Add Wasmtime v44.0.1 as a second WebAssembly execution engine, selectable at runtime via the new featureWasmtimeEngine Amendment. When the Amendment is enabled, hook execution and WASM validation switch from WasmEdge to Wasmtime.
sfHookInstructionCount changes semantics to fuel consumed (initial budget: 10,000,000,000 units); fee calculation is redefined accordingly.
New files:
- external/wasmtime/conanfile.py + conandata.yml — prebuilt C API binary package (macOS arm64, Linux x86_64; SHA256-pinned at v44.0.1)
- cmake/deps/Wasmtime.cmake — find_package(wasmtime REQUIRED)
- src/.../WasmtimeEngine.h/.cpp — IWasmEngine implementation
Build system changes:
- CMakeLists.txt, conanfile.py: with_wasmtime option (default on)
- cmake/RippledCore.cmake: link wasmtime::wasmtime alongside wasmedge::wasmedge
Protocol changes:
- features.macro: XRPL_FEATURE(WasmtimeEngine, Supported::yes, DefaultNo)
- WasmEngine.h: constexpr kWasmtimeInitialFuel = 10'000'000'000ULL (consensus-fixed)
- applyHook.cpp, SetHook.cpp, Change.cpp: engine selected by featureWasmtimeEngine
Implementation notes:
- Consensus-fixed config: consume_fuel=true, wasm_simd=true, relaxed_simd=false, reference_types=true, bulk_memory=true, multi_value=false, nan_canonicalization=true
- Termination ABI: accept/rollback sets ExecState::terminated flag then returns a wasm_trap_t* to unwind the guest; execute() checks the flag before inspecting callErr to distinguish clean termination from errors
- Memory access workaround (ensureMemoryExported): Wasmtime lacks an index-based memory accessor equivalent to WasmEdge_CallingFrameGetMemoryInstance. The binary is patched before instantiation to inject a "memory" export when the module owns memory without exporting it, enabling wasmtime_caller_export_get() inside host callbacks.
Introduce an engine-agnostic abstraction so that <wasmedge/wasmedge.h> is included only in WasmEdgeEngine.cpp, enabling future execution engines to be plugged in without touching Hook API implementation code.
New files:
- include/xrpl/hook/WasmTypes.h – GuestMemory, WasmValue, HostFunctionDecl
- src/.../hook/detail/WasmEngine.h – IWasmEngine pure virtual interface, ExecutionResult, hookHostFunctionDecls()
- src/.../hook/detail/WasmEdgeEngine.h/.cpp – WasmEdge implementation; the sole consumer of wasmedge.h
Key changes:
- Macro.h: replace WasmEdge_* types with engine-agnostic WasmValue/GuestMemory; DEFINE_HOOK_FUNCTION now returns HostCallStatus via a thin wrapper
- applyHook.h: remove wasmedge.h include and HookExecutor class entirely
- applyHook.cpp: call makeWasmEdgeEngine()->execute() at the single call site
- SetHook.cpp, Change.cpp: call makeWasmEdgeEngine()->validate() for WASM validation instead of HookExecutor::validateWasm()
No behavioral change; no Amendment required.
Due to rounding, the LPTokenBalance of the last LP might not match the LP's trustline balance. This was fixed for `AMMWithdraw` in `fixAMMv1_1` by adjusting the LPTokenBalance to be the same as the trustline balance. Since `AMMClawback` is also performing a withdrawal, we need to adjust LPTokenBalance as well in `AMMClawback.`
This change includes:
1. Refactored `verifyAndAdjustLPTokenBalance` function in `AMMUtils`, which both`AMMWithdraw` and `AMMClawback` call to adjust LPTokenBalance.
2. Added the unit test `testLastHolderLPTokenBalance` to test the scenario.
3. Modify the existing unit tests for `fixAMMClawbackRounding`.
* Add AMM bid/create/deposit/swap/withdraw/vote invariants:
- Deposit, Withdrawal invariants: `sqrt(asset1Balance * asset2Balance) >= LPTokens`.
- Bid: `sqrt(asset1Balance * asset2Balance) > LPTokens` and the pool balances don't change.
- Create: `sqrt(asset1Balance * assetBalance2) == LPTokens`.
