vm/eip6110: log layout check

Author: jochem-brouwer

packages/vm/src/requests.ts

@@ -5,6 +5,7 @@ import {
   EthereumJSErrorWithoutCode,
   bigIntToAddressBytes,
   bigIntToBytes,
+  bytesToBigInt,
   bytesToHex,
   bytesToInt,
   concatBytes,
@@ -16,6 +17,18 @@ import type { RunTxResult } from './types.ts'
 import type { VM } from './vm.ts'
 
 const DEPOSIT_TOPIC = '0x649bbc62d0e31342afea4e5cd82d4049e7e1ee912fc0889aa790803be39038c5'
+const PUBKEY_OFFSET = BigInt(160)
+const WITHDRAWAL_CREDENTIALS_OFFSET = BigInt(256)
+const AMOUNT_OFFSET = BigInt(320)
+const SIGNATURE_OFFSET = BigInt(384)
+const INDEX_OFFSET = BigInt(512)
+const PUBKEY_SIZE = 48
+const WITHDRAWAL_CREDENTIALS_SIZE = 32
+const AMOUNT_SIZE = 8
+const SIGNATURE_SIZE = 96
+const INDEX_SIZE = 8
+const LOG_SIZE = 576
+const LOG_LAYOUT_MISMATCH = 'invalid deposit log: unsupported data layout'
 
 /**
  * This helper method generates a list of all CL requests that can be included in a pending block
@@ -158,6 +171,9 @@ const accumulateDepositsRequest = (
 }
 
 function parseDepositLog(requestData: Uint8Array) {
+  if (requestData.length !== LOG_SIZE) {
+    throw EthereumJSErrorWithoutCode(LOG_LAYOUT_MISMATCH)
+  }
   // Extracts validator pubkey, withdrawal credential, deposit amount, signature,
   // and validator index from Deposit Event log.
   // The event fields are non-indexed so contained in one byte array (log[2]) so parsing is as follows:
@@ -166,19 +182,46 @@ function parseDepositLog(requestData: Uint8Array) {
   // 3. Read 32 bytes starting with the first field position to get the size of the first field
   // 4. Read the bytes from first field position + 32 + the size of the first field to get the first field value
   // 5. Repeat steps 3-4 for each field
-  const pubKeyIdx = bytesToInt(requestData.slice(0, 32))
+  const pubKeyIdxBigInt = bytesToBigInt(requestData.slice(0, 32))
+  const withdrawalCreditsIdxBigInt = bytesToBigInt(requestData.slice(32, 64))
+  const amountIdxBigInt = bytesToBigInt(requestData.slice(64, 96))
+  const sigIdxBigInt = bytesToBigInt(requestData.slice(96, 128))
+  const indexIdxBigInt = bytesToBigInt(requestData.slice(128, 160))
+
+  if (
+    pubKeyIdxBigInt !== PUBKEY_OFFSET ||
+    withdrawalCreditsIdxBigInt !== WITHDRAWAL_CREDENTIALS_OFFSET ||
+    amountIdxBigInt !== AMOUNT_OFFSET ||
+    sigIdxBigInt !== SIGNATURE_OFFSET ||
+    indexIdxBigInt !== INDEX_OFFSET
+  ) {
+    throw EthereumJSErrorWithoutCode(LOG_LAYOUT_MISMATCH)
+  }
+
+  const pubKeyIdx = Number(pubKeyIdxBigInt)
+  const withdrawalCreditsIdx = Number(withdrawalCreditsIdxBigInt)
+  const amountIdx = Number(amountIdxBigInt)
+  const sigIdx = Number(sigIdxBigInt)
+  const indexIdx = Number(indexIdxBigInt)
+
   const pubKeySize = bytesToInt(requestData.slice(pubKeyIdx, pubKeyIdx + 32))
-  const withdrawalCreditsIdx = bytesToInt(requestData.slice(32, 64))
   const withdrawalCreditsSize = bytesToInt(
     requestData.slice(withdrawalCreditsIdx, withdrawalCreditsIdx + 32),
   )
-  const amountIdx = bytesToInt(requestData.slice(64, 96))
   const amountSize = bytesToInt(requestData.slice(amountIdx, amountIdx + 32))
-  const sigIdx = bytesToInt(requestData.slice(96, 128))
   const sigSize = bytesToInt(requestData.slice(sigIdx, sigIdx + 32))
-  const indexIdx = bytesToInt(requestData.slice(128, 160))
   const indexSize = bytesToInt(requestData.slice(indexIdx, indexIdx + 32))
 
+  if (
+    pubKeySize !== PUBKEY_SIZE ||
+    withdrawalCreditsSize !== WITHDRAWAL_CREDENTIALS_SIZE ||
+    amountSize !== AMOUNT_SIZE ||
+    sigSize !== SIGNATURE_SIZE ||
+    indexSize !== INDEX_SIZE
+  ) {
+    throw EthereumJSErrorWithoutCode(LOG_LAYOUT_MISMATCH)
+  }
+
   const pubkey = requestData.slice(pubKeyIdx + 32, pubKeyIdx + 32 + pubKeySize)
   const withdrawalCredentials = requestData.slice(
     withdrawalCreditsIdx + 32,