perf(low): transient-storage reentrancy lock, double packed-slot write in capture, redundant configHash SLOAD

[pviti]

Severity: Low (gas). From the 2026-07-29 cross-repo audit.

Three small items in the fund-moving paths:

• contracts/src/RAIL0.sol:78 — _reentrancyStatus is regular storage; with solc 0.8.27 + via-ir and all target chains post-Cancun, EIP-1153 transient storage (tstore/tload) saves ~2k gas on each of the six guarded entrypoints.
• :392-393 — capture writes the same packed slot twice (capturableAmount, then refundableAmount); writing the whole PaymentState once (as authorize/charge do) removes reliance on the IR optimizer coalescing the writes.
• :480 — refund re-reads _configHash[paymentId] although _loadAndVerify (:593) just loaded and verified it; returning the hash from _loadAndVerify drops the extra SLOAD.

Bundle with the next version bump — not worth a deployment on their own.

[pviti]

#55 implements items 1 and 3. Leaving this open for item 2, which was measured and turns out to cost gas rather than save it.

Item 2 — collapse capture's two packed-field writes into one struct write

Measured on capture: 179,044 with the struct write vs 176,692 with the two field writes — a +2,352 gas regression, on top of the −1,655 the other items deliver.

The reason: the IR optimizer is already coalescing the two field writes into a single SSTORE. Writing the struct instead forces the whole 256-bit word to be assembled from four values (exists, both balances, disputed) with the masking and shifting that implies, where the field writes update in place.

So the issue's premise was right about the mechanism — the struct write does remove reliance on the optimizer — and wrong about the price. Buying that guarantee costs more than the guarantee is worth, unless the optimizer's behaviour ever changes.

Suggested resolution: close item 2 as won't-do, and instead keep a test guarding what the optimizer is doing for us. test_Capture_PreservesAnOpenDispute (added in #55) covers the correctness half — that neither neighbour field in the packed slot is disturbed by a capture — which is what would actually break if the coalescing were ever wrong.

Items 1 and 3, for the record: −1,655 to −1,964 gas on all six guarded entrypoints, with the transient-storage chain requirement shown to be pre-existing (the deployed bytecode already contains MCOPY).

[pviti]

Closing. Two of the three items are implemented in #55; the third is won't-do, measured.

Items 1 and 3 — done, in #55 (targets v2.0.0, not yet merged)

The reentrancy lock moved to EIP-1153 transient storage, and _loadAndVerify now returns the configHash it already loads so refund stops re-reading it. Result on every guarded entrypoint:

entrypoint	before	after	Δ
authorize	151,870	149,884	−1,986
charge	153,077	151,091	−1,986
capture	178,347	176,336	−2,011
void	137,247	135,277	−1,970
release	135,647	133,633	−2,014
refund	204,193	202,051	−2,142

The ~2k estimate in this issue was right. Note the implementation ended up better than what was proposed here: rather than inline assembly around tload/tstore, #55 uses a transient state variable (Solidity 0.8.28+), which measured 89–356 gas cheaper than the assembly and leaves zero assembly blocks in the contract. uint256 transient rather than bool transient, also measured — the bool costs 140–557 gas more for its 0/1 normalisation.

Chain safety turned out to be a non-issue: the deployed bytecode already contains MCOPY, a Cancun opcode, so all six live deployments are on Cancun chains today. evm_version is now pinned to "cancun" rather than inherited from forge's default.

Item 2 — won't-do

Collapsing capture's two packed-field writes into one struct write measures +2,352 gas (179,044 vs 176,692). The IR optimizer is already coalescing the two field writes; writing the struct forces the whole 256-bit word to be assembled from four values instead of updating in place.

This issue's premise — that it "removes reliance on the IR optimizer coalescing the writes" — was right about the mechanism and wrong about the price. Buying that guarantee costs more than the guarantee is worth.

What survives from evaluating it: test_Capture_PreservesAnOpenDispute, which pins that a successful capture does not disturb exists or disputed in the shared slot. Nothing covered that before — the existing test_Capture_IsNotBlockedByAnOpenDispute charges first, so its capture reverts and a dropped flag would go unnoticed.

One thing to know

#55 is not merged — it targets v2.0.0, and it carries the solc 0.8.31 / evm_version = cancun bump, which changes the bytecode of the whole contract. So the savings above are real but not yet live on any chain. Reopen if you would rather this tracked until the 2.0.0 rollout.