Solidity: Computing gas stipend for calls to precompiles could use an underflow guard (post-Byzantium)

[veox]

Has been brought up on /r/ethdev; most relevant to solc is likely this sub-thread.

In short: when preparing for a CALL to a precompile (ecrecover in this case), the compiler generates code that allocates a gas stipend of post_compile_const - GAS, and then doesn't check if the result wrapped around 0 by chance (i.e. post_compile_const < GAS).

@chriseth says that pre-Byzantium, this would fail.

/u/Figs999 links the code block where the computation is done.

[chriseth]

Duplicate of https://github.com/ethereum/solidity/issues/3680 :)

[veox]

X_X

Closing as duplicate.

[chriseth]

Actually this one has much more details :)

[chriseth]

It turns out that this is already correct for byzantium VMs. So if you compile for pre-Tangerine Whistle and run it on pre-Tangerine Whistle, it works fine, if you compile for Tangerine Whistle and run it on Tangerine Whistle it is fine, the only problem is if you compile for pre-Tangerine Whistle and run it on Tangerine Whistle.

What we could do is implement a check if the gas computaiton wraps around, but the cost for that computation would have to be included in the number that is subtracted, so it gets even more messy.

I would just ignore this very specific problem. It is fixed in latest solidity because it defaults to a byzantium VM.

Are there any situations where this could be used to fool users?

@axic what do you think?

[veox]

Somewhat OT:

@axic mentions in https://github.com/ethereum/solidity/pull/2673#issuecomment-319183436:

I think the best solution would be forwarding the maximum gas possible to ecrecover/sha256/ripemd160 and disallowing overriding them.

Is this worth re-considering?..

[chriseth]

@veox this is the case with a post-TangerineWhistle VM.

[axic]

If we can trust that the compiler calculates that value properly, then no matter if it wrapped or not, it will run out of gas. Doesn't it?

[axic]

the only problem is if you compile for pre-Tangerine Whistle and run it on Tangerine Whistle.

If it wraps, then it will be a very large number, which tangerine whistle VMs just truncate to the max available gas, so it should be working?

[chriseth]

Yes, I also think it is fine.

[axic]

We could consider though adding test cases with limited gas supplied to verify these assumptions.