fix(l1): amsterdam EIP fixes

.gitignore

@@ -133,3 +133,5 @@ core.*
 
 # Log files
 *.log
+
+__pycache__/

crates/common/types/block_access_list.rs

@@ -514,6 +514,10 @@ pub struct BlockAccessListRecorder {
     /// Used for efficient checkpoint/restore without cloning storage_reads.
     /// On restore, we truncate this Vec and the slots go back to being reads.
     reads_promoted_to_writes: BTreeMap<Address, Vec<U256>>,
+    /// When true, SYSTEM_ADDRESS balance/nonce/touch changes are filtered out.
+    /// Set during system contract calls (EIP-2935, EIP-4788, etc.) where the
+    /// system address account is backed up and restored, so changes are transient.
+    in_system_call: bool,
 }
 
 impl BlockAccessListRecorder {
@@ -588,6 +592,15 @@ impl BlockAccessListRecorder {
                 }
             }
 
+            // If this slot was promoted from read to write, undo the promotion
+            // so build() doesn't skip it from storage_reads.
+            if let Some(promoted) = self.reads_promoted_to_writes.get_mut(&addr) {
+                promoted.retain(|s| *s != slot);
+                if promoted.is_empty() {
+                    self.reads_promoted_to_writes.remove(&addr);
+                }
+            }
+
             // Add as a read instead
             self.storage_reads.entry(addr).or_default().insert(slot);
         }
@@ -638,24 +651,40 @@ impl BlockAccessListRecorder {
         self.current_index
     }
 
+    /// Marks the recorder as being inside a system contract call.
+    /// While in this mode, SYSTEM_ADDRESS balance/nonce/touch changes are filtered out
+    /// because system calls backup and restore the system address account state.
+    pub fn enter_system_call(&mut self) {
+        self.in_system_call = true;
+    }
+
+    /// Marks the recorder as no longer inside a system contract call.
+    pub fn exit_system_call(&mut self) {
+        self.in_system_call = false;
+    }
+
     /// Records an address as touched during execution.
     /// The address will appear in the BAL even if it has no state changes.
     ///
-    /// Note: SYSTEM_ADDRESS is excluded unless it has actual state changes.
+    /// Note: SYSTEM_ADDRESS is excluded during system contract calls.
     pub fn record_touched_address(&mut self, address: Address) {
-        // SYSTEM_ADDRESS is only included if it has actual state changes
-        if address != SYSTEM_ADDRESS {
-            self.touched_addresses.insert(address);
+        if address == SYSTEM_ADDRESS && self.in_system_call {
+            return;
         }
+        self.touched_addresses.insert(address);
     }
 
     /// Records multiple addresses as touched during execution.
     /// More efficient than calling `record_touched_address` in a loop.
     ///
-    /// Note: SYSTEM_ADDRESS is filtered out.
+    /// Note: SYSTEM_ADDRESS is filtered out during system contract calls.
     pub fn extend_touched_addresses(&mut self, addresses: impl Iterator<Item = Address>) {
-        self.touched_addresses
-            .extend(addresses.filter(|addr| *addr != SYSTEM_ADDRESS));
+        if self.in_system_call {
+            self.touched_addresses
+                .extend(addresses.filter(|addr| *addr != SYSTEM_ADDRESS));
+        } else {
+            self.touched_addresses.extend(addresses);
+        }
     }
 
     /// Records a storage slot read.
@@ -736,7 +765,8 @@ impl BlockAccessListRecorder {
     /// Should be called after every balance modification.
     /// Per EIP-7928, only the final balance per (address, block_access_index) is recorded.
     /// If multiple balance changes occur within the same transaction, only the last one matters.
-    /// Note: SYSTEM_ADDRESS balance changes are excluded (system calls backup/restore it).
+    /// Note: SYSTEM_ADDRESS balance changes are excluded during system contract calls
+    /// (system calls backup/restore the system address account state).
     ///
     /// IMPORTANT: We always push new entries (never update in-place) to support checkpoint/restore.
     /// The checkpoint mechanism captures lengths, not values. If we updated in-place, the restored
@@ -745,7 +775,7 @@ impl BlockAccessListRecorder {
     pub fn record_balance_change(&mut self, address: Address, post_balance: U256) {
         // SYSTEM_ADDRESS balance changes from system contract calls should not be recorded
         // (system calls backup and restore SYSTEM_ADDRESS state)
-        if address == SYSTEM_ADDRESS {
+        if address == SYSTEM_ADDRESS && self.in_system_call {
             return;
         }
 
