core, miner, consensus/bor, eth, triedb/pathdb: pipelined state root computation for block import

[pratikspatil024]

Description

Overlaps state-root computation (SRC) of block N with transaction execution of block N+1 during block import. Execution of N+1 opens state at the last committed trie root plus an in-memory FlatDiff overlay of block N's mutations, while a background SRC goroutine commits block N and computes its root. Disabled by default — enabled with [pipeline] enable-import-src = true.

Built on top of the delayed SRC PoC: instead of just deferring SRC, it pipelines SRC with the next block's work.

Measured impact

Mainnet full node (n2d-standard-16, path scheme, BlockSTM enforce), ~64k-block catch-up windows, block-weight and traffic-character controlled across adjacent weekday ranges:

configuration	agg mgasps	vs baseline
pipeline off	291.0	—
pipeline on	346.4	+19.0%
pipeline off + producewitnesses	255.3	—
pipeline on + producewitnesses	293.7	+15.0%

Per-block overhead beyond raw execution dropped from ~45–50ms to ~18ms. Zero root_mismatch, pipeline fallbacks, or execution errors across the benchmark campaign (~500k blocks imported under the pipeline).

How it works — import

When importing block N (pipeline active):

1. Execute block N at the last committed root + FlatDiff overlay from block N−1
2. Run ValidateStateCheap (gas, bloom, receipt root — no IntermediateRoot)
3. Extract block N's FlatDiff via CommitSnapshot (~1ms, no trie hashing)
4. Collect the previous SRC(N−1): verify its root, write + announce the witness, trie GC
5. Write block metadata and advance the head immediately (sync protocol sees it)
6. Store the FlatDiff so StateAt/RPC reads (eth_call, eth_estimateGas, pending reads) are correct during the pipeline window
7. Spawn SRC(N) in the background — it overlaps with block N+1's execution
8. Continue to the next block without waiting for SRC(N)

Two supporting optimizations ship with the pipeline:

• pathdb trie-node index (triedb/pathdb/lookup_nodes.go): a reference-counted (owner, path, hash) → blob map over live diff layers. reader.Node resolves in one probe instead of walking up to 128 diff layers per read (the walk measured ~44% of process CPU during catch-up). The hash is part of the key, so a hit is correct by construction; a definitive miss reads the disk layer directly. This index is always on (not gated by the pipeline flag) — it is a read-path cache whose misses fall through to the existing walk, adding ~250MB steady-state at 128 diff layers.
• Warm-node handoff (core/state/warm_snapshot.go, pipeline.warm-snapshot, default on): when witnesses are produced, the execution-side trie prefetcher is detached and handed to SRC, which builds an immutable hash-verified snapshot of the loaded trie nodes and consults it before pathdb. No effect when witnesses are off.

Review-sensitive properties

• The head advances before the state root is verified. ValidateStateCheap gates insertion; the full root check happens asynchronously in the SRC goroutine. A mismatch fires chain/imports/pipelined/root_mismatch (a hard alarm that must stay 0) and errors the pipeline. Sync compensates: hasPendingPipelinedHeadState keeps the node in full-sync while a head-state commit is in flight.
• WIT protocol behavior: WitnessReadyEvent now push-announces witness availability to stateless peers (replacing a 10s poll); GetWitness serving waits for in-flight SRC (bounded, with a header-existence DoS guard) and reads uncached so peer traffic can't evict import-critical cache entries.
• Witness completeness: the SRC uses a trie-only reader (NewTrieOnly) so every read walks the MPT and proof paths land in the witness; parity tests assert proof-node-set equality and stateless replay (ProcessBlockWithWitnesses) across all configurations. PropagateReadsTo in checkAndCommitSpan captures the validator-contract proof nodes read via a copied statedb; EIP-2935 accounts are touched into the read set.
• Lifecycle: one SRC goroutine + one auto-collection goroutine per pipelined block, registered on bc.wg; pending SRC is flushed on reorg, gap, or error.
• No database schema change (BlockChainVersion unchanged); nothing forces a resync.

Production-side (miner) pipelining: landed but disabled

miner/pipeline.go contains the speculative-sealing counterpart (FlatDiff extraction after FinalizeForPipeline, background SRC, speculative N+1 build, async chain write). It is hard-disabled: isPipelineEligible returns false unconditionally and no config exposes it (the worker/pipeline/enabled gauge is always 0). Pre-Rio seal-recovery interaction makes speculative Prepare fail; re-enablement is future work and the gating logic is preserved in comments. Reviewers can treat the miner path as dormant code with test coverage.

Config

[pipeline]
enable-import-src = false   # master gate (default: disabled)
import-src-logs   = false   # verbose pipeline logging
warm-snapshot     = true    # witness-producing nodes only; leave on

Notable negative results baked into the design (so nobody re-litigates them): the exec-side trie prefetcher and the speculative block prefetcher are load-bearing via shared-cache warming — disabling either regresses 25–75% — so neither is configurable (pipeline.exec-prefetch existed briefly on the feature branch and was removed).

Executed tests

• Parity suites (hash + path schemes, -race): pipelined vs sequential roots/hashes, witness proof-node-set parity + stateless replay, FlatDiff mutation/overlay suites, self-destruct integration, pathdb node-index unit tests (fork refcounting, deletion markers, definitive-miss semantics), tests/bor integration.
• Mainnet catch-up benchmark campaign (2026-07-10 → 2026-07-21): 12 instrumented legs covering the pipeline × witness matrix with per-leg lane analysis (exec / SRC / commit / overlap) and CPU+mutex profiling.
• RPC correctness under pipelined import: a deterministic window test (core/pipelined_window_test.go, SRC goroutine held open via test hook) pins the overlay/trie semantics of the "head advanced, root not yet committed" interval; an end-to-end battery (tests/bor/pipelined_rpc_test.go) drives 12 read methods against a live-syncing importer at pinned heights and latest, checks sync-time vs settled response identity, and verifies full per-height parity vs a non-pipelined BP including cryptographic account-proof verification. Handlers that need committed trie nodes (eth_getProof, debug_storageRangeAt) gate on WaitForPipelinedStateCommit instead of erroring transiently inside the window.
• Diffguard mutation testing (50% sampling): 89.9% overall kill rate, 93.6% on tier-1 logic.
• Pending before ready-for-review: 24h tip-following soak, kurtosis devnet e2e with reorgs, witness-sync devnet check.

Quality gates — declared deviations

Three CI gates fail for structural reasons; each is intentional and listed here rather than suppressed:

• Cognitive complexity / function size (diffguard, Quality metrics job): insertChainWithWitnesses, IntermediateRoot, getStateObject, and updateTrie exceed thresholds. All four are legacy hot-path giants that this PR extends in place; refactoring them is high-risk consensus-path churn that belongs in a dedicated cleanup, not a feature PR. New-code violations were extracted below thresholds (applyFlatMutationFast, runSRCCompute, FinalizeForPipeline, witness-collection loops deduped into addObjectWitness). nodeWalk is a rename of pre-existing upstream logic. The reported core -> core dependency cycle is a tool artifact (self-cycle).
• SonarCloud duplication (8.2% vs ≤3%): 941 of 1039 duplicated lines are test scaffolding (pipelined test variants deliberately share setup with their non-pipelined siblings so the comparison stays literal). Remaining production duplication was removed in this PR (addObjectWitness, commitSprintWork reuse); ValidateStateCheap intentionally mirrors ValidateState's shape.
• codecov/patch (46% vs 90% target): project coverage is up (+0.02%); the patch metric only counts unit-test instrumentation and misses the integration/e2e suites where most pipeline coverage lives (tests/bor, kurtosis). The 90% patch bar on a 12.7k-line PR spanning hot paths is not attainable without duplicating e2e coverage as unit tests.

