Counter-proposal to oil/karma: per-account gas limits

OK this is a fair point. Basically, the problem is that we are trying to protect against misreporting on both sides. The meta tx signer specifies an amount of gas G that they claim is sufficient to execute their tx. The signer needs an assurance that the tx actually will be executed with G gas, and not less. Meanwhile the relayer needs an assurance that they will actually be spending G gas on the meta tx and not more.

So the two sides need to negotiate and agree on G, and for that agreement to be enforceable. The current way to enforce G is to have the meta tx signer only approve payment to a specific contract that puts G gas on the sub-call. But all of these proposals make G flexible at origin level and unreadable at contract level, and so they break this approach. One approach would be to make it possible to read the total gas in the transaction, and have the contract call verify (i) that the total gas is G + buffer and (ii) that the origin called the contract directly and nothing else in between (this would require new opcodes). But this seems complicated, and also dumb developers could write applications that freeze in place specific total-gas checks that would lead to future hard forks breaking the applications.

So this leads to a philosophical question: why not just implement none of these proposals, keep tweaking gas costs as needed for sustainability as we’ve done before, and just publicly state the social norm that you should never hardcode gas limits into a contract, and all inputs to CALL that are not just “send all gas” should have gas values provided by the transaction?

1 Like