Merge branch 'develop' into feat/cancun

.github/workflows/docker_build.yml

@@ -0,0 +1,35 @@
+name: Docker Build & Run
+
+on:
+  push:
+    branches: [develop, main]
+  pull_request:
+    branches:
+      - "**"
+  workflow_dispatch:
+    branches:
+      - "**"
+
+jobs:
+  docker:
+    name: Build and run leader and worker docker images for regression check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build leader docker container
+        run: |
+          docker build --progress plain -t leader:${{ github.ref_name }} -f leader.Dockerfile .
+
+      - name: Run leader docker container
+        run: |
+          docker run --rm leader:${{ github.ref_name }} --help
+
+      - name: Build worker docker container
+        run: |
+          docker build --progress plain -t worker:${{ github.ref_name }} -f worker.Dockerfile .
+
+      - name: Run worker docker container
+        run: |
+          docker run --rm worker:${{ github.ref_name }} --help

.github/workflows/docker_build_push.yml

@@ -0,0 +1,83 @@
+name: Docker Build & Push
+
+on:
+  push:
+    branches: [develop, main]
+  release:
+    types: [created]
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME_LEADER: ${{ github.repository }}-leader
+  IMAGE_NAME_WORKER: ${{ github.repository }}-worker
+
+jobs:
+  docker:
+    name: Build and push leader and worker docker images to GitHub Container Registry
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Leader Docker
+        id: meta_leader
+        uses: docker/metadata-action@v5
+        with:
+          images: | 
+            name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LEADER }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Push to GitHub Container Registry - Leader
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          file: ./leader.Dockerfile
+          push: true
+          # platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta_leader.outputs.tags }}
+          labels: ${{ steps.meta_leader.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Extract metadata (tags, labels) for Worker Docker
+        id: meta_worker
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME_WORKER }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Push to GitHub Container Registry - Worker
+        uses: docker/build-push-action@v3
+        with:
+          context: .
+          file: ./worker.Dockerfile
+          push: true
+          # platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta_worker.outputs.tags }}
+          labels: ${{ steps.meta_worker.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

Cargo.toml

@@ -101,6 +101,7 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 uint = "0.9.5"
 url = "2.5.2"
+lru = "0.12.3"
 
 # zero-bin related dependencies
 ops = { path = "zero_bin/ops" }

evm_arithmetization/src/cpu/kernel/asm/curve/secp256k1/ecrecover.asm

@@ -175,6 +175,10 @@ pubkey_to_addr:
     PUSH @SECP_SCALAR
 %endmacro
 
+%macro secp_scalar_half
+    PUSH @SECP_SCALAR_HALF
+%endmacro
+
 // Return u256::MAX which is used to indicate the input was invalid.
 %macro ecrecover_invalid_input
     // stack: retdest

evm_arithmetization/src/cpu/kernel/asm/transactions/common_decoding.asm

@@ -216,6 +216,14 @@ decode_and_store_blob_versioned_hashes_finish:
     // stack: rlp_addr
     %decode_rlp_scalar
     %stack (rlp_addr, s) -> (s, rlp_addr)
+
+    // EIP-2: Check that s is within valid range.
+    DUP1
+    %secp_scalar_half
+    // stack: ceil(N/2), s, s, rlp_addr
+    %assert_gt
+
+    // stack: s, rlp_addr
     %mstore_txn_field(@TXN_FIELD_S)
     // stack: rlp_addr
 %endmacro

evm_arithmetization/src/cpu/kernel/constants/mod.rs

@@ -155,7 +155,7 @@ const HASH_CONSTANTS: [(&str, [u8; 32]); 2] = [
     ),
 ];
 
-const EC_CONSTANTS: [(&str, [u8; 32]); 24] = [
+const EC_CONSTANTS: [(&str, [u8; 32]); 25] = [
     (
         "U256_MAX",
         hex!("ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"),
@@ -230,6 +230,11 @@ const EC_CONSTANTS: [(&str, [u8; 32]); 24] = [
         "SECP_SCALAR",
         hex!("fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141"),
     ),
+    (
+        "SECP_SCALAR_HALF",
+        // Corresponds to `ceil(SECP_SCALAR / 2)`.
+        hex!("7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a1"),
+    ),
     (
         "SECP_GLV_BETA",
         hex!("7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),

evm_arithmetization/src/cpu/kernel/tests/transaction_parsing/parse_type_0_txn.rs

@@ -72,3 +72,25 @@ fn process_type_0_txn() -> Result<()> {
 
     Ok(())
 }
+
+#[test]
+fn process_type_0_txn_invalid_sig() -> Result<()> {
+    let process_type_0_txn = KERNEL.global_labels["process_type_0_txn"];
+
+    let retaddr = 0xDEADBEEFu32.into();
+    const INITIAL_TXN_RLP_ADDR: usize = Segment::RlpRaw as usize + 1;
+    let mut interpreter: Interpreter<F> = Interpreter::new(
+        process_type_0_txn,
+        vec![retaddr, INITIAL_TXN_RLP_ADDR.into()],
+    );
+
+    // Same transaction as `process_type_0_txn()`, with the exception that the `s`
+    // component in the signature is flipped (i.e. `s' = N - s`, where `N` is the
+    // order of the SECP256k1 prime subgroup).
+    interpreter.extend_memory_segment_bytes(Segment::RlpRaw, hex!("f861050a8255f0940000000000000000000000000000000000000000648242421ca07c5c61ed975ebd286f6b027b8c504842e50a47d318e1e801719dd744fe93e6c6a0e184aee64a822ab1e8a00d0faa36e0c408f99e2ca41c87ec8b557e9be8f0949f").to_vec());
+
+    let result = interpreter.run();
+    assert!(result.is_err());
+
+    Ok(())
+}