EIP-7951 (RIP-7212-compatible): secp256r1 P256VERIFY precompile by snissn · Pull Request #1708 · filecoin-project/builtin-actors

snissn · 2026-01-05T18:46:32Z

Summary

Add a secp256r1/P-256 ECDSA verification precompile at address 0x0000000000000000000000000000000000000100 (0x0100), implementing EIP-7951 semantics (interface-compatible with RIP-7212).
Reserve 0x0100 in the precompile address space and wire it into precompile dispatch.
Add unit + integration tests (including a Solidity fixture) for valid/invalid inputs and call-with-value behavior.
Update dependencies, including bumping ruint to address RUSTSEC-2025-0137.

Implementation

Precompile dispatch and reserved address handling: actors/evm/src/interpreter/precompiles/mod.rs
P256VERIFY implementation: actors/evm/src/interpreter/precompiles/secp256r1.rs
- Input encoding (160 bytes): msg_hash(32) || r(32) || s(32) || pubkey_x(32) || pubkey_y(32)
- Return value: success => 32 bytes with last byte set to 0x01; failure => empty bytes

EIP-7951 security fixes

EIP-7951 fixes two edge cases present in RIP-7212 verification specs:

Point-at-infinity check for the verification point R'.
Modular comparison (r' ≡ r (mod n)) to handle cases where the x-coordinate of R' exceeds the curve order n.

This implementation relies on the p256/ecdsa verifier for correctness, and therefore follows the ECDSA verification procedure with these fixes.

Tests

cargo test -p fil_actor_evm

Notes / Risk

0x...0100 is now a reserved precompile address; any code that previously treated it as a “normal” EVM address will now execute the precompile instead.

Copilot

Pull request overview

This PR implements the RIP-7212 secp256r1 (P-256) signature verification precompile at address 0x0100. Note: The PR title mentions "EIP-7951" but the implementation references "RIP-7212" throughout.

Key Changes:

Adds secp256r1 ECDSA signature verification precompile using the p256 crate
Implements special-case handling for address 0x0100 in precompile lookup logic
Includes comprehensive test coverage with test vectors from daimo-eth/p256-verifier

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
actors/evm/src/interpreter/precompiles/secp256r1.rs	Core implementation of RIP-7212 precompile with signature verification logic and extensive unit tests
actors/evm/src/interpreter/precompiles/mod.rs	Registers the secp256r1 precompile at address 0x0100 with special-case lookup handling
actors/evm/tests/rip7212_precompile.rs	Integration tests for precompile functionality including value transfer scenarios
actors/evm/tests/contracts/Secp256r1Precompile.sol	Solidity test contract with test cases for valid/invalid signatures and edge cases
actors/evm/tests/contracts/Secp256r1Precompile.hex	Compiled bytecode for the Solidity test contract
actors/evm/tests/basic.rs	Integration test that invokes all Solidity test functions
actors/evm/Cargo.toml	Adds p256 crate dependency for secp256r1 support and rstest for parameterized testing
Cargo.lock	Lock file updates for new dependencies (p256, rstest, and transitive dependencies)

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

actors/evm/src/interpreter/precompiles/secp256r1.rs

actors/evm/tests/basic.rs

actors/evm/src/interpreter/precompiles/secp256r1.rs

codecov-commenter · 2026-01-16T00:05:01Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.24%. Comparing base (2a06959) to head (05d591b).
⚠️ Report is 4 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1708      +/-   ##
==========================================
+ Coverage   91.23%   91.24%   +0.01%     
==========================================
  Files         151      152       +1     
  Lines       32006    32060      +54     
==========================================
+ Hits        29200    29254      +54     
  Misses       2806     2806

Files with missing lines	Coverage Δ
actors/evm/src/interpreter/precompiles/mod.rs	`91.73% <100.00%> (+1.83%)`	⬆️
...ctors/evm/src/interpreter/precompiles/secp256r1.rs	`100.00% <100.00%> (ø)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-21T01:57:47Z

actors/evm/tests/rip7212_precompile.rs

@@ -0,0 +1,156 @@
+mod asm;


The filename 'rip7212_precompile.rs' may be misleading since this implementation follows EIP-7951 semantics, not RIP-7212 directly. While the precompile is interface-compatible with RIP-7212, the filename should reflect that this is an EIP-7951 implementation. Consider renaming to 'secp256r1_precompile.rs' or 'p256verify_precompile.rs' to better align with the actual implementation and avoid confusion.

Copilot · 2026-01-21T01:57:47Z

actors/evm/tests/rip7212_precompile.rs

+fn rip7212_call_success() {
+    let rt = util::construct_and_verify(p256_verify_contract_call());
+
+    let input = p256_input();
+    let result = util::invoke_contract(&rt, &input);
+    let mut expected = [0u8; 32];
+    expected[31] = 1;
+    assert_eq!(result[0], util::PrecompileExit::Success as u8);
+    assert_eq!(&result[1..], &expected);
+}
+
+#[test]
+fn rip7212_invalid_input_returns_empty() {
+    let rt = util::construct_and_verify(p256_verify_contract_call());
+    let input = vec![0u8; 10];
+    let result = util::invoke_contract(&rt, &input);
+    assert_eq!(result[0], util::PrecompileExit::Success as u8);
+    assert!(result[1..].is_empty());
+}
+
+fn p256_verify_contract_call_value() -> Vec<u8> {
+    let init = "";
+    let body = r#"
+
+calldatasize
+push1 0x00
+push1 0x00
+calldatacopy
+
+# out size
+push1 0x20
+# out off
+push2 0xA000
+
+# in size (160)
+push1 0xA0
+# in off
+push1 0x00
+
+# value (1 atto)
+push1 0x01
+
+# dst (0x0100)
+push20 0x0000000000000000000000000000000000000100
+
+# gas
+push1 0x00
+
+call
+
+# write exit code memory
+push1 0x00 # offset
+mstore8
+
+returndatasize
+push1 0x00 # input offset
+push1 0x01 # dest offset
+returndatacopy
+
+returndatasize
+push1 0x01
+add
+push1 0x00
+return
+"#;
+    asm::new_contract("rip7212-precompile-caller-value", init, body).unwrap()
+}
+
+#[test]
+fn rip7212_call_with_value_transfers_on_success() {
+    let rt = util::construct_and_verify(p256_verify_contract_call_value());
+    rt.set_balance(TokenAmount::from_atto(100));
+
+    let input = p256_input();
+    let mut expected = [0u8; 32];
+    expected[31] = 1;
+
+    let addr = fil_actors_evm_shared::address::EthAddress(hex_literal::hex!(
+        "0000000000000000000000000000000000000100"
+    ));
+    let fil_addr =
+        FILAddress::new_delegated(fil_actors_runtime::EAM_ACTOR_ID, addr.as_ref()).unwrap();
+    rt.expect_send_simple(
+        fil_addr,
+        METHOD_SEND,
+        None,
+        TokenAmount::from_atto(1),
+        None,
+        ExitCode::OK,
+    );
+
+    let result = util::invoke_contract(&rt, &input);
+    assert_eq!(result[0], util::PrecompileExit::Success as u8);
+    assert_eq!(&result[1..], &expected);
+}


The function names 'rip7212_call_success', 'rip7212_invalid_input_returns_empty', and 'rip7212_call_with_value_transfers_on_success' reference RIP-7212 but the implementation follows EIP-7951 semantics. While interface-compatible, consider renaming these functions to use 'secp256r1' or 'p256verify' prefix for clarity and to accurately reflect the underlying EIP-7951 implementation.

BigLep · 2026-01-27T04:34:07Z

@LesnyRumcajs : could someone from Forest take a first pass?

redpanda-f

Thank you!

I would like to understand this better: Why are we introducing tests/contracts/*.sol and *.hex at all? I feel secp256r1.rs should be enough? Am i missing something critical?

redpanda-f · 2026-02-24T07:37:49Z

actors/evm/src/interpreter/precompiles/mod.rs

    }

+    #[test]
+    fn is_rip_7212_precompile() {


All mentions of RIP 7212 should be removed.

EIP-7951 is the formal Ethereum Improvement Proposal that supersedes RIP-7212.
References (https://eips.ethereum.org/EIPS/eip-7951):

This specification addresses critical security issues discovered in RIP-7212 while maintaining full interface compatibility with existing Layer 2 implementations.

This EIP supersedes RIP-7212 by implementing the same functionality with the same interface, but without the vulnerability.

Not sure if this should be part of this PR: but something like addr!(0x100) expanding to the full addr hex here should be easier for maintenance long term.

redpanda-f · 2026-02-24T07:40:10Z

actors/evm/src/interpreter/precompiles/secp256r1.rs

+//!
+//! This module implements secp256r1 (P-256) ECDSA signature verification for the FEVM precompile at `0x0100`.
+//!
+//! The precompile is specified by Ethereum's [EIP-7951](https://eips.ethereum.org/EIPS/eip-7951) and is interface-compatible


Again, this explicit description should be removed. EIP itself says it is interface compatible already.

redpanda-f · 2026-02-24T07:40:43Z

actors/evm/src/interpreter/precompiles/secp256r1.rs

+    use rstest::rstest;
+
+    #[rstest]
+    // Test vectors from https://github.com/daimo-eth/p256-verifier/tree/master/test-vectors


Thank you so much for this reference!

redpanda-f · 2026-02-24T07:48:12Z

Cargo.lock

 dependencies = [
 "data-encoding",
- "syn 2.0.106",
+ "syn 1.0.109",


Why do we have syn downgrade? I understand lockfile commit given Cargo.toml additions however.

I've seen this on other packages recently. It flip-flops but I suspect if you looked deeper you'd see both syn 1 and 2 included for different transitive reasons.

Insisted on going the other way here just last week: https://github.com/filecoin-project/filecoin-ffi/pull/563/changes

rvagg · 2026-02-25T01:23:21Z

Why are we introducing tests/contracts/*.sol and *.hex at all?

They're first-line integration tests. Can the evm actor even decode standard solidity that includes this new opcode and run it as expected. Being able to run it in Rust is one thing, being able to hit it from the Solidity path is another. See https://github.com/filecoin-project/builtin-actors/tree/master/actors/evm/tests/contracts for a bunch of others, and also #1720 that @ZenGround0 added today for the SectorStatus FIP as an integration test to exercise a feature that's supposed to be exposed to smart contracts. The feature might work, but does it work when you call it from a smart contract.

For many of these we'll also do the same in Lotus to integration test at even higher level - it runs here in Rust, but does it run when compiled to WASM, executed in FVM and called from a message in Lotus. See here for recent EVM features that @snissn added (TSTORE and BLS precompiles): https://github.com/filecoin-project/lotus/blob/7741226198083e943a64d917e88a0a77d17aa30e/itests/fevm_test.go#L1831-L1908 -- @wjmelements this might also be interesting on your question of activation, our integration tests can be configured to tick over from one network version to another (see the top of the TSTORE test for example), so for EVM features like this we can say "feature doesn't exist and therefore reverts", then "now it works" within the space of an epoch.

wjmelements · 2026-02-25T03:45:12Z

actors/evm/tests/rip7212_precompile.rs

+# gas
+push1 0x00
+
+call


it is good that we have test coverage for both call and staticcall

wjmelements · 2026-02-25T03:55:54Z

This has pretty good test coverage. I'd like additional testing for when there is excess or truncated calldata.

aaravm added 9 commits November 13, 2025 11:13

add secp256r1.rs

be0a3af

remove temp

1315bce

working tests

89b9369

Add precompiles + cargo fmt

3b5d8e4

adding rip72121 test

55c5a7c

correct clippy error

650a011

changing test vector to a vector from test suite

4b63728

remove unnecessary commits

f8da0b8

Add solidity tests

dfe8b53

github-project-automation bot added this to FilOz Jan 5, 2026

github-project-automation bot moved this to 📌 Triage in FilOz Jan 5, 2026

snissn marked this pull request as ready for review January 5, 2026 18:47

Copilot AI review requested due to automatic review settings January 5, 2026 18:47

Copilot started reviewing on behalf of snissn January 5, 2026 18:48 View session

Copilot AI reviewed Jan 5, 2026

View reviewed changes

snissn marked this pull request as draft January 5, 2026 19:00

BigLep moved this from 📌 Triage to ⌨️ In Progress in FilOz Jan 6, 2026

BigLep assigned snissn Jan 6, 2026

snissn marked this pull request as ready for review January 15, 2026 23:49

Fix secp256r1 precompile docs and tests

05d591b

Update ruint to address RUSTSEC-2025-0137

37c863c

snissn mentioned this pull request Jan 21, 2026

FIP: secp256r1 (P-256) P256VERIFY precompile filecoin-project/FIPs#1228

Open

snissn changed the title ~~[DRAFT] EIP-7951: secp256r1 Precompile~~ [DRAFT] EIP-7951 (RIP-7212-compatible): secp256r1 P256VERIFY precompile Jan 21, 2026

docs: align secp256r1 precompile naming

fb09b9d

snissn changed the title ~~[DRAFT] EIP-7951 (RIP-7212-compatible): secp256r1 P256VERIFY precompile~~ EIP-7951 (RIP-7212-compatible): secp256r1 P256VERIFY precompile Jan 21, 2026

snissn requested a review from Copilot January 21, 2026 01:54

Copilot started reviewing on behalf of snissn January 21, 2026 01:55 View session

Copilot AI reviewed Jan 21, 2026

View reviewed changes

BigLep moved this from ⌨️ In Progress to 🔎 Awaiting Review in FilOz Jan 27, 2026

BigLep requested a review from LesnyRumcajs January 27, 2026 04:33

LesnyRumcajs requested review from hanabi1224 and removed request for LesnyRumcajs January 27, 2026 10:03

redpanda-f requested changes Feb 24, 2026

View reviewed changes

github-project-automation bot moved this from 🔎 Awaiting Review to ⌨️ In Progress in FilOz Feb 24, 2026

rvagg mentioned this pull request Feb 25, 2026

feat: new session keys with viem FilOzone/synapse-sdk#618

Merged

2 tasks

wjmelements reviewed Feb 25, 2026

View reviewed changes

actors/evm/tests/rip7212_precompile.rs

# gas

push1 0x00

call

Copy link

wjmelements Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it is good that we have test coverage for both call and staticcall

snissn mentioned this pull request Feb 26, 2026

Use upstream EIP-7951 test vectors for P256VERIFY tests #1721

Open

Conversation

snissn commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Implementation

EIP-7951 security fixes

Tests

Notes / Risk

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov-commenter commented Jan 16, 2026

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

BigLep commented Jan 27, 2026

Uh oh!

redpanda-f left a comment

Choose a reason for hiding this comment

Uh oh!

redpanda-f Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

redpanda-f Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

redpanda-f Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

redpanda-f Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

redpanda-f Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

rvagg Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

rvagg commented Feb 25, 2026

Uh oh!

wjmelements Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

wjmelements commented Feb 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

snissn commented Jan 5, 2026 •

edited

Loading