From 37ddde2bc1620944e336432627f077b2312f4127 Mon Sep 17 00:00:00 2001
From: Steven <9539892+tuan-phan@users.noreply.github.com>
Date: Wed, 1 Jul 2026 21:42:50 +0900
Subject: [PATCH] fix(op-reth): install default rustls CryptoProvider for
 flashblocks TLS

rustls 0.23 no longer auto-selects a process-level CryptoProvider when
multiple provider features are present in the dependency graph, so op-reth
panics on startup when it opens the flashblocks wss connection:

    Could not automatically determine the process-level CryptoProvider
    from Rustls crate features.

This kills the flashblocks service, so pre-confirmation RPCs such as
eth_sendRawTransactionSync never receive flashblocks and time out (~30s)
even though the transaction is mined normally.

Install the aws-lc-rs default provider in main() before any TLS is used,
matching reth's default provider selection.
---
 rust/op-reth/bin/Cargo.toml  | 1 +
 rust/op-reth/bin/src/main.rs | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/rust/op-reth/bin/Cargo.toml b/rust/op-reth/bin/Cargo.toml
index 6c00b836e7a..45832f2979b 100644
--- a/rust/op-reth/bin/Cargo.toml
+++ b/rust/op-reth/bin/Cargo.toml
@@ -23,6 +23,7 @@ reth-node-builder.workspace = true
 reth-db.workspace = true
 
 clap = { workspace = true, features = ["derive", "env"] }
+rustls = { workspace = true, features = ["aws_lc_rs", "std"] }
 tracing.workspace = true
 eyre.workspace = true
 
diff --git a/rust/op-reth/bin/src/main.rs b/rust/op-reth/bin/src/main.rs
index cd1436ce6f0..cb857cf2c2d 100644
--- a/rust/op-reth/bin/src/main.rs
+++ b/rust/op-reth/bin/src/main.rs
@@ -15,6 +15,13 @@ static MALLOC_CONF: &[u8] = b"prof:true,prof_active:true,lg_prof_sample:19\0";
 fn main() {
     reth_cli_util::sigsegv_handler::install();
 
+    // rustls 0.23 no longer auto-selects a process-level CryptoProvider when
+    // multiple provider features are present in the dependency graph. Install one
+    // explicitly before any TLS is used (e.g. the flashblocks wss connection),
+    // otherwise op-reth panics on startup. See
+    // https://github.com/ethereum-optimism/optimism/issues/19322
+    let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
+
     // Enable backtraces unless a RUST_BACKTRACE value has already been explicitly provided.
     if std::env::var_os("RUST_BACKTRACE").is_none() {
         unsafe {