Skip to content

Fix issue with detection of RIP7212 precompile #5620

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 17 commits into from
Apr 3, 2025

Conversation

Amxx
Copy link
Collaborator

@Amxx Amxx commented Apr 2, 2025

Fixes #5619

PR Checklist

  • Tests
  • Documentation
  • Changeset entry (run npx changeset add)

Copy link

changeset-bot bot commented Apr 2, 2025

🦋 Changeset detected

Latest commit: f640dca

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
openzeppelin-solidity Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Copy link

socket-security bot commented Apr 2, 2025

New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/[email protected]2.22.7 Transitive: eval, unsafe +251 201 MB kanej

View full report↗︎

@Amxx Amxx requested a review from ernestognw April 2, 2025 14:18
arr00
arr00 previously approved these changes Apr 2, 2025
Comment on lines 126 to 128
let success := staticcall(gas(), 0x100, ptr, 0xa0, 0x00, 0x20)
isValid := and(success, and(eq(returndatasize(), 0x20), eq(mload(0), 1)))
}
Copy link
Contributor

@Vectorized Vectorized Apr 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a little paranoid on the gas estimation part.

// The `invalid` upon `staticcall` failure is solely for gas estimation.
// When given sufficient gas, the precompile will not revert.
if iszero(staticcall(gas(), 0x100, m, 0xa0, 0x00, 0x00)) { invalid() }
// The precompile will only return `uint256(1)` if and only if the signature is valid.
// As per latest spec, verified against the op-geth implementation:
// See: https://github.com/ethereum-optimism/op-geth/blob/02dfe8692a3c606dbabd83c1ced2037aab9753d7/core/vm/contracts.go#L1342
// Otherwise, it will always return no data.
isValid := iszero(iszero(returndatasize()))

More conservative (in case the spec and implementations are somehow edited again):

// The `invalid` upon `staticcall` failure is solely for gas estimation.
// When given sufficient gas, the precompile will not revert.
mstore(0x00, 0) // Zeroize the slot for the returndata.
if iszero(staticcall(gas(), 0x100, m, 0xa0, 0x00, 0x20)) { invalid() }
// The precompile will only return `uint256(1)` if and only if the signature is valid.
// As per latest spec, verified against the op-geth implementation:
// See: https://github.com/ethereum-optimism/op-geth/blob/02dfe8692a3c606dbabd83c1ced2037aab9753d7/core/vm/contracts.go#L1342
// Otherwise, it will always return no data.
isValid := mload(0x00)

Copy link
Collaborator Author

@Amxx Amxx Apr 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to avoid the invalid() here. I think its better if the function returns false instead of reverting if we are in a strange situation where the precompile acts eraticly. But again, if the precompile revert ... maybe something very fishy is going on and its ok to fail.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also, aren't ifs quite expensive compared to basic and operations?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we worry about the precompile returning something that is neither 0 nor 1 ?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we don't need to worry about it.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like @Vectorized's idea since the library is designed to work with RIP-7212 so it should be safe to assume that all implementations would be compliant (i.e. returning empty bytes on failed verification). We can add a note so that developers can just override the function and manually check the returndata, but I'm afraid the consequences of missing such note would be pretty bad.

Copy link
Member

@ernestognw ernestognw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving because I agree with the functionality. However, I'm leaving another nit. Feel free to merge if you don't agree @Amxx.

arr00
arr00 previously approved these changes Apr 2, 2025
ernestognw
ernestognw previously approved these changes Apr 3, 2025
@Amxx Amxx enabled auto-merge (squash) April 3, 2025 07:23
@Amxx Amxx requested review from arr00 and ernestognw April 3, 2025 07:23
@Amxx Amxx merged commit aa29301 into OpenZeppelin:master Apr 3, 2025
17 checks passed
@Amxx Amxx deleted the bugfix/rip7212-return-empty branch April 3, 2025 16:29
Amxx added a commit that referenced this pull request Apr 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

P256.verifyNative reverts when signature is invalid
4 participants