@aztec/simulator 3.0.0-nightly.20251217 → 3.0.0-nightly.20251219

package/dest/public/fixtures/opcode_spammer.js

@@ -149,14 +149,14 @@
  *
  */ import { FLAT_PUBLIC_LOGS_PAYLOAD_LENGTH, MAX_L2_TO_L1_MSGS_PER_TX, MAX_NOTE_HASHES_PER_TX, MAX_NULLIFIERS_PER_TX, MAX_PACKED_PUBLIC_BYTECODE_SIZE_IN_FIELDS, MAX_PUBLIC_DATA_UPDATE_REQUESTS_PER_TX, MAX_PUBLIC_LOG_SIZE_IN_FIELDS, PUBLIC_LOG_HEADER_LENGTH } from '@aztec/constants';
 import { Grumpkin } from '@aztec/foundation/crypto/grumpkin';
+import { randomBigInt } from '@aztec/foundation/crypto/random';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import assert from 'assert';
-import { Field, INTEGRAL_TAGS, TaggedMemory, TypeTag, Uint1, Uint32, Uint64, VALID_TAGS } from '../avm/avm_memory_types.js';
-import { Add, And, Call, CalldataCopy, Cast, DebugLog, Div, EcAdd, EmitNoteHash, EmitNullifier, EmitUnencryptedLog, Eq, FieldDiv, GetContractInstance, GetEnvVar, Jump, JumpI, KeccakF1600, L1ToL2MessageExists, Lt, Lte, Mov, Mul, Not, NoteHashExists, NullifierExists, Or, Poseidon2, ReturndataCopy, ReturndataSize, Revert, SLoad, SStore, SendL2ToL1Message, Set, Sha256Compression, Shl, Shr, Sub, SuccessCopy, ToRadixBE, Xor } from '../avm/opcodes/index.js';
+import { Field, TaggedMemory, TypeTag, Uint1, Uint32 } from '../avm/avm_memory_types.js';
+import { Add, And, Call, CalldataCopy, Cast, DebugLog, Div, EcAdd, EmitNoteHash, EmitNullifier, EmitUnencryptedLog, Eq, FieldDiv, GetContractInstance, GetEnvVar, InternalCall, InternalReturn, Jump, JumpI, KeccakF1600, L1ToL2MessageExists, Lt, Lte, Mov, Mul, Not, NoteHashExists, NullifierExists, Or, Poseidon2, Return, ReturndataCopy, ReturndataSize, Revert, SLoad, SStore, SendL2ToL1Message, Set, Sha256Compression, Shl, Shr, StaticCall, Sub, SuccessCopy, ToRadixBE, Xor } from '../avm/opcodes/index.js';
 import { encodeToBytecode } from '../avm/serialization/bytecode_serialization.js';
 import { Opcode } from '../avm/serialization/instruction_serialization.js';
 import { deployCustomBytecode, executeCustomBytecode } from './custom_bytecode_tester.js';
-import { deployAndExecuteCustomBytecode } from './index.js';
 // ============================================================================
 // Constants
 // ============================================================================
@@ -175,15 +175,131 @@ const MAX_BYTECODE_BYTES = (MAX_PACKED_PUBLIC_BYTECODE_SIZE_IN_FIELDS - 1) * BYT
 const JUMP_SIZE = encodeToBytecode([
     new Jump(0)
 ]).length; // JUMP_32
+const INTERNALCALL_SIZE = encodeToBytecode([
+    new InternalCall(0)
+]).length;
 // ============================================================================
 // Type Variant Helpers (for generating multiple configs per opcode)
 // ============================================================================
-const ALL_TAGS = Array.from(VALID_TAGS);
-const INT_TAGS = Array.from(INTEGRAL_TAGS);
+// Not using these sets directly because we want to control order
+//const ALL_TAGS = Array.from(VALID_TAGS);
+//const INT_TAGS = Array.from(INTEGRAL_TAGS);
+// Ordered so that limiting #configs per opcode still tests max size (Field)
+const ALL_TAGS = [
+    TypeTag.FIELD,
+    TypeTag.UINT1,
+    TypeTag.UINT8,
+    TypeTag.UINT16,
+    TypeTag.UINT32,
+    TypeTag.UINT64,
+    TypeTag.UINT128
+];
+// ordered so that limiting #configs per opcode still tests max size
+const INT_TAGS = [
+    TypeTag.UINT128,
+    TypeTag.UINT1,
+    TypeTag.UINT8,
+    TypeTag.UINT16,
+    TypeTag.UINT32,
+    TypeTag.UINT64
+];
 /** Build from tag truncating - shorter name */ function withTag(v, tag) {
     return TaggedMemory.buildFromTagTruncating(v, tag);
 }
 // ============================================================================
+// Random Value Helpers (seeded via SEED env var for reproducibility)
+// ============================================================================
+/** Modulus (really just max+1) for each integer type tag */ const TAG_MODULI = {
+    [TypeTag.UINT1]: 2n,
+    [TypeTag.UINT8]: 256n,
+    [TypeTag.UINT16]: 65536n,
+    [TypeTag.UINT32]: 0x1_0000_0000n,
+    [TypeTag.UINT64]: 0x1_0000_0000_0000_0000n,
+    [TypeTag.UINT128]: 0x1_0000_0000_0000_0000_0000_0000_0000_0000n,
