Skip to content

fix(payload): initialize prewarming state synchronously - #7227

Closed
joshieDo wants to merge 1 commit into
mainfrom
joshie/extract-prewarming-init
Closed

fix(payload): initialize prewarming state synchronously#7227
joshieDo wants to merge 1 commit into
mainfrom
joshie/extract-prewarming-init

Conversation

@joshieDo

Copy link
Copy Markdown
Member

Initializes per-worker EVM state before spawning scoped prewarming work, ensuring every worker is ready before transaction execution. Updates the lifecycle test to verify worker-local state is cleared after prewarming completes. Extracted while reviewing #4069.

@joshieDo
joshieDo marked this pull request as ready for review August 19, 2026 11:17
@joshieDo

Copy link
Copy Markdown
Member Author

cyclops audit super-fast

@tempoxyz-bot tempoxyz-bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👁️ Cyclops Review

This change leaves a high-severity stale worker-state path because Rayon scope callers are not covered by the pool broadcasts.

Reviewer Callouts
  • External Rayon scope participation: Confirm initialization and cleanup semantics for both Rayon-owned workers and the calling thread; the updated test currently checks only pool threads via broadcast.

Provider: StateProviderFactory + Clone + 'static,
{
let pool = executor.prewarming_pool();
let prewarm = ctx.prewarm.clone();

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 [SECURITY] Coordinator-thread worker state survives across payload builds

WorkerPool::init and pool.clear() broadcast only to Rayon-owned pool threads, but in_place_scope allows the external calling thread to execute scoped jobs. A job on that caller lazily stores this build's EVM in the global worker TLS; cleanup does not clear it, so a later build on the same coordinator thread can reuse stale parent state/environment. Its replay may then be rejected as invalid, causing an otherwise valid payment transaction to be omitted from the payload.

Recommended Fix:
Initialize and explicitly clear the external scope caller's worker slot for every build, with a barrier before jobs begin, or avoid global worker TLS for external scope participants and pass build-scoped state directly. Add a two-build regression test on the same coordinator thread with distinct contexts and force a scoped task onto that thread.

@joshieDo joshieDo closed this Aug 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants