Vulnerability: Gas Greifing and Missing Return Status Check for staticcall(s), May Lead to Unexpected Outcomes  Partially Addressed
Severity: high

Description:
The gas supplied to the staticcall(s), is calculated by subtracting `2000` from the remaining gas at this point in time. However, if not provided enough gas, the staticcall(s) may fail and there will be no return data, and the execution will continue with the stale data that was previously there at the memory location specified by the return offset with the staticcall(s).\\n1- Predictable Derivation of Challenges\\nThe function `derive_gamma_beta_alpha_zeta` is used to derive the challenge values `gamma`, `beta`, `alpha`, `zeta`. These values are derived from the prover's transcript by hashing defined parameters and are supposed to be unpredictable by either the prover or the verifier. The hash is collected with the help of SHA2-256 precompile. The values are considered unpredictable, due to the assumption that SHA2-256 acts as a random oracle and it would be computationally infeasible for an attacker to find the pre-image of `gamma`. However, the assumption might be wrong.\\n```\\npop(staticcall(sub(gas(), 2000), 0x2, add(mPtr, 0x1b), size, mPtr, 0x20)) //0x1b -> 000.."gamma"\\n```\\n\\n```\\npop(staticcall(sub(gas(), 2000), 0x2, add(mPtr, 0x1c), 0x24, mPtr, 0x20)) //0x1b -> 000.."gamma"\\n```\\n\\n```\\npop(staticcall(sub(gas(), 2000), 0x2, add(mPtr, 0x1b), 0x65, mPtr, 0x20)) //0x1b -> 000.."gamma"\\n```\\n\\n```\\npop(staticcall(sub(gas(), 2000), 0x2, add(mPtr, 0x1c), 0xe4, mPtr, 0x20))\\n```\\n\\n```\\npop(staticcall(sub(gas(), 2000), 0x2, add(mPtr,start\\_input), size\\_input, add(state, state\\_gamma\\_kzg), 0x20))\\n```\\n\\nIf the staticcall(s) fails, it will make the challenge values to be predictable and may help the prover in forging proofs and launching other adversarial attacks.\\n2- Incorrect Exponentiation\\nFunctions `compute_ith_lagrange_at_z`, `compute_pi`, and `verify` compute modular exponentiation by making a `staticcall` to the precompile `modexp` as:\\n```\\npop(staticcall(sub(gas(), 2000),0x05,mPtr,0xc0,0x00,0x20))\\n```\\n\\n```\\npop(staticcall(sub(gas(), 2000),0x05,mPtr,0xc0,mPtr,0x20))\\n```\\n\\n```\\npop(staticcall(sub(gas(), 2000),0x05,mPtr,0xc0,mPtr,0x20))\\n```\\n\\nHowever, if not supplied enough gas, the staticcall(s) will fail, thus returning no result and the execution will continue with the stale data.\\n3. Incorrect Point Addition and Scalar Multiplication\\n```\\npop(staticcall(sub(gas(), 2000),7,folded\\_evals\\_commit,0x60,folded\\_evals\\_commit,0x40))\\n```\\n\\n```\\nlet l\\_success := staticcall(sub(gas(), 2000),6,mPtr,0x80,dst,0x40)\\n```\\n\\n```\\nlet l\\_success := staticcall(sub(gas(), 2000),7,mPtr,0x60,dst,0x40)\\n```\\n\\n```\\nlet l\\_success := staticcall(sub(gas(), 2000),7,mPtr,0x60,mPtr,0x40)\\n```\\n\\n```\\nl\\_success := and(l\\_success, staticcall(sub(gas(), 2000),6,mPtr,0x80,dst, 0x40))\\n```\\n\\nFor the same reason, `point_add`, `point_mul`, and `point_acc_mul` will return incorrect results. Matter of fact, `point_acc_mul` will not revert even if the scalar multiplication fails in the first step. Because, the memory location specified for the return offset, will still be containing the old (x,y) coordinates of `src`, which are points on the curve. Hence, it will proceed by incorrectly adding (x,y) coordinates of `dst` with it.\\nHowever, it will not be practically possible to conduct a gas griefing attack for staticcall(s) at the start of the top-level transaction. As it will require an attacker to pass a very low amount of gas to make the `staticcall` fail, but at the same time, that would not be enough to make the top-level transaction execute entirely and not run out of gas. But, this can still be conducted for the staticcall(s) that are executed at the near end of the top-level transaction.

Impact:

Recommended mitigation:
Check the returned status of the staticcall and revert if any of the staticcall's return status has been 0.\\nAlso fix the comments mentioned for every staticcall, for instance: the function `derive_beta` says `0x1b -> 000.."gamma"` while the memory pointer holds the ASCII value of string `beta`