@feelyourprotocol/evm 8141.0.0

package/src/precompiles/0b-bls12-g1add.ts

@@ -0,0 +1,63 @@
+import { bytesToHex } from '@feelyourprotocol/util'
+
+import { EVMError } from '../errors.ts'
+import type { EVM } from '../evm.ts'
+import { EVMErrorResult, OOGResult } from '../evm.ts'
+
+import { leading16ZeroBytesCheck } from './bls12_381/index.ts'
+import { getPrecompileName } from './index.ts'
+import { equalityLengthCheck, gasLimitCheck } from './util.ts'
+
+import type { ExecResult } from '../types.ts'
+import type { PrecompileInput } from './types.ts'
+
+export async function precompile0b(opts: PrecompileInput): Promise<ExecResult> {
+  const pName = getPrecompileName('0b')
+  const bls = (opts._EVM as EVM)['_bls']!
+
+  // note: the gas used is constant; even if the input is incorrect.
+  const gasUsed = opts.common.param('bls12381G1AddGas')
+  if (!gasLimitCheck(opts, gasUsed, pName)) {
+    return OOGResult(opts.gasLimit)
+  }
+
+  if (!equalityLengthCheck(opts, 256, pName)) {
+    return EVMErrorResult(
+      new EVMError(EVMError.errorMessages.BLS_12_381_INVALID_INPUT_LENGTH),
+      opts.gasLimit,
+    )
+  }
+
+  // check if some parts of input are zero bytes.
+  const zeroByteRanges = [
+    [0, 16],
+    [64, 80],
+    [128, 144],
+    [192, 208],
+  ]
+  if (!leading16ZeroBytesCheck(opts, zeroByteRanges, pName)) {
+    return EVMErrorResult(
+      new EVMError(EVMError.errorMessages.BLS_12_381_POINT_NOT_ON_CURVE),
+      opts.gasLimit,
+    )
+  }
+
+  let returnValue
+  try {
+    returnValue = bls.addG1(opts.data)
+  } catch (e: any) {
+    if (opts._debug !== undefined) {
+      opts._debug(`${pName} failed: ${e.message}`)
+    }
+    return EVMErrorResult(e, opts.gasLimit)
+  }
+
+  if (opts._debug !== undefined) {
+    opts._debug(`${pName} return value=${bytesToHex(returnValue)}`)
+  }
+
+  return {
+    executionGasUsed: gasUsed,
+    returnValue,
+  }
+}

package/src/precompiles/0c-bls12-g1msm.ts

@@ -0,0 +1,87 @@
+import { bytesToHex } from '@feelyourprotocol/util'
+
+import { EVMError } from '../errors.ts'
+import type { EVM } from '../evm.ts'
+import { EVMErrorResult, OOGResult } from '../evm.ts'
+
+import {
+  BLS_GAS_DISCOUNT_PAIRS_G1,
+  leading16ZeroBytesCheck,
+  msmGasUsed,
+} from './bls12_381/index.ts'
+import { getPrecompileName } from './index.ts'
+import { gasLimitCheck, moduloLengthCheck } from './util.ts'
+
+import type { ExecResult } from '../types.ts'
+import type { PrecompileInput } from './types.ts'
+
+export async function precompile0c(opts: PrecompileInput): Promise<ExecResult> {
+  const pName = getPrecompileName('0d')
+  const bls = (opts._EVM as EVM)['_bls']!
+
+  const inputData = opts.data
+
+  if (inputData.length === 0) {
+    if (opts._debug !== undefined) {
+      opts._debug(`${pName} failed: Empty input`)
+    }
+    return EVMErrorResult(
+      new EVMError(EVMError.errorMessages.BLS_12_381_INPUT_EMPTY),
+      opts.gasLimit,
+    ) // follow Geth's implementation
+  }
+
+  // TODO: Double-check respectively confirm that this order is really correct that the gas check
+  // on this eventually to be "floored" pair number should happen before the input length modulo
+  // validation (same for g2msm)
+  const numPairs = Math.floor(inputData.length / 160)
+  const gasUsedPerPair = opts.common.param('bls12381G1MulGas')
+  const gasUsed = msmGasUsed(numPairs, gasUsedPerPair, BLS_GAS_DISCOUNT_PAIRS_G1)
+
+  if (!gasLimitCheck(opts, gasUsed, pName)) {
+    return OOGResult(opts.gasLimit)
+  }
+
+  if (!moduloLengthCheck(opts, 160, pName)) {
+    return EVMErrorResult(
+      new EVMError(EVMError.errorMessages.BLS_12_381_INVALID_INPUT_LENGTH),
+      opts.gasLimit,
+    )
+  }
+
+  // prepare pairing list and check for mandatory zero bytes
+  const zeroByteRanges = [
+    [0, 16],
+    [64, 80],
+  ]
+
+  for (let k = 0; k < numPairs; k++) {
+    // zero bytes check
+    const pairStart = 160 * k
+    if (!leading16ZeroBytesCheck(opts, zeroByteRanges, pName, pairStart)) {
+      return EVMErrorResult(
+        new EVMError(EVMError.errorMessages.BLS_12_381_POINT_NOT_ON_CURVE),
+        opts.gasLimit,
+      )
+    }
+  }
+
+  let returnValue
+  try {
+    returnValue = bls.msmG1(opts.data)
+  } catch (e: any) {
+    if (opts._debug !== undefined) {
+      opts._debug(`${pName} failed: ${e.message}`)
+    }
+    return EVMErrorResult(e, opts.gasLimit)
+  }
+
+  if (opts._debug !== undefined) {
+    opts._debug(`${pName} return value=${bytesToHex(returnValue)}`)
+  }
+
+  return {
+    executionGasUsed: gasUsed,
+    returnValue,
+  }
+}

package/src/precompiles/0d-bls12-g2add.ts

@@ -0,0 +1,66 @@
+import { bytesToHex } from '@feelyourprotocol/util'
+
+import { EVMError } from '../errors.ts'
+import type { EVM } from '../evm.ts'
+import { EVMErrorResult, OOGResult } from '../evm.ts'
+
+import { leading16ZeroBytesCheck } from './bls12_381/index.ts'
+import { getPrecompileName } from './index.ts'
+import { equalityLengthCheck, gasLimitCheck } from './util.ts'
+
+import type { ExecResult } from '../types.ts'
+import type { PrecompileInput } from './types.ts'
+
+export async function precompile0d(opts: PrecompileInput): Promise<ExecResult> {
+  const pName = getPrecompileName('0e')
+  const bls = (opts._EVM as EVM)['_bls']!
+
+  // note: the gas used is constant; even if the input is incorrect.
+  const gasUsed = opts.common.param('bls12381G2AddGas')
+  if (!gasLimitCheck(opts, gasUsed, pName)) {
+    return OOGResult(opts.gasLimit)
+  }
+
+  if (!equalityLengthCheck(opts, 512, pName)) {
+    return EVMErrorResult(
+      new EVMError(EVMError.errorMessages.BLS_12_381_INVALID_INPUT_LENGTH),
+      opts.gasLimit,
+    )
+  }
+
+  // check if some parts of input are zero bytes.
+  const zeroByteRanges = [
+    [0, 16],
+    [64, 80],
+    [128, 144],
+    [192, 208],
+    [256, 272],
+    [320, 336],
+    [384, 400],
+    [448, 464],
+  ]
+  if (!leading16ZeroBytesCheck(opts, zeroByteRanges, pName)) {
+    return EVMErrorResult(
+      new EVMError(EVMError.errorMessages.BLS_12_381_POINT_NOT_ON_CURVE),
+      opts.gasLimit,
+    )
+  }
+
+  // TODO: verify that point is on G2
+
+  let returnValue
+  try {
+    returnValue = bls.addG2(opts.data)
+  } catch (e: any) {
+    return EVMErrorResult(e, opts.gasLimit)
+  }
+
+  if (opts._debug !== undefined) {
+    opts._debug(`${pName} return value=${bytesToHex(returnValue)}`)
+  }
+
+  return {
+    executionGasUsed: gasUsed,
+    returnValue,
+  }
+}

