Regression in 2.3.2: Internal Error: unimplemented precompiled contract 0x10 (EIP-2537 BLS12-381) — works in 2.3.1
- Dominant language
- Haskell
- Stars
- 3.2k
- Forks
- 432
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 5
Description
## Summary
Echidna **2.3.2** aborts at campaign start with an hevm internal error on a target that Echidna **2.3.1 fuzzes without issue**:
```
echidna: Internal Error: unimplemented precompiled contract 0x0000000000000000000000000000000000000010 -- CallStack (from HasCallStack):
internalError, called at src/EVM.hs:3088:10 in hevm-0.57.0-...:EVM
CallStack (from HasCallStack):
error, called at src/EVM/Types.hs:1574:19 in hevm-0.57.0-...:EVM.Types
internalError, called at src/EVM.hs:3088:10 in hevm-0.57.0-...:EVM
```
Address `0x0000...0010` (`0x10`) is one of the **EIP-2537 BLS12-381 precompiles** (added in the Pectra hardfork; `0x10` is `BLS12_MAP_FP_TO_G1` in the final assignment). The target contract reaches that precompile, and `hevm 0.57.0` (bundled in the 2.3.2 Linux release) has no implementation for it, so the whole campaign dies immediately — no test cases are ever run.
This looks like a **regression in 2.3.2**: the exact same target, harness, and command produce a full 4-hour campaign under **2.3.1**.
## Environment
- **Broken:** Echidna `2.3.2` (official Linux x86_64 release, `echidna-2.3.2-x86_64-linux.tar.gz`), bundling `hevm-0.57.0`.
- **Working:** Echidna `2.3.1` (official Linux x86_64 release).
- OS: Ubuntu 24.04, x86_64.
- crytic-compile + slither compile the target successfully in both cases; the failure is purely at EVM execution.
## Steps to reproduce
Target (public): https://github.com/scfuzzbench/aave-v4-scfuzzbench @ `459b020058f4a65d18eb1481083b75c766340124`
Harness entry point: `tests/recon/CryticTester.sol` (contract `CryticTester`).
Command (verbatim from our runner):
```
echidna --config echidna.yaml --contract CryticTester --workers 16 \
--corpus-dir --test-limit 1000000000 --shrink-limit 1 \
tests/recon/CryticTester.sol +RTS -A1g -RTS
```
- **2.3.2:** compiles, runs slither, then immediately prints the `unimplemented precompiled contract 0x10` internal error and exits (~within seconds of starting the campaign).
- **2.3.1:** same command, same target — runs the full campaign and finds assertion failures normally.
## What we observed
We hit this while running Echidna as part of the [scfuzzbench](https://scfuzzbench.com) fuzzer benchmark. Across two independent 2.3.1 runs on this target, Echidna fuzzed for the full budget and found ~7–8 canonical assertion failures with no error. After bumping to 2.3.2 (identical target/commit/harness/flags), both instances died at ~88s with the error above and 0 test cases executed.
Public run page for the failing 2.3.2 run (see the Echidna leg warning + logs):
https://scfuzzbench.com/runs/gh-29938127768-1/1e70047c32b1c47c84a1c9b8b7154dba/
Full bootstrap + `echidna.log` for both the 2.3.1 (working) and 2.3.2 (crashing) runs are available — happy to attach or share.
## Hypothesis / questions
A plausible mechanism is a change in the **default EVM version / hardfork** between 2.3.1 and 2.3.2 (or in the bundled hevm): if 2.3.2 now targets a Pectra-era fork, calls to `0x10` get routed into precompile dispatch, where `hevm 0.57.0` lacks an EIP-2537 implementation and calls `internalError` instead of degrading gracefully. Under an earlier default fork, `0x10` would just be an ordinary (empty) account.
- Is this a known gap in the bundled hevm (no EIP-2537 BLS precompiles), and/or a change in the default `evmVersion`?
- Is there a recommended workaround today — e.g., pinning an earlier `evmVersion` in the Echidna config so `0x10` isn't treated as a precompile? (We can try this and report back.)
- Ideally, `hevm` would implement the EIP-2537 precompiles, or at least not `internalError` on an unimplemented precompile.
Thanks! Glad to provide a minimal reproducer, additional logs, or to test a candidate fix on the full target.
Contributor guide
Research direction
Reproduce the failure with tests/recon/CryticTester.sol and the listed Echidna command, comparing releases 2.3.1 and 2.3.2. Start by tracing the reported hevm paths at src/EVM.hs:3088 and src/EVM/Types.hs:1574, then inspect the EVM version and precompile dispatch behavior. Done means the target campaign no longer aborts on address 0x10 and executes test cases, with regression coverage for the affected behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- haskell, solidity
- Domain
- security, testing
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100