Skip to content
This repository was archived by the owner on Apr 18, 2025. It is now read-only.

Fix the bugs in RLP/Tx/PI circuit which are reported by Zellic & KALOS auditors #572

Merged
merged 23 commits into from
Aug 16, 2023

Conversation

kunxian-xia
Copy link

@kunxian-xia kunxian-xia commented Jun 28, 2023

Description

This PR aims to fix all the bugs found by Zellic auditors in RLP & Tx & PI circuits.

Issue Link

The bug report can be found here.

Type of change

  • Bug fix (non-breaking change which fixes an issue)

Contents

  1. finding 3: Fix finding 3 #575
  2. finding 4: Fix zellic finding 4 #576
  3. finding 5: Fix zellic finding 5 #584
  4. finding 6: Fix zellic finding 6 #586
  5. finding 7: Fix Zellic & Kalos finding 7 #625
  6. finding 10: Fix finding 10 #578
  7. finding 11: Fix finding 11 : use length for rlc in rlp table #719
  8. finding 13: Fix finding 13 #579
  9. finding 14: Fix zellic finding 14 #580
  10. finding 17: Fix finding 17 #602
  11. tx & pi: Fix the bugs in Tx & PI circuits reported by Zellic & KALOS auditors #612

@kunxian-xia kunxian-xia marked this pull request as draft June 28, 2023 15:08
@icemelon
Copy link
Member

Could you keep 1 PR per finding?

@kunxian-xia
Copy link
Author

What about 1 commit per finding? Because each fix can be done within about 10 lines of codes.

@icemelon
Copy link
Member

No, still better to have one PR per finding. after merged, it'll become 1 commit per fix

@kunxian-xia kunxian-xia force-pushed the fix/rlp-audit-wave1 branch from ba5f76a to 8de5a6d Compare July 3, 2023 12:20
@kunxian-xia kunxian-xia requested a review from roynalnaruto July 4, 2023 01:50
kunxian-xia and others added 5 commits July 6, 2023 10:17
* fix finding 3 (#575)

* fix finding 4

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
* fix finding 3 (#575)

* fix finding 10
* fix finding 3 (#575)

* fix finding 13
* fix finding 3 (#575)

* fix finding 14
@kunxian-xia kunxian-xia marked this pull request as ready for review July 6, 2023 02:54
* fix finding 3 (#575)

* fix finding 5

* refine comments

* fmt
@kunxian-xia kunxian-xia changed the title Fix the bugs in RLP circuit which are reported by Zellic auditors Fix the bugs in RLP circuit which are reported by Zellic & KALOS auditors Jul 10, 2023
@lispc
Copy link

lispc commented Aug 14, 2023

ComparatorChip needs a u8 column now in develop. Codes here can be refactored

impl<F: Field, const N_BYTES: usize> ComparatorChip<F, N_BYTES> {
    /// Configure the comparator chip. Returns the config.
    pub fn configure(
        meta: &mut ConstraintSystem<F>,
        q_enable: impl FnOnce(&mut VirtualCells<F>) -> Expression<F> + Clone,
        lhs: impl FnOnce(&mut VirtualCells<F>) -> Expression<F> + Clone,
        rhs: impl FnOnce(&mut VirtualCells<F>) -> Expression<F> + Clone,
        u8_table: TableColumn,
    ) -> ComparatorConfig<F, N_BYTES> {

* fix: use tag_bytes_rlc and tag_length to copy tag's bytes around

* fix lookup input for Len & RLC & GasCost fields in tx circuit

* refactor

* fix

* refactor

* fix col phase issue
@kunxian-xia kunxian-xia changed the base branch from develop to fix/allow-skip-l1msg-p2 August 16, 2023 06:07
Base automatically changed from fix/allow-skip-l1msg-p2 to develop August 16, 2023 07:06
…612)

* lookup chain_id to RLP table

* fix finding 22 (#614)

* fix finding 21 (#613)

* fix finding 23 (#618)

* fix finding 26 (#622)

* fix finding 28 (#624)

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* fix finding 29 (#623)

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* enforce is_final is true at the last row and fix RLC related vul (#735)

* Fix finding 30  (#733)

* enforce all txs in a block are included in the tx table

* clippy

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* Fix Zellic / Kalos finding25 (#619)

* fix finding 25

* add comment

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* fix conflicts

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
Co-authored-by: Zhang Zhuo <mycinbrin@gmail.com>
@kunxian-xia kunxian-xia changed the title Fix the bugs in RLP circuit which are reported by Zellic & KALOS auditors Fix the bugs in RLP/Tx/PI circuit which are reported by Zellic & KALOS auditors Aug 16, 2023
@lispc
Copy link

lispc commented Aug 16, 2023

great. we can mark the asana board to mark them all done

Copy link

@lispc lispc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let us merge it after CI passes

@lispc lispc merged commit 2e42287 into develop Aug 16, 2023
@lispc lispc deleted the fix/rlp-audit-wave1 branch August 16, 2023 10:18
darth-cy pushed a commit that referenced this pull request Aug 16, 2023
…S auditors (#572)

* fix finding 3 (#575)

* Fix zellic finding 4 (#576)

