[DONT MERGE] Seismic => upstream diff

[cdrappi]

No description provided.

[github-actions]

PR Review Summary

Changes

This PR ([DONT MERGE] Seismic => upstream diff) captures the full delta between the seismic branch and upstream main — 527 files changed, +50k/-5.8k lines. It introduces Seismic-specific crates for chainspec, hardforks, EVM execution, txpool, RPC, payload building, node orchestration, and enclave/TEE integration for confidential transactions (type 0x4A).

---

Blocking Issues

1. try_build_and_sign is a stub returning a garbage transaction
File: crates/seismic/rpc/src/eth/mod.rs (~lines 100–130)

try_build_and_sign silently returns a hardcoded legacy tx with zeroed signature (Signature::new(U256::ZERO, U256::ZERO, false)) and zeroed hash (B256::ZERO), ignoring both the signer and the actual input. This is indistinguishable from a real result at the type level — callers have no way to detect the stub. Replace with unimplemented!() or a compile error until properly implemented.

---

2. Hardcoded RngMode::Execution with explicit warning comment
File: crates/seismic/primitives/src/transaction/signed.rs (~line 195)

let rng_mode = RngMode::Execution; // TODO WARNING: chose a default value

The comment itself flags this as a known incorrect default. RngMode controls how the seismic EVM RNG is seeded — using Execution unconditionally in from_recovered_tx (which is called from simulation, pending-block, and call paths) will cause divergence between simulation and actual execution results. This must be resolved before merge.

---

3. Debug log of full consensus tx (potentially including input) in payload builder
File: crates/seismic/payload/src/builder.rs (~line 202)

debug!("default_seismic_payload: tx: {:?}", tx);  // tx is full SeismicTransactionSigned

Missing target: qualifier and formats the entire consensus transaction via {:?}, which may include the encrypted input field. If from_recovered_tx has decrypted the payload by this point, this logs plaintext calldata. Remove or replace with a hash-only log.

---

4. Debug log of full recovered transaction (ciphertext + sender) in send_raw_transaction
File: crates/seismic/rpc/src/eth/transaction.rs (~line 37)

tracing::debug!(target: "reth-seismic-rpc::eth", ?recovered, "serving seismic_eth_api::send_raw_transaction");

?recovered formats the full Recovered<SeismicTransactionSigned> — sender address, nonce, encryption pubkey, and ciphertext body — on every eth_sendRawTransaction call. Replace with:

tracing::debug!(target: "reth-seismic-rpc::eth", tx_hash=%recovered.tx_hash(), sender=%recovered.signer(), "serving seismic_eth_api::send_raw_transaction");

---

5. Debug log of full TxEnv (potentially post-decryption) in eth_call
File: crates/seismic/rpc/src/eth/call.rs (~line 175)

tracing::debug!("reth-seismic-rpc::eth create_txn_env {:?}", env);

Missing target: qualifier and logs the full TxEnv including the data field. For seismic call paths, signed_read_to_plaintext_tx may have already decrypted the calldata before this log fires — making this a potential plaintext leak in a hot path. Remove this log.

---

6. Debug log of full SeismicTransaction<TxEnv> in execution hot path
File: crates/seismic/primitives/src/transaction/signed.rs (~line 322)

tracing::debug!("from_recovered_tx: tx: {:?}", tx);

from_recovered_tx is called during EVM execution. By the time this log fires, data in the TxEnv may be decrypted calldata. This fires on every transaction execution. Remove entirely.

---

7. Mock enclave server gated only by runtime CLI flag, not compile-time feature
File: crates/seismic/node/src/enclave.rs (~lines 22–33)

The mock server and all get_unsecure_sample_* code paths are reachable in production binaries — a single --enclave.mock-server flag enables them. An operator misconfiguration or deployment error would silently use mock keys in production. Gate the mock server behind a compile-time feature flag:

#[cfg(any(test, feature = "mock-enclave"))]
if config.mock_server { ... }

Emit a compile error if mock-enclave is enabled on a release build.

---

Suggestions

1. SEISMIC_DEV_OLD / dev-old chain spec should be removed — crates/seismic/chainspec/src/lib.rs. Has a TODO comment "remove once we launch devnet with consensus". Dead code that increases attack surface and creates confusion about which chain spec is canonical.

2. Hardcoded Anvil keys in genesis manifest — crates/seismic/chainspec/res/genesis/manifest.toml line ~30 has a TODO acknowledging Anvil keys are hardcoded. Ensure this file is excluded from any non-dev genesis derivation pipeline.

3. RwLock poison recovery should emit a warning — crates/seismic/txpool/src/validator.rs lines ~163, 180, 201 use unwrap_or_else(|e| e.into_inner()) on poisoned locks. The fail-open behavior for expiration checks (recovered cache has current_block_number = 0, so all expiry checks pass) should at minimum log a warn! or error! when poison recovery occurs.

4. validate_signed_read_for_write allows signed_read = true on contract creation — crates/seismic/txpool/src/validator.rs. The check rejects signed_read for non-create calls but silently allows it for deploys. If signed reads are intended only for read-only calls this is a bug; if deploying with signed_read is intentional, add a comment.

5. Error codes are placeholders — crates/seismic/rpc/src/eth/ext.rs lines ~335, 344 use -32000 with a TODO comment. Assign specific codes in the -32099 to -32001 range so callers can distinguish decryption/encryption errors from generic server errors.

6. debug! in ext.rs logs full raw transaction bytes — crates/seismic/rpc/src/eth/ext.rs line ~296 logs full SeismicRawTxRequest (ciphertext bytes). Replace with size and variant only.

7. eth_call and eth_estimateGas debug logs leak full request — crates/seismic/rpc/src/eth/ext.rs lines ~258, 314 log full SeismicCallRequest / SeismicTransactionRequest including input bytes and from field on every call. Replace with summary logs.

8. Test utilities not gated by #[cfg(test)] — crates/seismic/node/src/utils.rs exposes pub mod test_utils with allow(clippy::unwrap_used) but is reachable in production builds. Gate with #[cfg(any(test, feature = "test-utils"))].

9. evm_env hardcodes SeismicSpecId::MERCURY — crates/seismic/evm/src/lib.rs lines ~125–127 have a TODO to use the correct spec. Acceptable for now but must be wired up before introducing new hardforks.

10. println! in proptest — crates/seismic/primitives/src/transaction/signed.rs line ~836 has a bare println! inside a proptest. Remove to avoid noisy test output.

---

Positive Notes

• Architecture follows reth patterns cleanly. Each seismic concern is a separate crate (chainspec, hardforks, evm, txpool, rpc, payload, node) with clean boundaries. Upstream types are extended via traits rather than forked.
• Purpose key management is correct. The OnceLock<GetPurposeKeysResponse> pattern in purpose_keys.rs initializes once at startup and panics (rather than returning mock keys) if called before initialization — the right fail-closed behavior.
• Enclave boot failure is fatal. The retry loop in enclave.rs with a final panic! ensures the node cannot start without real keys.
• RecentBlockCache is well-implemented. Handles reorgs (full rebuild), gaps (backfill), and sequential append correctly. Test suite covers all three update paths including same-height reorgs.
• Receipt conversion is complete. SeismicRethReceiptBuilder and SeismicReceiptConverter handle all six transaction types with no unmatched variants.
• Error types are specific. SeismicEthApiError correctly maps enclave/storage errors to RPC error objects, and FromEvmHalt<SeismicHaltReason> propagates seismic halt reasons through the RPC layer.
• Fuzz test suite exists with differential, EVM execution, flagged storage, and transaction encoding targets.
• RwLock poison recovery is deliberate (not accidental), and the fail-closed behavior for block hash validation (empty cache rejects all hashes) is the correct security-sensitive behavior.

[github-actions]

Based on my examination of the key seismic files in this large comparison PR, I can provide a focused review of the most critical security issues I found in the current codebase.

Large comparison PR between Seismic fork and upstream reth showing ~50k additions and ~5k deletions.

Phase 1

• crates/seismic/rpc/src/eth/ext.rs:53-55, 133-137 — Both SeismicApi and EthApiExt structs #[derive(Debug)] and hold GetPurposeKeysResponse containing tx_io_sk (the secret key). Any debug!("{:?}", api_instance) or similar formatting would leak the secret key in logs. This matches the exact vulnerability pattern flagged in the review guidelines.

Phase 2

• crates/seismic/rpc/src/eth/ext.rs:258 — debug!(?request, ...) logs the full SeismicCallRequest which may contain seismic_elements (encryption_pubkey, nonce) in plaintext. Consider logging only non-sensitive fields.
• crates/seismic/rpc/src/eth/ext.rs:296 — debug!(?tx, ...) logs the full SeismicRawTxRequest which could contain encrypted transaction data. While encrypted, this increases attack surface if logs are compromised.

Note: This appears to be a comparison PR showing differences between Seismic and upstream rather than actual changes for merge. The Debug derive issue is a pre-existing vulnerability that should be addressed regardless of this PR's purpose.