Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug: geth tracer returns hallucinated slot read data #6429

Closed
1 task done
sslivkoff opened this issue Feb 5, 2024 · 16 comments
Closed
1 task done

Bug: geth tracer returns hallucinated slot read data #6429

sslivkoff opened this issue Feb 5, 2024 · 16 comments
Labels
C-bug An unexpected or incorrect behavior

Comments

@sslivkoff
Copy link
Member

Describe the bug

Performing a debug_traceBlockByNumber trace with the prestateTracer tracer, reth hallucinates some storage reads in the returned RPC response.

For example, let's say we trace the transaction 0xc44ae9dc6047d56f0027f9e92e2a8d4e515e14e016bdfb7ff04f299cdfc29509. Erigon says there are 11 storage slot reads. Reth says there are 13 storage slot reads. The two extra slot reads from reth are in contract 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad. This is the uniswap universal router contract, and it basically has only two storage slots that have been there since deployment. But reth claims that this contracts slot 0xe03178286da22a27dd0b1f68fb538cd07bc9080172ee9a5a2238416fe86db02a was read. This slot does not exist so far as I can tell.

Scanning many other blocks and contracts, there are lots of false reads attributed to non-existent slots of this contract in particular.

Steps to reproduce

I used the command cryo storage_reads -b 18.8M:+1 -r RPC_URL to extract data files for both reth and erigon. The transaction listed above 0xc44ae9dc6047d56f0027f9e92e2a8d4e515e14e016bdfb7ff04f299cdfc29509 is the first transaction in block 18,800,000.

Under the hood this uses geth traces debug_traceBlockByNumber with the prestateTracer tracer

Node logs

No response

Platform(s)

Linux (x86)

What version/commit are you on?

This is the reth public node: reth Version: 0.1.0-alpha.10 Commit SHA: 2e73e21 Build Timestamp: 2023-11-03T20:23:02.271051235Z Build Features: default,jemalloc Build Profile: release

What database version are you on?

Current database version: 1
Local database is uninitialized

What type of node are you running?

Archive (default)

What prune config do you use, if any?

No response

If you've built Reth from source, provide the full command you used

No response

Code of Conduct

  • I agree to follow the Code of Conduct
@sslivkoff sslivkoff added C-bug An unexpected or incorrect behavior S-needs-triage This issue needs to be labelled labels Feb 5, 2024
@mattsse
Copy link
Collaborator

mattsse commented Feb 6, 2024

can you give some other examples for transactions that have incorrect prestate?

@mattsse
Copy link
Collaborator

mattsse commented Feb 6, 2024

are you sure about this @sslivkoff :

This is the reth public node: reth Version: 0.1.0-alpha.10 Commit SHA: 2e73e21 Build Timestamp: 2023-11-03T20:23:02.271051235Z Build Features: default,jemalloc Build Profile: release

@sslivkoff
Copy link
Member Author

are you sure about this @sslivkoff :

This is the reth public node: reth Version: 0.1.0-alpha.10 Commit SHA: 2e73e21 Build Timestamp: 2023-11-03T20:23:02.271051235Z Build Features: default,jemalloc Build Profile: release

it's what happens when I do

ssh ubuntu@69.67.151.138

ubuntu@reth-public-1:~$ ~/reth/target/release/reth --version
reth Version: 0.1.0-alpha.10
Commit SHA: 2e73e213
Build Timestamp: 2023-11-03T20:23:02.271051235Z
Build Features: default,jemalloc
Build Profile: release

@sslivkoff
Copy link
Member Author

sslivkoff commented Feb 6, 2024

heres a bunch of examples in this format

<TX_HASH>
<NUMBER_OF_SLOT_READS_FOR_ALL_CONTRACTS>
<TABLE_OF_READS_OF_ROUTER_CONTRACT>

I believe the only valid slots for this contract are the 0x000000...000X. all of the hashy slots are in error afaict

