@aztec/simulator 0.60.0 → 0.61.0

package/src/avm/avm_simulator.ts

@@ -6,6 +6,7 @@ import { strict as assert } from 'assert';
 import { SideEffectLimitReachedError } from '../public/side_effect_errors.js';
 import type { AvmContext } from './avm_context.js';
 import { AvmContractCallResult } from './avm_contract_call_result.js';
+import { type Gas } from './avm_gas.js';
 import { isAvmBytecode } from './bytecode_utils.js';
 import {
   AvmExecutionError,
@@ -17,9 +18,21 @@ import {
 import type { Instruction } from './opcodes/index.js';
 import { decodeFromBytecode } from './serialization/bytecode_serialization.js';
 
+type OpcodeTally = {
+  count: number;
+  gas: Gas;
+};
+type PcTally = {
+  opcode: string;
+  count: number;
+  gas: Gas;
+};
+
 export class AvmSimulator {
   private log: DebugLogger;
   private bytecode: Buffer | undefined;
+  public opcodeTallies: Map<string, OpcodeTally> = new Map();
+  public pcTallies: Map<number, PcTally> = new Map();
 
   constructor(private context: AvmContext) {
     assert(
@@ -33,10 +46,7 @@ export class AvmSimulator {
    * Fetch the bytecode and execute it in the current context.
    */
   public async execute(): Promise<AvmContractCallResult> {
-    const bytecode = await this.context.persistableState.getBytecode(
-      this.context.environment.address,
-      this.context.environment.functionSelector,
-    );
+    const bytecode = await this.context.persistableState.getBytecode(this.context.environment.address);
 
     // This assumes that we will not be able to send messages to accounts without code
     // Pending classes and instances impl details
@@ -75,6 +85,7 @@ export class AvmSimulator {
     try {
       // Execute instruction pointed to by the current program counter
       // continuing until the machine state signifies a halt
+      let instrCounter = 0;
       while (!machineState.getHalted()) {
         const instruction = instructions[machineState.pc];
         assert(
@@ -82,13 +93,26 @@ export class AvmSimulator {
           'AVM attempted to execute non-existent instruction. This should never happen (invalid bytecode or AVM simulator bug)!',
         );
 
-        const gasLeft = `l2=${machineState.l2GasLeft} da=${machineState.daGasLeft}`;
-        this.log.debug(`@${machineState.pc} ${instruction.toString()} (${gasLeft})`);
+        const instrStartGas = machineState.gasLeft; // Save gas before executing instruction (for profiling)
+        const instrPc = machineState.pc; // Save PC before executing instruction (for profiling)
+
+        this.log.debug(
+          `[PC:${machineState.pc}] [IC:${instrCounter++}] ${instruction.toString()} (gasLeft l2=${
+            machineState.l2GasLeft
+          } da=${machineState.daGasLeft})`,
+        );
         // Execute the instruction.
         // Normal returns and reverts will return normally here.
         // "Exceptional halts" will throw.
         await instruction.execute(this.context);
 
