ethrex integration: Crypto-trait guest + synthetic block fixture generator

[ColoCarletti]

Description

⚠️ Temporary. This pins our ethrex guest to the unmerged LambdaVM-backend ethrex PR branch and adds an in-repo fixture generator as a stand-in. Once that PR merges to ethrex main, we re-pin to the merge commit and switch fixture generation to ethrex-replay. The in-repo generator is then removed.

What this does

• Migrates the ethrex guest to the new Crypto-trait API (execution_program(input, LambdaVmCrypto)); keccak runs through our precompile. Removes the old [patch] ethrex-crypto and c-kzg.
• Adds tooling/ethrex-fixtures — a small offline tool that builds ethrex blocks with an arbitrary number of ETH transfers and writes the serialized ProgramInput. Pinned to the same ethrex rev as the guest so fixtures stay compatible.
• Regenerates the committed fixtures (empty / 1-tx / 10-tx) at the new rev and wires empty + 1-tx into the ethrex benchmark.
• Updates the executor native test reference + docs.

Current limitations

• Blocks/contracts that use the KZG point-evaluation precompile (0x0a) are unsupported under the LambdaVM guest today. The lambdavm feature does not wire a kzg-rs/c-kzg backend, so those calls fail closed/revert. The committed temporary fixtures are ETH-transfer-only and do not exercise this; wire KZG before switching to ethrex-replay or arbitrary real blocks.

[github-actions]

Codex Code Review

No issues found in the PR diff.

Notes:

• I reviewed only 55e8c7b1...fe199d41.
• git diff --check passed.
• Fixture SHA-256 values in executor/tests/README.md match the checked-in binaries.
• I could not run cargo check: Cargo tried to write git dependencies under read-only /home/runner/.cargo/git.

[github-actions]

Benchmark Results for unmodified programs 🚀

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
base binary_search	49.9 ± 1.3	48.5	52.2	1.00
head binary_search	50.2 ± 1.1	48.5	51.8	1.01 ± 0.03

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
base bitwise_ops	50.1 ± 1.1	48.6	51.6	1.00
head bitwise_ops	52.7 ± 4.6	48.7	63.6	1.05 ± 0.09

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
base fibonacci_26	54.6 ± 0.6	53.5	55.3	1.00
head fibonacci_26	55.0 ± 1.0	53.7	56.6	1.01 ± 0.02

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
base hashmap	105.4 ± 1.5	103.6	107.6	1.00 ± 0.02
head hashmap	105.2 ± 2.1	103.1	109.4	1.00

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
base keccak	109.2 ± 2.3	106.6	112.5	1.01 ± 0.03
head keccak	108.6 ± 2.2	103.9	110.7	1.00

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
base matrix_multiply	60.7 ± 1.4	59.0	63.0	1.01 ± 0.03
head matrix_multiply	60.0 ± 1.1	58.4	61.6	1.00

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
base modular_exp	50.7 ± 1.0	49.5	52.2	1.01 ± 0.03
head modular_exp	50.3 ± 1.0	49.1	52.0	1.00

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
base quicksort	53.9 ± 0.7	52.6	54.8	1.00
head quicksort	54.2 ± 1.0	52.6	55.7	1.00 ± 0.02

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
base sieve	57.2 ± 1.5	55.1	59.5	1.00 ± 0.04
head sieve	57.0 ± 1.7	54.9	59.9	1.00

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
base sum_array	67.5 ± 1.1	66.2	70.0	1.00
head sum_array	68.6 ± 1.7	66.7	71.4	1.02 ± 0.03

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
base syscall_commit	77.1 ± 1.3	75.5	79.0	1.00
head syscall_commit	78.5 ± 2.8	75.6	85.8	1.02 ± 0.04

[MauroToscano]

/ai-review

[github-actions]

Codex Code Review

Found one issue:

High - unsupported KZG precompile can silently produce non-Ethereum execution output

The guest now builds ethrex-guest-program with only the lambdavm feature and explicitly documents that KZG is not linked, so calls to the point-evaluation precompile 0x0a revert instead of returning a valid result: executor/programs/rust/ethrex/Cargo.toml, executor/programs/rust/ethrex/src/main.rs. The guest still accepts arbitrary ProgramInput and commits the execution result: executor/programs/rust/ethrex/src/main.rs. That means a block containing a contract call to 0x0a can be proven with different semantics from Ethereum rather than being rejected. The current tests only cover plain transfers and compare against NativeCrypto, so this regression is not exercised: executor/tests/rust.rs.

Action: either keep/restore KZG support in LambdaVmCrypto, or reject inputs that can exercise unsupported precompiles before committing output, and add a fixture/test for the point-evaluation precompile path.

I could not run the targeted compile check because rustup tried to write under the read-only home directory in this environment.

[claude]

Review — ethrex Crypto-trait guest + fixture generator

Reviewed the source/config changes (skimmed the Cargo.lock and vendored keccak/blake2f asm deletions, which are mechanical). Overall this is a clean, well-documented temporary-integration PR — fixtures are now committed and generated reproducibly in-repo, removing the network download. No blocking issues found. A few notes:

Soundness caveat to track (not a bug today) — The lambdavm guest fails closed on the KZG point-evaluation precompile (0x0a). For the committed ETH-transfer-only fixtures this is fine, but it's a silent-incorrectness footgun for real blocks: a 0x0a call reverts instead of returning, yielding a wrong state root that the prover would still faithfully prove. Before this guest is pointed at ethrex-replay/arbitrary blocks, add a hard guard that rejects blocks exercising 0x0a rather than relying on the doc comment. (See inline note on the guest main.rs.) The PR description already calls this out — just making sure it gets a guard, not just a comment.

Minor cleanup — executor/.gitignore still has /tests/ethrex_hoodi.bin (line 3). With the hoodi fixture and its download removed everywhere else, this is now dead config; drop it.

Things I checked that are fine:

• CI: the test_ethrex --ignored filter substring-matches the two non-ignored ethrex tests, but --ignored only runs the 10-tx test_ethrex; the others run in the regular --test rust step and read committed fixtures + the compiled ELF. test_ckzg is unrelated to this PR and unaffected.
• Fixture generator: the included-vs-requested assert guards against silently writing a short block (gas/balance/nonce drift); genesis funds the rich account with a huge balance so it won't trip. Deterministic (RFC6979 signing + fixed timestamp), so regen is reproducible.
• The exact rkyv = =0.8.16 pin is consistent across guest / executor / fixture writer, which keeps the ProgramInput layout in sync.
• Execution/proving consistency is cross-checked: tests compute the native NativeCrypto output and assert the LambdaVmCrypto guest ELF commits the same public output.

[github-actions]

AI Review

PR #666 · 35 changed files

Warning: the diff was truncated before review.

Findings

Status	Sev	Location	Finding	Found by
confirmed	high	executor/programs/rust/ethrex/Cargo.toml:14	KZG/point-evaluation precompile (0x0a) support removed without migration path	nemotron openrouter/nvidia/nemotron-3-ultra-550b-a55b
confirmed	low	Makefile:162	Manual README checksum refresh after fixture regeneration	kimi openrouter/moonshotai/kimi-k2.7-code
confirmed	low	executor/.gitignore:3	Dead gitignore entry for removed ethrex_hoodi.bin	glm openrouter/z-ai/glm-5.2 kimi openrouter/moonshotai/kimi-k2.7-code nemotron openrouter/nvidia/nemotron-3-ultra-550b-a55b

Status column reflects the verdict from the verifier: deepseek-verifier (openrouter/deepseek/deepseek-v4-pro).

AI-001: KZG/point-evaluation precompile (0x0a) support removed without migration path

• Status: confirmed
• Severity: high
• Location: executor/programs/rust/ethrex/Cargo.toml:14
• Found by: nemotron:openrouter/nvidia/nemotron-3-ultra-550b-a55b
• Verified by: deepseek-verifier:openrouter/deepseek/deepseek-v4-pro
• Rejected by: -

Claim

The new ethrex-guest-program with lambdavm feature explicitly does not include KZG/c-kzg, so the point-evaluation precompile (0x0a) fails closed (reverts) instead of returning a result. This is a breaking change for any workloads relying on EIP-4844 blob verification.

Evidence

Cargo.toml comment: 'KZG is NOT linked under this feature (no kzg-rs/c-kzg in the guest Cargo.lock), so the point-evaluation precompile (0x0a) is unsupported — see src/main.rs.' The c-kzg and kzg-rs dependencies were removed from both root and guest Cargo.lock files.