+    [TypeTag.FIELD]: Fr.MODULUS
+};
+/** Generate a random value with the given type tag. Uses SEED env var if set. */ function randomWithTag(tag) {
+    const modulus = TAG_MODULI[tag];
+    if (modulus === undefined) {
+        throw new Error(`Unsupported tag for random generation: ${TypeTag[tag]}`);
+    }
+    const value = randomBigInt(modulus);
+    return TaggedMemory.buildFromTagTruncating(value, tag);
+}
+/** Generate a random non-zero value with the given type tag (for division). */ function randomNonZeroWithTag(tag) {
+    const modulus = TAG_MODULI[tag];
+    if (modulus === undefined) {
+        throw new Error(`Unsupported tag for random generation: ${TypeTag[tag]}`);
+    }
+    // Generate random in range [1, max) by generating [0, max-1) and adding 1
+    const value = randomBigInt(modulus - 1n) + 1n;
+    return TaggedMemory.buildFromTagTruncating(value, tag);
+}
+/** Generate a random non-zero Field value (for field division). */ function randomNonZeroField() {
+    return new Field(randomBigInt(Fr.MODULUS - 1n) + 1n);
+}
+/** Reserved memory offsets for external call loop (used by CALL spam and side-effect opcodes) */ const CONST_0_OFFSET = 0; // Uint32(0)
+const CONST_1_OFFSET = 1; // Uint32(1)
+const CONST_MAX_U32_OFFSET = 2; // Uint32(MAX_U32)
+const CALL_ADDR_OFFSET = 3; // copy addr from calldata to here, and then use this addr for CALL
+const CALL_ARGS_OFFSET = CALL_ADDR_OFFSET; // address is the arg to send to CALL
+const CALL_COPY_SIZE_OFFSET = CONST_1_OFFSET; // copy size = 1 (forward calldata[0])
+const CALL_CALLDATA_INDEX_OFFSET = CONST_0_OFFSET; // calldata[0]
+const CALL_L2_GAS_OFFSET = CONST_MAX_U32_OFFSET; // MAX_U32 gets capped to remaining gas by AVM
+const CALL_DA_GAS_OFFSET = CONST_MAX_U32_OFFSET; // MAX_U32 gets capped to remaining gas by AVM
+const CALL_ARGS_SIZE_OFFSET = CONST_1_OFFSET; // argsSize = 1 (forward calldata[0] - might contain contract address)
+const MAX_U32 = 0xffffffffn;
+/**
+ * A SpamConfig for to make external CALLs to an address specified in calldata[0].
+ */ const EXTERNAL_CALL_CONFIG = {
+    setup: [
+        // calldata will contain 1 item: the external call address
+        {
+            offset: CONST_0_OFFSET,
+            value: new Uint32(0)
+        },
+        {
+            offset: CONST_1_OFFSET,
+            value: new Uint32(1)
+        },
+        {
+            offset: CONST_MAX_U32_OFFSET,
+            value: new Uint32(MAX_U32)
+        },
+        ()=>[
+                new CalldataCopy(/*indirect=*/ 0, /*copySizeOffset=*/ CALL_COPY_SIZE_OFFSET, /*cdStartOffset=*/ CALL_CALLDATA_INDEX_OFFSET, /*dstOffset=*/ CALL_ADDR_OFFSET)
+            ]
+    ],
+    targetInstructions: ()=>[
+            new Call(/*indirect=*/ 0, /*l2GasOffset=*/ CALL_L2_GAS_OFFSET, /*daGasOffset=*/ CALL_DA_GAS_OFFSET, /*addrOffset=*/ CALL_ADDR_OFFSET, /*argsSizeOffset=*/ CALL_ARGS_SIZE_OFFSET, /*argsOffset=*/ CALL_ARGS_OFFSET)
+        ],
+    addressAsCalldata: true
+};
+const STATIC_CALL_CONFIG = {
+    setup: [
+        // calldata will contain 1 item: the external call address
+        {
+            offset: CONST_0_OFFSET,
+            value: new Uint32(0)
+        },
+        {
+            offset: CONST_1_OFFSET,
+            value: new Uint32(1)
+        },
+        {
+            offset: CONST_MAX_U32_OFFSET,
+            value: new Uint32(MAX_U32)
+        },
+        ()=>[
+                new CalldataCopy(/*indirect=*/ 0, /*copySizeOffset=*/ CALL_COPY_SIZE_OFFSET, /*cdStartOffset=*/ CALL_CALLDATA_INDEX_OFFSET, /*dstOffset=*/ CALL_ADDR_OFFSET)
+            ]
+    ],
+    targetInstructions: ()=>[
+            new StaticCall(/*indirect=*/ 0, /*l2GasOffset=*/ CALL_L2_GAS_OFFSET, /*daGasOffset=*/ CALL_DA_GAS_OFFSET, /*addrOffset=*/ CALL_ADDR_OFFSET, /*argsSizeOffset=*/ CALL_ARGS_SIZE_OFFSET, /*argsOffset=*/ CALL_ARGS_OFFSET)
+        ],
+    addressAsCalldata: true
+};
+// ============================================================================
 // Configuration Map
 // ============================================================================
 /**
@@ -192,18 +308,18 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
  * Uses smallest wire format (_8) for maximum instruction density.
  */ export const SPAM_CONFIGS = {
     // ═══════════════════════════════════════════════════════════════════════════
-    // ARITHMETIC - Test with all type variants
+    // ARITHMETIC - Test with all type variants (random values, seeded via SEED env var)
     // ═══════════════════════════════════════════════════════════════════════════
     [Opcode.ADD_8]: ALL_TAGS.map((tag)=>({
             label: TypeTag[tag],
             setup: [
                 {
                     offset: 0,
-                    value: withTag(1n, tag)
+                    value: randomWithTag(tag)
                 },
                 {
                     offset: 1,
-                    value: withTag(1n, tag)
+                    value: randomWithTag(tag)
                 }
             ],
             targetInstructions: ()=>[
@@ -215,11 +331,11 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: withTag(1000000n, tag)
+                    value: randomWithTag(tag)
                 },
                 {
                     offset: 1,
-                    value: withTag(1n, tag)
+                    value: randomWithTag(tag)
                 }
             ],
             targetInstructions: ()=>[
@@ -231,11 +347,11 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: withTag(2n, tag)
+                    value: randomWithTag(tag)
                 },
                 {
                     offset: 1,
-                    value: withTag(2n, tag)
+                    value: randomWithTag(tag)
                 }
             ],
             targetInstructions: ()=>[
@@ -248,11 +364,11 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: withTag(111111111111111111n, tag)
+                    value: randomWithTag(tag)
                 },
                 {
                     offset: 1,
-                    value: withTag(1n, tag)
+                    value: randomNonZeroWithTag(tag)
                 }
             ],
             targetInstructions: ()=>[
@@ -265,11 +381,11 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: new Field(1000000n)
+                    value: new Field(Fr.random())
                 },
                 {
                     offset: 1,
-                    value: new Field(1n)
+                    value: randomNonZeroField()
                 }
             ],
             targetInstructions: ()=>[
@@ -278,18 +394,18 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
         }
     ],
     // ═══════════════════════════════════════════════════════════════════════════
-    // COMPARATORS - Test with all type variants
+    // COMPARATORS - Test with all type variants (random values)
     // ═══════════════════════════════════════════════════════════════════════════
     [Opcode.EQ_8]: ALL_TAGS.map((tag)=>({
             label: TypeTag[tag],
             setup: [
                 {
                     offset: 0,
-                    value: withTag(42n, tag)
+                    value: randomWithTag(tag)
                 },
                 {
                     offset: 1,
-                    value: withTag(42n, tag)
+                    value: randomWithTag(tag)
                 }
             ],
             targetInstructions: ()=>[
@@ -301,11 +417,11 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: withTag(1n, tag)
+                    value: randomWithTag(tag)
                 },
                 {
                     offset: 1,
-                    value: withTag(1000000n, tag)
+                    value: randomWithTag(tag)
                 }
             ],
             targetInstructions: ()=>[
@@ -317,11 +433,11 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: withTag(1n, tag)
+                    value: randomWithTag(tag)
                 },
                 {
                     offset: 1,
-                    value: withTag(1000000n, tag)
+                    value: randomWithTag(tag)
                 }
             ],
             targetInstructions: ()=>[
@@ -329,18 +445,18 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
                 ]
         })),
     // ═══════════════════════════════════════════════════════════════════════════
-    // BITWISE - Integer types only (no FIELD)
+    // BITWISE - Integer types only (no FIELD) (random values)
     // ═══════════════════════════════════════════════════════════════════════════
     [Opcode.AND_8]: INT_TAGS.map((tag)=>({
             label: TypeTag[tag],
             setup: [
                 {
                     offset: 0,
-                    value: withTag(0xffffffffffffffffffffffffffffffffn, tag)
+                    value: randomWithTag(tag)
                 },
                 {
                     offset: 1,
-                    value: withTag(0xffffffffffffffffffffffffffffffffn, tag)
+                    value: randomWithTag(tag)
                 }
             ],
             targetInstructions: ()=>[
@@ -352,11 +468,11 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: withTag(0xffffffffffffffffffffffffffffffffn, tag)
+                    value: randomWithTag(tag)
                 },
                 {
                     offset: 1,
-                    value: withTag(0n, tag)
+                    value: randomWithTag(tag)
                 }
             ],
             targetInstructions: ()=>[
@@ -368,11 +484,11 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: withTag(0xdeadbeefcafebaben, tag)
+                    value: randomWithTag(tag)
                 },
                 {
                     offset: 1,
-                    value: withTag(0x1234567890abcdefn, tag)
+                    value: randomWithTag(tag)
                 }
             ],
             targetInstructions: ()=>[
