EIP-8037 state-gas rules force Ethereum dApps to rewrite billing

Ethereum's core developers are asking application teams to help decide whether proposed gas changes in the Glamsterdam upgrade need revision, because their own audits cannot cover every project's contracts and off-chain services.

In a Nov. 6 post on the Ethereum Foundation blog, Marius van der Wijden asked developers and auditors to check eight gas assumptions affected by the proposed upgrade. Security auditors ChainSecurity and Dedaub are investigating alongside internal audits, but the review also needs projects to explain how they could repair affected systems.

The Hoodi testnet's planned Oct. 26 activation and accompanying 200 million gas-limit increase were postponed on Oct. 22.

The Nov. 6 appeal says the delay continues pending resolution, while the notices leave mainnet activation unset.

The consequences extend from relayers recovering too little of their transaction costs to wallet authorizations becoming reusable after a particular kind of failure. That makes application repairability part of the evidence developers need when weighing changes to the upgrade.

Glamsterdam's EIP-8037 would raise the cost of creating persistent blockchain data and meter that state growth separately from execution, and EIP-8038 would reprice access and writes to existing state.

The aim is to support higher throughput while controlling the data Ethereum nodes must retain.

The eight-invariant framework separates three price assumptions, covering fixed budgets and reserves, from five accounting assumptions involving gas returns, failure handling, billing and delegation.

Gas accounting changes payments and wallet safety

A relayer pays to execute a transaction for someone else and may recover that expense by measuring gas before and after the work. The framework's INV-5 entry explains how the proposed accounting can disrupt that calculation.

Under EIP-8037, a transaction initially funds a separate state-gas reservoir when its gas limit exceeds 16,777,216. State creation draws from that pool first, then execution gas. Solidity's gasleft() reading excludes the reservoir, so subtracting two readings can miss costs that the relayer actually pays.

If the later reading exceeds the earlier one, checked subtraction reverts, blocking the operation. Unchecked subtraction can wrap into a large number and potentially produce excessive reimbursement, depending on the surrounding arithmetic and payment checks.

Meanwhile, invisible reservoir spending can leave users undercharged and operators covering the shortfall.

The billing guidance suggests agreeing on a user-signed fee using an estimate under the new rules. Where metering remains necessary, clamping the subtraction and capping payment at a signed maximum limits the charge, while reservoir-funded costs remain outside the measurement.

An open specification proposal, PR #12581, would prevent gas readings from increasing. That would address the subtraction problem, but the reservoir's billing blind spot would remain.

One storage write, two ways to fund it

Under the proposed Glamsterdam rules, gasleft() excludes the state-gas reservoir. Select a funding state to see how the balance charged for one cold new-slot write changes.
ONE COLD NEW-SLOT WRITE 110,020total gas 12,100 execution gas 97,920 state gas Proposed EIP-8037 / EIP-8038 charges
ONE COLD NEW-SLOT WRITE 110,020total gas 12,100 execution 97,920 state Proposed EIP-8037 / EIP-8038 charges

Which balance pays the state charge?

Which balance pays the state charge?Reservoir fundedReservoir empty
Illustrative state with at least 97,920 gas in the reservoir at this write. The execution balance pays 12,100 and the reservoir pays 97,920.
EXECUTION BALANCE 12,100gas funds execution gasleft() drop 12,100 STATE-GAS RESERVOIR 97,920gas funds state creation Outside gasleft() NEW SLOT 110,020 total gas
EXECUTION BALANCE STATE RESERVOIR 12,10097,920 gas paysexecution gas pays statecreation gasleft() drop 12,100 Outside gasleft() NEW SLOT 110,020 total gas
Illustrative state with zero reservoir gas at this write. The execution balance pays the complete 110,020 charge, including the state component.
EXECUTION BALANCE 110,020gas funds both components gasleft() drop 110,020 STATE-GAS RESERVOIR 0gas available at this write State cost draws on execution NEW SLOT 110,020 total gas
EXECUTION BALANCE STATE RESERVOIR 110,0200 gas paysboth components gas availableat this write gasleft() drop 110,020 Paid from execution NEW SLOT 110,020 total gas

A funded reservoir can pay the state charge outside gasleft(), while an empty reservoir shifts that charge to the execution balance.

Proposed rules checked November 6, 2026. Operation-level charges exclude intrinsic, wrapper and incidental instruction costs. Initial reservoir funding requires a transaction gas limit above 16,777,216, and later refills may also fund it. Intermediate reservoir balances split the state charge between balances.
Sources and evidence

Sources

1. EIP-8037 gas accounting
2. Pinned EIP-8037
3. ChainSecurity operation costs
4. Ethereum compatibility framework
5. Pinned compatibility framework
6. EIP-8038 cost schedule
7. Pinned EIP-8038

Supporting facts

• Under the current EIP-8037 reservoir model, the initial separate state-gas reserve is funded only when the transaction gas limit exceeds 16,777,216. State charges use that reserve first, then execution gas, while gasleft() excludes the reserve. [1] [2] [3]
• EIP-8038 reprices state access and writes. In the audited schedule a cold new storage slot costs 110,020 total gas, consisting of 12,100 execution gas and 97,920 state gas, compared with 22,100 under Osaka. A first change to an existing nonzero slot costs 10,100 warm or 12,100 cold, compared with 2,900 or 5,000. [4] [5] [3] [6] [7]

Method

Uses the proposed charge for one cold zero-to-nonzero storage write. 12,100 execution + 97,920 state = 110,020 total gas. Funding illustrations assume at least 97,920 reservoir gas or zero at that write. The main bar is proportional, rounded to 0.001 SVG units. Connectors are schematic.

Scope

Proposed rules checked November 6, 2026. Operation-level charges exclude intrinsic, wrapper and incidental instruction costs. Initial reservoir funding requires a transaction gas limit above 16,777,216, and later refills may also fund it. Intermediate reservoir balances split the state charge between balances.
Infographic by CryptoSlate

INV-8 examines EIP-7702 delegation, where an account authorizes delegated contract code. Under the proposed rules, insufficient gas during pre-execution can leave a transaction included in a block while rolling back its delegation and authorization-related update to the account's sequence number, or nonce.

An exposed authorization that still satisfies its validity checks, including the authorizing account's nonce, can then be reused. If the delegated contract also has an initializer that lets the first caller choose the owner, an attacker could apply the authorization and initialize ownership in one transaction.

Authorization front-running already existed in public mempools, but here a failed mined transaction can expose a reusable authorization even after private submission.

Delegations already applied before the top-level execution frame remain in place when that later frame fails. A failed receipt requires further checking of the account's resulting code and nonce.

Suggested wallet safeguards include binding initialization to the account's signature or self-calls and invalidating exposed authorizations. Charging the worst-case authorization cost upfront has also been suggested as a protocol change and remains unadopted.

Repair options enter the upgrade decision

Under the proposed schedule, creating a cold storage slot costs 110,020 total gas, versus 22,100 under Osaka. Of that proposed total, 12,100 is execution gas, and 97,920 is state gas, with the reservoir determining which balance funds the latter.

ChainSecurity's Oct. 13 research shows how changed costs and returned gas can let a contract finish recording an underfunded operation as permanently unsuccessful. If that record removes the retry path, a valid operation can become impossible to repeat.

Revalidated budgets, propagating failures, and preserving retries address different parts of that risk.

The repository asks affected projects whether a setting, upgrade, or migration can fix their problem, and roughly when. Those answers help developers assess how much compatibility work applications can absorb and where specification changes could prevent damage.

Concrete reports of what breaks and how to repair it will inform the next specification discussions.