feat: add depth-based worst-case attack benchmarks for execute mode#1936
Closed
CPerezz wants to merge 1 commit intoethereum:forks/osakafrom
Closed
feat: add depth-based worst-case attack benchmarks for execute mode#1936CPerezz wants to merge 1 commit intoethereum:forks/osakafrom
CPerezz wants to merge 1 commit intoethereum:forks/osakafrom
Conversation
This PR introduces comprehensive benchmarks to test Ethereum clients under worst-case scenarios involving extremely deep state and account tries. The attack scenario: - Pre-deployed contracts with deep storage tries (depth=9) maximizing traversal costs - CREATE2-based deterministic addressing for reproducible benchmarks - AttackOrchestrator contract that batches up to 2,510 attacks per transaction - Tests measure state root recomputation impact when modifying deep slots Key components: - depth_9.sol, depth_10.sol: Contracts with deep storage tries - s9_acc3.json: Pre-computed CREATE2 addresses and auxiliary accounts (15k contracts) - AttackOrchestrator.sol: Optimized attack coordinator (3,650 gas per attack) - deep_branch_testing.py: EEST test harness for pre-deployed contracts - README.md: Complete documentation and setup instructions Performance optimizations: - Reduced gas forwarding from 50k to 3,650 per attack (8.3x throughput increase) - MAX_ATTACKS_PER_TX increased from 303 to 2,510 - Precise EVM opcode cost analysis with safety margins - Read init_code_hash directly from JSON instead of recompiling Deployment setup and instructions available at: https://gist.github.com/CPerezz/44d521c0f9e6adf7d84187a4f2c11978 This benchmark helps identify performance bottlenecks in state trie handling and validates client implementations under extreme depth conditions.
3 tasks
Contributor
|
You beat me to updating the base branch of this pull request! Closing this one in favour of #1937 |
Contributor
Author
|
@SamWilsn the plan was to not close this for now. And wait until the discussion settles on something with @marioevz and @LouisTsai-Csie Notice these 2 PRs do the same in different ways. And from the Gaslightning call yesterday, it's not yet clear which will be the chosen path to follow. |
Carsons-Eels
pushed a commit
to Carsons-Eels/execution-specs
that referenced
this pull request
Jan 6, 2026
safer implementation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds comprehensive benchmarks for testing worst-case depth attacks on Ethereum state and account tries in execute mode.
Description
These benchmarks test the worst-case scenario for Ethereum clients when dealing with extremely deep state and account tries. The attack exploits the computational complexity of Patricia Merkle Trie operations through:
The test measures the performance impact of state root recomputation and IO when modifying deep storage slots across thousands of contracts, simulating the maximum theoretical load on the state trie.
Setup Instructions
For complete deployment setup and instructions, see: https://gist.github.com/CPerezz/44d521c0f9e6adf7d84187a4f2c11978
Key Changes
test_worst_depth_stateroot_recomptest with configurable storage/account depth parametersAttackOrchestrator.solcontract for efficient batched attacksPerformance Improvements
This allows testing much larger attack surfaces within the same gas constraints.
Test Parameters
The test supports multiple depth configurations: