert/halt, state changes are rolled back so state gas should be
refunded back to the reservoir. Only on success should the frame's
final reservoir be used as-is.

* Fix EIP-8037 state_gas_spent accounting for EIP-7702 auth list

Two bugs in state_gas_spent reporting:

1. build_result_gas added full initial_state_gas without subtracting
   eip7702_reservoir_refund, overcounting state gas for existing
   authority accounts. This caused block_state_gas_used to be too
   high and block_regular_gas_used to be too low.

2. On revert/halt, last_frame_result set state_gas_spent before
   restoring it to the reservoir, leaving a stale execution value.
   Now correctly zeroed since state changes are rolled back.

* Improve precompile reservoir handling and apply formatting fixes

Refactor precompile provider to properly handle reservoir refill logic
for both success and error/halt cases, ensuring state gas accounting
is correct when precompiles don't track reservoir. Also apply rustfmt
formatting across multiple files.

* Fix precompile_provider compilation errors against current precompile API

PrecompileOutput has gas_used (not gas: GasTracker) and PrecompileError
is a flat enum (no .error/.gas subfields). Use record_regular_cost()
to avoid deprecation warning.

* Simplify precompile interface: remove gas_limit from PrecompileOutput, flatten PrecompileError

Remove gas_limit field from PrecompileOutput (only gas_used needed) and
eliminate the PrecompileError wrapper layer so errors are returned directly
as the enum variant without .into() conversion.

* Fix EIP-8037 reservoir refill tests and complete precompile interface cleanup

Update 4 EIP-8037 tests to match current reservoir refill behavior: on
revert/halt at the top level, state_gas_spent is zeroed and state gas is
restored to the reservoir (state changes rolled back). Regenerate testdata.

Also complete the PrecompileOutput/PrecompileError simplification from the
previous commit: remove reverted field, flatten error matching in tests.

* temporary remove all ee-tests

* Fix state gas accounting: include reservoir in total_gas_spent and prevent underflow

- Remove saturating_sub of reservoir from total_gas_spent in build_result_gas
- Use saturating_sub in block_regular_gas_used to prevent underflow

* Apply formatting fixes and use saturating arithmetic for state gas spent

* Revert "temporary remove all ee-tests"

This reverts commit 03986fc.

* Fix total_gas_spent to exclude reservoir and use saturating arithmetic

Compute total_gas_spent as limit - remaining - reservoir in
build_result_gas to correctly exclude unused state gas. Use
saturating_sub in Gas::spent/total_gas_spent to prevent underflow.
Add std feature to ee-tests revm dependency.

* Use build_result_gas helper in system call gas handling

Replace manual ResultGas construction with the shared build_result_gas
function for consistency with the main execution path.

* bump rust to 1.91

* Remove redundant gas_limit from Gas, delegate to GasTracker

Gas had its own `limit` field duplicating `GasTracker::gas_limit`.
Remove it and delegate `Gas::limit()` to `self.tracker.limit()`.

Also fixes `Gas::new_spent` which previously set tracker gas_limit
to 0 instead of the actual limit.

* refactor(precompile): restructure PrecompileOutput for state gas and reservoir support (bluealloy#3541)

* refactor(precompile): split PrecompileOutput and PrecompileError for state gas support

Rename PrecompileOutput to PrecompileOutputEth (simple gas_used + bytes) for
individual precompile functions. Introduce new PrecompileOutput with halt,
gas_used, state_gas_used, reservoir, and bytes fields for provider-level results.

Split PrecompileError: non-fatal errors become PrecompileHaltReason (expressed
via PrecompileOutput::halt), while PrecompileError now only holds fatal errors
(Fatal/FatalAny) that abort EVM execution.

