Foundry v1.7.0

Foundry v1.7.0 brings major improvements to fuzzing and invariant testing, upstreams Tempo support into the main Foundry toolchain, adds support for HTTP 402-gated RPC endpoints through MPP, improves browser-wallet and batching workflows across Forge and Cast, and moves Foundry releases to an immutable versioning model.

v1.7.0 folds in the previously cut v1.6.0-rc1 release candidate, which never shipped as stable, together with the changes merged since.

Highlights

Testing & Fuzzing

• Parallelized stateless fuzzing across worker threads with shared corpus (#12713)
• Invariant check_interval config — deep invariant runs up to 3.6× faster with check_interval = 10 (#13133)
• Invariant optimization mode — search input sequences that maximize a target value, with realtime best-value tracking and persistence (#13196, #14147, #14226)
• Improved reentrancy detection in call_override invariant testing (#13127)
• Time-based invariant fuzzing via max_time_delay / max_block_delay configs (#12616)

Network Updates

• Osaka is the default EVM hardfork (#13112), with precompile decoding for Prague BLS12-381 and Osaka P256VERIFY (#13094)
• Per-network hardfork and network keys in foundry.toml (#14312, #14337), with auto-detection from a fork's chain ID (#14193)

Tempo

Tempo support has been upstreamed from the standalone tempoxyz/tempo-foundry fork into foundry-rs/foundry. The fork is deprecated; a normal foundryup install now ships Tempo support in forge, cast, anvil, and chisel.

This is 110 merged PRs spanning execution, RPC, transaction signing and validation, the AA/access-key flow, TIP20 fee tokens, cast keychain, forge create/script/test/coverage integration, Anvil genesis + pool + tracing, and CI. Notable entry points include:

• forge init --network tempo (#12819)
• cast keychain for Tempo access keys (#14166, #14222)
• cast tip20 create and TIP20 virtual address salt mining (#14160, #14365)
• --tempo.fee-token on forge script and cast send (#14204, #14184)
• Tempo network auto-detection on anvil --fork-url (#14279)

Full list in the Tempo section below.

MPP (Machine Payments Protocol)

Foundry now supports MPP (Machine Payments Protocol) for HTTP 402-gated RPC endpoints. When an RPC provider returns 402, Foundry signs and pays the challenge with the configured wallet, then retries the request — no API keys or upfront provisioning. A built-in URL mapping covers known providers, and a WebSocket transport handles long-lived subscriptions over paid connections (#14192, #14404, #14353).

Forge & Cast

• Browser wallet support across forge script (#12952), forge create (#14394), cast send (#13747), and cast erc20 (#14395) — sign and broadcast transactions directly from a browser wallet extension instead of provisioning a hot key on disk
• Realtime console.log in forge and chisel (#13321) and console.table support (#14338)
• forge inspect <x> linearization (#13704) makes it easier to inspect where inherited functions are resolved from
• forge clone Sourcify support (#12900)
• cast batch-send / batch-mktx for native call batching (#13973)
• cast --curl flag to print equivalent curl commands (#13114)

Cheatcodes & Lint

• New cheatcodes: executeTransaction (#13437), Ed25519 crypto (#13450), getRecordedLogsJson (#13093), currentFilePath (#13735)
• New forge-lint rules: incorrect ERC20 interface (#14428), incorrect ERC721 interface (#14412), block-timestamp (#14431), and custom errors (#13126). These catch incorrect ERC20/ERC721 interface implementations, timestamp-dependent logic, and custom-error usage issues.

Benchmarks

Live dashboard: getfoundry.sh/benchmarks

Headline wins per command, comparing v1.5.1 against the v1.7.0 release-cycle build:

Raw data: benches/LATEST.md.

Breaking / Behavior Changes

• forge and anvil now default to Osaka (#13112).
• Fuzz tests now use a random seed by default when none is provided (#13309).
• copyStorage and setArbitraryStorage are now marked Unsafe (#13882).
• Compilation now fails on unresolved imports instead of continuing (#12848).
• foundry.toml now supports per-network hardfork selection and an explicit network key (#14312, #14337); forked runs can also auto-detect the active network from chain ID (#14193).

Upgrade Notes

• Run forge build after upgrading. Compilation now fails on unresolved imports instead of silently continuing (#12848) — projects with stale remappings or dead imports that previously compiled may now error. Fix by correcting the remapping or removing the dead import.
• If you rely on reproducible fuzz runs, pin a fuzz seed explicitly. v1.7.0 now generates a random seed when none is provided (#13309).
• If you rely on copyStorage or setArbitraryStorage, update tests and helpers to account for these cheatcodes now being marked Unsafe (#13882).
• If you previously configured a single hardfork, migrate to the new network / per-network hardfork settings (#14312, #14337). Forked runs can also infer the active network from chain ID (#14193).

Testing & Fuzzing

Parallelized Stateless Fuzzing (#12713)

Stateless fuzz tests now run across multiple worker threads, significantly improving execution speed on multi-core machines. Each worker maintains its own corpus and periodically syncs with a master corpus, enabling efficient parallel exploration while sharing discovered coverage. Workers automatically distribute runs evenly and aggregate results after completion. Stateful (invariant) tests are not parallelized in this release.

Invariant check_interval Config (#13133)

A new check_interval config option controls how often invariants are asserted during deep runs:

[invariant]
depth = 1000
check_interval = 10

Benchmark: With check_interval = 10, deep invariant runs (1×1000 depth) are 3.6× faster (15.09s → 4.17s).

Caveat: with check_interval > 1, an invariant that is violated and then restored between checks can be missed.

Invariant Optimization Mode (#13196, #14147, #14226)

Define an invariant_* function that returns int256 and the fuzzer searches for the call sequence that maximizes it. Useful for finding worst-case rounding errors, drained balances, max slippage, etc.

function invariant_optimize_maxRoundingError() external view returns (int256) {
    return int256(pool.totalShares()) - int256(pool.expectedShares());
}

The best value and shrunk reproducer are tracked in realtime and persisted across runs.

Improved Reentrancy Detection with call_override (#13127)

The call_override invariant testing feature now correctly detects ETH transfer reentrancy vulnerabilities, including:

• EtherStore pattern: classic DAO-style reentrancy where a handler sends ETH out and the attacker reenters
• Rari Capital pattern: protocol-level reentrancy where external protocols send ETH to handlers

Validated against a reproduction of the April 2022 Rari Capital hack.

Time-based Invariant Fuzzing (#12616)

New max_time_delay and max_block_delay invariant configs enable fuzzing of block timestamp and block number on consecutive transactions. This helps discover time-dependent vulnerabilities that only manifest under specific block timing conditions. Counterexamples now display the vm.warp() and vm.roll() calls needed to reproduce failures.

Other Testing Improvements

Smaller polish across the fuzzing and invariant pipeline: clearer reporting of assertion failures, faster feedback on broken invariants, more reliable counterexample replay, and broader fuzz coverage including native Rust code.

Network Updates

Multi-Network Execution

The entire foundry-evm and anvil stack has been genericized over Network, Spec, Block, and EvmFactory, allowing one Foundry binary to drive Ethereum, Optimism, and Tempo through the same execution path. See the Internals section below for the full list of refactor PRs.

Notable consequences:

• A new network key in foundry.toml and per-network hardfork selection (#14337, #14312)
• Auto-detection of the active network from a fork's chain ID (#14193)

[profile.default]
tempo = true              # marks Tempo as the active non-Ethereum network
hardfork = "tempo:T3"     # namespaced hardfork; bare names like "osaka" still work for Ethereum

Hardforks can also be set per-test via inline config:

/// forge-config: default.hardfork = "tempo:T3"
function test_something() public { ... }

forge init --network tempo writes the tempo = true key for you. Forked runs (forge test --fork-url ...) infer the network from chain ID, so the network key is only required when there is no fork to infer from.

Other Chain Support

Per-chain quirks landed across XDC, SKALE, Polkadot, Optimism, Monad, MegaETH, Arbitrum, and Etherlink — covering RPC gas estimation, base-fee parameters, system-tx senders, and fork block pinning.

Improved Integration

Immutable Releases (#14445)

Foundry releases are now fully immutable. The mutable nightly, stable, and rc Git tags are gone — only semver tags (v*.*.*) and per-commit nightly-{SHA} releases exist.

