diff --git a/trie/proof.go b/trie/proof.go
index a7874afd35b..e8ba8be7eb6 100644
--- a/trie/proof.go
+++ b/trie/proof.go
@@ -487,6 +487,10 @@ func VerifyRangeProof(rootHash common.Hash, firstKey []byte, keys [][]byte, valu
}
// Ensure the received batch is monotonic increasing and contains no deletions
for i := 0; i < len(keys)-1; i++ {
+ // See: https://github.com/ava-labs/coreth/issues/907
+ if len(keys[i]) != len(keys[i+1]) {
+ return false, errKeysHaveDifferentLengths
+ }
if bytes.Compare(keys[i], keys[i+1]) >= 0 {
return false, errors.New("range is not monotonically increasing")
}
diff --git a/trie/proof.libevm.go b/trie/proof.libevm.go
new file mode 100644
index 00000000000..b7b63ac66a1
--- /dev/null
+++ b/trie/proof.libevm.go
@@ -0,0 +1,23 @@
+// Copyright 2025 the libevm authors.
+//
+// The libevm additions to go-ethereum are free software: you can redistribute
+// them and/or modify them under the terms of the GNU Lesser General Public License
+// as published by the Free Software Foundation, either version 3 of the License,
+// or (at your option) any later version.
+//
+// The libevm additions are distributed in the hope that they will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser
+// General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public License
+// along with the go-ethereum library. If not, see
+// .
+
+package trie
+
+import (
+ "errors"
+)
+
+var errKeysHaveDifferentLengths = errors.New("keys have different lengths")
diff --git a/trie/proof.libevm_test.go b/trie/proof.libevm_test.go
new file mode 100644
index 00000000000..17b2ddc398d
--- /dev/null
+++ b/trie/proof.libevm_test.go
@@ -0,0 +1,48 @@
+// Copyright 2025 the libevm authors.
+//
+// The libevm additions to go-ethereum are free software: you can redistribute
+// them and/or modify them under the terms of the GNU Lesser General Public License
+// as published by the Free Software Foundation, either version 3 of the License,
+// or (at your option) any later version.
+//
+// The libevm additions are distributed in the hope that they will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser
+// General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public License
+// along with the go-ethereum library. If not, see
+// .
+
+package trie
+
+import (
+ "testing"
+
+ "github.com/stretchr/testify/require"
+
+ "github.com/ava-labs/libevm/common"
+)
+
+func TestRangeProofKeysWithDifferentLengths(t *testing.T) {
+ var (
+ root = common.HexToHash("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
+ start = common.Hex2Bytes("0000000000000000000000000000000000000000000000000000000000000000")
+ keys = [][]byte{
+ common.Hex2Bytes("1000000000000000000000000000000"),
+ common.Hex2Bytes("1000000000000000000000000000000000000000000000000000000000000000"),
+ }
+ values = [][]byte{
+ common.Hex2Bytes("02"),
+ common.Hex2Bytes("03"),
+ }
+ )
+ _, err := VerifyRangeProof(
+ root,
+ start,
+ keys,
+ values,
+ nil, // force it to use stacktrie
+ )
+ require.ErrorIs(t, err, errKeysHaveDifferentLengths)
+}