Skip to content

feat(engine/ssz): add target_gas_limit to PayloadAttributesV4 wire#11647

Merged
benaadams merged 1 commit into
NethermindEth:feat/engine-payload-attrs-target-gas-limitfrom
barnabasbusa:bbusa/ssz-payload-attrs-v4-target-gas-limit-master
May 18, 2026
Merged

feat(engine/ssz): add target_gas_limit to PayloadAttributesV4 wire#11647
benaadams merged 1 commit into
NethermindEth:feat/engine-payload-attrs-target-gas-limitfrom
barnabasbusa:bbusa/ssz-payload-attrs-v4-target-gas-limit-master

Conversation

@barnabasbusa

Copy link
Copy Markdown

Summary

Stacked on top of #11611. Plumbs the new `TargetGasLimit` field through the SSZ-REST wire schema for `engine_forkchoiceUpdatedV4` (introduced in #11611 for JSON-RPC).

  • `PayloadAttributesWire` gains `target_gas_limit: uint64` at the end of the container (matches execution-apis ssz-encoding.md `PayloadAttributesV4`).
  • `SszCodec.PayloadAttributesFromWire` forwards the wire `ulong` as `long` to `PayloadAttributes.TargetGasLimit`.
  • `DecodeFcuV4Request` round-trip test now also asserts `target_gas_limit` survives encode/decode, using a diverse-byte value (`0x0123456789ABCDEF`) rather than a plausible default.

Why

Without the SSZ wire counterpart, CLs that send `targetGasLimit` over the SSZ-REST transport (`POST /engine/v4/forkchoice`, advertised under execution-apis PR #764) get rejected as Malformed SSZ body — the 8 extra trailing bytes shift the inner `withdrawals` offset inside `PayloadAttributesV4`.

Spec alignment:

Fail-loud guarantee

The wire `target_gas_limit` is a required fixed-size `uint64` (per ssz-encoding.md), so a missing value fails SSZ decode directly — the V4 null-guard in `PayloadAttributes.GetInvalidPayloadAttributesMessage` (`Producers/PayloadAttributes.cs:232`) remains as defense-in-depth for the JSON path. No default-value fallback anywhere.

Sister PRs

Test plan

  • `DecodeFcuV4Request_spec_layout_roundtrips_parent_beacon_block_root_and_slot_number` now asserts `target_gas_limit` round-trips
  • CI green
  • Manual: consensoor ↔ nethermind on glamsterdam devnet — fcU v4 over SSZ no longer rejected

Plumbs the new TargetGasLimit field added in this PR through the
SSZ-REST wire schema for engine_forkchoiceUpdatedV4 (PR NethermindEth#764).

Without this, CLs that include target_gas_limit in the SSZ body get
rejected as "Malformed SSZ body" because the 8 extra trailing bytes
shift the inner withdrawals offset.

The wire field is a required fixed-size uint64 (per execution-apis
ssz-encoding.md), so a missing value fails SSZ decode directly — the
V4 null-guard in PayloadAttributes.GetInvalidPayloadAttributesMessage
remains as defense-in-depth for the JSON path.

Changes:
- PayloadAttributesWire gains target_gas_limit at the end of the
  container (matches execution-apis ssz-encoding.md PayloadAttributesV4).
- SszCodec.PayloadAttributesFromWire forwards the wire ulong as long
  to PayloadAttributes.TargetGasLimit.
- DecodeFcuV4Request roundtrip test now also asserts target_gas_limit
  survives encode/decode, using a diverse-byte value (0x0123456789ABCDEF).
@benaadams

Copy link
Copy Markdown
Member

Thank you for your contribution

@benaadams benaadams merged commit 8a82ef5 into NethermindEth:feat/engine-payload-attrs-target-gas-limit May 18, 2026
512 of 513 checks passed
benaadams added a commit that referenced this pull request Jun 3, 2026
commit 96ff773
Merge: 8a82ef5 1bb7582
Author: lukasz.rozmej <lukasz.rozmej@gmail.com>
Date:   Tue Jun 2 13:33:56 2026 +0200

    Merge branch 'master' into feat/engine-payload-attrs-target-gas-limit

commit 8a82ef5
Author: Barnabas Busa <barnabas.busa@ethereum.org>
Date:   Mon May 18 15:47:00 2026 +0200

    feat(engine/ssz): add target_gas_limit to PayloadAttributesV4 wire (#11647)

    Plumbs the new TargetGasLimit field added in this PR through the
    SSZ-REST wire schema for engine_forkchoiceUpdatedV4 (PR #764).

    Without this, CLs that include target_gas_limit in the SSZ body get
    rejected as "Malformed SSZ body" because the 8 extra trailing bytes
    shift the inner withdrawals offset.

    The wire field is a required fixed-size uint64 (per execution-apis
    ssz-encoding.md), so a missing value fails SSZ decode directly — the
    V4 null-guard in PayloadAttributes.GetInvalidPayloadAttributesMessage
    remains as defense-in-depth for the JSON path.

    Changes:
    - PayloadAttributesWire gains target_gas_limit at the end of the
      container (matches execution-apis ssz-encoding.md PayloadAttributesV4).
    - SszCodec.PayloadAttributesFromWire forwards the wire ulong as long
      to PayloadAttributes.TargetGasLimit.
    - DecodeFcuV4Request roundtrip test now also asserts target_gas_limit
      survives encode/decode, using a diverse-byte value (0x0123456789ABCDEF).

commit e60c92c
Author: lukasz.rozmej <lukasz.rozmej@gmail.com>
Date:   Fri May 15 08:05:21 2026 +0200

    refactor(aura): reuse inner calculator for IsGasLimitValid bound check

    `AuRaContractGasLimitOverride.IsGasLimitValid` now round-trips the
    candidate gas limit through `_innerCalculator` (a
    `TargetAdjustedGasLimitCalculator` in production): if the calculator
    returns the candidate unchanged it's within the standard parent ±
    delta range, otherwise it's been clamped. Drops the duplicated delta
    math and the `ISpecProvider` dependency added in the previous commit.

    Also strip the verbose XML doc comments added on `TargetGasLimit`,
    `PayloadAttributes.GetGasLimit`, `IGasLimitCalculator.GetGasLimit`,
    and the explanatory test comments.

commit fcd8b67
Author: lukasz.rozmej <lukasz.rozmej@gmail.com>
Date:   Fri May 15 07:11:04 2026 +0200

    fix(aura): relax IsGasLimitValid for CL-supplied targetGasLimit

    `AuRaContractGasLimitOverride.GetGasLimit` prefers the CL-supplied
    `targetGasLimit` (PayloadAttributesV4) over the on-chain contract
    value, but `IsGasLimitValid` — called from `AuRaBlockProcessor` —
    still strictly required the block to match the contract. On an AuRa
    chain with an active gas-limit contract that ever activates
    EIP-7843, a producer using the override path would emit a block its
    own validator rejects.

    Accept any block gas limit within parent ± delta when it differs
    from the contract value (HeaderValidator independently enforces the
    full consensus rule). Inject `ISpecProvider` so the bound divisor is
    read from the active release spec instead of being hardcoded.

commit 6abd4a3
Author: lukasz.rozmej <lukasz.rozmej@gmail.com>
Date:   Thu May 14 21:44:01 2026 +0200

    refactor(consensus): rename targetGasLimitOverride to targetGasLimit

    Align with the spec field name (`PayloadAttributesV4.targetGasLimit`).
    The "override" suffix was redundant — a non-null value already means
    override behavior. Inside `TargetAdjustedGasLimitCalculator`, reuse the
    parameter via `??=` instead of an extra local.

    Also drop the unused `using Nethermind.Xdc.Spec` in XdcGasLimitCalculator
    (left over from the previous expression-body collapse) — was failing the
    `IDE0005` lint check.

commit 74e2729
Author: lukasz.rozmej <lukasz.rozmej@gmail.com>
Date:   Thu May 14 21:32:17 2026 +0200

    style(xdc): collapse XdcGasLimitCalculator.GetGasLimit to expression body

commit c3ae2b4
Author: lukasz.rozmej <lukasz.rozmej@gmail.com>
Date:   Thu May 14 17:57:42 2026 +0200

    refactor(engine): simplify targetGasLimit wiring; AuRa override wins

    - Type `TargetGasLimit` as `long?` directly (was `ulong?`), dropping the
      narrowing cast and the upper-bound `> long.MaxValue` validation. Gas
      limits in Nethermind are already stored as `long`.
    - Consolidate the parameterless `PayloadAttributes.GetGasLimit()` and
      the duplicated `payloadAttributes?` access at the call site into a
      single `GetGasLimit(BlockHeader parent, IGasLimitCalculator calc)`.
      Base implementation routes `TargetGasLimit` through the calculator;
      Boost/Optimism/Taiko override to return their unadjusted value.
    - AuRa: drop the conflict warning and flip precedence — the CL's
      per-FCU `targetGasLimit` now takes priority over the on-chain
      contract value, with the contract acting as fallback when no
      override is supplied.
    - Dedup `TargetAdjustedGasLimitCalculatorTests` and the new AuRa
      override tests around small construction helpers.

commit e217c72
Author: lukasz.rozmej <lukasz.rozmej@gmail.com>
Date:   Thu May 14 17:29:29 2026 +0200

    fix(engine): address review on targetGasLimit handling

    - Collapse `IGasLimitCalculator.GetGasLimit` to a single method with
      `long? targetGasLimitOverride = null` default; update all
      implementations (TargetAdjusted, AuRa, FollowOtherMiners, Optimism,
      Xdc, ManualGasLimitCalculator).
    - Reject `TargetGasLimit > long.MaxValue` in `PayloadAttributes.Validate`
      to prevent silent wrap of the `ulong? -> long?` narrowing. Cast sites
      in BlockProducerBase / TestingRpcModule now use a `checked` cast for
      defense-in-depth on paths that bypass validation.
    - AuRa contract override: when the contract returns a limit and the CL
      also supplies a `targetGasLimit`, log a warning so operators know the
      contract takes precedence; otherwise forward the override to the
      inner calculator.
    - Add focused unit tests for AuRa: contract wins (override ignored) and
      no-contract (override forwarded). Add a V4 validation case for
      `TargetGasLimit > Int64.MaxValue`.

commit 9524007
Author: lukasz.rozmej <lukasz.rozmej@gmail.com>
Date:   Thu May 14 16:54:06 2026 +0200

    feat(engine): support targetGasLimit in PayloadAttributesV4

    Implements ethereum/execution-apis#796, which adds a required
    `targetGasLimit` field to `PayloadAttributesV4` so the CL can supply
    the per-FCU gas-limit target instead of relying on the EL's static
    configuration.

    - `PayloadAttributes.TargetGasLimit` is included in `ToString`, the
      payload-id hash input, version inference, and required-field
      validation for V4 attributes.
    - `IGasLimitCalculator` gains an overload accepting an optional
      target override; `TargetAdjustedGasLimitCalculator` honors it,
      taking precedence over `BlocksConfig.TargetBlockGasLimit`.
      `AuRaContractGasLimitOverride` forwards the override to its inner
      calculator.
    - `BlockProducerBase` and `TestingRpcModule` pass the per-call target
      into the calculator so the standard gas-limit adjustment applies.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants