Skip to content

Ignore verify blob proof #806

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
FletcherMan merged 5 commits into from
Nov 10, 2025
+4 −4
Merged

Ignore verify blob proof #806

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
70158ca
Merge pull request #787 from morph-l2/main
FletcherMan Oct 15, 2025
2223d98
Merge pull request #789 from morph-l2/main
FletcherMan Oct 20, 2025
8084ced
Merge pull request #790 from morph-l2/main
FletcherMan Oct 21, 2025
cc4b6de
ignore blob verify
curryxbo Oct 31, 2025
6277d66
Merge branch 'main' into ignoreVerifyBlob
curryxbo Nov 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions node/derivation/derivation.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -359,10 +359,10 @@ func (d *Derivation) fetchRollupDataByTxHash(txHash common.Hash, blockNumber uin
copy(blob[:], b)

// Verify blob
if err := VerifyBlobProof(&blob, commitment, kzg4844.Proof(sidecar.KZGProof)); err != nil {
d.logger.Error("Blob verification failed", "error", err)
continue
}
//if err := VerifyBlobProof(&blob, commitment, kzg4844.Proof(sidecar.KZGProof)); err != nil {
// d.logger.Error("Blob verification failed", "error", err)
// continue
//}
Comment on lines +362 to +365
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Nov 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Critical: Blob proof verification has been disabled without justification.

Commenting out VerifyBlobProof bypasses the cryptographic validation that ensures blob data matches its KZG commitment. This verification is fundamental to EIP-4844 blob security and data availability guarantees in rollup systems.

Without verification, the system will accept:

  • Corrupted blob data
  • Malicious or tampered blobs
  • Data that doesn't match the commitment hash

This could lead to state corruption, consensus failures, or security vulnerabilities in the rollup derivation process.

Required actions:

  1. Provide clear justification for why verification is being disabled
  2. If this is temporary (debugging/testing), add a TODO comment with a tracking issue
  3. Consider using a feature flag if verification needs to be optionally disabled
  4. Otherwise, restore the verification call immediately

If there's a legitimate reason for this change (e.g., verification is redundant due to upstream checks), please document it clearly in the code and PR description.

🤖 Prompt for AI Agents 
node/derivation/derivation.go lines 362-365: the call to VerifyBlobProof was
commented out, disabling required KZG blob verification; restore the
VerifyBlobProof call as originally implemented so blobs are cryptographically
validated and log+continue on error, or if verification must be disabled
temporarily add a clear TODO with a tracking issue number and a short
justification comment; if you need opt-out behavior make it behind a feature
flag/config (default enabled) and gate the VerifyBlobProof call accordingly,
ensuring any removal or bypass is documented in the PR description and code
comments.


// Add to sidecar
blobTxSidecar.Blobs = append(blobTxSidecar.Blobs, *blob.KZGBlob())
Expand Down
Loading