Describe the bug
Memory::resize grows EVM memory to the 1 MiB cap and only bounds checks. It charges no gas. Every expanding opcode charges only its fixed cost, so Ethereum's quadratic memory term (3*words + words^2/512) is entirely missing. Upstream revm applies it via resize_memory! which calls gas!(interpreter, memory_gas(...)), and that charge was dropped in the port.
To reproduce
Run PUSH2 0xFFE0; PUSH1 0x00; MSTORE.
Expected behavior
About 14,000 gas charged for the memory expansion of roughly 64 KiB, matching Ethereum.
Actual behavior
3 gas (VERYLOW) charged, and roughly 64 KiB is allocated and zeroed for free.
Location
- memory.rs (
resize)
- memory.rs (
MSTORE), and the same pattern for MLOAD, MSTORE8, MCOPY, CODECOPY, CALLDATACOPY, RETURNDATACOPY, KECCAK256, LOG*, RETURN, REVERT, and the CALL/CREATE memory ranges
Impact
Consensus and eth_estimateGas divergence for an Ethereum compatible chain, plus almost free 1 MiB allocations per call frame.
Suggested fix
Charge memory_gas(new_words) - memory_gas(old_words) at each expansion site, as revm does.
Describe the bug
Memory::resizegrows EVM memory to the 1 MiB cap and only bounds checks. It charges no gas. Every expanding opcode charges only its fixed cost, so Ethereum's quadratic memory term (3*words + words^2/512) is entirely missing. Upstreamrevmapplies it viaresize_memory!which callsgas!(interpreter, memory_gas(...)), and that charge was dropped in the port.To reproduce
Run
PUSH2 0xFFE0; PUSH1 0x00; MSTORE.Expected behavior
About 14,000 gas charged for the memory expansion of roughly 64 KiB, matching Ethereum.
Actual behavior
3 gas (
VERYLOW) charged, and roughly 64 KiB is allocated and zeroed for free.Location
resize)MSTORE), and the same pattern forMLOAD,MSTORE8,MCOPY,CODECOPY,CALLDATACOPY,RETURNDATACOPY,KECCAK256,LOG*,RETURN,REVERT, and the CALL/CREATE memory rangesImpact
Consensus and
eth_estimateGasdivergence for an Ethereum compatible chain, plus almost free 1 MiB allocations per call frame.Suggested fix
Charge
memory_gas(new_words) - memory_gas(old_words)at each expansion site, asrevmdoes.