+        // gas used by this instruction - used for profiling/tallying
+        const gasUsed: Gas = {
+          l2Gas: instrStartGas.l2Gas - machineState.l2GasLeft,
+          daGas: instrStartGas.daGas - machineState.daGasLeft,
+        };
+        this.tallyInstruction(instrPc, instruction.constructor.name, gasUsed);
+
         if (machineState.pc >= instructions.length) {
           this.log.warn('Passed end of program');
           throw new InvalidProgramCounterError(machineState.pc, /*max=*/ instructions.length);
@@ -100,6 +124,8 @@ export class AvmSimulator {
       const revertReason = reverted ? revertReasonFromExplicitRevert(output, this.context) : undefined;
       const results = new AvmContractCallResult(reverted, output, revertReason);
       this.log.debug(`Context execution results: ${results.toString()}`);
+
+      this.printOpcodeTallies();
       // Return results for processing by calling context
       return results;
     } catch (err: any) {
@@ -113,8 +139,45 @@ export class AvmSimulator {
       // Note: "exceptional halts" cannot return data, hence []
       const results = new AvmContractCallResult(/*reverted=*/ true, /*output=*/ [], revertReason);
       this.log.debug(`Context execution results: ${results.toString()}`);
+
+      this.printOpcodeTallies();
       // Return results for processing by calling context
       return results;
     }
   }
+
+  private tallyInstruction(pc: number, opcode: string, gasUsed: Gas) {
+    const opcodeTally = this.opcodeTallies.get(opcode) || ({ count: 0, gas: { l2Gas: 0, daGas: 0 } } as OpcodeTally);
+    opcodeTally.count++;
+    opcodeTally.gas.l2Gas += gasUsed.l2Gas;
+    opcodeTally.gas.daGas += gasUsed.daGas;
+    this.opcodeTallies.set(opcode, opcodeTally);
+
+    const pcTally = this.pcTallies.get(pc) || ({ opcode: opcode, count: 0, gas: { l2Gas: 0, daGas: 0 } } as PcTally);
+    pcTally.count++;
+    pcTally.gas.l2Gas += gasUsed.l2Gas;
+    pcTally.gas.daGas += gasUsed.daGas;
+    this.pcTallies.set(pc, pcTally);
+  }
+
+  private printOpcodeTallies() {
+    this.log.debug(`Printing tallies per opcode sorted by gas...`);
+    // sort descending by L2 gas consumed
+    const sortedOpcodes = Array.from(this.opcodeTallies.entries()).sort((a, b) => b[1].gas.l2Gas - a[1].gas.l2Gas);
+    for (const [opcode, tally] of sortedOpcodes) {
+      // NOTE: don't care to clutter the logs with DA gas for now
+      this.log.debug(`${opcode} executed ${tally.count} times consuming a total of ${tally.gas.l2Gas} L2 gas`);
+    }
+
+    this.log.debug(`Printing tallies per PC sorted by #times each PC was executed...`);
+    const sortedPcs = Array.from(this.pcTallies.entries())
+      .sort((a, b) => b[1].count - a[1].count)
+      .filter((_, i) => i < 20);
+    for (const [pc, tally] of sortedPcs) {
+      // NOTE: don't care to clutter the logs with DA gas for now
+      this.log.debug(
+        `PC:${pc} containing opcode ${tally.opcode} executed ${tally.count} times consuming a total of ${tally.gas.l2Gas} L2 gas`,
+      );
+    }
+  }
 }

package/src/avm/fixtures/index.ts

@@ -117,6 +117,13 @@ export function randomMemoryFields(length: number): Field[] {
   return [...Array(length)].map(_ => new Field(Fr.random()));
 }
 
+export function getAvmTestContractFunctionSelector(functionName: string): FunctionSelector {
+  const artifact = AvmTestContractArtifact.functions.find(f => f.name === functionName)!;
+  assert(!!artifact, `Function ${functionName} not found in AvmTestContractArtifact`);
+  const params = artifact.parameters;
+  return FunctionSelector.fromNameAndParameters(artifact.name, params);
+}
+
 export function getAvmTestContractBytecode(functionName: string): Buffer {
   const artifact = AvmTestContractArtifact.functions.find(f => f.name === functionName)!;
   assert(
@@ -147,10 +154,3 @@ export function resolveAvmTestContractAssertionMessage(
 
   return resolveAssertionMessage(revertReason.noirCallStack, debugMetadata);
 }
-
-export function getAvmTestContractFunctionSelector(functionName: string): FunctionSelector {
-  const artifact = AvmTestContractArtifact.functions.find(f => f.name === functionName)!;
-  assert(!!artifact, `Function ${functionName} not found in AvmTestContractArtifact`);
-  const params = artifact.parameters;
-  return FunctionSelector.fromNameAndParameters(artifact.name, params);
-}

package/src/avm/journal/journal.ts

@@ -1,10 +1,16 @@
-import { AztecAddress, type FunctionSelector, type Gas, SerializableContractInstance } from '@aztec/circuits.js';
+import {
+  AztecAddress,
+  type Gas,
+  SerializableContractInstance,
+  computePublicBytecodeCommitment,
+} from '@aztec/circuits.js';
 import { Fr } from '@aztec/foundation/fields';
 import { createDebugLogger } from '@aztec/foundation/log';
 
+import assert from 'assert';
+
 import { getPublicFunctionDebugName } from '../../common/debug_fn_name.js';
 import { type WorldStateDB } from '../../public/public_db_sources.js';
-import { type TracedContractInstance } from '../../public/side_effect_trace.js';
 import { type PublicSideEffectTraceInterface } from '../../public/side_effect_trace_interface.js';
 import { type AvmContractCallResult } from '../avm_contract_call_result.js';
 import { type AvmExecutionEnvironment } from '../avm_execution_environment.js';
@@ -210,22 +216,26 @@ export class AvmPersistableStateManager {
   /**
    * Get a contract instance.
    * @param contractAddress - address of the contract instance to retrieve.
-   * @returns the contract instance with an "exists" flag
+   * @returns the contract instance or undefined if it does not exist.
    */
-  public async getContractInstance(contractAddress: Fr): Promise<TracedContractInstance> {
-    let exists = true;
-    const aztecAddress = AztecAddress.fromField(contractAddress);
-    let instance = await this.worldStateDB.getContractInstance(aztecAddress);
-    if (instance === undefined) {
-      instance = SerializableContractInstance.default().withAddress(aztecAddress);
-      exists = false;
+  public async getContractInstance(contractAddress: Fr): Promise<SerializableContractInstance | undefined> {
+    this.log.debug(`Getting contract instance for address ${contractAddress}`);
+    const instanceWithAddress = await this.worldStateDB.getContractInstance(AztecAddress.fromField(contractAddress));
+    const exists = instanceWithAddress !== undefined;
+
+    if (exists) {
+      const instance = new SerializableContractInstance(instanceWithAddress);
+      this.log.debug(
+        `Got contract instance (address=${contractAddress}): exists=${exists}, instance=${JSON.stringify(instance)}`,
+      );
+      this.trace.traceGetContractInstance(contractAddress, exists, instance);
+
+      return Promise.resolve(instance);
+    } else {
+      this.log.debug(`Contract instance NOT FOUND (address=${contractAddress})`);
+      this.trace.traceGetContractInstance(contractAddress, exists);
+      return Promise.resolve(undefined);
     }
-    this.log.debug(
-      `Get Contract instance (address=${contractAddress}): exists=${exists}, instance=${JSON.stringify(instance)}`,
-    );
-    const tracedInstance = { ...instance, exists };
-    this.trace.traceGetContractInstance(tracedInstance);
-    return Promise.resolve(tracedInstance);
   }
 
   /**
@@ -237,10 +247,43 @@ export class AvmPersistableStateManager {
   }
 
   /**
-   * Get a contract's bytecode from the contracts DB
+   * Get a contract's bytecode from the contracts DB, also trace the contract class and instance
    */
-  public async getBytecode(contractAddress: AztecAddress, selector: FunctionSelector): Promise<Buffer | undefined> {
-    return await this.worldStateDB.getBytecode(contractAddress, selector);
+  public async getBytecode(contractAddress: AztecAddress): Promise<Buffer | undefined> {
+    this.log.debug(`Getting bytecode for contract address ${contractAddress}`);
+    const instanceWithAddress = await this.worldStateDB.getContractInstance(contractAddress);
+    const exists = instanceWithAddress !== undefined;
+
+    if (exists) {
+      const instance = new SerializableContractInstance(instanceWithAddress);
+
+      const contractClass = await this.worldStateDB.getContractClass(instance.contractClassId);
+      assert(
+        contractClass,
+        `Contract class not found in DB, but a contract instance was found with this class ID (${instance.contractClassId}). This should not happen!`,
+      );
+
+      const contractClassPreimage = {
+        artifactHash: contractClass.artifactHash,
+        privateFunctionsRoot: contractClass.privateFunctionsRoot,
+        publicBytecodeCommitment: computePublicBytecodeCommitment(contractClass.packedBytecode),
+      };
+
+      this.trace.traceGetBytecode(
+        contractAddress,
+        exists,
+        contractClass.packedBytecode,
+        instance,
+        contractClassPreimage,
+      );
+      return contractClass.packedBytecode;
+    } else {
+      // If the contract instance is not found, we assume it has not been deployed.
+      // It doesnt matter what the values of the contract instance are in this case, as long as we tag it with exists=false.
+      // This will hint to the avm circuit to just perform the non-membership check on the address and disregard the bytecode hash
+      this.trace.traceGetBytecode(contractAddress, exists); // bytecode, instance, class undefined
+      return undefined;
+    }
   }
 
   /**

package/src/avm/opcodes/contract.ts

@@ -1,23 +1,36 @@
-import { Fr } from '@aztec/circuits.js';
-
 import type { AvmContext } from '../avm_context.js';
-import { Field, TypeTag } from '../avm_memory_types.js';
+import { Field, TypeTag, Uint1 } from '../avm_memory_types.js';
+import { InstructionExecutionError } from '../errors.js';
 import { Opcode, OperandType } from '../serialization/instruction_serialization.js';
 import { Addressing } from './addressing_mode.js';
 import { Instruction } from './instruction.js';
 
+export enum ContractInstanceMember {
+  DEPLOYER,
+  CLASS_ID,
+  INIT_HASH,
+}
+
 export class GetContractInstance extends Instruction {
   static readonly type: string = 'GETCONTRACTINSTANCE';
   static readonly opcode: Opcode = Opcode.GETCONTRACTINSTANCE;
   // Informs (de)serialization. See Instruction.deserialize.
   static readonly wireFormat: OperandType[] = [
-    OperandType.UINT8,
-    OperandType.UINT8,
-    OperandType.UINT32,
-    OperandType.UINT32,
+    OperandType.UINT8, // opcode
+    OperandType.UINT8, // indirect bits
+    OperandType.UINT8, // member enum (immediate)
+    OperandType.UINT16, // addressOffset
+    OperandType.UINT16, // dstOffset
+    OperandType.UINT16, // existsOfsset
   ];
 
-  constructor(private indirect: number, private addressOffset: number, private dstOffset: number) {
+  constructor(
+    private indirect: number,
+    private memberEnum: number,
+    private addressOffset: number,
+    private dstOffset: number,
+    private existsOffset: number,
+  ) {
     super();
   }
 
@@ -25,27 +38,38 @@ export class GetContractInstance extends Instruction {
     const memory = context.machineState.memory.track(this.type);
     context.machineState.consumeGas(this.gasCost());
 
-    const operands = [this.addressOffset, this.dstOffset];
+    if (!(this.memberEnum in ContractInstanceMember)) {
+      throw new InstructionExecutionError(`Invalid GETCONSTRACTINSTANCE member enum ${this.memberEnum}`);
+    }
+
+    const operands = [this.addressOffset, this.dstOffset, this.existsOffset];
     const addressing = Addressing.fromWire(this.indirect, operands.length);
-    const [addressOffset, dstOffset] = addressing.resolve(operands, memory);
+    const [addressOffset, dstOffset, existsOffset] = addressing.resolve(operands, memory);
     memory.checkTag(TypeTag.FIELD, addressOffset);
 
     const address = memory.get(addressOffset).toFr();
     const instance = await context.persistableState.getContractInstance(address);
+    const exists = instance !== undefined;
 
