@aztec/simulator 4.0.0-nightly.20250907 → 4.0.0-nightly.20260107

package/src/public/avm/test_utils.ts

@@ -1,4 +1,4 @@
-import { Fr } from '@aztec/foundation/fields';
+import { Fr } from '@aztec/foundation/curves/bn254';
 import type { ContractClassPublic, ContractInstanceWithAddress } from '@aztec/stdlib/contract';
 
 import type { jest } from '@jest/globals';
@@ -27,13 +27,12 @@ export function mockStorageReadWithMap(worldStateDB: PublicTreesDB, mockedStorag
   );
 }
 
-export function mockNoteHashExists(worldStateDB: PublicTreesDB, _leafIndex: bigint, value?: Fr) {
+export function mockGetNoteHash(worldStateDB: PublicTreesDB, _leafIndex: bigint, value?: Fr) {
   (worldStateDB as jest.Mocked<PublicTreesDB>).getNoteHash.mockImplementation((index: bigint) => {
-    if (index == _leafIndex) {
+    if (index == _leafIndex && value) {
       return Promise.resolve(value);
     } else {
-      // This is ok for now since the traceing functions handle it
-      return Promise.resolve(undefined);
+      return Promise.resolve(Fr.ZERO);
     }
   });
 }
@@ -42,19 +41,12 @@ export function mockCheckNullifierExists(worldStateDB: PublicTreesDB, exists: bo
   (worldStateDB as jest.Mocked<PublicTreesDB>).checkNullifierExists.mockResolvedValue(exists);
 }
 
-export function mockL1ToL2MessageExists(
-  worldStateDB: PublicTreesDB,
-  leafIndex: bigint,
-  value: Fr,
-  valueAtOtherIndices?: Fr,
-) {
+export function mockGetL1ToL2LeafValue(worldStateDB: PublicTreesDB, leafIndex: bigint, value?: Fr) {
   (worldStateDB as jest.Mocked<PublicTreesDB>).getL1ToL2LeafValue.mockImplementation((index: bigint) => {
-    if (index == leafIndex) {
+    if (index == leafIndex && value) {
       return Promise.resolve(value);
     } else {
-      // any indices other than mockAtLeafIndex will return a different value
-      // (or undefined if no value is specified for other indices)
-      return Promise.resolve(valueAtOtherIndices!);
+      return Promise.resolve(Fr.ZERO!);
     }
   });
 }

package/src/public/contracts_db_checkpoint.ts

@@ -0,0 +1,41 @@
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import type { AztecAddress } from '@aztec/stdlib/aztec-address';
+import type { ContractClassPublic, ContractInstanceWithAddress } from '@aztec/stdlib/contract';
+
+export class ContractsDbCheckpoint {
+  private instances: Map<string, ContractInstanceWithAddress> = new Map();
+  private classes: Map<string, ContractClassPublic> = new Map();
+  private bytecodeCommitments: Map<string, Fr> = new Map();
+
+  public addInstance(address: AztecAddress, instance: ContractInstanceWithAddress): void {
+    this.instances.set(address.toString(), instance);
+  }
+
+  public addClass(classId: Fr, contractClass: ContractClassPublic): void {
+    this.classes.set(classId.toString(), contractClass);
+  }
+
+  public addBytecodeCommitment(classId: Fr, commitment: Fr): void {
+    this.bytecodeCommitments.set(classId.toString(), commitment);
+  }
+
+  public getInstance(address: AztecAddress): ContractInstanceWithAddress | undefined {
+    return this.instances.get(address.toString());
+  }
+
+  public getClass(classId: Fr): ContractClassPublic | undefined {
+    return this.classes.get(classId.toString());
+  }
+
+  public getBytecodeCommitment(classId: Fr): Fr | undefined {
+    return this.bytecodeCommitments.get(classId.toString());
+  }
+
+  public deepCopy(): ContractsDbCheckpoint {
+    const copy = new ContractsDbCheckpoint();
+    this.instances.forEach((value, key) => copy.instances.set(key, value));
+    this.classes.forEach((value, key) => copy.classes.set(key, value));
+    this.bytecodeCommitments.forEach((value, key) => copy.bytecodeCommitments.set(key, value));
+    return copy;
+  }
+}

package/src/public/db_interfaces.ts

@@ -1,4 +1,4 @@
-import type { Fr } from '@aztec/foundation/fields';
+import type { Fr } from '@aztec/foundation/curves/bn254';
 import type { FunctionSelector } from '@aztec/stdlib/abi';
 import type { AztecAddress } from '@aztec/stdlib/aztec-address';
 import type { ContractClassPublic, ContractInstanceWithAddress } from '@aztec/stdlib/contract';
@@ -58,4 +58,19 @@ export interface PublicContractsDBInterface {
    * @returns The name of the function or undefined if not found.
    */
   getDebugFunctionName(contractAddress: AztecAddress, selector: FunctionSelector): Promise<string | undefined>;
+
+  /**
+   * Creates a checkpoint of the current contract state.
+   */
+  createCheckpoint(): void;
+
+  /**
+   * Commits the current checkpoint, merging its state with the parent.
+   */
+  commitCheckpoint(): void;
+
+  /**
+   * Reverts the current checkpoint, discarding its state.
+   */
+  revertCheckpoint(): void;
 }

package/src/public/debug_fn_name.ts

@@ -1,4 +1,4 @@
-import type { Fr } from '@aztec/foundation/fields';
+import type { Fr } from '@aztec/foundation/curves/bn254';
 import { FunctionSelector } from '@aztec/stdlib/abi';
 import type { AztecAddress } from '@aztec/stdlib/aztec-address';
 
@@ -13,6 +13,38 @@ export async function getPublicFunctionDebugName(
   if (!calldata[0]) {
     return `<calldata[0] undefined> (Contract Address: ${contractAddress})`;
   }
-  const selector = FunctionSelector.fromField(calldata[0]);
-  return (await db.getDebugFunctionName(contractAddress, selector)) ?? selector.toString();
+  const fallbackName = `<calldata[0]:${calldata[0].toString()}> (Contract Address: ${contractAddress})`;
+  const selector = FunctionSelector.fromFieldOrUndefined(calldata[0]);
+  if (!selector) {
+    return fallbackName;
+  }
+  return (await db.getDebugFunctionName(contractAddress, selector)) ?? fallbackName;
+}
+
+/**
+ * Get the function selector and optional debug name for a public function.
+ * Returns the selector and name separately, with name only populated if a debug name is available.
+ * @param db - The contracts database
+ * @param contractAddress - The contract address
+ * @param calldata - The calldata (selector is in calldata[0])
+ * @returns An object with functionSelector (always if calldata[0] exists) and functionName (only if debug name found)
+ */
+export async function getPublicFunctionSelectorAndName(
+  db: PublicContractsDBInterface,
+  contractAddress: AztecAddress,
+  calldata: Fr[],
+): Promise<{ functionSelector?: FunctionSelector; functionName?: string }> {
+  // Public function is dispatched and therefore the target function is passed in the first argument.
+  if (!calldata[0]) {
+    return {};
+  }
+  const selector = FunctionSelector.fromFieldOrUndefined(calldata[0]);
+  if (!selector) {
+    return {};
+  }
+  const debugName = await db.getDebugFunctionName(contractAddress, selector);
+  return {
+    functionSelector: selector,
+    functionName: debugName ?? undefined,
+  };
 }

package/src/public/executor_metrics.ts

@@ -1,4 +1,5 @@
 import type { RevertCode } from '@aztec/stdlib/avm';
+import type { GasUsed } from '@aztec/stdlib/gas';
 import {
   Attributes,
   type Histogram,
@@ -70,7 +71,7 @@ export class ExecutorMetrics implements ExecutorMetricsInterface {
     // do nothing (unimplemented)
   }
 
-  stopRecordingTxSimulation(_txLabel: string, _revertedCode?: RevertCode) {
+  stopRecordingTxSimulation(_txLabel: string, _gasUsed?: GasUsed, _revertedCode?: RevertCode) {
     // do nothing (unimplemented)
   }
 

package/src/public/executor_metrics_interface.ts

@@ -1,8 +1,9 @@
 import type { RevertCode } from '@aztec/stdlib/avm';
+import type { GasUsed } from '@aztec/stdlib/gas';
 
 export interface ExecutorMetricsInterface {
   startRecordingTxSimulation(txLabel: string): void;
-  stopRecordingTxSimulation(txLabel: string, revertedCode?: RevertCode): void;
+  stopRecordingTxSimulation(txLabel: string, gasUsed?: GasUsed, revertedCode?: RevertCode): void;
   recordEnqueuedCallSimulation(fnName: string, durationMs: number, manaUsed: number, totalInstructions: number): void;
   recordEnqueuedCallSimulationFailure(
     fnName: string,

package/src/public/fixtures/amm_test.ts

@@ -1,6 +1,6 @@
 import { GeneratorIndex } from '@aztec/constants';
-import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto';
-import { Fr } from '@aztec/foundation/fields';
+import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
+import { Fr } from '@aztec/foundation/curves/bn254';
 import type { Logger } from '@aztec/foundation/log';
 import { Timer } from '@aztec/foundation/timer';
 import type { ContractArtifact } from '@aztec/stdlib/abi';

package/src/public/fixtures/bulk_test.ts

@@ -1,4 +1,4 @@
-import { Fr } from '@aztec/foundation/fields';
+import { Fr } from '@aztec/foundation/curves/bn254';
 import type { Logger } from '@aztec/foundation/log';
 import { Timer } from '@aztec/foundation/timer';
 import type { ContractArtifact } from '@aztec/stdlib/abi';
@@ -22,12 +22,17 @@ export async function bulkTest(
 
   // Needed since we invoke the Fee Juice Contract in the bulk test.registerFeeJuiceContract
   await tester.registerFeeJuiceContract();
+  // Register multiple different protocol contracts (to ensure we don't dedup bytecode hashing events):
+  await tester.registerAuthContract();
+  await tester.registerInstanceRegistryContract();
 
