add feature-gated higher gas costs for SLH-DSA-SHA128s transactions

alinush · alinush · commit 325c0299dc2f · 2025-12-11T20:39:28.000-06:00
diff --git a/aptos-move/aptos-gas-meter/src/meter.rs b/aptos-move/aptos-gas-meter/src/meter.rs
@@ -617,6 +617,16 @@ where
             .charge_execution(KEYLESS_BASE_COST)
             .map_err(|e| e.finish(Location::Undefined))
     }
+
+    fn charge_slh_dsa_sha2_128s(&mut self) -> VMResult<()> {
+        if self.feature_version() < RELEASE_V1_41 {
+            return Ok(());
+        }
+
+        self.algebra
+            .charge_execution(SLH_DSA_SHA2_128S_BASE_COST)
+            .map_err(|e| e.finish(Location::Undefined))
+    }
 }
 
 impl<A> CacheValueSizes for StandardGasMeter<A>
diff --git a/aptos-move/aptos-gas-meter/src/traits.rs b/aptos-move/aptos-gas-meter/src/traits.rs
@@ -128,6 +128,10 @@ pub trait AptosGasMeter: MoveGasMeter {
     /// expensive computation required.
     fn charge_keyless(&mut self) -> VMResult<()>;
 
+    /// Charges an additional cost for SLH-DSA signature verification to compensate for the
+    /// expensive computation required (5x more expensive than ed25519).
+    fn charge_slh_dsa_sha2_128s(&mut self) -> VMResult<()>;
+
     /// Charges IO gas for the transaction itself.
     fn charge_io_gas_for_transaction(&mut self, txn_size: NumBytes) -> VMResult<()>;
 
diff --git a/aptos-move/aptos-gas-profiling/src/erased.rs b/aptos-move/aptos-gas-profiling/src/erased.rs
@@ -230,6 +230,8 @@ impl ExecutionAndIOCosts {
 
         nodes.push(Node::new("keyless", self.keyless_cost));
 
+        nodes.push(Node::new("slh_dsa_sha2_128s", self.slh_dsa_sha2_128s_cost));
+
         if !self.dependencies.is_empty() {
             let deps = Node::new_with_children(
                 "dependencies",
diff --git a/aptos-move/aptos-gas-profiling/src/flamegraph.rs b/aptos-move/aptos-gas-profiling/src/flamegraph.rs
@@ -106,6 +106,8 @@ impl ExecutionAndIOCosts {
 
         lines.push("keyless", self.keyless_cost);
 
+        lines.push("slh_dsa_sha2_128s", self.slh_dsa_sha2_128s_cost);
+
         let mut path = vec![];
 
         struct Rec<'a> {
diff --git a/aptos-move/aptos-gas-profiling/src/log.rs b/aptos-move/aptos-gas-profiling/src/log.rs
@@ -133,6 +133,7 @@ pub struct ExecutionAndIOCosts {
 
     pub intrinsic_cost: InternalGas,
     pub keyless_cost: InternalGas,
+    pub slh_dsa_sha2_128s_cost: InternalGas,
     pub dependencies: Vec<Dependency>,
     pub call_graph: CallFrame,
     pub transaction_transient: Option<InternalGas>,
@@ -265,6 +266,7 @@ impl ExecutionAndIOCosts {
 
         total += self.intrinsic_cost;
         total += self.keyless_cost;
+        total += self.slh_dsa_sha2_128s_cost;
 
         for dep in &self.dependencies {
             total += dep.cost;
diff --git a/aptos-move/aptos-gas-profiling/src/profiler.rs b/aptos-move/aptos-gas-profiling/src/profiler.rs
@@ -37,6 +37,7 @@ pub struct GasProfiler<G> {
 
     intrinsic_cost: Option<InternalGas>,
     keyless_cost: Option<InternalGas>,
+    slh_dsa_sha2_128s_cost: Option<InternalGas>,
     dependencies: Vec<Dependency>,
     frames: Vec<CallFrame>,
     transaction_transient: Option<InternalGas>,
@@ -94,6 +95,7 @@ impl<G> GasProfiler<G> {
 
