EIP-7906: Transaction Assertions via State Diff Opcode

⌬LLM Three instructions are added, and at least two are complex because their gas is dynamic. This is level 3.

⚇Human Three new opcodes, at least one complex: `TXTRACE` (22 params), `TXDIFF` (11 params, dynamic warm/cold gas), `EVENTDATACOPY` (4 stack inputs, memory expansion, `CALLDATACOPY` semantics).

⌬LLM Existing instructions (APPROVE, FRAMEPARAM, ORIGIN) apply their existing rules in the new frame context. FRAMEPARAM can return mode 3, but that is a new value, not a new selector. No instruction's specified semantics change.

⚇Human No rationale recorded.

⌬LLM None added.

⚇Human No rationale recorded.

⌬LLM None modified.

⚇Human No rationale recorded.

⌬LLM No protocol-designated contract is introduced.

⚇Human No rationale recorded.

⌬LLM No existing system contract is affected.

⚇Human No rationale recorded.

⌬LLM TXDIFF is a new state-accessing operation that needs its own ordering and BAL-recording rule (cold/warm, live-state fallback versus diff-only answers, out-of-gas before access). No existing opcode class changes, so this is level 2.

⚇Human New state-accessing operations whose position must be settled per param. `TXDIFF` 0x00–0x05 read live state and record in the EIP-7928 BAL; 0x06–0x0A answer from the diff and touch neither. Each of the 11 params needs its access-list and BAL behaviour verified.

⌬LLM No blob-gas charging, pricing or limit rule changes. The blob fee is only exposed for reading.

⚇Human No rationale recorded.

⌬LLM Returning unused gas from skipped frames reuses the existing EIP-8141 settlement. No new protocol refund mechanism is introduced.

⚇Human No rationale recorded.

⌬LLM No new EIP-2718 type.

⚇Human No rationale recorded.

⌬LLM New static validity rules need dedicated cases, but they fit EIP-8141's existing static-constraint sequencing. This is level 2.

⚇Human Amends EIP-8141's structural rules: `assert frame.mode < 3` becomes `< 4`, and `POST_TX` frames must form a contiguous trailing suffix or the transaction is invalid. Coordinated with EIP-8141 but no existing vectors to redesign.

⌬LLM None.

⚇Human No rationale recorded.

⌬LLM Only new values within unchanged schemas.

⚇Human No rationale recorded.

⌬LLM No block decoding or structural rule changes.

⚇Human No rationale recorded.

⌬LLM Only rule selection at activation.

⚇Human No rationale recorded.

⌬LLM No Engine API field or endpoint changes.

⚇Human No rationale recorded.

⌬LLM No new transition-tool field or mechanism is needed. Frame mode values and receipts use existing EIP-8141 schemas.

⚇Human No rationale recorded.

⌬LLM Baseline tests gain no new output to assert.

⚇Human No rationale recorded.

⌬LLM The target's suite needs a new expectation abstraction: a model computing the expected net diff and its sorted indices, event and topic views, and receipt transformations after a POST_TX failure. The frame builder also needs a local extension for the new mode. Other families are unaffected, so this is level 2.

⚇Human New primitives needed to build `POST_TX` frames and to express an expected transaction diff and event enumeration. The BAL expectation types are the closest existing analogue but do not cover balances, codehashes or event ordering.

⌬LLM The change alters EIP-8141's rollback and commit boundaries: which frames revert, payer charging, receipts, logs and state gas. Targeted adversarial integration cases are needed, for example payment approval placed after SENDER frames, atomic batches before POST_TX, and griefing through gas exhaustion. The interaction is bounded to frame execution, so this is level 2.

⚇Human Introspection is inert: `POST_TX` is a `STATICCALL` that cannot modify state. But `TXDIFF` can still add arbitrary storage keys to the BAL reads, and we need to prove that this does not affect present usecases or future EIPs (the witness generation is affected by this).

⌬LLM Targeted integrated benchmarks are needed for a bounded interaction. The worst case is a full-gas execution body that maximizes touched slots and logs, followed by POST_TX frames using TXTRACE/TXDIFF topic and address views, and possibly a whole-body revert. These check that index construction and flat 100-gas pricing hold. This is level 2.

⚇Human `TXDIFF` 0x00–0x05 take an arbitrary address, so this is the first mechanism by which execution can read another account's storage slot. Those reads enter the BAL, so an assertion can populate the BAL with `(address, slot)` pairs the owning contract never touched, which breaks the assumption that a BAL entry implies interaction by that contract.

⌬LLM There are many independent boundary-sensitive rules: index bounds, topic counts, reserved operands, copy bounds, suffix rules, cold/warm, and net-change inclusion. Two are elevated matrices. First, POST_TX failure × frame position × atomic-batch state × number of POST_TX frames × validation-prefix boundary, which changes receipts and committed state. Second, diff-entry inclusion × create/selfdestruct/delegation × write-then-restore. This is level 3.

⚇Human Elevated case counts. `TXTRACE` has 22 params and `TXDIFF` 11, each with index bounds; every *must be 0* operand halts on non-zero; `event_topic0`–`3` halt past `event_topic_count`; `EVENTDATACOPY` halts on both out-of-range index and `dataOffset + length`. Plus net-zero collapsing (modified-then-restored sets no entry and no flag bit), canonical uint160/uint256 sort order, `CREATE` leaving empty code, and EIP-7702 designators excluded from `contracts_deployed`.

⌬LLM No cryptographic verification, signing or hashing rule changes.

⚇Human No rationale recorded.

⌬LLM The target couples EIP-8141 frame execution with EIP-2929 access pricing, EIP-7928 BAL recording, EIP-7708 log semantics, EIP-6780 deletion timing and EIP-7702 designators. Coordinated scenarios across these interactions are needed, so this is level 3.

⚇Human Strong interdependencies. **EIP-8141** is a hard dependency that this EIP *amends* — nothing here is testable without it, and EIP-8141 is itself Draft and assessed 🔴 38. **EIP-2929** (pricing, and `TXDIFF` mutates the access list), **EIP-7928** (BAL recording for live-state reads), **EIP-7702** (designators excluded from `contracts_deployed`), **EIP-4844** (blob fees folded into `gas_pre_charge`). <br><br>The "valid only inside a `POST_TX` frame" restriction then pulls in every transaction type as a negative case: the three opcodes must be shown to halt in legacy, **EIP-2930**, **EIP-1559**, **EIP-4844** and **EIP-7702** transactions, and in the `DEFAULT`, `VERIFY` and `SENDER` frame modes — roughly 3 x 8 coordinated cases, each owned by a different EIP's transaction format. With **EIP-2718** framing those types, 8 interacting EIPs gives +1 for 5 beyond the first 3.

⌬LLM Several localized observable outcomes have competing interpretations: the gas_pre_charge value, codehash for nonexistent accounts, warming side effects, and refund-counter and access-set handling on body revert. Clients must agree on these before expected results can be fixed, so this is level 2.

⚇Human Previously unobservable behaviour becomes consensus-critical and has to be settled by discussion before vectors can be baselined: what counts as a change, how net-zero writes collapse, and the canonical enumeration order. Localized to the diff model.