GasMetering generates different results compared to gasleft() diff

[Tudmotu]

Component

Forge

Have you ensured that all of these are up to date?

• Foundry
• Foundryup

What version of Foundry are you on?

forge 0.2.0 (ed9298d 2023-03-09T00:04:28.809303436Z)

What command(s) is the bug in?

forge test

Operating System

Linux

Describe the bug

In certain scenarios, using vm.pause/resumeGasMetering() will yield results that differ from what gasleft() would yield.

Below is a simplified reproducible example:

pragma solidity ^0.8.18;

import 'forge-std/Test.sol';

contract GasMeterTest is Test {
    mapping(uint => bytes32) map;

    function test_GasMeter () public {
        vm.pauseGasMetering();

        for (uint i = 0; i < 10000; i++) {
            map[i] = keccak256(abi.encode(i));
        }

        vm.resumeGasMetering();

        for (uint i = 0; i < 10000; i++) {
            map[i] = keccak256(abi.encode(i));
        }
    }

    function test_GasLeft () public {
        for (uint i = 0; i < 10000; i++) {
            map[i] = keccak256(abi.encode(i));
        }

        uint start = gasleft();
        for (uint i = 0; i < 10000; i++) {
            map[i] = keccak256(abi.encode(i));
        }
        console2.log("Gas cost:", start - gasleft());
    }
}

The output shows the difference:

Running 2 tests for test/GasMeterTest.sol:GasMeterTest
[PASS] test_GasLeft() (gas: 231370361)
Logs:
  Gas cost: 6464479

[PASS] test_GasMeter() (gas: 7308777)
Test result: ok. 2 passed; 0 failed; finished in 38.05ms

We can see that when calculating the gas used by diffing gasleft(), we get 6464479 while using the vm.pause/resumeGasMetering cheatcode, we get 7308777.

I've seen more complex scenarios (that are too long to share) where the difference is considerably larger.

[mattsse]

tbh am lacking some details on how this is implemented

Maybe @ArtificialPB can shed some light on this?

[ArtificialPB]

@mattsse had a quick look, it seems that memory gas is being used twice. Using gasleft in vm.pause/resumeGasMetering case also produces the wrong result.

The following seems to be happening:

1. we pause gas metering,
2. lots of memory is expanded while in the first loop,
3. we resume gas metering, overriding the actual gas used with cached gas from before we expanded the memory. The memory stays expanded, but the costs related to it are gone.
4. in the second loop, we start expanding the memory again. Memory gas cost is always set to current number of used words, regardless by how much it was expanded. When metering memory expansion costs, we don't increment by the words expanded delta * gas cost of word expansion, but rather set memory gas used to total words expanded * gas cost of word expansion . Check record_memory function in revm: https://github.com/bluealloy/revm/blob/afc30663270f77df9b4399ad9d4cfb0ad2b814ec/crates/interpreter/src/gas.rs#L74-L84
5. on first memory expansion in second loop, the gas costs are recorded as if we just expanded the memory up to total size. E.g. if we expanded memory from 3200 bits to 3232, the gas_memory cost is as if we just expanded 101 words (3232 / 32) of memory.

This means that in the second loop, after we resume gas metering, the total cost of memory expansion is accounted for as soon as we expand the memory again. Need to find a way to ignore/discard the memory expansion costs while metering is paused.