Skip to content
This repository was archived by the owner on Apr 18, 2025. It is now read-only.

Fix the bugs in Tx & PI circuits reported by Zellic & KALOS auditors #612

Merged
merged 14 commits into from
Aug 16, 2023

Conversation

kunxian-xia
Copy link

@kunxian-xia kunxian-xia commented Jul 11, 2023

@kunxian-xia kunxian-xia changed the title Fix the bugs in Tx circuit reported by Zellic & KALOS auditors Fix the bugs in Tx & PI circuits reported by Zellic & KALOS auditors Jul 12, 2023
kunxian-xia and others added 7 commits August 9, 2023 17:36
Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
* enforce all txs in a block are included in the tx table

* clippy

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
* fix finding 25

* add comment

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
);

// last non-padding tx must have tx_id == cum_num_txs
meta.create_gate(
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

will these 2 gates still ok since we need to handle the l1 tx queue index design now?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, the l1 queue index is only relevant to num_all_txs.

@lispc
Copy link

lispc commented Aug 14, 2023

2 changes needs to be considered carefully

(1) NumTx: the complex l1 tx num mechanism
(2) TxFieldTag::TxType: recently to handle l1 tx, we added this to tx table. This may affect some hardcode offset (if any)

@kunxian-xia kunxian-xia changed the base branch from develop to fix/rlp-audit-wave1 August 16, 2023 06:08
@kunxian-xia kunxian-xia changed the base branch from fix/rlp-audit-wave1 to develop August 16, 2023 06:10
@kunxian-xia kunxian-xia changed the base branch from develop to fix/rlp-audit-wave1 August 16, 2023 06:37
@kunxian-xia kunxian-xia merged commit 7cdca82 into fix/rlp-audit-wave1 Aug 16, 2023
@kunxian-xia kunxian-xia deleted the fix/tx-audit-wave branch August 16, 2023 08:36
lispc added a commit that referenced this pull request Aug 16, 2023
…S auditors (#572)

* fix finding 3 (#575)

* Fix zellic finding 4 (#576)

* fix finding 3 (#575)

* fix finding 4

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* add range check on diffs (#586)

* Fix finding 10 (#578)

* fix finding 3 (#575)

* fix finding 10

* Fix finding 13 (#579)

* fix finding 3 (#575)

* fix finding 13

* Fix zellic finding 14 (#580)

* fix finding 3 (#575)

* fix finding 14

* Fix zellic finding 5 (#584)

* fix finding 3 (#575)

* fix finding 5

* refine comments

* fmt

* Fix finding 17 (#602)

* add q_last

* fix

* add more diff range check

* fix finding 7 (#625)

* tx_id = 1 when sm starts

* Fix finding 11 : use length for rlc in rlp table (#719)

* fix: use tag_bytes_rlc and tag_length to copy tag's bytes around

* fix lookup input for Len & RLC & GasCost fields in tx circuit

* refactor

* fix

* refactor

* fix col phase issue

* refactor bytes_rlc type

* Fix the bugs in Tx & PI circuits reported by Zellic & KALOS auditors (#612)

* lookup chain_id to RLP table

* fix finding 22 (#614)

* fix finding 21 (#613)

* fix finding 23 (#618)

* fix finding 26 (#622)

* fix finding 28 (#624)

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* fix finding 29 (#623)

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* enforce is_final is true at the last row and fix RLC related vul (#735)

* Fix finding 30  (#733)

* enforce all txs in a block are included in the tx table

* clippy

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* Fix Zellic / Kalos finding25 (#619)

* fix finding 25

* add comment

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* fix conflicts

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
Co-authored-by: Zhang Zhuo <mycinbrin@gmail.com>

* use q_first instead

* fmt

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
Co-authored-by: Zhang Zhuo <mycinbrin@gmail.com>
darth-cy pushed a commit that referenced this pull request Aug 16, 2023
…S auditors (#572)

* fix finding 3 (#575)

* Fix zellic finding 4 (#576)

* fix finding 3 (#575)

* fix finding 4

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* add range check on diffs (#586)

* Fix finding 10 (#578)

* fix finding 3 (#575)

* fix finding 10

* Fix finding 13 (#579)

* fix finding 3 (#575)

* fix finding 13

* Fix zellic finding 14 (#580)

* fix finding 3 (#575)

* fix finding 14

* Fix zellic finding 5 (#584)

* fix finding 3 (#575)

* fix finding 5

* refine comments

* fmt

* Fix finding 17 (#602)

* add q_last

* fix

* add more diff range check

* fix finding 7 (#625)

* tx_id = 1 when sm starts

* Fix finding 11 : use length for rlc in rlp table (#719)