@@ -384,7 +500,7 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: withTag(0xffffffffffffffffn, tag)
+                    value: randomWithTag(tag)
                 }
             ],
             targetInstructions: ()=>[
@@ -396,7 +512,7 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: withTag(1n, tag)
+                    value: randomWithTag(tag)
                 },
                 {
                     offset: 1,
@@ -412,7 +528,7 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: withTag(0xffffffffffffffffn, tag)
+                    value: randomWithTag(tag)
                 },
                 {
                     offset: 1,
@@ -424,14 +540,14 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
                 ]
         })),
     // ═══════════════════════════════════════════════════════════════════════════
-    // CAST / MOV - Test with all type variants
+    // CAST / MOV - Test with all type variants (random values)
     // ═══════════════════════════════════════════════════════════════════════════
     [Opcode.CAST_8]: ALL_TAGS.map((tag)=>({
             label: TypeTag[tag],
             setup: [
                 {
                     offset: 0,
-                    value: withTag(42n, tag)
+                    value: randomWithTag(tag)
                 }
             ],
             targetInstructions: ()=>[
@@ -443,7 +559,7 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: withTag(42n, tag)
+                    value: randomWithTag(tag)
                 }
             ],
             targetInstructions: ()=>[
@@ -518,6 +634,72 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
                 ]
         }
     ],
+    // INTERNALCALL: calls itself infinitely by jumping to its own PC (PC 0, since no setup)
+    // Creates infinite recursion until OOG (internal call stack grows forever)
+    [Opcode.INTERNALCALL]: [
+        {
+            setup: [],
+            targetInstructions: ()=>[
+                    new InternalCall(/*loc=*/ 0)
+                ]
+        }
+    ],
+    // INTERNALRETURN: needs INTERNALCALL to return without error
+    // Layout: INTERNALCALL(10) -> JUMP(0) -> INTERNALRETURN
+    // INTERNALCALL jumps to INTERNALRETURN, which returns to JUMP, which loops back
+    [Opcode.INTERNALRETURN]: [
+        {
+            setup: [],
+            targetInstructions: ()=>[
+                    new InternalCall(/*loc=*/ INTERNALCALL_SIZE + JUMP_SIZE),
+                    new Jump(/*jumpOffset=*/ 0),
+                    new InternalReturn()
+                ]
+        }
+    ],
+    // CALL (EXTERNALCALL): calls the current contract address (self) in a loop
+    // Contract address is passed via calldata[0] and propagated to nested calls
+    [Opcode.CALL]: [
+        EXTERNAL_CALL_CONFIG
+    ],
+    [Opcode.STATICCALL]: [
+        STATIC_CALL_CONFIG
+    ],
+    // RETURN: terminates execution, so we need to use the two-contract pattern
+    // Outer contract CALLs inner contract in a loop, inner contract does RETURN
+    [Opcode.RETURN]: [
+        {
+            setup: [
+                {
+                    offset: 0,
+                    value: new Uint32(0)
+                }
+            ],
+            targetInstructions: ()=>[
+                    new Return(/*indirect=*/ 0, /*returnSizeOffset=*/ 0, /*returnOffset=*/ 0)
+                ],
+            // Use the side-effect-limit pattern (even though it's not a side-effect) as it fits
+            // this case (we want to CALL, RETURN, then CALL again back in parent). We omit "cleanup"
+            // because we don't need to REVERT as we do for real side-effects.
+            limit: 1
+        }
+    ],
+    // REVERT: terminates execution, so we need to use the two-contract pattern
+    // Outer contract CALLs inner contract in a loop, inner contract does REVERT
+    [Opcode.REVERT_8]: [
+        {
+            setup: [
+                {
+                    offset: 0,
+                    value: new Uint32(0)
+                }
+            ],
+            targetInstructions: ()=>[
+                    new Revert(/*indirect=*/ 0, /*retSizeOffset=*/ 0, /*returnOffset=*/ 1).as(Opcode.REVERT_8, Revert.wireFormat8)
+                ],
+            limit: 1
+        }
+    ],
     // ═══════════════════════════════════════════════════════════════════════════
     // ENVIRONMENT
     // ═══════════════════════════════════════════════════════════════════════════
@@ -529,11 +711,47 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
                 ]
         }
     ],
+    // CALLDATACOPY has dynamic gas scaling with copySize
     [Opcode.CALLDATACOPY]: [
         {
-            // CalldataCopy(indirect=0, copySizeOffset=0, cdStartOffset=1, dstOffset=2)
-            // Copies M[0]=1 elements starting from CD[M[1]]=CD[0] into M[2].
-            // In other words: M[2] = CD[0]
+            label: 'Min copy size',
+            // CalldataCopy with copySize=0 is a no-op but still executes the opcode
+            setup: [
+                {
+                    offset: 0,
+                    value: new Uint32(0n)
+                },
+                {
+                    offset: 1,
+                    value: new Uint32(0n)
+                }
+            ],
+            targetInstructions: ()=>[
+                    new CalldataCopy(/*indirect=*/ 0, /*copySizeOffset=*/ 0, /*cdStartOffset=*/ 1, /*dstOffset=*/ 2)
+                ]
+        },
+        {
+            label: 'Large copy size',
+            // Large copySize with large dynamic gas - will OOG quickly
+            // NOTE: we don't want it so large that it exceeds memory bounds (MAX_MEMORY_SIZE = 2^32)
+            // and we really want it small enough that we run at least 1 successful target opcode.