   // Get a deployed contract instance to pass to the contract
   // for it to use as "expected" values when testing contract instance retrieval.
   const expectContractInstance = avmTestContract;
   const argsField = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsU8 = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
+  const argsU8 = [1, 2, 3, 4, 5, 6, 7, 8].map(x => new Fr(x));
+  argsU8.push(new Fr(2n ** 128n + 9n)); // Trigger truncation from large (> 128 bits) value (canonical decomposition event)
+  argsU8.push(new Fr(2n ** 125n + 10n)); // Trigger truncation from small (< 128 bits) value (no canonical decomposition event)
   const args = [
     argsField,
     argsU8,
@@ -48,6 +53,26 @@ export async function bulkTest(
         fnName: 'bulk_testing',
         args,
       },
+      // 3 calls creating calldata + asserting calldata copy:
+      {
+        address: avmTestContract.address,
+        fnName: 'assert_calldata_copy_large',
+        args: [Array.from({ length: 300 }, () => Fr.random()), /* with_selector: */ true],
+      },
+      {
+        address: avmTestContract.address,
+        fnName: 'assert_calldata_copy',
+        args: [argsField.slice(3), /* with_selector: */ true],
+      },
+      {
+        address: avmTestContract.address,
+        fnName: 'assert_calldata_copy_large',
+        args: [Array.from({ length: 300 }, () => Fr.random()), /* with_selector: */ true],
+      },
+      // 3 calls to external contracts
+      { address: avmTestContract.address, fnName: 'call_fee_juice', args: [] },
+      { address: avmTestContract.address, fnName: 'call_auth_registry', args: [] },
+      { address: avmTestContract.address, fnName: 'call_instance_registry', args: [] },
     ],
     /*teardownCall=*/ undefined,
     /*feePayer*/ undefined,
@@ -89,20 +114,14 @@ export async function megaBulkTest(
   // for it to use as "expected" values when testing contract instance retrieval.
   const expectContractInstance = avmTestContract;
   const argsField0 = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField1 = [2, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField2 = [3, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField3 = [4, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField4 = [5, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField5 = [6, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField6 = [7, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField7 = [8, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField8 = [9, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField9 = [10, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField10 = [11, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField11 = [12, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField12 = [13, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField13 = [14, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
-  const argsField14 = [15, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
+  const argsField1 = [3, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
+  const argsField2 = [5, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
+  const argsField3 = [7, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
+  const argsField4 = [9, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
+  const argsField5 = [11, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
+  //const argsField6 = [13, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
+  //const argsField7 = [15, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
+  //const argsField8 = [17, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
   const argsU8 = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].map(x => new Fr(x));
   const genArgs = (argsField: Fr[]) => [
     argsField,
@@ -126,15 +145,9 @@ export async function megaBulkTest(
       { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField3) },
       { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField4) },
       { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField5) },
-      { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField6) },
-      { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField7) },
