release/v1.4.0: new release w/ bug fixes

[dmitry123]

Release name: MITHRIDATE

Summary

This release focuses on security and correctness hardening across release artifact provenance, runtime resource limits, Solidity ABI/codec compatibility, and system contracts. It adds fail-closed authentication for genesis and runtime-upgrade inputs, closes multiple untrusted-input edge cases, and expands regression coverage across the affected components.

Genesis Upgrade

The genesis/runtime upgrade must deploy these changed system contracts:

• PRECOMPILE_EIP7951 — switch P256 verification to the Osaka EIP-7951 implementation, use the Osaka gas schedule, and return the canonical 32-byte success value.
• PRECOMPILE_EVM_RUNTIME — include the updated EVM execution path, notably safe zero-length EXTCODECOPY handling, while keeping runtime semantics explicitly pinned to Osaka.
• PRECOMPILE_FEE_MANAGER — reject ownership transfers to the zero address so an empty owner slot cannot reactivate the genesis bootstrap authority.
• PRECOMPILE_RUNTIME_UPGRADE — clear planned-upgrade authority during ownership transitions and emit the actual installed code hash for canonical precompile upgrades.
• PRECOMPILE_UNIVERSAL_TOKEN_RUNTIME — reject non-canonical creation payloads, oversized metadata, and malformed UTF-8 before invalid metadata can be persisted or returned.
• PRECOMPILE_WEBAUTHN_VERIFIER — parse clientDataJSON structurally, reject duplicate or malformed fields and decoy values, and update the verifyStrict selector after removing caller-provided originIndex.

Changes

Release integrity and build pipeline

• Add the fluentbase-release-verify crate for bounded loading and fail-closed verification of release assets using the pinned OpenPGP key, detached signatures, signed manifests, and SHA-256 digests.
• Authenticate built-in devnet, testnet, and mainnet genesis assets before use, including cached artifacts, and add CI verification for the published assets.
• Authenticate runtime-upgrade genesis inputs before loading the operator wallet or constructing transactions; support release channels and record verified provenance in generated manifests.
• Share the bounded release fetcher and reject oversized downloads or decompressed genesis payloads.
• Require contract builder images to resolve to an immutable registry digest, re-check the image before execution, and allow unverified locally built images only for explicit dry runs.
• Ignore local graphify-out/ artifacts.

Runtime, EVM, and precompiles

• Cap aggregate linear memory retained by live nested contract frames at 1.5 GiB while preserving full-depth execution for ordinary contracts.
• Add coverage for initial-memory fuel charging and update runtime regressions for the rWasm upgrade.
• Fix Ed25519 point addition to write the result to the first operand pointer.
• Handle zero-length resumed EXTCODECOPY without rejecting an otherwise irrelevant unrepresentable memory offset.
• Charge the EIP-7951 P256 verification gas cost.
• Document the delegated EVM runtime's Osaka pin, zero-valued blob opcodes, and the intentional runtime-upgrade exemption from Wasm/rWasm deployment size limits.

Codec, SDK, ABI, and generated clients

• Validate collection bodies before allocation and require complete aligned words when decoding integer values, returning errors instead of panicking on truncated input.
• Add Solidity-compatible event topic encoding, including indexed reference-type hashing and top-level event-data semantics.
• Resolve struct components before selector hashing so generated routers and published ABIs agree, and key ABI structs by module path for deterministic artifacts.
• Reject unsupported Solidity functions and parameters at compile time and propagate mutability correctly through generated interfaces.
• Generate static calls for view and pure methods and prevent value from being attached to non-payable calls.
• Use Solidity-compatible padding for signed and fixed-bytes mapping keys.
• Widen StorageVec index arithmetic to U256 so large indices cannot wrap and alias earlier elements.

System contracts

• Reject non-canonical universal-token creation payloads before persisting metadata; reject oversized metadata and return errors for malformed UTF-8 reads.
• Parse WebAuthn clientDataJSON structurally in strict verification instead of matching caller-selected substrings.
• Reject zero-address ownership transfers in the fee manager.
• Revoke planned runtime-upgrade authority on ownership transitions.
• Emit the installed code hash for canonical precompile upgrades.