Rollout notes

Backwards-compatible; off by default; no coordinated upgrade required. Not consensus-affecting: the pipeline computes the identical root on the identical commit path, one block later in wall-clock, and aborts on mismatch. Operator-facing changes when enabled: witness-ready latency trails the block by one SRC cycle (~210ms end-to-end vs ~143ms inline). Related: #2312 implements an alternative trie-node index on develop; this PR lands first and #2312 rebases.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[claude]

Code Review

Found 6 issues: 4 bugs and 2 security concerns.

Bugs

1. miner/worker.go:1117 — writeElapsed always measures ~0 (broken metric)
   writeElapsed is computed immediately after writeStart, before either write call executes. The original code had the write call between writeStart and writeElapsed. The writeBlockAndSetHeadTimer metric will always report approximately zero. Fix: move writeElapsed := time.Since(writeStart) to after the if/else block.
   

   bor/miner/worker.go

   Lines 1116 to 1123 in 07345ad

   	writeStart := time.Now()
   	writeElapsed := time.Since(writeStart)
   	if task.pipelined {
   	_, err = w.chain.WriteBlockAndSetHeadPipelined(block, receipts, logs, task.state, true, task.witnessBytes)
   	} else {
   	_, err = w.chain.WriteBlockAndSetHead(block, receipts, logs, task.state, true)
   	}
   	writeBlockAndSetHeadTimer.Update(writeElapsed)

2. miner/pipeline.go:380-383 — nil pointer dereference when chainHead == nil
   When chainHead is nil, the || short-circuits to true and enters the if-body, where chainHead.Number.Uint64() panics. This is in the block production path. Per security-common.md: No panics in consensus, sync, or block production paths. Fix: split the nil check from the number check into separate if-blocks.
   

   bor/miner/pipeline.go

   Lines 379 to 384 in 07345ad

   	chainHead := w.chain.CurrentBlock()
   	if chainHead == nil || chainHead.Number.Uint64() != blockNNum {
   	log.Error("Pipelined SRC: chain head mismatch after waiting", "expected", blockNNum,
   	"got", chainHead.Number.Uint64())
   	return
   	}

3. core/stateless/witness.go:101 — NewWitness no longer copies the context header (mutation risk)
   The old code did ctx := types.CopyHeader(context) and zeroed Root/ReceiptHash. The new code stores the caller pointer directly. In miner/worker.go:1196, the raw header pointer is passed — this header is later mutated in place. The Witness will silently see those mutations. See state-security.md threat model.
   

   bor/core/stateless/witness.go

   Lines 88 to 107 in 07345ad

   	func NewWitness(context *types.Header, chain HeaderReader) (*Witness, error) {
   	// When building witnesses, retrieve the parent header, which will *always*
   	// be included to act as a trustless pre-root hash container
   	var headers []*types.Header
   	if chain != nil {
   	parent := chain.GetHeader(context.ParentHash, context.Number.Uint64()-1)
   	if parent == nil {
   	return nil, errors.New("failed to retrieve parent header")
   	}
   	headers = append(headers, parent)
   	}
   	// Create the witness with a reconstructed gutted out block
   	return &Witness{
   	context: context,
   	Headers: headers,
   	Codes: make(map[string]struct{}),
   	State: make(map[string]struct{}),
   	chain: chain,
   	}, nil
   	}

4. miner/pipeline.go:124 — SetLastFlatDiff stores a provisional header hash that never matches
   env.header.Hash() lacks both Root and the seal signature. In PostExecutionStateAt, the comparison uses the sealed header — so FlatDiff overlay path is never taken. The txpool falls back to StateAt(header.Root) which may fail if SRC hasn't committed. Same issue at lines 521 and 783.
   

   bor/miner/pipeline.go

   Lines 123 to 125 in 07345ad

   	w.chain.SetLastFlatDiff(flatDiff, env.header.Hash())
   	// Note: this counts block N as "entering the pipeline." If Prepare() fails

Security Concerns

5. core/stateless/witness.go:56 — pre-state root validation anchored to untrusted witness data
   The old ValidateWitnessPreState took a caller-supplied expectedPreStateRoot. The new version fetches the parent using witness.context.ParentHash (from the witness itself). For peer-received witnesses, no call site verifies witness.context.ParentHash == block.ParentHash(). A malicious peer could bypass the pre-state root check. Per state-security.md and security-common.md peer-triggerable escalation.
   

   bor/core/stateless/witness.go

   Lines 49 to 71 in 07345ad

   	// Get the witness context header (the block this witness is for).
   	contextHeader := witness.Header()
   	if contextHeader == nil {
   	return fmt.Errorf("witness context header is nil")
   	}
   	// Get the parent block header from the chain.
   	parentHeader := headerReader.GetHeader(contextHeader.ParentHash, contextHeader.Number.Uint64()-1)
   	if parentHeader == nil {
   	return fmt.Errorf("parent block header not found: parentHash=%x, parentNumber=%d",
   	contextHeader.ParentHash, contextHeader.Number.Uint64()-1)
   	}
   	// Get witness pre-state root (from first header which should be parent).
   	witnessPreStateRoot := witness.Root()
   	// Compare with actual parent block's state root.
   	if witnessPreStateRoot != parentHeader.Root {
   	return fmt.Errorf("witness pre-state root mismatch: witness=%x, parent=%x, blockNumber=%d",
   	witnessPreStateRoot, parentHeader.Root, contextHeader.Number.Uint64())
   	}
   	return nil

6. core/blockchain.go:4402 — SpawnSRCGoroutine uses raw go func() without panic recovery
   The old code used bc.wg.Go(func() { ... }) for lifecycle-safe goroutine management. The new code uses bc.wg.Add(1) + raw go func(). If the goroutine panics, the process crashes without graceful shutdown. Per security-common.md: No panics in block production paths.
   

   bor/core/blockchain.go

   Lines 4399 to 4410 in 07345ad

   	pending.wg.Add(1)
   	bc.wg.Add(1)
   	go func() {
   	defer bc.wg.Done()
   	defer pending.wg.Done()
   	tmpDB, err := state.New(parentRoot, bc.statedb)
   	if err != nil {
   	log.Error("Pipelined SRC: failed to open tmpDB", "parentRoot", parentRoot, "err", err)
   	pending.err = err
   	return

[claude]

Code Review

Found 5 issues in miner/worker.go and miner/pipeline.go. Checked for bugs and CLAUDE.md compliance.

---

1. Bug: writeElapsed always ~0ns (miner/worker.go L1116-L1123)

writeElapsed := time.Since(writeStart) is computed immediately after writeStart := time.Now(), before either WriteBlockAndSetHeadPipelined or WriteBlockAndSetHead executes. writeBlockAndSetHeadTimer always records ~0, and workerMgaspsTimer (line 1148) reports inflated MGas/s. Fix: move writeElapsed := time.Since(writeStart) to after the if/else block.

---

2. Bug: nil pointer dereference (miner/pipeline.go L379-L384)

When chainHead is nil, the || short-circuits into the if-body, but chainHead.Number.Uint64() in log.Error dereferences nil and panics. Per CLAUDE.md: No panics in consensus, sync, or block production paths. Fix: split into two if-checks.

---

3. Bug: unchecked type assertion (miner/pipeline.go L335-L341)

borEngine, _ := w.engine.(*bor.Bor) discards the ok boolean. If w.engine is not *bor.Bor, borEngine is nil and borEngine.AssembleBlock(...) panics. The same assertion at line 96 correctly checks ok. Fix: check ok and return early.

---

4. Bug: goroutine leak on 5 return paths (miner/pipeline.go L293-L345)

initialFillDone channel (line 293) goroutine is not drained on return paths at lines 345, 357, 371, 373, 383. Only WaitForSRC error (line 331) and happy path (line 390) drain it. Fix: defer drain after line 293.

---

5. Bug: trie DB race after SpawnSRCGoroutine (miner/pipeline.go L206-L229)

SpawnSRCGoroutine called at line 213 launches a goroutine doing CommitWithUpdate. If StateAtWithFlatDiff fails (line 219) or GetHeader returns nil (line 228), fallbackToSequential does IntermediateRoot inline on the same parent root concurrently. The comments at lines 206-211 identify this as causing missing trie node / layer stale errors but only guard the Prepare() case. Fix: WaitForSRC() before fallbackToSequential, or move spawn after preconditions.

[codecov]

Codecov Report

❌ Patch coverage is 45.88369% with 1433 lines in your changes missing coverage. Please review.
✅ Project coverage is 54.09%. Comparing base (55cac19) to head (ccedec8).

Files with missing lines	Patch %	Lines
miner/pipeline.go	5.42%	749 Missing ⚠️
miner/worker.go	61.80%	89 Missing and 21 partials ⚠️
core/state/warm_snapshot.go	44.85%	63 Missing and 12 partials ⚠️
core/state/statedb.go	82.60%	63 Missing and 9 partials ⚠️
core/blockchain_reader.go	50.35%	64 Missing and 5 partials ⚠️
core/state/trie_prefetcher.go	22.22%	51 Missing and 5 partials ⚠️
consensus/bor/bor.go	43.75%	54 Missing ⚠️
triedb/pathdb/reader.go	32.25%	41 Missing and 1 partial ⚠️
tests/bor/helper.go	63.15%	21 Missing and 7 partials ⚠️
core/block_validator.go	20.00%	14 Missing and 6 partials ⚠️
... and 17 more

❌ Your patch check has failed because the patch coverage (45.88%) is below the target coverage (90.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #2180      +/-   ##
===========================================
+ Coverage    54.07%   54.09%   +0.01%     
===========================================
  Files          907      911       +4     
  Lines       162012   165335    +3323     
===========================================
+ Hits         87615    89442    +1827     
- Misses       68984    70380    +1396     
- Partials      5413     5513     +100     

Files with missing lines	Coverage Δ
core/blockchain.go	64.87% <ø> (+1.79%)	⬆️
core/blockchain_insert.go	78.50% <100.00%> (+1.27%)	⬆️
core/evm.go	93.67% <100.00%> (+19.65%)	⬆️
core/stateless/encoding.go	63.49% <ø> (ø)
core/stateless/witness.go	44.64% <100.00%> (+6.02%)	⬆️
core/txpool/blobpool/blobpool.go	54.87% <100.00%> (ø)
core/types/block.go	43.19% <ø> (ø)
eth/ethconfig/config.go	78.94% <ø> (ø)
eth/peer.go	95.80% <100.00%> (ø)
internal/cli/server/flags.go	100.00% <100.00%> (ø)
... and 30 more

... and 20 files with indirect coverage changes

Files with missing lines	Coverage Δ
core/blockchain.go	64.87% <ø> (+1.79%)	⬆️
core/blockchain_insert.go	78.50% <100.00%> (+1.27%)	⬆️
core/evm.go	93.67% <100.00%> (+19.65%)	⬆️
core/stateless/encoding.go	63.49% <ø> (ø)
core/stateless/witness.go	44.64% <100.00%> (+6.02%)	⬆️
core/txpool/blobpool/blobpool.go	54.87% <100.00%> (ø)
core/types/block.go	43.19% <ø> (ø)
eth/ethconfig/config.go	78.94% <ø> (ø)
eth/peer.go	95.80% <100.00%> (ø)
internal/cli/server/flags.go	100.00% <100.00%> (ø)
... and 30 more

... and 20 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[lucca30]

Additionally, the 500ms buffer previously reserved after transaction execution for SRC is removed when the pipeline is active. Transactions now get the full block time for inclusion since SRC runs in the background.

I am okay with the idea of removing the remaining 100ms.

We already reduced this buffer from 500ms to 100ms in v2.7.1, and from what we have seen so far, this remaining time looks small enough that removing it seems reasonable.

My main concern is not the removal of the 100ms itself. My concern is the cost of pipelining SRC with the next block production.

In other words: by doing SRC in parallel with block building, how much do we impact SRC time itself?

Do we expect SRC to remain roughly the same, or does it become meaningfully slower because it is now competing with the next block production? That is the part I would like to understand better.