-      { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField8) },
-      { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField9) },
-      { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField10) },
-      { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField11) },
-      { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField12) },
-      { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField13) },
-      { address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField14) },
+      //{ address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField6) },
+      //{ address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField7) },
+      //{ address: avmTestContract.address, fnName: 'bulk_testing', args: genArgs(argsField8) },
     ],
     /*teardownCall=*/ undefined,
     /*feePayer*/ undefined,

package/src/public/fixtures/custom_bytecode_tester.ts

@@ -0,0 +1,83 @@
+import { FunctionType, emptyContractArtifact, emptyFunctionArtifact } from '@aztec/stdlib/abi';
+import type { PublicTxResult } from '@aztec/stdlib/avm';
+import { AztecAddress } from '@aztec/stdlib/aztec-address';
+import type { ContractInstanceWithAddress } from '@aztec/stdlib/contract';
+
+import { PublicTxSimulationTester } from './public_tx_simulation_tester.js';
+
+/**
+ * Deploy a contract with the provided bytecode.
+ * @param bytecode - The bytecode buffer to use
+ * @param tester - The tester to use
+ * @param contractName - The name of the contract
+ * @param deployer - The deployer address
+ * @returns The deployed contract instance
+ */
+export async function deployCustomBytecode(
+  bytecode: Buffer,
+  tester: PublicTxSimulationTester,
+  contractName: string = 'CustomBytecodeContract',
+  deployer: AztecAddress = AztecAddress.fromNumber(42),
+): Promise<ContractInstanceWithAddress> {
+  const contractArtifact = emptyContractArtifact();
+  contractArtifact.name = contractName;
+  contractArtifact.functions = [emptyFunctionArtifact()];
+  // We use name 'public_dispatch' since that is what is expected
+  // in a ContractArtifact. But function selectors are not required
+  // when executing since the custom bytecode likely has no dispatch.
+  contractArtifact.functions[0].name = 'public_dispatch';
+  contractArtifact.functions[0].functionType = FunctionType.PUBLIC;
+  contractArtifact.functions[0].bytecode = bytecode;
+
+  // return the contract instance
+  return await tester.registerAndDeployContract(
+    /*constructorArgs=*/ [],
+    deployer,
+    /*contractArtifact=*/ contractArtifact,
+  );
+}
+
+/**
+ * Execute a custom bytecode contract.
+ * @param contract - The contract instance to execute
+ * @param tester - The tester to use
+ * @param txLabel - The label of the transaction
+ * @param calldata - The calldata to use
+ * @returns The execution result
+ */
+export async function executeCustomBytecode(
+  contract: ContractInstanceWithAddress,
+  tester: PublicTxSimulationTester,
+  txLabel: string = 'CustomBytecodeTest',
+  calldata: any[] = [],
+): Promise<PublicTxResult> {
+  // EXECUTE! This means that if using AvmProvingTester subclass, it will PROVE the transaction!
+  return await tester.executeTxWithLabel(
+    /*txLabel=*/ txLabel,
+    /*sender=*/ contract.deployer,
+    /*setupCalls=*/ [],
+    /*appCalls=*/ [{ address: contract.address, args: calldata }],
+  );
+}
+
+/**
+ * Deploy and execute a custom bytecode contract.
+ * @param bytecode - The bytecode buffer to use
+ * @param tester - The tester to use
+ * @param txLabel - The label of the transaction
+ * @param contractName - The name of the contract
+ * @param deployer - The deployer address
+ * @param calldata - The calldata to use
+ * @returns The execution result
+ */
+export async function deployAndExecuteCustomBytecode(
+  bytecode: Buffer,
+  tester: PublicTxSimulationTester,
+  txLabel: string = 'CustomBytecodeTest',
+  contractName: string = 'CustomBytecodeContract',
+  deployer: AztecAddress = AztecAddress.fromNumber(42),
+  calldata: any[] = [],
+): Promise<PublicTxResult> {
+  const testContract = await deployCustomBytecode(bytecode, tester, contractName, deployer);
+  return await executeCustomBytecode(testContract, tester, txLabel, calldata);
+}

package/src/public/fixtures/custom_bytecode_tests.ts

@@ -0,0 +1,219 @@
+import { strict as assert } from 'assert';
+
+import { TypeTag } from '../avm/avm_memory_types.js';
+import { Addressing, AddressingMode } from '../avm/opcodes/addressing_mode.js';
+import { Add, CalldataCopy, Jump, Return, Set } from '../avm/opcodes/index.js';
+import { encodeToBytecode } from '../avm/serialization/bytecode_serialization.js';
+import {
+  MAX_OPCODE_VALUE,
+  Opcode,
+  OperandType,
+  getOperandSize,
+} from '../avm/serialization/instruction_serialization.js';
+import { deployAndExecuteCustomBytecode } from './custom_bytecode_tester.js';
+import { PublicTxSimulationTester } from './public_tx_simulation_tester.js';
+
+// First instruction resolved a base address (offset 0) which is uninitialized and therefore
+// of invalid tag (FF). This will trigger an exceptional halt.
+export async function addressingWithBaseTagIssueTest(isIndirect: boolean, tester: PublicTxSimulationTester) {
+  const addressingMode = Addressing.fromModes([
+    isIndirect ? AddressingMode.INDIRECT_RELATIVE : AddressingMode.RELATIVE,
+    AddressingMode.DIRECT,
+    AddressingMode.DIRECT,
+  ]);
+
+  const bytecode = encodeToBytecode([
+    new CalldataCopy(/*indirect=*/ addressingMode.toWire(), /*copySize=*/ 1, /*cdOffset=*/ 0, /*dstOffset=*/ 0),
+    new Return(/*indirect=*/ 0, /*copySizeOffset=*/ 0, /*returnOffset=*/ 0),
+  ]);
+
+  const txLabel = isIndirect ? 'AddressingWithBaseTagInvalidIndirect' : 'AddressingWithBaseTagInvalidDirect';
+  return await deployAndExecuteCustomBytecode(bytecode, tester, txLabel);
+}
+
+// First instruction sets a value with tag U64 at offset 0. Then a CalldataCopy instruction
+// uses INDIRECT addressing to read from offset 0, which should fail because the value at
+// offset 0 has tag U64 (not U32), making it an invalid address tag.
+export async function addressingWithIndirectTagIssueTest(tester: PublicTxSimulationTester) {
+  // Set a U64 value at offset 0 - this will be used as an indirect address
+  const addressingMode = Addressing.fromModes([
+    AddressingMode.INDIRECT, // First operand (cdOffset) uses indirect addressing
+    AddressingMode.DIRECT,
+    AddressingMode.DIRECT,
+  ]);
+
+  const bytecode = encodeToBytecode([
+    // Set a U64 value at offset 0 - this has the wrong tag for an address (should be U32)
+    new Set(/*indirect=*/ 0, /*dstOffset=*/ 0, TypeTag.UINT64, /*value=*/ 100n).as(Opcode.SET_64, Set.wireFormat64),
+    // Try to use indirect addressing: read from offset 0, which contains a U64 value
+    // This should fail because U64 is not a valid address tag (must be U32)
+    new CalldataCopy(/*indirect=*/ addressingMode.toWire(), /*copySize=*/ 1, /*cdOffset=*/ 0, /*dstOffset=*/ 1),
+    new Return(/*indirect=*/ 0, /*copySizeOffset=*/ 0, /*returnOffset=*/ 0),
+  ]);
+
+  const txLabel = 'AddressingWithIndirectTagInvalid';
+  return await deployAndExecuteCustomBytecode(bytecode, tester, txLabel);
+}
+
+// First instruction sets a value 10 with tag U32 at offset 1 (direct, no relative).
+// Then an ADD_16 instruction uses INDIRECT addressing for the first operand (offset 1)
+// and RELATIVE addressing for the second operand (offset 2). The indirect addressing
+// succeeds (reads U32 value 10 from offset 1, uses it as address), but the relative
+// addressing fails because the base address at offset 0 has the wrong tag (uninitialized/invalid).
+export async function addressingWithIndirectThenRelativeTagIssueTest(tester: PublicTxSimulationTester) {
+  const addressingMode = Addressing.fromModes([
+    AddressingMode.INDIRECT, // First operand (aOffset) uses indirect addressing, no relative
+    AddressingMode.RELATIVE, // Second operand (bOffset) uses relative addressing
+    AddressingMode.DIRECT, // Third operand (dstOffset) uses direct addressing
+  ]);
+
+  const bytecode = encodeToBytecode([
+    // Set a U32 value 10 at offset 1 - this will be used as an indirect address
+    new Set(/*indirect=*/ 0, /*dstOffset=*/ 1, TypeTag.UINT32, /*value=*/ 10).as(Opcode.SET_32, Set.wireFormat32),
+    // ADD_16: first operand uses indirect addressing (reads from offset 1, gets value 10, uses as address - succeeds)
+    //         second operand uses relative addressing (tries to read base from offset 0, but offset 0 has wrong tag - fails)
+    new Add(/*indirect=*/ addressingMode.toWire(), /*aOffset=*/ 1, /*bOffset=*/ 2, /*dstOffset=*/ 3).as(
+      Opcode.ADD_16,
+      Add.wireFormat16,
+    ),
+    new Return(/*indirect=*/ 0, /*copySizeOffset=*/ 0, /*returnOffset=*/ 0),
+  ]);
+
+  const txLabel = 'AddressingWithIndirectThenRelativeTagInvalid';
+  return await deployAndExecuteCustomBytecode(bytecode, tester, txLabel);
+}
+
+// First instruction sets UINT32_MAX at offset 0 (base address) with tag U32.
+// Then an ADD_8 instruction uses INDIRECT_RELATIVE addressing for the first operand (offset 1)
+// and INDIRECT addressing for the second operand (offset 2). The relative addressing
+// for the first operand will overflow (UINT32_MAX + 1 >= MAX_MEMORY_SIZE), causing the instruction to fail.
+// The second operand will also fail (indirect addressing from offset 2 which is uninitialized with tag FF).
+export async function addressingWithRelativeOverflowAndIndirectTagIssueTest(tester: PublicTxSimulationTester) {
+  const addressingMode = Addressing.fromModes([
+    AddressingMode.INDIRECT_RELATIVE, // First operand (aOffset) uses both indirect and relative addressing
+    AddressingMode.INDIRECT, // Second operand (bOffset) uses indirect addressing only
+    AddressingMode.DIRECT, // Third operand (dstOffset) uses direct addressing
+  ]);
+
+  // UINT32_MAX = 2^32 - 1 = 4294967295
+  const UINT32_MAX = 0xffffffff;
+
+  const bytecode = encodeToBytecode([
+    // Set UINT32_MAX at offset 0 as base address - this will cause overflow when adding relative offset 1
+    new Set(/*indirect=*/ 0, /*dstOffset=*/ 0, TypeTag.UINT32, /*value=*/ UINT32_MAX).as(
+      Opcode.SET_32,
+      Set.wireFormat32,
+    ),
+    new Add(/*indirect=*/ addressingMode.toWire(), /*aOffset=*/ 1, /*bOffset=*/ 2, /*dstOffset=*/ 3).as(
+      Opcode.ADD_8,
+      Add.wireFormat8,
+    ),
+    new Return(/*indirect=*/ 0, /*copySizeOffset=*/ 0, /*returnOffset=*/ 0),
+  ]);
+
+  const txLabel = 'AddressingWithRelativeOverflowAndIndirectTagInvalid';
+  return await deployAndExecuteCustomBytecode(bytecode, tester, txLabel);
+}
+
+export async function pcOutOfRangeTest(tester: PublicTxSimulationTester) {
+  const bytecode = encodeToBytecode([
+    new Jump(/*jumpOffset=*/ 123), // Jump to out-of-range pc offset.
+    new Return(/*indirect=*/ 0, /*copySizeOffset=*/ 0, /*returnOffset=*/ 0),
+  ]);
+
+  const txLabel = 'PcOutOfRange';
+  return await deployAndExecuteCustomBytecode(bytecode, tester, txLabel);
+}
+
+export async function invalidOpcodeTest(tester: PublicTxSimulationTester) {
+  let bytecode = encodeToBytecode([
+    new Set(/*indirect=*/ 0, /*dstOffset=*/ 0, TypeTag.UINT32, /*value=*/ 0).as(Opcode.SET_8, Set.wireFormat8),
+  ]);
+
+  const offsetReturnOpcodeByte = bytecode.length;
+
+  bytecode = Buffer.concat([
+    bytecode,
+    encodeToBytecode([new Return(/*indirect=*/ 0, /*copySizeOffset=*/ 0, /*returnOffset=*/ 0)]),
+  ]);
+
+  // Manipulate the Return opcode to make the opcode invalid (out of range).
+  bytecode[offsetReturnOpcodeByte] = MAX_OPCODE_VALUE + 1; // opcode is invalid.
+
+  const txLabel = 'InvalidOpcode';
+  return await deployAndExecuteCustomBytecode(bytecode, tester, txLabel);
+}
+
+// Single invalid byte in the bytecode.
+export async function invalidByteTest(tester: PublicTxSimulationTester) {
+  const invalidOpcode = MAX_OPCODE_VALUE + 7;
+  assert(invalidOpcode < 256, 'Invalid opcode must fit in a single byte');
+  const bytecode = Buffer.from([invalidOpcode]);
+
+  const txLabel = 'InvalidByte';
+  return await deployAndExecuteCustomBytecode(bytecode, tester, txLabel);
+}
+
+// Truncate the last instruction in the bytecode.
+export async function instructionTruncatedTest(tester: PublicTxSimulationTester) {
+  let bytecode = encodeToBytecode([
+    new Set(/*indirect=*/ 0, /*dstOffset=*/ 0, TypeTag.UINT32, /*value=*/ 0).as(Opcode.SET_8, Set.wireFormat8),
+  ]);
+
+  // Truncate the bytecode.
+  bytecode = bytecode.subarray(0, -1);
+
+  const txLabel = 'InstructionTruncated';
+  return await deployAndExecuteCustomBytecode(bytecode, tester, txLabel);
+}
+
+// Invalid tag value byte in an instruction.
+export async function invalidTagValueTest(tester: PublicTxSimulationTester) {
+  const bytecode = encodeToBytecode([
+    new Set(/*indirect=*/ 0, /*dstOffset=*/ 0, TypeTag.UINT32, /*value=*/ 0).as(Opcode.SET_8, Set.wireFormat8),
+    new Return(/*indirect=*/ 0, /*copySizeOffset=*/ 0, /*returnOffset=*/ 0),
+  ]);
+
+  const tagOffset = getTagOffsetInInstruction(Set.wireFormat8);
+  assert(bytecode[tagOffset].valueOf() == TypeTag.UINT32.valueOf(), 'Set instruction tag should be UINT32 in test');
+  bytecode[tagOffset] = TypeTag.INVALID;
+
+  const txLabel = 'InvalidTagValue';
+  return await deployAndExecuteCustomBytecode(bytecode, tester, txLabel);
+}
+
+// Combine an invalid tag in the last instruction that is truncated.
+export async function invalidTagValueAndInstructionTruncatedTest(tester: PublicTxSimulationTester) {
+  let bytecode = encodeToBytecode([
+    // Important: value argument must be a bigint otherwise a type error will be thrown.
+    new Set(/*indirect=*/ 0, /*dstOffset=*/ 0, TypeTag.UINT128, /*value=*/ 0n).as(Opcode.SET_128, Set.wireFormat128),
+  ]);
+
+  // Truncate the bytecode.
+  bytecode = bytecode.subarray(0, -5);
+  const tagOffset = getTagOffsetInInstruction(Set.wireFormat128);
+  assert(bytecode[tagOffset].valueOf() == TypeTag.UINT128.valueOf(), 'Set instruction tag should be UINT128 in test');
+  bytecode[tagOffset] = 0x6f; // Invalid tag value.
+
+  const txLabel = 'InvalidTagValueAndInstructionTruncated';
+  return await deployAndExecuteCustomBytecode(bytecode, tester, txLabel);
+}
+
+/**
+ * Returns the offset of the tag in an instruction.
+ * @details Loops over the wire format operand type entries until it finds the tag.
+ * Returns the byte offset of the tag based on each operand size that is passed.
+ *
+ * @param wireFormat array of operand types
+ * @returns byte offset of the tag
+ */
+function getTagOffsetInInstruction(wireFormat: OperandType[]): number {
+  let offset = 0;
+  for (const operand of wireFormat) {
+    if (operand === OperandType.TAG) {
+      break;
+    }
+    offset += getOperandSize(operand);
+  }
+  return offset;
+}

package/src/public/fixtures/index.ts

@@ -1,8 +1,15 @@
 export * from './public_tx_simulation_tester.js';
 export * from './utils.js';
 export * from './simple_contract_data_source.js';
-export { readAvmMinimalPublicTxInputsFromFile, createAvmMinimalPublicTx } from './minimal_public_tx.js';
+export { executeAvmMinimalPublicTx } from './minimal_public_tx.js';
 export { TestExecutorMetrics } from '../test_executor_metrics.js';
 export { ammTest } from './amm_test.js';
 export { bulkTest, megaBulkTest } from './bulk_test.js';
 export { tokenTest } from './token_test.js';
+export * from './custom_bytecode_tests.js';
+export {
+  deployCustomBytecode,
+  executeCustomBytecode,
+  deployAndExecuteCustomBytecode,
+} from './custom_bytecode_tester.js';
+export { getSpamConfigsPerOpcode, testOpcodeSpamCase } from './opcode_spammer.js';