fix(evm): address devnet-6 review findings in the state-gas policy

- Clamp RemoveStateGasRefundFromReservoir for a net-spill (negative)
  reservoir so revoking an advanced refund cannot reclaim spilled state
  gas or over-deduct recorded usage; regression test included.
- Set the OutOfGas flag when ConsumeStateGas fails on the spill path.
- Saturate the EIP-7825 cap subtraction in CreateAvailableFromIntrinsic.
- Extract the shared destroy/recreate logic in TransactionProcessor into
  DestroyAccount, removing the duplicated EIP-8246 blocks.
- Note the intentional EIP-2780 divergence on the SELFDESTRUCT
  new-account charge.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Marchhill

src/Nethermind/Nethermind.Evm.Test/Eip8037Tests.cs

@@ -215,6 +215,20 @@ public void ConsumeStateGas_oog_does_not_zero_reservoir()
 
         Assert.That((consumed, gas.Value, gas.StateReservoir, gas.StateGasUsed, gas.StateGasSpill),
             Is.EqualTo((false, 10L, 50L, 0L, 0L)));
+        Assert.That(EthereumGasPolicy.IsOutOfGas(in gas), Is.True);
+    }
+
+    [Test]
+    public void Removing_advanced_refund_from_net_spill_reservoir_deducts_usage_only()
+    {
+        // A net-spill (negative) reservoir, as left by RestoreChildStateGas after nested spills.
+        EthereumGasPolicy gas = new() { Value = 400, StateReservoir = -300, StateGasUsed = 800 };
+
+        // Revoking an advanced refund must not reclaim spilled gas via the negative reservoir;
+        // it comes out of the recorded usage instead.
+        EthereumGasPolicy.RemoveStateGasRefundFromReservoir(ref gas, 200);
+
+        Assert.That((gas.StateReservoir, gas.StateGasUsed), Is.EqualTo((-300L, 600L)));
     }
 
     [Test]

src/Nethermind/Nethermind.Evm/GasPolicy/EthereumGasPolicy.cs

@@ -137,6 +137,7 @@ public static bool ConsumeStateGas(ref EthereumGasPolicy gas, long stateGasCost)
         ulong spillAmount = CalculateStateGasSpill(in gas, stateGasCost);
         if (!TryConsume(ref gas, spillAmount))
         {
+            gas.OutOfGas = true;
             return false;
         }
 
@@ -398,7 +399,9 @@ public static void AddStateGasRefundToReservoir(ref EthereumGasPolicy gas, long
     [MethodImpl(MethodImplOptions.AggressiveInlining)]
     public static void RemoveStateGasRefundFromReservoir(ref EthereumGasPolicy gas, long amount)
     {
-        long fromReservoir = Math.Min(amount, gas.StateReservoir);
+        // A net-spill reservoir is negative: the advanced refund was already consumed, so the
+        // whole removal comes out of the recorded usage and the spill accounting stays intact.
+        long fromReservoir = Math.Max(0, Math.Min(amount, gas.StateReservoir));
         gas.StateReservoir -= fromReservoir;
         amount -= fromReservoir;
 
@@ -547,7 +550,7 @@ public static EthereumGasPolicy CreateAvailableFromIntrinsic(ulong gasLimit, in
         if (spec.IsEip8037Enabled)
         {
             // EIP-8037: cap gas_left at TX_MAX_GAS_LIMIT - intrinsic_regular, overflow goes to reservoir
-            ulong maxGasLeft = Eip7825Constants.DefaultTxGasLimitCap - intrinsicGas.Value;
+            ulong maxGasLeft = Eip7825Constants.DefaultTxGasLimitCap.SaturatingSub(intrinsicGas.Value);
             reservoir = executionGas.SaturatingSub(maxGasLeft);
             executionGas -= reservoir;
         }

src/Nethermind/Nethermind.Evm/Instructions/EvmInstructions.ControlFlow.cs

@@ -239,7 +239,7 @@ public static EvmExceptionType InstructionSelfDestruct<TGasPolicy, TEip8037, TEi
         if (vm.TxTracer.IsTracingActions)
             vm.TxTracer.ReportSelfDestruct(executingAccount, result, inheritor);
 
-        // Charge gas if transferring to a dead or non-existent account.
+        // Charge gas if transferring to a dead or non-existent account (intentionally not repriced by EIP-2780).
         bool inheritorAccountExists = state.AccountExists(inheritor);
         bool chargesNewAccount = spec.ClearEmptyAccountWhenTouched switch
         {

src/Nethermind/Nethermind.Evm/TransactionProcessing/TransactionProcessor.cs

@@ -380,22 +380,29 @@ static void FinalizeDestroyedAccount(IWorldState worldState, in TransactionSubst
                         substate.Logs.Add(TransferLog.CreateBurn(toBeDestroyed, balance));
                     }
 
-                    if (commit) worldState.MarkStorageDestroyed(toBeDestroyed);
-                    else worldState.ClearStorage(toBeDestroyed);
-                    worldState.DeleteAccount(toBeDestroyed);
-
-                    // EIP-8246: preserve any remaining balance as a fresh nonce-0,
-                    // code-less account; an empty account stays deleted via EIP-161.
-                    if (removeSelfdestructBurn && !balance.IsZero)
-                    {
-                        worldState.CreateAccount(toBeDestroyed, balance);
-                    }
+                    DestroyAccount(worldState, toBeDestroyed, in balance, commit, removeSelfdestructBurn);
                 }
             }
 
             return FinalizeTransaction(tx, spec, tracer, opts, restore, commit, deleteCallerAccount, in senderReservedGasPayment, env.ExecutingAccount, in substate, spentGas, statusCode);
         }
 
+        private static void DestroyAccount(IWorldState worldState, Address toBeDestroyed, in UInt256 balance, bool commit, bool removeSelfdestructBurn)
+        {
+            // Build-up rounds (!commit) span the whole block: later txs may redeploy this address,
+            // so the order-preserving journaled clear is required; the O(1) mark needs a commit after.
+            if (commit) worldState.MarkStorageDestroyed(toBeDestroyed);
+            else worldState.ClearStorage(toBeDestroyed);
+            worldState.DeleteAccount(toBeDestroyed);
+
+            // EIP-8246: preserve any remaining balance as a fresh nonce-0, code-less account;
+            // an empty account stays deleted via EIP-161.
+            if (removeSelfdestructBurn && !balance.IsZero)
+            {
+                worldState.CreateAccount(toBeDestroyed, balance);
+            }
+        }
+
         [SkipLocalsInit]
         [MethodImpl(MethodImplOptions.NoInlining)]
         private TransactionResult ExecuteSimpleTransfer(
@@ -1386,19 +1393,7 @@ private int ExecuteEvmCall<TTracingInst>(
                                 substate.Logs.Add(TransferLog.CreateSelfDestruct(toBeDestroyed, balance));
                             }
 
-                            // Build-up rounds (!commit) span the whole block: later txs may
-                            // redeploy this address, so the order-preserving journaled clear
-                            // is required; the O(1) mark is only valid when a commit follows.
-                            if (commit) WorldState.MarkStorageDestroyed(toBeDestroyed);
-                            else WorldState.ClearStorage(toBeDestroyed);
-                            WorldState.DeleteAccount(toBeDestroyed);
-
-                            // EIP-8246: preserve any remaining balance as a fresh nonce-0,
-                            // code-less account; an empty account stays deleted via EIP-161.
-                            if (removeSelfdestructBurn && !balance.IsZero)
-                            {
-                                WorldState.CreateAccount(toBeDestroyed, balance);
-                            }
+                            DestroyAccount(WorldState, toBeDestroyed, in balance, commit, removeSelfdestructBurn);
 
                             if (tracingRefunds)
                             {