Incorrect gas estimate for BALANCE opcode

Severity

Low Risk

Relevant GitHub Links

https://github.com/vyperlang/vyper/blob/b01cd686aa567b32498fefd76bd96b0597c6f099/vyper/evm/opcodes.py#L55

Summary

When gas costs are estimated, BALANCE is presumed to cost 700 gas. However, the correct gas cost for BALANCE is 2600.

Vulnerability Details

When gas costs are estimated, we use a cost of 700 for any calls to BALANCE:

"BALANCE": (0x31, 1, 1, 700),

However, since EIP 2929 the cost of a BALANCE read has increased to 2600.

Looking at the opcode gas costs, we can see that BALANCE is defined as follows:

gas_cost = 100 if target_addr in touched_addresses (warm access)
gas_cost = 2600 if target_addr not in touched_addresses (cold access)

Since Vyper defaults to taking the higher cost in situations that have discounts for warm addresses or storage slots (see: SSTORE, EXTCODESIZE), the gas cost for this operation should default to 2600.

Impact

Gas prices will be underestimated because of an incorrectly priced BALANCE opcode.

Tools Used

Manual Review, EVM.codes

Recommendations

Adjust BALANCE to reflect EIP 2929, as you have already done for EXTCODESIZE and EXTCODEHASH:

- "BALANCE": (0x31, 1, 1, 700),
+ "BALANCE": (0x31, 1, 1, (700, 2600)),