feat: merge-train/avm (#20419)

BEGIN_COMMIT_OVERRIDE
fix(avm)!: Enshrine bytecode size in public bytecode commitment (#20254)
fix(avm)!: pre-audit note-hash-tree-check (#20386)
chore(avm)!: ff_gt pre-audit (#20442)
fix(avm)!: rename unencrypted log to public log (#20344)
chore: Pre audit L1ToL2MsgTreeCheck (#20443)
chore(avm)!: Bytecode Decomposition pre-audit docs (#20120)
END_COMMIT_OVERRIDE

Author: fcarreiro

avm-transpiler/src/opcodes.rs

@@ -63,7 +63,7 @@ pub enum AvmOpcode {
     EMITNULLIFIER,
     L1TOL2MSGEXISTS,
     GETCONTRACTINSTANCE,
-    EMITUNENCRYPTEDLOG,
+    EMITPUBLICLOG,
     SENDL2TOL1MSG,
     // External calls
     CALL,
@@ -155,7 +155,7 @@ impl AvmOpcode {
             AvmOpcode::L1TOL2MSGEXISTS => "L1TOL2MSGEXISTS", // Messages
 
             // Accrued Substate
-            AvmOpcode::EMITUNENCRYPTEDLOG => "EMITUNENCRYPTEDLOG",
+            AvmOpcode::EMITPUBLICLOG => "EMITPUBLICLOG",
             AvmOpcode::SENDL2TOL1MSG => "SENDL2TOL1MSG",
             AvmOpcode::GETCONTRACTINSTANCE => "GETCONTRACTINSTANCE",
 

avm-transpiler/src/transpile.rs

@@ -542,8 +542,8 @@ fn handle_foreign_call(
         "avmOpcodeStaticCall" => {
             handle_external_call(avm_instrs, destinations, inputs, AvmOpcode::STATICCALL);
         }
-        "avmOpcodeEmitUnencryptedLog" => {
-            handle_emit_unencrypted_log(avm_instrs, destinations, inputs);
+        "avmOpcodeEmitPublicLog" => {
+            handle_emit_public_log(avm_instrs, destinations, inputs);
         }
         "avmOpcodeNoteHashExists" => handle_note_hash_exists(avm_instrs, destinations, inputs),
         "avmOpcodeEmitNoteHash" | "avmOpcodeEmitNullifier" => handle_emit_note_hash_or_nullifier(
@@ -697,14 +697,14 @@ fn handle_note_hash_exists(
     });
 }
 
-fn handle_emit_unencrypted_log(
+fn handle_emit_public_log(
     avm_instrs: &mut Vec<AvmInstruction>,
     destinations: &[ValueOrArray],
     inputs: &[ValueOrArray],
 ) {
     if !destinations.is_empty() || inputs.len() != 2 {
         panic!(
-            "Transpiler expects ForeignCall::EMITUNENCRYPTEDLOG to have 0 destinations and 2 inputs, got {} and {}",
+            "Transpiler expects ForeignCall::EMITPUBLICLOG to have 0 destinations and 2 inputs, got {} and {}",
             destinations.len(),
             inputs.len()
         );
@@ -714,10 +714,10 @@ fn handle_emit_unencrypted_log(
     // The length field is redundant and we skipt it.
     let (message_offset, message_size_offset) = match &inputs[1] {
         ValueOrArray::HeapVector(vec) => (vec.pointer, vec.size),
-        _ => panic!("Unexpected inputs for ForeignCall::EMITUNENCRYPTEDLOG: {:?}", inputs),
+        _ => panic!("Unexpected inputs for ForeignCall::EMITPUBLICLOG: {:?}", inputs),
     };
     avm_instrs.push(AvmInstruction {
-        opcode: AvmOpcode::EMITUNENCRYPTEDLOG,
+        opcode: AvmOpcode::EMITPUBLICLOG,
         // The message array from Brillig is indirect (addressing mode).
         addressing_mode: Some(
             AddressingModeBuilder::default()

barretenberg/cpp/pil/vm2/bytecode/bc_decomposition.pil

@@ -106,9 +106,20 @@ namespace bc_hashing;
     // We need 3 packed fields to use as inputs for each poseidon round
     pol commit packed_fields_0, packed_fields_1, packed_fields_2;
 
-    // At the start of a new bytecode hash, the initial field has to be the separator, and we skip the lookup:
-    #[START_IS_SEPARATOR]
-    start * (packed_fields_0 - constants.DOM_SEP__PUBLIC_BYTECODE) = 0;
+    // Only constrained at start for the prepended field:
+    pol commit size_in_bytes;
+    #[BYTECODE_LENGTH_BYTES]
+    start { precomputed.zero, bytecode_id, size_in_bytes }
+    is
+    bc_decomposition.start { bc_decomposition.pc, bc_decomposition.id, bc_decomposition.bytes_remaining };
+
+    // At the start of a new bytecode hash, the initial field has to be the size appended to the separator, and we skip the lookup
+    // fetching a field from decomposition. NOTE: size_in_bytes is constrained to be less than MAX_PACKED_PUBLIC_BYTECODE_SIZE_IN_FIELDS (= 3000) * 31 at the contract registration
+    // level, so the below should never overflow.
+    pol FIRST_FIELD = constants.DOM_SEP__PUBLIC_BYTECODE + size_in_bytes * 2**32;
+
+    #[START_IS_FIRST_FIELD]
+    start * (packed_fields_0 - FIRST_FIELD) = 0;
 
     #[GET_PACKED_FIELD_0]
     sel_not_start { pc_index, bytecode_id, packed_fields_0 }
@@ -222,12 +233,12 @@ namespace bc_hashing;
         sel_not_padding_2 * pc_index_2 // no padding ==> pc_at_final_field = pc_index_2
     ) = 0;
 
-    // The length of the hashed bytecode in fields, including the prepended separator. We use it to look up into poseidon_2 to ensure that
+    // The length of the hashed bytecode in fields, including the prepended field. We use it to look up into poseidon_2 to ensure that
     // the hashed IV matches our bytecode length.
     // Note: this is constrained at the final row (latch) by linking it to the pc_at_final_field (see above lookups/relations).
     pol commit input_len;
 
-    // Minus one for the separator field not present in bc_decomposition, and one to include the final field (pc_at_final_field marks the beginning of the last field).
+    // Minus one for the initial field not present in bc_decomposition, and one to include the final field (pc_at_final_field marks the beginning of the last field).
     // Note: this shouldn't underflow as we don't handle empty bytecode.
     #[BYTECODE_LENGTH_FIELDS]
     latch * (31 * (input_len - 2) - pc_at_final_field) = 0;
@@ -268,7 +279,7 @@ namespace bc_hashing;
     // a row with latch == 1 before we meet start == 1 when we go up. This shows that bytecode_id,
     // pc_index, and incremental_hash evolution did not deviate from the happy path.
     // When we reach a row with start == 1 (we know we must reach one thanks to #[START_AFTER_LATCH]
-    // enforces it on the second row.), then #[START_IS_SEPARATOR] implies that pc_index and packed_fields
+    // enforces it on the second row.), then #[START_IS_FIRST_FIELD] implies that pc_index and packed_fields
     // are correctly initialized. Note also that thanks #[TRACE_CONTINUITY] and #[GET_PACKED_FIELD_i]
     // we retrieved packed_field_i at the right pc_index_i from bc_decomposition sub-trace.
     // We remark that before reaching another latch, a prover might add additional rows without

barretenberg/cpp/pil/vm2/bytecode/bc_hashing.pil

@@ -54,7 +54,7 @@ namespace constants;
     pol AVM_SUBTRACE_ID_RETURNDATA_COPY = 32;
     pol AVM_SUBTRACE_ID_SET = 64;
     pol AVM_SUBTRACE_ID_GETCONTRACTINSTANCE = 128;
-    pol AVM_SUBTRACE_ID_EMITUNENCRYPTEDLOG = 256;
+    pol AVM_SUBTRACE_ID_EMITPUBLICLOG = 256;
     pol AVM_SUBTRACE_ID_POSEIDON2_PERM = 512;
     pol AVM_SUBTRACE_ID_SHA256_COMPRESSION = 1024;
     pol AVM_SUBTRACE_ID_KECCAKF1600 = 2048;
@@ -64,7 +64,7 @@ namespace constants;
     pol AVM_DYN_GAS_ID_RETURNDATACOPY = 2;
     pol AVM_DYN_GAS_ID_TORADIX = 4;
     pol AVM_DYN_GAS_ID_BITWISE = 8;
-    pol AVM_DYN_GAS_ID_EMITUNENCRYPTEDLOG = 16;
+    pol AVM_DYN_GAS_ID_EMITPUBLICLOG = 16;
     pol AVM_DYN_GAS_ID_SSTORE = 32;
     pol AVM_EXEC_OP_ID_GETENVVAR = 1;
     pol AVM_EXEC_OP_ID_MOV = 2;

barretenberg/cpp/pil/vm2/constants_gen.pil

@@ -111,11 +111,11 @@ namespace execution;
     pol commit retrieved_bytecodes_tree_size;
 
