Motivation
We've made most of the pipeline trustless: CAR-verified IPFS fetches, hash-verified npm tarballs and solc binaries, pinned circom WASM, self-hosted Monaco assets. The remaining unverified input is every RPC response — token balances, storageAt, ENS lookups, simulation pre-state are all taken on the provider's word.
Colibri (corpus.core, production release for Ethereum mainnet Nov 2025) closes that gap: a stateless light client (~200kB C→WASM) split into a remote prover (assembles sync-committee BLS signatures + Merkle proofs into a compact bundle) and a local verifier that checks the bundle in-browser, holding only the current sync committee (~27h rotation). A dishonest prover can't forge anything — its bundle simply fails verification. It exposes an EIP-1193 provider and can verify eth_call results and revert reasons against cryptographically anchored pre-state.
Proposed integration
Infrastructure in the sdk, not an EVML module:
- Wrap the transport in the sdk's
clientFor with Colibri's EIP-1193 provider when the chain is supported and verification is enabled.
- Opt-in via
set $std:verifyReads true (and/or a --verified flag on reads and sim:fork) — proof assembly adds latency vs. a plain RPC round-trip, so it shouldn't be on for every hover/completion read.
- Wire the revm backend's miss-and-replay state fetches through the verified provider → verified pre-state in, locally executed revm out: fully verified local simulation.
- Pin a weak-subjectivity checkpoint in the repo (same discipline as the solc hash pins) and update it periodically.
Caveats / open questions
- Chain coverage: production is Ethereum mainnet only; Gnosis and Optimism are MVP-stage upstream. Needs graceful fallback to plain RPC on unsupported chains, and our audience is heavily on Gnosis — track upstream.
- Prover liveness: integrity is free but availability isn't. The prover is open source;
api.evmcrispr.com could host one alongside the CORS proxy if the public endpoint flakes.
- Historical state: sync-committee proofs favor recent blocks — fine for sims and live reads, thin for explorer-module archaeology.
- Bundle-size impact of the WASM verifier in the terminal app; asset must be hash-pinned per our asset-verification policy.
References
Motivation
We've made most of the pipeline trustless: CAR-verified IPFS fetches, hash-verified npm tarballs and solc binaries, pinned circom WASM, self-hosted Monaco assets. The remaining unverified input is every RPC response — token balances,
storageAt, ENS lookups, simulation pre-state are all taken on the provider's word.Colibri (corpus.core, production release for Ethereum mainnet Nov 2025) closes that gap: a stateless light client (~200kB C→WASM) split into a remote prover (assembles sync-committee BLS signatures + Merkle proofs into a compact bundle) and a local verifier that checks the bundle in-browser, holding only the current sync committee (~27h rotation). A dishonest prover can't forge anything — its bundle simply fails verification. It exposes an EIP-1193 provider and can verify
eth_callresults and revert reasons against cryptographically anchored pre-state.Proposed integration
Infrastructure in the sdk, not an EVML module:
clientForwith Colibri's EIP-1193 provider when the chain is supported and verification is enabled.set $std:verifyReads true(and/or a--verifiedflag on reads andsim:fork) — proof assembly adds latency vs. a plain RPC round-trip, so it shouldn't be on for every hover/completion read.Caveats / open questions
api.evmcrispr.comcould host one alongside the CORS proxy if the public endpoint flakes.References