bal-devnet-2 working update: fix BAL system address filter and gas_table tracking (#19894)

## Summary

Cherry-pick of BAL fixes from bal-devnet-2 that resolved all BAL hash
mismatches on the devnet. Erigon synced from block 110k to tip (221k+)
with zero BAL errors after these changes.

**Two fixes:**

- **gas_table.go**: Add unconditional `MarkAddressAccess(address,
false)` after all `Empty()`/`Exist()` calls in `statefulGasCall` and
`gasSelfdestruct` (4 sites). Previously only recorded in the narrow
`transfersValue && empty` case, but geth tracks ALL state reads via
`OnAccountRead` hooks.

- **versionedio.go**: Change system address filter from requiring
non-revertable user access (`!opts.revertable`) to including on ANY user
tx access. Rename `nonRevertableUserAccess` → `userAccess`. Geth
includes the system address whenever any user tx reads it, even via
internal `versionRead` (revertable=true).

## Test plan

- [x] All `TestAsBlockAccessList_*` tests pass
- [x] Verified on bal-devnet-2: erigon synced 110k blocks
(110000→221000+) with zero BAL hash mismatches
- [ ] CI passes on main
- [ ] `make lint` clean

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Mark Holt <erigon@dev-bm-e3-ethmainnet-n4.erigon.io>
Co-authored-by: Shoham Chakraborty <shhmchk@gmail.com>

Author: 4 people

execution/stagedsync/bal_create_test.go

@@ -1,6 +1,7 @@
 package stagedsync
 
 import (
+	"fmt"
 	"math/big"
 	"testing"
 
@@ -96,6 +97,10 @@ func TestCreateBALOrdering(t *testing.T) {
 }
 
 func addStorageRead(readSets map[int]state.ReadSet, txIdx int, addr accounts.Address, slot accounts.StorageKey) {
+	addStorageReadVal(readSets, txIdx, addr, slot, *uint256.NewInt(0))
+}
+
+func addStorageReadVal(readSets map[int]state.ReadSet, txIdx int, addr accounts.Address, slot accounts.StorageKey, val uint256.Int) {
 	rs := readSets[txIdx]
 	if rs == nil {
 		rs = state.ReadSet{}
@@ -105,6 +110,7 @@ func addStorageRead(readSets map[int]state.ReadSet, txIdx int, addr accounts.Add
 		Address: addr,
 		Path:    state.StoragePath,
 		Key:     slot,
+		Val:     val,
 	})
 }
 
@@ -117,7 +123,7 @@ func addBalanceRead(readSets map[int]state.ReadSet, txIdx int, addr accounts.Add
 	rs.Set(state.VersionedRead{
 		Address: addr,
 		Path:    state.BalancePath,
-		Val:     value,
+		Val:     *uint256.NewInt(value),
 	})
 }
 