* fix: use tag_bytes_rlc and tag_length to copy tag's bytes around

* fix lookup input for Len & RLC & GasCost fields in tx circuit

* refactor

* fix

* refactor

* fix col phase issue

* refactor bytes_rlc type

* Fix the bugs in Tx & PI circuits reported by Zellic & KALOS auditors (#612)

* lookup chain_id to RLP table

* fix finding 22 (#614)

* fix finding 21 (#613)

* fix finding 23 (#618)

* fix finding 26 (#622)

* fix finding 28 (#624)

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* fix finding 29 (#623)

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* enforce is_final is true at the last row and fix RLC related vul (#735)

* Fix finding 30  (#733)

* enforce all txs in a block are included in the tx table

* clippy

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* Fix Zellic / Kalos finding25 (#619)

* fix finding 25

* add comment

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* fix conflicts

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
Co-authored-by: Zhang Zhuo <mycinbrin@gmail.com>

* use q_first instead

* fmt

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
Co-authored-by: Zhang Zhuo <mycinbrin@gmail.com>
lispc added a commit that referenced this pull request Aug 17, 2023
* add row counting interface for keccak

* add class level capacity calculator for keccak

* remove f capacity from core

* remove capacity calculator in aggregator util

* remove unnecessary imports

* replace max keccak round in core

* replace reference for max keccak

* remove unnecessary keccak imports and constants

* remove max keccak constant

* remove constants in hash cell parsing

* remove constant column sanity check

* add state column usage log

* adjust input bytes column

* add long column padding

* correct fmt

* fix fmt

* minor fixes

* fix

* Fix: allow skipping of L1Msg tx part 2 (calculate num_all_txs in tx circuit) (#778)

* calculate num_l1_msgs and num_l2_txs in tx circuit

* fix

* fmt and clippy

* fix: non-last tx requires next is calldata

* add NumAllTxs in block table and copy it from pi to block table

* add lookup for NumAllTxs in tx circuit

* clippy

* add block num diff check to avoid two real block have same num

* clippy

* address comments

* Fix the bugs in RLP/Tx/PI circuit which are reported by Zellic & KALOS auditors (#572)

* fix finding 3 (#575)

* Fix zellic finding 4 (#576)

* fix finding 3 (#575)

* fix finding 4

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* add range check on diffs (#586)

* Fix finding 10 (#578)

* fix finding 3 (#575)

* fix finding 10

* Fix finding 13 (#579)

* fix finding 3 (#575)

* fix finding 13

* Fix zellic finding 14 (#580)

* fix finding 3 (#575)

* fix finding 14

* Fix zellic finding 5 (#584)

* fix finding 3 (#575)

* fix finding 5

* refine comments

* fmt

* Fix finding 17 (#602)

* add q_last

* fix

* add more diff range check

* fix finding 7 (#625)

* tx_id = 1 when sm starts

* Fix finding 11 : use length for rlc in rlp table (#719)

* fix: use tag_bytes_rlc and tag_length to copy tag's bytes around

* fix lookup input for Len & RLC & GasCost fields in tx circuit

* refactor

* fix

* refactor

* fix col phase issue

* refactor bytes_rlc type

* Fix the bugs in Tx & PI circuits reported by Zellic & KALOS auditors (#612)

* lookup chain_id to RLP table

* fix finding 22 (#614)

* fix finding 21 (#613)

* fix finding 23 (#618)

* fix finding 26 (#622)

* fix finding 28 (#624)

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* fix finding 29 (#623)

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* enforce is_final is true at the last row and fix RLC related vul (#735)

* Fix finding 30  (#733)

* enforce all txs in a block are included in the tx table

* clippy

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* Fix Zellic / Kalos finding25 (#619)

* fix finding 25

* add comment

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>

* fix conflicts

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
Co-authored-by: Zhang Zhuo <mycinbrin@gmail.com>

* use q_first instead

* fmt

---------

Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
Co-authored-by: Zhang Zhuo <mycinbrin@gmail.com>

* add pi comments

* rename preimage col idx

* add keccak rows check

* rename input bytes col finder fn

* modify keccak row env constaint

* modify keccak row env constaint

* add named constant setup vars

* modify keccak row check

* clippy advised

* add comments on chunk hash

* fmt

* avoid constant lookup table

* avoid repetitive computation of input_bytes_col_idx

---------

Co-authored-by: Zhuo Zhang <mycinbrin@gmail.com>
Co-authored-by: xkx <xiakunxian130@gmail.com>
Co-authored-by: Rohit Narurkar <rohit.narurkar@protonmail.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants