# Geth — EIP-7928 Block-Level Access Lists Public-source review, 2026-10-27. **Two known, conditional conformance candidates; no new canonical-chain bug established.** Both are manifestations of one missing index-wide netting step. Neither was executed locally. ## Pins, specification version and activation - **Geth default branch:** `master`, newest commit returned when first read: **`8817f99f92852f8ac53e596de6202dd9e3494065`**, committer timestamp 2026-10-27T03:32:47Z. [Commit](https://github.com/ethereum/go-ethereum/commit/8817f99f92852f8ac53e596de6202dd9e3494065); [branch API](https://api.github.com/repos/ethereum/go-ethereum/commits/master). - **Execution reference:** **`7f2f4c9bf6d73b09ecb8b24eb14d08bf0cf0247b`**, committer timestamp 2026-10-27T17:40:55Z; [src/ethereum/forks/amsterdam/block_access_lists.py][src1]. The requested [master URL][src2] did not resolve. The repository API reports its default branch as `forks/bogota`; the pin is that branch's Amsterdam module, not a claimed resolution of `master`. The master commit API returned HTTP 422. [Repository](https://api.github.com/repos/ethereum/execution-specs); [default-branch commit](https://api.github.com/repos/ethereum/execution-specs/commits/forks/bogota). - **EIP version:** [published EIP-7928](https://eips.ethereum.org/EIPS/eip-7928), **Last Call**, deadline 2026-11-01; immutable text snapshot [EIPs@`d4c575521d99ec881a444ab3af604e684b5f0743`][src3]. Its latest path-specific commit is also `d4c575521d99ec881a444ab3af604e684b5f0743`. There is no numbered semantic version in its metadata; this commit identifies the reviewed version. BAL scalars are **RLP unsigned integers**, not SSZ scalars. The consensus execution-payload container transports the RLP bytes; SSZ scalar validation is not an alternative EL encoding. - **Comparison client:** Nethermind `master` at **`d48833af88ec4224c86afadd1c596e8f619c406b`**. [Commit](https://github.com/NethermindEth/nethermind/commit/d48833af88ec4224c86afadd1c596e8f619c406b). - **Not active on mainnet at review time:** the pinned [Glamsterdam meta EIP][src4] leaves mainnet activation blank; Geth's [params/chainspecs/mainnet.json:L1–L51][src5] contains no Amsterdam activation. BAL construction is enabled by Amsterdam in [core/state/statedb.go:L1522–L1527][src6]. Thus the task's live-code withholding rule does not apply to these Amsterdam-only BAL discrepancies. No independently active-mainnet vulnerability is reported. The meta EIP schedules 2780, 7688, 7708, 7732, 7778, 7843, **7928**, 7954, 7976, 7981, 7997, 8024, 8037, 8038, 8045, 8061, 8246 and 8282. This item's conformance scope is only EIP-7928, including interactions needed to understand its BAL. Other EIPs and consensus clients were not audited. ## Candidate 1 — restored storage remains a write at the final index **Status: known; conditional on interacting system-contract code.** ### 1. Specification Verbatim from [Recording semantics / Storage](https://eips.ethereum.org/EIPS/eip-7928#storage): > Implementations MUST compare each write against the storage value as of immediately before the current `block_access_index` (i.e., the cumulative state from all prior indices, falling back to the pre-block state) to correctly distinguish between actual writes and no-op writes. Also, from the same section: > A no-op write MUST NOT remove `storage_changes` entries from earlier indices for the same slot. The [index-assignment section](https://eips.ethereum.org/EIPS/eip-7928#blockaccessindex-assignment) assigns `n + 1` to post-execution system calls. The reference uses an index/address/slot baseline, not a new baseline for each system call: [src/ethereum/forks/amsterdam/block_access_lists.py:L747–L762][src1] and [src/ethereum/forks/amsterdam/block_access_lists.py:L812–L825][src1]. ### 2. Geth location and relevant quoted lines All links below pin `8817f99f92852f8ac53e596de6202dd9e3494065`. - [core/state_processor.go:L469–L502][src7] calls Prepare/Finalise separately for each request system call, passing the same final index. [core/state/statedb.go:L1142–L1152][src6] clears the journal and releases the per-scope access list. - [core/state/state_object.go:L255–L284][src8] compares dirty slots within that scope and records: `s.db.stateAccessList.StorageWrite(s.db.blockAccessIndex, s.address, key, value)` - [core/types/bal/bal.go:L168–L183][src9] merges colliding writes with: `existing[txIdx] = value` The merge replaces the earlier value but cannot tell that the replacement equals the value before the whole index began. It also removes the slot from storage reads. The final-index path returns the merged BAL without index-wide reconciliation: [core/state_processor.go:L190–L229][src7]. ### 3. Condition and divergent output, in words An Amsterdam block has two post-execution calls sharing its final index. With substituted request-predeploy code, the withdrawal request call invokes the consolidation contract, which changes a slot from zero to nonzero. The later direct system call to the consolidation contract restores that slot to zero. No other block index writes the slot. The reference emits the slot only in storage reads. Geth retains a storage change at the final index with value zero. The account and slot are still correctly included, but their classification and the resulting RLP/hash differ. A block committing to the reference BAL fails Geth's execution-derived hash comparison in [core/block_validator.go:L181–L195][src10]. This condition is present in the public reference test [tests/amsterdam/eip7928_block_level_access_lists/test_block_access_lists_cross_index.py:L536–L652][src11], whose expected read-only toggle slot is at lines 615–616. The fixture deliberately replaces predeploy bytecode; it is not evidence that a transaction can replace the canonical Ethereum predeploys. ### 4. One other named client Nethermind at `d48833af88ec4224c86afadd1c596e8f619c406b` agrees with the reference for the described rule. - [src/Nethermind/Nethermind.Consensus/Processing/BlockAccessListManager.SystemContracts.cs:L72–L91][src12] routes withdrawals and requests through the same post-execution world state. - [src/Nethermind/Nethermind.Consensus/Processing/BlockAccessListManager.TxProcessorPool.cs:L156–L176][src13] reuses the existing processor for the same index; [src/Nethermind/Nethermind.Consensus/Processing/BlockAccessListManager.TxProcessorPool.cs:L275–L276][src13] clamps the post-execution sentinel to the final index. - [src/Nethermind/Nethermind.Core/BlockAccessLists/AccountChangesAtIndex.cs:L78–L88][src14] preserves the first captured slot value. - [src/Nethermind/Nethermind.Core/BlockAccessLists/BlockAccessListAtIndex.cs:L212–L241][src15] compares against that value; on restoration the relevant quoted lines are: `accountChanges.RemoveStorageChange(key);` `accountChanges.AddStorageRead(key);` This is a static path comparison, not a fresh cross-client execution result. ### 5. Confidence and attempted disproof **High** confidence in the conditional conformance discrepancy: current Geth source, current reference source, explicit reference-test expectation and Geth's own skip agree. **No demonstrated canonical-chain reachability.** I checked whether last-write-wins could itself satisfy the rule: it does for a nonzero final difference, but not when the later scope restores the index-start value. I checked whether transaction-local dirty-slot cancellation removes the issue: it cannot cancel a write already finalized in another scope. I checked for a later reconciliation: the post-execution function returns directly after merging. The strongest challenge is practical reachability. The maintainer discussion on [PR #35843](https://github.com/ethereum/go-ethereum/pull/35843) says the existing system contracts have independent state footprints and proposes discussing the spec rather than immediately taking the added complexity. The test itself uses mutable preallocation and substituted code. This substantially limits the finding: it is a supported/custom-state conformance mismatch, not an established attack on canonical Glamsterdam state. ### 6. Severity **Valid block rejected** under the stated custom-predeploy condition. A divergent BAL commitment could cause a split between implementations on a chain permitting that state, but no canonical Ethereum consensus split is established. No gas/fee error is claimed. ### Known-check **Known:** [Geth issue #35776](https://github.com/ethereum/go-ethereum/issues/35776) describes this exact storage case. [PR #35843](https://github.com/ethereum/go-ethereum/pull/35843) is open and unmerged in the reviewed API response. [PR #35895](https://github.com/ethereum/go-ethereum/pull/35895) is closed **without merge**, as a duplicate; closure is not evidence of a deployed fix. Geth's [tests/block_test.go:L94–L96][src16] explicitly skips the storage fixture. The [testnet release tracker #3217](https://github.com/ethereum/execution-specs/issues/3217) links [execution-specs PR #3566](https://github.com/ethereum/execution-specs/pull/3566), which explains index-start netting and adds boundary-index coverage. The pinned reference fixture above supplies direct public test evidence. No matching Hive run was found/verified; dashboard and search limitations are documented below. ## Candidate 2 — withdrawal credit restored by a dequeue leaves a spurious balance change **Status: known; same root cause as Candidate 1, different recorded field.** ### 1. Specification Verbatim from [Balance recording](https://eips.ethereum.org/EIPS/eip-7928#balance-balance_changes): > If an account’s balance changes during a transaction, but its post-transaction balance is equal to its pre-transaction balance, then the change MUST NOT be recorded in `balance_changes`. The [state-transition section](https://eips.ethereum.org/EIPS/eip-7928#state-transition-function) puts withdrawals and subsequent post-execution work at the same `len(transactions) + 1` index. The EIP sentence uses “transaction”; the reference resolves its application to the shared system index explicitly. [src/ethereum/forks/amsterdam/block_access_lists.py:L727–L744][src1] captures the account at index start; [src/ethereum/forks/amsterdam/block_access_lists.py:L784–L792][src1] removes a balance entry when the final value equals it. This interpretation is also pinned by [tests/amsterdam/eip7928_block_level_access_lists/test_block_access_lists_cross_index.py:L860–L943][src11]. ### 2. Geth location and relevant quoted lines All links pin `8817f99f92852f8ac53e596de6202dd9e3494065`. - [core/state_processor.go:L232–L250][src7] finalizes withdrawal credits in one scope, then [core/state_processor.go:L488–L502][src7] finalizes each request call separately. - [core/state/statedb.go:L835–L844][src6] compares against the scope-local journal baseline: `if state.balanceSet && balance.Cmp(state.balance) != 0 {` - [core/types/bal/bal.go:L185–L187][src9] overwrites a same-index entry: `acc.BalanceChanges[txIdx] = balance` The first comparison can correctly detect two individual changes while the merge incorrectly retains a change netting to zero over the index. [core/state/journal.go:L139–L150][src17] stashes the first balance in each journal window; [core/state/journal.go:L203–L210][src17] resets that window. ### 3. Condition and divergent output, in words An Amsterdam block withdraws a nonzero amount to a request predeploy whose starting balance is zero. In its subsequent system call, substituted predeploy code forwards the entire credited amount to another account. The recipient predeploy ends the final index at its original zero balance. The reference retains the accessed predeploy address with no balance change. Geth's withdrawal scope records the credit, then its system-call scope overwrites the entry with a final zero balance. Geth therefore emits an extra final-index zero balance change. Hashes differ and the reference-conforming block is rejected at [core/block_validator.go:L181–L195][src10]. The no-user-transaction, forward-all reference case is [tests/amsterdam/eip7928_block_level_access_lists/test_block_access_lists_cross_index.py:L852–L943][src11]. A forward-half variant is a useful negative control: a positive retained balance is a genuine net change, so last-write-wins can produce the right balance entry there. The claimed bug concerns complete restoration, not every withdrawal to a system address. ### 4. One other named client Nethermind at `d48833af88ec4224c86afadd1c596e8f619c406b` agrees with the reference. The shared post-execution processor paths cited in Candidate 1 retain the same BAL slice through withdrawals and requests. [src/Nethermind/Nethermind.Core/BlockAccessLists/BlockAccessListAtIndex.cs:L106–L131][src15] captures the first pre-index balance and updates the optional entry: `UInt256 preTxBalance = accountChanges.PreTxBalance ??