Update gas cost of secp256 and ed25519

Author: chipshort

packages/vm/src/environment.rs

@@ -42,11 +42,9 @@ pub struct GasConfig {
     /// ed25519 signature verification cost
     pub ed25519_verify_cost: u64,
     /// ed25519 batch signature verification cost
-    /// This is charged per signature.
-    pub ed25519_batch_verify_cost: u64,
+    pub ed25519_batch_verify_cost: LinearGasCost,
     /// ed25519 batch signature verification cost (single public key)
-    /// This is charged per signature.
-    pub ed25519_batch_verify_one_pubkey_cost: u64,
+    pub ed25519_batch_verify_one_pubkey_cost: LinearGasCost,
     /// bls12-381 aggregate cost per point (g1)
     pub bls12_381_aggregate_g1_per_point: u64,
     /// bls12-381 aggregate cost per point (g2)
@@ -67,20 +65,26 @@ impl Default for GasConfig {
         // Target is 10^12 per second (see GAS.md), i.e. 10^6 gas per µ second.
         const GAS_PER_US: u64 = 1_000_000;
         Self {
-            // ~119 us in crypto benchmarks
-            secp256k1_verify_cost: 119 * GAS_PER_US,
-            // ~233 us in crypto benchmarks
-            secp256k1_recover_pubkey_cost: 233 * GAS_PER_US,
-            // ~374 us in crypto benchmarks
-            secp256r1_verify_cost: 374 * GAS_PER_US,
-            // ~834 us in crypto benchmarks
-            secp256r1_recover_pubkey_cost: 834 * GAS_PER_US,
-            // ~63 us in crypto benchmarks
-            ed25519_verify_cost: 63 * GAS_PER_US,
-            // Gas cost factors, relative to ed25519_verify cost
-            // From https://docs.rs/ed25519-zebra/2.2.0/ed25519_zebra/batch/index.html
-            ed25519_batch_verify_cost: 63 * GAS_PER_US / 2,
-            ed25519_batch_verify_one_pubkey_cost: 63 * GAS_PER_US / 4,
+            // ~96 us in crypto benchmarks
+            secp256k1_verify_cost: 96 * GAS_PER_US,
+            // ~194 us in crypto benchmarks
+            secp256k1_recover_pubkey_cost: 194 * GAS_PER_US,
+            // ~279 us in crypto benchmarks
+            secp256r1_verify_cost: 279 * GAS_PER_US,
+            // ~592 us in crypto benchmarks
+            secp256r1_recover_pubkey_cost: 592 * GAS_PER_US,
+            // ~35 us in crypto benchmarks
+            ed25519_verify_cost: 35 * GAS_PER_US,
+            // Calculated based on the benchmark results for `ed25519_batch_verify_{x}`.
+            ed25519_batch_verify_cost: LinearGasCost {
+                base: 24 * GAS_PER_US,
+                per_item: 21 * GAS_PER_US,
+            },
+            // Calculated based on the benchmark results for `ed25519_batch_verify_one_pubkey_{x}`.
+            ed25519_batch_verify_one_pubkey_cost: LinearGasCost {
+                base: 36 * GAS_PER_US,
+                per_item: 10 * GAS_PER_US,
+            },
             // just assume the production machines have more than 4 cores, so we can half that
             bls12_381_aggregate_g1_per_point: 16 * GAS_PER_US / 2,
             bls12_381_aggregate_g2_per_point: 33 * GAS_PER_US / 2,
@@ -93,6 +97,25 @@ impl Default for GasConfig {
     }
 }
 
+/// Linear gas cost model where the cost is linear in the number of items.
+///
+/// To calculate it, you sample the cost for a few different amounts of items and fit a line to it.
+/// Let `b` be that line of best fit. Then `base = b(0)` is the y-intercept and
+/// `per_item = b(1) - b(0)` the slope.
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct LinearGasCost {
+    /// This is a flat part of the cost, charged once per batch.
+    base: u64,
+    /// This is the cost per item in the batch.
+    per_item: u64,
+}
+
+impl LinearGasCost {
+    pub fn total_cost(&self, items: u64) -> u64 {
+        self.base + self.per_item * items
+    }
+}
+
 /** context data **/
 
 #[derive(Clone, PartialEq, Eq, Debug, Default)]

packages/vm/src/imports.rs

@@ -728,14 +728,14 @@ pub fn do_ed25519_batch_verify<
     let signatures = decode_sections(&signatures);
     let public_keys = decode_sections(&public_keys);
 
-    let gas_cost_per_sig = if public_keys.len() == 1 {
-        data.gas_config.ed25519_batch_verify_one_pubkey_cost
+    let gas_cost = if public_keys.len() == 1 {
+        &data.gas_config.ed25519_batch_verify_one_pubkey_cost
     } else {
-        data.gas_config.ed25519_batch_verify_cost
+        &data.gas_config.ed25519_batch_verify_cost
     };
     let gas_info = GasInfo::with_cost(max(
         // charge for each signature
-        gas_cost_per_sig * (signatures.len() as u64),
+        gas_cost.total_cost(signatures.len() as u64),
         // but ensure we charge something even if there are no signatures
         data.gas_config.ed25519_verify_cost,
     ));