feat!(ethexe): malachite

[grishasobol]

Closes #5434

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
ethexe/ethereum/abi/WrappedVara.json	100% smaller
ethexe/ethereum/abi/BatchMulticall.json	100% smaller
ethexe/ethereum/abi/POAMiddleware.json	99% smaller
ethexe/ethereum/abi/Middleware.json	99% smaller
ethexe/ethereum/abi/DemoCaller.json	98% smaller
ethexe/ethereum/abi/Gear.json	96% smaller
ethexe/ethereum/abi/Mirror.json	96% smaller
ethexe/sdk/src/mirror.rs	79% smaller
ethexe/db/src/visitor.rs	74% smaller
ethexe/observer/src/utils.rs	72% smaller
ethexe/prometheus/src/lib.rs	71% smaller
ethexe/processor/src/promise.rs	56% smaller
ethexe/db/src/iterator.rs	51% smaller
ethexe/ethereum/src/abi/gear.rs	51% smaller
ethexe/processor/src/lib.rs	48% smaller
ethexe/processor/src/handling/run/mod.rs	47% smaller
ethexe/rpc/src/tests.rs	46% smaller
ethexe/compute/src/prepare.rs	44% smaller
ethexe/common/src/gear.rs	40% smaller
ethexe/db/src/dump/collect.rs	40% smaller
ethexe/db/src/database.rs	39% smaller
ethexe/network/src/lib.rs	36% smaller
ethexe/ethereum/src/abi/events/router.rs	33% smaller
ethexe/network/src/validator/topic.rs	32% smaller
ethexe/processor/src/tests.rs	32% smaller
ethexe/rpc/src/apis/block.rs	28% smaller
ethexe/compute/src/service.rs	28% smaller
ethexe/processor/src/handling/overlaid.rs	27% smaller
ethexe/common/src/db.rs	27% smaller
ethexe/common/src/utils.rs	26% smaller
ethexe/consensus/src/validator/batch/types.rs	26% smaller
ethexe/common/src/consensus.rs	25% smaller
ethexe/db/src/verifier.rs	25% smaller
ethexe/common/src/injected.rs	24% smaller
ethexe/ethereum/src/router/mod.rs	23% smaller
ethexe/consensus/src/validator/batch/tests.rs	21% smaller
ethexe/consensus/src/validator/batch/manager.rs	21% smaller
ethexe/service/src/tests/utils/events.rs	20% smaller
ethexe/consensus/src/validator/batch/filler.rs	19% smaller
ethexe/cli/src/params/node.rs	18% smaller
ethexe/db/src/migrations/init.rs	18% smaller
ethexe/cli/src/commands/check.rs	16% smaller
ethexe/service/src/tests/utils/env.rs	14% smaller
ethexe/common/src/mock.rs	14% smaller
ethexe/rpc/src/apis/program.rs	13% smaller
ethexe/common/src/events/router.rs	13% smaller
ethexe/db/src/migrations/migration.rs	13% smaller
ethexe/common/src/lib.rs	12% smaller
ethexe/observer/src/lib.rs	12% smaller
ethexe/rpc/src/apis/injected/relay.rs	12% smaller
ethexe/consensus/src/validator/mod.rs	11% smaller
ethexe/compute/src/compute.rs	10% smaller
ethexe/network/src/db_sync/mod.rs	9% smaller
ethexe/network/src/db_sync/responses.rs	9% smaller
ethexe/consensus/src/validator/batch/utils.rs	9% smaller
ethexe/db/src/migrations/v5.rs	7% smaller
ethexe/service/src/tests/mod.rs	6% smaller
ethexe/consensus/src/validator/core.rs	6% smaller
ethexe/consensus/src/validator/coordinator.rs	5% smaller
ethexe/observer/src/sync.rs	4% smaller
ethexe/runtime/common/src/transitions.rs	4% smaller
ethexe/service/tests/smoke.rs	4% smaller
ethexe/common/src/network.rs	3% smaller
ethexe/consensus/src/utils.rs	3% smaller
ethexe/rpc/src/utils.rs	3% smaller
ethexe/network/src/db_sync/requests.rs	3% smaller
ethexe/service/src/config.rs	3% smaller
ethexe/common/src/primitives.rs	2% smaller
ethexe/consensus/src/validator/participant.rs	1% smaller
ethexe/node-loader/src/batch.rs	1% smaller
ethexe/cli/src/params/network.rs	1% smaller
ethexe/compute/src/tests.rs	1% smaller
ethexe/processor/src/handling/run/chunk_execution_spawn.rs	1% smaller
.config/nextest.toml	Unsupported file format
