fix(evm): address devnet-6 review findings in the state-gas policy

- Make advanced state-gas refund revocation exact: track how much spill
  refund each advance marked (VmState.StateGasSpillRefundAdvanced) and
  undo it on revert; the removal drains the reservoir only to zero, then
  recorded usage, and restores any net-spill debt the credit had filled.
- Set the OutOfGas flag when ConsumeStateGas fails on the spill path.
- Saturate the EIP-7825 cap subtraction in CreateAvailableFromIntrinsic
  (replacing the debug assert) so an over-cap intrinsic moves the excess
  to the reservoir; regression tests for all three.
- Extract the shared destroy/recreate logic into DestroyAccount on the
  non-generic TransactionProcessorBase.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Marchhill

src/Nethermind/Nethermind.Evm.Test/Eip8037Tests.cs

@@ -213,8 +213,46 @@ public void ConsumeStateGas_oog_does_not_zero_reservoir()
 
         bool consumed = EthereumGasPolicy.ConsumeStateGas(ref gas, 70);
 
-        Assert.That((consumed, gas.Value, gas.StateReservoir, gas.StateGasUsed, gas.StateGasSpill),
-            Is.EqualTo((false, 10L, 50L, 0L, 0L)));
+        Assert.That((consumed, gas.Value, gas.StateReservoir, gas.StateGasUsed, gas.StateGasSpill, EthereumGasPolicy.IsOutOfGas(in gas)),
+            Is.EqualTo((false, 10UL, 50L, 0L, 0L, true)));
+    }
+
+    [Test]
+    public void Revoking_advanced_refund_restores_net_spill_reservoir_and_spill_tracking()
+    {
+        // A net-spill (negative) reservoir, as left by RestoreChildStateGas after nested spills.
+        EthereumGasPolicy gas = new() { Value = 400, StateReservoir = -300, StateGasUsed = 0, StateGasSpill = 300, StateGasSpillRefunded = 0 };
+
+        long tracked = EthereumGasPolicy.AddStateGasRefundToReservoir(ref gas, 200, trackSpillRefund: true);
+        Assert.That((tracked, gas.StateReservoir, gas.StateGasSpillRefunded), Is.EqualTo((200L, -100L, 200L)));
+
+        EthereumGasPolicy.RemoveStateGasRefundFromReservoir(ref gas, 200, tracked);
+
+        Assert.That((gas.StateReservoir, gas.StateGasUsed, gas.StateGasSpillRefunded), Is.EqualTo((-300L, 0L, 0L)));
+    }
+
+    [Test]
+    public void Revoking_consumed_advanced_refund_deducts_usage_without_fabricating_spill_debt()
+    {
+        EthereumGasPolicy gas = new() { Value = 400, StateReservoir = 0, StateGasUsed = 100 };
+
+        long tracked = EthereumGasPolicy.AddStateGasRefundToReservoir(ref gas, 200, trackSpillRefund: true);
+        Assert.That(EthereumGasPolicy.ConsumeStateGas(ref gas, 200), Is.True);
+
+        EthereumGasPolicy.RemoveStateGasRefundFromReservoir(ref gas, 200, tracked);
+
+        Assert.That((gas.StateReservoir, gas.StateGasUsed), Is.EqualTo((0L, 100L)));
+    }
+
+    [Test]
+    public void Intrinsic_regular_gas_above_the_tx_cap_saturates_into_the_reservoir()
+    {
+        EthereumGasPolicy intrinsic = new() { Value = Eip7825Constants.DefaultTxGasLimitCap + 1, StateReservoir = 0 };
+
+        EthereumGasPolicy gas = EthereumGasPolicy.CreateAvailableFromIntrinsic(
+            Eip7825Constants.DefaultTxGasLimitCap + 2, in intrinsic, Amsterdam.Instance);
+
+        Assert.That((gas.Value, gas.StateReservoir), Is.EqualTo((0UL, 1L)));
     }
 
     [Test]

src/Nethermind/Nethermind.Evm/GasPolicy/EthereumGasPolicy.cs

@@ -137,6 +137,7 @@ public static bool ConsumeStateGas(ref EthereumGasPolicy gas, long stateGasCost)
         ulong spillAmount = CalculateStateGasSpill(in gas, stateGasCost);
         if (!TryConsume(ref gas, spillAmount))
         {
+            gas.OutOfGas = true;
             return false;
         }
 
@@ -385,34 +386,38 @@ public static long DiscardStateGas(ref EthereumGasPolicy gas, long amount, long
     }
 
     [MethodImpl(MethodImplOptions.AggressiveInlining)]
-    public static void AddStateGasRefundToReservoir(ref EthereumGasPolicy gas, long amount, bool trackSpillRefund)
+    public static long AddStateGasRefundToReservoir(ref EthereumGasPolicy gas, long amount, bool trackSpillRefund)
     {
-        if (trackSpillRefund)
-        {
-            TrackStateGasSpillRefund(ref gas, amount);
-        }
-
+        long trackedSpillRefund = trackSpillRefund ? TrackStateGasSpillRefund(ref gas, amount) : 0;
         gas.StateReservoir += amount;
+        return trackedSpillRefund;
     }
 
     [MethodImpl(MethodImplOptions.AggressiveInlining)]
-    public static void RemoveStateGasRefundFromReservoir(ref EthereumGasPolicy gas, long amount)
+    public static void RemoveStateGasRefundFromReservoir(ref EthereumGasPolicy gas, long amount, long trackedSpillRefund)
     {
-        long fromReservoir = Math.Min(amount, gas.StateReservoir);
+        gas.StateGasSpillRefunded -= Math.Min(trackedSpillRefund, gas.StateGasSpillRefunded);
+
+        // Revoke what is still parked in the reservoir (never fabricating spill debt), then
+        // usage the credit funded; any remainder refilled a net-spill hole, so restore the debt.
+        long fromReservoir = Math.Max(0, Math.Min(amount, gas.StateReservoir));
         gas.StateReservoir -= fromReservoir;
         amount -= fromReservoir;
 
         if (amount > 0)
         {
-            gas.StateGasUsed -= Math.Min(amount, gas.StateGasUsed);
+            long fromUsed = Math.Min(amount, gas.StateGasUsed);
+            gas.StateGasUsed -= fromUsed;
+            gas.StateReservoir -= amount - fromUsed;
         }
     }
 
     [MethodImpl(MethodImplOptions.AggressiveInlining)]
-    private static void TrackStateGasSpillRefund(ref EthereumGasPolicy gas, long amount)
+    private static long TrackStateGasSpillRefund(ref EthereumGasPolicy gas, long amount)
     {
-        long unrefundedSpill = GetUnrefundedStateGasSpill(in gas);
-        gas.StateGasSpillRefunded += Math.Min(amount, unrefundedSpill);
+        long tracked = Math.Min(amount, GetUnrefundedStateGasSpill(in gas));
+        gas.StateGasSpillRefunded += tracked;
+        return tracked;
     }
 
     [MethodImpl(MethodImplOptions.AggressiveInlining)]
@@ -538,16 +543,13 @@ public static EthereumGasPolicy CreateAvailableFromIntrinsic(ulong gasLimit, in
         // before calling; if they don't, the subtraction wraps silently.
         Debug.Assert(gasLimit >= intrinsicGas.Value + (ulong)intrinsicGas.StateReservoir,
             $"gasLimit ({gasLimit}) < intrinsicRegular ({intrinsicGas.Value}) + intrinsicState ({intrinsicGas.StateReservoir})");
-        Debug.Assert(!spec.IsEip8037Enabled || Eip7825Constants.DefaultTxGasLimitCap >= intrinsicGas.Value,
-            "Eip8037 enabled but intrinsicRegular exceeds tx gas cap.");
-
         ulong executionGas = gasLimit - intrinsicGas.Value - (ulong)intrinsicGas.StateReservoir;
         ulong reservoir = 0;
 
         if (spec.IsEip8037Enabled)
         {
             // EIP-8037: cap gas_left at TX_MAX_GAS_LIMIT - intrinsic_regular, overflow goes to reservoir
-            ulong maxGasLeft = Eip7825Constants.DefaultTxGasLimitCap - intrinsicGas.Value;
+            ulong maxGasLeft = Eip7825Constants.DefaultTxGasLimitCap.SaturatingSub(intrinsicGas.Value);
             reservoir = executionGas.SaturatingSub(maxGasLeft);
             executionGas -= reservoir;
         }

src/Nethermind/Nethermind.Evm/GasPolicy/IGasPolicy.cs

@@ -228,12 +228,16 @@ static virtual void RefundStateGas(ref TSelf gas, long amount, long stateGasFloo
     [MethodImpl(MethodImplOptions.AggressiveInlining)]
     static virtual long DiscardStateGas(ref TSelf gas, long amount, long stateGasFloor, bool trackSpillRefund) => amount;
 
+    // Returns the spill-refund amount it marked so a later revocation can unmark it exactly.
     [MethodImpl(MethodImplOptions.AggressiveInlining)]
-    static virtual void AddStateGasRefundToReservoir(ref TSelf gas, long amount, bool trackSpillRefund) =>
+    static virtual long AddStateGasRefundToReservoir(ref TSelf gas, long amount, bool trackSpillRefund)
+    {
         TSelf.UpdateGasUp(ref gas, (ulong)amount);
+        return 0;
+    }
 
     [MethodImpl(MethodImplOptions.AggressiveInlining)]
-    static virtual void RemoveStateGasRefundFromReservoir(ref TSelf gas, long amount) { }
+    static virtual void RemoveStateGasRefundFromReservoir(ref TSelf gas, long amount, long trackedSpillRefund) { }
 
     // EIP-8037 top-level halt: snap state-gas back to (R0, intrinsicStateUsed, 0); the
     // post-reset StateGasUsed feeds SpentGas so the user doesn't pay for uncommitted state.

src/Nethermind/Nethermind.Evm/TransactionProcessing/TransactionProcessor.cs

@@ -73,6 +73,22 @@ public bool TryCalculateBlobFees(BlockHeader header, Transaction transaction,
     public abstract class TransactionProcessorBase
     {
         internal static bool ForceSimpleTransferDisabled;
+
+        private protected static void DestroyAccount(IWorldState worldState, Address toBeDestroyed, in UInt256 balance, bool commit, bool removeSelfdestructBurn)
+        {
+            // Build-up rounds (!commit) span the whole block: later txs may redeploy this address,
+            // so the order-preserving journaled clear is required; the O(1) mark needs a commit after.
+            if (commit) worldState.MarkStorageDestroyed(toBeDestroyed);
+            else worldState.ClearStorage(toBeDestroyed);
+            worldState.DeleteAccount(toBeDestroyed);
+
+            // EIP-8246: preserve any remaining balance as a fresh nonce-0, code-less account;
+            // an empty account stays deleted via EIP-161.
+            if (removeSelfdestructBurn && !balance.IsZero)
+            {
+                worldState.CreateAccount(toBeDestroyed, balance);
+            }
+        }
     }
 
     public abstract class TransactionProcessorBase<TGasPolicy> : TransactionProcessorBase, ITransactionProcessor
@@ -380,16 +396,7 @@ static void FinalizeDestroyedAccount(IWorldState worldState, in TransactionSubst
                         substate.Logs.Add(TransferLog.CreateBurn(toBeDestroyed, balance));
                     }
 
-                    if (commit) worldState.MarkStorageDestroyed(toBeDestroyed);
-                    else worldState.ClearStorage(toBeDestroyed);
-                    worldState.DeleteAccount(toBeDestroyed);
-
-                    // EIP-8246: preserve any remaining balance as a fresh nonce-0,
-                    // code-less account; an empty account stays deleted via EIP-161.
-                    if (removeSelfdestructBurn && !balance.IsZero)
-                    {
-                        worldState.CreateAccount(toBeDestroyed, balance);
-                    }
+                    DestroyAccount(worldState, toBeDestroyed, in balance, commit, removeSelfdestructBurn);
                 }
             }
 
@@ -1386,19 +1393,7 @@ private int ExecuteEvmCall<TTracingInst>(
                                 substate.Logs.Add(TransferLog.CreateSelfDestruct(toBeDestroyed, balance));
                             }
 
-                            // Build-up rounds (!commit) span the whole block: later txs may
-                            // redeploy this address, so the order-preserving journaled clear
-                            // is required; the O(1) mark is only valid when a commit follows.
-                            if (commit) WorldState.MarkStorageDestroyed(toBeDestroyed);
-                            else WorldState.ClearStorage(toBeDestroyed);
-                            WorldState.DeleteAccount(toBeDestroyed);
-
-                            // EIP-8246: preserve any remaining balance as a fresh nonce-0,
-                            // code-less account; an empty account stays deleted via EIP-161.
-                            if (removeSelfdestructBurn && !balance.IsZero)
-                            {
-                                WorldState.CreateAccount(toBeDestroyed, balance);
-                            }
+                            DestroyAccount(WorldState, toBeDestroyed, in balance, commit, removeSelfdestructBurn);
 
                             if (tracingRefunds)
                             {

src/Nethermind/Nethermind.Evm/VirtualMachine.cs

@@ -687,9 +687,10 @@ internal void CreditStateGasRefund(ref TGasPolicy gas, long amount, bool trackSp
         {
             // Restored state gas paid by an ancestor frame stays spendable here; the
             // state-gas-used reduction must propagate upward separately.
-            TGasPolicy.AddStateGasRefundToReservoir(ref gas, pendingRefund, trackSpillRefund);
+            long trackedSpillRefund = TGasPolicy.AddStateGasRefundToReservoir(ref gas, pendingRefund, trackSpillRefund);
             vmState.StateGasRefundPending += pendingRefund;
             vmState.StateGasRefundAdvanced += pendingRefund;
+            vmState.StateGasSpillRefundAdvanced += trackedSpillRefund;
         }
     }
 
@@ -709,10 +710,12 @@ private void IncorporateChildStateGasRefunds(VmState<TGasPolicy> childState)
             {
                 _currentState.StateGasRefundPending += unappliedRefund;
                 _currentState.StateGasRefundAdvanced += unappliedRefund;
+                _currentState.StateGasSpillRefundAdvanced += Math.Min(childState.StateGasSpillRefundAdvanced, unappliedRefund);
             }
 
             childState.StateGasRefundPending = 0;
             childState.StateGasRefundAdvanced = 0;
+            childState.StateGasSpillRefundAdvanced = 0;
         }
     }
 
@@ -721,10 +724,11 @@ private static void RemoveAdvancedStateGasRefund(VmState<TGasPolicy> vmState, re
     {
         if (vmState.StateGasRefundAdvanced > 0)
         {
-            TGasPolicy.RemoveStateGasRefundFromReservoir(ref gas, vmState.StateGasRefundAdvanced);
+            TGasPolicy.RemoveStateGasRefundFromReservoir(ref gas, vmState.StateGasRefundAdvanced, vmState.StateGasSpillRefundAdvanced);
             vmState.StateGasRefundAdvanced = 0;
         }
 
+        vmState.StateGasSpillRefundAdvanced = 0;
         vmState.StateGasRefundPending = 0;
     }
 

src/Nethermind/Nethermind.Evm/VmState.cs

@@ -37,6 +37,7 @@ private static readonly
     // State-gas refund already made spendable in this frame while its accounting correction
     // still has to reach the ancestor frame that originally paid the state gas.
     public long StateGasRefundAdvanced;
+    public long StateGasSpillRefundAdvanced;
     internal long OutputDestination { get; private set; } // TODO: move to CallEnv
     internal long OutputLength { get; private set; } // TODO: move to CallEnv
     public long Refund { get; set; }
@@ -156,10 +157,12 @@ private void Initialize(
         _accessTracker.TakeSnapshot();
         Debug.Assert(StateGasRefundPending == 0, "Pooled VmState returned with uncleared StateGasRefundPending.");
         Debug.Assert(StateGasRefundAdvanced == 0, "Pooled VmState returned with uncleared StateGasRefundAdvanced.");
+        Debug.Assert(StateGasSpillRefundAdvanced == 0, "Pooled VmState returned with uncleared StateGasSpillRefundAdvanced.");
         Gas = gas;
         InitialStateGasUsed = TGasPolicy.GetStateGasUsed(in gas);
         StateGasRefundPending = 0;
         StateGasRefundAdvanced = 0;
+        StateGasSpillRefundAdvanced = 0;
         OutputDestination = outputDestination;
         OutputLength = outputLength;
         Refund = 0;
@@ -230,6 +233,7 @@ public void Dispose()
         _snapshot = default;
         StateGasRefundPending = 0;
         StateGasRefundAdvanced = 0;
+        StateGasSpillRefundAdvanced = 0;
 
         _statePool.Enqueue(this);