Update EIP-6493: Add RLP to SSZ conversion implementation

Merged by EIP-Bot.

Author: etan-status

EIPS/eip-6493.md

@@ -25,9 +25,9 @@ For each transaction, two perpetual hashes are derived.
 
 For existing [EIP-2718](./eip-2718.md) Recursive-Length Prefix (RLP) transactions, these hashes are based on a linear keccak256 hash across their serialization.
 
-For [Simple Serialize (SSZ)](https://github.com/ethereum/consensus-specs/blob/ef434e87165e9a4c82a99f54ffd4974ae113f732/ssz/simple-serialize.md) transaction types, an alternative signature scheme based on SHA256 hash tree is defined in this EIP.
+For [Simple Serialize (SSZ)](https://github.com/ethereum/consensus-specs/blob/ef434e87165e9a4c82a99f54ffd4974ae113f732/ssz/simple-serialize.md) transaction types, an alternative signature scheme based on SHA256 Merkle trees is defined in this EIP.
 
-Furthermore, the EIP defines a conversion mechanism to achieve a consistent representation across both RLP and SSZ transactions and receipts.
+Furthermore, this EIP defines a conversion mechanism to achieve a consistent representation across both RLP and SSZ transactions and receipts.
 
 ## Specification
 
@@ -67,8 +67,6 @@ Definitions from existing specifications that are used throughout this document
 
 | Name | Value |
 | - | - |
-| [`MAX_BYTES_PER_TRANSACTION`](https://github.com/ethereum/consensus-specs/blob/ef434e87165e9a4c82a99f54ffd4974ae113f732/specs/bellatrix/beacon-chain.md#execution) | `uint64(2**30)` (= 1,073,741,824) |
-| [`MAX_TRANSACTIONS_PER_PAYLOAD`](https://github.com/ethereum/consensus-specs/blob/ef434e87165e9a4c82a99f54ffd4974ae113f732/specs/bellatrix/beacon-chain.md#execution) | `uint64(2**20)` (= 1,048,576) |
 | [`BYTES_PER_LOGS_BLOOM`](https://github.com/ethereum/consensus-specs/blob/ef434e87165e9a4c82a99f54ffd4974ae113f732/specs/bellatrix/beacon-chain.md#execution) | `uint64(2**8)` (= 256) |
 | [`MAX_BLOB_COMMITMENTS_PER_BLOCK`](https://github.com/ethereum/consensus-specs/blob/ef434e87165e9a4c82a99f54ffd4974ae113f732/specs/deneb/beacon-chain.md#execution) | `uint64(2**12)` (= 4,096) |
 
@@ -183,16 +181,60 @@ class SigningData(Container):
     domain: Domain
 
 def compute_ssz_sig_hash(payload: TransactionPayload, chain_id: ChainId) -> Hash32:
-    return Hash32(hash_tree_root(SigningData(
-        object_root=hash_tree_root(payload),
+    return Hash32(SigningData(
+        object_root=payload.hash_tree_root(),
         domain=compute_ssz_transaction_domain(chain_id),
-    )))
+    ).hash_tree_root())
 
 def compute_ssz_tx_hash(tx: SignedTransaction) -> Hash32:
     assert tx.signature.type_ == TRANSACTION_TYPE_SSZ
     return Hash32(tx.hash_tree_root())
 ```
 
+### Transaction validation
+
+As part of validating a `SignedTransaction`, the `from` address MUST be checked for consistency with the `ecdsa_signature`.
+
+```python
+def ecdsa_pack_signature(y_parity: bool,
+                         r: uint256,
+                         s: uint256) -> ByteVector[ECDSA_SIGNATURE_SIZE]:
+    return r.to_bytes(32, 'big') + s.to_bytes(32, 'big') + bytes([0x01 if y_parity else 0x00])
+
+def ecdsa_unpack_signature(signature: ByteVector[ECDSA_SIGNATURE_SIZE]) -> tuple[bool, uint256, uint256]:
+    y_parity = signature[64] != 0
+    r = uint256.from_bytes(signature[0:32], 'big')
+    s = uint256.from_bytes(signature[32:64], 'big')
+    return (y_parity, r, s)
+
+def ecdsa_validate_signature(signature: ByteVector[ECDSA_SIGNATURE_SIZE]):
+    SECP256K1N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
+    assert len(signature) == 65
+    assert signature[64] in (0, 1)
+    _, r, s = ecdsa_unpack_signature(signature)
+    assert 0 < r < SECP256K1N
+    assert 0 < s < SECP256K1N
+
+def ecdsa_recover_from_address(signature: ByteVector[ECDSA_SIGNATURE_SIZE],
+                               sig_hash: Hash32) -> ExecutionAddress:
+    ecdsa = ECDSA()
+    recover_sig = ecdsa.ecdsa_recoverable_deserialize(signature[0:64], signature[64])
+    public_key = PublicKey(ecdsa.ecdsa_recover(sig_hash, recover_sig, raw=True))
+    uncompressed = public_key.serialize(compressed=False)
+    return ExecutionAddress(keccak(uncompressed[1:])[12:])
+
+def validate_transaction(tx: SignedTransaction,
+                         chain_id: ChainId):
+    check_transaction_supported(tx)
+    ecdsa_validate_signature(tx.signature.ecdsa_signature)
+    assert tx.signature.from_ == ecdsa_recover_from_address(
+        tx.signature.ecdsa_signature,
+        compute_sig_hash(tx, chain_id),
+    )
+```
+
+See [EIP assets](../assets/eip-6493/tx_hashes.py) for a definition of `compute_sig_hash` that takes the various transaction types into account.
+
 ### SSZ `Receipt` container
 
 All SSZ receipts are represented as a single, normalized SSZ container. The definition uses the `PartialContainer[T, N]` SSZ type and `Optional[E]` as defined in [EIP-7495](./eip-7495.md).
@@ -208,7 +250,7 @@ All SSZ receipts are represented as a single, normalized SSZ container. The defi
 class Log(Container):
     address: ExecutionAddress
     topics: List[Bytes32, MAX_TOPICS_PER_LOG]
-    data: ByteVector[MAX_LOG_DATA_SIZE]
+    data: ByteList[MAX_LOG_DATA_SIZE]
 
 @dataclass
 class ReceiptPayload:
@@ -219,7 +261,7 @@ class ReceiptPayload:
     logs: List[Log, MAX_LOGS_PER_RECEIPT]
 
     # EIP-658
-    status: Optional[bool]
+    status: Optional[boolean]
 
 class Receipt(PartialContainer[ReceiptPayload, MAX_RECEIPT_FIELDS]):
     pass
@@ -278,11 +320,13 @@ This also reduces combinatorial explosion; for example, the `access_list` proper
 
 ## Backwards Compatibility
 
-The new signature scheme is solely used for new transactions.
+The new signature scheme is solely used for SSZ transactions.
+
+Existing RLP transactions can be converted to SSZ transactions. Their original `sig_hash` and `tx_hash` can be recovered from their SSZ representation.
 
-Existing RLP transactions can be converted to SSZ transactions for a normalized representation. Their original representation can be fully recovered from their SSZ representation, allowing bidirectional lossless conversion.
+Existing RLP receipts can be converted to SSZ receipts. The full sequence of accompanying transactions must be known to fill-in the new `contract_address` field. Note that because JSON-RPC exposes the `contract_address`, implementations are already required to know the transaction before queries for receipts can be served.
 
