Submitted by 0x41, also found by ABAIKUNANBAEV and Sentryx
There is a mismatch between how gas fees are deducted and refunded in the EVM implementation:
This mismatch means users will receive incorrect (lower) refunds than they should. The gas refund should be based on the difference between a transactions gas limit (what was charged) and its actual gas usage (what was consumed), not the blocks total gas usage.
The impact is that users will lose funds as they receive smaller refunds than they should. This becomes especially problematic when multiple transactions are included in a block, as the cumulative block gas increases with each transaction, reducing refunds for subsequent transactions.
The issue stems from two pieces of code:
Where VerifyFee returns the fee based on the transaction gas limit:
To demonstrate the impact, consider this scenario:
The refund calculation should be based on each transactions individual gas usage rather than the block gas. Modify the refund logic in msg_server.go:
This ensures that each transactions refund is calculated based on its own gas limit and usage, independent of other transactions in the block.
ABAIKUNANBAEV (warden) commented:
berndartmueller (judge) commented:
k-yang (Nibiru) disputed and commented:
Nibiru mitigated:
Status: Mitigation confirmed. 
