SSTORE Refund

The Ethereum Virtual Machine (EVM) provides a gas refund when a smart contract sets a storage slot's value from a non-zero value to zero. This refund is applied at the end of transaction execution, offsetting the total gas cost. The refund is capped at a maximum of gasUsed / 5 or 4800 gas per cleared slot, whichever is lower. This mechanism incentivizes developers to clean up unused state to reduce the blockchain's overall storage burden.

Refunds are leveraged in several key patterns:

• Token Burning & Transfers: Burning tokens or transferring an entire balance to zero an account's storage slot.
• Proxy Upgrades: Clearing old implementation addresses in upgradeable proxy patterns.
• Temporary State: Resetting flags, counters, or locks after an operation completes.
• Contract Self-Destruction: The SELFDESTRUCT opcode triggers a 24,000 gas refund for clearing the entire contract's storage, though its behavior is changing post-EIP-6780.

A critical constraint is the refund cap: the total refund cannot exceed 50% of the total gas used in the transaction (gasUsed / 2). This prevents refunds from making transaction execution free or profitable. Furthermore, refunds are only applied after all execution is complete. Therefore, a gas-intensive operation after clearing storage does not increase the refundable amount, making the order of operations within a transaction crucial for optimization.

Implemented in the London Hard Fork, EIP-3529 significantly reduced SSTORE refunds to mitigate certain gas token and spam attack vectors. Key changes:

• Reduced maximum refund for clearing a storage slot from 15,000 gas to 4,800 gas.
• Removed the refund for the SELFDESTRUCT opcode (effective post-EIP-6780).
• Lowered the overall refund cap from gasUsed / 2 to gasUsed / 5. This made reliance on large refunds for gas savings less viable and altered optimal contract patterns.

A classic optimization is clearing a dynamic array by iterating and setting elements to zero, then resetting the array length. For example:

solidityCopy
for (uint i; i < array.length; i++) {
    delete array[i]; // SSTORE to zero, triggers refund
}
delete array; // Clears the length slot

The gas cost of the loop is partially offset by the refunds from each delete. Developers must calculate if the net gas after the 50% cap (post-EIP-3529: 20% cap) is lower than alternative patterns like tracking a separate index.

• Gas Tokens: Projects like GST1/GST2 (GasToken) exploited pre-EIP-3529 refunds by minting storage when gas was cheap and clearing it when gas was expensive, effectively "banking" gas.
• Net Gas Cost: The final transaction cost calculated as gasUsed - min(refund, gasUsed/5).
• State Rent: Refunds were initially introduced as a soft incentive for state clearance, contrasting with proposed (but not implemented) explicit state rent models.
• EIP-2200: Earlier update that refined net gas metering for SSTORE, defining the exact gas costs for different storage transitions.

The SSTORE opcode is used to write data to contract storage. When a non-zero storage slot is set to zero (e.g., sstore(slot, 0)), the EVM grants a gas refund of 4,800 gas. This refund is applied at the end of the transaction, reducing the total gas cost. The refund exists to encourage developers to free up storage, which helps reduce the size of the Ethereum state.

• Refund Cap: The total refund per transaction is capped at a maximum of 20% of the gas used.
• Historical Context: This was part of the original "Yellow Paper" gas schedule (EIP-150).

Projects like GST2 and CHI tokenized this refund mechanism. Users would mint tokens by writing data to a contract's storage (consuming gas), receiving tokens in return. Later, they could burn the tokens, which triggered an SSTORE operation to clear that data, generating a large gas refund.

• Arbitrage: Users would mint tokens when gas prices were low and burn them to refund gas when prices were high, effectively "locking in" cheap gas costs.
• Impact: This created perverse incentives, bloating the Ethereum state with temporary data solely for financial arbitrage, leading to its removal in the London upgrade.

Implemented in the London Hard Fork (August 2021), EIP-3529 significantly reduced the SSTORE refund to mitigate state bloat and eliminate the gas token business model.

• Key Changes:
  • Refund for clearing storage was reduced from 15,000 gas to 4,800 gas.
  • The SELFDESTRUCT refund was removed entirely.
  • The maximum refund cap was reduced from 50% to 20% of gas used.
• Result: This made gas token arbitrage economically non-viable and reduced the incentive for complex refund-maximizing transactions.

The deferred nature of the gas refund can be exploited in combination with reentrancy. An attacker can design a call chain where:

1. An initial call uses gas to set storage slots.
2. A reentrant call triggers the clearing of those slots, queueing up a large refund.
3. Execution returns to the original function, which may perform further expensive operations.

Because the refund is applied at the transaction's end, it can make the net gas cost of the entire attack path artificially low, allowing more complex operations to fit within a block's gas limit than otherwise possible. This can bypass gas-based security checks.

While EIP-3529 neutered the most famous exploits, understanding SSTORE refunds remains crucial.

• Auditing: Legacy code may still contain patterns optimized for the old refund schedule.
• Layer 2 Scaling: Optimistic Rollups (like Optimism, Arbitrum) and some zkEVMs implement their own gas metering and state models. While they generally follow Ethereum's lead, auditors must verify how storage operations and potential refunds are handled on each L2 to prevent novel economic attacks.
• State Management: The core principle—incentivizing cleanup—informs state management design in other blockchain systems.

Smart contract auditors must scrutinize code for refund-related vulnerabilities:

• Gas Left Checks: Functions that check gasleft() to authorize actions can be bypassed if an attacker manipulates pending refunds to make gas appear sufficient.
• Complex Call Chains: Analyze any pattern where storage is written and then later cleared within the same transaction, especially if external calls are involved.
• Assumptions on Gas Cost: Never assume the gas cost of an operation is static; it can be effectively reduced by refunds from other parts of the transaction.
• Legacy Code: Review pre-London upgrade contracts for gas token integration or refund-maximizing logic that may now behave unexpectedly.

The Ethereum gas refund is a mechanism that returns a portion of the gas cost when a transaction performs specific state-clearing operations. The primary sources are:

• SSTORE: Refunding gas for setting a storage slot from a non-zero value back to zero.
• SELFDESTRUCT: Refunding gas for deleting a contract.

Refunds are not paid directly; they reduce the total gas consumed by the transaction at the end of execution, lowering the final cost. The total refund is capped at 50% of the gas used.

SLOAD is the EVM opcode that reads a word from contract storage. It is a key counterpart to SSTORE.

• Cost: Base cost is 2100 gas for a cold storage read (first access), reduced to 100 gas for a warm access (subsequent read within same transaction).
• Interaction with SSTORE: The gas cost of an SSTORE operation depends on whether the slot being written is currently cold or warm, which is determined by prior SLOAD or SSTORE accesses.

Understanding the cold/warm access model is essential for optimizing gas costs for storage-heavy contracts.

EIP-3529, implemented in the London hard fork, significantly reduced gas refunds to mitigate certain network attacks and state bloat.

Key changes:

• Maximum Refund: Reduced from 50% to 20% of the transaction's gas used.
• SSTORE Refund Amount: Lowered from 15,000 gas to 4,800 gas for clearing a storage slot.
• SELFDESTRUCT Refund: Removed entirely.

This change made previously profitable "gas token" contracts (like CHI and GST2) economically non-viable and altered contract design patterns that relied on high refunds.

Net gas metering refers to how the EVM calculates the final gas cost of a transaction by subtracting refunds from the total gas used.

Process:

1. The EVM tracks all gas consumed during execution.
2. It tallies eligible refunds for operations like SSTORE to zero.
3. At the end of execution, refunds are applied, but the final refund cannot exceed 20% (post-EIP-3529) of the gas used.

Critical Implication: A transaction must have sufficient gas used to claim its full refunds. If a transaction's execution uses very little gas, the refund cap may prevent full recovery, making some operations unexpectedly costly.

The concept of state rent (or storage rent) was a proposed long-term solution to Ethereum's growing state size, which is exacerbated by cheap storage writes and refunds. While not implemented, it informed later designs.

Related Evolution:

• Verkle Trees & Stateless Clients: Current research focuses on stateless clients, which do not need to store the full state. This relies on cryptographic proofs (like Verkle proofs) for state access.
• Impact on Storage: These future upgrades aim to reduce the node resource burden of permanent storage, indirectly affecting the economic model around SSTORE operations and long-term data persistence.

Gas tokens were smart contracts that exploited the pre-EIP-3529 SSTORE refund mechanism to create "banked" gas. Users could mint tokens when gas prices were low (by performing storage writes) and burn them later when gas prices were high (by clearing storage) to get a large refund, offsetting transaction costs.

Mechanism:

1. Mint: Create contract storage (SSTORE non-zero), consuming gas.
2. Burn: Later, clear that storage (SSTORE zero), triggering a 15,000 gas refund.

Post-EIP-3529: With the refund reduced to 4,800 gas, the economic arbitrage was largely eliminated, rendering most gas token contracts obsolete.