diff --git a/complexity_assessments/EIPs/EIP-8368.md b/complexity_assessments/EIPs/EIP-8368.md new file mode 100644 index 0000000..c5097f7 --- /dev/null +++ b/complexity_assessments/EIPs/EIP-8368.md @@ -0,0 +1,419 @@ +# EIP-8368: CPSB Recalibration for New Gas Limit + +Checklist revision: **2** (28 anchors) — see [Revision Notes](#revision-notes) + +Link: https://eips.ethereum.org/EIPS/eip-8368 + +## Execution Specs + +### Specs + +[EIP-8368](https://eips.ethereum.org/EIPS/eip-8368) + +Re-derive [EIP-8037](https://eips.ethereum.org/EIPS/eip-8037)'s cost per state byte (CPSB) for a new reference block gas limit. The EIP is currently a placeholder: the new reference limit, the recalibrated value, and the rationale are all TBD. The prototype applies the EIP-8037 derivation at a provisional 300M reference (twice the original 150M), giving CPSB = 3060, exactly 2 x 1530, with ceiling rounding (which reproduces the published 1530 at the 150M reference). In EELS this is a single constant change (`COST_PER_STATE_BYTE` in the amsterdam `vm/gas.py`): every derived quantity (`STORAGE_SET`, `NEW_ACCOUNT`, `AUTH_BASE`, the system-transaction reservoir, the t8n) follows from it. Prototype: [EELS reference PR](https://github.com/spencer-tb/execution-specs/pull/56). + +### Testing + +#### Anchors + +All anchors are scored on a 0–3 scale. A score of 4 may be used in exceptional circumstances where the complexity or impact exceeds the defined anchors. + +##### EVM Gas rule changes + +New EVM gas accounting rules +- 0. No gas accounting changes. +- 1. Existing gas accounting mechanism is updated. +- 2. A new gas accounting mechanism is introduced but it does not affect existing mechanisms nor does it affect existing tests. +- 3. A new gas accounting mechanism is introduced and affects existing mechanisms which in turn affect existing tests. + +##### State-access ordering within opcode execution + +Changes *where inside an opcode's execution* state is accessed, or where gas is charged relative to that access. Because a state access is recorded in the block-level access list only if execution had enough gas to reach it, this ordering is consensus-critical: moving it changes the BAL at every gas boundary of every affected opcode. + +- 0. No change to where state is accessed, or to where gas is charged relative to a state access, within any opcode. +- 1. A single opcode's state-access or gas-charge ordering changes. +- 2. Multiple opcodes' ordering changes, or a new state-accessing operation is introduced whose position in the order must be settled. +- 3. The ordering rule changes for a whole class of state-accessing opcodes at once, or what counts as a recordable state access is redefined — requiring existing BAL vectors to be re-derived across opcodes and forks. + +*Distinct from "Modified opcodes", which asks whether an opcode's **result** changed. This row asks about the **path to the result**, which is observable even when the result is identical. An EIP can be 0 on that row and 3 on this one. + +*Score changes **to** the ordering. Do not score the fact that state accesses are observable — they always are. + +*Each boundary must be re-tested against every other dimension that can change the answer (cold/warm, static/non-static, delegated/direct, revert/success), so the case count grows multiplicatively rather than additively. Note this explicitly under Special Considerations. + +##### Blob gas accounting changes + +New Blob gas accounting rules which potentially affect pre-existing tests + +- 0. No blob gas accounting changes. +- 1. Existing blob gas accounting mechanism is updated. +- 2. A new blob gas accounting mechanism is introduced but it does not affect existing mechanisms nor does it affect existing tests. +- 3. A new blob gas accounting mechanism is introduced and affects existing mechanisms which in turn affect existing tests. + +##### State gas accounting changes + +New state gas accounting rules. State gas is the cost of *writing* state, as opposed to accessing or executing it: `StateGasCosts`, `COST_PER_STATE_BYTE`, the block-level state gas budget, and the spill path into execution gas. + +- 0. No state gas accounting changes. +- 1. An existing state gas cost or `STATE_BYTES_PER_*` rate is adjusted. +- 2. A new state-gas-charging site is introduced, or the block-level state gas budget or reservoir allocation is modified. +- 3. A new state gas charging mechanism is introduced, or the spill interaction between state gas and execution gas is modified, affecting existing gas tests. + +*Harder to test than blob gas: the spill path means state gas cannot be metered independently of execution gas, and some costs (e.g. `NEW_ACCOUNT`) are state-dependent. + +##### New EVM gas refund + +New gas-refund mechanism + +- 0. No new gas-refund mechanisms are introduced. +- 1. A new simple gas-refund mechanism is introduced that does not affect either existing tests or existing gas-refund mechanisms. +- 2. A new complex gas-refund mechanism is introduced or a simple mechanism that affects existing tests or existing gas-refund mechanisms. +- 3. A new complex gas-refund mechanism is introduced that affects existing tests or existing gas-refund mechanisms. + +##### Patterns affecting pre-existing tests + +Implements a new validation mechanism or rule that translates in reworking pre-existing tests + +- 0. No pre-existing tests are affected by this change. +- 1. Minor subset of existing tests are affected by this change. +- 2. Considerable subset of existing tests are affected by this change but involves only a contrived category of tests. +- 3. Major subset of existing tests are affected, including diverse category of tests (benchmarks, static, multiple forks, etc.). + +##### New invariant on pre-existing tests + +Tests that are **not about this EIP** must nonetheless assert something this EIP produces. Their logic does not change; they gain a new thing to check. + +- 0. Pre-existing tests assert nothing new. +- 1. A narrow, contrived category of pre-existing tests gains a new assertion. +- 2. A broad category gains a new assertion, applied mechanically. +- 3. Every test in the fork gains the assertion regardless of what it tests, and pre-fork vectors must be re-derived to satisfy it. + +*Paired with the row above, and easy to confuse with it. "Patterns affecting pre-existing tests" asks whether existing tests must be **reworked**; this row asks whether they must **additionally assert something new**. Score both — an EIP can be low on one and high on the other. + +##### Transition-tool interface changes + +Modifies or adds new fields to the transition tool interface. + +- 0. No modifications to the transition tool interface are required. +- 1. A single new field needs to be introduced to the transition tool interface. +- 2. Multiple new fields or a new mechanism has to be introduced to the transition tool interface. +- 3. Multiple new fields and a new mechanism has to be introduced to the transition tool interface. + +*Special consideration must be paid to this section if the EIP introduces a mechanism that requires the state transition tool to be aware whether the block it is processing is the fork-activation block. + +##### New test-framework primitives + +Requires new abstractions in the test framework itself — expectation types, modifiers, helpers — beyond writing test functions with what already exists. + +- 0. Existing test primitives suffice. +- 1. Existing primitives need minor extension. +- 2. New expectation or modifier primitives are required, reusable within this EIP's own test suite. +- 3. New framework-level primitives are required that become a permanent part of the framework and are used by other EIPs' tests. + +##### Cryptography + +Introduces new cryptography mechanisms or modifies existing functionality that involves cryptography + +- 0. No cryptography mechanisms are introduced. +- 1. A new cryptography mechanism is introduced but it is a well known mechanism that is known to have vast resources to aid on its testing. +- 2. Multiple new cryptography mechanisms are introduced that are well-known or a single but novel mechanism is introduced that is either untested or has limited resources. +- 3. Multiple new cryptography mechanisms are introduced and at least one of them is a novel mechanism. + +##### Edge/boundary conditions + +Feature contains edge/boundary conditions. + +- 0. No discernible edge cases or boundary conditions are introduced. +- 1. A single edge-case or boundary-condition prone mechanism is introduced. +- 2. Multiple edge-case or boundary-condition prone mechanisms are introduced, but none of them requires an elevated number of cases to test. +- 3. Multiple edge-case or boundary-condition prone mechanisms are introduced and at least one of them requires an elevated number of cases to test. + +##### Block syncing changes + +Modifies block RLP validation mechanisms that require test client syncing. + +- 0. No new RLP validation mechanism is introduced. +- 1. A single simple RLP validation mechanism is introduced. +- 2. Multiple simple RLP validation mechanisms are introduced or a single complex one. +- 3. Multiple RLP validation mechanisms are introduced and at least one of them is deemed complex. + +##### Engine API