EIP-7951: Precompile for secp256r1 Curve Support

[lorenzogentile404]

Note

Adds P256_VERIFY precompile and EIP-7823-based MODEXP changes, wiring them across Osaka (hub/oob/ecdata/MMU) with new constants, phases, and validations, plus assorted fixes/refactors.

• Osaka fork integration:
  • Add P256_VERIFY precompile end-to-end: ecdata/osaka (columns/constants/constraints), hub/osaka (scenarios, NSRs/flag sums, success/return-data paths), oob/osaka (flags/shorthands, handlers), constants (gas, calldata/ret sizes, phases), and OOB opcode OOB_INST_P256_VERIFY.
  • Wire into Makefile via ZKEVM_MODULES_OSAKA and new blake2fmodexpdata/osaka module.
• MODEXP (EIP-7823) overhaul:
  • Enforce upper byte-size bound EIP_7823_MODEXP_UPPER_BYTE_SIZE_BOUND = 1024 and min pricing GAS_CONST_MODEXP_EIP_7823 = 500; update OOB pricing/xbs logic and validations.
  • Refactor common processing into granular files; normalize bbs/ebs/mbs paths; adjust result copy offsets/sizes to bound; rename/comparison cleanups.
  • Increase MMU micro rows for MODEXP (NB_MICRO_ROWS_TOT_MODEXP_{ZERO,DATA} = 64) and update MMU preprocessing math.
• Core constants and phases:
  • Add GAS_CONST_P256_VERIFY, PRECOMPILE_CALL_DATA_SIZE___P256_VERIFY, PRECOMPILE_RETURN_DATA_SIZE___P256_VERIFY, and PHASE_P256_VERIFY_{DATA,RESULT}.
• BLAKE/MODEXP data:
  • Introduce blake2fmodexpdata/osaka with columns/constants/constraints and WCP lookup; include in fork builds.
• EC data fixes and selectors:
  • Switch ECRECOVER zero checks to ISZERO and correct success-bit polarity; convert several circuit selector constraints to defcomputedcolumn.
• OOB/MISC infrastructure:
  • Add automatic vanishing constraints for EXP/MMU/MXP/OOB/STP misc rows; rename maxct-sum to ct-max-sum usage.

^{Written by Cursor Bugbot for commit ee70747. This will update automatically on new commits. Configure here.}

[lorenzogentile404]

Only non trivial part of this PR.

[cursor]

Bug: Phase IDs collide for precompile operations

Phase constant collision: PHASE_P256_VERIFY_DATA is set to 0x100A, which is identical to the existing PHASE_BLS_MAP_FP_TO_G1_DATA constant (also 0x100A). These phase identifiers must be unique to correctly distinguish between different precompile operations. This collision will cause the system to confuse P256_VERIFY operations with BLS_MAP_FP_TO_G1 operations.

 

[cursor]

Bug: Incorrect MODEXP Gas Pricing

The modexp-full-log calculation multiplies sub-ebs-32 by 16 instead of 8. Since sub-ebs-32 represents bytes and the exponent log is measured in bits, the conversion factor should be 8 bits per byte, not 16. This will cause incorrect gas pricing calculations for MODEXP operations where the exponent size exceeds 32 bytes.

 

[cursor]

Bug: MODEXP Gas Pricing: Incorrect Calculation Inflates Costs

The precompile-processing---MODEXP---modexp-full-log calculation uses multiplier 16 instead of 8 to convert sub-ebs-32 (bytes) to bits. This doubles the exponent log value, causing incorrect MODEXP gas pricing. All other forks (London, Shanghai, Cancun, Prague) use multiplier 8, which correctly converts bytes to bits.

 

[cursor]

Bug: P256_VERIFY: Circuit Selector Integrity Compromised

The circuit-selectors-sum-binary constraint is missing CS_P256_VERIFY in the sum. This fails to verify that only one circuit selector is active at a time when P256_VERIFY is used, potentially allowing multiple circuit selectors to be active simultaneously.

 

[cursor]

Bug: Precompile Processing Ignores P256_VERIFY

The precompile-processing---2nd-half-NSR and precompile-processing---2nd-half-flag-sum functions don't include P256_VERIFY handling. P256_VERIFY is not part of scenario-shorthand---PRC---common-BLS-address-bit-sum, so when P256_VERIFY is invoked, the NSR and flag sum calculations will be zero instead of the correct values, causing constraint violations.

 

[cursor]

Bug: Data Index Error Impacts Verification

The INDEX_MAX_P256_VERIFY_DATA constant is set to 10, but P256_VERIFY data has 10 limbs with indices 0-9, making the maximum index 9. This off-by-one error causes internal_checks_passed to be read from the wrong HURDLE offset in the justify-success-bit-256-verify constraint.

 

[cursor]

Bug: Circuit Selectors: Mutual Exclusivity Broken

The circuit-selectors-sum-binary constraint is missing CS_P256_VERIFY in the sum that validates at most one circuit selector is active at a time. This allows CIRCUIT_SELECTOR_P256_VERIFY to be active simultaneously with other circuit selectors, violating the mutual exclusivity requirement.

 

[cursor]

Bug: Verification Flag Sum Calculation Error

The first term in precompile-processing---2nd-half-flag-sum-for-P256-VERIFY is missing the flag sum function call. It multiplies scenario/PRC_FAILURE_KNOWN_TO_HUB by nothing instead of by (precompile-processing---flag-sum-P256-VERIFY-FKTH), causing incorrect flag sum calculation for the P256_VERIFY failure case.