Skip to content

Bump ethnum to placate nightly, for unified build, for oss-fuzz#5287

Merged
graydon merged 1 commit into
stellar:masterfrom
graydon:bump-ethnum-for-fuzzer
May 22, 2026
Merged

Bump ethnum to placate nightly, for unified build, for oss-fuzz#5287
graydon merged 1 commit into
stellar:masterfrom
graydon:bump-ethnum-for-fuzzer

Conversation

@graydon
Copy link
Copy Markdown
Contributor

@graydon graydon commented May 21, 2026

The causal chain here is:

  • oss-fuzz wants to fuzz with sanitizers turned on (a generally good idea)
  • rust sanitizer builds have to be both unified builds and nightly builds (the sanitizer flag is rust-nightly-only)
  • our rust build depends on ethnum, specifically version 1.5.0
  • ethnum 1.5.0 has a bug in it that our pinned rust 1.95.0 doesn't mind, but rust nightly rejects; it's fixed in 1.5.3
  • 1.5.3 otherwise seems to work fine and the release notes show only some optimizations and bugfixes.
  • There's some theoretical potential for divergence (eg. where observable bugs in ethnum were fixed: Conversion to i128 is broken nlordell/ethnum-rs#44) but .. I don't see any way for this to actually get hit in practice: this PR is a bump to the ethnum dependency outside any of the soroban production-build deps (they all have their own pinned ones in production builds) and that dependency only exists, as far as I can tell, because stellar-xdr links in ethnum to be able to do u256/i256 ops, which .. we don't actually use anywhere in the non-soroban-host rust code (eg. the bridge helpers). There's no use of i256, u256, I256, U256, or ethnum in any rust code in our tree outside the soroban crates. So I don't think this can cause any divergence in production. But, you know, one can always miss something!

If that very narrow possible I-don't-see-how risk is still too much to swallow we can wait for a protocol boundary, but this will I think basically block oss-fuzz integration until it's resolved.

(There's another option which is to turn off the sanitizers, I guess; I am going to try that in the meantime to see if I can get it working, but I'm not sure how likely that is nor whether it's a particularly good idea longer-term.)

Copilot AI review requested due to automatic review settings May 21, 2026 23:28
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.

Copy link
Copy Markdown
Contributor

@sisuresh sisuresh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This only affects --enable-unified-rust-unsafe-for-production builds, so seems safe to me.

@graydon graydon added this pull request to the merge queue May 22, 2026
Merged via the queue into stellar:master with commit 444ff29 May 22, 2026
68 checks passed
@graydon graydon deleted the bump-ethnum-for-fuzzer branch May 22, 2026 03:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Conversion to i128 is broken

3 participants