Merge pull request #4999 from paritytech/eip-213

EIP-213 (bn128 curve operations)

Cargo.lock

@@ -177,6 +177,16 @@ name = "bloomchain"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 
+[[package]]
+name = "bn"
+version = "0.4.3"
+source = "git+https://github.com/paritytech/bn#59d848e642ad1ff0d60e39348576a6f11ee123b8"
+dependencies = [
+ "byteorder 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rand 0.3.14 (registry+https://github.com/rust-lang/crates.io-index)",
+ "rustc-serialize 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)",
+]
+
 [[package]]
 name = "byteorder"
 version = "1.0.0"
@@ -377,6 +387,7 @@ version = "1.7.0"
 dependencies = [
  "bit-set 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "bloomchain 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
+ "bn 0.4.3 (git+https://github.com/paritytech/bn)",
  "byteorder 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "clippy 0.0.103 (registry+https://github.com/rust-lang/crates.io-index)",
  "crossbeam 0.2.10 (registry+https://github.com/rust-lang/crates.io-index)",
@@ -2631,6 +2642,7 @@ dependencies = [
 "checksum bitflags 0.7.0 (registry+https://github.com/rust-lang/crates.io-index)" = "aad18937a628ec6abcd26d1489012cc0e18c21798210f491af69ded9b881106d"
 "checksum blastfig 0.3.3 (registry+https://github.com/rust-lang/crates.io-index)" = "09640e0509d97d5cdff03a9f5daf087a8e04c735c3b113a75139634a19cfc7b2"
 "checksum bloomchain 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)" = "3f421095d2a76fc24cd3fb3f912b90df06be7689912b1bdb423caefae59c258d"
+"checksum bn 0.4.3 (git+https://github.com/paritytech/bn)" = "<none>"
 "checksum byteorder 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)" = "c40977b0ee6b9885c9013cd41d9feffdd22deb3bb4dc3a71d901cc7a77de18c8"
 "checksum bytes 0.3.0 (registry+https://github.com/rust-lang/crates.io-index)" = "c129aff112dcc562970abb69e2508b40850dd24c274761bb50fb8a0067ba6c27"
 "checksum bytes 0.4.1 (registry+https://github.com/rust-lang/crates.io-index)" = "46112a0060ae15e3a3f9a445428a53e082b91215b744fa27a1948842f4a64b96"

ethcore/Cargo.toml

@@ -48,6 +48,7 @@ ethcore-logger = { path = "../logger" }
 stats = { path = "../util/stats" }
 hyper = { git = "https://github.com/paritytech/hyper", default-features = false }
 num = "0.1"
+bn = { git = "https://github.com/paritytech/bn" }
 
 [features]
 jit = ["evmjit"]

ethcore/res/ethereum/foundation.json

@@ -190,6 +190,8 @@
 		"0000000000000000000000000000000000000003": { "builtin": { "name": "ripemd160", "pricing": { "linear": { "base": 600, "word": 120 } } } },
 		"0000000000000000000000000000000000000004": { "builtin": { "name": "identity", "pricing": { "linear": { "base": 15, "word": 3 } } } },
 		"0000000000000000000000000000000000000005": { "builtin": { "name": "modexp", "activate_at": "0x7fffffffffffff", "pricing": { "modexp": { "divisor": 20 } } } },
+		"0000000000000000000000000000000000000006": { "builtin": { "name": "bn128_add", "activate_at": "0x7fffffffffffff", "pricing": { "linear": { "base": 999999, "word": 0 } } } },
+		"0000000000000000000000000000000000000007": { "builtin": { "name": "bn128_mul", "activate_at": "0x7fffffffffffff", "pricing": { "linear": { "base": 999999, "word": 0 } } } },
 		"3282791d6fd713f1e94f4bfd565eaa78b3a0599d": {
 			"balance": "1337000000000000000000"
 		},

ethcore/src/builtin.rs

@@ -27,10 +27,19 @@ use util::{U256, H256, Uint, Hashable, BytesRef};
 use ethkey::{Signature, recover as ec_recover};
 use ethjson;
 
+#[derive(Debug)]
+pub struct Error(pub &'static str);
+
+impl From<&'static str> for Error {
+	fn from(val: &'static str) -> Self {
+		Error(val)
+	}
+}
+
 /// Native implementation of a built-in contract.
 pub trait Impl: Send + Sync {
 	/// execute this built-in on the given input, writing to the given output.
-	fn execute(&self, input: &[u8], output: &mut BytesRef);
+	fn execute(&self, input: &[u8], output: &mut BytesRef) -> Result<(), Error>;
 }
 
 /// A gas pricing scheme for built-in contracts.
@@ -102,7 +111,9 @@ impl Builtin {
 	pub fn cost(&self, input: &[u8]) -> U256 { self.pricer.cost(input) }
 
 	/// Simple forwarder for execute.
-	pub fn execute(&self, input: &[u8], output: &mut BytesRef) { self.native.execute(input, output) }
+	pub fn execute(&self, input: &[u8], output: &mut BytesRef) -> Result<(), Error> { 
+		self.native.execute(input, output)
+	}
 
 	/// Whether the builtin is activated at the given block number.
 	pub fn is_active(&self, at: u64) -> bool { at >= self.activate_at }
@@ -145,6 +156,8 @@ fn ethereum_builtin(name: &str) -> Box<Impl> {
 		"sha256" => Box::new(Sha256) as Box<Impl>,
 		"ripemd160" => Box::new(Ripemd160) as Box<Impl>,
 		"modexp" => Box::new(ModexpImpl) as Box<Impl>,
+		"bn128_add" => Box::new(Bn128AddImpl) as Box<Impl>,
+		"bn128_mul" => Box::new(Bn128MulImpl) as Box<Impl>,
 		_ => panic!("invalid builtin name: {}", name),
 	}
 }
@@ -172,14 +185,21 @@ struct Ripemd160;
 #[derive(Debug)]
 struct ModexpImpl;
 
+#[derive(Debug)]
+struct Bn128AddImpl;
+
+#[derive(Debug)]
+struct Bn128MulImpl;
+
 impl Impl for Identity {
-	fn execute(&self, input: &[u8], output: &mut BytesRef) {
+	fn execute(&self, input: &[u8], output: &mut BytesRef) -> Result<(), Error> {
 		output.write(0, input);
+		Ok(())
 	}
 }
 
 impl Impl for EcRecover {
-	fn execute(&self, i: &[u8], output: &mut BytesRef) {
+	fn execute(&self, i: &[u8], output: &mut BytesRef) -> Result<(), Error> {
 		let len = min(i.len(), 128);
 
 		let mut input = [0; 128];
@@ -192,7 +212,7 @@ impl Impl for EcRecover {
 
 		let bit = match v[31] {
 			27 | 28 if &v.0[..31] == &[0; 31] => v[31] - 27,
-			_ => return,
+			_ => { return Ok(()); },
 		};
 
 		let s = Signature::from_rsv(&r, &s, bit);
@@ -203,11 +223,13 @@ impl Impl for EcRecover {
 				output.write(12, &r[12..r.len()]);
 			}
 		}
+
+		Ok(())
 	}
 }
 
 impl Impl for Sha256 {
-	fn execute(&self, input: &[u8], output: &mut BytesRef) {
+	fn execute(&self, input: &[u8], output: &mut BytesRef) -> Result<(), Error> {
 		let mut sha = Sha256Digest::new();
 		sha.input(input);
 
@@ -215,11 +237,13 @@ impl Impl for Sha256 {
 		sha.result(&mut out);
 
 		output.write(0, &out);
+
+		Ok(())
 	}
 }
 
 impl Impl for Ripemd160 {
-	fn execute(&self, input: &[u8], output: &mut BytesRef) {
+	fn execute(&self, input: &[u8], output: &mut BytesRef) -> Result<(), Error> {
 		let mut sha = Ripemd160Digest::new();
 		sha.input(input);
 
@@ -227,11 +251,13 @@ impl Impl for Ripemd160 {
 		sha.result(&mut out[12..32]);
 
 		output.write(0, &out);
+
+		Ok(())
 	}
 }
 
 impl Impl for ModexpImpl {
-	fn execute(&self, input: &[u8], output: &mut BytesRef) {
+	fn execute(&self, input: &[u8], output: &mut BytesRef) -> Result<(), Error> {
 		let mut reader = input.chain(io::repeat(0));
 		let mut buf = [0; 32];
 
