Fix critical security vulnerabilities and EVM compliance issues

[Copilot]

Addresses stack underflow memory corruption, ADDMOD/MULMOD arithmetic overflow, and use-after-free in memory operations. BYTE instruction verified correct, no changes needed.

Stack Underflow Protection

Stack pop operations now check for underflow before decrementing stack_ptr. Returns null pointer on underflow, detected by caller which returns StackUnderflow error instead of wrapping to u32::MAX and accessing arbitrary memory.

// In build_stack_pop - check before decrement
let is_underflow = self.builder.build_int_compare(
    inkwell::IntPredicate::EQ,
    stack_ptr,
    self.types.i32.const_zero(),
    "is_underflow",
)?;
// Branch to return null if underflow detected

ADDMOD/MULMOD 512-bit Intermediate Arithmetic

EVM spec requires unlimited precision for (a + b) % N and (a * b) % N to prevent overflow before modulo. Implemented runtime builtins using bnum's U512 for intermediate calculations:

// Convert to 512-bit, perform operation, then mod and downcast
let a_u512 = u256_to_u512(a_u256);
let b_u512 = u256_to_u512(b_u256);
let sum = a_u512 + b_u512;  // No overflow possible
let result = (sum % n_u512).as_u256();

Handles division-by-zero per spec (returns 0). Symbol mappings added to execution engine.

Memory UAF Prevention

mem_load previously returned pointer into memory buffer. When mem_expand reallocates, those pointers become dangling. Changed to return i256 value directly:

// Old: returned pointer that could dangle
let byte_ptr = /* calculate pointer into memory buffer */;
self.builder.build_return(Some(&byte_ptr))

// New: load and return value immediately
let value = self.builder.build_load(self.types.i256, byte_ptr, "mem.value")?;
self.builder.build_return(Some(&value))

BYTE Instruction

Verified implementation correct. The 31 - index formula properly converts big-endian EVM indices to little-endian internal representation per existing tests and spec.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
crates/jet/src/builder/ops.rs	22% smaller
crates/jet_runtime/src/runtime_builder.rs	6% smaller
crates/jet/src/builder/env.rs	0% smaller
crates/jet/src/engine/mod.rs	0% smaller
crates/jet_runtime/src/builtins.rs	0% smaller
crates/jet_runtime/src/exec.rs	0% smaller
crates/jet_runtime/src/symbols.rs	0% smaller

[Copilot]

Pull request overview

This pull request addresses three critical security vulnerabilities in the EVM implementation: stack underflow memory corruption, ADDMOD/MULMOD arithmetic overflow, and use-after-free in memory operations.

Changes:

• Stack underflow protection: Adds bounds checking in stack_pop to return null pointer on underflow, with caller detecting and returning StackUnderflow error
• ADDMOD/MULMOD 512-bit precision: Implements runtime builtins using bnum's U512 for intermediate arithmetic to prevent overflow before modulo, as required by EVM spec
• Memory UAF fix: Changes mem_load to return i256 value directly instead of pointer, preventing dangling pointer issues when memory is reallocated

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
crates/jet_runtime/src/symbols.rs	Adds symbol constants FN_ADDMOD and FN_MULMOD for new builtin functions
crates/jet_runtime/src/runtime_builder.rs	Adds LLVM function declarations for addmod/mulmod, implements stack underflow check in build_stack_pop, changes mem_load return type from ptr to i256
crates/jet_runtime/src/exec.rs	Adds StackUnderflow = -2 return code enum variant
crates/jet_runtime/src/builtins.rs	Implements jet_ops_addmod and jet_ops_mulmod with 512-bit intermediate arithmetic using bnum, includes helper functions for U256/U512 conversions
crates/jet/src/engine/mod.rs	Registers addmod and mulmod builtins with execution engine symbol map
crates/jet/src/builder/ops.rs	Updates addmod/mulmod to call new builtins, adds null pointer check in call_stack_pop for underflow detection, updates mload to handle i256 return value from mem_load
crates/jet/src/builder/env.rs	Adds addmod and mulmod function value fields to Symbols struct with accessor methods

[Copilot]

The stack underflow detection logic is not covered by tests. Consider adding a test case that attempts to pop from an empty stack to verify that the StackUnderflow error is properly returned. This would ensure the security-critical underflow protection works correctly.