feat(evm): align Zones with Tempo T11 precompile decoding

[legion2002]

Summary

Updates the Zones EVM integration to Tempo PR #7444 and makes Zone precompile admission follow the active Tempo hardfork.

• aligns Tempo, Reth, Alloy, Commonware, and lockfile revisions
• passes the active TempoHardfork into precompile input-gas calculation
• uses the Tempo fork-aware ABI decoder configuration in every Zone admission wrapper
• retains permissive decoding before T11 and enables strict decoding at T11

Why

Tempo precompile input cost and ABI decoding are now hardfork-dependent. Zones wraps Tempo precompiles with its own authorization layer, so decoding calldata with a different configuration before forwarding can produce caller-dependent results for malformed input.

Using the same Tempo configuration in both layers ensures historical pre-T11 blocks retain their old decoding and gas behavior, while T11 blocks use the increased input cost, strict ABI validation, and the allocation limit selected by Tempo.

Zone chain specs already inherit Tempo fork activation times, and ZoneEvmConfig selects the Tempo spec from each block timestamp. This change carries that selected spec through the wrapper admission paths.

Reexecution

• pre-T11: 6 gas per calldata word and permissive ABI decoding
• T11+: 30 gas per calldata word and strict ABI decoding
• historical blocks derive behavior from their original block timestamp

Validation

• cargo test -p zone-precompiles --lib --no-fail-fast: 152 passed, 1 existing ignored
• cargo check -p zone-evm
• T10/T11 input-gas boundary regression
• pre-T11 noncanonical-address privacy regression
• T11 owner/outsider malformed-calldata consistency regression
• existing timestamp-based Tempo fork-selection coverage

Stack note

This is the base of a two-PR stack.

The dependency alignment includes a newer Reth revision that removed the old HashedStorage.wiped and sparse-trie wipe APIs. As a result, the full workspace check stops at the expected zone-spf compatibility errors on this PR alone. The stacked child adapts stateless proof execution and the node APIs to the new Reth revision, and restores the full workspace build.

This split keeps the Tempo/T11 behavior change independently reviewable.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	commonware-cryptography@​2026.7.1
	commonware-actor@​2026.7.1
	commonware-codec@​2026.7.1
	commonware-math@​2026.7.1
	commonware-p2p@​2026.7.1
	commonware-runtime@​2026.7.1
	commonware-utils@​2026.7.1
	alloy@​2.3.0 ⏵ 2.4.1
	alloy-consensus@​2.3.0 ⏵ 2.4.1
	alloy-contract@​2.3.0 ⏵ 2.4.1
	alloy-eips@​2.3.0 ⏵ 2.4.1
	alloy-hardforks@​0.4.7 ⏵ 0.4.8
	alloy-network@​2.3.0 ⏵ 2.4.1
	alloy-primitives@​1.6.1 ⏵ 1.7.2
	alloy-provider@​2.3.0 ⏵ 2.4.1
	alloy-rpc-client@​2.3.0 ⏵ 2.4.1
	alloy-rpc-types-debug@​2.3.0 ⏵ 2.4.1
	alloy-rpc-types-engine@​2.3.0 ⏵ 2.4.1
	alloy-rpc-types-eth@​2.3.0 ⏵ 2.4.1
	alloy-signer@​2.3.0 ⏵ 2.4.1
	alloy-signer-local@​2.3.0 ⏵ 2.4.1
	alloy-sol-types@​1.6.1 ⏵ 1.7.2
	alloy-transport@​2.3.0 ⏵ 2.4.1
	alloy-genesis@​2.3.0 ⏵ 2.4.1

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Recently published: cargo alloy-dyn-abi published 9 hours ago Location: Package overview From: ? → cargo/alloy-contract@2.4.1 → cargo/alloy@2.4.1 → cargo/alloy-dyn-abi@1.7.2 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/alloy-dyn-abi@1.7.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: cargo alloy-json-abi published 9 hours ago Location: Package overview From: ? → cargo/alloy-contract@2.4.1 → cargo/alloy@2.4.1 → cargo/alloy-sol-types@1.7.2 → cargo/alloy-json-abi@1.7.2 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/alloy-json-abi@1.7.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: cargo alloy-primitives published 9 hours ago Location: Package overview From: bin/prover/enclave/Cargo.toml → cargo/alloy-primitives@1.7.2 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/alloy-primitives@1.7.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: cargo alloy-sol-macro-expander published 9 hours ago Location: Package overview From: ? → cargo/alloy-sol-types@1.7.2 → cargo/alloy-sol-macro-expander@1.7.2 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/alloy-sol-macro-expander@1.7.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: cargo alloy-sol-macro-input published 9 hours ago Location: Package overview From: ? → cargo/alloy-sol-types@1.7.2 → cargo/alloy-sol-macro-input@1.7.2 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/alloy-sol-macro-input@1.7.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: cargo alloy-sol-macro published 9 hours ago Location: Package overview From: ? → cargo/alloy-sol-types@1.7.2 → cargo/alloy-sol-macro@1.7.2 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/alloy-sol-macro@1.7.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: cargo alloy-sol-type-parser published 9 hours ago Location: Package overview From: ? → cargo/alloy-contract@2.4.1 → cargo/alloy@2.4.1 → cargo/alloy-sol-types@1.7.2 → cargo/alloy-sol-type-parser@1.7.2 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/alloy-sol-type-parser@1.7.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: cargo alloy-sol-types published 9 hours ago Location: Package overview From: bin/prover/utils/Cargo.toml → cargo/alloy-sol-types@1.7.2 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/alloy-sol-types@1.7.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: cargo lru published 19 hours ago Location: Package overview From: ? → cargo/alloy-provider@2.4.1 → cargo/lru@0.18.4 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/lru@0.18.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: cargo syn-solidity published 9 hours ago Location: Package overview From: ? → cargo/alloy-sol-types@1.7.2 → cargo/syn-solidity@1.7.2 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/syn-solidity@1.7.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[0xalpharush]

we can only check these selectors using .get(..4) after T11

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-03T19:19:40.655419Z	af16f93	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.