feat(tests): EIP-8037 unmask intrinsic-cap transaction-validity checks#2956
Merged
spencer-tb merged 1 commit intoJun 10, 2026
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## forks/amsterdam #2956 +/- ##
================================================
Coverage 90.53% 90.53%
================================================
Files 535 535
Lines 32897 32893 -4
Branches 3021 3021
================================================
- Hits 29782 29780 -2
+ Misses 2596 2595 -1
+ Partials 519 518 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
6 tasks
Member
|
Potentially a duplicate of #2898. Also needs a rebase and base change to |
The three EIP-8037 transaction-validity tests that assert `max(intrinsic_regular, calldata_floor) <= TX_MAX_GAS_LIMIT` were each satisfied by the *sufficiency* check (`max(intrinsic_total, floor) <= tx.gas`) that runs before the cap check, so none of them exercised the cap itself: * `test_intrinsic_regular_gas_exceeds_cap` pushed both dimensions over the cap with non-zero calldata at `gas_limit = cap * 2`; the calldata floor exceeded `tx.gas`, so sufficiency rejected it first. * `test_intrinsic_regular_gas_exceeds_cap_with_floor_below_cap` inflated the regular dimension with EIP-7702 authorizations, whose coupled state gas pushed the total intrinsic far above `tx.gas` (sufficiency). * `test_calldata_floor_exceeding_tx_gas_limit_cap[exceeds_cap]` set `gas_limit = cap` while the floor exceeded the cap, so `floor > tx.gas` tripped sufficiency. A client with the sufficiency gate but no `max(regular, floor) > cap` gate passes all three. Differential fuzzing on bal-devnet-7 caught exactly such a client: besu (26.6-develop-e8c2195) executes a floor-over-cap transaction that geth, nethermind, revm, and the EELS reference all reject. Re-lever each test so the cap is the only check that can reject: * The regular-dimension tests use a large access list (regular intrinsic only, no state gas) with `gas_limit` above the total intrinsic, and assert `max(regular, floor) > cap`, `regular + state <= tx.gas`, and (for the floor-below-cap variant) `floor < cap`. * The floor test funds the floor in full (`gas_limit = floor + 1_000_000`) and asserts `floor > cap` and `regular < cap`. * Add `test_intrinsic_within_cap_gas_limit_above_cap` as the accepting positive control (`gas_limit` above the cap, both operands below it). All operands are derived from the fork gas calculators so the tests stay correct as Amsterdam pricing evolves. Verified by re-filling under EELS (rejects) and replaying the fixtures against the bal-devnet-7 clients: geth, nethermind, revm, and EELS reject; besu e8c2195 executes (consensus divergence); the positive control is accepted by all.
1a4570f to
721002a
Compare
Contributor
Author
Done, feel free to close it if it is a dup. |
spencer-tb
approved these changes
Jun 10, 2026
spencer-tb
left a comment
Contributor
There was a problem hiding this comment.
LGTM, I think we can keep both PRs for now.
Contributor
|
Close and reopen to trigger CI! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🗒️ Description
The EIP-8037 "transaction validity" tests assert requirement 1,
max(intrinsic_regular, calldata_floor) <= TX_MAX_GAS_LIMIT. That capcheck runs after the sufficiency check
max(intrinsic_total, calldata_floor) <= tx.gas. The three existingcap-rejection tests were each tripped by the sufficiency check first, so
none of them ever exercised the cap — a client with the sufficiency gate
but no
max(regular, floor) > capgate passes all three:test_intrinsic_regular_gas_exceeds_capgas_limit = cap*2madefloor > tx.gas(sufficiency)test_intrinsic_regular_gas_exceeds_cap_with_floor_below_capintrinsic_total > tx.gas(sufficiency)test_calldata_floor_exceeding_tx_gas_limit_cap[exceeds_cap]gas_limit = capwhilefloor > cap, sofloor > tx.gas(sufficiency)Differential fuzzing on bal-devnet-7 found a client with exactly that gap:
besu
26.6-develop-e8c2195executes a floor-over-cap transaction thatgeth, nethermind, revm, and the EELS reference all reject. The masked
tests would not have caught it.
This PR re-levers each test so the cap is the only check that can
reject, and adds the accepting positive control:
only, no state gas) with
gas_limitabove the total intrinsic, andassert
max(regular, floor) > cap,regular + state <= tx.gas, and —for the
_with_floor_below_capvariant —floor < cap.gas_limit = floor + 1_000_000)and asserts
floor > capandregular < cap.test_intrinsic_within_cap_gas_limit_above_capaccepts a tx whosegas_limitexceeds the cap while both operands stay below it.All operands are derived from the fork gas calculators so the tests stay
correct as Amsterdam pricing evolves.
Verification (re-filled under EELS, fixtures replayed against the
bal-devnet-7 client binaries):
besu's gap covers both operands of
max(regular, floor), not just thefloor. (Amsterdam / EIP-8037 is not live on mainnet; this is devnet
test-hardening, not a mainnet-exposing disclosure.)
This targets
devnets/bal/7, the branch the nightly bal hive fixtures arefilled from and where the EIP-8037 transaction-validity tests live.
🔗 Related Issues or PRs
Re-levers the cap tests added in #2870 and the surrounding EIP-8037
state-gas test work.
✅ Checklist
just statictype(scope):.mkdocs servelocally and verified the auto-generated docs for new tests in the Test Case Reference are correctly formatted.@ported_frommarker.Cute Animal Picture