Suggested fix

Document this limitation clearly in the README and migration guide. If KZG support is needed, consider adding a separate feature flag or tracking issue for re-implementing KZG via pure-Rust crates (e.g., bls12_381 + arkworks) instead of c-kzg.

AI-004: Manual README checksum refresh after fixture regeneration

• Status: confirmed
• Severity: low
• Location: Makefile:162
• Found by: kimi:openrouter/moonshotai/kimi-k2.7-code
• Verified by: deepseek-verifier:openrouter/deepseek/deepseek-v4-pro
• Rejected by: -

Claim

The regen-ethrex-fixtures Makefile target regenerates the committed .bin fixtures but does not update the SHA-256 checksums documented in executor/tests/README.md. This manual step is easy to miss after an ethrex rev bump, leaving stale checksums in the documented provenance.

Evidence

Makefile lines 160-166 define regen-ethrex-fixtures to run cargo run --release -- ... for the three fixtures, but the rule performs no checksum update. executor/tests/README.md lines 31-33 explicitly tells the user to "refresh checksums" manually after regeneration, indicating the process is not automated.

Suggested fix

Extend regen-ethrex-fixtures to recompute and inline the SHA-256 checksums in executor/tests/README.md (e.g. with a small helper script or shell commands), or emit a loud post-run reminder that checksums must be refreshed.

AI-005: Dead gitignore entry for removed ethrex_hoodi.bin

• Status: confirmed
• Severity: low
• Location: executor/.gitignore:3
• Found by: glm:openrouter/z-ai/glm-5.2, kimi:openrouter/moonshotai/kimi-k2.7-code, nemotron:openrouter/nvidia/nemotron-3-ultra-550b-a55b
• Verified by: deepseek-verifier:openrouter/deepseek/deepseek-v4-pro
• Rejected by: -

Claim

The PR removes the prepare-test-data Makefile target (and its ETHREX_FILE/ETHREX_URL) that downloaded ethrex_hoodi.bin, and the test fixtures now use committed ethrex_*.bin files, but executor/.gitignore still contains /tests/ethrex_hoodi.bin for the now-unused file.

Evidence

executor/.gitignore line 3 contains /tests/ethrex_hoodi.bin. A repo-wide grep shows the only remaining references to ethrex_hoodi.bin are in the PR diff/context and this .gitignore entry; the active tests in executor/tests/rust.rs now read ethrex_10_transfers.bin, ethrex_simple_tx.bin, and ethrex_empty_block.bin, and Makefile no longer references the old download target.

Suggested fix

Remove line 3 (/tests/ethrex_hoodi.bin) from executor/.gitignore.

Reviewer Lanes

Lane	Model	Prompt	Status	Findings
glm	openrouter/z-ai/glm-5.2	general	success	1
kimi	openrouter/moonshotai/kimi-k2.7-code	general	success	2
minimax	minimax/MiniMax-M3	general	success	0
nemotron	openrouter/nvidia/nemotron-3-ultra-550b-a55b	general	success	5

Verification Lanes

Lane	Model	Status	Confirmed	Rejected	Uncertain
deepseek-verifier	openrouter/deepseek/deepseek-v4-pro	success	3	3	0

Native Codex and Claude reviews run separately and post their own comments. They are not included in this structured provenance report.

Discarded candidates (3) — rejected by the verifier

• Exact rkyv version pin (=0.8.16) may cause dependency resolution conflicts (executor/Cargo.toml:10, found by nemotron:openrouter/nvidia/nemotron-3-ultra-550b-a55b) — The =0.8.16 pins are intentional and documented with explicit comments in all three Cargo.toml files (executor, ethrex guest, ethrex-fixtures): 'must match the fixture writer + guest so the rkyv ProgramInput layout stays consistent.' No actual resolution conflict is demonstrated; Cargo would produce a clear error at build time if one occurred. This is a speculative concern, not a real bug.
• Patch URL in ethrex guest Cargo.toml may not match ethrex-guest-program's lambda-vm-syscalls source (executor/programs/rust/ethrex/Cargo.toml:25, found by nemotron:openrouter/nvidia/nemotron-3-ultra-550b-a55b) — The guest Cargo.lock (executor/programs/rust/ethrex/Cargo.lock line 1242) shows lambda-vm-syscalls with no 'source' field, meaning it resolved via the path patch override rather than a registry/git source. This confirms the patch is working correctly and the URL matches. The ethrex-guest-program dependency (line 784) correctly lists lambda-vm-syscalls as a dependency, and the patch successfully overrides it.
• ckzg program still depends on removed c-kzg crate (executor/programs/rust/ckzg/Cargo.toml:10, found by nemotron:openrouter/nvidia/nemotron-3-ultra-550b-a55b) — The ckzg program (executor/programs/rust/ckzg/) is a separate Cargo workspace with its own Cargo.lock that independently resolves c-kzg. The root Cargo.lock never listed c-kzg as a dependency of the root workspace — c-kzg was only a dependency of the old ethrex guest program (version 9.0.0) which has been replaced. The ckzg program's Cargo.lock still contains c-kzg at its locked version and will continue to compile fine. There is no inconsistency or problem.

Raw lane outputs, candidates, final issues, and model metrics are uploaded as workflow artifacts.

[MauroToscano]

/ai-review

[github-actions]

Codex Code Review

Findings

1. Medium - KZG point-evaluation precompile is now unsupported in the ethrex guest
   executor/programs/rust/ethrex/src/main.rs documents that calls to precompile 0x0a now revert because the lambdavm feature does not link KZG. That means valid Ethereum execution containing a point-evaluation precompile call will produce incorrect guest output/proof semantics. The added tests only cover empty/plain-transfer blocks, so this gap is not caught. Either keep/link a KZG implementation for the guest or explicitly constrain/reject unsupported fixtures before proving them.

2. Low - Removed ethrex keccak patch regresses the hot keccak path back to software
   executor/programs/rust/ethrex/src/main.rs says only trait-routed Crypto::keccak256 uses the LambdaVM precompile, while ethrex trie/RLP hashing still calls ethrex_crypto::keccak::keccak_hash in software. This PR deletes the previous ethrex-crypto patch that routed that crate’s keccak through the syscall, so the main state/trie hashing path loses acceleration. For ethrex block execution/proving, that is likely a material cycle regression. Consider preserving the patch or upstreaming a trait-routed keccak path before removing it.

Verification

I could not run the targeted cargo test because this sandbox has a read-only /home/runner/.rustup and rustup failed while syncing 1.94.0. Static checks performed: PR diff inspection, git diff --check, fixture checksum verification, and dependency/fixture reference scans.

[claude]

Review: ethrex Crypto-trait guest + fixture generator

Reviewed the substantive changes (guest main.rs, tooling/ethrex-fixtures, test wiring, Makefile/CI/provision cleanup). No critical/high/medium issues found. This is a clean, unusually well-documented migration:

• rkyv is consistently exact-pinned (=0.8.16) across the guest, fixture writer, and executor reader, and all four ethrex deps share one rev — so the ProgramInput layout stays consistent. 👍
• The ethrex_hoodi.bin / prepare-test-data removal is complete: Makefile, CI ignored step, provision.sh, executor/src/main.rs, and both tests are all repointed to committed fixtures with no dangling references.
• The KZG / point-evaluation (0x0a) limitation is intentional and documented in three places (guest main.rs, both Cargo.tomls, PR body). Fixtures are transfer-only and don't exercise it.
• Fixture generator has a good defensive assert_eq!(included, n_transfers) so a silently-underfilled block can't produce a misleading fixture.

Two minor, non-blocking observations:

1. Regeneration reproducibility (Low). The README/Makefile flow is "regenerate, then refresh the committed sha256s." That only stays friction-free if build_payload + generate_witness_for_blocks serialize deterministically (no map-iteration-order dependence in the witness). The committed blobs are fine as-is; just worth confirming two clean regens at the same rev yield identical bytes before relying on the checksum-refresh workflow — otherwise re-pinning to ethrex-replay later will look like a spurious diff.

2. CI cost of test_ethrex (Low). The ignored-step test_ethrex now executes the 10-transfer fixture (~42M cycles per the bench note) through the VM interpreter, vs. the old ethrex_hoodi block of unknown size. Execution-only and gated to --ignored, so acceptable — just flagging it may lengthen that step noticeably if hoodi was smaller.

Nice work, and clear TODOs for the eventual re-pin + generator removal.