EIP-7823: Set upper bounds for MODEXP

EIPs EIPs core
1

Discussion topic for EIP-7823

Update Log

External Reviews

None as of 2024-11-11.

Outstanding Issues

  • Need to run a full sync to extract edge cases / uses outside the limits. Done.
  • Verify that no reasonable use case exists outside of the limits.
1 Like
2

We set the exactly same limit on the zkEVM: zkevm-rom/main/precompiled/pre-modexp.zkasm at v9.0.0-rc.2-fork.13 · 0xPolygonHermez/zkevm-rom · GitHub
More context on why we decided to set up that limit is explained in this issue: Computing the maximum ModExp input length · Issue #419 · 0xPolygonHermez/zkevm-rom · GitHub

This EIP will also make life easier to Rollups in order to be fully compliant with Ethereum.

2 Likes
3

Thank you @krlosmata, that is very useful feedback. Will incorporate some of this into the EIP.

1 Like
4

The following is an analysis of MODEXP precompile calls, the dataset was collected by tracing calls to the MODEXP precompile since ~Byzantium Hard Fork until Block 21550926 (January 4th, 2025), the analysis contains the different input sizes used in all MODEXP calls and its frequency, being size 32 the most commonly used base/exponent/mod size, and 512 the maximum observed size (with the exception of a couple of transactions using size 513 for baseLen):

1 Like
5

Could this analysis be updated to explicitly define if these are bits or bytes? Even though the max bits/bytes reported seem to be 513 (2 entries in base_len), it is not clear to me if those are bits or bytes. (The 513 would fit in the EIP requirement of < 8192 bits / 1024 bytes, but would be nice to know by the analysis if the current “max” usage is 513 bits or bytes (likely: bytes?))

6

If any of these inputs are larger than the limit, the precompile execution stops, returns an error, and consumes all gas.

A quick note that current precompiles do not return any errors. They leave empty returndata which indicates there has been an error.

7

Yes, the values in the analysis results are given in bytes. I have updated the document to make it explicit. Thanks!.

2 Likes
8

I’m interested in two more restrictions:

  1. How often the modulus is even? If is, how often is it a power of 2? If this is not often used I’d restrict the modulus to odd or power-of-two values.
  2. How often the base >= modulus? Requiring base < modulus saves us from complicated initial base reduction.
9

Updated the EIP with the result of analysis.

10

Note: Scroll sets an upper bound of 32 bytes.