Skip to content

Incorrect precompile address lookup in DELEGATECALL context

High
fakedev9999 published GHSA-x8rg-xfvg-9fq3 Jan 21, 2026

Package

No package listed

Affected versions

<=3.4.1

Patched versions

None

Description

Summary

The precompile provider incorrectly uses target_address instead of bytecode_address when looking up precompiles, causing failures when contracts invoke precompiles via DELEGATECALL.

Impact

Blocks containing transactions that DELEGATECALL to precompiles are unprovable.
The derived block hash and state root will not match the canonical chain, causing proof generation to fail.

Details

In DELEGATECALL context:

  • target_address: The calling contract's address (context preservation)
  • bytecode_address: The actual precompile address being invoked

Using target_address causes the precompile lookup to fail, resulting in:

  • Incorrect gas calculations
  • Different execution results
  • Invalid block derivation

Patches

Fix to be included in next v3.5.0 release by changing precompile lookups from inputs.target_address to inputs.bytecode_address.

References

Severity

High

CVE ID

No known CVE

Weaknesses

No CWEs

Credits