# Precompile gas and context mismatch

Hardcoded or assumed precompile gas, semantics, or context that differ across chains or L1 vs L2

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-06-18. Updated 2026-10-24._

## How it works
Code assumes a precompile behaves the same everywhere: same gas price, same gas ceiling, same return semantics. That assumption breaks when the precompile is priced differently on another chain, when reproducing the call on a different layer costs more than the original, or when the emulated opcode's edge-case semantics differ from the EIP. The call then fails, or returns a value the caller misreads, even though the source looks correct.

## Where it shows up
- A hardcoded gas constant passed to a precompile `staticcall` (e.g. a pairing check stipend) [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-6.md)
- Precompiles with dynamic, input-sized gas (pairing, KZG) whose cost can approach a full block [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AH-04.md)
- Fault-proof or oracle code that must re-execute an L2 operation on L1, paying EIP-150 63/64 forwarding plus calldata overhead [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AH-04.md)
- Opcode emulation (extcodehash, account emptiness) that ignores balance/nonce or special-cases precompile address ranges [E3](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-19.md)
- Any cross-chain or L1/L2 equivalence layer where gas schedules or precompile pricing are not identical [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AH-04.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-6.md)

## How to review
For each precompile call, establish the invariant: the gas supplied must be at least the target chain's actual cost for the worst-case input, and the reproduction path must fit within the destination block limit. Check the constant against the target chain's real pricing (not EIP-1108 by default) [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-6.md). For re-execution paths, compare original cost plus forwarding and calldata overhead against the L1 block gas limit [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AH-04.md). For emulated opcodes, diff the implementation line-by-line against the EIP, including balance/nonce in emptiness checks and precompile handling [E3](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-19.md).

## Variants seen
- Hardcoded pairing gas too low for a chain with higher EcPairing pricing, so verification always reverts [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-6.md)
- L2 precompile call consuming near-full block gas that cannot be reproduced on L1, stalling the fault-proof step [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AH-04.md)
- Emulated extcodehash diverging from EIP-1052 on empty accounts and precompiles [E3](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-19.md)

## Impact and severity
Ranged from broken signature verification [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-6.md) to blocked invalid-state challenges in a fault-proof system [E1](https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AH-04.md) and consensus-relevant opcode divergence [E3](https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-19.md). Severity rises when the mismatch is unconditional (always fails) or sits in dispute/verification logic where failure halts safety guarantees.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-07-optimism%3AH-04.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-06-symbiotic-relay%3AM-6.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-10-zksync%3AM-19.md