CLAUDE.md	Unsupported file format
Cargo.lock	Unsupported file format
Cargo.toml	Unsupported file format
ethexe/cli/Cargo.toml	Unsupported file format
ethexe/cli/src/commands/dump.rs	0% smaller
ethexe/cli/src/commands/malachite.rs	0% smaller
ethexe/cli/src/commands/mod.rs	0% smaller
ethexe/cli/src/params/malachite.rs	0% smaller
ethexe/cli/src/params/mod.rs	0% smaller
ethexe/common/src/malachite.rs	0% smaller
ethexe/compute/Cargo.toml	Unsupported file format
ethexe/compute/src/lib.rs	Unsupported file format
ethexe/consensus/Cargo.toml	Unsupported file format
ethexe/consensus/src/announces.rs	0% smaller
ethexe/consensus/src/connect/mod.rs	0% smaller
ethexe/consensus/src/lib.rs	Unsupported file format
ethexe/consensus/src/mock.rs	0% smaller
ethexe/consensus/src/tx_validation.rs	0% smaller
ethexe/consensus/src/validator/idle.rs	0% smaller
ethexe/consensus/src/validator/initial.rs	0% smaller
ethexe/consensus/src/validator/mock.rs	0% smaller
ethexe/consensus/src/validator/producer.rs	0% smaller
ethexe/consensus/src/validator/subordinate.rs	0% smaller
ethexe/consensus/src/validator/tx_pool.rs	0% smaller
ethexe/contracts/src/IRouter.sol	Unsupported file format
ethexe/contracts/src/Router.sol	Unsupported file format
ethexe/contracts/src/libraries/Gear.sol	Unsupported file format
ethexe/contracts/test/Base.t.sol	Unsupported file format
ethexe/db/Cargo.toml	Unsupported file format
ethexe/db/src/dump/mod.rs	0% smaller
ethexe/db/src/migrations/mod.rs	Unsupported file format
ethexe/db/src/migrations/v1.rs	0% smaller
ethexe/db/src/migrations/v2.rs	0% smaller
ethexe/db/src/migrations/v3.rs	0% smaller
ethexe/db/src/migrations/v4.rs	0% smaller
ethexe/ethereum/abi/Router.json	Unsupported file format
ethexe/ethereum/src/router/events.rs	Unsupported file format
ethexe/malachite/core/Cargo.toml	Unsupported file format
ethexe/malachite/core/src/app.rs	0% smaller
ethexe/malachite/core/src/codec.rs	Unsupported file format
ethexe/malachite/core/src/config.rs	0% smaller
ethexe/malachite/core/src/context.rs	0% smaller
ethexe/malachite/core/src/externalities.rs	0% smaller
ethexe/malachite/core/src/lib.rs	0% smaller
ethexe/malachite/core/src/service.rs	0% smaller
ethexe/malachite/core/src/signing.rs	0% smaller
ethexe/malachite/core/src/state.rs	0% smaller
ethexe/malachite/core/src/store.rs	0% smaller
ethexe/malachite/core/src/streaming.rs	0% smaller
ethexe/malachite/core/src/types.rs	0% smaller
ethexe/malachite/core/tests/multi_validators.rs	0% smaller
ethexe/malachite/service/Cargo.toml	Unsupported file format
ethexe/malachite/service/src/config.rs	0% smaller
ethexe/malachite/service/src/externalities.rs	0% smaller
ethexe/malachite/service/src/lib.rs	0% smaller
ethexe/malachite/service/src/mempool.rs	0% smaller
ethexe/malachite/service/src/quarantine.rs	0% smaller
ethexe/malachite/service/src/service.rs	0% smaller
ethexe/malachite/service/tests/restart_resilience.rs	0% smaller
ethexe/network/Cargo.toml	Unsupported file format
ethexe/observer/Cargo.toml	Unsupported file format
ethexe/observer/src/tests.rs	Unsupported file format
ethexe/rpc/src/apis/injected/promise_manager.rs	0% smaller
ethexe/rpc/src/apis/injected/server.rs	0% smaller
ethexe/rpc/src/lib.rs	0% smaller
ethexe/scripts/start-local-network.sh	Unsupported file format
ethexe/service/Cargo.toml	Unsupported file format
ethexe/service/src/fast_sync.rs	Unsupported file format
ethexe/service/src/lib.rs	Unsupported file format
ethexe/service/src/tests/utils/mod.rs	0% smaller

[grishasobol]

@claude opus review

[claude]

Claude finished @grishasobol's task in 4m 13s —— View job

---

Opus Review (2nd pass) — feat!(ethexe): malachite

Re-reviewing after 20 commits since the prior pass. Status of prior findings, plus what's still open.

---

Status of prior findings

#	Prior finding	Status
1	Silent Ok(()) in try_include_checkpoint_chain_commitment	partially fixed: last_committed_eb missing now hard-errors (utils.rs:301); block_header(advanced) missing and "didn't fit" path still silent — see below
2	SignedMagnitude::add_assign panic on overflow	unresolved (utils.rs:451)
3	unreachable! in update_inner Err path	unresolved (validator/mod.rs:171)
4	prepare_one_block non-atomic 2-write sequence	unresolved (prepare.rs:355-366)
5	Streaming reaper / PartStreamsMap unbounded	tracked: TODO #5473 with ignored regression test — acceptable
6	Checkpoint walk over-trusts peer-supplied last_advanced_eth_block	unresolved (same code path as #1)
7	Codex: regression of last_advanced_eb in validator path	fixed: is_strict_descendant_of enforced (externalities.rs:484-508) ✓

Also resolved during this revision: shape+ordering+gas-allowance check in validate_block_above, propose-timeout hang in app.rs (now drops reply sender on process_get_value error), checkpoint commitment loss on chain progress (cf45922), and the O(n²) batch-pack pass (5a90bb1).

---

severity: high — update_inner leaves inner = None on Err path

File: ethexe/consensus/src/validator/mod.rs:164-176

fn update_inner(&mut self, update: impl FnOnce(ValidatorState) -> Result<ValidatorState>) -> Result<()> {
    let inner = self.inner.take().unwrap_or_else(|| unreachable!("inner must be Some"));
    update(inner).map(|inner| { self.inner = Some(inner); })
}

take() consumes inner. When update(...) returns Err, the closure's .map is never invoked and self.inner stays None. The next context() / context_mut() call (e.g. lines 153, 160 or via role() at 181) hits unreachable!.

Every ConsensusService method (receive_new_chain_head, receive_synced_block, receive_prepared_block, receive_validation_request, receive_validation_reply) routes through update_inner with closures that propagate ? from DB and protocol code — any of those errors poisons the validator. The first error bubbles up cleanly; the second event the consumer dispatches panics in unreachable! instead of returning a clean error.

Either restore inner on the Err path (mem::replace with a sentinel Faulted state) or refactor the closure to (ValidatorState, Result<()>) so the state is always restored. The TODO note in Idle already hints that a permanently-faulted state is expected.

severity: high — SignedMagnitude::add_assign panics on adversarial transition aggregation

File: ethexe/consensus/src/validator/batch/utils.rs:447-452

fn add_assign(&mut self, other: Self, actor_id: ActorId) {
    match self.negative == other.negative {
        true => {
            self.value = self.value.checked_add(other.value).unwrap_or_else(|| {
                panic!("squashed transition value overflow for actor {actor_id:?}")
            });
        }

Reachable via squash_transitions_by_actor over StateTransitions sourced from MB payloads that the coordinator did not author. The current unit test test_squash_value_overflow_panics documents the panic — in production code path this means every honest participant crashes on the same input. Convert to Result and reject the offending commitment instead of crashing the validator process.

severity: medium — silent Ok(()) on missing block_header(advanced)

File: ethexe/consensus/src/validator/batch/utils.rs:291-297

let advanced = db.mb_meta(mb_head).last_advanced_eb;
if advanced.is_zero() { return Ok(()); }
let Some(advanced_header) = db.block_header(advanced) else {
    return Ok(());                       // silent skip
};

Inconsistent with the new hard-error at 301-303 (last_committed_eb missing despite prepared==true). By construction, if mb_meta(mb_head).last_advanced_eb is non-zero, the MB observed that EB during proposal/finalize (see EthexeExternalities::process_mb_proposal setting meta.last_advanced_eb = last_advanced), so the header must be locally present. A None here is the same invariant violation class — hard-error to surface real bugs.

Separately at lines 327-330, when the chain commitment doesn't fit:

if let Err(err) = batch_filler.include_chain_commitment(commitment) {
    tracing::trace!("checkpoint chain commitment didn't fit (...)");
}

If uncommitted_chain_len_threshold is later breached for this reason, validators will reject the next coordinator's batches and the network stalls with only a trace! to debug from. At minimum warn!, and consider surfacing as a BatchFillerError variant so the coordinator can choose a smaller payload.

severity: medium — prepare_one_block writes block-meta and globals non-atomically

File: ethexe/compute/src/prepare.rs:355-366

db.mutate_block_meta(block.hash, |meta| {
    meta.prepared = true;
    /* ... */
});
db.globals_mutate(|globals| {
    globals.latest_prepared_eb_hash = block.hash;
});