0xbbf35f2a055cec9238d3740343249a0d7d9593580edd940d37a52e400273730f
13
shape: (3, 2)
┌────────────────────────────────────────────┬─────────────────────────────────────────────────────┐
│ contract_address                           ┆ slot                                                │
│ ---                                        ┆ ---                                                 │
│ str                                        ┆ str                                                 │
╞════════════════════════════════════════════╪═════════════════════════════════════════════════════╡
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x0000000000000000000000000000000000000000000000000 │
│                                            ┆ 000000000000001                                     │
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x0000000000000000000000000000000000000000000000000 │
│                                            ┆ 00000000000000c                                     │
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0xe03178286da22a27dd0b1f68fb538cd07bc9080172ee9a5a2 │
│                                            ┆ 238416fe86db02a                                     │
└────────────────────────────────────────────┴─────────────────────────────────────────────────────┘



0x87f200a114a0e69865ff2eb2a68d0fe2bd75a4ab5d9a5f2620316e54157e9cd0
26
shape: (2, 2)
┌────────────────────────────────────────────┬─────────────────────────────────────────────────────┐
│ contract_address                           ┆ slot                                                │
│ ---                                        ┆ ---                                                 │
│ str                                        ┆ str                                                 │
╞════════════════════════════════════════════╪═════════════════════════════════════════════════════╡
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x0000000000000000000000000000000000000000000000000 │
│                                            ┆ 000000000000001                                     │
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0xe03178286da22a27dd0b1f68fb538cd07bc9080172ee9a5a2 │
│                                            ┆ 238416fe86db02a                                     │
└────────────────────────────────────────────┴─────────────────────────────────────────────────────┘





0x4cfd0a0a2bb60b346927445769b1095a0535b4feed799aba61c11382c37a03ee
57
shape: (2, 2)
┌────────────────────────────────────────────┬─────────────────────────────────────────────────────┐
│ contract_address                           ┆ slot                                                │
│ ---                                        ┆ ---                                                 │
│ str                                        ┆ str                                                 │
╞════════════════════════════════════════════╪═════════════════════════════════════════════════════╡
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x0000000000000000000000000000000000000000000000000 │
│                                            ┆ 000000000000001                                     │
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x6846934998a7dd645aafe5c7ae43a437c0ef262dd349c8d30 │
│                                            ┆ 61cacc1fa30faae                                     │
└────────────────────────────────────────────┴─────────────────────────────────────────────────────┘



0xe12742ef26dd7c61a4acf396de2eef98fcfa886782ba1dac1b032b70b4e0d13d
21
shape: (2, 2)
┌────────────────────────────────────────────┬─────────────────────────────────────────────────────┐
│ contract_address                           ┆ slot                                                │
│ ---                                        ┆ ---                                                 │
│ str                                        ┆ str                                                 │
╞════════════════════════════════════════════╪═════════════════════════════════════════════════════╡
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x0000000000000000000000000000000000000000000000000 │
│                                            ┆ 000000000000001                                     │
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0xe03178286da22a27dd0b1f68fb538cd07bc9080172ee9a5a2 │
│                                            ┆ 238416fe86db02a                                     │
└────────────────────────────────────────────┴─────────────────────────────────────────────────────┘



0x10b079af9a9d7595064e6d846e73aa545d4c89bcf2b98fc9a0d4ada8b66431ac
18
shape: (2, 2)
┌────────────────────────────────────────────┬─────────────────────────────────────────────────────┐
│ contract_address                           ┆ slot                                                │
│ ---                                        ┆ ---                                                 │
│ str                                        ┆ str                                                 │
╞════════════════════════════════════════════╪═════════════════════════════════════════════════════╡
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x0000000000000000000000000000000000000000000000000 │
│                                            ┆ 000000000000001                                     │
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0xe03178286da22a27dd0b1f68fb538cd07bc9080172ee9a5a2 │
│                                            ┆ 238416fe86db02a                                     │
└────────────────────────────────────────────┴─────────────────────────────────────────────────────┘