changes + +Introduces new fields to the Engine API directives + +- 0. No new fields or communication mechanisms are introduced to the Engine API. +- 1. A single new field is introduced in one of the Engine API endpoints. +- 2. Multiple fields are introduced to one or multiple Engine API end points, or a new Engine API end-point is introduced. +- 3. Multiple fields are introduced to one or multiple Engine API end points and a new Engine API end-point is introduced. + +##### Added system contracts + +Introduces new system contract, stateful or not + +- 0. No new system contracts are introduced. +- 1. A new system contract is introduced that is not stateful nor does it trigger a new system action (e.g. requests to the consensus layer). +- 2. Multiple new system contracts are introduced or a single new system contract that is either stateful or triggers a new system action (e.g. requests to the consensus layer). +- 3. Multiple new system contracts are introduced and at least one of them is either stateful or triggers a new system action (e.g. requests to the consensus layer). + +##### Modified system contracts + +Modifies pre-existing system contracts + +- 0. No modifications to pre-existing system contracts are introduced, directly or indirectly. +- 1. Does not directly modify any system contract, but its behavior has minor indirect effects on one or more system contracts. +- 2. Does not directly modify any system contract, but its behavior has major indirect effects on one or more system contracts. +- 3. At least one pre-existing system contract code or state is modified, which would involve irregular state transition or a similarly complex transition methodology. + +##### Added opcodes + +Introduces new opcodes + +- 0. No new opcodes are introduced. +- 1. A new simple opcode is introduced (no data portion, no complex stack mechanics, and a constant gas cost). +- 2. Multiple new simple opcodes are introduced, or a single new complex opcode is introduced (has data portion, or complex stack mechanics, or a dynamic gas cost). +- 3. Multiple new opcodes are introduced, and at least one of them is complex (has data portion, or complex stack mechanics, or a dynamic gas cost). + +*Cryptography opcodes are not considered complex by default. Refer to the "Cryptography" section for a separate assessment. + +##### Modified opcodes + +Modifies pre-existing opcodes + +- 0. No pre-existing opcode modifications are introduced. +- 3. At least one pre-existing opcode's behavior is modified (not including gas changes) or a pre-existing opcode is deprecated. + +##### Added precompiles + +Introduces new precompiles + +- 0. No new precompiles are introduced. +- 1. A new simple precompile is introduced (constant input length, constant gas cost). +- 2. Multiple new simple precompiles are introduced, or a single new complex precompile is introduced (dynamic input length or dynamic gas cost). +- 3. Multiple new precompiles are introduced, and at least one of them is complex (dynamic input length or dynamic gas cost). + +*Cryptography precompiles are not considered complex by default. Refer to the "Cryptography" for a separate assessment. + +##### Modified precompiles + +Modifies pre-existing precompiles logic or gas-accounting + +- 0. No pre-existing precompiles are modified. +- 1. At least one pre-existing precompile has its gas schedule modified. +- 2. Multiple pre-existing precompiles have their gas schedule modified, or a single pre-existing precompile has its behavior modified. +- 3. The behavior of multiple pre-existing precompiles, or a single complex pre-existing precompile modified. + +##### Encoding changes (RLP/SSZ) + +Introduces encoding changes at the transaction/block/interfaces level + +- 0. No encoding changes are introduced at the transaction, block, or interfaces levels. +- 3. An encoding change is introduced at transaction, block or interfaces level (e.g. RLP -> SSZ). + +*"Interfaces level" includes the Engine API. Score an Engine API encoding change (e.g. JSON -> SSZ) here. + +##### New transaction types + +Introduces a new transaction type + +- 0. No new transaction types are introduced. +- 3. A new transaction type is introduced. + +##### New or modified transaction validity mechanisms + +Creates new or modifies pre-existing transaction types' validation mechanisms + +- 0. No changes are introduced to the validity rules of existing transaction types or to their intrinsic gas cost calculation. +- 1. Minor adjustments are introduced to validity rules or intrinsic gas cost calculation, but they do not significantly affect existing tests. +- 2. Changes to validity rules or