[CHIA-4316] Vdfverifywjb

[wjblanke]

Moved to chia_rs from https://github.com/richardkiss/chia-vdf-verify

---

Note

High Risk
New consensus-critical VDF verification logic with a large ported cryptographic codebase; incorrect verification could break block acceptance or open invalid-proof acceptance.

Overview
Adds the chia-vdf-verify crate (ported from richardkiss/chia-vdf-verify) as a workspace member with optional vdf-verify feature on the root chia_rs package.

The crate implements pure-Rust n-Wesolowski VDF proof verification (class groups, malachite-nz big integers—no GMP/C). Workspace deps add malachite-nz and malachite-base.

Tests & perf: integration tests against chiavdf vdf.txt vectors; ~100 mainnet reward-chain IP proofs in benches/proofs.json with Criterion benches (verify, mainnet_proofs) and a script to regenerate fixtures from a Chia DB. Docs include BENCHMARKS.md (Rust vs C++ chiavdf). fuzz_timeouts/ JSON captures edge cases from fuzzing.

^{Reviewed by Cursor Bugbot for commit ae23879. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pytest@​9.1.1
	cargo/​rand@​0.8.7

View full report

[coveralls-official]

Coverage Report for CI Build 30836044232

Warning

Build has drifted: This PR's base is out of sync with its target branch, so coverage data may include unrelated changes.
Quick fix: rebase this PR. Learn more →

Coverage decreased (-0.5%) to 81.37%

Details

• Coverage decreased (-0.5%) from the base build.
• Patch coverage: 523 uncovered changes across 13 files (1796 of 2319 lines covered, 77.45%).
• 96 coverage regressions across 2 files.

Uncovered Changes

Top 10 Files by Coverage Impact	Changed	Covered	%
crates/chia-vdf-verify/src/python.rs	195	13	6.67%
crates/chia-vdf-verify/src/verifier.rs	239	121	50.63%
crates/chia-vdf-verify/src/bin/timing.rs	105	0	0.0%
crates/chia-vdf-verify/src/integer.rs	304	264	86.84%
crates/chia-vdf-verify/tests/integration_tests.rs	303	283	93.4%
crates/chia-vdf-verify/src/bqfc.rs	218	202	92.66%
crates/chia-vdf-verify/src/form.rs	73	60	82.19%
crates/chia-vdf-verify/src/xgcd_partial.rs	98	86	87.76%
crates/chia-vdf-verify/src/nucomp.rs	173	166	95.95%
crates/chia-vdf-verify-c/src/lib.rs	73	69	94.52%
Total (16 files)	2319	1796	77.45%

Coverage Regressions

96 previously-covered lines in 2 files lost coverage.

File	Lines Losing Coverage	Coverage
wheel/src/api.rs	95	81.04%
crates/chia-consensus/src/fast_forward.rs	1	98.72%

---

Coverage Stats

Relevant Lines:	22217
Covered Lines:	18078
Line Coverage:	81.37%
Coverage Strength:	10701209.29 hits per line

---

💛 - Coveralls

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 33cac2c. Configure here.}

[arvidn]

I don't think we should include chia-vdf-verify-c. We don't need C-bindings and we should not commit to maintaining them.

Likewise, we don't need python bindings for chia-vdf-verify and I don't think we should maintain them. Meaning not including the wheel directory.

[arvidn]

I think we should remove this. The fuzzer to compare the C implementation against the rust implementation should be a proper rust fuzzer (using libfuzzer). That would give use coverage guided fuzzing and probably more confidence (and performance)

[arvidn]

this doesn't look like something to keep. best case it should be a benchmark, but I don't think it's really relevant

[arvidn]

this is pretty big too, but in a more reasonable file format. I would expect this to be sufficient, and that we could remove the json files

[arvidn]

this file is in an odd location. typically rust source files are under src/. Does anything actually build and run this test?