@@ -294,9 +320,79 @@ impl Impl for ModexpImpl {
 			let res_start = mod_len - bytes.len();
 			output.write(res_start, &bytes);
 		}
+
+		Ok(())
 	}
 }
 
+fn read_fr(reader: &mut io::Chain<&[u8], io::Repeat>) -> Result<::bn::Fr, Error> {
+	let mut buf = [0u8; 32];
+	
+	reader.read_exact(&mut buf[..]).expect("reading from zero-extended memory cannot fail; qed");
+	::bn::Fr::from_slice(&buf[0..32]).map_err(|_| Error::from("Invalid field element"))
+}
+
+fn read_point(reader: &mut io::Chain<&[u8], io::Repeat>) -> Result<::bn::G1, Error> {
+	use bn::{Fq, AffineG1, G1, Group};
+	
+	let mut buf = [0u8; 32];
+	
+	reader.read_exact(&mut buf[..]).expect("reading from zero-extended memory cannot fail; qed");
+	let px = Fq::from_slice(&buf[0..32]).map_err(|_| Error::from("Invalid point x coordinate"))?;
+
+	reader.read_exact(&mut buf[..]).expect("reading from zero-extended memory cannot fail; qed");
+	let py = Fq::from_slice(&buf[0..32]).map_err(|_| Error::from("Invalid point x coordinate"))?;
+	
+	Ok(
+		if px == Fq::zero() && py == Fq::zero() {
+			G1::zero()
+		} else {
+			AffineG1::new(px, py).map_err(|_| Error::from("Invalid curve point"))?.into()
+		}
+	)
+}
+
+impl Impl for Bn128AddImpl {
+	// Can fail if any of the 2 points does not belong the bn128 curve
+	fn execute(&self, input: &[u8], output: &mut BytesRef) -> Result<(), Error> {
+		use bn::AffineG1;
+
+		let mut padded_input = input.chain(io::repeat(0));
+		let p1 = read_point(&mut padded_input)?;
+		let p2 = read_point(&mut padded_input)?;
+
+		let mut write_buf = [0u8; 64];
+		if let Some(sum) = AffineG1::from_jacobian(p1 + p2) {
+			// point not at infinity
+			sum.x().to_big_endian(&mut write_buf[0..32]).expect("Cannot fail since 0..32 is 32-byte length");
+			sum.y().to_big_endian(&mut write_buf[32..64]).expect("Cannot fail since 32..64 is 32-byte length");;
+		}
+		output.write(0, &write_buf);
+
+		Ok(())
+	}	
+}
+
+impl Impl for Bn128MulImpl {
+	// Can fail if first paramter (bn128 curve point) does not actually belong to the curve
+	fn execute(&self, input: &[u8], output: &mut BytesRef) -> Result<(), Error> {
+		use bn::AffineG1;
+
+		let mut padded_input = input.chain(io::repeat(0));
+		let p = read_point(&mut padded_input)?;
+		let fr = read_fr(&mut padded_input)?;
+
+		let mut write_buf = [0u8; 64];
+		if let Some(sum) = AffineG1::from_jacobian(p * fr) {
+			// point not at infinity
+			sum.x().to_big_endian(&mut write_buf[0..32]).expect("Cannot fail since 0..32 is 32-byte length");
+			sum.y().to_big_endian(&mut write_buf[32..64]).expect("Cannot fail since 32..64 is 32-byte length");;
+		}
+		output.write(0, &write_buf);
+		Ok(())
+	}	
+}
+
 #[cfg(test)]
 mod tests {
 	use super::{Builtin, Linear, ethereum_builtin, Pricer, Modexp};
@@ -310,15 +406,15 @@ mod tests {
 		let i = [0u8, 1, 2, 3];
 
 		let mut o2 = [255u8; 2];
-		f.execute(&i[..], &mut BytesRef::Fixed(&mut o2[..]));
+		f.execute(&i[..], &mut BytesRef::Fixed(&mut o2[..])).expect("Builtin should not fail");
 		assert_eq!(i[0..2], o2);
 
 		let mut o4 = [255u8; 4];
-		f.execute(&i[..], &mut BytesRef::Fixed(&mut o4[..]));
+		f.execute(&i[..], &mut BytesRef::Fixed(&mut o4[..])).expect("Builtin should not fail");
 		assert_eq!(i, o4);
 
 		let mut o8 = [255u8; 8];
-		f.execute(&i[..], &mut BytesRef::Fixed(&mut o8[..]));
+		f.execute(&i[..], &mut BytesRef::Fixed(&mut o8[..])).expect("Builtin should not fail");
 		assert_eq!(i, o8[..4]);
 		assert_eq!([255u8; 4], o8[4..]);
 	}
@@ -331,19 +427,19 @@ mod tests {
 		let i = [0u8; 0];
 
 		let mut o = [255u8; 32];
-		f.execute(&i[..], &mut BytesRef::Fixed(&mut o[..]));
+		f.execute(&i[..], &mut BytesRef::Fixed(&mut o[..])).expect("Builtin should not fail");
 		assert_eq!(&o[..], &(FromHex::from_hex("e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855").unwrap())[..]);
 
 		let mut o8 = [255u8; 8];
-		f.execute(&i[..], &mut BytesRef::Fixed(&mut o8[..]));
+		f.execute(&i[..], &mut BytesRef::Fixed(&mut o8[..])).expect("Builtin should not fail");
 		assert_eq!(&o8[..], &(FromHex::from_hex("e3b0c44298fc1c14").unwrap())[..]);
 
 		let mut o34 = [255u8; 34];
-		f.execute(&i[..], &mut BytesRef::Fixed(&mut o34[..]));
+		f.execute(&i[..], &mut BytesRef::Fixed(&mut o34[..])).expect("Builtin should not fail");
 		assert_eq!(&o34[..], &(FromHex::from_hex("e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855ffff").unwrap())[..]);
 
 		let mut ov = vec![];
-		f.execute(&i[..], &mut BytesRef::Flexible(&mut ov));
+		f.execute(&i[..], &mut BytesRef::Flexible(&mut ov)).expect("Builtin should not fail");
 		assert_eq!(&ov[..], &(FromHex::from_hex("e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855").unwrap())[..]);
 	}
 
@@ -355,15 +451,15 @@ mod tests {
 		let i = [0u8; 0];
 
 		let mut o = [255u8; 32];
-		f.execute(&i[..], &mut BytesRef::Fixed(&mut o[..]));
+		f.execute(&i[..], &mut BytesRef::Fixed(&mut o[..])).expect("Builtin should not fail");
 		assert_eq!(&o[..], &(FromHex::from_hex("0000000000000000000000009c1185a5c5e9fc54612808977ee8f548b2258d31").unwrap())[..]);
 
 		let mut o8 = [255u8; 8];
-		f.execute(&i[..], &mut BytesRef::Fixed(&mut o8[..]));
+		f.execute(&i[..], &mut BytesRef::Fixed(&mut o8[..])).expect("Builtin should not fail");
 		assert_eq!(&o8[..], &(FromHex::from_hex("0000000000000000").unwrap())[..]);
 
 		let mut o34 = [255u8; 34];
-		f.execute(&i[..], &mut BytesRef::Fixed(&mut o34[..]));
+		f.execute(&i[..], &mut BytesRef::Fixed(&mut o34[..])).expect("Builtin should not fail");
 		assert_eq!(&o34[..], &(FromHex::from_hex("0000000000000000000000009c1185a5c5e9fc54612808977ee8f548b2258d31ffff").unwrap())[..]);
 	}
 
@@ -383,40 +479,40 @@ mod tests {
 		let i = FromHex::from_hex("47173285a8d7341e5e972fc677286384f802f8ef42a5ec5f03bbfa254cb01fad000000000000000000000000000000000000000000000000000000000000001b650acf9d3f5f0a2c799776a1254355d5f4061762a237396a99a0e0e3fc2bcd6729514a0dacb2e623ac4abd157cb18163ff942280db4d5caad66ddf941ba12e03").unwrap();
 
 		let mut o = [255u8; 32];
-		f.execute(&i[..], &mut BytesRef::Fixed(&mut o[..]));
+		f.execute(&i[..], &mut BytesRef::Fixed(&mut o[..])).expect("Builtin should not fail");
 		assert_eq!(&o[..], &(FromHex::from_hex("000000000000000000000000c08b5542d177ac6686946920409741463a15dddb").unwrap())[..]);
 