Two separate RocksDB writes. If the process dies between them, block_meta(at).prepared == true but globals.latest_prepared_eb_hash lags. Downstream code (Idle::process_prepared_block, the validator's coordinator selection at idle.rs:99-on) keys off prepared, so a recovery walk seeing prepared==true could pick a block ahead of latest_prepared_eb_hash. Use a single batch-write or document the recovery contract.

severity: low — TxValidityChecker::check_tx_validity bails on local-state miss inside producer loop

File: ethexe/malachite/service/src/tx_validity.rs:173-179

let Some(state) = self.db.program_state(destination_state_hash.hash) else {
    anyhow::bail!("program state not found for actor({}) by valid hash({})", ...);
};

In build_block_above (externalities.rs:270) this ? propagates and the proposer fails to produce a block for this round. The hash came from latest_states which the checker just loaded, so the only way to hit this is a transient lookup race (or DB corruption). The current behavior — abort the round, let the engine rotate — is probably fine, but worth a comment noting that bail is intentional and the alternative (skip the tx) was rejected.

severity: low — eb_touched_programs walk is intentionally unbounded but lacks a soft cap

File: ethexe/malachite/service/src/tx_validity.rs:328-346

The comment is candid: "The walk is intentionally unbounded ... bailing at start_block_hash is the safe fallback." Under a reorg deeper than canonical_quarantine, the walk runs from advanced_eb back to start_block_hash accumulating into chain: Vec<H256>. That's a one-shot O(chain_depth) allocation, not a persistent leak, but it's worth a defense-in-depth MAX_EB_WALK_DEPTH that errors rather than silently allocating an enormous Vec. Especially given this runs inside both validate_block_above and build_block_above per proposal.

---

Verified clean

• is_strict_descendant_of is now enforced on the validator path for AdvanceTillEthereumBlock (externalities.rs:484-508) — closes Codex's previous concern.
• Genesis parent_hash sentinel (H256::zero() for height 1) is consistent — app.rs:376-388 only consults the store when height > 1, and store.rs/externalities.rs consistently treat zero as "pre-genesis".
• TODOs marked +_+_+ are now linked to tracking issues (ethexe-malachite: PartStreamsMap has no caps, single peer can exhaust memory #5473, ethexe-malachite: add per-peer rate limit on ReceivedProposalPart #5475, ethexe-malachite: verify ProposalFin signature before buffering future-height parts #5476, ethexe-malachite: extract shared helper for producer/validator EB-advance check #5477, ethexe-malachite: emit metrics for validate_block_above abstains #5479, ethexe-malachite: gate ReceivedProposalPart on validator peer-id allowlist #5480) — good follow-up hygiene.
• Test coverage for the previously-flagged corner cases (validate_rejects_advance_that_regresses_last_advanced_eb, part_streams_map_grows_unbounded_under_fin_sequence_attack, buffered_future_proposal_is_saved_on_promotion, the empty-checkpoint regression) is present in the right places.

Spot-checks worth adding before merge

1. A state-machine test that drives update_inner through an Err closure and then dispatches a follow-up event — currently panics with unreachable!.
2. A property test on SignedMagnitude::add_assign with adversarial inputs; assert no panic.
3. A test where mb_meta(mb_head).last_advanced_eb is set but the corresponding block_header is purged — current behavior emits no checkpoint and reports success.

---

• Re-fetch branch & survey changes since last opus review
• Verify status of prior opus findings
• Read malachite/core + consensus/validator/batch in detail
• Check new findings (atomicity, streaming reaper, EB regression)
• Post final review
  · branch gsobol/ethexe/malachite-new

[ark0f]

What does this even mean?

[ark0f]

This literally has nothing to do with buckets

[ark0f]

mock(()) or arb_value::<T>() should be used instead

[ark0f]

pub use and use must not be mixed in imports

[ark0f]

<< is rudimentary way to calculate power of 2. Use pow instead.

[ark0f]

No need for Once

[ark0f]

Imports are always at the top

[ark0f]

Suggested change

	fn arb_churn_events(
	fn churn_events_strategy(

The strategy has nothing to do with aribtrary crate

[ark0f]

Suggested change

	let Some(msg) = self.channels.consensus.recv().await else {
	return Err(anyhow!("consensus channel closed"));
	};
	let msg = self.channels.consensus.recv().await.context("consensus channel closed")?;

[ark0f]

https://rust-lang.github.io/api-guidelines/naming.html
Type parameters: concise UpperCamelCase, usually single uppercase letter: T

Suggested change

	impl<P, EXT> AppMsgHandler<P, EXT>
	impl<P, Ext> AppMsgHandler<P, Ext>