+            setup: [
+                {
+                    offset: 0,
+                    value: new Uint32(1000n)
+                },
+                {
+                    offset: 1,
+                    value: new Uint32(0n)
+                }
+            ],
+            targetInstructions: ()=>[
+                    new CalldataCopy(/*indirect=*/ 0, /*copySizeOffset=*/ 0, /*cdStartOffset=*/ 1, /*dstOffset=*/ 2)
+                ]
+        },
+        {
+            label: 'Near min copy size of 1',
+            // Near-min but actually copies data (more meaningful than size=0 no-op)
             setup: [
                 {
                     offset: 0,
@@ -565,8 +783,10 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
                 ]
         }
     ],
+    // RETURNDATACOPY has dynamic gas scaling with copySize
     [Opcode.RETURNDATACOPY]: [
         {
+            label: 'Min copy size',
             setup: [
                 {
                     offset: 0,
@@ -580,6 +800,42 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             targetInstructions: ()=>[
                     new ReturndataCopy(/*indirect=*/ 0, /*copySizeOffset=*/ 0, /*rdStartOffset=*/ 1, /*dstOffset=*/ 2)
                 ]
+        },
+        {
+            label: 'Large copy size',
+            // Large copySize to maximize dynamic gas - will OOG quickly
+            // NOTE: we don't want it so large that it exceeds memory bounds (MAX_MEMORY_SIZE = 2^32)
+            // and we really want it small enough that we run at least 1 successful target opcode.
+            setup: [
+                {
+                    offset: 0,
+                    value: new Uint32(1000n)
+                },
+                {
+                    offset: 1,
+                    value: new Uint32(0n)
+                }
+            ],
+            targetInstructions: ()=>[
+                    new ReturndataCopy(/*indirect=*/ 0, /*copySizeOffset=*/ 0, /*rdStartOffset=*/ 1, /*dstOffset=*/ 2)
+                ]
+        },
+        {
+            label: 'Near min copy size of 1',
+            // Near-min but actually copies data (more meaningful than size=0 no-op)
+            setup: [
+                {
+                    offset: 0,
+                    value: new Uint32(1n)
+                },
+                {
+                    offset: 1,
+                    value: new Uint32(0n)
+                }
+            ],
+            targetInstructions: ()=>[
+                    new ReturndataCopy(/*indirect=*/ 0, /*copySizeOffset=*/ 0, /*rdStartOffset=*/ 1, /*dstOffset=*/ 2)
+                ]
         }
     ],
     // ═══════════════════════════════════════════════════════════════════════════
@@ -587,27 +843,61 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
     // ═══════════════════════════════════════════════════════════════════════════
     [Opcode.SLOAD]: [
         {
+            label: 'Cold read (slot not written)',
             setup: [
                 {
                     offset: 0,
-                    value: new Field(0n)
+                    value: new Field(Fr.random())
                 }
             ],
             targetInstructions: ()=>[
                     new SLoad(/*indirect=*/ 0, /*slotOffset=*/ 0, /*dstOffset=*/ 1)
                 ]
+        },
+        {
+            label: 'Warm read (SSTORE first)',
+            // Memory layout: slot (incremented), value, constant 1, revertSize, loaded value
+            setup: [
+                {
+                    offset: 0,
+                    value: new Field(Fr.random())
+                },
+                {
+                    offset: 1,
+                    value: new Field(Fr.random())
+                },
+                {
+                    offset: 2,
+                    value: new Field(1n)
+                },
+                {
+                    offset: 3,
+                    value: new Uint32(0n)
+                }
+            ],
+            targetInstructions: ()=>[
+                    new SStore(/*indirect=*/ 0, /*srcOffset=*/ 1, /*slotOffset=*/ 0),
+                    new SLoad(/*indirect=*/ 0, /*slotOffset=*/ 0, /*dstOffset=*/ 4),
+                    new Add(/*indirect=*/ 0, /*aOffset=*/ 0, /*bOffset=*/ 2, /*dstOffset=*/ 0).as(Opcode.ADD_8, Add.wireFormat8)
+                ],
+            cleanupInstructions: ()=>[
+                    new Revert(/*indirect=*/ 0, /*retSizeOffset=*/ 3, /*returnOffset=*/ 0).as(Opcode.REVERT_8, Revert.wireFormat8)
+                ],
+            limit: MAX_PUBLIC_DATA_UPDATE_REQUESTS_PER_TX
         }
     ],
     [Opcode.NOTEHASHEXISTS]: [
         {
+            // Note: Can't easily do "write first" version - would need to know the leaf index
+            // that EMITNOTEHASH will produce, which depends on tree state
             setup: [
                 {
                     offset: 0,
-                    value: new Field(0n)
+                    value: new Field(Fr.random())
                 },
                 {
                     offset: 1,
-                    value: new Uint64(0n)
+                    value: randomWithTag(TypeTag.UINT64)
                 }
             ],
             targetInstructions: ()=>[
@@ -617,19 +907,51 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
     ],
     [Opcode.NULLIFIEREXISTS]: [
         {
+            label: 'Non-existent nullifier',
             setup: [
                 {
                     offset: 0,
-                    value: new Field(0n)
+                    value: new Field(Fr.random())