0x23bae2c18bca58477fbf406190d7c3b75368063a034b8f34502aff0b8dd50331
22
shape: (2, 2)
┌────────────────────────────────────────────┬─────────────────────────────────────────────────────┐
│ contract_address                           ┆ slot                                                │
│ ---                                        ┆ ---                                                 │
│ str                                        ┆ str                                                 │
╞════════════════════════════════════════════╪═════════════════════════════════════════════════════╡
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x0000000000000000000000000000000000000000000000000 │
│                                            ┆ 000000000000001                                     │
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x783d83ea9f2ac8cdbafd52d2216a4779b49020645d6c61046 │
│                                            ┆ 4be5f3ed4e09ecf                                     │
└────────────────────────────────────────────┴─────────────────────────────────────────────────────┘




0xe956222ebee4d2959b4a0f97650d520a7878c8971963100a77fd59ac7817d8fe
28
shape: (3, 2)
┌────────────────────────────────────────────┬─────────────────────────────────────────────────────┐
│ contract_address                           ┆ slot                                                │
│ ---                                        ┆ ---                                                 │
│ str                                        ┆ str                                                 │
╞════════════════════════════════════════════╪═════════════════════════════════════════════════════╡
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x0000000000000000000000000000000000000000000000000 │
│                                            ┆ 000000000000000                                     │
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x0000000000000000000000000000000000000000000000000 │
│                                            ┆ 000000000000001                                     │
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0xae3177e6212ac78cbfc767e9f6ee5100ab51b46edf0f8cf32 │
│                                            ┆ a38a5fb95629c1d                                     │
└────────────────────────────────────────────┴─────────────────────────────────────────────────────┘




0xd1a32e1c4ebdc8ea966ca361e252b37db9a3f1afda79259260494b4ea621e844
27
shape: (2, 2)
┌────────────────────────────────────────────┬─────────────────────────────────────────────────────┐
│ contract_address                           ┆ slot                                                │
│ ---                                        ┆ ---                                                 │
│ str                                        ┆ str                                                 │
╞════════════════════════════════════════════╪═════════════════════════════════════════════════════╡
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x0000000000000000000000000000000000000000000000000 │
│                                            ┆ 000000000000001                                     │
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x64d94787f60a1abbfc78d722d549547cc650de36813797aca │
│                                            ┆ 89358068914d1e4                                     │
└────────────────────────────────────────────┴─────────────────────────────────────────────────────┘



0x04144a492f1ec024d49b677ddb01184d40fb2b9719bafb6fb02d6f9298f5f4fc
35
shape: (2, 2)
┌────────────────────────────────────────────┬─────────────────────────────────────────────────────┐
│ contract_address                           ┆ slot                                                │
│ ---                                        ┆ ---                                                 │
│ str                                        ┆ str                                                 │
╞════════════════════════════════════════════╪═════════════════════════════════════════════════════╡
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x0000000000000000000000000000000000000000000000000 │
│                                            ┆ 000000000000001                                     │
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x4e57e0cb97228e856c9c474b3e99c7dbe38ea477fe6908998 │
│                                            ┆ 4acf7c4cb48bf48                                     │
└────────────────────────────────────────────┴─────────────────────────────────────────────────────┘



0x83ca160123e4eb2de213ab38188b6723346b80f9f99c61a591dcf388bc5040d5
29
shape: (2, 2)
┌────────────────────────────────────────────┬─────────────────────────────────────────────────────┐
│ contract_address                           ┆ slot                                                │
│ ---                                        ┆ ---                                                 │
│ str                                        ┆ str                                                 │
╞════════════════════════════════════════════╪═════════════════════════════════════════════════════╡
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x0000000000000000000000000000000000000000000000000 │
│                                            ┆ 000000000000001                                     │
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0xe03178286da22a27dd0b1f68fb538cd07bc9080172ee9a5a2 │
│                                            ┆ 238416fe86db02a                                     │
└────────────────────────────────────────────┴─────────────────────────────────────────────────────┘




0x179a304be6d256761bce7fa90c3946e94290eae8800f47311d716f16cfe632a6
33
shape: (2, 2)
┌────────────────────────────────────────────┬─────────────────────────────────────────────────────┐
│ contract_address                           ┆ slot                                                │
│ ---                                        ┆ ---                                                 │
│ str                                        ┆ str                                                 │
╞════════════════════════════════════════════╪═════════════════════════════════════════════════════╡
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0x0000000000000000000000000000000000000000000000000 │
│                                            ┆ 000000000000001                                     │
│ 0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad ┆ 0xe03178286da22a27dd0b1f68fb538cd07bc9080172ee9a5a2 │
│                                            ┆ 238416fe86db02a                                     │
└────────────────────────────────────────────┴─────────────────────────────────────────────────────┘



@onbjerg
Copy link
Member

onbjerg commented Feb 6, 2024

Checked the first tx, it looks like the balance check in the transactions for WETH are attributed to the wrong address.

If you see here: https://evm.storage/eth/0xbbf35f2a055cec9238d3740343249a0d7d9593580edd940d37a52e400273730f

The first call to WETH.deposit does an SLOAD for balanceOf[0x3fc91a3afd70395cd496c647d5a6cc9d4b2b7fad], and the corresponding storage slot for that entry in the mapping is 0xe03178286da22a27dd0b1f68fb538cd07bc9080172ee9a5a2238416fe86db02a

@mattsse
Copy link
Collaborator

mattsse commented Feb 6, 2024

this might be fixed by paradigmxyz/revm-inspectors#15 which will land with alpha17

@sslivkoff
Copy link
Member Author

this might be fixed by paradigmxyz/evm-inspectors#15 which will land with alpha17

mentioned in that issue:

because the prestate tracer should only include changed slots

my understanding is that the prestate tracer should include all read slots, not just changed slots

@sslivkoff
Copy link
Member Author

that contradicts what is written here https://geth.ethereum.org/docs/developers/evm-tracing/built-in-tracers

The prestate tracer has two modes: prestate and diff. The prestate mode returns the accounts necessary to execute a given transaction. diff mode returns the differences between the transaction's pre and post-state (i.e. what changed because the transaction happened). The prestateTracer defaults to prestate mode. It reexecutes the given transaction and tracks every part of state that is touched. This is similar to the concept of a stateless witness, the difference being this tracer doesn't return any cryptographic proof, rather only the trie leaves.

@onbjerg
Copy link
Member

onbjerg commented Feb 6, 2024

That's true, although the code suggests that only state that is strictly modified is included, and I haven't seen anything suggest otherwise. I guess the only way to find out is to run a call :/

@sslivkoff
Copy link
Member Author

I'm not sure what's going on with the geth code but it seems like the documented description is quite important functionality

being able to create state witnesses and measure reads more generally will be important for understanding state growth and studying the verkle transition

@sslivkoff
Copy link
Member Author

sslivkoff commented Feb 6, 2024

I think this is the issue

the prestate tracer has two modes, prestate mode and diff mode. When t.config.DiffMode is false, meaning prestate mode, the function returns early and never gets rid of those unmodified slots. this gives it the behavior expected from the geth docs

@mattsse
Copy link
Collaborator

mattsse commented Feb 6, 2024

for prestate:
https://github.com/ethereum/go-ethereum/blob/bc0b87ca196f92e5af49bd33cc190ef0ec32b197/eth/tracers/native/prestate.go#L223-L224

I'll revisit this once alpha17 is rolled out on reth-public tonight

@onbjerg
Copy link
Member

onbjerg commented Feb 6, 2024

I think this is the issue

Good catch

@mattsse
Copy link
Collaborator

mattsse commented Feb 6, 2024

@sslivkoff thanks for the reference, I previously overlooked that

should be fixed with the evm-inspector pr

mattsse added a commit to paradigmxyz/revm-inspectors that referenced this issue Feb 6, 2024
@onbjerg
Copy link
Member

onbjerg commented Feb 6, 2024

Closed by paradigmxyz/revm-inspectors#18 (will take some dep bumps to resolve)

@onbjerg onbjerg closed this as completed Feb 6, 2024
@github-project-automation github-project-automation bot moved this from Todo to Done in Reth Tracker Feb 6, 2024
@DaniPopes DaniPopes removed the S-needs-triage This issue needs to be labelled label Apr 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
C-bug An unexpected or incorrect behavior
Projects
Archived in project
Development

No branches or pull requests

4 participants