-    const data = [
-      new Fr(instance.exists),
-      instance.salt,
-      instance.deployer.toField(),
-      instance.contractClassId,
-      instance.initializationHash,
-      // This this okay ?
-      ...instance.publicKeys.toFields(),
-    ].map(f => new Field(f));
+    let memberValue = new Field(0);
+    if (exists) {
+      switch (this.memberEnum as ContractInstanceMember) {
+        case ContractInstanceMember.DEPLOYER:
+          memberValue = new Field(instance.deployer.toField());
+          break;
+        case ContractInstanceMember.CLASS_ID:
+          memberValue = new Field(instance.contractClassId.toField());
+          break;
+        case ContractInstanceMember.INIT_HASH:
+          memberValue = new Field(instance.initializationHash);
+          break;
+      }
+    }
 
-    memory.setSlice(dstOffset, data);
+    memory.set(existsOffset, new Uint1(exists ? 1 : 0));
+    memory.set(dstOffset, memberValue);
 
-    memory.assert({ reads: 1, writes: 17, addressing });
+    memory.assert({ reads: 1, writes: 2, addressing });
     context.machineState.incrementPc();
   }
 }

package/src/avm/opcodes/conversion.ts

@@ -5,9 +5,9 @@ import { Opcode, OperandType } from '../serialization/instruction_serialization.
 import { Addressing } from './addressing_mode.js';
 import { Instruction } from './instruction.js';
 
-export class ToRadixLE extends Instruction {
+export class ToRadixBE extends Instruction {
   static type: string = 'TORADIXLE';
-  static readonly opcode: Opcode = Opcode.TORADIXLE;
+  static readonly opcode: Opcode = Opcode.TORADIXBE;
 
   // Informs (de)serialization. See Instruction.deserialize.
   static readonly wireFormat: OperandType[] = [
@@ -44,15 +44,18 @@ export class ToRadixLE extends Instruction {
 
     let value: bigint = memory.get(srcOffset).toBigInt();
     const radix: bigint = memory.get(radixOffset).toBigInt();
+    if (this.numLimbs < 1) {
+      throw new InstructionExecutionError(`ToRadixBE instruction's numLimbs should be > 0 (was ${this.numLimbs})`);
+    }
     if (radix > 256) {
-      throw new InstructionExecutionError(`ToRadixLE instruction's radix should be <= 256 (was ${radix})`);
+      throw new InstructionExecutionError(`ToRadixBE instruction's radix should be <= 256 (was ${radix})`);
     }
     const radixBN: bigint = BigInt(radix);
-    const limbArray = [];
+    const limbArray = new Array(this.numLimbs);
 
-    for (let i = 0; i < this.numLimbs; i++) {
+    for (let i = this.numLimbs - 1; i >= 0; i--) {
       const limb = value % radixBN;
-      limbArray.push(limb);
+      limbArray[i] = limb;
       value /= radixBN;
     }
 

package/src/avm/opcodes/environment_getters.ts

@@ -1,5 +1,6 @@
 import type { AvmContext } from '../avm_context.js';
 import { Field, Uint32, Uint64 } from '../avm_memory_types.js';
+import { InstructionExecutionError } from '../errors.js';
 import { Opcode, OperandType } from '../serialization/instruction_serialization.js';
 import { Addressing } from './addressing_mode.js';
 import { Instruction } from './instruction.js';
@@ -63,7 +64,7 @@ export class GetEnvVar extends Instruction {
     OperandType.UINT16, // dstOffset
   ];
 
-  constructor(private indirect: number, private varEnum: EnvironmentVariable, private dstOffset: number) {
+  constructor(private indirect: number, private varEnum: number, private dstOffset: number) {
     super();
   }
 
@@ -71,11 +72,15 @@ export class GetEnvVar extends Instruction {
     const memory = context.machineState.memory.track(this.type);
     context.machineState.consumeGas(this.gasCost());
 