                 },
                 {
                     offset: 1,
-                    value: new Field(0n)
+                    value: new Field(Fr.random())
                 }
             ],
             targetInstructions: ()=>[
                     new NullifierExists(/*indirect=*/ 0, /*nullifierOffset=*/ 0, /*addressOffset=*/ 1, /*existsOffset=*/ 2)
                 ]
+        },
+        {
+            label: 'Existing nullifier (EMITNULLIFIER first)',
+            // Memory layout: nullifier (incremented), constant 1, current address (from GETENVVAR), revertSize, exists result
+            setup: [
+                {
+                    offset: 0,
+                    value: new Field(Fr.random())
+                },
+                {
+                    offset: 1,
+                    value: new Field(1n)
+                },
+                ()=>[
+                        // Get current contract address into offset 2
+                        new GetEnvVar(/*indirect=*/ 0, /*dstOffset=*/ 2, /*varEnum=*/ 0).as(Opcode.GETENVVAR_16, GetEnvVar.wireFormat16)
+                    ],
+                {
+                    offset: 3,
+                    value: new Uint32(0n)
+                }
+            ],
+            targetInstructions: ()=>[
+                    new EmitNullifier(/*indirect=*/ 0, /*nullifierOffset=*/ 0),
+                    new NullifierExists(/*indirect=*/ 0, /*nullifierOffset=*/ 0, /*addressOffset=*/ 2, /*existsOffset=*/ 4),
+                    new Add(/*indirect=*/ 0, /*aOffset=*/ 0, /*bOffset=*/ 1, /*dstOffset=*/ 0).as(Opcode.ADD_8, Add.wireFormat8)
+                ],
+            cleanupInstructions: ()=>[
+                    new Revert(/*indirect=*/ 0, /*retSizeOffset=*/ 3, /*returnOffset=*/ 0).as(Opcode.REVERT_8, Revert.wireFormat8)
+                ],
+            limit: MAX_NULLIFIERS_PER_TX - 1
         }
     ],
     [Opcode.L1TOL2MSGEXISTS]: [
@@ -637,11 +959,11 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: new Field(0n)
+                    value: new Field(Fr.random())
                 },
                 {
                     offset: 1,
-                    value: new Uint64(0n)
+                    value: randomWithTag(TypeTag.UINT64)
                 }
             ],
             targetInstructions: ()=>[
@@ -651,11 +973,12 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
     ],
     [Opcode.GETCONTRACTINSTANCE]: [
         {
+            // Use GETENVVAR to get current contract address (varEnum 0 = ADDRESS)
+            // This ensures we're querying a valid deployed contract
             setup: [
-                {
-                    offset: 0,
-                    value: new Field(0n)
-                }
+                ()=>[
+                        new GetEnvVar(/*indirect=*/ 0, /*dstOffset=*/ 0, /*varEnum=*/ 0).as(Opcode.GETENVVAR_16, GetEnvVar.wireFormat16)
+                    ]
             ],
             // memberEnum 0 = DEPLOYER
             targetInstructions: ()=>[
@@ -671,7 +994,7 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: new Field(0x1000n)
+                    value: new Field(Fr.random())
                 },
                 {
                     offset: 1,
@@ -694,7 +1017,7 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: new Field(0x2000n)
+                    value: new Field(Fr.random())
                 },
                 {
                     offset: 1,
@@ -720,11 +1043,11 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: new Field(1n)
+                    value: new Field(Fr.random())
                 },
                 {
                     offset: 1,
-                    value: new Field(0x3000n)
+                    value: new Field(Fr.random())
                 },
                 {
                     offset: 2,
@@ -749,11 +1072,11 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: new Field(42n)
+                    value: new Field(Fr.random())
                 },
                 {
                     offset: 1,
-                    value: new Field(0x100n)
+                    value: new Field(Fr.random())
                 },
                 {
                     offset: 2,
@@ -772,11 +1095,11 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
             setup: [
                 {
                     offset: 0,
-                    value: new Field(42n)
+                    value: new Field(Fr.random())
                 },
                 {
                     offset: 1,
-                    value: new Field(0x100n)
+                    value: new Field(Fr.random())
                 },
                 {
                     offset: 2,
@@ -843,7 +1166,7 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
         }
     ],
     // ═══════════════════════════════════════════════════════════════════════════
-    // GADGETS - Use non-trivial inputs to avoid special-case optimizations
+    // GADGETS - Random inputs (seeded via SEED env var)
     // ═══════════════════════════════════════════════════════════════════════════
     [Opcode.POSEIDON2]: [
         {
@@ -852,7 +1175,7 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
                 length: 4
             }, (_, i)=>({
                     offset: i,
-                    value: new Field(BigInt(0xdeadbeef + i * 0x1111))
+                    value: new Field(Fr.random())
                 })),
             // Poseidon hash data at M[0..3], write result to M[0:3] (reuse results as next inputs)
             targetInstructions: ()=>[
@@ -863,45 +1186,19 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
