fix t8n's EthAddress parser

tools/t8n/helpers.nim

@@ -34,8 +34,14 @@ proc parseHexOrInt[T](x: string): T =
     else:
       parseInt(x).T
 
-template fromJson(T: type EthAddress, n: JsonNode, field: string): EthAddress =
-  hexToByteArray(n[field].getStr(), sizeof(T))
+proc fromJson(T: type EthAddress, n: JsonNode, field: string): EthAddress =
+  let x = n[field].getStr()
+  var xlen = x.len
+  if x.startsWith("0x"):
+    xlen = xlen - 2
+  if xlen != sizeof(T) * 2:
+    raise newError(ErrorJson, "malformed Eth address " & x)
+  hexToByteArray(x, sizeof(T))
 
 template fromJson(T: type Blob, n: JsonNode, field: string): Blob =
   hexToSeqByte(n[field].getStr())

tools/t8n/t8n_test.nim

@@ -448,6 +448,15 @@ const
       output: T8nOutput(alloc: true, result: true),
       expOut: "exp.json",
     ),
+    TestSpec(
+      name  : "Malicious withdrawals address",
+      base  : "testdata/00-515",
+      input : t8nInput(
+        "alloc.json", "txs.json", "env.json", "Shanghai", "",
+      ),
+      output: T8nOutput(alloc: false, result: false),
+      expExitCode: ErrorJson.int,
+    ),
   ]
 
 proc main() =

tools/t8n/testdata/00-515/alloc.json

@@ -0,0 +1,8 @@
+{
+  "a94f5374fce5edbc8e2a8697c15331677e6ebf0b": {
+    "balance": "0x0",
+    "code": "0x",
+    "nonce": "0xac",
+    "storage": {}
+  }
+}

tools/t8n/testdata/00-515/env.json

@@ -0,0 +1,17 @@
+{
+  "currentCoinbase": "0xc94f5374fce5edbc8e2a8697c15331677e6ebf0b",
+  "currentDifficulty": null,
+  "currentRandom": "0xdeadc0de",
+  "currentGasLimit": "0x750a163df65e8a",
+  "currentBaseFee": "0x500",
+  "currentNumber": "1",
+  "currentTimestamp": "1000",
+  "withdrawals": [
+    {
+      "index" : "0x0",
+      "validatorIndex" : "0x0",
+      "amount" : "0x2710",
+      "address" : "0x00c94f5374fce5edbc8e2a8697c15331677e6ebf0b"
+    }
+  ]
+}

tools/t8n/testdata/00-515/txs.json

@@ -0,0 +1 @@
+[]