+    if (!(this.varEnum in EnvironmentVariable)) {
+      throw new InstructionExecutionError(`Invalid GETENVVAR var enum ${this.varEnum}`);
+    }
+
     const operands = [this.dstOffset];
     const addressing = Addressing.fromWire(this.indirect, operands.length);
     const [dstOffset] = addressing.resolve(operands, memory);
 
-    memory.set(dstOffset, getValue(this.varEnum, context));
+    memory.set(dstOffset, getValue(this.varEnum as EnvironmentVariable, context));
 
     memory.assert({ writes: 1, addressing });
     context.machineState.incrementPc();

package/src/avm/opcodes/external_calls.ts

@@ -1,10 +1,9 @@
-import { FunctionSelector, Gas } from '@aztec/circuits.js';
-import { padArrayEnd } from '@aztec/foundation/collection';
+import { Fr, FunctionSelector, Gas, PUBLIC_DISPATCH_SELECTOR } from '@aztec/circuits.js';
 
 import type { AvmContext } from '../avm_context.js';
 import { type AvmContractCallResult } from '../avm_contract_call_result.js';
 import { gasLeftToGas } from '../avm_gas.js';
-import { Field, TypeTag, Uint8 } from '../avm_memory_types.js';
+import { type Field, TypeTag, Uint1 } from '../avm_memory_types.js';
 import { AvmSimulator } from '../avm_simulator.js';
 import { RethrownError } from '../errors.js';
 import { Opcode, OperandType } from '../serialization/instruction_serialization.js';
@@ -21,58 +20,39 @@ abstract class ExternalCall extends Instruction {
     OperandType.UINT16,
     OperandType.UINT16,
     OperandType.UINT16,
-    OperandType.UINT16,
-    OperandType.UINT16,
-    OperandType.UINT16,
   ];
 
   constructor(
     private indirect: number,
-    private gasOffset: number /* Unused due to no formal gas implementation at this moment */,
+    private gasOffset: number,
     private addrOffset: number,
     private argsOffset: number,
     private argsSizeOffset: number,
-    private retOffset: number,
-    private retSize: number,
     private successOffset: number,
-    // NOTE: Function selector is likely temporary since eventually public contract bytecode will be one
-    // blob containing all functions, and function selector will become an application-level mechanism
-    // (e.g. first few bytes of calldata + compiler-generated jump table)
-    private functionSelectorOffset: number,
   ) {
     super();
   }
 
   public async execute(context: AvmContext) {
     const memory = context.machineState.memory.track(this.type);
-    const operands = [
-      this.gasOffset,
-      this.addrOffset,
-      this.argsOffset,
-      this.argsSizeOffset,
-      this.retOffset,
-      this.successOffset,
-      this.functionSelectorOffset,
-    ];
+    const operands = [this.gasOffset, this.addrOffset, this.argsOffset, this.argsSizeOffset, this.successOffset];
     const addressing = Addressing.fromWire(this.indirect, operands.length);
-    const [gasOffset, addrOffset, argsOffset, argsSizeOffset, retOffset, successOffset, functionSelectorOffset] =
-      addressing.resolve(operands, memory);
+    const [gasOffset, addrOffset, argsOffset, argsSizeOffset, successOffset] = addressing.resolve(operands, memory);
     memory.checkTags(TypeTag.FIELD, gasOffset, gasOffset + 1);
     memory.checkTag(TypeTag.FIELD, addrOffset);
     memory.checkTag(TypeTag.UINT32, argsSizeOffset);
-    memory.checkTag(TypeTag.FIELD, functionSelectorOffset);
 
     const calldataSize = memory.get(argsSizeOffset).toNumber();
     memory.checkTagsRange(TypeTag.FIELD, argsOffset, calldataSize);
 
     const callAddress = memory.getAs<Field>(addrOffset);
     const calldata = memory.getSlice(argsOffset, calldataSize).map(f => f.toFr());
-    const functionSelector = memory.getAs<Field>(functionSelectorOffset).toFr();
+    const functionSelector = new Fr(PUBLIC_DISPATCH_SELECTOR);
     // If we are already in a static call, we propagate the environment.
     const callType = context.environment.isStaticCall ? 'STATICCALL' : this.type;
 
