feat(core/vm,params,crypto): add the EIP-7951 P256VERIFY precompile #31991, part of #2690

[gzliudan]

Proposed changes

The Osaka precompile set has no secp256r1 verifier, so once Osaka is scheduled a call to 0x100 falls through to "call an empty account" and returns success with empty output; contracts doing WebAuthn or passkey style signature checks would silently get a zero result instead of a verification. EIP-7951 places the precompile at 0x100.

This adds the precompile at 0x100 in PrecompiledContractsOsaka, the P256VerifyGas constant (6900) and crypto/secp256r1, which holds the signature verifier. Ported from geth ethereum#31991. The verifier uses only crypto/ecdsa and crypto/elliptic, so no dependency is added. geth's Cacheable and NormalizeInput methods and the exported PrecompiledContractsP256Verify set are not ported, because this fork's PrecompiledContract interface does not declare them and nothing calls them.

The 782 official test vectors are included and run through testJson.

Vector state: the vectors assert for real because of the JSON vector plumbing from #2664, which is merged into dev-upgrade and therefore in the base of this branch. On the current head all 782 cases pass with the vector-derived names and gas, and flipping one Expected value in the vector file makes the test fail. The test also asserts that 0x100 is registered in PrecompiledContractsOsaka, and TestPrecompileSetsByFork pins it as an Osaka-only entry: presence, Name(), and the ActivePrecompiles listing.

Activation status: the five real network configs (XDCMainnet, Mainnet, Testnet, Devnet, Localnet) keep OsakaBlock at nil, so the Osaka set is not selected on any of them and this change has no effect there yet. The six in-tree test configs (AllEthashProtocolChanges, AllDevChainProtocolChanges, AllCliqueProtocolChanges, TestXDPoSMockChainConfig, TestChainConfig, MergedTestChainConfig) have OsakaBlock set to 0, so on those the precompile is selected from genesis: a call to 0x100 changes from "call an empty account" (success with empty output) to real verification, and ActivePrecompiles now lists the address. That is the intended behaviour and the reason the vectors can run under the Osaka rules; no existing test relied on the empty-account behaviour.

Interaction with the EIP-2537 work: the Osaka set is now 0x01–0x09 plus the 0x0a stub (#2666) plus 0x0b–0x11 (EIP-2537, #2668, already merged) plus 0x100 (this PR). This branch is rebased onto #2668, and TestPrecompileSetsByFork pins 0x100 so a later bucket edit cannot drop it silently.

Part of #2690

Types of changes

What types of changes does your code introduce to XDC network?

• build: Changes that affect the build system or external dependencies
• ci: Changes to CI configuration files and scripts
• chore: Changes that don't change source code or tests
• docs: Documentation only changes
• feat: A new feature
• fix: A bug fix
• perf: A code change that improves performance
• refactor: A code change that neither fixes a bug nor adds a feature
• revert: Revert something
• style: Changes that do not affect the meaning of the code
• test: Adding missing tests or correcting existing tests

Impacted Components

Which parts of the codebase does this PR touch?

• Consensus
• Account
• Network
• Geth
• Smart Contract
• External components
• Not sure (Please specify below)

Checklist

• This PR has sufficient test coverage (unit/integration test) OR I have provided reason in the PR description for not having test coverage
• Tested on a private network from the genesis block and monitored the chain operating correctly for multiple epochs.
• Provide an end-to-end test plan in the PR description on how to manually test it on the devnet/testnet.
• Tested the backwards compatibility.
• Tested with XDC nodes running this version co-exist with those running the previous version.
• Relevant documentation has been updated as part of this PR
• N/A

Notes on the unchecked items: the precompile is unreachable until OsakaBlock is scheduled, so there is nothing to exercise on a private network, no behaviour to be backwards compatible with, and no user facing change to document yet. The gas constant, the 160 byte input layout and the 782 official vectors (including their expected gas) are covered by unit tests.

Note on the diff: #2664 and #2668 are merged into dev-upgrade and this branch is rebased onto it, so the diff contains only the six files of this change (crypto/secp256r1/verifier.go, params/protocol_params.go, core/vm/contracts.go, core/vm/contracts_test.go, core/vm/precompile_sets_test.go, core/vm/testdata/precompiles/p256Verify.json).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5eae2503-309a-4ccb-8f6c-e3e9b6ece1aa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot review overview

🟡 Changes recommended

Exact-length rejection lacks coverage, and unrelated literal rewrites should be removed.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Add short and long input rejection tests · New
• Limit diff to adding the 0x100 P256VERIFY entry · New

What changed in this PR

Adds EIP-7951 P256VERIFY support to the Osaka precompile set.

Changes:

• Implements secp256r1 signature verification at 0x100.
• Adds the fixed 6900 gas cost.
• Adds registration checks, benchmarks, and 782 vectors.

File	Description
params/​protocol_params.go	Defines P256 verification gas.
crypto/​secp256r1/​verifier.go	Implements P-256 verification.
core/​vm/​contracts.go	Registers and executes the precompile.
core/​vm/​contracts_test.go	Adds tests and benchmark coverage.
core/​vm/​testdata/​precompiles/​p256Verify.json	Provides verification vectors.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation matches upstream behavior and has comprehensive consensus-focused coverage without activating on production networks.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Add short and long input rejection tests
• Limit diff to adding the 0x100 P256VERIFY entry