@@ -148,3 +154,225 @@ func recordAll(io *state.VersionedIO, reads map[int]state.ReadSet, writes map[in
 		io.RecordWrites(state.Version{TxIndex: txIdx}, ws)
 	}
 }
+
+// TestBALBlock943Direct constructs the BAL for bal-devnet-2 block 943
+// (first Amsterdam block, 0 user txs) directly and verifies the hash
+// matches the known-good value from the devnet header.
+//
+// Block 943 system calls:
+//   - txIndex=-1: EIP-4788 beacon root (2 storage writes), EIP-2935 block hash (1 storage write)
+//   - txIndex=0 (finalize): EIP-7002 withdrawal request dequeue (4 SLOADs + 4 SSTOREs, all net-zero),
+//     EIP-7251 consolidation request dequeue (4 SLOADs + 4 SSTOREs, all net-zero)
+//
+// The system address (0xff..fe) is filtered out per EIP-7928.
+func TestBALBlock943Direct(t *testing.T) {
+	expectedHash := common.HexToHash("0x0e9aff2d3f1c6d5083afd44ef786e54858d50004845d5ae2f0437dd61b83d00d")
+
+	// System contract addresses (sorted lexicographically)
+	eip7002Addr := accounts.InternAddress(common.HexToAddress("0x00000961Ef480Eb55e80D19ad83579A64c007002")) // EIP-7002 Withdrawal Requests
+	eip7251Addr := accounts.InternAddress(common.HexToAddress("0x0000BBdDc7CE488642fb579F8B00f3a590007251")) // EIP-7251 Consolidation Requests
+	eip2935Addr := accounts.InternAddress(common.HexToAddress("0x0000F90827F1C53a10cb7A02335B175320002935")) // EIP-2935 Block Hash Store
+	eip4788Addr := accounts.InternAddress(common.HexToAddress("0x000F3df6D732807Ef1319fB7B8bB8522d0Beac02")) // EIP-4788 Beacon Roots
+
+	// Storage slots and values for block 943 (from RPC)
+	slot4788Timestamp := accounts.InternKey(common.BigToHash(big.NewInt(0x1747))) // timestamp % 8191
+	slot4788Root := accounts.InternKey(common.BigToHash(big.NewInt(0x3746)))      // (timestamp % 8191) + 8191
+	slot2935 := accounts.InternKey(common.BigToHash(big.NewInt(0x3ae)))           // (blockNum-1) % 8191
+
+	val4788Timestamp := uint256.NewInt(0x69862afc)
+	val4788Root := new(uint256.Int)
+	val4788Root.SetBytes(common.Hex2Bytes("6d29857d40bc9c49248f83435de3c0f4df64b701e77c8550a40b4981802ccc9c"))
+	val2935 := new(uint256.Int)
+	val2935.SetBytes(common.Hex2Bytes("52b76c49b7b2892ef00b543e27480f8e57ca399e8ddf4a2aba127b263988885c"))
+
+	// EIP-7002 and EIP-7251 dequeue contracts read slots 0-3 (excess, count, head, tail)
+	// when queue is empty. All SSTOREs write 0 back to zero-valued slots (net-zero → reads only).
+	slot0 := accounts.InternKey(common.BigToHash(big.NewInt(0)))
+	slot1 := accounts.InternKey(common.BigToHash(big.NewInt(1)))
+	slot2 := accounts.InternKey(common.BigToHash(big.NewInt(2)))
+	slot3 := accounts.InternKey(common.BigToHash(big.NewInt(3)))
+
+	// Construct BAL directly. Addresses must be sorted lexicographically:
+	// 0x00000961... < 0x0000BBdD... < 0x0000F908... < 0x000F3df6...
+	bal := types.BlockAccessList{
+		// EIP-7002: only storage reads (empty queue, all writes are net-zero)
+		{
+			Address:      eip7002Addr,
+			StorageReads: []accounts.StorageKey{slot0, slot1, slot2, slot3},
+		},
+		// EIP-7251: only storage reads (empty queue, all writes are net-zero)
+		{
+			Address:      eip7251Addr,
+			StorageReads: []accounts.StorageKey{slot0, slot1, slot2, slot3},
+		},
+		// EIP-2935: 1 storage change at accessIndex 0 (system call txIndex=-1)
+		{
+			Address: eip2935Addr,
+			StorageChanges: []*types.SlotChanges{
+				{
+					Slot:    slot2935,
+					Changes: []*types.StorageChange{{Index: 0, Value: *val2935}},
+				},
+			},
+		},
+		// EIP-4788: 2 storage changes at accessIndex 0 (system call txIndex=-1)
+		{
+			Address: eip4788Addr,
+			StorageChanges: []*types.SlotChanges{
+				{
+					Slot:    slot4788Timestamp,
+					Changes: []*types.StorageChange{{Index: 0, Value: *val4788Timestamp}},
+				},
+				{
+					Slot:    slot4788Root,
+					Changes: []*types.StorageChange{{Index: 0, Value: *val4788Root}},
+				},
+			},
+		},
+	}
+
+	if err := bal.Validate(); err != nil {
+		t.Fatalf("BAL validation failed: %v", err)
+	}
+
+	got := bal.Hash()
+	t.Logf("BAL hash: %s", got.Hex())
+	t.Logf("BAL debug: %s", bal.DebugString())
+	if got != expectedHash {
+		t.Fatalf("BAL hash mismatch:\n  got:      %s\n  expected: %s", got.Hex(), expectedHash.Hex())
+	}
+}
+
+// TestBALBlock943ViaVersionedIO constructs the BAL through VersionedIO
+// (the same path used during block execution) and verifies the hash.
+func TestBALBlock943ViaVersionedIO(t *testing.T) {
+	expectedHash := common.HexToHash("0x0e9aff2d3f1c6d5083afd44ef786e54858d50004845d5ae2f0437dd61b83d00d")
+
+	// System address, system contracts
+	systemAddr := accounts.InternAddress(common.HexToAddress("0xfffffffffffffffffffffffffffffffffffffffe"))
+	eip7002Addr := accounts.InternAddress(common.HexToAddress("0x00000961Ef480Eb55e80D19ad83579A64c007002"))
+	eip7251Addr := accounts.InternAddress(common.HexToAddress("0x0000BBdDc7CE488642fb579F8B00f3a590007251"))
+	eip2935Addr := accounts.InternAddress(common.HexToAddress("0x0000F90827F1C53a10cb7A02335B175320002935"))
+	eip4788Addr := accounts.InternAddress(common.HexToAddress("0x000F3df6D732807Ef1319fB7B8bB8522d0Beac02"))
+
+	// Storage slots and values
+	slot4788Timestamp := accounts.InternKey(common.BigToHash(big.NewInt(0x1747)))
+	slot4788Root := accounts.InternKey(common.BigToHash(big.NewInt(0x3746)))
+	slot2935 := accounts.InternKey(common.BigToHash(big.NewInt(0x3ae)))
+	slot0 := accounts.InternKey(common.BigToHash(big.NewInt(0)))
+	slot1 := accounts.InternKey(common.BigToHash(big.NewInt(1)))
+	slot2 := accounts.InternKey(common.BigToHash(big.NewInt(2)))
+	slot3 := accounts.InternKey(common.BigToHash(big.NewInt(3)))
+
+	val4788Timestamp := uint256.NewInt(0x69862afc)
+	val4788Root := new(uint256.Int)
+	val4788Root.SetBytes(common.Hex2Bytes("6d29857d40bc9c49248f83435de3c0f4df64b701e77c8550a40b4981802ccc9c"))
+	val2935 := new(uint256.Int)
+	val2935.SetBytes(common.Hex2Bytes("52b76c49b7b2892ef00b543e27480f8e57ca399e8ddf4a2aba127b263988885c"))
+
+	// Block 943 has 0 user txs. Tasks: txIndex=-1 (Initialize), txIndex=0 (Finalize).
+	// NewVersionedIO(numTx) where numTx is the count of user transactions (0).
+	// However, the Finalize task at txIndex=0 needs to be accommodated.
+	vio := state.NewVersionedIO(0)
+
+	readSets := map[int]state.ReadSet{}
+	writeSets := map[int]state.VersionedWrites{}
+
+	// === txIndex=-1: Initialize system calls (EIP-4788, EIP-2935) ===
+
+	// System address balance reads/writes (from SubBalance with Gnosis exception)
+	// Balance is 0x24ac0a — read and write same value (no-op write filtered)
+	systemBalance := uint256.NewInt(0x24ac0a)
+	addBalanceRead(readSets, -1, systemAddr, systemBalance.Uint64())
+	addBalanceWrite(writeSets, -1, systemAddr, systemBalance.Uint64())
+
+	// EIP-4788 contract: balance read+write (no-op), 2 storage writes
+	addBalanceRead(readSets, -1, eip4788Addr, 0)
+	addBalanceWrite(writeSets, -1, eip4788Addr, 0)
+	addStorageWrite(writeSets, -1, eip4788Addr, slot4788Timestamp, val4788Timestamp.Uint64())
+	writeSets[-1] = append(writeSets[-1], &state.VersionedWrite{
+		Address: eip4788Addr,
+		Path:    state.StoragePath,
+		Key:     slot4788Root,
+		Version: state.Version{TxIndex: -1},
+		Val:     *val4788Root,
+	})
+
+	// EIP-2935 contract: balance read+write (no-op), 1 storage write
+	addBalanceRead(readSets, -1, eip2935Addr, 0)
+	addBalanceWrite(writeSets, -1, eip2935Addr, 0)
+	writeSets[-1] = append(writeSets[-1], &state.VersionedWrite{
+		Address: eip2935Addr,
+		Path:    state.StoragePath,
+		Key:     slot2935,
+		Version: state.Version{TxIndex: -1},
+		Val:     *val2935,
+	})
+
+	// === txIndex=0: Finalize system calls (EIP-7002, EIP-7251 dequeue) ===
+	// Empty queue: read slots 0-3, write 0 back to each (net-zero → reads only)
+
+	// EIP-7002: balance read+write (no-op), storage reads + net-zero writes
+	addBalanceRead(readSets, 0, eip7002Addr, 0)
+	addBalanceWrite(writeSets, 0, eip7002Addr, 0)
+	addStorageRead(readSets, 0, eip7002Addr, slot0)
+	addStorageRead(readSets, 0, eip7002Addr, slot1)
+	addStorageRead(readSets, 0, eip7002Addr, slot2)
+	addStorageRead(readSets, 0, eip7002Addr, slot3)
+	addStorageWrite(writeSets, 0, eip7002Addr, slot0, 0) // net-zero: write 0 to 0-valued slot
+	addStorageWrite(writeSets, 0, eip7002Addr, slot1, 0)
+	addStorageWrite(writeSets, 0, eip7002Addr, slot2, 0)
+	addStorageWrite(writeSets, 0, eip7002Addr, slot3, 0)
+
+	// EIP-7251: balance read+write (no-op), storage reads + net-zero writes
+	addBalanceRead(readSets, 0, eip7251Addr, 0)
+	addBalanceWrite(writeSets, 0, eip7251Addr, 0)
+	addStorageRead(readSets, 0, eip7251Addr, slot0)
+	addStorageRead(readSets, 0, eip7251Addr, slot1)
+	addStorageRead(readSets, 0, eip7251Addr, slot2)
+	addStorageRead(readSets, 0, eip7251Addr, slot3)
+	addStorageWrite(writeSets, 0, eip7251Addr, slot0, 0)
+	addStorageWrite(writeSets, 0, eip7251Addr, slot1, 0)
+	addStorageWrite(writeSets, 0, eip7251Addr, slot2, 0)
+	addStorageWrite(writeSets, 0, eip7251Addr, slot3, 0)
+
+	// System address balance from Finalize Transfer calls (no-op)
+	addBalanceRead(readSets, 0, systemAddr, systemBalance.Uint64())
+	addBalanceWrite(writeSets, 0, systemAddr, systemBalance.Uint64())
+
+	recordAll(vio, readSets, writeSets)
+
+	bal := vio.AsBlockAccessList()
+
+	t.Logf("BAL accounts: %d", len(bal))
+	for i, ac := range bal {
+		t.Logf("  [%d] %s: storage_changes=%d storage_reads=%d balance_changes=%d nonce_changes=%d code_changes=%d",
+			i, ac.Address.Value().Hex(),
+			len(ac.StorageChanges), len(ac.StorageReads),
+			len(ac.BalanceChanges), len(ac.NonceChanges), len(ac.CodeChanges))
+		for _, sc := range ac.StorageChanges {
+			for _, ch := range sc.Changes {
+				t.Logf("    slot %s [%d] -> %s", sc.Slot.Value().Hex(), ch.Index, ch.Value.Hex())
+			}
+		}
+		for _, sr := range ac.StorageReads {
+			t.Logf("    read slot %s", sr.Value().Hex())
+		}
+	}
+
+	got := bal.Hash()
+	t.Logf("BAL hash: %s", got.Hex())
+	if got != expectedHash {
+		t.Logf("BAL debug: %s", bal.DebugString())
+		t.Fatalf("BAL hash mismatch:\n  got:      %s\n  expected: %s", got.Hex(), expectedHash.Hex())
+	}
+
+	// Verify system address was filtered out
+	for _, ac := range bal {
+		if ac.Address == systemAddr {
+			t.Fatal("system address should have been filtered from BAL")
+		}
+	}
+
+	_ = fmt.Sprintf // suppress unused import
+}

execution/state/versionedio.go

@@ -1085,14 +1085,8 @@ func (io *VersionedIO) AsBlockAccessList() types.BlockAccessList {
 			}
 
 			account := ensureAccountState(ac, addr)
-			// A non-revertable access means the address was the target of
-			// an actual EVM operation (evm.Call, evm.Create, SELFDESTRUCT
-			// with non-zero balance, BALANCE, EXTCODESIZE, etc.) — not just
-			// a gas-calculation read. This is used to distinguish real state
-			// access from incidental reads (e.g. Empty() in gas calc) for
-			// the system address filter.
-			if isUserTx && opts != nil && !opts.revertable {
-				account.nonRevertableUserAccess = true
+			if isUserTx && opts != nil {
+				account.userAccess = true
 			}
 		}
 	}
@@ -1102,14 +1096,9 @@ func (io *VersionedIO) AsBlockAccessList() types.BlockAccessList {
 		account.finalize()
 		account.changes.Normalize()
 		// The system address (0xff...fe) is touched during every block's system
-		// call (EIP-4788 beacon root) because it is msg.sender. Per EIP-7928,
-		// "SYSTEM_ADDRESS MUST NOT be included unless it experiences state access
-		// itself." We use the non-revertable access flag from MarkAddressAccess
-		// to distinguish real state access (evm.Call target, SELFDESTRUCT
-		// beneficiary, BALANCE opcode, etc.) from incidental gas-calculation
-		// reads (Empty() in statefulGasCall). Keep it when it has actual state
-		// changes or when a user tx performed a non-revertable access to it.
-		if account.changes.Address == params.SystemAddress && !hasAccountChanges(account.changes) && !account.nonRevertableUserAccess {
+		// call (EIP-4788 beacon root) because it is msg.sender. Filter it out
+		// unless it has actual state changes or a user tx accessed it.
+		if account.changes.Address == params.SystemAddress && !hasAccountChanges(account.changes) && !account.userAccess {
 			continue
 		}
 		bal = append(bal, account.changes)
@@ -1122,22 +1111,30 @@ func (io *VersionedIO) AsBlockAccessList() types.BlockAccessList {
 	return bal
 }
 
