Glamsterdam (EIP-8037/8038) gas invariants review #6858

Tracking issue for reviewing contracts/ (mocks excluded) against the Glamsterdam gas changes, EIP-8037 (state-creation gas, reservoir) and EIP-8038 (state access repricing). The review used the invariants published in ethereum/glamsterdam-gas-invariants.

Unless stated otherwise, findings are inferred from the code and the spec gas table. The paymaster findings were measured on EDR 0.25 with the amsterdam hardfork (#6838).

Findings (sub-issues)

1. PaymasterERC20Guarantor (PaymasterERC20Guarantor: default postOp gas floor too low after Glamsterdam, can strand guarantor prefund #6863): the guaranteed postOp pulls the cost from the user, whose balance (and finite allowance) are cold first writes in the transaction. EIP-8038 raises those by ~7.1k each. Measured on EDR 0.25 (Test guaranteed refunds at the postOp gas floor #6866): with a finite allowance, postOp uses 41,575 of the 45,000 floor, down from a ~17.6k margin before the fork to ~3.4k. A token with heavier transfer logic would run out of gas and strand the guarantor's prefund (INV-4 / INV-7). Fix in Raise default _guaranteedPostOpCost to cover EIP-8038 repricing #6869: default _guaranteedPostOpCost() raised from 15,000 to 30,000.

Closed:

• PaymasterERC20 default _postOpCost() (PaymasterERC20: default _postOpCost under-bills after EIP-8038 repricing #6860), not a bug. The refund in postOp only writes balance slots that _prefund already changed during validation, which still cost 100 gas each under EIP-8038. Measured on EDR 0.25: the paymaster's margin is 17,344 gas on prague/osaka and 17,254 on amsterdam.
• ERC2771Forwarder gas check (ERC2771Forwarder: post-call gas check bypassable via state gas refunded on REVERT (Glamsterdam) #6859), not a bug. The scenario needs a reverting callee, which the check doesn't cover by design. In the case it does cover, a callee that runs out of gas or hits invalid(), the check still holds under Amsterdam: I tested it in EDR and checked it against the spec. A possible follow-up is to document in the NatSpec that reverting callees aren't covered.
• NatSpec initializer examples for EIP-7702 delegates (NatSpec initializer examples are unsafe for EIP-7702 delegates (Glamsterdam INV-8) #6862), not specific to Glamsterdam. An initializer anyone can call on a 7702 delegate was already unsafe before the fork (front-running from the mempool, or a setup call that reverts after the delegation is applied). EIP-8037 only adds that a private transaction can be mined with status 0 while its delegation is rolled back. The general docs gap is tracked in Document safe setup of accounts used as EIP-7702 delegates #6868.
• CrosschainRemoteExecutor EXECTYPE_TRY starvation (CrosschainRemoteExecutor: EXECTYPE_TRY lets the delivering relayer starve sub-calls (Glamsterdam) #6861), working as intended. TRY is the controller's explicit choice to treat failed calls as non-fatal and final, including calls starved by the party delivering the message; EXECTYPE_DEFAULT reverts on any failure. This was already the case before the fork. EIP-8037 may widen the gas range where a single call can be starved, but doesn't change the semantics.

Notes (no action needed in this repo)

• INV-3, effect on downstream code: ERC721Utils, ERC1155Utils, ERC1363Utils and Address turn empty revert data into custom errors. Every branch here reverts, so nothing breaks in this repo. But downstream "empty revert data means out of gas" heuristics no longer hold.
• INV-4, values signed before the fork: ForwardRequest.gas and ERC-4337 gas limits signed before the fork may be too low afterwards. In ERC2771Forwarder.executeBatch that burns the nonce.

Checked, nothing found

• INV-3, CREATE results: every create/create2 result is checked (Clones, ERC1967Clones, Create2, RelayedCall, SimulateCall).
• INV-5: no contract bills by subtracting two gasleft() readings.
• INV-2: ReentrancyGuard rests at 1 and goes 1 → 2 → 1. The transient variants and Initializable don't refill either.
• INV-7: no transfer or send calls.
• Execution paths: Governor, GovernorTimelockAccess, TimelockController and AccessManager revert on any failed call.
• Harmless try/catch:
  • The try/catch in GovernorTimelockAccess._cancel is harmless: only the governor could run the leftover operation.
  • The try/catch in GovernorVotes.clock cannot be exploited: starving a call that cheap leaves too little gas for propose.

Not covered

• Off-chain components: relayers and bundlers integrating these contracts.
• Settings of deployed contracts.
• Rules still under discussion: INV-1, INV-2, INV-3 and INV-5 depend on parts of the spec that may change (e.g. EIPs PR #12581). The fixes proposed should work under either rule.