package/src/precompiles/0e-bls12-g2msm.ts

@@ -0,0 +1,84 @@
+import { bytesToHex } from '@feelyourprotocol/util'
+
+import { EVMError } from '../errors.ts'
+import type { EVM } from '../evm.ts'
+import { EVMErrorResult, OOGResult } from '../evm.ts'
+
+import {
+  BLS_GAS_DISCOUNT_PAIRS_G2,
+  leading16ZeroBytesCheck,
+  msmGasUsed,
+} from './bls12_381/index.ts'
+import { getPrecompileName } from './index.ts'
+import { gasLimitCheck, moduloLengthCheck } from './util.ts'
+
+import type { ExecResult } from '../types.ts'
+import type { PrecompileInput } from './types.ts'
+
+export async function precompile0e(opts: PrecompileInput): Promise<ExecResult> {
+  const pName = getPrecompileName('10')
+  const bls = (opts._EVM as EVM)['_bls']!
+
+  if (opts.data.length === 0) {
+    if (opts._debug !== undefined) {
+      opts._debug(`${pName} failed: Empty input`)
+    }
+    return EVMErrorResult(
+      new EVMError(EVMError.errorMessages.BLS_12_381_INPUT_EMPTY),
+      opts.gasLimit,
+    ) // follow Geth's implementation
+  }
+
+  const numPairs = Math.floor(opts.data.length / 288)
+  const gasUsedPerPair = opts.common.param('bls12381G2MulGas')
+  const gasUsed = msmGasUsed(numPairs, gasUsedPerPair, BLS_GAS_DISCOUNT_PAIRS_G2)
+
+  if (!gasLimitCheck(opts, gasUsed, pName)) {
+    return OOGResult(opts.gasLimit)
+  }
+
+  if (!moduloLengthCheck(opts, 288, pName)) {
+    return EVMErrorResult(
+      new EVMError(EVMError.errorMessages.BLS_12_381_INVALID_INPUT_LENGTH),
+      opts.gasLimit,
+    )
+  }
+
+  // prepare pairing list and check for mandatory zero bytes
+  const zeroByteRanges = [
+    [0, 16],
+    [64, 80],
+    [128, 144],
+    [192, 208],
+  ]
+
+  for (let k = 0; k < numPairs; k++) {
+    // zero bytes check
+    const pairStart = 288 * k
+    if (!leading16ZeroBytesCheck(opts, zeroByteRanges, pName, pairStart)) {
+      return EVMErrorResult(
+        new EVMError(EVMError.errorMessages.BLS_12_381_POINT_NOT_ON_CURVE),
+        opts.gasLimit,
+      )
+    }
+  }
+
+  let returnValue
+  try {
+    returnValue = bls.msmG2(opts.data)
+  } catch (e: any) {
+    if (opts._debug !== undefined) {
+      opts._debug(`${pName} failed: ${e.message}`)
+    }
+    return EVMErrorResult(e, opts.gasLimit)
+  }
+
+  if (opts._debug !== undefined) {
+    opts._debug(`${pName} return value=${bytesToHex(returnValue)}`)
+  }
+
+  return {
+    executionGasUsed: gasUsed,
+    returnValue,
+  }
+}