     [Opcode.SHA256COMPRESSION]: [
         {
             setup: [
-                // State: 8 x UINT32 at offsets 0-7 (use SHA256 initial hash values)
-                {
-                    offset: 0,
-                    value: new Uint32(0x6a09e667n)
-                },
-                {
-                    offset: 1,
-                    value: new Uint32(0xbb67ae85n)
-                },
-                {
-                    offset: 2,
-                    value: new Uint32(0x3c6ef372n)
-                },
-                {
-                    offset: 3,
-                    value: new Uint32(0xa54ff53an)
-                },
-                {
-                    offset: 4,
-                    value: new Uint32(0x510e527fn)
-                },
-                {
-                    offset: 5,
-                    value: new Uint32(0x9b05688cn)
-                },
-                {
-                    offset: 6,
-                    value: new Uint32(0x1f83d9abn)
-                },
-                {
-                    offset: 7,
-                    value: new Uint32(0x5be0cd19n)
-                },
-                // Inputs: 16 x UINT32 at offsets 8-23 (non-trivial message block)
+                // State: 8 x UINT32 at offsets 0-7 (random initial state)
+                ...Array.from({
+                    length: 8
+                }, (_, i)=>({
+                        offset: i,
+                        value: randomWithTag(TypeTag.UINT32)
+                    })),
+                // Inputs: 16 x UINT32 at offsets 8-23 (random message block)
                 ...Array.from({
                     length: 16
                 }, (_, i)=>({
                         offset: 8 + i,
-                        value: new Uint32(0xcafebaben + BigInt(i) * 0x01010101n & 0xffffffffn)
+                        value: randomWithTag(TypeTag.UINT32)
                     }))
             ],
             targetInstructions: ()=>[
@@ -911,12 +1208,12 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
     ],
     [Opcode.KECCAKF1600]: [
         {
-            // Keccak state: 25 x UINT64 (5x5 lane array)
+            // Keccak state: 25 x UINT64 (5x5 lane array) with random values
             setup: Array.from({
                 length: 25
             }, (_, i)=>({
                     offset: i,
-                    value: new Uint64(0xdeadbeefcafebaben + BigInt(i) * 0x0101010101010101n & 0xffffffffffffffffn)
+                    value: randomWithTag(TypeTag.UINT64)
                 })),
             targetInstructions: ()=>[
                     new KeccakF1600(/*indirect=*/ 0, /*dstOffset=*/ 0, /*inputOffset=*/ 0)
@@ -957,20 +1254,46 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
                 ]
         }
     ],
+    // TORADIXBE has dynamic gas scaling with numLimbs
     [Opcode.TORADIXBE]: [
         {
+            label: 'Min limbs',
             setup: [
                 {
                     offset: 0,
-                    value: new Field(0xdeadbeefcafebaben)
+                    value: new Field(1n)
                 },
                 {
                     offset: 1,
-                    value: new Uint32(16n)
+                    value: new Uint32(2n)
                 },
                 {
                     offset: 2,
-                    value: new Uint32(16n)
+                    value: new Uint32(1n)
+                },
+                {
+                    offset: 3,
+                    value: new Uint1(0n)
+                }
+            ],
+            targetInstructions: ()=>[
+                    new ToRadixBE(/*indirect=*/ 0, /*srcOffset=*/ 0, /*radixOffset=*/ 1, /*numLimbsOffset=*/ 2, /*outputBitsOffset=*/ 3, /*dstOffset=*/ 4)
+                ]
+        },
+        {
+            label: 'Max limbs',
+            setup: [
+                {
+                    offset: 0,
+                    value: new Field(Fr.random())
+                },
+                {
+                    offset: 1,
+                    value: new Uint32(2n)
+                },
+                {
+                    offset: 2,
+                    value: new Uint32(256n)
                 },
                 {
                     offset: 3,
@@ -985,6 +1308,8 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
     // ═══════════════════════════════════════════════════════════════════════════
     // MISC
     // ═══════════════════════════════════════════════════════════════════════════
+    // DEBUGLOG only has base gas (no dynamic gas scaling) - memory reads only happen
+    // when collectDebugLogs config is enabled
     [Opcode.DEBUGLOG]: [
         {
             setup: [
@@ -1128,7 +1453,7 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
     const instructions = [];
     // 1. Setup memory
     appendSetupInstructions(instructions, config.setup);
-    // 2. Infinite loop - maximize iterations until out-of-gas
+    // 2. Infinite loop - maximize calls to target until out-of-gas
     appendInfiniteLoop(instructions, config);
     return encodeToBytecode(instructions);
 }
@@ -1151,66 +1476,14 @@ const INT_TAGS = Array.from(INTEGRAL_TAGS);
     }
     return encodeToBytecode(instructions);
 }
-/** Reserved memory offsets for outer call loop */ const CONST_1_OFFSET = 0;
-const CALL_L2_GAS_OFFSET = 1;
-const CALL_DA_GAS_OFFSET = 2;
-const CALL_ADDR_OFFSET = 3;
-const CALL_ARGS_SIZE = 4;
-const CALL_ARGS_OFFSET = 5;
-const CALLDATA_INDEX_OFFSET = 6; // calldata index as in calldata[index]
-/**
- * A SpamConfig for an external call loop.
- */ const EXTERNAL_CALL_LOOP_CONFIG = {
-    setup: [
-        // calldata will contain 1 item: the external call address
-        {
-            offset: CONST_1_OFFSET,
-            value: new Uint32(1)
-        },
-        {
-            offset: CALLDATA_INDEX_OFFSET,
-            value: new Uint32(0)
-        },
-        {
-            offset: CALL_L2_GAS_OFFSET,
-            value: new Uint32(0xffffffffn)
-        },
-        {
-            offset: CALL_DA_GAS_OFFSET,
-            value: new Uint32(0xffffffffn)
-        },
-        ()=>[
-                new CalldataCopy(/*indirect=*/ 0, /*copySizeOffset=*/ CONST_1_OFFSET, /*cdStartOffset=*/ CALLDATA_INDEX_OFFSET, /*dstOffset=*/ CALL_ADDR_OFFSET)
-            ],
-        {
-            offset: CALL_ARGS_SIZE,
-            value: new Uint32(0)
-        },
-        {
-            offset: CALL_ARGS_SIZE,
-            value: new Uint32(0)
-        }
-    ],
-    targetInstructions: ()=>[
-            new Call(/*indirect=*/ 0, /*l2GasOffset=*/ CALL_L2_GAS_OFFSET, /*daGasOffset=*/ CALL_DA_GAS_OFFSET, /*addrOffset=*/ CALL_ADDR_OFFSET, /*argsSizeOffset=*/ CALL_ARGS_SIZE, /*argsOffset=*/ CALL_ARGS_OFFSET)
-        ]
-};
-/**
- * Create bytecode that makes an external call in a loop.
- *
- * @returns the bytecode for the external call loop
- */ export function createExternalCallLoopBytecode() {
-    const config = EXTERNAL_CALL_LOOP_CONFIG;
-    const instructions = [];
-    // 1. Setup memory
-    appendSetupInstructions(instructions, config.setup);
-    // 2. Infinite loop of external calls - maximize iterations until out-of-gas
-    appendInfiniteLoop(instructions, config);
-    return encodeToBytecode(instructions);
-}
 async function testStandardOpcodeSpam(tester, config, expectToBeTrue) {
     const bytecode = createOpcodeSpamBytecode(config);
-    const result = await deployAndExecuteCustomBytecode(bytecode, tester, config.label);
+    const contract = await deployCustomBytecode(bytecode, tester, config.label);
+    // Should we pass the contract address as calldata?
+    const calldata = config.addressAsCalldata ? [
+        contract.address.toField()
+    ] : [];
+    const result = await executeCustomBytecode(contract, tester, config.label, calldata);
     // should have halted with out of gas
     expectToBeTrue(!result.revertCode.isOK());
     const revertReason = result.findRevertReason()?.message.toLowerCase();
@@ -1219,12 +1492,14 @@ async function testStandardOpcodeSpam(tester, config, expectToBeTrue) {
         'not enough l2gas'
     ];
     // expect the reason to match ONE of the allowed reasons
-    expectToBeTrue(allowedReasons.some((allowedReason)=>revertReason.includes(allowedReason)));
+    expectToBeTrue(allowedReasons.some((allowedReason)=>revertReason?.includes(allowedReason)));
     return result;
 }
 async function testSideEffectOpcodeSpam(tester, config, expectToBeTrue) {
+    // Inner contract will spam the side-effect limited opcode up to its limit, then REVERT
     const innerBytecode = createSideEffectSpamBytecode(config);
-    const outerBytecode = createExternalCallLoopBytecode();
+    // Outer contract will CALL to inner contract in a loop
+    const outerBytecode = createOpcodeSpamBytecode(EXTERNAL_CALL_CONFIG);
     const innerContract = await deployCustomBytecode(innerBytecode, tester, `${config.label}_Inner`);
     const outerContract = await deployCustomBytecode(outerBytecode, tester, `${config.label}_Outer`);
     // Outer contract reads calldata[0] as inner contract address to CALL to
@@ -1240,7 +1515,7 @@ async function testSideEffectOpcodeSpam(tester, config, expectToBeTrue) {
         'not enough l2gas'
     ];
     // expect the reason to match ONE of the allowed reasons
-    expectToBeTrue(allowedReasons.some((allowedReason)=>revertReason.includes(allowedReason)));
+    expectToBeTrue(allowedReasons.some((allowedReason)=>revertReason?.includes(allowedReason)));
     // Top-level should _always_ run out of gas for these tests
     // Check top-level halting message
     // WARNING: only the C++ simulator (or TsVsCpp) will have haltingMessage
@@ -1248,10 +1523,12 @@ async function testSideEffectOpcodeSpam(tester, config, expectToBeTrue) {
         'out of gas',
         'not enough l2gas'
     ];
-    const outerCallMetadata = result.callStackMetadata[0];
-    const outerReason = outerCallMetadata.haltingMessage?.toLowerCase();
-    // expect the reason to match ONE of the allowed reasons
-    expectToBeTrue(allowedOuterReasons.some((allowedReason)=>outerReason.includes(allowedReason)));
+    if (result.callStackMetadata && result.callStackMetadata.length > 0) {
+        const outerCallMetadata = result.callStackMetadata[0];
+        const outerReason = outerCallMetadata.haltingMessage?.toLowerCase();
+        // expect the reason to match ONE of the allowed reasons
+        expectToBeTrue(allowedOuterReasons.some((allowedReason)=>outerReason?.includes(allowedReason)));
+    }
     return result;
 }
 export async function testOpcodeSpamCase(tester, config, expectToBeTrue = ()=>{}) {