 		let mut o8 = [255u8; 8];
-		f.execute(&i[..], &mut BytesRef::Fixed(&mut o8[..]));
+		f.execute(&i[..], &mut BytesRef::Fixed(&mut o8[..])).expect("Builtin should not fail");
 		assert_eq!(&o8[..], &(FromHex::from_hex("0000000000000000").unwrap())[..]);
 
 		let mut o34 = [255u8; 34];
-		f.execute(&i[..], &mut BytesRef::Fixed(&mut o34[..]));
+		f.execute(&i[..], &mut BytesRef::Fixed(&mut o34[..])).expect("Builtin should not fail");
 		assert_eq!(&o34[..], &(FromHex::from_hex("000000000000000000000000c08b5542d177ac6686946920409741463a15dddbffff").unwrap())[..]);
 
 		let i_bad = FromHex::from_hex("47173285a8d7341e5e972fc677286384f802f8ef42a5ec5f03bbfa254cb01fad000000000000000000000000000000000000000000000000000000000000001a650acf9d3f5f0a2c799776a1254355d5f4061762a237396a99a0e0e3fc2bcd6729514a0dacb2e623ac4abd157cb18163ff942280db4d5caad66ddf941ba12e03").unwrap();
 		let mut o = [255u8; 32];
-		f.execute(&i_bad[..], &mut BytesRef::Fixed(&mut o[..]));
+		f.execute(&i_bad[..], &mut BytesRef::Fixed(&mut o[..])).expect("Builtin should not fail");
 		assert_eq!(&o[..], &(FromHex::from_hex("ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff").unwrap())[..]);
 
 		let i_bad = FromHex::from_hex("47173285a8d7341e5e972fc677286384f802f8ef42a5ec5f03bbfa254cb01fad000000000000000000000000000000000000000000000000000000000000001b000000000000000000000000000000000000000000000000000000000000001b0000000000000000000000000000000000000000000000000000000000000000").unwrap();
 		let mut o = [255u8; 32];
-		f.execute(&i_bad[..], &mut BytesRef::Fixed(&mut o[..]));
+		f.execute(&i_bad[..], &mut BytesRef::Fixed(&mut o[..])).expect("Builtin should not fail");
 		assert_eq!(&o[..], &(FromHex::from_hex("ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff").unwrap())[..]);
 
 		let i_bad = FromHex::from_hex("47173285a8d7341e5e972fc677286384f802f8ef42a5ec5f03bbfa254cb01fad000000000000000000000000000000000000000000000000000000000000001b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001b").unwrap();
 		let mut o = [255u8; 32];
-		f.execute(&i_bad[..], &mut BytesRef::Fixed(&mut o[..]));
+		f.execute(&i_bad[..], &mut BytesRef::Fixed(&mut o[..])).expect("Builtin should not fail");
 		assert_eq!(&o[..], &(FromHex::from_hex("ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff").unwrap())[..]);
 
 		let i_bad = FromHex::from_hex("47173285a8d7341e5e972fc677286384f802f8ef42a5ec5f03bbfa254cb01fad000000000000000000000000000000000000000000000000000000000000001bffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000001b").unwrap();
 		let mut o = [255u8; 32];
-		f.execute(&i_bad[..], &mut BytesRef::Fixed(&mut o[..]));
+		f.execute(&i_bad[..], &mut BytesRef::Fixed(&mut o[..])).expect("Builtin should not fail");
 		assert_eq!(&o[..], &(FromHex::from_hex("ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff").unwrap())[..]);
 
 		let i_bad = FromHex::from_hex("47173285a8d7341e5e972fc677286384f802f8ef42a5ec5f03bbfa254cb01fad000000000000000000000000000000000000000000000000000000000000001b000000000000000000000000000000000000000000000000000000000000001bffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff").unwrap();
 		let mut o = [255u8; 32];
-		f.execute(&i_bad[..], &mut BytesRef::Fixed(&mut o[..]));
+		f.execute(&i_bad[..], &mut BytesRef::Fixed(&mut o[..])).expect("Builtin should not fail");
 		assert_eq!(&o[..], &(FromHex::from_hex("ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff").unwrap())[..]);
 
 		// TODO: Should this (corrupted version of the above) fail rather than returning some address?
@@ -450,7 +546,7 @@ mod tests {
 			let expected = FromHex::from_hex("0000000000000000000000000000000000000000000000000000000000000001").unwrap();
 			let expected_cost = 1638;
 
-			f.execute(&input[..], &mut BytesRef::Fixed(&mut output[..]));
+			f.execute(&input[..], &mut BytesRef::Fixed(&mut output[..])).expect("Builtin should not fail");
 			assert_eq!(output, expected);
 			assert_eq!(f.cost(&input[..]), expected_cost.into());
 		}
@@ -469,7 +565,7 @@ mod tests {
 			let expected = FromHex::from_hex("0000000000000000000000000000000000000000000000000000000000000000").unwrap();
 			let expected_cost = 1638;
 
-			f.execute(&input[..], &mut BytesRef::Fixed(&mut output[..]));
+			f.execute(&input[..], &mut BytesRef::Fixed(&mut output[..])).expect("Builtin should not fail");
 			assert_eq!(output, expected);
 			assert_eq!(f.cost(&input[..]), expected_cost.into());
 		}
@@ -489,7 +585,7 @@ mod tests {
 			let expected = FromHex::from_hex("3b01b01ac41f2d6e917c6d6a221ce793802469026d9ab7578fa2e79e4da6aaab").unwrap();
 			let expected_cost = 102;
 
-			f.execute(&input[..], &mut BytesRef::Fixed(&mut output[..]));
+			f.execute(&input[..], &mut BytesRef::Fixed(&mut output[..])).expect("Builtin should not fail");
 			assert_eq!(output, expected);
 			assert_eq!(f.cost(&input[..]), expected_cost.into());
 		}
@@ -507,12 +603,118 @@ mod tests {
 			let mut output = vec![];
 			let expected_cost = 0;
 
-			f.execute(&input[..], &mut BytesRef::Flexible(&mut output));
+			f.execute(&input[..], &mut BytesRef::Flexible(&mut output)).expect("Builtin should not fail");
 			assert_eq!(output.len(), 0); // shouldn't have written any output.
 			assert_eq!(f.cost(&input[..]), expected_cost.into());
 		}
 	}
 
