Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions gas/gas.zkasm
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@
;; "Out Of Gas Exception". When OOGX==1, it means the corresponding
;; instruction generated an out-of-gas exception (rather than some
;; other exception kind).
pub fn gas(GAS_COST u64, GAS_ACTUAL u64, XAHOY u1, OOGX u1) {
var tmp u64
pub fn gas(GAS_COST u32, GAS_ACTUAL u32, XAHOY u1, OOGX u1) {
var tmp u32
var b u1
;;
b, tmp = GAS_ACTUAL - GAS_COST
Expand Down
4 changes: 2 additions & 2 deletions hub/cancun/columns/shared.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -64,8 +64,8 @@

;; gas columns
( GAS_EXPECTED :i64 )
( GAS_ACTUAL :i64 )
( GAS_COST :i64 )
( GAS_ACTUAL :i32 )
( GAS_COST :i32 )
( GAS_NEXT :i64 )
( REFUND_COUNTER :i32 )
( REFUND_COUNTER_NEW :i32 )
Expand Down
6 changes: 3 additions & 3 deletions hub/cancun/columns/transaction.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,9 @@

;; end of transaction predictions
( STATUS_CODE :binary )
( GAS_LEFTOVER :i64 )
( REFUND_COUNTER_INFINITY :i64 )
( REFUND_EFFECTIVE :i64 )
( GAS_LEFTOVER :i32 )
( REFUND_COUNTER_INFINITY :i25 )
( REFUND_EFFECTIVE :i25 )
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Refund fields use insufficient bit width for values

The REFUND_COUNTER_INFINITY, REFUND_COUNTER_FINAL, and REFUND_EFFECTIVE fields are reduced to :i25 (max ~33.5 million), but with LINEA_BLOCK_GAS_LIMIT at 2 billion, the maximum REFUND_EFFECTIVE value can reach 400 million (gas_used/5 per EIP-3529). Additionally, REFUND_COUNTER_INFINITY receives values from REFUND_COUNTER_NEW which is :i32 in the HUB's shared columns, creating a type mismatch. The 25-bit width is insufficient to hold these potential values and could cause overflow or truncation.

Additional Locations (2)

Fix in Cursor Fix in Web

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Refund columns too small for pre-Osaka forks

The REFUND_COUNTER_INFINITY and REFUND_EFFECTIVE columns are reduced to :i25 (max ~33.5 million), but the i25 size is only valid when EIP-7825 applies (which caps transaction gas at 2^24 ≈ 16.7M). EIP-7825 only applies to Osaka fork. For pre-Osaka forks (London, Shanghai, Cancun, Prague), transaction gas can reach LINEA_GAS_LIMIT_MAXIMUM = 2 billion, making REFUND_EFFECTIVE potentially up to 2 billion and refund_limit up to 400 million - both exceeding the i25 capacity and causing overflow.

Additional Locations (2)

Fix in Cursor Fix in Web


;; coinbase related
( COINBASE_ADDRESS_HI :i32 )
Expand Down
4 changes: 2 additions & 2 deletions hub/london/columns/shared.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -51,8 +51,8 @@

;; gas columns
( GAS_EXPECTED :i64 )
( GAS_ACTUAL :i64 )
( GAS_COST :i64 )
( GAS_ACTUAL :i32 )
( GAS_COST :i32 )
( GAS_NEXT :i64 )
( REFUND_COUNTER :i32 )
( REFUND_COUNTER_NEW :i32 )
Expand Down
6 changes: 3 additions & 3 deletions hub/london/columns/transaction.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,9 @@

;; end of transaction predictions
( STATUS_CODE :binary)
( GAS_LEFTOVER :i64 )
( REFUND_COUNTER_INFINITY :i64 )
( REFUND_EFFECTIVE :i64 )
( GAS_LEFTOVER :i32 )
( REFUND_COUNTER_INFINITY :i25 )
( REFUND_EFFECTIVE :i25 )

;; coinbase related
( COINBASE_ADDRESS_HI :i32 )
Expand Down
4 changes: 2 additions & 2 deletions hub/osaka/columns/shared.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -64,8 +64,8 @@