     // First we consume the gas for this operation.
-    context.machineState.consumeGas(this.gasCost(calldataSize + this.retSize));
+    context.machineState.consumeGas(this.gasCost(calldataSize));
     // Then we consume the gas allocated for the nested call. The excess will be refunded later.
     // Gas allocation is capped by the amount of gas left in the current context.
     // We have to do some dancing here because the gas allocation is a field,
@@ -106,18 +86,12 @@ abstract class ExternalCall extends Instruction {
       throw new RethrownError(nestedCallResults.revertReason.message, nestedCallResults.revertReason);
     }
 
-    // We only take as much data as was specified in the return size and pad with zeroes if the return data is smaller
-    // than the specified size in order to prevent that memory to be left with garbage
-    const returnData = nestedCallResults.output.slice(0, this.retSize);
-    const convertedReturnData = padArrayEnd(
-      returnData.map(f => new Field(f)),
-      new Field(0),
-      this.retSize,
-    );
+    // Save return/revert data for later.
+    const fullReturnData = nestedCallResults.output;
+    context.machineState.nestedReturndata = fullReturnData;
 
-    // Write our return data into memory
-    memory.set(successOffset, new Uint8(success ? 1 : 0));
-    memory.setSlice(retOffset, convertedReturnData);
+    // Write our success flag into memory.
+    memory.set(successOffset, new Uint1(success ? 1 : 0));
 
     // Refund unused gas
     context.machineState.refundGas(gasLeftToGas(nestedContext.machineState));
@@ -132,7 +106,7 @@ abstract class ExternalCall extends Instruction {
       /*avmCallResults=*/ nestedCallResults,
     );
 
-    memory.assert({ reads: calldataSize + 5, writes: 1 + this.retSize, addressing });
+    memory.assert({ reads: calldataSize + 4, writes: 1, addressing });
     context.machineState.incrementPc();
   }
 
@@ -204,22 +178,24 @@ export class Revert extends Instruction {
     OperandType.UINT16,
   ];
 
-  constructor(private indirect: number, private returnOffset: number, private retSize: number) {
+  constructor(private indirect: number, private returnOffset: number, private retSizeOffset: number) {
     super();
   }
 
   public async execute(context: AvmContext): Promise<void> {
     const memory = context.machineState.memory.track(this.type);
-    context.machineState.consumeGas(this.gasCost(this.retSize));
 
-    const operands = [this.returnOffset];
+    const operands = [this.returnOffset, this.retSizeOffset];
     const addressing = Addressing.fromWire(this.indirect, operands.length);
-    const [returnOffset] = addressing.resolve(operands, memory);
+    const [returnOffset, retSizeOffset] = addressing.resolve(operands, memory);
 
-    const output = memory.getSlice(returnOffset, this.retSize).map(word => word.toFr());
+    memory.checkTag(TypeTag.UINT32, retSizeOffset);
+    const retSize = memory.get(retSizeOffset).toNumber();
+    context.machineState.consumeGas(this.gasCost(retSize));
+    const output = memory.getSlice(returnOffset, retSize).map(word => word.toFr());
 
     context.machineState.revert(output);
-    memory.assert({ reads: this.retSize, addressing });
+    memory.assert({ reads: retSize + 1, addressing });
   }
 }
 

package/src/avm/opcodes/memory.ts

@@ -1,5 +1,5 @@
 import type { AvmContext } from '../avm_context.js';
-import { Field, TaggedMemory } from '../avm_memory_types.js';
+import { Field, TaggedMemory, TypeTag, Uint32 } from '../avm_memory_types.js';
 import { Opcode, OperandType } from '../serialization/instruction_serialization.js';
 import { Addressing } from './addressing_mode.js';
 import { Instruction } from './instruction.js';
@@ -179,11 +179,11 @@ export class CalldataCopy extends Instruction {
 
