feat(tests): EIP-8037 drop double refund on incorporate_child_on_error

Author: spencer-tb

tests/amsterdam/eip8037_state_creation_gas_cost_increase/test_state_gas_reservoir.py

@@ -1328,9 +1328,7 @@ def test_nested_failure_resets_to_tx_reservoir(
     - `cumulative_gas_used` (receipt) pins `tx.gas - gas_left -
       state_gas_left`, catching bugs in the leftover split.
     - `header.gas_used` pins `max(block_regular, block_state)` via
-      the block accumulators. They differ from the receipt by
-      exactly `non_top_burns` (inline refunds the user pays for but
-      the block doesn't track in either accumulator).
+      the block accumulators.
     """
     gas_limit_cap = fork.transaction_gas_limit_cap()
     assert gas_limit_cap is not None
@@ -1359,41 +1357,25 @@ def test_nested_failure_resets_to_tx_reservoir(
     else:
         top, frame_codes = _build_create_chain(pre, frame_bodies, terminator)
 
-    # Non-top inline state-gas refunds (body SSTORE x→0 plus CREATE
-    # pre-charge credits on child failure) accumulate in each frame's
-    # `state_gas_refund` and get subtracted at the parent's
-    # `incorporate_child_on_error` boundary so the inflation does not
-    # leak across the rolled-back state change. The top frame's
-    # refund is preserved by the tx-level error handler.
-    non_top_body_refund_burn = sum(
-        b.state_refund(fork) for b in frame_bodies[1:]
-    )
-    non_top_create_credit_burn = max(0, n_creates - 1) * new_account_state_gas
-    non_top_burns = non_top_body_refund_burn + non_top_create_credit_burn
-
     sum_regular = sum(code.regular_cost(fork) for code in frame_codes)
     spill = max(0, total_state_charges - reservoir)
     if failure_mode == "halt":
         # Policy A (updated EIP): all state-gas — body charges, spilled
         # portions, and CREATE pre-charges (returned via credit) — folds
         # into state_gas_left at tx end. gas_left is zeroed by halt.
-        # `non_top_burns` is the inline refund burn at incorporate
-        # boundaries that does not return to the user's reservoir.
-        state_gas_at_end = max(reservoir, total_state_charges) - non_top_burns
+        state_gas_at_end = max(reservoir, total_state_charges)
         expected_cumulative = tx_gas - state_gas_at_end
         # Header: block_regular = gas_limit_cap - spill (spilled
         # state-gas drained gas_left but is no longer reclassified to
         # regular under Policy A); block_state ≈ 0 for plain CALLs.
         expected_header_gas_used = gas_limit_cap - spill
     elif failure_mode == "revert":
         # Revert preserves gas_left; full state-gas refund.
-        # User pays only regular costs + intrinsic + non-top burns.
-        expected_cumulative = intrinsic_cost + sum_regular + non_top_burns
+        # User pays only regular costs + intrinsic.
+        expected_cumulative = intrinsic_cost + sum_regular
         # Header reflects the regular-vs-state attribution directly:
         # state_gas_used is zeroed by the tx error handler, so only
-        # regular gas usage shows up. The refund burn lives in the
-        # `state_gas_left` shortfall (visible in cumulative), not
-        # the regular accumulator.
+        # regular gas usage shows up.
         expected_header_gas_used = intrinsic_cost + sum_regular
     else:
         raise ValueError("Invariant, unreachable code.")
@@ -1842,3 +1824,62 @@ def test_set_and_clear_pays_no_state_gas(
     # never touched because frame-end byte_delta was zero.
     post = {contract: Account(storage={0: 0})}
     state_test(pre=pre, post=post, tx=tx)
+
+
+@pytest.mark.valid_from("EIP8037")
+def test_subcall_set_clear_revert_pays_no_state_gas(
+    state_test: StateTestFiller,
+    pre: Alloc,
+    fork: Fork,
+) -> None:
+    """
+    A child frame doing SSTORE 0 to x to 0 then REVERT must bill the
+    sender only intrinsic + regular costs.
+
+    Both SSTOREs roll back with the REVERT, so the matching
+    state-gas charge and refund cancel cleanly. The receipt's
+    `cumulative_gas_used` equals the regular baseline; a leftover
+    `sstore_state_gas` would surface a double-charge at the failure
+    boundary.
+    """
+    intrinsic_cost = fork.transaction_intrinsic_cost_calculator()()
+    gas_limit_cap = fork.transaction_gas_limit_cap()
+    assert gas_limit_cap is not None
+
+    set_op = Op.SSTORE.with_metadata(
+        key_warm=False,
+        original_value=0,
+        current_value=0,
+        new_value=1,
+    )(0, 1)
+    clear_op = Op.SSTORE.with_metadata(
+        key_warm=True,
+        original_value=0,
+        current_value=1,
+        new_value=0,
+    )(0, 0)
+    inner_code = set_op + clear_op + Op.REVERT(0, 0)
+    inner = pre.deploy_contract(code=inner_code)
+
+    top_code = Op.POP(Op.CALL(gas=Op.GAS, address=inner)) + Op.STOP
+    top = pre.deploy_contract(code=top_code)
+
+    expected_cumulative = (
+        intrinsic_cost
+        + top_code.regular_cost(fork)
+        + inner_code.regular_cost(fork)
+    )
+
+    tx = Transaction(
+        to=top,
+        gas_limit=gas_limit_cap,
+        sender=pre.fund_eoa(),
+        expected_receipt=TransactionReceipt(
+            cumulative_gas_used=expected_cumulative,
+        ),
+    )
+    state_test(
+        pre=pre,
+        post={top: Account(), inner: Account(storage={0: 0})},
+        tx=tx,
+    )

tests/amsterdam/eip8037_state_creation_gas_cost_increase/test_state_gas_sstore.py

@@ -828,12 +828,15 @@ def test_sstore_restoration_sub_frame_revert(
     call_opcode: Op,
 ) -> None:
     """
-    Verify 0 to x to 0 reservoir refund unwinds on sub-frame REVERT.
-
-    The sub-call performs 0 to x to 0 then REVERTs.  If the reservoir
-    refund is not rolled back with the reverted frame, the reservoir
-    stays inflated by `sstore_state_gas`.  A single-SSTORE probe sized
-    to OOG by 1 would then succeed; the test asserts it OOGs.
+    Verify 0 to x to 0 reservoir refund returns to the caller on
+    sub-frame REVERT.
+
+    The sub-call performs 0 to x to 0 then REVERTs.  Since both the
+    set-charge and its refund roll back together, the
+    `state_gas_used + state_gas_left` sum reflects the unconsumed
+    reservoir and is returned to the caller via
+    `incorporate_child_on_error`.  A single-SSTORE probe sized to OOG
+    by 1 succeeds, confirming the caller's reservoir was replenished.
     """
     gas_costs = fork.gas_costs()
     # Probe SSTORE(0, 1): 2 pushes + cold storage write + state gas - 1,
@@ -853,7 +856,7 @@ def test_sstore_restoration_sub_frame_revert(
     # and REVERT without a hard-coded budget.
     caller_storage = Storage()
     caller_code = Op.POP(call_opcode(gas=Op.GAS, address=child)) + Op.SSTORE(
-        caller_storage.store_next(0, "probe_must_fail"),
+        caller_storage.store_next(1, "probe_must_succeed"),
         Op.CALL(gas=probe_gas, address=probe),
     )
     caller = pre.deploy_contract(code=caller_code)
@@ -876,16 +879,15 @@ def test_sstore_restoration_ancestor_revert(
     fork: Fork,
 ) -> None:
     """
-    Verify the SSTORE 0 to x to 0 refund unwinds when an ancestor frame
-    (not the applying frame itself) reverts.
+    Verify the SSTORE 0 to x to 0 refund returns to the caller when an
+    ancestor frame (not the applying frame itself) reverts.
 
     Inner frame applies the refund and returns successfully; its
-    refund propagates to middle via `incorporate_child_on_success`.
-    Middle then REVERTs; its refund must be dropped by the caller's
-    `incorporate_child_on_error`, rather than propagating up.  This
-    exercises the recursive scope that single-frame revert tests do
-    not: a bug in the success propagation of `state_gas_refund` would
-    leak the refund into the caller's reservoir.
+    `state_gas_left` (inflated by the refund) propagates to middle
+    via `incorporate_child_on_success`.  Middle then REVERTs; the
+    refunded reservoir flows back to the caller via
+    `incorporate_child_on_error`, so the caller's reservoir is
+    replenished by `sstore_state_gas`.
     """
     gas_costs = fork.gas_costs()
     # Probe SSTORE(0, 1): 2 pushes + cold storage write + state gas - 1,
@@ -910,7 +912,7 @@ def test_sstore_restoration_ancestor_revert(
         code=(
             Op.POP(Op.CALL(gas=Op.GAS, address=middle))
             + Op.SSTORE(
-                caller_storage.store_next(0, "probe_must_fail"),
+                caller_storage.store_next(1, "probe_must_succeed"),
                 Op.CALL(gas=probe_gas, address=probe),
             )
         ),
@@ -936,16 +938,17 @@ def test_sstore_restoration_create_init_revert(
     create_opcode: Op,
 ) -> None:
     """
-    Verify reservoir refunds unwind when CREATE init code REVERTs
-    inside a sub-frame that also REVERTs.
+    Verify reservoir refunds return to the caller when CREATE init
+    code REVERTs inside a sub-frame that also REVERTs.
 
     Wrapping the CREATE in an outer reverting frame isolates the
     rollback concern from the legitimate CREATE silent-failure refund
     (`create_account_state_gas` credited to the frame executing the
-    CREATE opcode).  When the outer frame reverts, every refund that
-    occurred inside it must unwind, leaving the caller's reservoir at
-    its pre-call value.  A single-SSTORE probe sized to OOG by 1
-    detects any leaked refund.
+    CREATE opcode).  When the outer frame reverts, the refunded
+    reservoir flows back to the caller via
+    `incorporate_child_on_error`, replenishing the caller's
+    reservoir by at least `sstore_state_gas`.  A single-SSTORE probe
+    sized to OOG by 1 succeeds, confirming the propagation.
     """
     gas_costs = fork.gas_costs()
     # Probe SSTORE(0, 1): 2 pushes + cold storage write + state gas - 1,
@@ -965,9 +968,7 @@ def test_sstore_restoration_create_init_revert(
     else:
         create_call = Op.CREATE2(0, 0, len(init_code), 0)
 
-    # Inner contract performs the CREATE then REVERTs, so any refunds
-    # (SSTORE restoration or CREATE silent-failure) applied during its
-    # execution must unwind with the frame.
+    # Inner contract performs the CREATE then REVERTs.
     inner = pre.deploy_contract(
         code=(
             Op.MSTORE(
@@ -985,7 +986,7 @@ def test_sstore_restoration_create_init_revert(
         code=(
             Op.POP(Op.CALL(gas=Op.GAS, address=inner))
             + Op.SSTORE(
-                caller_storage.store_next(0, "probe_must_fail"),
+                caller_storage.store_next(1, "probe_must_succeed"),
                 Op.CALL(gas=probe_gas, address=probe),
             )
         ),