[SECURITY] Non-Compliance: Stack Modification During RETURN Operation

[mhoste51]

Our team at FuzzingLabs discovered an non-compliance, during the execution of the RETURN operation in Lambdaclass's EVM implementation, an additional value (1) is pushed onto the stack. This behavior deviates from the expected behavior as outlined in the Ethereum Yellow Paper.

Root cause

    // RETURN operation
    pub fn op_return(
        &mut self,
        current_call_frame: &mut CallFrame,
    ) -> Result<OpcodeSuccess, VMError> {
        let offset: usize = current_call_frame
            .stack
            .pop()?
            .try_into()
            .map_err(|_| VMError::VeryLargeNumber)?;
        let size = current_call_frame
            .stack
            .pop()?
            .try_into()
            .map_err(|_| VMError::VeryLargeNumber)?;

        let gas_cost =
            current_call_frame
                .memory
                .expansion_cost(offset.checked_add(size).ok_or(VMError::Internal(
                    InternalError::ArithmeticOperationOverflow,
                ))?)?;

        self.increase_consumed_gas(current_call_frame, gas_cost)?;

        let return_data = current_call_frame.memory.load_range(offset, size)?.into();
        current_call_frame.returndata = return_data;
        current_call_frame
            .stack
            .push(U256::from(SUCCESS_FOR_RETURN))?;

        Ok(OpcodeSuccess::Result(ResultReason::Return))
    }

The code responsible for this behavior is as follows:

current_call_frame
    .stack
    .push(U256::from(SUCCESS_FOR_RETURN))?;

Here, SUCCESS_FOR_RETURN is a constant defined as 1. This results in the stack being modified during the RETURN operation, with the value 1 added to it.

Impact

• Non-compliance with the Ethereum Specification:
  • The Yellow Paper does not mention any modification of the stack during the RETURN operation.
• Interoperability Issues:
  • Smart contracts may exhibit unintended behavior when deployed on Lambdaclass compared to other EVMs, as the additional stack value could lead to unexpected results.
• Compatibility Problems:
  • Testing or migrating contracts between Lambdaclass and other clients (e.g., REVM, Geth) may lead to inconsistent results.