# Gas estimate omits real cost

Does the gas or fee formula cover every byte, frame, and post-snapshot operation actually consumed?

_Area: DeFi accounting and math bugs. Seen in 15 disclosed reports; latest 2025-06-13. Updated 2026-10-23._

## How it works
A contract or handler charges or reimburses gas using a formula that measures only part of the real cost. The assumption that breaks is "my measured gas equals the gas actually spent." Real cost includes things the formula skips: calldata bytes of the encoded call, wrapper/executor frames, sibling operations like token swaps, L1 rollup data fees, or gas consumed after a snapshot. The gap is paid by the protocol, keeper, or block-utilization accounting, not the user.

## Where it shows up
- A constant reserve (e.g. 185k) plus `gasleft()` checkpoints used to price an external call [E1](https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-04.md).
- Fee = `gasUsed * multiplier + buffer` times `block.basefee` on an L2 deployment [E2](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AH-6.md).
- `baseGas()` computed over the inner `_message` rather than the encoded wrapper actually sent [E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AM-2.md).
- Sibling estimators where one branch (deposit) counts swaps and the other (withdrawal) does not [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-3.md).
- Calldata gas charged at 16/byte for all bytes, ignoring the 4-gas zero byte [E5](https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-4.md).
- Gas snapshot taken before burn/refund/bank transfers, or before fee checks [E6](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AM-01.md)[E7](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AM-02.md).

## How to review
The invariant: the gas/fee charged or refunded must equal the gas actually consumed by the full emitted transaction. Check that the byte length in the cost formula matches the real calldata (selector + ABI-padded args + wrapper) [E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AM-2.md); that the executor frame, modifiers, and calldata fees are inside the estimate [E1](https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-04.md); that L2 formulas include the L1 data fee [E2](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AH-6.md); that every branch adding swaps/hooks/callbacks updates its estimator [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-3.md); that zero bytes are priced at 4 [E5](https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-4.md); and that snapshots are taken immediately before the state mutation they measure, with `GasConsumed()` deltas instrumented [E6](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AM-01.md)[E7](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AM-02.md). Diff sibling functions for asymmetric cost components.

## Variants seen
- Underpriced fallback/execution budget draining a shared reserve [E1](https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-04.md).
- Keeper incentive omitting L1 rollup fee, so keepers lose money [E2](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AH-6.md).
- Undercounted calldata bytes in cross-chain gas [E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AM-2.md).
- Missing swap gas in withdrawal estimator [E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-3.md).
- Overestimation from wrong zero-byte price bricking messages [E5](https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-4.md).
- Post-snapshot gas refunded as tip [E6](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AM-01.md).
- Early snapshot undercounting block utilization and base fee [E7](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AM-02.md).

## Impact and severity
Underpayment drains protocol budgets and stops keepers submitting prices/orders [E1](https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-04.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AH-6.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-3.md); mispriced demand and L1/L2 discrepancy [E3](https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AM-2.md); overestimation can make withdrawals unrelayable and lose funds [E5](https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-4.md); inflated refunds and wrong base fees [E6](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AM-01.md)[E7](https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AM-02.md). Severity rises when the gap is systematic and compounds per transaction.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-04.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AH-6.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-03-optimism%3AM-2.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-3.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-4.md
- E6: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AM-01.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-chain%3AM-02.md