New type aliases:
- PrecompileEthResult = Result<PrecompileOutputEth, PrecompileHaltReason>
- PrecompileResult = Result<PrecompileOutput, PrecompileError>

* refactor(precompile): replace Option<PrecompileHalt> with PrecompileStatus enum

Introduce PrecompileStatus enum (Success, Revert, Halt) to replace the
Option<PrecompileHalt> field in PrecompileOutput. Add PrecompileEthFn type
alias for legacy precompile function signatures, with Precompile::execute()
now returning PrecompileOutput via a From<PrecompileEthResult> conversion.
Add helper methods: is_success, is_revert, halt_reason, into_halt_reason.

* refactor(handler): extract precompile_output_to_interpreter_result helper

Add a standalone function that converts PrecompileOutput into
InterpreterResult, and use it in EthPrecompiles::run. Fmt and clippy fixes.

* refactor(precompile): thread reservoir through PrecompileOutput and revert execute signature

- Add `reservoir` parameter to PrecompileOutput::new, halt, revert constructors
- Add `from_eth_result` constructor that takes reservoir
- Revert Precompile::execute to return PrecompileEthResult
- Move PrecompileOutput conversion to call site in EthPrecompiles
- Remove unused into_halt_reason and From<PrecompileEthResult> impl

* refactor(precompile): change Precompile fn_ from PrecompileEthFn to PrecompileFn (bluealloy#3546)

Change the Precompile struct's fn_ field from PrecompileEthFn (fn(&[u8], u64) -> PrecompileEthResult)
to PrecompileFn (fn(&[u8], u64, u64) -> PrecompileOutput) so precompiles receive reservoir
directly and return PrecompileOutput.

Add call_eth_precompile helper to wrap existing PrecompileEthFn implementations into
the new PrecompileFn signature. Each precompile module gets a thin wrapper using this helper.

* refactor(precompile): add eth_precompile_fn! macro to eliminate wrapper boilerplate

Replace 17 hand-written PrecompileEthFn-to-PrecompileFn wrapper functions
with the new eth_precompile_fn! macro that generates them uniformly.

* refactor(op-revm): use eth_precompile_fn! macro for precompile wrappers

Replace 8 hand-written wrapper functions in op-revm with the
eth_precompile_fn! macro.

* style: apply cargo fmt

* Rename Eth precompile structs

* fix(op-revm): add missing reservoir argument to execute calls in tests

* refactor(precompile): move reservoir into PrecompileOutput and add PrecompileStatus helpers

PrecompileOutput now carries reservoir and state_gas_used, so
precompile_output_to_interpreter_result no longer needs a separate
reservoir parameter. Added convenience methods on PrecompileStatus
and fixed unused import warning.

* fix: update bench and test code for new Precompile API

Update eip2537 benchmarks to use Precompile::execute() instead of
removed precompile() method, and fix manual div_ceil clippy warning.

* docs: fix ResultGas doc comments to match current API

Remove references to removed getters (limit, spent, intrinsic_gas,
remaining) and update table and derived values to reflect the actual
methods (total_gas_spent, tx_gas_used, block_regular_gas_used, etc.).

* docs: fix broken doc links and typos in ResultGas

- Fix unresolved links to non-existent `regular_gas_spent` and
  `with_regular_gas_spent` methods in deprecation notes
- Fix typos: "substract" → "subtract", "enought" → "enough"
- Fix stale comments referencing `regular_gas_spent` field

* feat: track state_gas_spent and reservoir in GasInspector

* fix: validate max(intrinsic_gas, floor_gas) against TX_MAX_GAS_LIMIT cap

* chore: add must_use annotations to gas recording methods and minor cleanups

* refactor: update custom_precompile_journal example to use PrecompileOutput API

Use `PrecompileOutput::from_eth_result` and `precompile_output_to_interpreter_result`
instead of manually constructing InterpreterResult, aligning with the new gas handling.

* refactor: make Precompile::execute return Result<PrecompileOutput, PrecompileError>

Distinguish fatal/unrecoverable precompile errors from non-fatal halts
by returning a Result. PrecompileFn signature updated accordingly, and
all call sites now propagate or unwrap the error.

* chore: bump MSRV to 1.91 in CI

* fix: exclude EIP-8037 reservoir gas from op-revm fee settlement

The core revm handler already excludes reservoir gas when calculating
beneficiary rewards and caller reimbursement, but op-revm's fee
settlement did not account for it. Once Osaka/EIP-8037 is enabled,
transactions with leftover reservoir gas would over-credit
BASE_FEE_RECIPIENT and OPERATOR_FEE_RECIPIENT, and under-refund
operator fees to the caller.

- reward_beneficiary: use effective_used (gas.used() - reservoir) for
  base_fee_amount and operator_fee_cost calculations
- operator_fee_refund: include gas.reservoir() when computing gas_used
  so the refund correctly covers unused reservoir gas
- handler validation: use initial_regular_gas (excluding state gas)
  when checking floor_gas against TX_MAX_GAS_LIMIT cap
…as (bluealloy#3552)

Extract `initial_regular_gas()` helper on InitialAndFloorGas and move
the EIP-8037 TX_MAX_GAS_LIMIT validation from the handler into
`validate_initial_tx_gas`, consolidating validation logic. Also clean
up formatting across precompile and op-revm crates.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix: reject transactions with nonce at u64::MAX to prevent overflow

Incrementing a nonce of u64::MAX would overflow, so validate this
upfront in transaction validation.

* Apply suggestion from @rakita
* docs: add v106 migration guide entry

* chore: v106 release prep — version bumps and changelogs

* add revm version
Co-authored-by: Sergei Shulepov <2205845+pepyakin@users.noreply.github.com>
* fix(bytecode): mark `Bytecode::new_analyzed` as unsafe

`new_analyzed` does not validate that the bytecode has sufficient
padding for PUSH immediates. Misuse causes UB via out-of-bounds reads
in `ExtBytecode::read_slice`. Mark it `unsafe` and fix the serde
deserializer to re-analyze from original bytes instead of trusting
serialized padding.

Co-authored-by: Sergei Shulepov <2205845+pepyakin@users.noreply.github.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019d801a-b1e7-7291-a077-f9cd826ca9b0

* docs: remove intra-doc link to private analyze_legacy

Co-authored-by: Sergei Shulepov <2205845+pepyakin@users.noreply.github.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019d801a-b1e7-7291-a077-f9cd826ca9b0

* Apply suggestion from @rakita

---------

Co-authored-by: Sergei Shulepov <2205845+pepyakin@users.noreply.github.com>
Co-authored-by: rakita <rakita@users.noreply.github.com>
…#3568)

* chore: remove op-revm from workspace

op-revm has moved to its own repository at https://github.com/ethereum-optimism/optimism/tree/develop/rust/op-revm.
Remove the crate, its tests/testdata, and update all references across
CI, publish script, docs, and book.

* fix: update op-revm links to ethereum-optimism/optimism

* chore: restore Optimism references with updated link
…lloy#3567)

* ci: pin GitHub Actions to SHA, add least-privilege permissions

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com>

* ci: add deny.toml, pin mdbook downloads to specific versions

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com>

* fix: use mdbook-template v1.1.0 (v1.1.1 tag is deprecated)

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com>

* ci: add cargo-deny check job

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com>

* ci: use EmbarkStudios/cargo-deny-action for deny job

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com>

* fix(ci): fix codspeed v4 mode input and cargo-deny failures

- Add required 'mode: walltime' for CodSpeedHQ/action v4
- Pin cargo-deny-action to SHA (v2.0.17)
- Add LGPL-3.0-or-later to license allow list (gmp-mpfr-sys)
- Ignore RUSTSEC-2026-0097 (rand 0.9.2 unsound, no fix yet)
- Remove stale RUSTSEC-2024-0388 ignore (derivative advisory withdrawn)
- Remove stale webpki license exception (no longer in dep tree)

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019d903c-cee9-772d-840c-3335c0b11f81

* fix(ci): use simulation mode for codspeed (matches build step)

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com>

---------

Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com>
rakita and others added 28 commits September 9, 2026 13:18
Prepare v119 after the EIP-8037 system-call gas revert in bluealloy#3903. Bump revm-handler, revm-inspector, revm, and revme to 43.0.2 and update the release documentation.
…3902)

Bumps the github-actions group with 3 updates: [taiki-e/install-action](https://github.com/taiki-e/install-action), [actions/deploy-pages](https://github.com/actions/deploy-pages) and [crate-ci/typos](https://github.com/crate-ci/typos).


Updates `taiki-e/install-action` from 2.87.2 to 2.87.4
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Commits](taiki-e/install-action@v2.87.2...v2.87.4)

Updates `actions/deploy-pages` from 5.0.0 to 5.0.1
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](actions/deploy-pages@cd2ce8f...368f825)

Updates `crate-ci/typos` from 1.50.0 to 1.50.1
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](crate-ci/typos@4d9c206...d43b6c0)

---
updated-dependencies:
- dependency-name: taiki-e/install-action
  dependency-version: 2.87.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/deploy-pages
  dependency-version: 5.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: crate-ci/typos
  dependency-version: 1.50.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Protect host package downloads, pin tool installers, and preserve the committed lockfile in CI and release-PR preparation without changing existing toolchain channels or test scope.

Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com>
* feat(state): carry account extension data

Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

* fix(state): omit empty account extension from JSON

* fix: initialize account extensions in tests

* Revert "fix(state): omit empty account extension from JSON"

This reverts commit 78d2b9e.

* refactor(state): make account extension generic

* Revert "refactor(state): make account extension generic"

This reverts commit 585aa02.

* test(bench): cover account extension performance

* bench: compare compact account extension representations

* bench: compare account storage against extension-less revm

* feat: gate ThinArc account payloads behind account-ext

* chore: lock ThinArc dependency

* test: cover account-ext execution snapshots separately

* fix: forward optional ThinArc features

* chore: remove account extension benchmark artifacts

* refactor: omit unnecessary account extension hashing

* fix: avoid draining storage into a new map

* fix: journal account extension changes and share payload allocations

* fix: encode raw account extensions with explicit framing

* fix: omit empty account extensions from serde

* fix: always serialize journal extension payloads

---------

Co-authored-by: Brian Picciano <933154+mediocregopher@users.noreply.github.com>
Co-authored-by: Brian Picciano <me@mediocregopher.com>
Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com>
* chore(ci): scan GitHub Actions workflows

Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

* chore(ci): fix workflow scanner findings

Co-authored-by: Derek Cofausper <256792747+decofe@users.noreply.github.com>

---------

Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com>
Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com>
Merges the upstream release tag v120 into the sync branch. This commit
resolves the merge conflicts only and does not build; the commits that
follow port the fork's changes to the upstream API.

Where upstream restructured code that carries Supra behaviour, this commit
takes upstream's code and the port commits re-apply the behaviour:
- execution modes in the handler and pre-execution (gas charging, nonce
  update, EIP-3607 scoping), and reserved and system addresses as EIP-7702
  authorities;
- reserved-address checks in the call frame (value transfers, code
  execution, delegation targets) and the TX_HASH precompile input;
- the inspector's post-execution gating.

Resolution choices:
- crates/op-revm is removed, as upstream removed it.
- The fork's ci.yml, book.yml and ethereum-tests.yml are kept. The
  no-std and feature-check matrices follow upstream's feature set (no
  kzg-rs; account-ext added).
- The TX_HASH precompile is added to the Prague set in upstream's
  init_precompiles. PrecompileId::mainnet_address, removed upstream, is
  not restored.
- The journal's self-destruct burn accounting is kept on upstream's
  selfdestruct; a self-targeted destruction before Amsterdam counts as
  burned, and from Amsterdam (EIP-8246) it does not.
- The fork's CodeChange revert fix and the transaction-id stamping on
  account load are replaced by upstream's equivalents.
- Cargo.lock is upstream's and is regenerated in a later commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
….lock