+	#[test]
+	fn bn128_add() {
+		use rustc_serialize::hex::FromHex;
+
+		let f = Builtin {
+			pricer: Box::new(Linear { base: 0, word: 0 }),
+			native: ethereum_builtin("bn128_add"),
+			activate_at: 0,
+		};		
+
+		// zero-points additions
+		{
+			let input = FromHex::from_hex("\
+				0000000000000000000000000000000000000000000000000000000000000000\
+				0000000000000000000000000000000000000000000000000000000000000000\
+				0000000000000000000000000000000000000000000000000000000000000000\
+				0000000000000000000000000000000000000000000000000000000000000000"
+			).unwrap();
+
+			let mut output = vec![0u8; 64];
+			let expected = FromHex::from_hex("\
+				0000000000000000000000000000000000000000000000000000000000000000\
+				0000000000000000000000000000000000000000000000000000000000000000"
+			).unwrap();
+
+			f.execute(&input[..], &mut BytesRef::Fixed(&mut output[..])).expect("Builtin should not fail");
+			assert_eq!(output, expected);
+		}		
+
+
+		// no input, should not fail
+		{
+			let mut empty = [0u8; 0];
+			let input = BytesRef::Fixed(&mut empty);
+
+			let mut output = vec![0u8; 64];
+			let expected = FromHex::from_hex("\
+				0000000000000000000000000000000000000000000000000000000000000000\
+				0000000000000000000000000000000000000000000000000000000000000000"
+			).unwrap();
+
+			f.execute(&input[..], &mut BytesRef::Fixed(&mut output[..])).expect("Builtin should not fail");
+			assert_eq!(output, expected);
+		}				
+
+		// should fail - point not on curve
+		{
+			let input = FromHex::from_hex("\
+				1111111111111111111111111111111111111111111111111111111111111111\
+				1111111111111111111111111111111111111111111111111111111111111111\
+				1111111111111111111111111111111111111111111111111111111111111111\
+				1111111111111111111111111111111111111111111111111111111111111111"
+			).unwrap();
+
+			let mut output = vec![0u8; 64];
+
+			let res = f.execute(&input[..], &mut BytesRef::Fixed(&mut output[..]));
+			assert!(res.is_err(), "There should be built-in error here");
+		}		
+	}
+
+
+	#[test]
+	fn bn128_mul() {
+		use rustc_serialize::hex::FromHex;
+
+		let f = Builtin {
+			pricer: Box::new(Linear { base: 0, word: 0 }),
+			native: ethereum_builtin("bn128_mul"),
+			activate_at: 0,
+		};		
+
+		// zero-point multiplication
+		{
+			let input = FromHex::from_hex("\
+				0000000000000000000000000000000000000000000000000000000000000000\
+				0000000000000000000000000000000000000000000000000000000000000000\
+				0200000000000000000000000000000000000000000000000000000000000000"
+			).unwrap();
+
+			let mut output = vec![0u8; 64];
+			let expected = FromHex::from_hex("\
+				0000000000000000000000000000000000000000000000000000000000000000\
+				0000000000000000000000000000000000000000000000000000000000000000"
+			).unwrap();
+
+			f.execute(&input[..], &mut BytesRef::Fixed(&mut output[..])).expect("Builtin should not fail");
+			assert_eq!(output, expected);
+		}		
+
+		// should fail - point not on curve
+		{
+			let input = FromHex::from_hex("\
+				1111111111111111111111111111111111111111111111111111111111111111\
+				1111111111111111111111111111111111111111111111111111111111111111\
+				0f00000000000000000000000000000000000000000000000000000000000000"
+			).unwrap();
+
+			let mut output = vec![0u8; 64];
+
+			let res = f.execute(&input[..], &mut BytesRef::Fixed(&mut output[..]));
+			assert!(res.is_err(), "There should be built-in error here");
+		}		
+	}
+	
+
 	#[test]
 	#[should_panic]
 	fn from_unknown_linear() {
@@ -549,7 +751,7 @@ mod tests {
 
 		let i = [0u8, 1, 2, 3];
 		let mut o = [255u8; 4];
-		b.execute(&i[..], &mut BytesRef::Fixed(&mut o[..]));
+		b.execute(&i[..], &mut BytesRef::Fixed(&mut o[..])).expect("Builtin should not fail");
 		assert_eq!(i, o);
 	}
 
@@ -571,7 +773,7 @@ mod tests {
 
 		let i = [0u8, 1, 2, 3];
 		let mut o = [255u8; 4];
-		b.execute(&i[..], &mut BytesRef::Fixed(&mut o[..]));
+		b.execute(&i[..], &mut BytesRef::Fixed(&mut o[..])).expect("Builtin should not fail");
 		assert_eq!(i, o);
 	}
-}
+}

ethcore/src/evm/evm.rs

@@ -20,6 +20,7 @@ use std::{ops, cmp, fmt};
 use util::{U128, U256, U512, Uint, trie};
 use action_params::ActionParams;
 use evm::Ext;
+use builtin;
 
 /// Evm errors.
 #[derive(Debug, Clone, PartialEq)]
@@ -59,6 +60,8 @@ pub enum Error {
 		/// What was the stack limit
 		limit: usize
 	},
+	/// Built-in contract failed on given input
+	BuiltIn(&'static str),
 	/// Returned on evm internal error. Should never be ignored during development.
 	/// Likely to cause consensus issues.
 	Internal(String),
@@ -70,6 +73,12 @@ impl From<Box<trie::TrieError>> for Error {
 	}
 }
 