-Existing RLP receipts can be converted to SSZ receipts for a normalized representation. The full sequence of accompanying transactions must be known to fill-in the new `contract_address` field. Note that JSON-RPC already exposes the `contract_address`, so implementations are already required to know the transaction before queries for receipts can be served.
+See [EIP assets](../assets/eip-6493/convert.py) for a reference implementation to convert from RLP to SSZ, as well as corresponding [test cases](../assets/eip-6493/convert_tests.py).
 
 ## Test Cases
 

assets/eip-6493/convert.py

@@ -0,0 +1,197 @@
+from typing import List as PyList
+from rlp import decode
+from rlp_types import *
+from ssz_types import *
+
+def upgrade_rlp_transaction_to_ssz(pre_bytes: bytes,
+                                   chain_id: ChainId) -> SignedTransaction:
+    type_ = pre_bytes[0]
+
+    if type_ == 0x03:  # EIP-4844
+        pre = decode(pre_bytes[1:], Eip4844SignedTransaction)
+        assert pre.chain_id == chain_id
+
+        assert pre.signature_y_parity in (0, 1)
+        ecdsa_signature = ecdsa_pack_signature(
+            pre.signature_y_parity != 0,
+            pre.signature_r,
+            pre.signature_s,
+        )
+        from_ = ecdsa_recover_from_address(ecdsa_signature, compute_eip4844_sig_hash(pre))
+
+        return SignedTransaction(
+            payload=PartialContainer[TransactionPayload, MAX_TRANSACTION_PAYLOAD_FIELDS](
+                nonce=pre.nonce,
+                max_fee_per_gas=pre.max_fee_per_gas,
+                gas=pre.gas_limit,
+                to=ExecutionAddress(pre.destination),
+                value=pre.amount,
+                input_=pre.data,
+                access_list=[AccessTuple(
+                    address=access_tuple[0],
+                    storage_keys=access_tuple[1]
+                ) for access_tuple in pre.access_list],
+                max_priority_fee_per_gas=pre.max_priority_fee_per_gas,
+                max_fee_per_blob_gas=pre.max_fee_per_blob_gas,
+                blob_versioned_hashes=pre.blob_versioned_hashes,
+            ),
+            signature=PartialContainer[TransactionSignature, MAX_TRANSACTION_SIGNATURE_FIELDS](
+                from_=from_,
+                ecdsa_signature=ecdsa_signature,
+                type_=TRANSACTION_TYPE_EIP4844,
+            ),
+        )
+
+    if type_ == 0x02:  # EIP-1559
+        pre = decode(pre_bytes[1:], Eip1559SignedTransaction)
+        assert pre.chain_id == chain_id
+
+        assert pre.signature_y_parity in (0, 1)
+        ecdsa_signature = ecdsa_pack_signature(
+            pre.signature_y_parity != 0,
+            pre.signature_r,
+            pre.signature_s,
+        )
+        from_ = ecdsa_recover_from_address(ecdsa_signature, compute_eip1559_sig_hash(pre))
+
+        return SignedTransaction(
+            payload=PartialContainer[TransactionPayload, MAX_TRANSACTION_PAYLOAD_FIELDS](
+                nonce=pre.nonce,
+                max_fee_per_gas=pre.max_fee_per_gas,
+                gas=pre.gas_limit,
+                to=ExecutionAddress(pre.destination) if len(pre.destination) > 0 else None,
+                value=pre.amount,
+                input_=pre.data,
+                access_list=[AccessTuple(
+                    address=access_tuple[0],
+                    storage_keys=access_tuple[1]
+                ) for access_tuple in pre.access_list],
+                max_priority_fee_per_gas=pre.max_priority_fee_per_gas,
+            ),
+            signature=PartialContainer[TransactionSignature, MAX_TRANSACTION_SIGNATURE_FIELDS](
+                from_=from_,
+                ecdsa_signature=ecdsa_signature,
+                type_=TRANSACTION_TYPE_EIP1559,
+            ),
+        )
+
+    if type_ == 0x01:  # EIP-2930
+        pre = decode(pre_bytes[1:], Eip2930SignedTransaction)
+        assert pre.chainId == chain_id
+
+        assert pre.signatureYParity in (0, 1)
+        ecdsa_signature = ecdsa_pack_signature(
+            pre.signatureYParity != 0,
+            pre.signatureR,
+            pre.signatureS
+        )
+        from_ = ecdsa_recover_from_address(ecdsa_signature, compute_eip2930_sig_hash(pre))
+
+        return SignedTransaction(
