fix: pairing cost formula

[kunxian-xia]

This pr fixes the #658.

[rakita]

Posting this here for awareness #658 (comment).

the gas used is indeed wrong but the precompile expects that len be multiple of PAIR_ELEMENT_LEN so the outcome would be the same:

https://github.com/bluealloy/revm/blob/main/crates/precompile/src/bn128.rs#L176-L178

[roynalnaruto]

@rakita our test case was an out-of-gas case, but with len(input) not a multiple of 192. The trace from go-ethereum indeed catches the out-of-gas error. However we used revm in our bus-mapping implementation to get the precompile result, where although the call fails (due to the len(input) not being a multiple of 192), it fails for a different reason (not out-of-gas). And this resulted in a mismatch between traces from go-ethereum and the witness we construct in zkEvm.

A summary of how the bug was identified^

[rakita]

@rakita our test case was an out-of-gas case, but with len(input) not a multiple of 192. The trace from go-ethereum indeed catches the out-of-gas error. However we used revm in our bus-mapping implementation to get the precompile result, where although the call fails (due to the len(input) not being a multiple of 192), it fails for a different reason (not out-of-gas). And this resulted in a mismatch between traces from go-ethereum and the witness we construct in zkEvm.

A summary of how the bug was identified^

Yep, it is a bug, and a nice find! But at first look, it looked a lot more serious (like everything is going to break, wrong gas calculation etc.) so I just wanted to add what impact is.