[Amxx]

Fixes #6863

Note

Stacked on #6838 (tests run on the amsterdam hardfork): this PR targets amsterdam-hardfork and should be retargeted to master once #6838 merges.

In the guaranteed path, PaymasterERC20Guarantor._refund pulls the cost from userOp.sender with trySafeTransferFrom. Validation never wrote the user's balance, nor their allowance when it is finite. The userOp execution may have accessed or modified these slots, but that can't be relied on: in the worst case, they are cold slots changed for the first time in the transaction. EIP-8038 raises that write from 2,800 to STORAGE_WRITE (10,000), about +7,100 per slot. The paymaster and guarantor balances were already changed by _prefund during validation, so writing them again in postOp stays at 100 gas.

Measurements from #6866 (EDR 0.25, postOp given exactly the 45,000 floor):

Allowance	postOp gas used	Margin below 45k
unlimited	31,138	13.9k
finite	41,575	3.4k

Before the fork, the finite-allowance case cost about 27.4k (41,575 − 2 × 7,100), a margin of about 17.6k. A 3.4k margin is too thin: a token with slightly heavier transfer logic exceeds the floor, postOp runs out of gas, and the guarantor's prefund is stranded.

This PR raises the default _guaranteedPostOpCost() from 15,000 to 30,000, adding back the 2 × 7,100 the fork added. The floor becomes 60,000 (_postOpCost() + _guaranteedPostOpCost()), and _postOpGasBudget follows since it is derived from it. Guaranteed operations are billed about 15k more gas; on chains still using the old pricing that is an over-estimate, which is the safe direction the NatSpec already promises.

The base _postOpCost() is unchanged: its refund only writes slots already changed during validation (see #6860).

PR Checklist

• Tests
• Documentation
• Changeset entry (run npx changeset add)

[changeset-bot]

🦋 Changeset detected

Latest commit: f824bb4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
openzeppelin-solidity	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[socket-security]

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

[coderabbitai]

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[Copilot]

🟡 Changes recommended

The test exercises only $_prefund, leaving postOp completion at the 60,000-gas floor unverified for finite and unlimited allowances with cold user slots.

1 open issue

• Add handleOps regression tests for the 60,000-gas postOp floor · New

What changed in this PR

This PR increases the default gas allowance for guaranteed ERC20 paymaster operations to restore headroom after EIP-8038 storage-write repricing, addressing #6863.

Changes:

• Raises _guaranteedPostOpCost() from 15,000 to 30,000, increasing the guaranteed-operation floor to 60,000.
• Documents the repricing rationale and updates existing validation and billing expectations.
• Adds a patch changeset for the behavior change.

File	Description
test/​account/​paymaster/​PaymasterERC20Guarantor.test.js	Updates gas-floor values, billing assertions, and explanatory comments.
contracts/​account/​paymaster/​extensions/​PaymasterERC20Guarantor.sol	Raises the guaranteed-operation estimate and documents its rationale.
.changeset/​guarantor-postop-cost-glamsterdam.md	Records the increased default estimate for release notes.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Tests check only prefund acceptance at the 60,000-gas floor, leaving end-to-end repayment and full guarantor refunds unverified at that limit for both finite and unlimited allowances.

2 open issues

• Cover finite and unlimited allowance refunds at the gas floor · New
• Add handleOps regression tests for the 60,000-gas postOp floor

_{Review effort: Balanced}

[Amxx]

Addressed in f824bb4 by completes postOp at the paymasterPostOpGasLimit floor; see #6869 (comment) for details, including why the unlimited-allowance case is covered by the finite one.

[Copilot]

🔵 Needs a closer look

The tests do not exercise EntryPoint repayment at the new 60,000-gas floor with cold sender storage and a finite allowance, leaving successful repayment and a full guarantor refund unverified on the path motivating the increase.

2 open issues

• Cover finite and unlimited allowance refunds at the gas floor
• Add handleOps regression tests for the 60,000-gas postOp floor

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues block the gas-estimate increase intended to restore headroom for guaranteed refunds.

1 open issue

• Cover finite and unlimited allowance refunds at the gas floor

1 resolved since last review

• Add handleOps regression tests for the 60,000-gas postOp floor

_{Review effort: Balanced}