EIP-4762: Statelessness gas cost changes

EIPS/eip-4762.md

@@ -0,0 +1,308 @@
+---
+eip: 4762
+title: Statelessness gas cost changes
+description:  Changes the gas schedule to reflect the costs of creating a witness by requiring clients update their database layout to match.
+author: Guillaume Ballet (@gballet), Vitalik Buterin (@vbuterin), Dankrad Feist (@dankrad)
+discussions-to: https://ethereum-magicians.org/t/eip-4762-statelessness-gas-cost-changes/8714
+status: Draft
+type: Standards Track
+category: Core
+created: 2022-02-03
+---
+## Abstract
+
+This EIP introduces changes in the gas schedule to reflect the costs of creating a witness. It requires clients to update their database layout to match this, so as to avoid potential DoS attacks.
+
+## Motivation
+
+The introduction of Verkle trees into Ethereum requires fundamental changes and as a preparation, this EIP is targeting the fork coming right before the verkle tree fork, in order to incentivize Dapp developers to adopt the new storage model, and ample time to adjust to it. It also incentivizes client developers to migrate their database format ahead of the verkle fork.
+
+## Specification
+
+### Access events
+
+We define access events as follows. When an access event takes place, the accessed data is saved to the Verkle tree (even if it was not modified). An access event is of the form`(address, sub_key, leaf_key)`, determining what data is being accessed.
+
+#### Access events for account headers
+
+When a non-precompile address is the target of a `CALL`, `CALLCODE`, `DELEGATECALL`, `SELFDESTRUCT`, `EXTCODESIZE`, or `EXTCODECOPY` opcode, or is the target address of a contract creation whose initcode starts execution, process these access events:
+
+```
+(address, 0, VERSION_LEAF_KEY)
+(address, 0, CODE_SIZE_LEAF_KEY)
+```
+
+If a call is value-bearing (ie. it transfers nonzero wei), whether or not the callee is a precompile, process these two access events:
+
+```
+(caller_address, 0, BALANCE_LEAF_KEY)
+(callee_address, 0, BALANCE_LEAF_KEY)
+```
+
+When a contract is created, process these access events:
+
+```
+(contract_address, 0, VERSION_LEAF_KEY)
+(contract_address, 0, NONCE_LEAF_KEY)
+(contract_address, 0, BALANCE_LEAF_KEY)
+(contract_address, 0, CODE_KECCAK_LEAF_KEY)
+(contract_address, 0, CODE_SIZE_LEAF_KEY)
+```
+
+If the `BALANCE` opcode is called targeting some address, process this access event:
+
+```
+(address, 0, BALANCE_LEAF_KEY)
+```
+
+If the `SELFDESTRUCT` opcode is called by some caller_address targeting some target_address (regardless of whether it’s value-bearing or not), process access events of the form:
+
+```
+(caller_address, 0, BALANCE_LEAF_KEY)
+(target_address, 0, BALANCE_LEAF_KEY)
+```
+
+If the `EXTCODEHASH` opcode is called targeting some address, process an access event of the form:
+
+```
+(address, 0, CODEHASH_LEAF_KEY)
+```
+
+#### Access events for storage
+
+`SLOAD` and `SSTORE` opcodes with a given address and key process an access event of the form
+
+```
+(address, tree_key, sub_key)
+```
+
+Where tree_key and sub_key are computed as follows:
+
+```python
+def get_storage_slot_tree_keys(storage_key: int) -> [int, int]:
+    if storage_key < (CODE_OFFSET - HEADER_STORAGE_OFFSET):
+        pos = HEADER_STORAGE_OFFSET + storage_key
+    else:
+        pos = MAIN_STORAGE_OFFSET + storage_key
+    return (
+        pos // 256,
+        pos % 256
+    ) 
+```
+
+#### Access events for code
+
+In the conditions below, “chunk chunk_id is accessed” is understood to mean an access event of the form
+
+```
+(address, (chunk_id + 128) // 256, (chunk_id + 128) % 256)
+```
+
+ * At each step of EVM execution, if and only if PC < len(code), chunk PC // CHUNK_SIZE (where PC is the current program counter) of the callee is accessed. In particular, note the following corner cases:
+     * The destination of a `JUMP` (or positively evaluated JUMPI) is considered to be accessed, even if the destination is not a jumpdest or is inside pushdata
+     * The destination of a `JUMPI` is not considered to be accessed if the jump conditional is false.
+     * The destination of a jump is not considered to be accessed if the execution gets to the jump opcode but does not have enough gas to pay for the gas cost of executing the `JUMP` opcode (including chunk access cost if the `JUMP` is the first opcode in a not-yet-accessed chunk)
+    * The destination of a jump is not considered to be accessed if it is beyond the code (`destination >= len(code)`)
+     * If code stops execution by walking past the end of the code, `PC = len(code)` is not considered to be accessed
+ * If the current step of EVM execution is a `PUSH{n}`, all chunks `(PC // CHUNK_SIZE) <= chunk_index <= ((PC + n) // CHUNK_SIZE)`` of the callee are accessed.
+ *   If a nonzero-read-size `CODECOPY` or `EXTCODECOPY` read bytes `x...y` inclusive, all chunks ``(x // CHUNK_SIZE) <= chunk_index <= (min(y, code_size - 1) // CHUNK_SIZE)`` of the accessed contract are accessed.
+     *   Example 1: for a `CODECOPY` with start position 100, read size 50, `code_size = 200`, `x = 100` and `y = 149`
+     *  Example 2: for a `CODECOPY` with start position 600, read size 0, no chunks are accessed
+     *  Example 3: for a `CODECOPY` with start position 1500, read size 2000, `code_size = 3100`, `x = 1500` and `y = 3099`
+ * `CODESIZE`, `EXTCODESIZE` and `EXTCODEHASH` do NOT access any chunks.
+    When a contract is created, access chunks `0 ... (len(code)+30)//31`
+
+### Write Events
+
+We define **write events** as follows. Note that when a write takes place, an access event also takes place (so the definition below should be a subset of the definition of access lists) A write event is of the form `(address, sub_key, leaf_key)`, determining what data is being written to.
+
+#### Write events for account headers
+
+When a nonzero-balance-sending CALL or SELFDESTRUCT with a given sender and recipient takes place, process these write events:
+
+```
+(sender, 0, BALANCE_LEAF_KEY)
+(recipient, 0, BALANCE_LEAF_KEY)
+```
+
+When a contract creation is initialized, process these write events:
+
+```
+(contract_address, 0, VERSION_LEAF_KEY)
+(contract_address, 0, NONCE_LEAF_KEY)
+```
+
+Only if the value sent with the creation is nonzero, also process:
+
+```
+(contract_address, 0, BALANCE_LEAF_KEY)
+```
+
+When a contract is created, process these write events:
+
+```
+(contract_address, 0, VERSION_LEAF_KEY)
+(contract_address, 0, NONCE_LEAF_KEY)
+(contract_address, 0, BALANCE_LEAF_KEY)
+(contract_address, 0, CODE_KECCAK_LEAF_KEY)
+(contract_address, 0, CODE_SIZE_LEAF_KEY)
+```
+
+#### Write events for storage
+
+SSTORE opcodes with a given `address` and `key` process a write event of the form
+
+```
+(address, tree_key, sub_key)
+```
+
+Where `tree_key` and `sub_key` are computed as follows:
+
+```python
+def get_storage_slot_tree_keys(storage_key: int) -> [int, int]:
+    if storage_key < (CODE_OFFSET - HEADER_STORAGE_OFFSET):
+        pos = HEADER_STORAGE_OFFSET + storage_key
+    else:
+        pos = MAIN_STORAGE_OFFSET + storage_key
+    return (
+        pos // 256,
+        pos % 256
+    )
+```
+
+#### Write events for code
+
+When a contract is created, make write events:
+
+```python
+(
+    address,
+    (CODE_OFFSET + i) // VERKLE_NODE_WIDTH,
+    (CODE_OFFSET + i) % VERKLE_NODE_WIDTH
+)
+```
+
+For `i` in `0 ... (len(code)+30)//31`.
+
+### Transactions
+
+#### Access events
+For a transaction, make these access events:
+
+```
+(tx.origin, 0, VERSION_LEAF_KEY)
+(tx.origin, 0, BALANCE_LEAF_KEY)
+(tx.origin, 0, NONCE_LEAF_KEY)
+(tx.origin, 0, CODE_SIZE_LEAF_KEY)
+(tx.origin, 0, CODE_KECCAK_LEAF_KEY)
+(tx.target, 0, VERSION_LEAF_KEY)
+(tx.target, 0, BALANCE_LEAF_KEY)
+(tx.target, 0, NONCE_LEAF_KEY)
+(tx.target, 0, CODE_SIZE_LEAF_KEY)
+(tx.target, 0, CODE_KECCAK_LEAF_KEY)
+```
+
+#### Write events
+
+```
+(tx.origin, 0, NONCE_LEAF_KEY)
+```
+
+if `value` is non-zero:
+
+```
+(tx.origin, 0, BALANCE_LEAF_KEY)
+(tx.target, 0, BALANCE_LEAF_KEY)
+```
+
+### Witness gas costs
+
+Remove the following gas costs:
+
+ * Increased gas cost of `CALL` if it is nonzero-value-sending
+ * EIP-2200 `SSTORE` gas costs except for the `SLOAD_GAS`
+ * 200 per byte contract code cost
+
+Reduce gas cost:
+
+ * `CREATE` to 1000
+
+|Constant |Value|
+|-|-|
+|WITNESS_BRANCH_COST 	|1900|
+|WITNESS_CHUNK_COST 	|200|
+|SUBTREE_EDIT_COST 	|3000|
+|CHUNK_EDIT_COST 	|500|
+|CHUNK_FILL_COST 	|6200|
+
+When executing a transaction, maintain four sets:
+
+ * `accessed_subtrees: Set[Tuple[address, int]]`
+ * `accessed_leaves: Set[Tuple[address, int, int]]`
+ * `edited_subtrees`: `Set[Tuple[address, int]]`
+ * `edited_leaves`: `Set[Tuple[address, int, int]]`
+
+
+When an **access** event of `(address, sub_key, leaf_key)` occurs, perform the following checks:
+
+ * If ``(address, sub_key)`` is not in accessed_subtrees, charge WITNESS_BRANCH_COST gas and add that tuple to accessed_subtrees.
+ * If `leaf_key` is not `None` and ``(address, sub_key, leaf_key)`` is not in `accessed_leaves`, charge `WITNESS_CHUNK_COST` gas and add it to `accessed_leaves`
+
+When a **write** event of `(address, sub_key, leaf_key)` occurs, perform the following checks:
+
+ * If (address, sub_key) is not in edited_subtrees, charge `SUBTREE_EDIT_COST` gas and add that tuple to edited_subtrees.
+ * If leaf_key is not None and `(address, sub_key, leaf_key)` is not in `edited_leaves`, charge `CHUNK_EDIT_COST` gas and add it to `edited_leaves`
+     * Additionally, if there was no value stored at `(address, sub_key, leaf_key)` (ie. the state held None at that position), charge `CHUNK_FILL_COST`
+
+Note that tree keys can no longer be emptied: only the values `0...2**256-1` can be written to a tree key, and 0 is distinct from None. Once a tree key is changed from `None` to not-`None`, it can never go back to `None`.
+
+### Replacement for access lists
+
+We replace EIP 2930 access lists with an SSZ structure of the form:
+
+```python
+class AccessList(Container):
+    addresses: List[AccountAccessList, ACCESS_LIST_MAX_ELEMENTS]
+
+class AccountAccessList(Container):
+    address: Address32
+    subtrees: List[AccessSubtree, ACCESS_LIST_MAX_ELEMENTS]
+
+class AccessSubtree(Container):
+    subtree_key: uint256
+    elements: BitVector[256]
+```
+
+## Rationale
+
+### Gas reform
+
+Gas costs for reading storage and code are reformed to more closely reflect the gas costs under the new Verkle tree design. `WITNESS_CHUNK_COST` is set to charge 6.25 gas per byte for chunks, and `WITNESS_BRANCH_COST` is set to charge ~13,2 gas per byte for branches on average (assuming 144 byte branch length) and ~2.5 gas per byte in the worst case if an attacker fills the tree with keys deliberately computed to maximize proof length.
+
+The main differences from gas costs in Berlin are:
+
+ * 200 gas charged per 31 byte chunk of code. This has been estimated to increase average gas usage by ~6-12% suggesting 10-20% gas usage increases at a 350 gas per chunk level).
+ * Cost for accessing adjacent storage slots (`key1 // 256 == key2 // 256`) decreases from 2100 to 200 for all slots after the first in the group,
+ * Cost for accessing storage slots 0…63 decreases from 2100 to 200, including the first storage slot. This is likely to significantly improve performance of many existing contracts, which use those storage slots for single persistent variables.
+
+Gains from the latter two properties have not yet been analyzed, but are likely to significantly offset the losses from the first property. It’s likely that once compilers adapt to these rules, efficiency will increase further.
+
+The precise specification of when access events take place, which makes up most of the complexity of the gas repricing, is necessary to clearly specify when data needs to be saved to the period 1 tree.
+
+## Backward Compatibility
+
+This EIP requires a hard fork, since it modifies consensus rules.
+
+The main backwards-compatibility-breaking changes is the gas costs for code chunk access making some applications less economically viable. It can be mitigated by increasing the gas limit at the same time as implementing this EIP, reducing the risk that applications will no longer work at all due to transaction gas usage rising above the block gas limit. 
+
+## Security Considerations
+
+This EIP will mean that certain operations, mostly reading and writing several elements in the same suffix tree, become cheaper. If clients retain the same database structure as they have now, this would result in a DOS vector.
+
+So some adaptation of the database is required in order to make this work.
+ * In all possible futures, it is important to logically separate the commitment scheme from data storage. In particular, no traversal of the commitment scheme tree should be necessary to find any given state element
+ * In order to make accesses to the same stem cheap as required for this EIP, the best way is probably to store each stem in the same location in the database. Basically the 256 leaves of 32 bytes each would be stored in an 8kB BLOB. The overhead of reading/writing this BLOB is small because most of the cost of disk access is seeking and not the amount transferred.
+
+## Copyright
+
+Copyright and related rights waived via [CC0](https://creativecommons.org/publicdomain/zero/1.0/).