Add L1SLOAD (RIP-7728) proof collection and ZK verification for Taiko L2

[jmadibekov]

What is L1SLOAD?

L1SLOAD (RIP-7728) is a precompile at address 0x10001 that lets L2 smart contracts read L1 Ethereum storage. An L2 transaction calls the precompile with 84 bytes — an L1 contract address (20 bytes), a storage key (32 bytes), and an L1 block number (32 bytes) — and gets back the 32-byte storage value from that slot at that block.

This enables cross-layer composability: L2 contracts can read L1 oracle prices, verify L1 token balances, or check L1 governance state without a separate bridge.

What this PR does

Adds end-to-end L1SLOAD support to Raiko's preflight (witness collection) and proving (ZK verification) phases.

Preflight phase (with network access)

1. Direct call detection — Scans block transactions for calls to 0x10001 with 84-byte input and extracts the requested (address, key, block_number) tuples.
2. Indirect call detection — Executes the block with an RPC fallback callback. When a smart contract internally calls the L1SLOAD precompile (not visible from tx scanning), the callback fetches the value from L1, caches it, and records the call.
3. Proof collection — Fetches EIP-1186 Merkle proofs (eth_getProof) for all detected calls, batched by (block_number, address).
4. Header chain collection — Fetches L1 block headers for the backward chain (anchor → anchor-256) and forward chain (anchor → l1origin) needed for state root verification.

Proving phase (no network, inside ZK/SGX)

1. Header chain verification — Verifies parent_hash linkage in both directions from the trusted anchor block to build a verified block_number → state_root map.
2. MPT proof verification — For each L1SLOAD call, verifies the account proof against the state root and the storage proof against the account's storage root, using alloy_trie::verify_proof.
3. Cache population — Populates the L1SLOAD precompile cache with verified values only.
4. Re-execution — The block re-executes deterministically; all L1SLOAD reads come from the pre-populated cache.

Trust model

The anchor block's state root (committed in the L2 anchor transaction) is the cryptographic trust root. All L1 state is verified against it:

Anchor tx → anchor_state_root (trusted)
                    |
    ┌───────────────┴───────────────┐
    ▼                               ▼
  Backward (parent_hash)      Forward (parent_hash)
  anchor-1 ... anchor-256    anchor+1 ... l1origin
    ▼                               ▼
  State root per block        State root per block
    ▼                               ▼
  Account proof (MPT)         Account proof (MPT)
    ▼                               ▼
  Storage proof (MPT)         Storage proof (MPT)
    ▼                               ▼
  Verified value              Verified value

Block range

• Backward: up to 256 blocks before the anchor block
• Forward: from anchor block up to the L1 origin block
• Valid range: [anchor - 256, l1origin]

Key implementation details

• Concurrency safety: A global execution lock serializes the cache clear → verify → populate → execute cycle across concurrent proving tasks, since the L1SLOAD precompile uses process-global state.
• Anchor extraction: get_anchor_tx_info_by_fork() handles all Taiko fork variants (Shasta, Pacaya, Ontake, default).
• Non-existence proofs: MPT verification correctly handles branch nodes (17 RLP elements), extension nodes (HP flag < 2), and leaf nodes (HP flag ≥ 2).
• Backward compatibility: New GuestInput fields use #[serde(default)] so pre-L1SLOAD inputs continue to work.

Example: what gets detected

Call pattern	Detection method
EOA → 0x10001 (direct)	Transaction input scanning
EOA → Contract → 0x10001 (indirect)	RPC fallback callback during execution
EOA → Proxy → Implementation → 0x10001	RPC fallback callback during execution

Files changed

Area	Files	What
Data types	lib/src/input.rs, lib/src/anchor.rs	L1StorageProof struct, anchor extraction
Verification	lib/src/l1_precompiles/l1sload.rs	MPT verification, header chain validation
Proving	core/src/lib.rs	prepare_l1sload_for_execution() orchestration
Preflight	core/src/preflight/mod.rs, core/src/preflight/util.rs	Call detection, proof collection, RPC fallback
RPC	core/src/provider/rpc.rs, core/src/provider/mod.rs	L1 storage proof fetching
Build	lib/src/builder/mod.rs	Cache population during block building

Cross references

• Companion precompile PR: Add L1SLOAD precompile (RIP-7728) for reading L1 storage from L2 alethia-reth#11 (the L1SLOAD precompile implementation in alethia-reth that this PR integrates with)
• RIP-7728: https://github.com/ethereum/RIPs/blob/master/RIPS/rip-7728.md
• EIP-1186 (eth_getProof): https://eips.ethereum.org/EIPS/eip-1186
• MPT reference: https://ethereum.org/developers/docs/data-structures-and-encoding/patricia-merkle-trie/