Upstream v120 removed bincode from the workspace dependencies; revm-supra-extension uses it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ay in the fork's additions

is_state_mutating treats NonceBump and, with account-ext, ExtensionChange as state mutations. HaltReason::ReservedAddressTarget gets a Display arm.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…on signature

Precompile functions take a reservoir argument from v120; TX_HASH wraps identity_run with eth_precompile_fn.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…pre-execution

Caller validation and fee deduction follow the execution mode:
- EIP-3607 applies only where ExecutionMode::enforces_eip3607 holds;
- the nonce is checked and bumped only where the mode updates it;
- a mode that charges no gas deducts no fee, and the caller must hold
  the transferred value unless the balance check is disabled.

Both auth-list paths skip an authorization whose authority is a Supra
reserved address or the EIP-2935 system address.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tream's call frame

- A non-zero value transfer to a Supra reserved address is refused with
  ReservedAddressTarget unless a registered precompile there accepts
  value.
- A call to the TX_HASH precompile address receives the transaction hash
  as its input.
- Code does not execute from a reserved address: a frame whose target or
  bytecode address is reserved is refused when that account holds code,
  and a frame whose EIP-7702 delegation points to a reserved address is
  refused when the delegated code is non-empty. Upstream passes the
  delegation-resolved code in CallInputs::known_bytecode, so the frame
  account's own code is read from the journal for these checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
In both the handler and the inspector handler, a mode that charges no gas
skips post-execution (refund cap, gas floor, reimbursement, beneficiary
reward). Its ResultGas is built from the frame's gas.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…120 API

- Journal tests pass skip_cold_load to selfdestruct, sload and sstore,
  and compare TransactionId through get().
- SELFDESTRUCT tests run against DummyHost with the gas table; a run
  that reaches the host now ends with SelfDestruct.
- The test precompile provider implements the new PrecompileProvider
  methods; precompile functions take a reservoir.
- Results are compared through ResultGas and tx_gas_used().
- The state-test TxEnv sets tx_hash to zero; fixtures carry no hash.
- Restores the closing lines the merge dropped between upstream's tests
  and the fork's tests in revm_tests.rs and inspector_tests.rs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Upstream v120 uses alloy-consensus and alloy-eips 2.0. The fork's
revm-supra-extension also depended on the alloy 1.x meta-crates, which
linked a second copy of each alloy crate.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ate snapshot

An account created and self-destructed earlier in the same journal has
its self-destruct and created flags cleared when a later transaction
loads it, as the fork's journal does since bluealloy#3113. Upstream's snapshot
expects the flag-based status; the deleted JSON fixture this replaces
carried the fork's expectation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…sing_const_for_fn lint

Upstream v120 enables clippy::missing_const_for_fn for the workspace. The
ExecutionMode predicates, TxEnvBuilder::tx_hash and the revm-supra-extension
constructors, builders and accessors it names become const fn; their
bodies are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… charge no gas

A mode that charges no gas skips post-execution, so no gas floor is
applied to it. upstream's build_result_gas sets the floor on the
ResultGas, and tx_gas_used() reports at least the floor; the result for
these modes now sets the floor to zero and reports the gas the execution
used, as before the sync.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…et position as they now stand

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The merge of v120 added upstream's .github changes that did not conflict:
the pr-audit and scan-github-actions workflows, the third-party actions
added to bench.yml and release-plz.yml, the Dependabot configuration,
and a SECURITY.md that directs vulnerability reports to upstream's
maintainer. These are restored to the fork's versions or removed, so the
only difference in .github from before the merge is ci.yml's feature
matrices.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…l entry docs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@isaacdoidge
isaacdoidge requested a review from aregng November 13, 2026 06:01
…skip, inline the reserved-address checks

- The comment on the result of a mode that charges no gas states that it
  reports gas spent less the uncapped refund, with no floor.
- The reserved and system authority skip is one helper,
  is_refused_authority, used by both auth-list paths.
- is_supra_reserved and is_vm_signer are #[inline].

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.