fix(kona): graceful OOG on precompile gas overspend in fpvm provider#21582
Open
ajsutton wants to merge 1 commit into
Open
fix(kona): graceful OOG on precompile gas overspend in fpvm provider#21582ajsutton wants to merge 1 commit into
ajsutton wants to merge 1 commit into
Conversation
The fpvm precompile provider's hand-rolled `run` panicked via `assert!(underflow, "Gas underflow is not possible")` if a precompile reported `gas_used > gas_limit`. revm v40's `EthPrecompiles::run` (which op-revm inherits by delegation) instead gracefully out-of-gases this case (`spend_all` + `PrecompileOOG`). The branch is unreachable for the registered precompile set — each checks cost <= gas_limit before returning `Ok` — so there is no consensus impact. But matching upstream keeps the FPVM and op-reth aligned by construction rather than by audit, and removes a foot-gun where a future precompile that omits the check would halt the fault-proof program instead of deterministically OOG-ing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The fpvm precompile provider's hand-rolled
runpanicked viaassert!(underflow, "Gas underflow is not possible")if a precompile reportedgas_used > gas_limit. Align it with revm v40'sEthPrecompiles::run(which op-revm inherits by delegation): gracefully out-of-gas the call (spend_all+PrecompileOOG) instead of panicking.Why
Surfaced while reviewing the reth v2.3.0 / revm v40 bump (#21348). revm v40 added defensive handling for a precompile overspending its gas limit; op-revm picks it up automatically by delegation, but kona reimplements
runand still asserts.The branch is unreachable for the current registered precompile set — every accelerated and inner precompile checks
cost <= gas_limitbefore returningOk— so there is no consensus or fault-proof divergence today. This is hardening: it keeps the FPVM and op-reth aligned by construction rather than by audit, and removes a foot-gun where a future precompile that omits the check would halt the fault-proof program instead of deterministically OOG-ing.Test
test_run_overspending_precompile_oogs_without_panickingregisters a mock accelerated precompile reportinggas_used = gas_limit + 1and assertsrunreturnsPrecompileOOGwith all gas spent. Verified red against the oldassert!(panics at provider.rs:148) and green with the fix.