             intrinsic_cost: None,
             keyless_cost: None,
+            slh_dsa_sha2_128s_cost: None,
             dependencies: vec![],
             frames: vec![CallFrame::new_script()],
             transaction_transient: None,
@@ -114,6 +116,7 @@ impl<G> GasProfiler<G> {
 
             intrinsic_cost: None,
             keyless_cost: None,
+            slh_dsa_sha2_128s_cost: None,
             dependencies: vec![],
             frames: vec![CallFrame::new_function(module_id, func_name, ty_args)],
             transaction_transient: None,
@@ -702,9 +705,24 @@ where
     }
 
     fn charge_keyless(&mut self) -> VMResult<()> {
-        let (_cost, res) = self.delegate_charge(|base| base.charge_keyless());
+        let (cost, res) = self.delegate_charge(|base| base.charge_keyless());
 
-        // TODO: add keyless
+        // TODO: Is this right? (Do not understand the semantics here.)
+        if res.is_ok() {
+            self.keyless_cost = Some(self.keyless_cost.unwrap_or_else(|| 0.into()) + cost);
+        }
+
+        res
+    }
+
+    fn charge_slh_dsa_sha2_128s(&mut self) -> VMResult<()> {
+        let (cost, res) = self.delegate_charge(|base| base.charge_slh_dsa_sha2_128s());
+
+        // TODO: Is this right? (Do not understand the semantics here.)
+        if res.is_ok() {
+            self.slh_dsa_sha2_128s_cost =
+                Some(self.slh_dsa_sha2_128s_cost.unwrap_or_else(|| 0.into()) + cost);
+        }
 
         res
     }
@@ -726,6 +744,7 @@ where
             total: self.algebra().execution_gas_used() + self.algebra().io_gas_used(),
             intrinsic_cost: self.intrinsic_cost.unwrap_or_else(|| 0.into()),
             keyless_cost: self.keyless_cost.unwrap_or_else(|| 0.into()),
+            slh_dsa_sha2_128s_cost: self.slh_dsa_sha2_128s_cost.unwrap_or_else(|| 0.into()),
             dependencies: self.dependencies,
             call_graph: self.frames.pop().expect("frame must exist"),
             transaction_transient: self.transaction_transient,
diff --git a/aptos-move/aptos-gas-profiling/src/report.rs b/aptos-move/aptos-gas-profiling/src/report.rs
@@ -135,6 +135,23 @@ impl TransactionGasLog {
             data.insert("keyless-percentage".to_string(), json!(percentage));
         }
 
+        // SLH-DSA-SHA2-128s cost
+        if !self.exec_io.slh_dsa_sha2_128s_cost.is_zero() {
+            let cost_scaled = format!(
+                "{:.8}",
+                (u64::from(self.exec_io.slh_dsa_sha2_128s_cost) as f64 / scaling_factor)
+            );
+            let percentage = format!(
+                "{:.2}%",
+                u64::from(self.exec_io.slh_dsa_sha2_128s_cost) as f64 / total_exec_io * 100.0
+            );
+            data.insert("slh_dsa_sha2_128s".to_string(), json!(cost_scaled));
+            data.insert(
+                "slh_dsa_sha2_128s-percentage".to_string(),
+                json!(percentage),
+            );
+        }
+
         let mut deps = self.exec_io.dependencies.clone();
         deps.sort_by(|lhs, rhs| rhs.cost.cmp(&lhs.cost));
         data.insert(
diff --git a/aptos-move/aptos-gas-profiling/src/unique_stack.rs b/aptos-move/aptos-gas-profiling/src/unique_stack.rs
@@ -81,6 +81,7 @@ impl ExecutionAndIOCosts {
             total: self.total + other.total,
             intrinsic_cost: self.intrinsic_cost + other.intrinsic_cost,
             keyless_cost: self.keyless_cost + other.keyless_cost,
+            slh_dsa_sha2_128s_cost: self.slh_dsa_sha2_128s_cost + other.slh_dsa_sha2_128s_cost,
             dependencies: dependencies
                 .into_iter()
                 .map(|((kind, id, size), cost)| Dependency {
diff --git a/aptos-move/aptos-gas-profiling/templates/index.html b/aptos-move/aptos-gas-profiling/templates/index.html
@@ -88,6 +88,11 @@ <h4>Keyless Cost</h4>
         {{keyless}} gas units, {{keyless-percentage}} of the total cost for execution & IO.
         {{/if}}
 
