EIP-150: when gas became a security parameter
In 2016 an attacker discovered that Ethereum's most expensive operations — reading storage, loading accounts — were priced far below what they actually cost a node. A few cheap transactions could grind every node on Earth to a crawl. EIP-150 repriced them, and in doing so turned gas from a nominal fee into a line of defense.
- the EVM & gas
- storage & state access
The EVM chapter sold gas as the thing that makes computation paid-for and bounded. That framing has a hidden assumption: that each opcode’s price actually reflects the work it causes a node to do. In October 2016, at the Tangerine Whistle fork, Ethereum learned the hard way what happens when that assumption is false. Some operations — the ones that reach into state and disk — were priced at a small fraction of their real cost, and an attacker turned that gap into a weapon that nearly stopped the chain. EIP-150 is the fix, and it’s where the community internalized that gas isn’t a fee schedule — it’s a security parameter. Let’s derive it.
The problem: the price tag didn’t match the work
Most EVM opcodes are pure computation — add, compare, hash — and their cost is honest. But the opcodes that touch state are different: SLOAD chases a key through the state trie and off disk; CALL, BALANCE, EXTCODESIZE, and EXTCODECOPY each load another account’s data. Those are the slowest things a node does — and in 2015’s gas schedule they were nearly free: SLOAD cost 50 gas, account-touching opcodes 20–40. The price tag sat far below the real burden.
That gap is a resource-exhaustion attack Crafting cheap transactions that trigger disproportionately expensive work on every validating node — here, spamming underpriced state-access opcodes so block processing slows to a crawl, threatening liveness. . In September–October 2016 the Shanghai DoS attacks A series of 2016 denial-of-service attacks that spammed underpriced IO-heavy opcodes (EXTCODESIZE, then SUICIDE/SLOAD variants), pushing some blocks to tens of seconds of processing time and threatening to stall Ethereum. did exactly this: transactions that hammered these opcodes pushed block processing to tens of seconds, and the network came close to grinding to a halt.
→ Step 2: raise the prices to match the cost.
Gas is a security parameter — so align it to real cost
The fix isn’t clever, it’s corrective: raise the gas cost of the IO-heavy opcodes until it reflects what they actually make a node do. EIP-150 pushed SLOAD from 50 to 200, BALANCE and EXTCODESIZE and the account-loading opcodes up to 400–700, CALL to 700, and so on. Once the price matches the burden, the very attack that stalled the chain now costs the attacker real gas — and is simply priced out of a block.
The lasting lesson is bigger than the numbers. gas as a security parameter The principle, cemented by EIP-150, that opcode gas costs must track the real CPU, disk, and state-growth burden each operation imposes on nodes — because any operation priced below its true cost is a potential denial-of-service vector, not just a bargain. means the gas schedule is part of Ethereum’s threat model, not just its fee model. Every later repricing — and there have been many — traces back to this realization.
→ Step 3: never forward the last drop of gas.
The 63/64 rule: always keep a sliver back
EIP-150 shipped a second, subtler change alongside the repricing. When a contract calls another, it may forward at most 63/64 of its remaining gas — it always keeps at least 1/64 for itself. So no matter how deeply calls nest or how greedily a callee burns what it’s handed, the caller is guaranteed to survive the sub-call with a little gas left: enough to notice the failure, clean up, and return an error instead of dying outright.