+// hasAccountChanges returns true if the account has any state changes
+// (storage, balance, nonce, or code) that belong in the BAL.
+func hasAccountChanges(ac *types.AccountChanges) bool {
+	return len(ac.StorageChanges) > 0 || len(ac.StorageReads) > 0 ||
+		len(ac.BalanceChanges) > 0 || len(ac.NonceChanges) > 0 ||
+		len(ac.CodeChanges) > 0
+}
+
 type accountState struct {
-	changes                 *types.AccountChanges
-	balance                 *fieldTracker[uint256.Int]
-	nonce                   *fieldTracker[uint64]
-	code                    *fieldTracker[[]byte]
-	balanceValue            *uint256.Int                        // tracks latest seen balance
-	initialBalanceValue     *uint256.Int                        // tracks pre-block balance for net-zero detection
-	selfDestructed          bool                                //
-	selfDestructedAt        uint16                              // access index of the selfdestruct
-	storageReadValues       map[accounts.StorageKey]uint256.Int // original read values for net-zero detection
-	nonRevertableUserAccess bool                                // true if a user tx (txIndex >= 0) has non-revertable access
+	changes             *types.AccountChanges
+	balance             *fieldTracker[uint256.Int]
+	nonce               *fieldTracker[uint64]
+	code                *fieldTracker[[]byte]
+	balanceValue        *uint256.Int // tracks latest seen balance
+	initialBalanceValue *uint256.Int // tracks pre-block balance for net-zero detection
+	selfDestructed      bool
+	selfDestructedAt    uint16                              // access index of the selfdestruct
+	storageReadValues   map[accounts.StorageKey]uint256.Int // original read values for net-zero detection
+	userAccess          bool                                // true if a user tx (txIndex >= 0) accessed this account
 }
 
 // check pre- and post-values, add to BAL if different
 func (a *accountState) finalize() {
-	applyToBalance(a.balance, a.changes)
+	applyToBalance(a.balance, a.changes, a.initialBalanceValue)
 	applyToNonce(a.nonce, a.changes)
 	applyToCode(a.code, a.changes)
 }
@@ -1154,8 +1151,20 @@ func newBalanceTracker() *fieldTracker[uint256.Int] {
 	return &fieldTracker[uint256.Int]{}
 }
 
-func applyToBalance(bt *fieldTracker[uint256.Int], ac *types.AccountChanges) {
+func applyToBalance(bt *fieldTracker[uint256.Int], ac *types.AccountChanges, initialBalance *uint256.Int) {
+	// Get the sorted indices to identify the first (lowest-index) entry.
+	// If the first entry equals the pre-block balance, it's a net-zero
+	// change from a reverted tx (e.g. CALL with value then revert) and
+	// must be excluded. Geth's scope-based BAL builder handles this via
+	// ExitScope which converts reverted writes to reads.
+	firstFiltered := false
 	bt.changes.apply(func(idx uint16, value uint256.Int) {
+		if !firstFiltered {
+			firstFiltered = true
+			if initialBalance != nil && value.Eq(initialBalance) {
+				return
+			}
+		}
 		ac.BalanceChanges = append(ac.BalanceChanges, &types.BalanceChange{
 			Index: idx,
 			Value: value,
@@ -1403,11 +1412,6 @@ func removeStorageRead(ac *types.AccountChanges, slot accounts.StorageKey) {
 	}
 }
 
-func hasAccountChanges(ac *types.AccountChanges) bool {
-	return len(ac.BalanceChanges) > 0 || len(ac.NonceChanges) > 0 ||
-		len(ac.CodeChanges) > 0 || len(ac.StorageChanges) > 0
-}
-
 type versionedReadSet struct {
 	incarnation int
 	readSet     ReadSet