     // Prev side effects state
-    pol commit prev_num_unencrypted_log_fields;
+    pol commit prev_num_public_log_fields;
     pol commit prev_num_l2_to_l1_messages;
 
     // Next side effects state
-    pol commit num_unencrypted_log_fields;
+    pol commit num_public_log_fields;
     pol commit num_l2_to_l1_messages;
 
     // ==== Helper columns ====
@@ -662,7 +662,7 @@ namespace execution;
         written_public_data_slots_tree_root,
         written_public_data_slots_tree_size,
         // Retrieved bytecodes tree is not commited and restored, since it's a tx global state.
-        num_unencrypted_log_fields,
+        num_public_log_fields,
         num_l2_to_l1_messages
     } is // Crucial to be a permutation to prevent malicious insertions in the context stack.
     context_stack.sel {
@@ -693,7 +693,7 @@ namespace execution;
         context_stack.public_data_tree_size,
         context_stack.written_public_data_slots_tree_root,
         context_stack.written_public_data_slots_tree_size,
-        context_stack.num_unencrypted_log_fields,
+        context_stack.num_public_log_fields,
         context_stack.num_l2_to_l1_messages
     };
 
@@ -731,7 +731,7 @@ namespace execution;
         prev_public_data_tree_size',
         prev_written_public_data_slots_tree_root',
         prev_written_public_data_slots_tree_size',
-        prev_num_unencrypted_log_fields',
+        prev_num_public_log_fields',
         prev_num_l2_to_l1_messages'
     } in // Lookup is fine during a pop/read operation. (permutation would not work because not every context is rolled back.)
     context_stack.sel {
@@ -762,7 +762,7 @@ namespace execution;
         context_stack.public_data_tree_size,
         context_stack.written_public_data_slots_tree_root,
         context_stack.written_public_data_slots_tree_size,
-        context_stack.num_unencrypted_log_fields,
+        context_stack.num_public_log_fields,
         context_stack.num_l2_to_l1_messages
     };
 
@@ -896,8 +896,8 @@ namespace execution;
     NOT_LAST_NOT_FAILURE_NOT_ENQ_END * (written_public_data_slots_tree_root - prev_written_public_data_slots_tree_root') = 0;
     #[WRITTEN_PUBLIC_DATA_SLOTS_TREE_SIZE_CONTINUITY]
     NOT_LAST_NOT_FAILURE_NOT_ENQ_END * (written_public_data_slots_tree_size - prev_written_public_data_slots_tree_size') = 0;
-    #[NUM_UNENCRYPTED_LOGS_CONTINUITY]
-    NOT_LAST_NOT_FAILURE_NOT_ENQ_END * (num_unencrypted_log_fields - prev_num_unencrypted_log_fields') = 0;
+    #[NUM_PUBLIC_LOGS_CONTINUITY]
+    NOT_LAST_NOT_FAILURE_NOT_ENQ_END * (num_public_log_fields - prev_num_public_log_fields') = 0;
     #[NUM_L2_TO_L1_MESSAGES_CONTINUITY]
     NOT_LAST_NOT_FAILURE_NOT_ENQ_END * (num_l2_to_l1_messages - prev_num_l2_to_l1_messages') = 0;
 

barretenberg/cpp/pil/vm2/context.pil

@@ -57,5 +57,5 @@ namespace context_stack;
     pol commit written_public_data_slots_tree_size;
 
     // Side effects state
-    pol commit num_unencrypted_log_fields;
+    pol commit num_public_log_fields;
     pol commit num_l2_to_l1_messages;

barretenberg/cpp/pil/vm2/context_stack.pil

@@ -49,7 +49,7 @@ include "opcodes/emit_notehash.pil";
 include "opcodes/l1_to_l2_message_exists.pil";
 include "opcodes/nullifier_exists.pil";
 include "opcodes/emit_nullifier.pil";
-include "opcodes/emit_unencrypted_log.pil";
+include "opcodes/emit_public_log.pil";
 include "opcodes/send_l2_to_l1_msg.pil";
 