For foundryup users:

• latest is the new default channel (alias: stable).
• nightly resolves to the most recent nightly-{SHA} prerelease.
• Pinning to a specific build (foundryup -i v1.7.0 or foundryup -i nightly-abc1234) continues to work and is now permanently reproducible.

Docker tags follow the same model: version releases get :v1.7.0, :v1.7, :v1; nightlies are tagged as nightly-{SHA}.

Foundryup Rust Rewrite (Experimental)

This release is accompanied by a new Rust rewrite of foundryup for better maintainability, testing, and compatibility. The rewrite is still experimental; the existing installer remains the recommended path for now. To try the new foundryup:

curl -L https://raw.githubusercontent.com/foundry-rs/foundryup/HEAD/foundryup-init.sh | bash
foundryup

Foundry-toolchain TypeScript Rewrite

The foundry-toolchain GitHub Action has been completely rewritten in TypeScript for improved maintainability and reliability. See the v1.7.0 release.

foundry-core

The previously standalone foundry-fork-db, foundry-compilers, foundry-block-explorers (+ foundry-blob-explorers), and foundry-wallets crates are now maintained under foundry-rs/foundry-core and consumed as published crates (#14348, #14427, #14443).

Other Integration Changes

Hardening of the publishing pipeline: trusted OIDC for npm and proper semver floating tags for Docker.

Tempo

Full PR breakdown for the Tempo upstreaming.

MPP (Machine Payments Protocol)

Full PR breakdown for end-to-end MPP support — 402 challenge handling, retry logic, a built-in RPC URL mapping, a WebSocket transport for paid subscriptions, and dedicated CI coverage.

Forge

Features

Headline Forge changes: Osaka becomes the default hardfork, browser-wallet signing extends to forge script / forge create, realtime console.log / console.table, random fuzz seeds by default, Sourcify support in forge clone, forge inspect linearization, and broader network/solc compatibility.

Cheatcodes, Fuzz & Invariant

Cheatcode features

• feat(cheatcodes): add getRecordedLogsJson cheatcode (#13093) by @grandizzy

• feat(cheatcodes): support both 4844/7594 formats in attachBlob (#13054) by @mablr

• feat: add executeTransaction cheatcode (#13437) by @onbjerg

  Replays a fully-signed RLP-encoded transaction in an isolated EVM context, recovering the signer from the signature. State changes merge back into the parent context.

  function executeTransaction(bytes calldata rawTx) external returns (bytes memory);

• feat(cheatcodes): add Ed25519 crypto cheatcodes (#13450) by @howydev

  bytes32 privateKey = vm.createEd25519Key(salt);
  bytes32 publicKey  = vm.publicKeyEd25519(privateKey);
  bytes memory sig   = vm.signEd25519("namespace", message, privateKey);
  bool ok            = vm.verifyEd25519(sig, "namespace", message, publicKey);

• feat(cheatcodes): add currentFilePath cheatcode (#13735) by @alextnetto

Fuzz

Improvements to mutation strategies and coverage-guided fuzzing for native Rust code, plus minor correctness fixes.

Invariant

Better counterexample validation, surfacing of assertion failures, and faster reporting of broken invariants. Optimization-mode PRs (#13196, #14147, #14226) and other testing improvements are listed under Testing & Fuzzing.

Cast

Wallets, signing & account inputs

Mnemonic-derived accounts, multi-authorization 7702 flows, browser-wallet receipt handling for cast send / cast erc20, plus cleanups around WalletOpts / EtherscanOpts.

Transactions, batching & gas

Native call batching (batch-send / batch-mktx), EIP-7594 support, raw-tx flags, system-tx replay, network-aware encoding, and a wave of correctness fixes around boundary checks and historical execution.

Tracing, inspection & interface tooling

--curl for reproducing requests, trace_transaction / trace_rawTransaction, --flatten for cast interface, persistent Etherscan source cache, query chunking for cast logs, plus --json parity across erc20 commands.

Reliability & RPC plumbing

Smaller robustness fixes for sender enumeration, threads handling, plasma verifier errors, and flaky-test cleanup.

