Detect short-PUSH address refs and computed call targets

Author: leolara

scripts/filler_to_python/analyzer.py

@@ -668,25 +668,37 @@ def _resolve_storage_values(
 def _find_address_refs_in_bytecode(
     code_bytes: bytes,
     known_addresses: set[Address],
-) -> set[Address]:
-    """Find which known addresses are referenced in bytecode via PUSH."""
-    refs: set[Address] = set()
+) -> dict[Address, int]:
+    """Find which known addresses are referenced in bytecode via PUSH.
+
+    Return a mapping ``address -> minimum PUSH size observed``. A push size
+    smaller than 20 means the baseline bytecode compiled the address down
+    to fewer bytes (the original address had leading zero bytes); the
+    referenced contract must stay hardcoded so that the compiler keeps
+    emitting the same short PUSH opcode and the trace stays aligned.
+    """
+    refs: dict[Address, int] = {}
     # Pre-compute int values for fast comparison
     known_ints = {int.from_bytes(a, "big") for a in known_addresses}
     i = 0
     while i < len(code_bytes):
         opcode = code_bytes[i]
-        if 0x60 <= opcode <= 0x7F:  # PUSHn
+        if 0x60 <= opcode <= 0x7F:  # PUSH1..PUSH32
             push_size = opcode - 0x5F
             push_data = code_bytes[i + 1 : i + 1 + push_size]
-            if len(push_data) == push_size and push_size >= 4:
-                # Addresses may be in PUSH19 or smaller if they have
-                # leading zero bytes (compiler optimization). Use
-                # min size 4 to avoid false positives on small values.
+            if len(push_data) == push_size:
+                # Addresses with leading zero bytes are compiled to
+                # a PUSH smaller than PUSH20 (down to PUSH1 for 1-byte
+                # addresses like 0x01). Match on int value against the
+                # known-address set — false positives would require a
+                # PUSHn that happens to push exactly a value already
+                # registered as a pre-state address, which is rare in
+                # practice.
                 val = int.from_bytes(push_data, "big")
                 if val in known_ints:
                     addr = Address(val)
-                    refs.add(addr)
+                    if addr not in refs or push_size < refs[addr]:
+                        refs[addr] = push_size
             i += 1 + push_size
         else:
             i += 1
@@ -851,11 +863,27 @@ def _build_accounts(
             all_known_addrs.add(Address(int.from_bytes(addr_or_eoa, "big")))
 
     deps: dict[Address, set[Address]] = {}
+    # Addresses referenced via PUSH<20 anywhere: baseline bytecode
+    # compiled them to a short PUSH because of leading zero bytes, so
+    # they must stay hardcoded to keep the opcode sequence aligned.
+    short_push_refs: set[Address] = set()
+    # True when a short-PUSH ref targets an address that is not a
+    # deployed contract in the pre-state (e.g. an external tag like
+    # <contract:0x...dead> only referenced from bytecode). In that case
+    # no contract can be pinned, so fall back to globally disabling
+    # dynamic addresses for the whole test.
+    short_push_unpinnable = False
     for addr, cb in code_bytes_map.items():
         refs = _find_address_refs_in_bytecode(cb, all_known_addrs)
         # Track deps on other contracts. Keep self-references — they
         # create self-loops detected as cycles, forcing hardcoded addr.
-        deps[addr] = refs & known_contract_addrs
+        deps[addr] = set(refs) & known_contract_addrs
+        for ref_addr, push_size in refs.items():
+            if push_size < 20:
+                if ref_addr in known_contract_addrs:
+                    short_push_refs.add(ref_addr)
+                else:
+                    short_push_unpinnable = True
 
     contract_addrs_ordered = [
         acct.address
@@ -873,6 +901,9 @@ def _build_accounts(
     for acct in raw_accounts:
         if acct.oversized_code and acct.address is not None:
             non_dynamic_addrs.add(acct.address)
+    # Short-PUSH refs: pin the referenced contract so its address keeps
+    # the same leading-zero profile as baseline.
+    non_dynamic_addrs.update(short_push_refs)
 
     changed = True
     while changed:
@@ -936,9 +967,47 @@ def _build_accounts(
         if has_addr_arithmetic:
             break
 
-    if has_addr_arithmetic:
+    # ------------------------------------------------------------------
+    # Computed call targets: CALL/STATICCALL/DELEGATECALL/CALLCODE
+    # receiving `address=` from arithmetic or memory reads. Tests that
+    # do this usually rely on specific pre-state contract addresses
+    # (dispatch-by-offset) and won't survive dynamic allocation.
+    # ------------------------------------------------------------------
+    _COMPUTED_ADDR_PATTERNS = (
+        "address=Op.ADD(",
+        "address=Op.SUB(",
+        "address=Op.MUL(",
+        "address=Op.DIV(",
+        "address=Op.MOD(",
+        "address=Op.MLOAD(",
+        "address=Op.SLOAD(",
+        "address=Op.CALLDATALOAD(",
+    )
+    has_computed_call_target = False
+    for acct in raw_accounts:
+        if not acct.code_expr:
+            continue
+        for pat in _COMPUTED_ADDR_PATTERNS:
+            if pat in acct.code_expr:
+                has_computed_call_target = True
+                break
+        if has_computed_call_target:
+            break
+
+    if (
+        has_addr_arithmetic
+        or short_push_unpinnable
+        or has_computed_call_target
+    ):
         # Disable dynamic for all contracts and re-generate Op
-        # expressions without addr_to_var
+        # expressions without addr_to_var. Triggers:
+        #   * address arithmetic (Op.ADD(var, ...)) assumes sequential
+        #     addresses that dynamic allocation can't preserve.
+        #   * a short-PUSH ref that points outside the pre-state has no
+        #     contract to pin, so the whole test must keep the filler's
+        #     resolved addresses.
+        #   * computed call targets (CALL with address=Op.ADD/MLOAD/
+        #     CALLDATALOAD/...) dispatch by baseline-relative offsets.
         for acct in raw_accounts:
             if not acct.is_eoa:
                 acct.use_dynamic = False

tests/ported_static/stArgsZeroOneBalance/test_create_non_const.py

@@ -14,6 +14,7 @@
     Environment,
     StateTestFiller,
     Transaction,
+    compute_create_address,
 )
 from execution_testing.forks import Fork
 from execution_testing.specs.static_state.expect_section import (
@@ -97,7 +98,9 @@ def test_create_non_const(
             "network": [">=Cancun"],
             "result": {
                 contract_0: Account(
-                    storage={0: 0xD2571607E241ECF590ED94B12D87C94BABE36DB6},
+                    storage={
+                        0: compute_create_address(address=contract_0, nonce=0),
+                    },
                 ),
             },
         },
@@ -106,7 +109,9 @@ def test_create_non_const(
             "network": [">=Cancun"],
             "result": {
                 contract_0: Account(
-                    storage={0: 0xD2571607E241ECF590ED94B12D87C94BABE36DB6},
+                    storage={
+                        0: compute_create_address(address=contract_0, nonce=0),
+                    },
                 ),
             },
         },

tests/ported_static/stAttackTest/test_contract_creation_spam.py

@@ -621,6 +621,7 @@ def test_contract_creation_spam(
         + Op.SSTORE,
         balance=0xDE0B6B3A7640000,
         nonce=0,
+        address=Address(0x6A0A0FC761C612C340A0E98D33B37A75E5268472),  # noqa: E501
     )
 
     tx = Transaction(

tests/ported_static/stCallCodes/test_callcode_dynamic_code.py

@@ -264,7 +264,9 @@ def test_callcode_dynamic_code(
                 contract_1: Account(
                     storage={
                         0: 1,
-                        10: 0x13136008B64FF592819B2FA6D43F2835C452020E,
+                        10: compute_create_address(
+                            address=contract_1, nonce=0
+                        ),
                         11: 1,
                         20: contract_1,
                         21: sender,
@@ -298,9 +300,13 @@ def test_callcode_dynamic_code(
                         0: 1,
                         10: 0xBF1676BE6038AB86D66E00824C2E3577858040F6,
                         11: 1,
-                        20: 0x4B86C4ED99B87F0F396BC0C76885453C343916ED,
+                        20: compute_create_address(
+                            address=contract_3, nonce=0
+                        ),
                         21: sender,
-                        22: 0x4B86C4ED99B87F0F396BC0C76885453C343916ED,
+                        22: compute_create_address(
+                            address=contract_3, nonce=0
+                        ),
                     },
                     code=b"",
                     balance=0,
@@ -317,9 +323,13 @@ def test_callcode_dynamic_code(
                         0: 1,
                         10: 0xF2D6BF688FAE45DA62AB2DD4F36945BC924CC61,
                         11: 1,
-                        20: 0xA51C188504A60578914FCAE68F7A1F0DCBB856A9,
+                        20: compute_create_address(
+                            address=contract_4, nonce=0
+                        ),
                         21: sender,
-                        22: 0xA51C188504A60578914FCAE68F7A1F0DCBB856A9,
+                        22: compute_create_address(
+                            address=contract_4, nonce=0
+                        ),
                     },
                     code=b"",
                     balance=0,

tests/ported_static/stCallCodes/test_callcode_dynamic_code2_self_call.py

@@ -168,7 +168,9 @@ def test_callcode_dynamic_code2_self_call(
                 contract_2: Account(
                     storage={
                         0: 1,
-                        10: 0x13136008B64FF592819B2FA6D43F2835C452020E,
+                        10: compute_create_address(
+                            address=contract_2, nonce=0
+                        ),
                         11: 1,
                         20: contract_2,
                         21: sender,

tests/ported_static/stCallCodes/test_callcode_in_initcode_to_empty_contract.py

@@ -86,6 +86,7 @@ def test_callcode_in_initcode_to_empty_contract(
         )
         + Op.STOP,
         nonce=0,
+        address=Address(0x1100000000000000000000000000000000000000),  # noqa: E501
     )
     # Source: lll
     # {(seq (CREATE 0 0 (lll (seq  [[1]] (CALLCODE 500000 0x1000000000000000000000000000000000000001 1 0 0 0 0)  [[2]] 1  ) 0)   )           )}  # noqa: E501
@@ -112,6 +113,7 @@ def test_callcode_in_initcode_to_empty_contract(
         + Op.STOP,
         balance=10000,
         nonce=0,
+        address=Address(0x1000000000000000000000000000000000000000),  # noqa: E501
     )
     # Source: lll
     # {(seq (CREATE2 0 0 (lll (seq  [[1]] (CALLCODE 500000 0x1000000000000000000000000000000000000001 1 0 0 0 0) [[2]] 1 ) 0)   0)           )}  # noqa: E501
@@ -139,6 +141,7 @@ def test_callcode_in_initcode_to_empty_contract(
         + Op.STOP,
         balance=10000,
         nonce=0,
+        address=Address(0x2000000000000000000000000000000000000000),  # noqa: E501
     )
 
     expect_entries_: list[dict] = [

tests/ported_static/stCallCodes/test_callcode_in_initcode_to_exis_contract_with_v_transfer_ne_money.py

