From 8f215241a5d045fef8de2a7ed8ea37a1e04727aa Mon Sep 17 00:00:00 2001
From: Guillaume Ballet <3272758+gballet@users.noreply.github.com>
Date: Wed, 4 Mar 2026 13:15:31 +0100
Subject: [PATCH] trie/bintrie: fix overflow management in slot key computation

---
 trie/bintrie/key_encoding.go | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/trie/bintrie/key_encoding.go b/trie/bintrie/key_encoding.go
index 94a22d52d0..c5fc1d2af6 100644
--- a/trie/bintrie/key_encoding.go
+++ b/trie/bintrie/key_encoding.go
@@ -47,11 +47,19 @@ var (
 )
 
 func GetBinaryTreeKey(addr common.Address, key []byte) []byte {
+	return getBinaryTreeKey(addr, key, false)
+}
+
+func getBinaryTreeKey(addr common.Address, key []byte, overflow bool) []byte {
 	hasher := sha256.New()
 	hasher.Write(zeroHash[:12])
 	hasher.Write(addr[:])
 	hasher.Write(key[:31])
-	hasher.Write([]byte{0})
+	if overflow {
+		hasher.Write([]byte{1})
+	} else {
+		hasher.Write([]byte{0})
+	}
 	k := hasher.Sum(nil)
 	k[31] = key[31]
 	return k
@@ -82,11 +90,12 @@ func GetBinaryTreeKeyStorageSlot(address common.Address, key []byte) []byte {
 	// note that the first 64 bytes of the main offset storage
 	// are unreachable, which is consistent with the spec and
 	// what verkle does.
-	k[0] = 1 // 1 << 248
-	copy(k[1:], key[:31])
+	copy(k[:31], key[:31])
+	overflow := k[0] == 255
+	k[0] += 1 // 1 << 248, handle overflow out of band
 	k[31] = key[31]
 
-	return GetBinaryTreeKey(address, k[:])
+	return getBinaryTreeKey(address, k[:], overflow)
 }
 
 func GetBinaryTreeKeyCodeChunk(address common.Address, chunknr *uint256.Int) []byte {