 /**
@@ -430,23 +430,23 @@ pol commit sel_gas_calldata_copy; // @boolean
 pol commit sel_gas_returndata_copy; // @boolean
 pol commit sel_gas_to_radix; // @boolean
 pol commit sel_gas_bitwise; // @boolean
-pol commit sel_gas_emit_unencrypted_log; // @boolean
+pol commit sel_gas_emit_public_log; // @boolean
 pol commit sel_gas_sstore; // @boolean
 
 // Bolean constraints
 sel_gas_calldata_copy * (1 - sel_gas_calldata_copy) = 0;
 sel_gas_returndata_copy * (1 - sel_gas_returndata_copy) = 0;
 sel_gas_to_radix * (1 - sel_gas_to_radix) = 0;
 sel_gas_bitwise * (1 - sel_gas_bitwise) = 0;
-sel_gas_emit_unencrypted_log * (1 - sel_gas_emit_unencrypted_log) = 0;
+sel_gas_emit_public_log * (1 - sel_gas_emit_public_log) = 0;
 sel_gas_sstore * (1 - sel_gas_sstore) = 0;
 
 #[DYN_GAS_ID_DECOMPOSITION]
 sel_gas_calldata_copy * constants.AVM_DYN_GAS_ID_CALLDATACOPY +
 sel_gas_returndata_copy * constants.AVM_DYN_GAS_ID_RETURNDATACOPY +
 sel_gas_to_radix * constants.AVM_DYN_GAS_ID_TORADIX +
 sel_gas_bitwise * constants.AVM_DYN_GAS_ID_BITWISE +
-sel_gas_emit_unencrypted_log * constants.AVM_DYN_GAS_ID_EMITUNENCRYPTEDLOG +
+sel_gas_emit_public_log * constants.AVM_DYN_GAS_ID_EMITPUBLICLOG +
 sel_gas_sstore * constants.AVM_DYN_GAS_ID_SSTORE
    // We force the selectors to be 0 if we failed before gas checks
    // or when we are not in the execution subtrace.
@@ -535,26 +535,26 @@ sel_gas_sstore {
 };
 
 ///////////////////////////////////////////////////////////////////////////////
-// EMITUNENCRYPTEDLOG, CALLDATACOPY, RETURNDATACOPY, Dynamic Gas Calculation
+// EMITPUBLICLOG, CALLDATACOPY, RETURNDATACOPY, Dynamic Gas Calculation
 ///////////////////////////////////////////////////////////////////////////////
 
 // #[DYN_GAS_ID_DECOMPOSITION] ensures that the gas selectors are mutually exclusive.
-// register[0] is the log size for emit_unencrypted_log, the calldata/returndata size for call_data_copy/returndata_copy.
-(sel_gas_emit_unencrypted_log + sel_gas_calldata_copy + sel_gas_returndata_copy) * (register[0] - dynamic_l2_gas_factor) = 0;
+// register[0] is the log size for emit_public_log, the calldata/returndata size for call_data_copy/returndata_copy.
+(sel_gas_emit_public_log + sel_gas_calldata_copy + sel_gas_returndata_copy) * (register[0] - dynamic_l2_gas_factor) = 0;
 
-sel_gas_emit_unencrypted_log * (/*log_size=*/ register[0] - dynamic_da_gas_factor) = 0;
+sel_gas_emit_public_log * (/*log_size=*/ register[0] - dynamic_da_gas_factor) = 0;
 
 ///////////////////////////////////////////////////////////////////////////////
 // Dynamic L2/DA Gas Calculation is ZERO for all other cases
 ///////////////////////////////////////////////////////////////////////////////
 
-// Except SSTORE, EMITUNENCRYPTEDLOG, all opcodes have a zero dynamic da gas.
+// Except SSTORE, EMITPUBLICLOG, all opcodes have a zero dynamic da gas.
 #[DYN_DA_GAS_IS_ZERO]
-(1 - sel_gas_sstore - sel_gas_emit_unencrypted_log) * dynamic_da_gas_factor = 0;
+(1 - sel_gas_sstore - sel_gas_emit_public_log) * dynamic_da_gas_factor = 0;
 