;; gas columns
( GAS_EXPECTED :i64 )
( GAS_ACTUAL :i64 )
( GAS_COST :i64 )
( GAS_ACTUAL :i32 )
( GAS_COST :i32 )
( GAS_NEXT :i64 )
( REFUND_COUNTER :i32 )
( REFUND_COUNTER_NEW :i32 )
Expand Down
6 changes: 3 additions & 3 deletions hub/osaka/columns/transaction.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,9 @@

;; end of transaction predictions
( STATUS_CODE :binary )
( GAS_LEFTOVER :i64 )
( REFUND_COUNTER_INFINITY :i64 )
( REFUND_EFFECTIVE :i64 )
( GAS_LEFTOVER :i32 )
( REFUND_COUNTER_INFINITY :i25 )
( REFUND_EFFECTIVE :i25 )

;; coinbase related
( COINBASE_ADDRESS_HI :i32 )
Expand Down
4 changes: 2 additions & 2 deletions hub/prague/columns/shared.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -64,8 +64,8 @@

;; gas columns
( GAS_EXPECTED :i64 )
( GAS_ACTUAL :i64 )
( GAS_COST :i64 )
( GAS_ACTUAL :i32 )
( GAS_COST :i32 )
( GAS_NEXT :i64 )
( REFUND_COUNTER :i32 )
( REFUND_COUNTER_NEW :i32 )
Expand Down
6 changes: 3 additions & 3 deletions hub/prague/columns/transaction.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,9 @@

;; end of transaction predictions
( STATUS_CODE :binary )
( GAS_LEFTOVER :i64 )
( REFUND_COUNTER_INFINITY :i64 )
( REFUND_EFFECTIVE :i64 )
( GAS_LEFTOVER :i32 )
( REFUND_COUNTER_INFINITY :i25 )
( REFUND_EFFECTIVE :i25 )

;; coinbase related
( COINBASE_ADDRESS_HI :i32 )
Expand Down
4 changes: 2 additions & 2 deletions hub/shanghai/columns/shared.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -51,8 +51,8 @@

;; gas columns
( GAS_EXPECTED :i64 )
( GAS_ACTUAL :i64 )
( GAS_COST :i64 )
( GAS_ACTUAL :i32 )
( GAS_COST :i32 )
( GAS_NEXT :i64 )
( REFUND_COUNTER :i32 )
( REFUND_COUNTER_NEW :i32 )
Expand Down
6 changes: 3 additions & 3 deletions hub/shanghai/columns/transaction.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -35,9 +35,9 @@

;; end of transaction predictions
( STATUS_CODE :binary)
( GAS_LEFTOVER :i64 )
( REFUND_COUNTER_INFINITY :i64 )
( REFUND_EFFECTIVE :i64 )
( GAS_LEFTOVER :i32 )
( REFUND_COUNTER_INFINITY :i25 )
( REFUND_EFFECTIVE :i25 )

;; coinbase related
( COINBASE_ADDRESS_HI :i32 )
Expand Down
2 changes: 1 addition & 1 deletion txndata/cancun/columns/common.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,6 @@
;; heartbeat
( CT :i4 )
( CT_MAX :i4 )
( GAS_CUMULATIVE :i128 )
( GAS_CUMULATIVE :i32 )
)

6 changes: 3 additions & 3 deletions txndata/cancun/columns/hub_view.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,9 @@
( CFI :i16 )
( INIT_BALANCE :i128 )
( STATUS_CODE :binary@prove )
( GAS_LEFTOVER :i128 )
( REFUND_COUNTER_FINAL :i128 )
( REFUND_EFFECTIVE :i128 )
( GAS_LEFTOVER :i32 )
( REFUND_COUNTER_FINAL :i25 )
( REFUND_EFFECTIVE :i25 )
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Refund field type too small for large transactions

The REFUND_COUNTER_FINAL and REFUND_EFFECTIVE fields are reduced to :i25 (max ~33.5 million), but on Linea the block gas limit is 2 billion. With MAX_REFUND_QUOTIENT of 5, a transaction consuming all available gas could have a refund up to 400 million, which far exceeds what :i25 can represent. The transaction gas cap (EIP-7825 at 2^24) that would justify this size only applies to Osaka, not to cancun, prague, london, or shanghai forks where this change is also applied. This would cause overflow for large transactions.

Additional Locations (2)

Fix in Cursor Fix in Web

( EIP_4788 :binary@prove )
( EIP_2935 :binary@prove )
( NOOP :binary@prove )
Expand Down
8 changes: 4 additions & 4 deletions txndata/london/columns.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -30,10 +30,10 @@
(TYPE2 :binary@prove)
(REQUIRES_EVM_EXECUTION :binary@prove)
(COPY_TXCD :binary@prove)
(GAS_LEFTOVER :i128)
(REFUND_COUNTER :i128)
(REFUND_EFFECTIVE :i128)
(GAS_CUMULATIVE :i128)
(GAS_LEFTOVER :i32 )
(REFUND_COUNTER :i25 )
(REFUND_EFFECTIVE :i25 )
(GAS_CUMULATIVE :i32 )
(STATUS_CODE :binary@prove)
(PHASE_RLP_TXN :byte)
(PHASE_RLP_TXNRCPT :byte)
Expand Down
2 changes: 1 addition & 1 deletion txndata/osaka/columns/common.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,6 @@
;; heartbeat
( CT :i5 )
( CT_MAX :i5 )
( GAS_CUMULATIVE :i128 )
( GAS_CUMULATIVE :i32 )
)

6 changes: 3 additions & 3 deletions txndata/osaka/columns/hub_view.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,9 @@
( CFI :i16 )
( INIT_BALANCE :i128 )
( STATUS_CODE :binary@prove )
( GAS_LEFTOVER :i128 )
( REFUND_COUNTER_FINAL :i128 )
( REFUND_EFFECTIVE :i128 )
( GAS_LEFTOVER :i32 )
( REFUND_COUNTER_FINAL :i25 )
( REFUND_EFFECTIVE :i25 )
( EIP_4788 :binary@prove )
( EIP_2935 :binary@prove )
( NOOP :binary@prove )
Expand Down
2 changes: 1 addition & 1 deletion txndata/prague/columns/common.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,6 @@
;; heartbeat
( CT :i4 )
( CT_MAX :i4 )
( GAS_CUMULATIVE :i128 )
( GAS_CUMULATIVE :i32 )
)

6 changes: 3 additions & 3 deletions txndata/prague/columns/hub_view.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,9 @@
( CFI :i16 )
( INIT_BALANCE :i128 )
( STATUS_CODE :binary@prove )
( GAS_LEFTOVER :i128 )
( REFUND_COUNTER_FINAL :i128 )
( REFUND_EFFECTIVE :i128 )
( GAS_LEFTOVER :i32 )
( REFUND_COUNTER_FINAL :i25 )
( REFUND_EFFECTIVE :i25 )
( EIP_4788 :binary@prove )
( EIP_2935 :binary@prove )
( NOOP :binary@prove )
Expand Down
8 changes: 4 additions & 4 deletions txndata/shanghai/columns.lisp
Original file line number Diff line number Diff line change
Expand Up @@ -30,10 +30,10 @@
(TYPE2 :binary@prove)
(REQUIRES_EVM_EXECUTION :binary@prove)
(COPY_TXCD :binary@prove)
(GAS_LEFTOVER :i128)
(REFUND_COUNTER :i128)
(REFUND_EFFECTIVE :i128)
(GAS_CUMULATIVE :i128)
(GAS_LEFTOVER :i32 )
(REFUND_COUNTER :i25 )
(REFUND_EFFECTIVE :i25 )
(GAS_CUMULATIVE :i32 )
(STATUS_CODE :binary@prove)
(PHASE_RLP_TXN :byte)
(PHASE_RLP_TXNRCPT :byte)
Expand Down
Loading