intrinsic gas cost calculation affect existing tests, but require only limited updates to test cases and no redesign of the testing infrastructure. +- 3. Changes to validity rules or intrinsic gas cost calculation require extensive rework or redesign of the tests or testing infrastructure. + +##### New block / header fields + +Introduces new block or block header fields + +- 0. No new block or header fields are introduced. +- 3. A new block or header field is introduced. + +##### New fork activation mechanism + +Modifies state, internal variables, or similar, at the fork activation block + +- 0. No state modifications, internal variables or similar are modified at the fork activation block. +- 3. Either a state modification or internal variables are modified at the fork activation block. + +*Initialization of new internal variable is not considered a modification. + +##### Performance risks + +Introduces or modifies mechanisms and requires performance validation. + +- 0. No new mechanisms are introduced that require performance validation. +- 1. The introduced mechanisms can be benchmarked in isolation and do not affect existing performance behavior. +- 2. The introduced mechanisms cannot be fully benchmarked in isolation, but they only have a limited impact on the existing performance benchmarks. +- 3. The introduced mechanisms cannot be benchmarked in isolation and have a substantial impact on existing performance benchmarks or have complex interactions with existing mechanisms. + +##### Security risks + +Introduces or modifies mechanisms that could compromise the security of the chain, users, validators, or other stakeholders, if not implemented properly. + +- 0. No new mechanisms are introduced that could pose a security risk. +- 1. The introduced mechanisms are self-contained, can be validated in isolation, and do not alter existing invariants that could pose a security risk for any stakeholders. +- 2. The introduced mechanisms interact with a limited number of existing components, slightly altering their security assumptions and requiring a targeted security review or fuzzing. +- 3. The introduced mechanisms interact with multiple existing components, including critical ones, substantially altering their security assumptions and requiring an extensive security review and fuzzing. + +##### Unspecified behavior requiring cross-client consensus + +The EIP text does not determine the answer for cases a test can construct. Clients must agree on a previously unspecified detail before tests can be baselined. The cost here is coordination and re-baselining, not test writing. + +- 0. The EIP text determines the answer for every case a test could construct. +- 1. A few details are unspecified but have an obvious intended reading. +- 2. Details require client agreement before tests can be written, but they are localized. +- 3. A previously unspecified *and previously unobservable* behavior becomes consensus-critical; expect tests to be re-baselined on each round of EIP amendment. + +*Score this from the EIP's state at assessment time: whether it has client implementations, whether it has been through a devnet, and how many open questions remain on its discussion thread. + +##### Cross-EIP interactions + +Introduces or modifies mechanisms that affect other EIPs in either the same or past forks. + +- 0. Fully self-contained EIP that does not depend on, modify, or conflict with any other EIP. +- 1. The EIP interacts with one or more other EIPs in a non-critical and limited way but can be tested independently for the most part. +- 2. The EIP depends on or modifies one or more other EIPs such that coordinated testing and consideration is required, but interactions are limited in scope and not complex. +- 3. The EIP has strong interdependencies with multiple EIPs, requiring extensive coordinated cross-EIP testing as well as potential re-design of existing test vectors. +- **+1 for every 3 additional interacting EIPs beyond the first 3**, each of which requires its own coordinated test cases. List the EIPs in the rationale. + +*This row is intentionally uncapped, unlike every other anchor: each interacting EIP is another axis of the test matrix, so a ceiling would make a 12-EIP product indistinguishable from a 3-EIP one. + +### Checklist + +| Anchor | Score (0–3) | Rationale | +|---|---:|---| +| **EVM Gas rule changes** | 0 | Execution gas schedule untouched. The change is confined to state gas, scored on its own row. Measured: zero execution-gas flips outside state-charging paths. | +| **State-access ordering within opcode execution** | 0 | No ordering changes, only the size of a charge. | +| **Blob gas accounting changes** | 0 | | +| **State gas accounting changes** | 1 | The definitional anchor-1 case: `COST_PER_STATE_BYTE` is adjusted (1530 to a provisional 3060). Byte rates, charging sites, reservoir mechanics, and the spill path are untouched. | +| **New EVM gas refund** | 0 | | +| **Patterns affecting pre-existing tests** | 4 | Measured blast radius: 1,614 executions / 314 functions of 65,756 collected, spanning ported static plus tangerine, byzantium, osaka, prague, and amsterdam suites. 300 files parked, 8 sibling suites re-derived to fork-correct budgets. Scored above anchor 3 because the impact recurs: the value is TBD, so every parked boundary and re-derived budget moves again when the final value lands. | +| **New invariant on pre-existing tests** | 0 | No new assertion lands on unrelated tests. | +| **Transition-tool interface changes** | 0 | The constant flows through the existing interface. | +| **New test-framework primitives** | 0 | The EIP-8037 fork API (`cost_per_state_byte`) already exists; activation is one override. | +| **Cryptography-related testing** | 0 | | +| **Edge/boundary conditions** | 2 | Exact-fit and one-short OOG boundaries at every charging site, plus the funding-regime boundary (reservoir vs spill vs the block gas limit, which a max-size deposit now exceeds). Multiple prone surfaces, none with elevated case counts. | +| **Block syncing changes** | 0 | | +| **Engine API changes** | 0 | | +| **Added system contracts** | 0 | | +| **Modified system contracts** | 0 | The system-transaction reservoir re-derives from the constant; contract code unchanged. | +| **Added opcodes** | 0 | | +| **Modified opcodes** | 0 | No result changes, only prices. | +| **Added precompiles** | 0 | | +| **Modified precompiles** | 0 | | +| **Encoding changes (RLP/SSZ)** | 0 | | +| **New transaction types** | 0 | | +| **New or modified transaction validity mechanisms** | 0 | Intrinsic rules and the gas limit cap are unchanged; only charged amounts shift. | +| **New block / header fields** | 0 | | +| **New fork activation mechanism** | 0 | | +| **Performance risks** | 1 | No new mechanism, but the recalibrated value can only be validated against state-growth benchmarks, and the benchmark suite sits outside the measured blast radius (excluded from default fills) while its state-heavy compositions halve in per-block capacity. | +| **Security risks** | 1 | A self-contained parameter change, validated in isolation. It doubles the economic cost of state creation, an economics shift rather than a mechanism risk. | +| **Unspecified behavior requiring cross-client consensus** | 3 | Scored from the EIP's state at assessment time: the entire Specification section is TBD (reference limit, value, rationale, rounding rule), there are no client implementations, and it has never been on a devnet. Every amendment round re-baselines every fixture that creates state. The prototype's ceiling rounding reproduces the published 1530 at 150M, but nothing in the EIP confirms it. | +| **Cross-EIP interactions** (uncapped) | 4 | Directly modifies EIP-8037. Coordinated testing needed with EIP-7954 (a 2x CPSB puts a max-size deposit above ~201M gas, undeployable below that block limit), EIP-7825 (cap-funded state creation capacity halves to ~5.5 KiB per transaction), EIP-7702 (per-authorization state gas), EIP-7928 (BAL scenario budgets), and EIP-8038 (companion access-gas schedule). Six interacting EIPs: anchor 3 plus one increment. | + +**Total: 16** + +#### Special Considerations + +The placeholder status dominates the testing cost. Until the reference limit and value land, every fixture encodes a provisional number, and the 459 `valid_before("EIP8368")` parking markers in the prototype double as the re-derivation worklist for whatever value is chosen. Activation is also coupled to real block gas limits: any recalibration of 2x or more makes max-size EIP-7954 contracts undeployable until live block limits exceed the deposit cost (~201M gas at the provisional value), so the recalibration cannot sensibly precede the limit growth it targets. + +#### Notes + +Benchmark suites are excluded from the default fill and were not part of the measured blast radius; state-heavy benchmark compositions halve in per-block capacity and will need the same budget re-derivation. The prototype's default fill block gas limit (120M) is itself below the provisional max-size deposit cost, which is why the affected deploy tests now derive their block environment from the fork. + +#### Final Assessment + +| Category | Description | Value | +|-----------|--------------|:----:| +| **Total