+            payload=PartialContainer[TransactionPayload, MAX_TRANSACTION_PAYLOAD_FIELDS](
+                nonce=pre.nonce,
+                max_fee_per_gas=pre.gasPrice,
+                gas=pre.gasLimit,
+                to=ExecutionAddress(pre.to) if len(pre.to) > 0 else None,
+                value=pre.value,
+                input_=pre.data,
+                access_list=[AccessTuple(
+                    address=access_tuple[0],
+                    storage_keys=access_tuple[1]
+                ) for access_tuple in pre.accessList],
+            ),
+            signature=PartialContainer[TransactionSignature, MAX_TRANSACTION_SIGNATURE_FIELDS](
+                from_=from_,
+                ecdsa_signature=ecdsa_signature,
+                type_=TRANSACTION_TYPE_EIP2930,
+            ),
+        )
+
+    if 0xc0 <= type_ <= 0xfe:  # Legacy
+        pre = decode(pre_bytes, LegacySignedTransaction)
+
+        if pre.v not in (27, 28):  # EIP-155
+            assert pre.v in (2 * chain_id + 35, 2 * chain_id + 36)
+        ecdsa_signature = ecdsa_pack_signature(
+            (pre.v & 0x1) == 0,
+            pre.r,
+            pre.s,
+        )
+        from_ = ecdsa_recover_from_address(ecdsa_signature, compute_legacy_sig_hash(pre))
+
+        return SignedTransaction(
+            payload=PartialContainer[TransactionPayload, MAX_TRANSACTION_PAYLOAD_FIELDS](
+                nonce=pre.nonce,
+                max_fee_per_gas=pre.gasprice,
+                gas=pre.startgas,
+                to=ExecutionAddress(pre.to) if len(pre.to) > 0 else None,
+                value=pre.value,
+                input_=pre.data,
+            ),
+            signature=PartialContainer[TransactionSignature, MAX_TRANSACTION_SIGNATURE_FIELDS](
+                from_=from_,
+                ecdsa_signature=ecdsa_signature,
+                type_=TRANSACTION_TYPE_LEGACY if (pre.v not in (27, 28)) else None,
+            ),
+        )
+
+    assert False
+
+class ContractAddressData(Serializable):
+    fields = (
+        ('from_', Binary(20, 20)),
+        ('nonce', big_endian_int),
+    )
+
+def compute_contract_address(from_: ExecutionAddress,
+                             nonce: uint64) -> ExecutionAddress:
+    return ExecutionAddress(keccak(encode(ContractAddressData(
+        from_=from_,
+        nonce=nonce,
+    )))[12:32])
+
+def upgrade_rlp_receipt_to_ssz(pre_bytes: bytes,
+                               prev_cumulative_gas_used: uint64,
+                               transaction: SignedTransaction) -> Receipt:
+    type_ = pre_bytes[0]
+
+    if type_ in (0x03, 0x02, 0x01):  # EIP-4844, EIP-1559, EIP-2930
+        pre = decode(pre_bytes[1:], RlpReceipt)
+    elif 0xc0 <= type_ <= 0xfe:  # Legacy
+        pre = decode(pre_bytes, RlpReceipt)
+    else:
+        assert False
+
+    if len(pre.post_state_or_status) == 32:
+        root = pre.post_state_or_status
+        status = None
+    else:
+        root = None
+        status = len(pre.post_state_or_status) > 0 and pre.post_state_or_status[0] != 0
+
+    return Receipt(
+        root=root,
+        gas_used=pre.cumulative_gas_used - prev_cumulative_gas_used,
+        contract_address=compute_contract_address(
+            transaction.signature.from_,
+            transaction.payload.nonce,
+        ) if transaction.payload.to is None else None,
+        logs_bloom=pre.logs_bloom,
+        logs=[Log(
+            address=log[0],
+            topics=log[1],
+            data=log[2],
+        ) for log in pre.logs],
+        status=status,
+    )
+
+def upgrade_rlp_receipts_to_ssz(pre_bytes_list: PyList[bytes],
+                                chain_id: ChainId,
+                                transactions: PyList[SignedTransaction]) -> PyList[Receipt]:
+    receipts = []
+    cumulative_gas_used = 0
+    for i, pre_bytes in enumerate(pre_bytes_list):
+        receipt = upgrade_rlp_receipt_to_ssz(pre_bytes, cumulative_gas_used, transactions[i])
+        cumulative_gas_used += receipt.gas_used
+        receipts.append(receipt)
+    return receipts