Tests

• Add focused unit, snapshot, and end-to-end regressions for release verification, Docker image provenance, runtime memory limits, codec bounds, ABI generation, event topics, universal-token metadata, WebAuthn verification, runtime upgrades, EIP-7951 gas accounting, fee-manager ownership, EVM behavior, and account updates.

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 107 files, which is 7 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 707997a4-5fc9-4e09-ac01-d68ccb4d8615

📥 Commits

Reviewing files that changed from the base of the PR and between 4a662b7 and eb30fd4.

⛔ Files ignored due to path filters (17)

• Cargo.lock is excluded by !**/*.lock
• contracts/Cargo.lock is excluded by !**/*.lock
• crates/codec-derive/src/snapshots/fluentbase_codec_derive__tests__empty_struct.snap is excluded by !**/*.snap
• crates/codec-derive/src/snapshots/fluentbase_codec_derive__tests__generic_struct.snap is excluded by !**/*.snap
• crates/codec-derive/src/snapshots/fluentbase_codec_derive__tests__simple_struct.snap is excluded by !**/*.snap
• crates/codec-derive/src/snapshots/fluentbase_codec_derive__tests__single_field_struct.snap is excluded by !**/*.snap
• crates/sdk-derive/derive-core/src/snapshots/fluentbase_sdk_derive_core__client__tests__generate_client.snap is excluded by !**/*.snap
• crates/sdk-derive/derive-core/src/snapshots/fluentbase_sdk_derive_core__event__tests__all_indexed.snap is excluded by !**/*.snap
• crates/sdk-derive/derive-core/src/snapshots/fluentbase_sdk_derive_core__event__tests__anonymous.snap is excluded by !**/*.snap
• crates/sdk-derive/derive-core/src/snapshots/fluentbase_sdk_derive_core__event__tests__basic_transfer.snap is excluded by !**/*.snap
• crates/sdk-derive/derive-core/src/snapshots/fluentbase_sdk_derive_core__event__tests__dynamic_indexed.snap is excluded by !**/*.snap
• crates/sdk-derive/derive-core/src/snapshots/fluentbase_sdk_derive_core__event__tests__mixed_static_dynamic_data.snap is excluded by !**/*.snap
• crates/sdk-derive/derive-core/src/snapshots/fluentbase_sdk_derive_core__event__tests__no_indexed.snap is excluded by !**/*.snap
• crates/sdk-derive/derive-core/src/snapshots/fluentbase_sdk_derive_core__sol_input__tests__sol_to_rust_trait_full_surface.snap is excluded by !**/*.snap
• crates/sdk-derive/derive-core/src/snapshots/fluentbase_sdk_derive_core__sol_input__tests__sol_to_sol_client_nested_struct.snap is excluded by !**/*.snap
• evm-e2e/Cargo.lock is excluded by !**/*.lock
• examples/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (107)

• .github/scripts/verify-built-in-genesis.sh
• .github/workflows/ci.yml
• .github/workflows/release.yml
• .gitignore
• Cargo.toml
• bins/runtime-upgrade/Cargo.toml
• bins/runtime-upgrade/main.rs
• bins/runtime-upgrade/provenance.rs
• contracts/Cargo.toml
• contracts/eip7951/src/lib.rs
• contracts/evm/src/lib.rs
• contracts/fee-manager/src/lib.rs
• contracts/runtime-upgrade/Cargo.toml
• contracts/runtime-upgrade/README.md
• contracts/runtime-upgrade/src/lib.rs
• contracts/runtime-upgrade/src/tests.rs
• contracts/universal-token/src/lib.rs
• contracts/universal-token/src/tests.rs
• contracts/webauthn/README.md
• contracts/webauthn/src/client_data.rs
• contracts/webauthn/src/lib.rs
• contracts/webauthn/src/webauthn.rs
• crates/build/src/build.rs
• crates/build/src/docker.rs
• crates/build/src/generators/metadata.rs
• crates/build/src/generators/mod.rs
• crates/build/src/generators/solidity.rs
• crates/build/src/generators/struct_parser.rs
• crates/build/src/lib.rs
• crates/build/tests/abi_generation.rs
• crates/build/tests/docker_image_verification.rs
• crates/codec-derive/src/lib.rs
• crates/codec/src/bytes_codec.rs
• crates/codec/src/encoder.rs
• crates/codec/src/hash.rs
• crates/codec/src/lib.rs
• crates/codec/src/primitive.rs
• crates/codec/src/topic.rs
• crates/codec/src/vec.rs
• crates/codec/tests/topic.rs
• crates/contracts/build.rs
• crates/evm/src/evm.rs
• crates/evm/src/host.rs
• crates/evm/src/opcodes.rs
• crates/evm/src/utils.rs
• crates/node/Cargo.toml
• crates/node/src/chainspec.rs
• crates/node/src/utils.rs
• crates/release-verify/Cargo.toml
• crates/release-verify/src/asset.rs
• crates/release-verify/src/error.rs
• crates/release-verify/src/http.rs
• crates/release-verify/src/key.rs
• crates/release-verify/src/lib.rs
• crates/release-verify/src/load.rs
• crates/release-verify/src/manifest.rs
• crates/release-verify/src/signature.rs
• crates/release-verify/src/test_support.rs
• crates/release-verify/src/tests.rs
• crates/release-verify/testdata/genesis-mainnet-v1.0.0.json.gz.asc
• crates/release-verify/testdata/genesis-manifest-v1.3.2.txt
• crates/release-verify/testdata/genesis-manifest-v1.3.2.txt.asc
• crates/release-verify/testdata/genesis-v0.3.4-dev.json.gz.asc
• crates/release-verify/testdata/genesis-v0.5.7.json.gz.asc
• crates/revm/src/evm.rs
• crates/revm/src/executor.rs
• crates/revm/src/syscall.rs
• crates/runtime/src/executor.rs
• crates/runtime/src/runtime.rs
• crates/runtime/src/runtime/contract_runtime.rs
• crates/runtime/src/syscall_handler/edwards/edwards_add.rs
• crates/sdk-derive/derive-core/Cargo.toml
• crates/sdk-derive/derive-core/src/abi/constructor.rs
• crates/sdk-derive/derive-core/src/abi/error.rs
• crates/sdk-derive/derive-core/src/abi/function.rs
• crates/sdk-derive/derive-core/src/abi/mod.rs
• crates/sdk-derive/derive-core/src/abi/parameter.rs
• crates/sdk-derive/derive-core/src/abi/structs.rs
• crates/sdk-derive/derive-core/src/attr/mod.rs
• crates/sdk-derive/derive-core/src/attr/state_mutability.rs
• crates/sdk-derive/derive-core/src/client.rs
• crates/sdk-derive/derive-core/src/codec.rs
• crates/sdk-derive/derive-core/src/constructor.rs
• crates/sdk-derive/derive-core/src/event.rs
• crates/sdk-derive/derive-core/src/lib.rs
• crates/sdk-derive/derive-core/src/method.rs
• crates/sdk-derive/derive-core/src/router.rs
• crates/sdk-derive/derive-core/src/signature.rs
• crates/sdk-derive/derive-core/src/sol_input.rs
• crates/sdk-derive/docs/client.md
• crates/sdk-derive/docs/solidity_client.md
• crates/sdk-derive/src/lib.rs
• crates/sdk/src/storage/map.rs
• crates/sdk/src/storage/primitive.rs
• crates/sdk/src/storage/vec.rs
• crates/sdk/src/types/context.rs
• crates/sdk/src/types/storage.rs
• crates/sdk/src/universal_token.rs
• crates/sdk/src/universal_token/storage.rs
• crates/types/src/lib.rs
• e2e/src/builtins.rs
• e2e/src/ddos.rs
• e2e/src/eip7951.rs
• e2e/src/evm.rs
• e2e/src/fee_manager.rs
• e2e/src/lib.rs
• e2e/src/update_account.rs

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Criterion results (vs baseline)

running 131 tests

Heads-up: runner perf is noisy; treat deltas as a smoke check.