Skip to content

[pallet-revive] EVM memory expansion gas is never charged #12640

Description

@Nathy-bajo

Describe the bug

Memory::resize grows EVM memory to the 1 MiB cap and only bounds checks. It charges no gas. Every expanding opcode charges only its fixed cost, so Ethereum's quadratic memory term (3*words + words^2/512) is entirely missing. Upstream revm applies it via resize_memory! which calls gas!(interpreter, memory_gas(...)), and that charge was dropped in the port.

To reproduce

Run PUSH2 0xFFE0; PUSH1 0x00; MSTORE.

Expected behavior

About 14,000 gas charged for the memory expansion of roughly 64 KiB, matching Ethereum.

Actual behavior

3 gas (VERYLOW) charged, and roughly 64 KiB is allocated and zeroed for free.

Location

  • memory.rs (resize)
  • memory.rs (MSTORE), and the same pattern for MLOAD, MSTORE8, MCOPY, CODECOPY, CALLDATACOPY, RETURNDATACOPY, KECCAK256, LOG*, RETURN, REVERT, and the CALL/CREATE memory ranges

Impact

Consensus and eth_estimateGas divergence for an Ethereum compatible chain, plus almost free 1 MiB allocations per call frame.

Suggested fix

Charge memory_gas(new_words) - memory_gas(old_words) at each expansion site, as revm does.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions