feat(spec-specs, tests): EIP-8037 halt refunds spilled state gas (#2815)

Author: spencer-tb

src/ethereum/forks/amsterdam/vm/interpreter.py

@@ -236,19 +236,11 @@ def process_create_message(message: Message) -> Evm:
             restore_tx_state(tx_state, snapshot)
             evm.regular_gas_used += evm.gas_left
             evm.gas_left = Uint(0)
-            # On halt, restore the state gas reservoir to what was
-            # passed into this frame. State-gas charges in excess of
-            # the original reservoir came from gas_left (spill) or
-            # from a child revert refund; either way they get
-            # re-classified as regular gas usage on halt.
-            total_state = evm.state_gas_used + evm.state_gas_left
-            reservoir = evm.message.state_gas_reservoir
-            if total_state > reservoir:
-                evm.regular_gas_used += total_state - reservoir
-            evm.state_gas_left = reservoir
-            evm.state_gas_used = Uint(0)
-            evm.state_gas_refund = Uint(0)
-            evm.state_gas_refund_pending = Uint(0)
+            # State-gas counters preserved: parent's
+            # incorporate_child_on_error (or tx-level error handler at
+            # top) folds the full state-gas charge — including any
+            # spilled portion — back into the reservoir, since no
+            # state was actually grown.
             evm.output = b""
             evm.error = error
         else:
@@ -340,19 +332,11 @@ def process_message(message: Message) -> Evm:
         evm_trace(evm, OpException(error))
         evm.regular_gas_used += evm.gas_left
         evm.gas_left = Uint(0)
-        # On halt, restore the state gas reservoir to what was passed
-        # into this frame. State-gas charges in excess of the original
-        # reservoir came from gas_left (spill) or from a child revert
-        # refund; either way they get re-classified as regular gas
-        # usage on halt.
-        total_state = evm.state_gas_used + evm.state_gas_left
-        reservoir = evm.message.state_gas_reservoir
-        if total_state > reservoir:
-            evm.regular_gas_used += total_state - reservoir
-        evm.state_gas_left = reservoir
-        evm.state_gas_used = Uint(0)
-        evm.state_gas_refund = Uint(0)
-        evm.state_gas_refund_pending = Uint(0)
+        # State-gas counters preserved: parent's
+        # incorporate_child_on_error (or tx-level error handler at
+        # top) folds the full state-gas charge — including any
+        # spilled portion — back into the reservoir, since no
+        # state was actually grown.
         evm.output = b""
         evm.error = error
     except Revert as error:

tests/amsterdam/eip8037_state_creation_gas_cost_increase/test_state_gas_call.py

@@ -1353,23 +1353,30 @@ def test_call_value_to_pre_existing_selfdestructed_account(
     ],
 )
 @pytest.mark.valid_from("EIP8037")
-def test_top_level_halt_preserves_restored_reservoir(
+def test_top_level_halt_refunds_total_state_gas(
     blockchain_test: BlockchainTestFiller,
     pre: Alloc,
     fork: Fork,
     child_termination: str,
     reservoir_delta: int,
 ) -> None:
     """
-    Verify a top-level halt resets `state_gas_left` to the frame's
-    entry reservoir regardless of child failure mode or in-frame
-    drain/spill. The parent calls a child that either reverts (which
-    refunds the full `state_gas_used` back to the parent's reservoir)
-    or halts (which leaves only the reservoir-portion behind), then
-    the parent INVALIDs. In both child-failure paths and across all
-    three reservoir sizes (one short / exact / one over the child's
-    SSTORE cost), the top-level halt collapses to a final reservoir
-    equal to the original tx-level R0 — billed as `gas_limit_cap`.
+    Verify a top-level halt refunds the total state-gas consumed
+    (reservoir-portion + spilled-portion) regardless of child failure
+    mode. The parent calls a child that either reverts or halts, then
+    INVALIDs at the top level.
+
+    Per the updated EIP, both child failure modes propagate the full
+    `state_gas_used` back through `incorporate_child_on_error`, and
+    the top-level halt no longer overrides it. The tx-level error
+    handler then folds the residual into the reservoir, so
+    `state_gas_left_end = max(reservoir, child_charge)` and
+    `tx_gas_used = tx.gas - state_gas_left_end`:
+
+    - `reservoir < child_charge` (one_short): spill is refunded too,
+      `tx_gas_used = gas_limit_cap - (child_charge - reservoir)`.
+    - `reservoir >= child_charge`: no spill, `tx_gas_used =
+      gas_limit_cap`.
     """
     gas_limit_cap = fork.transaction_gas_limit_cap()
     assert gas_limit_cap is not None
@@ -1386,20 +1393,20 @@ def test_top_level_halt_preserves_restored_reservoir(
         code=(Op.POP(Op.CALL(gas=500_000, address=child)) + Op.INVALID),
     )
 
+    reservoir = sstore_state_gas + reservoir_delta
+    tx_gas = gas_limit_cap + reservoir
+
     tx = Transaction(
         to=parent,
-        gas_limit=gas_limit_cap + sstore_state_gas + reservoir_delta,
+        gas_limit=tx_gas,
         sender=pre.fund_eoa(),
     )
 
-    # Halt rule: every halted frame's (gas_left, state_gas_left) is
-    # reset to (0, message.state_gas_reservoir). Whatever the child
-    # did inside the call — drain, spill, or revert refund — is
-    # wiped when the parent's INVALID hits. The user's final
-    # reservoir is exactly the top-level R0 = sstore + delta, and
-    # `tx_gas_used = tx.gas - 0 - R0 = gas_limit_cap` for all six
-    # combinations.
-    expected_gas_used = gas_limit_cap
+    # Policy A halt: state_gas counters preserved through the child
+    # halt/revert, parent halt, and tx-level fold.
+    # state_gas_left_end = max(reservoir, sstore_state_gas).
+    state_gas_left_end = max(reservoir, sstore_state_gas)
+    expected_gas_used = tx_gas - state_gas_left_end
 
     blockchain_test(
         pre=pre,

tests/amsterdam/eip8037_state_creation_gas_cost_increase/test_state_gas_create.py

@@ -27,6 +27,7 @@
     Storage,
     Transaction,
     TransactionException,
+    TransactionReceipt,
     compute_create2_address,
     compute_create_address,
 )
@@ -596,6 +597,196 @@ def test_code_deposit_oog_preserves_parent_reservoir(
     state_test(pre=pre, post=post, tx=tx)
 
 
+@pytest.mark.parametrize(
+    ("with_reservoir", "failure_op"),
+    [
+        pytest.param(True, Op.REVERT(0, 0), id="with_reservoir-revert"),
+        pytest.param(True, Op.INVALID, id="with_reservoir-halt"),
+        pytest.param(False, Op.REVERT(0, 0), id="no_reservoir-revert"),
+        pytest.param(False, Op.INVALID, id="no_reservoir-halt"),
+    ],
+)
+@pytest.mark.valid_from("EIP8037")
+def test_parent_state_gas_after_child_failure(
+    state_test: StateTestFiller,
+    pre: Alloc,
+    fork: Fork,
+    with_reservoir: bool,
+    failure_op: Bytecode,
+) -> None:
+    """
+    Test parent state-gas pools after CREATE child failure.
+
+    A factory invokes CREATE whose initcode performs an SSTORE
+    (charging state gas) then either REVERTs or hits INVALID. The
+    factory's own SSTORE after the failed CREATE acts as the
+    discriminator that the parent's state-gas accounting (reservoir
+    and gas_left) is in the expected state.
+
+    Four scenarios cover the gas-pool state space:
+
+    - `with_reservoir x revert`: child state gas (new account +
+      initcode SSTORE) is fully refunded to the parent reservoir on
+      REVERT.
+    - `with_reservoir x halt`: HALT resets the child frame to
+      `(0, R0_child)`; only the reservoir-portion entering the
+      initcode is returned, any spilled gas stays burned.
+    - `no_reservoir x revert`: child state gas refunded forms a
+      fresh reservoir even though `R0_parent` started at 0.
+    - `no_reservoir x halt`: no phantom reservoir may form; the
+      factory's post-CREATE SSTORE must spill from gas_left.
+    """
+    gas_limit_cap = fork.transaction_gas_limit_cap()
+    assert gas_limit_cap is not None
+    gas_costs = fork.gas_costs()
+    intrinsic_cost = fork.transaction_intrinsic_cost_calculator()()
+    sstore_state_gas = fork.sstore_state_gas()
+    new_account_state_gas = gas_costs.NEW_ACCOUNT
+
+    initcode = Op.SSTORE(0, 1, original_value=0, new_value=1) + failure_op
+
+    factory_storage = Storage()
+    factory_code = (
+        Op.MSTORE(0, Op.PUSH32(bytes(initcode)))
+        + Op.SSTORE(
+            factory_storage.store_next(0, "create_fails"),
+            Op.CREATE(
+                value=0,
+                offset=32 - len(initcode),
+                size=len(initcode),
+            ),
+            original_value=0,
+            new_value=0,
+        )
+        + Op.SSTORE(
+            factory_storage.store_next(1, "post_create"),
+            1,
+            original_value=0,
+            new_value=1,
+        )
+    )
+    factory = pre.deploy_contract(code=factory_code)
+
+    gas_limit = (
+        gas_limit_cap + new_account_state_gas + sstore_state_gas * 2
+        if with_reservoir
+        else 5_000_000
+    )
+
+    # `bytecode.gas_cost(fork)` accounts for opcode base costs and
+    # state-gas charges, but does NOT track memory-expansion or CREATE
+    # init-code word costs. Add those back to recover runtime regular
+    # gas consumption.
+    init_code_word_count = (len(initcode) + 31) // 32
+    init_code_word_cost = gas_costs.CODE_INIT_PER_WORD * init_code_word_count
+    mstore_memory_expansion = gas_costs.MEMORY_PER_WORD  # 1 word
+    gas_cost_helper_extras = init_code_word_cost + mstore_memory_expansion
+
+    # Factory bytecode shape costs, derived from fork.gas_costs():
+    #   pre-CREATE: PUSH32 + PUSH1 + MSTORE (with 1-word expansion)
+    #               + 3 PUSHes for CREATE inputs
+    #   post-CREATE: PUSH key + SSTORE (no-op) + 2 PUSHes + SSTORE
+    #                (zero-to-nonzero regular)
+    factory_pre_create_regular = (
+        gas_costs.VERY_LOW * 2
+        + gas_costs.OPCODE_MSTORE_BASE
+        + mstore_memory_expansion
+        + gas_costs.VERY_LOW * 3
+    )
+    factory_post_create_regular = (
+        gas_costs.VERY_LOW
+        + gas_costs.COLD_STORAGE_ACCESS
+        + gas_costs.WARM_ACCESS
+        + gas_costs.VERY_LOW * 2
+        + gas_costs.COLD_STORAGE_WRITE
+    )
+
+    factory_regular = (
+        factory_code.gas_cost(fork)
+        - new_account_state_gas
+        - sstore_state_gas
+        + gas_cost_helper_extras
+    )
+    initcode_regular_revert = initcode.gas_cost(fork) - sstore_state_gas
+
+    if failure_op == Op.INVALID:
+        # Simulate runtime gas accounting for HALT using fork helpers:
+        #  1. Initial regular pool capped by transaction_gas_limit_cap;
+        #     remainder forms the state reservoir.
+        #  2. CREATE op charges new_account state gas (from reservoir
+        #     first, spilled to gas_left otherwise).
+        #  3. 63/64 retention rule: parent retains gas_left // 64.
+        #  4. INVALID burns all forwarded regular gas in the child.
+        #     Per the updated EIP, child halt preserves its state-gas
+        #     counters and `incorporate_child_on_error` refunds the
+        #     full child charge — including any spilled portion — to
+        #     the parent's reservoir.
+        #  5. CREATE failure refunds new_account state gas to the
+        #     parent's state pool (account creation rolled back).
+        #  6. Factory's post-CREATE SSTORE charges sstore_state_gas
+        #     (state pool first, spilled to gas_left otherwise).
+        execution_gas = gas_limit - intrinsic_cost
+        regular_budget = gas_limit_cap - intrinsic_cost
+        sim_gas_left = min(regular_budget, execution_gas)
+        sim_state_gas_left = execution_gas - sim_gas_left
+
+        sim_gas_left -= factory_pre_create_regular
+        sim_gas_left -= gas_costs.OPCODE_CREATE_BASE + init_code_word_cost
+
+        if sim_state_gas_left >= new_account_state_gas:
+            sim_state_gas_left -= new_account_state_gas
+        else:
+            sim_gas_left -= new_account_state_gas - sim_state_gas_left
+            sim_state_gas_left = 0
+
+        # `child_reservoir` is what the parent forwards to the child.
+        # Under Policy A halt, incorporate refunds child.state_gas_used
+        # + child.state_gas_left = max(sstore, child_reservoir) back to
+        # the parent. The simulator already implicitly retains
+        # `child_reservoir` in `sim_state_gas_left`, so the additional
+        # Policy A refund versus the Policy B "burn the spill" rule is
+        # `max(0, sstore_state_gas - child_reservoir)`.
+        child_reservoir = sim_state_gas_left
+        sim_gas_left = sim_gas_left // 64
+        sim_state_gas_left += max(0, sstore_state_gas - child_reservoir)
+        sim_state_gas_left += new_account_state_gas
+
+        sim_gas_left -= factory_post_create_regular
+
+        if sim_state_gas_left >= sstore_state_gas:
+            sim_state_gas_left -= sstore_state_gas
+        else:
+            sim_gas_left -= sstore_state_gas - sim_state_gas_left
+            sim_state_gas_left = 0
+
+        expected_cumulative = gas_limit - sim_gas_left - sim_state_gas_left
+    else:
+        # REVERT preserves gas_left and refunds the child frame's
+        # state gas (initcode SSTORE + new account). Only the
+        # factory's own post-CREATE SSTORE consumes net state gas.
+        expected_cumulative = (
+            intrinsic_cost
+            + factory_regular
+            + initcode_regular_revert
+            + sstore_state_gas
+        )
+
+    tx = Transaction(
+        to=factory,
+        gas_limit=gas_limit,
+        sender=pre.fund_eoa(),
+        expected_receipt=TransactionReceipt(
+            cumulative_gas_used=expected_cumulative,
+        ),
+    )
+
+    state_test(
+        pre=pre,
+        post={factory: Account(storage=factory_storage)},
+        tx=tx,
+    )
+
+
 @pytest.mark.valid_from("EIP8037")
 def test_nested_create_code_deposit_cannot_borrow_parent_gas(
     state_test: StateTestFiller,