@@ -779,7 +809,7 @@ impl BlockAccessListRecorder {
     /// Note: SYSTEM_ADDRESS nonce changes from system calls are excluded.
     pub fn record_nonce_change(&mut self, address: Address, post_nonce: u64) {
         // SYSTEM_ADDRESS nonce changes from system contract calls should not be recorded
-        if address == SYSTEM_ADDRESS {
+        if address == SYSTEM_ADDRESS && self.in_system_call {
             return;
         }
         self.nonce_changes
@@ -1093,4 +1123,70 @@ impl BlockAccessListRecorder {
         // Note: touched_addresses is intentionally NOT restored - per EIP-7928,
         // accessed addresses must be included even from reverted calls
     }
+
+    /// Handles BAL cleanup for a self-destructed account per EIP-7928/EIP-6780.
+    /// Called after destroy_account for contracts created and destroyed in the same tx.
+    /// Removes nonce/code changes, converts storage writes to reads.
+    /// Matches EELS `track_selfdestruct` in state_tracker.py:315.
+    pub fn track_selfdestruct(&mut self, address: Address) {
+        let idx = self.current_index;
+
+        // 1. Remove nonce changes for this address at current tx index
+        if let Some(changes) = self.nonce_changes.get_mut(&address) {
+            changes.retain(|(i, _)| *i != idx);
+            if changes.is_empty() {
+                self.nonce_changes.remove(&address);
+            }
+        }
+
+        // 2. Remove balance changes if pre-balance was 0 (round-trip: 0→X→0)
+        // If initial_balance was never set, treat it as 0 (contract created with no value)
+        let pre_balance = self
+            .initial_balances
+            .get(&address)
+            .copied()
+            .unwrap_or_default();
+        if pre_balance.is_zero()
+            && let Some(changes) = self.balance_changes.get_mut(&address)
+        {
+            changes.retain(|(i, _)| *i != idx);
+            if changes.is_empty() {
+                self.balance_changes.remove(&address);
+            }
+        }
+
+        // 3. Remove code changes for this address at current tx index
+        if let Some(changes) = self.code_changes.get_mut(&address) {
+            changes.retain(|(i, _)| *i != idx);
+            if changes.is_empty() {
+                self.code_changes.remove(&address);
+            }
+        }
+
+        // 4. Convert storage writes from current tx to reads
+        if let Some(slots) = self.storage_writes.get_mut(&address) {
+            let mut slots_to_read: Vec<U256> = Vec::new();
+            for (slot, changes) in slots.iter_mut() {
+                if changes.iter().any(|(i, _)| *i == idx) {
+                    slots_to_read.push(*slot);
+                }
+                changes.retain(|(i, _)| *i != idx);
+            }
+            slots.retain(|_, changes| !changes.is_empty());
+            if slots.is_empty() {
+                self.storage_writes.remove(&address);
+            }
+
+            for slot in slots_to_read {
+                self.storage_reads.entry(address).or_default().insert(slot);
+                // Undo read-to-write promotion for these slots
+                if let Some(promoted) = self.reads_promoted_to_writes.get_mut(&address) {
+                    promoted.retain(|s| *s != slot);
+                    if promoted.is_empty() {
+                        self.reads_promoted_to_writes.remove(&address);
+                    }
+                }
+            }
+        }
+    }
 }

crates/vm/backends/levm/mod.rs

@@ -751,10 +751,21 @@ pub fn generic_system_contract_levm(
         data: calldata,
         ..Default::default()
     });
-    let mut vm =
-        VM::new(env, db, tx, LevmCallTracer::disabled(), vm_type).map_err(EvmError::from)?;
+    // EIP-7928: Mark BAL recorder as in system call mode to filter SYSTEM_ADDRESS changes
+    if let Some(recorder) = db.bal_recorder.as_mut() {
+        recorder.enter_system_call();
+    }
+
+    let result = VM::new(env, db, tx, LevmCallTracer::disabled(), vm_type)
+        .and_then(|mut vm| vm.execute())
+        .map_err(EvmError::from);
+
+    // EIP-7928: Exit system call mode before restoring accounts (must run even on error)
+    if let Some(recorder) = db.bal_recorder.as_mut() {
+        recorder.exit_system_call();
+    }
 
-    let report = vm.execute().map_err(EvmError::from)?;
+    let report = result?;
 
     if let Some(system_account) = system_account_backup {
         db.current_accounts_state

crates/vm/levm/src/hooks/default_hook.rs

@@ -182,9 +182,11 @@ pub fn refund_sender(
 
     // EIP-7778: Separate block vs user gas accounting for Amsterdam+
     if vm.env.config.fork >= Fork::Amsterdam {
-        // Block accounting uses pre-refund gas
-        ctx_result.gas_used = gas_used_pre_refund;
-        // User pays post-refund gas
+        // Block accounting uses max(pre-refund gas, calldata floor)
+        // This prevents gas smuggling via refunds (EIP-7778)
+        let floor = vm.get_min_gas_used()?;
+        ctx_result.gas_used = gas_used_pre_refund.max(floor);
+        // User pays post-refund gas (with floor)
         ctx_result.gas_spent = gas_spent;
     } else {
         // Pre-Amsterdam: both use post-refund value
@@ -300,6 +302,11 @@ pub fn delete_self_destruct_accounts(vm: &mut VM<'_>) -> Result<(), VMError> {
 
         *account_to_remove = LevmAccount::default();
         account_to_remove.mark_destroyed();
+
+        // EIP-7928: Clean up BAL for selfdestructed account
+        if let Some(recorder) = vm.db.bal_recorder.as_mut() {
+            recorder.track_selfdestruct(*address);
+        }
     }
 
     Ok(())