   public async execute(context: AvmContext): Promise<void> {
     const memory = context.machineState.memory.track(this.type);
-    // We don't need to check tags here because: (1) the calldata is NOT in memory, and (2) we are the ones writing to destination.
     const operands = [this.cdStartOffset, this.copySizeOffset, this.dstOffset];
     const addressing = Addressing.fromWire(this.indirect, operands.length);
     const [cdStartOffset, copySizeOffset, dstOffset] = addressing.resolve(operands, memory);
 
+    memory.checkTags(TypeTag.UINT32, cdStartOffset, copySizeOffset);
     const cdStart = memory.get(cdStartOffset).toNumber();
     const copySize = memory.get(copySizeOffset).toNumber();
     context.machineState.consumeGas(this.gasCost(copySize));
@@ -196,3 +196,70 @@ export class CalldataCopy extends Instruction {
     context.machineState.incrementPc();
   }
 }
+
+export class ReturndataSize extends Instruction {
+  static readonly type: string = 'RETURNDATASIZE';
+  static readonly opcode: Opcode = Opcode.RETURNDATASIZE;
+  // Informs (de)serialization. See Instruction.deserialize.
+  static readonly wireFormat: OperandType[] = [OperandType.UINT8, OperandType.UINT8, OperandType.UINT16];
+
+  constructor(private indirect: number, private dstOffset: number) {
+    super();
+  }
+
+  public async execute(context: AvmContext): Promise<void> {
+    const memory = context.machineState.memory.track(this.type);
+    const operands = [this.dstOffset];
+    const addressing = Addressing.fromWire(this.indirect, operands.length);
+    const [dstOffset] = addressing.resolve(operands, memory);
+    context.machineState.consumeGas(this.gasCost());
+
+    memory.set(dstOffset, new Uint32(context.machineState.nestedReturndata.length));
+
+    memory.assert({ writes: 1, addressing });
+    context.machineState.incrementPc();
+  }
+}
+
+export class ReturndataCopy extends Instruction {
+  static readonly type: string = 'RETURNDATACOPY';
+  static readonly opcode: Opcode = Opcode.RETURNDATACOPY;
+  // Informs (de)serialization. See Instruction.deserialize.
+  static readonly wireFormat: OperandType[] = [
+    OperandType.UINT8,
+    OperandType.UINT8,
+    OperandType.UINT16,
+    OperandType.UINT16,
+    OperandType.UINT16,
+  ];
+
+  constructor(
+    private indirect: number,
+    private rdStartOffset: number,
+    private copySizeOffset: number,
+    private dstOffset: number,
+  ) {
+    super();
+  }
+
+  public async execute(context: AvmContext): Promise<void> {
+    const memory = context.machineState.memory.track(this.type);
+    const operands = [this.rdStartOffset, this.copySizeOffset, this.dstOffset];
+    const addressing = Addressing.fromWire(this.indirect, operands.length);
+    const [rdStartOffset, copySizeOffset, dstOffset] = addressing.resolve(operands, memory);
+
+    memory.checkTags(TypeTag.UINT32, rdStartOffset, copySizeOffset);
+    const rdStart = memory.get(rdStartOffset).toNumber();
+    const copySize = memory.get(copySizeOffset).toNumber();
+    context.machineState.consumeGas(this.gasCost(copySize));
+
+    const transformedData = context.machineState.nestedReturndata
+      .slice(rdStart, rdStart + copySize)
+      .map(f => new Field(f));
+
+    memory.setSlice(dstOffset, transformedData);
+
+    memory.assert({ reads: 2, writes: copySize, addressing });
+    context.machineState.incrementPc();
+  }
+}