evmone v0.25.0

capi.cpp

@@ -14,18 +14,18 @@ int evmone_capi_ec_add(
     unsigned char* out,
     const unsigned char* x_in,
     const unsigned char* y_in) {
-    const auto x = evmmax::bn254::AffinePoint::from_bytes(
+    const auto x = evmone::crypto::bn254::AffinePoint::from_bytes(
         std::span<const uint8_t, 64>{x_in, 64});
-    const auto y = evmmax::bn254::AffinePoint::from_bytes(
+    const auto y = evmone::crypto::bn254::AffinePoint::from_bytes(
         std::span<const uint8_t, 64>{y_in, 64});
 
     if (!x.has_value() || !y.has_value())
         return 0;
 
-    if (!evmmax::bn254::validate(*x) || !evmmax::bn254::validate(*y))
+    if (!evmone::crypto::bn254::validate(*x) || !evmone::crypto::bn254::validate(*y))
         return 0;
 
-    const auto res = evmmax::ecc::add_affine(*x, *y);
+    const auto res = evmone::crypto::ecc::add_affine(*x, *y);
     res.to_bytes(std::span<uint8_t, 64>{out, 64});
     return 1;
 }

evmone/.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 0.23.0
+current_version = 0.25.0
 tag = True
 sign_tags = True
 tag_message = evmone {new_version}

evmone/.github/workflows/codspeed.yml

@@ -0,0 +1,111 @@
+# evmone: Fast Ethereum Virtual Machine implementation
+# Copyright 2026 The evmone Authors.
+# SPDX-License-Identifier: Apache-2.0
+
+name: CodSpeed
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+  # `workflow_dispatch` allows CodSpeed to trigger backtest
+  # performance analysis in order to generate initial data.
+  workflow_dispatch:
+
+env:
+  BUILD_DIR: build
+  CMAKE_BUILD_PARALLEL_LEVEL: 4
+  # The newest GCC on the ubuntu-24.04 image, which otherwise defaults to GCC 13.
+  CC: gcc-14
+  CXX: g++-14
+  # A benchmark is identified by the name of the fixture it ran, so a release which renames
+  # the fixtures starts the series over. Bump this deliberately, with the archive's digest.
+  BENCHMARK_FIXTURES_RELEASE: benchmark@v0.0.7
+  BENCHMARK_FIXTURES_SHA256: efa7cbec58bedab28870e260eca1f5271b1c3d81c952f221ba6432bff88fee5d
+  FIXTURES: fixtures/blockchain_tests/benchmark
+
+jobs:
+  benchmark:
+    name: Benchmark ${{ matrix.name }}
+    # CodSpeed ships its instrumented Valgrind for Ubuntu 22.04, Ubuntu 24.04 and Debian 12 only,
+    # and bails out with "Unsupported system" anywhere else, so the image cannot be `latest`.
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read # required for actions/checkout
+      id-token: write # required for OIDC authentication with CodSpeed
+    strategy:
+      fail-fast: false
+      # CodSpeed merges the jobs of a workflow run into one report, but rejects too many
+      # benchmarks in a single upload (750 were), so the fixtures are split into jobs. Two sweeps
+      # measured elsewhere are left out: modexp.json (the precompiles benchmark sweeps it) and
+      # log_benchmark.json (log.json sweeps the same opcodes).
+      matrix:
+        include:
+          - name: evmone
+            # The precompiles benchmark runs both the mainnet inputs and the modexp parameter sweep:
+            # the mainnet moduli are all odd and 256-bit, so they cover one code path and hide the
+            # work on the others.
+            run: >-
+              $BUILD_DIR/bin/evmone-bench test/evm-benchmarks/benchmarks --benchmark_filter='baseline/(analyse|execute)' &&
+              $BUILD_DIR/bin/evmone-precompiles-bench
+          # The worst-case blocks of the execution spec tests, run as the tests they are: each
+          # checks its post state and is measured on the way. Every one is filled for seven block
+          # sizes and the smallest is taken, covering all in a fraction of the simulator time.
+          - name: instruction
+            fixtures: compute/instruction
+            run: >-
+              $BUILD_DIR/bin/evmone test $FIXTURES/compute/instruction -k benchmark-gas-value_1M
+              --ignore call_context --ignore account_query --ignore log/log_benchmark.json
+          - name: instruction/call_context
+            fixtures: compute/instruction/call_context
+            run: $BUILD_DIR/bin/evmone test $FIXTURES/compute/instruction/call_context -k benchmark-gas-value_1M
+          - name: instruction/account_query
+            fixtures: compute/instruction/account_query
+            run: $BUILD_DIR/bin/evmone test $FIXTURES/compute/instruction/account_query -k benchmark-gas-value_1M
+          - name: precompile
+            fixtures: compute/precompile
+            run: $BUILD_DIR/bin/evmone test $FIXTURES/compute/precompile -k benchmark-gas-value_1M --ignore modexp/modexp.json
+          - name: scenario
+            fixtures: compute/scenario
+            run: $BUILD_DIR/bin/evmone test $FIXTURES/compute/scenario -k benchmark-gas-value_1M
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          submodules: recursive
+
+      - name: Install GMP
+        run: sudo apt-get -q update && sudo apt-get -qy install libgmp-dev
+
+      - name: Configure
+        # The Release build type keeps the -O3 optimizations on, -g adds the debug information
+        # needed by CodSpeed to attribute the measurements to the source code. CodSpeed recommends
+        # (and warns about) RelWithDebInfo, but that would downgrade the optimizations to -O2.
+        run: >
+          cmake -S . -B $BUILD_DIR
+          -DCMAKE_BUILD_TYPE=Release
+          -DCMAKE_C_FLAGS=-g
+          -DCMAKE_CXX_FLAGS=-g
+          -DBUILD_SHARED_LIBS=OFF
+          -DEVMONE_TESTING=ON
+          -DEVMONE_PRECOMPILES_GMP=ON
+          -DEVMONE_PRECOMPILES_LIBSECP256K1=ON
+          -DCODSPEED_MODE=simulation
+
+      - name: Build
+        run: cmake --build $BUILD_DIR --target evmone-bench evmone-precompiles-bench evmone-cli
+
+      # Only the job's own fixtures are unpacked.
+      - name: Download the benchmark fixtures
+        if: matrix.fixtures
+        run: |
+          curl -L --fail --retry 3 --output-dir /tmp -O \
+            https://github.com/ethereum/execution-spec-tests/releases/download/$BENCHMARK_FIXTURES_RELEASE/fixtures_benchmark.tar.gz
+          echo "$BENCHMARK_FIXTURES_SHA256  /tmp/fixtures_benchmark.tar.gz" | sha256sum -c
+          tar -xzf /tmp/fixtures_benchmark.tar.gz $FIXTURES/${{ matrix.fixtures }}
+
+      - name: Benchmark
+        uses: CodSpeedHQ/action@v5
+        with:
+          mode: simulation
+          run: ${{ matrix.run }}

evmone/AGENTS.md

@@ -2,54 +2,22 @@
 
 ## Review guidelines
 
-When reviewing changes (code, tests, build scripts, documentation, workflows), expand the review beyond correctness and style. Actively look for:
+evmone implements the Ethereum execution specification, so any divergence from it is a consensus bug and outranks every other finding. Compare against the latest merged EIPs and ethereum/execution-specs, not only the released test fixtures, which lag them.
 
-### Vulnerabilities
-- Injection risks (SQL/command/template), unsafe string handling, path traversal, deserialization hazards.
-- Memory-safety issues (OOB reads/writes, use-after-free patterns, integer overflow/underflow, uninitialized data).
-- Crypto misuse (non-constant-time operations on secrets, weak randomness, incorrect nonce handling, missing domain separation, insecure parameters).
-- Authentication/authorization gaps, privilege escalation paths, and broken access controls.
-- Supply-chain risks (unpinned dependencies, unsafe download/exec patterns, overly broad CI permissions).
+Also look for:
+- Attacker-controlled inputs (bytecode, transactions, precompile inputs) that cause a crash, undefined behavior, or work not bounded by the gas charged.
+- Off-by-one, sign/width, and overflow errors, especially in shifts, carries/borrows, and limb arithmetic.
+- Word-size assumptions (CI also builds 32-bit x86 and riscv32).
+- Unpinned or unverified downloads and overly broad permissions in CI workflows.
+- Non-obvious invariants that no `assert` pins.
 
-### Security regressions
-- Changes that weaken previous security properties (e.g., removal of validation, relaxed checks, reduced entropy, widened accepted inputs).
-- New feature flags or configuration paths that silently disable protections.
-- Debug/diagnostic code that could leak secrets or sensitive data in logs, metrics, crashes, or error messages.
+Behavioral coverage comes from the execution-specs tests, which CI runs on every PR. Suggest a unit test only for what they cannot pin; behavior they miss is a gap in those tests, not a missing unit test.
 
-### Safety issues
-- Unexpected behavior under malformed, adversarial, or extreme inputs (fuzz-like thinking).
-- Denial-of-service vectors (algorithmic complexity, unbounded loops/recursion, large allocations, input-triggered worst cases).
-- Concurrency hazards (data races, deadlocks, TOCTOU, improper locking/atomic usage).
-- Resource handling (file descriptors, handles, memory, temporary files, cleanup on error paths).
+evmone deliberately implements the simplest code for the current specification, so hardcoded current constants, missing extension points for future EIPs, and missing fast paths for degenerate inputs are not findings. Suggest maintainability changes only when they reduce bug risk.
 
-### Correctness bugs
-- Off-by-one errors, boundary conditions, and sign/width issues (especially around shifts, carries/borrows, and limb arithmetic).
-- Undefined/implementation-defined behavior (C/C++), especially shifts, aliasing, and overflow.
-- Error handling and propagation: ensure failures are detected, returned, and tested.
-- Cross-platform/endianness/word-size assumptions that may break on other targets.
+## Building and testing
 
-### What to include in review feedback
-- Call out risks explicitly and suggest mitigations or tests.
-- Recommend additional unit tests, property tests, fuzzing targets, or negative tests where appropriate.
-- Suggest clarity/maintainability improvements when they reduce future bug risk.
-- Flag any unclear invariants, missing comments, or undocumented assumptions.
+Out-of-source CMake builds live under `build/`. If one exists, build it directly, e.g. `cmake --build build/debug`.
 
-Other suggestions and improvements are welcome as long as they are constructive, actionable, and help improve quality, security, and maintainability.
-
-## Building
-
-This repository uses out-of-source CMake builds. Common build directories live under `build/`, e.g.:
-
-- `build/debug`
-- `build/release`
-
-If a build directory already exists, build it directly:
-
-- `cmake --build build/debug`
-
-## Testing
-
-All tests can be run via CTest. Make sure the build is up to date.
-
-- `ctest --test-dir build/debug --output-on-failure`
-- to filter tests use `-R <regex>`
+- Unit and integration tests: `ctest --test-dir build/debug --output-on-failure` (filter with `-R <regex>`).
+- execution-specs tests: `build/debug/bin/evmone test <fixtures>/state_tests <fixtures>/blockchain_tests`, with the fixtures from the ethereum/execution-specs releases.