ethereum / ethereum/execution-specs

Fix unhandled modexp U256 overflow for forks before Osaka

Open
#1,465 2 comments 0 reactions 1 assignee Claimed by @spencer-tb View on GitHub
A-spec-specs C-bug E-easy P-medium stale
Dominant language
Python
Stars
1.2k
Forks
505
Avg merge
2d 14h
Merged PRs (30d)
116

Description

## Description

The MODEXP precompile (EIP-198) tests crash with an unhandled OverflowError when processing inputs with extremely large `base_length` values that cause U256 overflow during pointer arithmetic. This affects all forks from Byzantium through Prague, but not Osaka.

The specific tests for this can be found within `tests/eest/byzantium/eip198_modexp_precompile/test_modexp.py` post Weld. Specifically `immunefi-38958-by-omik-overflow` and `max-base-length-overflow-out-of-gas` cases.

## Solution (potential)

Check for overflows before handling pointer arithmetic within the `modexp()` function via `src/ethereum/byzantium/vm/precompiled_contracts/modexp.py`, onwards for each fork up to Osaka.

```python
# Check for overflow
if base_length > U256.MAX_VALUE - U256(96):
evm.output = Bytes()
return

exp_start = U256(96) + base_length
```

Related PR: https://github.com/ethereum/execution-spec-tests/pull/1096

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.