+impl From<builtin::Error> for Error {
+	fn from(err: builtin::Error) -> Self {
+		Error::BuiltIn(err.0)
+	}	
+}
+
 impl fmt::Display for Error {
 	fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
 		use self::Error::*;
@@ -79,6 +88,7 @@ impl fmt::Display for Error {
 			BadInstruction { .. } => "Bad instruction",
 			StackUnderflow { .. } => "Stack underflow",
 			OutOfStack { .. } => "Out of stack",
+			BuiltIn { .. } => "Built-in failed",
 			Internal(ref msg) => msg,
 		};
 		message.fmt(f)

ethcore/src/executive.rs

@@ -276,25 +276,31 @@ impl<'a, B: 'a + StateBackend> Executive<'a, B> {
 
 			let cost = builtin.cost(data);
 			if cost <= params.gas {
-				builtin.execute(data, &mut output);
+				if let Err(e) = builtin.execute(data, &mut output) {
-				self.state.discard_checkpoint();
+					self.state.revert_to_checkpoint();
+					let evm_err: evm::evm::Error = e.into();
+					tracer.trace_failed_call(trace_info, vec![], evm_err.clone().into());
+					Err(evm_err)
+				} else {
+					self.state.discard_checkpoint();
 
-				// trace only top level calls to builtins to avoid DDoS attacks
+					// trace only top level calls to builtins to avoid DDoS attacks
-				if self.depth == 0 {
+					if self.depth == 0 {
-					let mut trace_output = tracer.prepare_trace_output();
+						let mut trace_output = tracer.prepare_trace_output();
-					if let Some(mut out) = trace_output.as_mut() {
+						if let Some(mut out) = trace_output.as_mut() {
-						*out = output.to_owned();
+							*out = output.to_owned();
+						}
+
+						tracer.trace_call(
+							trace_info,
+							cost,
+							trace_output,
+							vec![]
+						);
 					}
 
-					tracer.trace_call(
+					Ok(params.gas - cost)
-						trace_info,
-						cost,
-						trace_output,
-						vec![]
-					);
 				}
-
-				Ok(params.gas - cost)
 			} else {
 				// just drain the whole gas
 				self.state.revert_to_checkpoint();
@@ -497,6 +503,7 @@ impl<'a, B: 'a + StateBackend> Executive<'a, B> {
 				| Err(evm::Error::BadJumpDestination {..})
 				| Err(evm::Error::BadInstruction {.. })
 				| Err(evm::Error::StackUnderflow {..})
+				| Err(evm::Error::BuiltIn {..})
 				| Err(evm::Error::OutOfStack {..}) => {
 					self.state.revert_to_checkpoint();
 			},

ethcore/src/lib.rs

@@ -108,6 +108,7 @@ extern crate hardware_wallet;
 extern crate stats;
 extern crate ethcore_logger;
 extern crate num;
+extern crate bn;
 extern crate itertools;
 
 #[macro_use]

ethcore/src/types/trace_types/error.rs

@@ -34,7 +34,9 @@ pub enum Error {
 	/// `StackUnderflow` when there is not enough stack elements to execute instruction
 	StackUnderflow,
 	/// When execution would exceed defined Stack Limit
-	OutOfStack,
+	OutOfStack,	
+	/// When builtin contract failed on input data
+	BuiltIn,
 	/// Returned on evm internal error. Should never be ignored during development.
 	/// Likely to cause consensus issues.
 	Internal,
@@ -48,6 +50,7 @@ impl<'a> From<&'a EvmError> for Error {
 			EvmError::BadInstruction { .. } => Error::BadInstruction,
 			EvmError::StackUnderflow { .. } => Error::StackUnderflow,
 			EvmError::OutOfStack { .. } => Error::OutOfStack,
+			EvmError::BuiltIn { .. } => Error::BuiltIn,
 			EvmError::Internal(_) => Error::Internal,
 		}
 	}
@@ -68,6 +71,7 @@ impl fmt::Display for Error {
 			BadInstruction => "Bad instruction",
 			StackUnderflow => "Stack underflow",
 			OutOfStack => "Out of stack",
+			BuiltIn => "Built-in failed",
 			Internal => "Internal error",
 		};
 		message.fmt(f)
@@ -84,6 +88,7 @@ impl Encodable for Error {
 			StackUnderflow => 3,
 			OutOfStack => 4,
 			Internal => 5,
+			BuiltIn => 6,
 		};
 
 		s.append_internal(&value);
@@ -101,6 +106,7 @@ impl Decodable for Error {
 			3 => Ok(StackUnderflow),
 			4 => Ok(OutOfStack),
 			5 => Ok(Internal),
+			6 => Ok(BuiltIn),
 			_ => Err(DecoderError::Custom("Invalid error type")),
 		}
 	}