package/src/precompiles/0f-bls12-pairing.ts

@@ -0,0 +1,86 @@
+import { bytesToHex } from '@feelyourprotocol/util'
+
+import { EVMError } from '../errors.ts'
+import type { EVM } from '../evm.ts'
+import { EVMErrorResult, OOGResult } from '../evm.ts'
+
+import { leading16ZeroBytesCheck } from './bls12_381/index.ts'
+import { getPrecompileName } from './index.ts'
+import { gasLimitCheck, moduloLengthCheck } from './util.ts'
+
+import type { ExecResult } from '../types.ts'
+import type { PrecompileInput } from './types.ts'
+
+export async function precompile0f(opts: PrecompileInput): Promise<ExecResult> {
+  const pName = getPrecompileName('11')
+  const bls = (opts._EVM as EVM)['_bls']!
+
+  const baseGas = opts.common.param('bls12381PairingBaseGas')
+
+  // TODO: confirm that this is not a thing for the other precompiles
+  if (opts.data.length === 0) {
+    if (opts._debug !== undefined) {
+      opts._debug(`${pName} failed: Empty input`)
+    }
+    return EVMErrorResult(
+      new EVMError(EVMError.errorMessages.BLS_12_381_INPUT_EMPTY),
+      opts.gasLimit,
+    )
+  }
+
+  const gasUsedPerPair = opts.common.param('bls12381PairingPerPairGas')
+
+  // TODO: For this precompile it is the only exception that the length check is placed before the
+  // gas check. I will keep it there to not side-change the existing implementation, but we should
+  // check (respectively Jochem can maybe have a word) if this is something intended or not
+  if (!moduloLengthCheck(opts, 384, pName)) {
+    return EVMErrorResult(
+      new EVMError(EVMError.errorMessages.BLS_12_381_INVALID_INPUT_LENGTH),
+      opts.gasLimit,
+    )
+  }
+
+  const gasUsed = baseGas + gasUsedPerPair * BigInt(Math.floor(opts.data.length / 384))
+  if (!gasLimitCheck(opts, gasUsed, pName)) {
+    return OOGResult(opts.gasLimit)
+  }
+
+  // check for mandatory zero bytes
+  const zeroByteRanges = [
+    [0, 16],
+    [64, 80],
+    [128, 144],
+    [192, 208],
+    [256, 272],
+    [320, 336],
+  ]
+  for (let k = 0; k < opts.data.length / 384; k++) {
+    // zero bytes check
+    const pairStart = 384 * k
+    if (!leading16ZeroBytesCheck(opts, zeroByteRanges, pName, pairStart)) {
+      return EVMErrorResult(
+        new EVMError(EVMError.errorMessages.BLS_12_381_POINT_NOT_ON_CURVE),
+        opts.gasLimit,
+      )
+    }
+  }
+
+  let returnValue
+  try {
+    returnValue = bls.pairingCheck(opts.data)
+  } catch (e: any) {
+    if (opts._debug !== undefined) {
+      opts._debug(`${pName} failed: ${e.message}`)
+    }
+    return EVMErrorResult(e, opts.gasLimit)
+  }
+
+  if (opts._debug !== undefined) {
+    opts._debug(`${pName} return value=${bytesToHex(returnValue)}`)
+  }
+
+  return {
+    executionGasUsed: gasUsed,
+    returnValue,
+  }
+}

package/src/precompiles/10-bls12-map-fp-to-g1.ts

@@ -0,0 +1,58 @@
+import { bytesToHex } from '@feelyourprotocol/util'
+
+import { EVMError } from '../errors.ts'
+import type { EVM } from '../evm.ts'
+import { EVMErrorResult, OOGResult } from '../evm.ts'
+
+import { leading16ZeroBytesCheck } from './bls12_381/index.ts'
+import { getPrecompileName } from './index.ts'
+import { equalityLengthCheck, gasLimitCheck } from './util.ts'
+
+import type { ExecResult } from '../types.ts'
+import type { PrecompileInput } from './types.ts'
+
+export async function precompile10(opts: PrecompileInput): Promise<ExecResult> {
+  const pName = getPrecompileName('12')
+  const bls = (opts._EVM as EVM)['_bls']!
+
+  // note: the gas used is constant; even if the input is incorrect.
+  const gasUsed = opts.common.param('bls12381MapG1Gas')
+  if (!gasLimitCheck(opts, gasUsed, pName)) {
+    return OOGResult(opts.gasLimit)
+  }
+
+  if (!equalityLengthCheck(opts, 64, pName)) {
+    return EVMErrorResult(
+      new EVMError(EVMError.errorMessages.BLS_12_381_INVALID_INPUT_LENGTH),
+      opts.gasLimit,
+    )
+  }
+
+  // check if some parts of input are zero bytes.
+  const zeroByteRanges = [[0, 16]]
+  if (!leading16ZeroBytesCheck(opts, zeroByteRanges, pName)) {
+    return EVMErrorResult(
+      new EVMError(EVMError.errorMessages.BLS_12_381_POINT_NOT_ON_CURVE),
+      opts.gasLimit,
+    )
+  }
+
+  let returnValue
+  try {
+    returnValue = bls.mapFPtoG1(opts.data)
+  } catch (e: any) {
+    if (opts._debug !== undefined) {
+      opts._debug(`${pName} failed: ${e.message}`)
+    }
+    return EVMErrorResult(e, opts.gasLimit)
+  }
+
+  if (opts._debug !== undefined) {
+    opts._debug(`${pName} return value=${bytesToHex(returnValue)}`)
+  }
+
+  return {
+    executionGasUsed: gasUsed,
+    returnValue,
+  }
+}

package/src/precompiles/100-p256verify.ts

@@ -0,0 +1,152 @@
+import { bytesToBigInt, bytesToHex, setLengthLeft } from '@feelyourprotocol/util'
+import { p256 } from '@noble/curves/nist.js'
+
+import { OOGResult } from '../evm.ts'
+
+import { getPrecompileName } from './index.ts'
+import type { PrecompileInput } from './types.ts'
+import { gasLimitCheck } from './util.ts'
+
+import type { ExecResult } from '../types.ts'
+
+const P256VERIFY_GAS_COST = BigInt(6900)
+const SUCCESS_RETURN = new Uint8Array(32).fill(0).map((_, i) => (i === 31 ? 1 : 0))
+
+// Curve parameters for secp256r1
+const P256_N = BigInt('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551') // Subgroup order
+const P256_P = BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff') // Base field modulus
+const P256_A = BigInt('0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc') // Curve coefficient a
+const P256_B = BigInt('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b') // Curve coefficient b
+
+export function precompile100(opts: PrecompileInput): ExecResult {
+  const pName = getPrecompileName('100')
+  const gasUsed = P256VERIFY_GAS_COST
+
+  if (!gasLimitCheck(opts, gasUsed, pName)) {
+    return OOGResult(opts.gasLimit)
+  }
+
+  const data = opts.data
+
+  // 1. Input length: Input MUST be exactly 160 bytes
+  if (data.length !== 160) {
+    if (opts._debug !== undefined) {
+      opts._debug(`${pName} failed: invalid input length ${data.length}, expected 160`)
+    }
+    return {
+      executionGasUsed: gasUsed,
+      returnValue: new Uint8Array(),
+    }
+  }
+
+  const msgHash = data.subarray(0, 32)
+  const r = data.subarray(32, 64)
+  const s = data.subarray(64, 96)
+  const qx = data.subarray(96, 128)
+  const qy = data.subarray(128, 160)
+
+  const rBigInt = bytesToBigInt(r)
+  const sBigInt = bytesToBigInt(s)
+  const qxBigInt = bytesToBigInt(qx)
+  const qyBigInt = bytesToBigInt(qy)
+
+  // 2. Signature component bounds: Both r and s MUST satisfy 0 < r < n and 0 < s < n
+  if (!(rBigInt > BigInt(0) && rBigInt < P256_N && sBigInt > BigInt(0) && sBigInt < P256_N)) {
+    if (opts._debug !== undefined) {
+      opts._debug(
+        `${pName} failed: signature component out of bounds: r=${bytesToHex(r)}, s=${bytesToHex(s)}`,
+      )
+    }
+    return {
+      executionGasUsed: gasUsed,
+      returnValue: new Uint8Array(),
+    }
+  }
+
+  // 3. Public key bounds: Both qx and qy MUST satisfy 0 ≤ qx < p and 0 ≤ qy < p
+  if (!(qxBigInt >= BigInt(0) && qxBigInt < P256_P && qyBigInt >= BigInt(0) && qyBigInt < P256_P)) {
+    if (opts._debug !== undefined) {
+      opts._debug(
+        `${pName} failed: public key component out of bounds: qx=${bytesToHex(qx)}, qy=${bytesToHex(qy)}`,
+      )
+    }
+    return {
+      executionGasUsed: gasUsed,
+      returnValue: new Uint8Array(),
+    }
+  }
+
+  // 4. Point validity: The point (qx, qy) MUST satisfy the curve equation qy^2 ≡ qx^3 + a*qx + b (mod p)
+  const leftSide = (qyBigInt * qyBigInt) % P256_P
+  const rightSide = (qxBigInt * qxBigInt * qxBigInt + P256_A * qxBigInt + P256_B) % P256_P
+
+  if (leftSide !== rightSide) {
+    if (opts._debug !== undefined) {
+      opts._debug(`${pName} failed: point not on curve`)
+    }
+    return {
+      executionGasUsed: gasUsed,
+      returnValue: new Uint8Array(),
+    }
+  }
+
+  // 5. Point not at infinity: The point (qx, qy) MUST NOT be the point at infinity (represented as (0, 0))
+  if (qxBigInt === BigInt(0) && qyBigInt === BigInt(0)) {
+    if (opts._debug !== undefined) {
+      opts._debug(`${pName} failed: public key is point at infinity`)
+    }
+    return {
+      executionGasUsed: gasUsed,
+      returnValue: new Uint8Array(),
+    }
+  }
+
+  try {
+    // Create public key point
+    const publicKey = p256.Point.fromAffine({
+      x: qxBigInt,
+      y: qyBigInt,
+    })
+
+    // Create signature
+    const rBytes = setLengthLeft(r, 32)
+    const sBytes = setLengthLeft(s, 32)
+    const signatureBytes = new Uint8Array(64)
+    signatureBytes.set(rBytes, 0)
+    signatureBytes.set(sBytes, 32)
+
+    const signature = p256.Signature.fromBytes(signatureBytes).toBytes()
+
+    // Verify signature
+    const isValid = p256.verify(signature, msgHash, publicKey.toBytes(false), {
+      lowS: false,
+      prehash: false,
+    })
+
+    if (isValid) {
+      if (opts._debug !== undefined) {
+        opts._debug(`${pName} succeeded: signature verification passed`)
+      }
+      return {
+        executionGasUsed: gasUsed,
+        returnValue: SUCCESS_RETURN,
+      }
+    } else {
+      if (opts._debug !== undefined) {
+        opts._debug(`${pName} failed: signature verification failed`)
+      }
+      return {
+        executionGasUsed: gasUsed,
+        returnValue: new Uint8Array(),
+      }
+    }
+  } catch (error) {
+    if (opts._debug !== undefined) {
+      opts._debug(`${pName} failed: verification error: ${error}`)
+    }
+    return {
+      executionGasUsed: gasUsed,
+      returnValue: new Uint8Array(),
+    }
+  }
+}