+        {{#if slh_dsa_sha2_128s}}
+        <h4>SLH-DSA-SHA2-128s Cost</h4>
+        {{slh_dsa_sha2_128s}} gas units, {{slh_dsa_sha2_128s-percentage}} of the total cost for execution & IO.
+        {{/if}}
+
         <h4>Dependencies</h4>
         {{#if deps}}
         <table>
diff --git a/aptos-move/aptos-gas-schedule/src/gas_schedule/transaction.rs b/aptos-move/aptos-gas-schedule/src/gas_schedule/transaction.rs
@@ -8,6 +8,7 @@ use crate::{
     gas_schedule::VMGasParameters,
     ver::gas_feature_versions::{
         RELEASE_V1_10, RELEASE_V1_11, RELEASE_V1_12, RELEASE_V1_13, RELEASE_V1_15, RELEASE_V1_26,
+        RELEASE_V1_41,
     },
 };
 use aptos_gas_algebra::{
@@ -275,7 +276,12 @@ crate::gas_schedule::macros::define_gas_parameters!(
             max_aa_gas: Gas,
             { RELEASE_V1_26.. => "max_aa_gas" },
             60,
-        ]
+        ],
+        [
+            slh_dsa_sha2_128s_base_cost: InternalGas,
+            { RELEASE_V1_41.. => "slh_dsa_sha2_128s.base" },
+            13_800_000,
+        ],
     ]
 );
 
diff --git a/aptos-move/aptos-gas-schedule/src/ver.rs b/aptos-move/aptos-gas-schedule/src/ver.rs
@@ -8,9 +8,10 @@
 ///   - Changing how gas is calculated in any way
 ///
 /// Change log:
+/// - V41:
+///    - Gas charging for SLH-DSA-SHA2-128s signature verification
 /// - V31:
 ///    - Gas charging for modules used in type tags
-///
 /// - V22
 ///    - Gas parameters for enums
 ///    - Gas parameters for new native function `bcs::serialized_size`
@@ -72,7 +73,7 @@
 ///       global operations.
 /// - V1
 ///   - TBA
-pub const LATEST_GAS_FEATURE_VERSION: u64 = gas_feature_versions::RELEASE_V1_40;
+pub const LATEST_GAS_FEATURE_VERSION: u64 = gas_feature_versions::RELEASE_V1_41;
 
 pub mod gas_feature_versions {
     pub const RELEASE_V1_8: u64 = 11;
@@ -107,4 +108,5 @@ pub mod gas_feature_versions {
     pub const RELEASE_V1_38: u64 = 42;
     pub const RELEASE_V1_39: u64 = 43;
     pub const RELEASE_V1_40: u64 = 44;
+    pub const RELEASE_V1_41: u64 = 45;
 }
diff --git a/aptos-move/aptos-memory-usage-tracker/src/lib.rs b/aptos-move/aptos-memory-usage-tracker/src/lib.rs
@@ -595,5 +595,7 @@ where
         fn charge_intrinsic_gas_for_transaction(&mut self, txn_size: NumBytes) -> VMResult<()>;
 
         fn charge_keyless(&mut self) -> VMResult<()>;
+
+        fn charge_slh_dsa_sha2_128s(&mut self) -> VMResult<()>;
     }
 }
diff --git a/aptos-move/aptos-vm/src/aptos_vm.rs b/aptos-move/aptos-vm/src/aptos_vm.rs
@@ -1032,6 +1032,9 @@ impl AptosVM {
         if txn_data.is_keyless() {
             gas_meter.charge_keyless()?;
         }
+        if txn_data.is_slh_dsa_sha2_128s() {
+            gas_meter.charge_slh_dsa_sha2_128s()?;
+        }
 
         match executable {
             TransactionExecutableRef::Script(script) => {
@@ -1187,6 +1190,9 @@ impl AptosVM {
         if txn_data.is_keyless() {
             gas_meter.charge_keyless()?;
         }
+        if txn_data.is_slh_dsa_sha2_128s() {
+            gas_meter.charge_slh_dsa_sha2_128s()?;
+        }
 