@@ -89,12 +89,14 @@ def test_callcode_in_initcode_to_exis_contract_with_v_transfer_ne_money(
         )
         + Op.STOP,
         nonce=0,
+        address=Address(0x1100000000000000000000000000000000000000),  # noqa: E501
     )
     # Source: lll
     # { (SSTORE 2 1) }
     contract_3 = pre.deploy_contract(  # noqa: F841
         code=Op.SSTORE(key=0x2, value=0x1) + Op.STOP,
         nonce=0,
+        address=Address(0x1000000000000000000000000000000000000001),  # noqa: E501
     )
     # Source: lll
     # {(seq (CREATE2 0 0 (lll (seq  [[1]] (CALLCODE 500000 0x1000000000000000000000000000000000000001 1 0 0 0 0)) 0)   0)           )}  # noqa: E501
@@ -121,6 +123,7 @@ def test_callcode_in_initcode_to_exis_contract_with_v_transfer_ne_money(
         + Op.STOP,
         balance=10000,
         nonce=0,
+        address=Address(0x2000000000000000000000000000000000000000),  # noqa: E501
     )
     # Source: lll
     # {(seq (CREATE 0 0 (lll (seq  [[1]] (CALLCODE 500000 0x1000000000000000000000000000000000000001 1 0 0 0 0)) 0)   )           )}  # noqa: E501
@@ -146,6 +149,7 @@ def test_callcode_in_initcode_to_exis_contract_with_v_transfer_ne_money(
         + Op.STOP,
         balance=10000,
         nonce=0,
+        address=Address(0x1000000000000000000000000000000000000000),  # noqa: E501
     )
 
     expect_entries_: list[dict] = [

tests/ported_static/stCallCodes/test_callcode_in_initcode_to_existing_contract.py

@@ -89,12 +89,14 @@ def test_callcode_in_initcode_to_existing_contract(
         )
         + Op.STOP,
         nonce=0,
+        address=Address(0x1100000000000000000000000000000000000000),  # noqa: E501
     )
     # Source: lll
     # { (SSTORE 2 1) }
     contract_3 = pre.deploy_contract(  # noqa: F841
         code=Op.SSTORE(key=0x2, value=0x1) + Op.STOP,
         nonce=0,
+        address=Address(0x1000000000000000000000000000000000000001),  # noqa: E501
     )
     # Source: lll
     # {(seq (CREATE2 1 0 (lll (seq  [[1]] (CALLCODE 50000 0x1000000000000000000000000000000000000001 1 0 0 0 0)) 0)   0)           )}  # noqa: E501
@@ -122,6 +124,7 @@ def test_callcode_in_initcode_to_existing_contract(
         + Op.STOP,
         balance=10000,
         nonce=0,
+        address=Address(0x2000000000000000000000000000000000000000),  # noqa: E501
     )
     # Source: lll
     # {(seq (CREATE 1 0 (lll (seq  [[1]] (CALLCODE 50000 0x1000000000000000000000000000000000000001 1 0 0 0 0)) 0)   )           )}  # noqa: E501
@@ -148,6 +151,7 @@ def test_callcode_in_initcode_to_existing_contract(
         + Op.STOP,
         balance=10000,
         nonce=0,
+        address=Address(0x1000000000000000000000000000000000000000),  # noqa: E501
     )
 
     expect_entries_: list[dict] = [

tests/ported_static/stCallCreateCallCodeTest/test_create_fail_balance_too_low.py

@@ -82,6 +82,7 @@ def test_create_fail_balance_too_low(
         + Op.STOP,
         balance=0xDE0B6B3A7640000,
         nonce=0,
+        address=Address(0x095E7BAEA6A6C7C4C2DFEB977EFAC326AF552D87),  # noqa: E501
     )
 
     expect_entries_: list[dict] = [

tests/ported_static/stCallCreateCallCodeTest/test_create_init_fail_bad_jump_destination.py

@@ -53,6 +53,7 @@ def test_create_init_fail_bad_jump_destination(
         + Op.STOP,
         balance=0xDE0B6B3A7640000,
         nonce=0,
+        address=Address(0x866B704865D7D80842E1D7C2C1C8BF682A3A437C),  # noqa: E501
     )
 
     tx = Transaction(