-// Except BITWISE, TORADIX, EMITUNENCRYPTEDLOG, CALLDATACOPY, RETURNDATACOPY, all opcodes have a zero dynamic l2 gas.
+// Except BITWISE, TORADIX, EMITPUBLICLOG, CALLDATACOPY, RETURNDATACOPY, all opcodes have a zero dynamic l2 gas.
 #[DYN_L2_GAS_IS_ZERO]
-(1 - sel_gas_bitwise - sel_gas_to_radix - sel_gas_emit_unencrypted_log - sel_gas_calldata_copy - sel_gas_returndata_copy) * dynamic_l2_gas_factor = 0;
+(1 - sel_gas_bitwise - sel_gas_to_radix - sel_gas_emit_public_log - sel_gas_calldata_copy - sel_gas_returndata_copy) * dynamic_l2_gas_factor = 0;
 
 /**************************************************************************************************
  *  Temporality group 5: Opcode execution
@@ -582,7 +582,7 @@ pol commit sel_exec_dispatch_calldata_copy; // @boolean
 pol commit sel_exec_dispatch_returndata_copy; // @boolean
 pol commit sel_exec_dispatch_set; // @boolean
 pol commit sel_exec_dispatch_get_contract_instance; // @boolean
-pol commit sel_exec_dispatch_emit_unencrypted_log; // @boolean
+pol commit sel_exec_dispatch_emit_public_log; // @boolean
 pol commit sel_exec_dispatch_poseidon2_perm; // @boolean
 pol commit sel_exec_dispatch_sha256_compression; // @boolean
 pol commit sel_exec_dispatch_keccakf1600; // @boolean
@@ -598,7 +598,7 @@ sel_exec_dispatch_calldata_copy * (1 - sel_exec_dispatch_calldata_copy) = 0;
 sel_exec_dispatch_returndata_copy * (1 - sel_exec_dispatch_returndata_copy) = 0;
 sel_exec_dispatch_set * (1 - sel_exec_dispatch_set) = 0;
 sel_exec_dispatch_get_contract_instance * (1 - sel_exec_dispatch_get_contract_instance) = 0;
-sel_exec_dispatch_emit_unencrypted_log * (1 - sel_exec_dispatch_emit_unencrypted_log) = 0;
+sel_exec_dispatch_emit_public_log * (1 - sel_exec_dispatch_emit_public_log) = 0;
 sel_exec_dispatch_poseidon2_perm * (1 - sel_exec_dispatch_poseidon2_perm) = 0;
 sel_exec_dispatch_sha256_compression * (1 - sel_exec_dispatch_sha256_compression) = 0;
 sel_exec_dispatch_keccakf1600 * (1 - sel_exec_dispatch_keccakf1600) = 0;
@@ -615,7 +615,7 @@ sel_exec_dispatch_calldata_copy * constants.AVM_SUBTRACE_ID_CALLDATA_COPY +
 sel_exec_dispatch_returndata_copy * constants.AVM_SUBTRACE_ID_RETURNDATA_COPY +
 sel_exec_dispatch_set * constants.AVM_SUBTRACE_ID_SET +
 sel_exec_dispatch_get_contract_instance * constants.AVM_SUBTRACE_ID_GETCONTRACTINSTANCE +
-sel_exec_dispatch_emit_unencrypted_log * constants.AVM_SUBTRACE_ID_EMITUNENCRYPTEDLOG +
+sel_exec_dispatch_emit_public_log * constants.AVM_SUBTRACE_ID_EMITPUBLICLOG +
 sel_exec_dispatch_poseidon2_perm * constants.AVM_SUBTRACE_ID_POSEIDON2_PERM +
 sel_exec_dispatch_sha256_compression * constants.AVM_SUBTRACE_ID_SHA256_COMPRESSION +
 sel_exec_dispatch_keccakf1600 * constants.AVM_SUBTRACE_ID_KECCAKF1600 +
@@ -765,8 +765,8 @@ sel_execute_returndata_size * (mem_tag_reg[0] - constants.MEM_TAG_U32) = 0; // W
 (1 - sel_execute_emit_nullifier) * (prev_nullifier_tree_size - nullifier_tree_size) = 0;
 #[NUM_NULLIFIERS_EMITTED_NOT_CHANGED]
 (1 - sel_execute_emit_nullifier) * (prev_num_nullifiers_emitted - num_nullifiers_emitted) = 0;
-#[NUM_UNENCRYPTED_LOGS_NOT_CHANGED]
-(1 - sel_exec_dispatch_emit_unencrypted_log) * (prev_num_unencrypted_log_fields - num_unencrypted_log_fields) = 0;
+#[NUM_PUBLIC_LOGS_NOT_CHANGED]
+(1 - sel_exec_dispatch_emit_public_log) * (prev_num_public_log_fields - num_public_log_fields) = 0;
 #[NUM_L2_TO_L1_MESSAGES_NOT_CHANGED]
 (1 - sel_execute_send_l2_to_l1_msg) * (prev_num_l2_to_l1_messages - num_l2_to_l1_messages) = 0;
 // Retrieved bytecodes tree state can only change in the first row of a new context
@@ -808,7 +808,7 @@ sel_opcode_error * (1 - sel_opcode_error) = 0;
  // - RETURNDATA_COPY: #[DISPATCH_TO_RD_COPY]
  // - SET: #[DISPATCH_TO_SET]
  // - GET_CONTRACT_INSTANCE: #[DISPATCH_TO_GET_CONTRACT_INSTANCE]
- // - EMIT_UNENCRYPTED_LOG: #[DISPATCH_TO_EMIT_UNENCRYPTED_LOG]
+ // - EMIT_PUBLIC_LOG: #[DISPATCH_TO_EMIT_PUBLIC_LOG]
  // - POSEIDON2_PERM: #[DISPATCH_TO_POSEIDON2_PERM]
  // - SHA256_COMPRESSION: #[DISPATCH_TO_SHA256_COMPRESSION]
  // - KECCAKF1600: #[DISPATCH_TO_KECCAKF1600]
@@ -996,8 +996,8 @@ sel_exec_dispatch_get_contract_instance {
     get_contract_instance.sel_error
 };
 
-#[DISPATCH_TO_EMIT_UNENCRYPTED_LOG]
-sel_exec_dispatch_emit_unencrypted_log {
+#[DISPATCH_TO_EMIT_PUBLIC_LOG]
+sel_exec_dispatch_emit_public_log {
         clk,
         context_id,
         // Message offset
@@ -1006,23 +1006,23 @@ sel_exec_dispatch_emit_unencrypted_log {
         register[0],
         contract_address,
         // Context
-        prev_num_unencrypted_log_fields,
-        num_unencrypted_log_fields,
+        prev_num_public_log_fields,
+        num_public_log_fields,
         is_static,
         // Error
         sel_opcode_error,
         discard
-} is emit_unencrypted_log.start {
-        emit_unencrypted_log.execution_clk,
-        emit_unencrypted_log.space_id,
-        emit_unencrypted_log.log_address,
-        emit_unencrypted_log.log_size,
-        emit_unencrypted_log.contract_address,
-        emit_unencrypted_log.prev_num_unencrypted_log_fields,
-        emit_unencrypted_log.next_num_unencrypted_log_fields,
-        emit_unencrypted_log.is_static,
-        emit_unencrypted_log.error,
-        emit_unencrypted_log.discard
+} is emit_public_log.start {
+        emit_public_log.execution_clk,
+        emit_public_log.space_id,
+        emit_public_log.log_address,
+        emit_public_log.log_size,
+        emit_public_log.contract_address,
+        emit_public_log.prev_num_public_log_fields,
+        emit_public_log.next_num_public_log_fields,
+        emit_public_log.is_static,
+        emit_public_log.error,
+        emit_public_log.discard
 };
 
 #[DISPATCH_TO_POSEIDON2_PERM]

barretenberg/cpp/pil/vm2/execution.pil

@@ -73,7 +73,7 @@ namespace execution;
     // gt gadget requires both inputs to be bounded by 2^128.
     // prev_l2_gas_used is bounded by l2_gas_limit < 2^32
     // BASE_L2_GAS < 2^17
-    // dynamic_l2_gas_factor < 2^32 (for unencrypted logs and to_radix, 32-bit register)
+    // dynamic_l2_gas_factor < 2^32 (for public logs and to_radix, 32-bit register)
     // dynamic_l2_gas < 2^16
     // Then total_gas_l2 = prev_l2_gas_used + BASE_L2_GAS + dynamic_l2_gas_factor * dynamic_da_gas < 2^49
     // l2_gas_limit is 32 bits (see at the top of this file).