Score** | Sum of all anchor scores (0–84 nominal; **Cross-EIP interactions** is uncapped, so there is no hard maximum) | **`16`** | +| **Complexity Tier** | Computed from total score | 🟡 | + +##### Tier Interpretation + +| Tier | Range | Meaning | +|------|--------|----------| +| 🟢 **Low Complexity** | **<12** | Minor feature or localized change. Existing tests are largely unaffected. Does not require intensive cross-EIP testing. | +| 🟡 **Medium Complexity** | **>=12<23** | Moderate change affecting multiple components. Requires moderate cross-EIP testing. | +| 🔴 **High Complexity** | **>=23** | Broad or deep impact on protocol behavior; high regression risk; and/or requiring intensive cross-EIP testing. | + +##### Revision Notes + +> Background only. Nothing here is needed to fill in the checklist — the anchor +> definitions above are self-contained. Record the revision a completed +> assessment was scored against at the top of the document; **scores are not +> comparable across revisions**, so re-score rather than compare. + +###### Revision 2 — 28 anchors, nominal 0–84 + +Five anchors were added, one was removed, and **Cross-EIP interactions** was +uncapped: 24 anchors become 28. + +Tier thresholds were 10/20 against revision 1's 24-anchor, 72-point scale. They +are scaled by 84/72 to 12/23 so that tier membership stays stable as the anchor +set grows, rather than every EIP drifting upward a tier. + +The revision comes from +[the Amsterdam calibration](../complexity_assessments/calibration/README.md), +which measured each Amsterdam EIP's score against the work it actually produced in +`ethereum/execution-specs`. Every mature Amsterdam EIP landed within ±3 of the +score its measured work implies, except EIP-7928, which was short by 11 points +with no rows left to score on — it had 29 of a possible 33 across the ten rows +that applied to it. The five new rows are where that work should have been +recorded. See +[proposed-anchors.md](../complexity_assessments/calibration/proposed-anchors.md) +for the evidence behind each one. + +Per-row notes: + +- **State-access ordering within opcode execution.** EIP-7928 made every state + access consensus-observable via the BAL. That was a one-time transition, so the + row is worded for the world after it: it scores EIPs that *move* the ordering, + not the introduction of observability. EIP-7928 itself scored 0 on **Modified + opcodes** — correctly, since final EVM semantics were unchanged — which is how + the most expensive part of its work scored zero under the previous revision. + Scored retroactively against this row it is a 3: it reordered gas-charge sites + across an entire class of opcodes. Any pre-Amsterdam EIP is a 0 regardless of + what it did internally, since intra-opcode ordering was not consensus then. +- **New invariant on pre-existing tests.** Split out from **Patterns affecting + pre-existing tests**, which only captures *rework*. EIP-7928 scored 2 there and + would score 3 here: every Amsterdam test now validates a BAL whether or not it + has anything to do with access lists. +- **State gas accounting changes.** State gas was introduced by EIP-8037. The + checklist had a row for blob gas and none for this. +- **Cross-EIP interactions.** The `+1 per 3 additional EIPs` increment is a + judgement call, not a calibrated figure. It exists because EIP-7928 interacted + with 12 EIPs and scored the same 3 as an EIP interacting with three. +- **Engine API encoding changes** was removed. It described a wire-format change + at the Engine API layer (JSON -> RLP/SSZ), but such migrations are coordinated + outside the EIP process, so an EIP-scoped assessment has no use for the row. It + was scored 0 or left blank in all 28 assessments written against revision 1, so + removing it changes no historical total, and it never had anchor level + definitions. **Encoding changes (RLP/SSZ)** covers the case if it ever arises — + that row already reads "transaction, block or interfaces level". + +One finding is deliberately **not** reflected in the scoring: some of this cost +grows multiplicatively rather than additively, and no additive row at any weight +reproduces EIP-7928's measured cost. A multiplier row was considered and deferred +— with only one high-cost EIP observed, the data cannot identify which row should +multiply. Until a second fork supplies a second observation, evaluators record +multiplicative test-matrix growth under **Special Considerations**, as the +State-access ordering anchor instructs. + +###### Revision 1 — 24 anchors, 0–72 + +Original version. + + +## Consensus Specs + +### Specs + +### Testing + +### Notes