package/src/precompiles/11-bls12-map-fp2-to-g2.ts

@@ -0,0 +1,61 @@
+import { bytesToHex } from '@feelyourprotocol/util'
+
+import { EVMError } from '../errors.ts'
+import type { EVM } from '../evm.ts'
+import { EVMErrorResult, OOGResult } from '../evm.ts'
+
+import { leading16ZeroBytesCheck } from './bls12_381/index.ts'
+import { getPrecompileName } from './index.ts'
+import { equalityLengthCheck, gasLimitCheck } from './util.ts'
+
+import type { ExecResult } from '../types.ts'
+import type { PrecompileInput } from './types.ts'
+
+export async function precompile11(opts: PrecompileInput): Promise<ExecResult> {
+  const pName = getPrecompileName('13')
+  const bls = (opts._EVM as EVM)['_bls']!
+
+  // note: the gas used is constant; even if the input is incorrect.
+  const gasUsed = opts.common.param('bls12381MapG2Gas')
+  if (!gasLimitCheck(opts, gasUsed, pName)) {
+    return OOGResult(opts.gasLimit)
+  }
+
+  if (!equalityLengthCheck(opts, 128, pName)) {
+    return EVMErrorResult(
+      new EVMError(EVMError.errorMessages.BLS_12_381_INVALID_INPUT_LENGTH),
+      opts.gasLimit,
+    )
+  }
+
+  // check if some parts of input are zero bytes.
+  const zeroByteRanges = [
+    [0, 16],
+    [64, 80],
+  ]
+  if (!leading16ZeroBytesCheck(opts, zeroByteRanges, pName)) {
+    return EVMErrorResult(
+      new EVMError(EVMError.errorMessages.BLS_12_381_POINT_NOT_ON_CURVE),
+      opts.gasLimit,
+    )
+  }
+
+  let returnValue
+  try {
+    returnValue = bls.mapFP2toG2(opts.data)
+  } catch (e: any) {
+    if (opts._debug !== undefined) {
+      opts._debug(`${pName} failed: ${e.message}`)
+    }
+    return EVMErrorResult(e, opts.gasLimit)
+  }
+
+  if (opts._debug !== undefined) {
+    opts._debug(`${pName} return value=${bytesToHex(returnValue)}`)
+  }
+
+  return {
+    executionGasUsed: gasUsed,
+    returnValue,
+  }
+}