         // Step 1: Obtain the payload. If any errors happen here, the entire transaction should fail
         let invariant_violation_error = || {
diff --git a/aptos-move/aptos-vm/src/gas.rs b/aptos-move/aptos-vm/src/gas.rs
@@ -5,8 +5,9 @@ use crate::{move_vm_ext::AptosMoveResolver, transaction_metadata::TransactionMet
 use aptos_gas_algebra::{Gas, GasExpression, InternalGas};
 use aptos_gas_meter::{StandardGasAlgebra, StandardGasMeter};
 use aptos_gas_schedule::{
-    gas_feature_versions::RELEASE_V1_13, gas_params::txn::KEYLESS_BASE_COST, AptosGasParameters,
-    VMGasParameters,
+    gas_feature_versions::RELEASE_V1_13,
+    gas_params::txn::{KEYLESS_BASE_COST, SLH_DSA_SHA2_128S_BASE_COST},
+    AptosGasParameters, VMGasParameters,
 };
 use aptos_logger::{enabled, Level};
 use aptos_memory_usage_tracker::MemoryTrackedGasMeter;
@@ -125,10 +126,16 @@ pub(crate) fn check_gas(
     } else {
         InternalGas::zero()
     };
+    let slh_dsa_sha2_128s = if txn_metadata.is_slh_dsa_sha2_128s() {
+        SLH_DSA_SHA2_128S_BASE_COST.evaluate(gas_feature_version, &gas_params.vm)
+    } else {
+        InternalGas::zero()
+    };
     let intrinsic_gas = txn_gas_params
         .calculate_intrinsic_gas(raw_bytes_len)
         .evaluate(gas_feature_version, &gas_params.vm);
-    let total_rounded: Gas = (intrinsic_gas + keyless).to_unit_round_up_with_params(txn_gas_params);
+    let total_rounded: Gas =
+        (intrinsic_gas + keyless + slh_dsa_sha2_128s).to_unit_round_up_with_params(txn_gas_params);
     if txn_metadata.max_gas_amount() < total_rounded {
         speculative_warn!(
             log_context,
diff --git a/aptos-move/aptos-vm/src/transaction_metadata.rs b/aptos-move/aptos-vm/src/transaction_metadata.rs
@@ -32,6 +32,7 @@ pub struct TransactionMetadata {
     pub script_hash: Vec<u8>,
     pub script_size: NumBytes,
     pub is_keyless: bool,
+    pub is_slh_dsa_sha2_128s: bool,
     pub entry_function_payload: Option<EntryFunction>,
     pub multisig_payload: Option<Multisig>,
     // Index of the transaction in the block.
@@ -78,6 +79,15 @@ impl TransactionMetadata {
             is_keyless: aptos_types::keyless::get_authenticators(txn)
                 .map(|res| !res.is_empty())
                 .unwrap_or(false),
+            is_slh_dsa_sha2_128s: txn
+                .authenticator_ref()
+                .to_single_key_authenticators()
+                .map(|authenticators| {
+                    authenticators
+                        .iter()
+                        .any(|auth| matches!(auth.signature(), aptos_types::transaction::authenticator::AnySignature::SlhDsa_Sha2_128s { .. }))
+                })
+                .unwrap_or(false),
             entry_function_payload: if txn.payload().is_multisig() {
                 None
             } else if let Ok(TransactionExecutableRef::EntryFunction(e)) =
@@ -183,6 +193,10 @@ impl TransactionMetadata {
         self.is_keyless
     }
 
+    pub fn is_slh_dsa_sha2_128s(&self) -> bool {
+        self.is_slh_dsa_sha2_128s
+    }
+
     pub fn entry_function_payload(&self) -> Option<EntryFunction> {
         self.entry_function_payload.clone()
     }