- Swap: `asset1BalanceAfter * asset2BalanceAfter >= asset1BalanceBefore * asset2BalanceBefore`
and `LPTokens` don't change.
- Vote: `LPTokens` and pool balances don't change.
- All AMM and swap transactions: amounts and tokens are greater than zero, except on withdrawal if all tokens
are withdrawn.
* Add AMM deposit and withdraw rounding to ensure AMM invariant:
- On deposit, tokens out are rounded downward and deposit amount is rounded upward.
- On withdrawal, tokens in are rounded upward and withdrawal amount is rounded downward.
* Add Order Book Offer invariant to verify consumed amounts. Consumed amounts are less than the offer.
* Fix Bid validation. `AuthAccount` can't have duplicate accounts or the submitter account.
Combine multiple related debug log data points into a single
message. Allows quick correlation of events that
previously were either not logged or, if logged, strewn
across multiple lines, making correlation difficult.
The Heartbeat Timer and consensus ledger accept processing
each have this capability.
Also guarantees that log entries will be written if the
node is a validator, regardless of log severity level.
Otherwise, the level of these messages is at INFO severity.
In PeerImpl.cpp, if the function is a message handler (onMessage) or called directly from a message handler, then it should use fee_, since when the handler returns (OnMessageEnd) then the charge function is called. If the function is not a message handler, such as a job queue item, it should remain charge.
- Also get the branch name.
- Use rev-parse instead of describe to get a clean hash.
- Return the git hash and branch name in server_info for admin
connections.
- Include git hash and branch name on separate lines in --version.
The LEDGER_ENTRY macro now takes an additional parameter, which makes it easier to avoid missing including the new field in jss.h and to the list of account_objects/ledger_data filters.
Replace Issue in STIssue with Asset. STIssue with MPTIssue is only used in MPT tests.
Will be used in Vault and in transactions with STIssue fields once MPT is integrated into DEX.
* Rename ASSERT to XRPL_ASSERT
* Upgrade to Anthithesis SDK 0.4.4, and use new 0.4.4 features
* automatic cast to bool, like assert
* Add instrumentation workflow to verify build with instrumentation enabled
Adds two CMake functions:
* add_module(library subdirectory): Declares an OBJECT "library" (a CMake abstraction for a collection of object files) with sources from the given subdirectory of the given library, representing a module. Isolates the module's headers by creating a subdirectory in the build directory, e.g. .build/tmp123, that contains just a symlink, e.g. .build/tmp123/basics, to the module's header directory, e.g. include/xrpl/basics, in the source directory, and putting .build/tmp123 (but not include/xrpl) on the include path of the module sources. This prevents the module sources from including headers not explicitly linked to the module in CMake with target_link_libraries.
* target_link_modules(library scope modules...): Links the library target to each of the module targets, and removes their sources from its source list (so they are not compiled and linked twice).
Uses these functions to separate and explicitly link modules in libxrpl:
Level 01: beast
Level 02: basics
Level 03: json, crypto
Level 04: protocol
Level 05: resource, server
* Copy Antithesis SDK version 0.4.0 to directory external/
* Add build option `voidstar` to enable instrumentation with Antithesis SDK
* Define instrumentation macros ASSERT and UNREACHABLE in terms of regular C assert
* Replace asserts with named ASSERT or UNREACHABLE
* Add UNREACHABLE to LogicError
* Document instrumentation macros in CONTRIBUTING.md
- Fix an erroneous high fee penalty that peers could incur for sending
older transactions.
- Update to the fees charged for imposing a load on the server.
- Prevent the relaying of internal pseudo-transactions.
- Before: Pseudo-transactions received from a peer will fail the signature
check, even if they were requested (using TMGetObjectByHash), because
they have no signature. This causes the peer to be charge for an
invalid signature.
- After: Pseudo-transactions, are put into the global cache
(TransactionMaster) only. If the transaction is not part of
a TMTransactions batch, the peer is charged an unwanted data fee.
These fees will not be a problem in the normal course of operations,
but should dissuade peers from behaving badly by sending a bunch of
junk.
- Improve logging: include the reason for fees charged to a peer.
Co-authored-by: Ed Hennis <ed@ripple.com>