I think this is basically a TPS vs finality question:

• on one side, we gain more block time for transaction inclusion, which is good for TPS
• on the other side, if SRC takes longer to complete, we may delay block completion, which could hurt finality

So I am supportive of the direction, but I think the key question is still:

How much TPS do we gain, and how much finality do we lose, if any, by making SRC fully pipelined with block production?

If the impact on SRC time is only slight, then the tradeoff is probably clearly worth it.

But if SRC time increases materially once it is pipelined with block production, then we should make that tradeoff explicit

[cffls]

Do we expect SRC to remain roughly the same, or does it become meaningfully slower because it is now competing with the next block production? That is the part I would like to understand better.

I think SRC will be roughly the same, because the time consuming part, trie nodes prefetching, is already running at the same time with tx execution today, and this PR doesn't change this behavior.

[claude]

Code Review

Found 3 issues in core/blockchain.go. Checked for bugs and CLAUDE.md compliance.

1. Missing ValidateReorg guard in pipelined import path (HIGH) — The non-pipelined path checks forker.ValidateReorg per-block before writing to prevent a race with newly-whitelisted Heimdall milestones/checkpoints. The pipelined path skips this check, allowing a block that conflicts with a freshly-anchored milestone to be accepted as chain head.

2. writeHeadBlock called without chainmu in auto-collection goroutine (HIGH) — On root mismatch, the recovery goroutine calls writeHeadBlock(parentBlock) which has a documented contract requiring the mu mutex to be held. The goroutine does not acquire it, creating a data race on chain head state.

3. flushPendingImportSRC error silently discarded (HIGH) — The function returns a meaningful error (SRC failure or root mismatch from a previously-committed block) but the error is discarded with _ in the block-error cleanup path. Every other call site handles this error.

[claude]

Inline Review Comments

Since inline comments could not be posted via the review API, here are the detailed findings with line references:

---

Issue 1 (HIGH): Missing ValidateReorg guard in pipelined import path — core/blockchain.go:3457

The non-pipelined path (lines 3618-3631) calls forker.ValidateReorg per-block immediately before writing to DB to prevent a race where a Heimdall milestone/checkpoint is whitelisted during block execution. The pipelined path skips this check entirely, calling writeBlockAndSetHeadPipelined without a preceding ValidateReorg. A block that conflicts with a freshly-anchored Heimdall milestone or checkpoint can be accepted as chain head in pipelined mode. The upfront check at line 3103 runs before execution begins and does not close this window.

Fix: Add the same per-block ValidateReorg guard before writeBlockAndSetHeadPipelined.

CLAUDE.md: blockchain-security.md and consensus-security.md

---

Issue 2 (HIGH): writeHeadBlock called without chainmu in auto-collection goroutine — core/blockchain.go:3507

writeHeadBlock has a documented contract at line 1733: "this function assumes that the mu mutex is held!". The auto-collection goroutine calls it without acquiring chainmu. After insertChainWithWitnesses returns and releases chainmu, this goroutine may still be running. If a root mismatch is detected, writeHeadBlock is called without the mutex — while another goroutine could concurrently acquire chainmu for a new InsertChain call. This is a data race on chain head state.

Fix: Acquire bc.chainmu.Lock() before calling writeHeadBlock in the error recovery path.

CLAUDE.md: security-common.md — "Shared mutable state protected by mutex or atomic operations"

---

Issue 3 (HIGH): flushPendingImportSRC error silently discarded — core/blockchain.go:3407

flushPendingImportSRC() returns a meaningful error (state root mismatch or SRC failure from a previously-committed block). Discarding it with _ means a block with a bad state root could persist undetected. Every other call site handles this error (line 1784, line 3328).

Fix: Replace _ = bc.flushPendingImportSRC() with if err := bc.flushPendingImportSRC(); err != nil { log.Error(...) } consistent with other call sites.

CLAUDE.md: security-common.md — "Error values checked — never discard errors with _ in security-sensitive paths"

[sonarqubecloud]

Quality Gate failed

Failed conditions
8.2% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 65 out of 66 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 72 out of 73 changed files in this pull request and generated 1 comment.

[pratikspatil024]

@claude review

[Copilot]

Pull request overview

Copilot reviewed 72 out of 73 changed files in this pull request and generated 2 comments.

[claude]

No new bugs found this run. Given the scale and consensus-critical nature of this pipelined state-root PR (73 files, block-import head-advance-before-root-verify, witness protocol changes), this still needs human sign-off rather than a shadow approval.

What was reviewed: the FlatDiff/PostExecState overlay and prefetch-root consistency paths, the pipelined-import auto-collection/root-verification flow, and the WIT-protocol witness-serving changes (resolveWitnessSizes, GetWitness pipelined wait, minedBroadcastLoop goroutine lifecycle, warm-snapshot Verkle handling) flagged by Copilot — none of these rose to a confirmed bug: the witness-wait/size-resolution paths are bounded by the header-existence + 64-block recency gate already added, and the goroutine-lifecycle/Verkle concerns didn't reproduce a concrete failure on inspection.

Extended reasoning...

No bugs were found by the bug-hunting system in this run. This PR (pipelined SRC for block import) is large (73 files) and touches consensus-critical paths: block head advancement before state-root verification, FlatDiff overlay masking for txpool/RPC reads, witness generation/serving over the WIT protocol, and prefetcher root handling. Prior runs found several real bugs (missing ValidateReorg guard, writeHeadBlock without chainmu, discarded flushPendingImportSRC error, nil-deref in pipeline.go, stale witness header copy) which the author has since fixed per their replies in the thread.

This run's bug hunters specifically re-examined the four still-open Copilot findings (resolveWitnessSizes read-before-budget-check and cache pollution, GetWitness's unbounded wait, minedBroadcastLoop's untracked goroutine, warm-snapshot behavior under Verkle) and did not confirm any of them as bugs beyond what the author already addressed via the header-existence/64-block-recency gate. That gate bounds the size-resolution and wait paths to a single in-flight SRC block rather than arbitrary hashes, which is why these did not reproduce as a real DoS or correctness issue on inspection.

Given the severity classification in this repo's own security rules (peer/RPC-triggerable issues in consensus/sync paths are escalated), and the sheer surface area of this diff (state package internals, bor consensus timing, witness protocol, txpool interaction), a human reviewer with deep context on the pipelined-SRC design should make the final call, especially since this is a new consensus-adjacent subsystem being enabled by a feature flag for the first time.

[Copilot]

Pull request overview

Copilot reviewed 72 out of 73 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

eth/handler_wit.go:143

• resolveWitnessSizes calls Chain().GetWitness(hash) to fetch witnesses when the persisted size index is missing. GetWitness() populates the chain witness cache (core/blockchain_reader.go:166-183) and may load a full witness before the per-request memory budget checks in handleGetWitness, so peer traffic can evict import-critical cache entries and can force large allocations even for requests that would later be rejected.

Consider adding an uncached “wait for pipelined witness” read path (e.g. extend GetWitnessUncached to also wait, but never cache), and use that here; alternatively, avoid prefetching full witnesses in size resolution and only fetch on-demand after passing the memory-budget guard.

[Copilot]

Pull request overview

Copilot reviewed 72 out of 73 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

consensus/bor/bor_test.go:5120

• This subtest’s fixed 100ms lower bound can be flaky, and it doesn’t directly assert the intended property (that Prepare(waitOnPrepare=true) waits until the cached parent boundary). Prefer asserting that the call returns at/after parentActual (with parentActual set far enough in the future to tolerate CI variability).

		require.NoError(t, err)
		require.GreaterOrEqual(t, elapsed, 100*time.Millisecond)
		require.NotZero(t, header.Time, "Prepare should still populate header time")

[Copilot]

Pull request overview

Copilot reviewed 72 out of 73 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

tests/bor/pipelined_rpc_test.go:86

• Same as above: waiting for importer listener port without a timeout can hang the test indefinitely on startup failures. Please add a bounded wait.

[Copilot]

Pull request overview

Copilot reviewed 72 out of 73 changed files in this pull request and generated 1 comment.