Anvil

Features

New RPC endpoints (trace_replayBlockTransactions, eth_fillTransaction, eth_getStorageValues, debug_traceBlockBy{Hash,Number}), EIP-2935 / EIP-3860 / EIP-7825 support, multi-fork-URL round-robin load balancing, and new CLI flags for tx gas limits and pool sizing.

Chisel

Stability fixes for invalid pc/memory access and uninitialized variable handling. Realtime console.log is shared with forge (#13321) — see the Forge section.

Forge Lint

Features

These catch incorrect ERC20/ERC721 interface implementations, timestamp-dependent logic, and custom-error usage issues. Also includes lower default verbosity, mixedCase exception tweaks, and broader visitor coverage.

Fixes

Exit-code semantics for compilation warnings, unreachable macro cleanup, and missing late-visitor methods.

Forge Fmt

Features

A new namespace_import_style config and generic pretty-printing across blocks, transactions, receipts, OP envelopes, and Tempo receipts.

Fixes

Indentation correctness for chained struct calls, empty contracts, named-args calls, and multi-statement control blocks; plus total_difficulty and Tempo pretty-print fixes.

Verification

Features

Auto-recompile on forge verify-bytecode, custom verifier URLs for unknown Etherscan chains, and clearer Etherscan-key error messages.

Coverage

Coverage output is now produced even when tests fail, BRDA hit counts match LCOV expectations, and stack-too-deep warnings link to the troubleshooting guide.

Traces & Debugger

Features

A new -d / --depth trace flag (analogous to tree) and the debugger now shows actual gas usage alongside refunds.

Fixes

Decoder cache hygiene, verbosity unification, safer Sourcify parsing, panic guards on invalid source spans, and improved expectRevert formatting.

Wallets

Features

Browser-wallet flows extended to forge script / forge create, generic Network MultiWallet, new BrowserWalletOpts, and a --browser priority-fee patch.

Script & Broadcast

Features

The script pipeline (ScriptSequence, ScriptResult, ScriptConfig, BundledState, ScriptTransactionBuilder, …) is now fully Network-generic, enabling Tempo and Optimism scripting through the same code paths as Ethereum.

Fixes

Sender resolution improvements (--turnkey msg.sender, single-keystore auto-set) and preservation of exit reason on failed revert decoding.

Config

Features

foundry.toml gains a network key and per-network hardfork selection, plus ignored_error_codes_from and curl mode as a config key.

CLI

Markdown docs generation, log routing to stderr, --no-proxy for sandboxed macOS, common RPC opts extraction, and a handful of error-handling and EtherscanOpts polishing.

Internals: generic Network / EVM refactor

Mostly relevant to contributors and downstream integrators. The largest internal refactor since the revm/alloy migration: the entire foundry-evm, cheatcodes, script, cast, and anvil stacks were genericized over Network, Spec, Block, and EvmFactory, enabling a single Foundry binary to drive Ethereum, Optimism, and Tempo through the same code paths.

This work spans ~260 PRs, primarily by @mablr, @figtracer, and @stevencartavia, broken down roughly as:

• foundry-evm core: ~130 PRs (Backend, Executor, DatabaseExt, InspectorStack, FoundryEvmFactory, FoundryContextExt, NestedEvm, etc. all generic; Env abstraction removed; EthFoundryEvmFactory and OpEvmNetwork introduced)
• Cheatcodes generic refactor: ~30 PRs (Cheatcodes, CheatcodesExecutor, BroadcastableTransaction made Network/Evm/Spec/Block-generic)
• Anvil generic refactor: ~50 PRs (Backend, EthApi, Pool, Storage, Signer, BlockExecutor, fee history, beacon handlers, etc. all generic over Network)
• Additional supporting changes: ~50 PRs (trait-method usage instead of direct field access, dead-code removal, revm v34→v38 bump, alloy 2.0.x bumps)

Full PR list: v1.5.1...v1.7.0 changelog.

Distribution

Smaller distribution work covers Tempo support in foundryup, sha256sum sanitation, and npm OIDC release setup.

Docs

Major refresh of the foundry.toml reference (fuzz/invariant options, full config schema), README slimming, lint rule documentation, plus Anvil and command-help corrections.

Full Changelog

v1.5.1...v1.7.0