Glamsterdam · EIP-8037

Repricing of state gas vs execution gas

EIP-8037 splits a transaction's gas into two pools: execution gas and the reservoir (state gas).
Execution gas is capped to 16.7M, but total tx.gas is now 4.2B. Anything outside the 16.7M goes into the reservoir.
Everything is execution gas except creation of state. (See What pays from which pool.)
If state creation is undone, the gas refund goes back to the pool where it came from.
8037 also makes new state far more expensive.
gasleft() only sees execution gas left, not all the gas. This breaks a ton of assumptions.

Step through the three assumptions this breaks, with a small transaction and a big one.

Assumption

tx.gas

Intrinsicgas_left, capped at 16,777,216State-gas reservoir

Execution gas of the opcodes themselves is left out so the state-gas moves are easy to see.

The rules behind it

At the start, up to 16,777,216 of tx.gas (after intrinsic gas) becomes gas_left. The rest goes into the reservoir.
Execution gas is paid from gas_left only.
State gas is paid from the reservoir first, then from gas_left.
When a state creation is undone, its gas is refilled last in, first out: back into gas_left first, up to what was taken from it.
gasleft() returns gas_left only. The 63/64 rule applies to gas_left only; a callee borrows the whole reservoir.

What pays from which pool

Operation	Execution gas	State gas
Reading state (SLOAD, BALANCE, EXTCODE*, cold access)	All of it	0
Changing or clearing an existing slot	All of it	0
New storage slot (zero to non-zero)	The access part	64 B × 1,530 = 97,920
ETH to an address that doesn't exist yet	The normal call part	120 B × 1,530 = 183,600
Deploy (CREATE, CREATE2)	Constructor, code hashing, access	183,600 + 1,530 per code byte
EIP-7702 authorisation	Calldata, ecrecover, access	35,190 (+183,600 if the account is empty)
Logs, memory, compute, precompiles, calldata	All of it	0

Based on EIP-8037 as of October 2026. The EIP is in last call and paused after a security finding, so details can change before mainnet. Scenario 2 is an illustration built from the spec text, not a description of a specific exploit.