* fix finding 3 (#575)

* fix finding 4

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* add range check on diffs (#586)

* Fix finding 10 (#578)

* fix finding 3 (#575)

* fix finding 10

* Fix finding 13 (#579)

* fix finding 3 (#575)

* fix finding 13

* Fix zellic finding 14 (#580)

* fix finding 3 (#575)

* fix finding 14

* Fix zellic finding 5 (#584)

* fix finding 3 (#575)

* fix finding 5

* refine comments

* fmt

* Fix finding 17 (#602)

* add q_last

* fix

* add more diff range check

* fix finding 7 (#625)

* tx_id = 1 when sm starts

* Fix finding 11 : use length for rlc in rlp table (#719)

* fix: use tag_bytes_rlc and tag_length to copy tag's bytes around

* fix lookup input for Len & RLC & GasCost fields in tx circuit

* refactor

* fix

* refactor

* fix col phase issue

* refactor bytes_rlc type

* Fix the bugs in Tx & PI circuits reported by Zellic & KALOS auditors (#612)

* lookup chain_id to RLP table

* fix finding 22 (#614)

* fix finding 21 (#613)

* fix finding 23 (#618)

* fix finding 26 (#622)

* fix finding 28 (#624)

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* fix finding 29 (#623)

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* enforce is_final is true at the last row and fix RLC related vul (#735)

* Fix finding 30  (#733)

* enforce all txs in a block are included in the tx table

* clippy

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* Fix Zellic / Kalos finding25 (#619)

* fix finding 25

* add comment

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* fix conflicts

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
Co-authored-by: Zhang Zhuo <mycinbrin@gmail.com>

* use q_first instead

* fmt

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
Co-authored-by: Zhang Zhuo <mycinbrin@gmail.com>
lispc added a commit that referenced this pull request Aug 17, 2023
* add row counting interface for keccak

* add class level capacity calculator for keccak

* remove f capacity from core

* remove capacity calculator in aggregator util

* remove unnecessary imports

* replace max keccak round in core

* replace reference for max keccak

* remove unnecessary keccak imports and constants

* remove max keccak constant

* remove constants in hash cell parsing

* remove constant column sanity check

* add state column usage log

* adjust input bytes column

* add long column padding

* correct fmt

* fix fmt

* minor fixes

* fix

* Fix: allow skipping of L1Msg tx part 2 (calculate num_all_txs in tx circuit) (#778)

* calculate num_l1_msgs and num_l2_txs in tx circuit

* fix

* fmt and clippy

* fix: non-last tx requires next is calldata

* add NumAllTxs in block table and copy it from pi to block table

* add lookup for NumAllTxs in tx circuit

* clippy

* add block num diff check to avoid two real block have same num

* clippy

* address comments

* Fix the bugs in RLP/Tx/PI circuit which are reported by Zellic & KALOS auditors (#572)

* fix finding 3 (#575)

* Fix zellic finding 4 (#576)

* fix finding 3 (#575)

* fix finding 4

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* add range check on diffs (#586)

* Fix finding 10 (#578)

* fix finding 3 (#575)

* fix finding 10

* Fix finding 13 (#579)

* fix finding 3 (#575)

* fix finding 13

* Fix zellic finding 14 (#580)

* fix finding 3 (#575)

* fix finding 14

* Fix zellic finding 5 (#584)

* fix finding 3 (#575)

* fix finding 5

* refine comments

* fmt

* Fix finding 17 (#602)

* add q_last

* fix

* add more diff range check

* fix finding 7 (#625)

* tx_id = 1 when sm starts

* Fix finding 11 : use length for rlc in rlp table (#719)

* fix: use tag_bytes_rlc and tag_length to copy tag's bytes around

* fix lookup input for Len & RLC & GasCost fields in tx circuit

* refactor

* fix

* refactor

* fix col phase issue

* refactor bytes_rlc type

* Fix the bugs in Tx & PI circuits reported by Zellic & KALOS auditors (#612)

* lookup chain_id to RLP table

* fix finding 22 (#614)

* fix finding 21 (#613)

* fix finding 23 (#618)

* fix finding 26 (#622)

* fix finding 28 (#624)

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* fix finding 29 (#623)

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* enforce is_final is true at the last row and fix RLC related vul (#735)

* Fix finding 30  (#733)

* enforce all txs in a block are included in the tx table

* clippy

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* Fix Zellic / Kalos finding25 (#619)

* fix finding 25

* add comment

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* fix conflicts

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
Co-authored-by: Zhang Zhuo <mycinbrin@gmail.com>

* use q_first instead

* fmt

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
Co-authored-by: Zhang Zhuo <mycinbrin@gmail.com>

* add pi comments

* rename preimage col idx

* add keccak rows check

* rename input bytes col finder fn

* modify keccak row env constaint

* modify keccak row env constaint

* add named constant setup vars

* modify keccak row check

* clippy advised

* add comments on chunk hash

* fmt

* avoid constant lookup table

* avoid repetitive computation of input_bytes_col_idx

---------

Co-authored-by: Zhuo Zhang <mycinbrin@gmail.com>
Co-authored-by: xkx <xiakunxian130@gmail.com>
Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants