BLOCKHASH Opcode does not comply with Kakarot spec

[howlbot-integration]

Lines of code

https://github.com/kkrt-labs/kakarot/blob/697100af34444b3931c18596cec56c454caf28ed/src/kakarot/instructions/block_information.cairo#L167-L172

Vulnerability details

Proof of Concept

blockhash function in the Internals namespace does not align with the Kakarot protocol's hint for the BLOCKHASH opcode. According to the Kakarot's doc, the BLOCKHASH opcode should return 0 for the last 10 blocks, but this is not followed.

https://github.com/kkrt-labs/kakarot/blob/697100af34444b3931c18596cec56c454caf28ed/src/kakarot/instructions/block_information.cairo#L167-L172

let lower_bound = Helpers.saturated_sub(evm.message.env.block_number, 256);
let in_range = is_in_range(block_number.low, lower_bound, evm.message.env.block_number);

if (in_range == FALSE) {
    Stack.push_uint256(Uint256(0, 0));
    return ();
}

This allows access to block hashes for all blocks within the last 256 blocks, including the most recent ones. It does not implement the Kakarot-specific behavior of returning 0 for the last 10 blocks.

Reference to Kakarot's doc:

Item	Ethereum	Kakarot
BLOCKHASH	Get the hash of one of the 256 most recent complete blocks	The last 10 blocks are not available, and 0 is returned instead

This could cause issues for contracts expecting Kakarot's specified BLOCKHASH behavior.

Recommended Mitigation Steps

Modify the blockhash function to comply with Kakarot's specification:

  let lower_bound = Helpers.saturated_sub(evm.message.env.block_number, 256);
-    let in_range = is_in_range(block_number.low, lower_bound, evm.message.env.block_number);
+    let upper_bound = evm.message.env.block_number - 10;
+    let in_range = is_in_range(block_number.low, lower_bound, upper_bound);

     if (in_range == FALSE) {
         Stack.push_uint256(Uint256(0, 0));
         return ();
     }

Assessed type

Other

[ClementWalter]

Severity: Low

Comment: SEE issue 3 for comment dup 130, 5, 3, 37

[c4-judge]

dmvt marked the issue as satisfactory

[c4-judge]

dmvt changed the severity to QA (Quality Assurance)

[c4-judge]

dmvt marked the issue as grade-b