= before;` `accountChanges.BalanceChange = preTxBalance != after` `? new BalanceChange(Index, after)` `: null;` Thus forwarding all of the withdrawal removes the balance change while preserving account access. [src/Nethermind/Nethermind.Core/BlockAccessLists/GeneratedAccountChanges.cs:L197–L202][src18] adds a balance entry to the final assembled list only if that optional change is present. This conclusion is from source inspection; the historical cross-client results in the Geth issue are the reporter's results, not mine. ### 5. Confidence and attempted disproof **High** confidence in the conditional mismatch. The entry is explicitly present according to the public bug report, and both the current Geth implementation and its forward-all test skip match the report. **No demonstrated canonical-chain reachability.** I tested the explanation logically against ordinary zero transfers, self-transfers and multiple withdrawals: a single journal scope already nets those correctly. The failure needs independently finalized scopes sharing one BAL index. I also checked whether the withdrawal-order fix solved it: withdrawals now run first, but that does not preserve the index-start baseline across later calls. I checked closed fix PRs for merge status rather than treating “closed” as “fixed.” The public report and maintainer response state that canonical queue predeploys do not forward their balances in the required way. The reference fixture replaces their bytecode. Consequently I do not claim that a withdrawal alone or an ordinary transaction can trigger this on canonical Ethereum state. ### 6. Severity **Valid block rejected** under the stated substituted-predeploy condition; potential custom-chain consensus disagreement. No established canonical-chain split, theft, or wrong fee. ### Known-check **Known:** [issue #35894](https://github.com/ethereum/go-ethereum/issues/35894), closed as a duplicate of [#35776](https://github.com/ethereum/go-ethereum/issues/35776). [PR #35843](https://github.com/ethereum/go-ethereum/pull/35843) remains unmerged; [#35895](https://github.com/ethereum/go-ethereum/pull/35895) was closed without merging. [tests/block_test.go:L94–L96][src16] explicitly skips only the balance fixture's forward-all case. The ordering bug [#35775](https://github.com/ethereum/go-ethereum/issues/35775) is related but distinct: current code already processes withdrawals before calls. The netting PR's body and comments explain the residual issue. [Execution-specs tracker #3217](https://github.com/ethereum/execution-specs/issues/3217), [PR #3566](https://github.com/ethereum/execution-specs/pull/3566), and the pinned fixture above identify this as existing public coverage. No matching Hive run was independently verified. ## Rules checked with no discrepancy found in the inspected paths These are bounded static findings, not certification of every possible execution. EIP links identify the applicable normative section; every client-file link pins `8817f99f92852f8ac53e596de6202dd9e3494065`. | Rule and boundary checked | Geth evidence and conclusion | |---|---| | [Account ordering and uniqueness](https://eips.ethereum.org/EIPS/eip-7928#ordering-uniqueness-and-determinism) | [core/types/bal/bal.go:L69–L95][src9] keys accounts by address; [core/types/bal/bal_encoding.go:L458–L471][src19] sorts addresses. [core/types/bal/bal_encoding.go:L82–L94][src19] and [core/types/bal/bal_encoding.go:L168–L175][src19] reject equal or decreasing received addresses. | | [Slot/index ordering, deduplication, disjoint reads/writes](https://eips.ethereum.org/EIPS/eip-7928#ordering-uniqueness-and-determinism) | [core/types/bal/bal.go:L87–L110][src9] uses sets/maps and deletes a read on a write; [core/types/bal/bal_encoding.go:L392–L454][src19] sorts slots and indices. [core/types/bal/bal_encoding.go:L180–L194][src19] and [core/types/bal/bal_encoding.go:L247–L329][src19] reject empty write lists, duplicate/unsorted keys or indices, intersections and indices above transaction count plus one. This does not remedy index-wide netting. | | [Minimal RLP scalars, widths, address length](https://eips.ethereum.org/EIPS/eip-7928#rlp-encoding) | [core/types/bal/bal_encoding_rlp_generated.go:L10–L75][src20] writes integer scalars, including slots, rather than fixed hash strings. [core/types/bal/bal_encoding_rlp_generated.go:L78–L230][src20] uses ReadUint256/Uint32/Uint64 and a 20-byte address buffer. [rlp/decode.go:L659–L678][src21], [rlp/decode.go:L742–L770][src21] and [rlp/decode.go:L891–L927][src21] enforce length/width and reject leading-zero and non-minimal integer encodings, including a zero encoded as a literal zero byte. | | [Raw BAL commitment and malformed bytes](https://eips.ethereum.org/EIPS/eip-7928#engine-api) | [beacon/engine/types.go:L346–L379][src22] hashes supplied RLP bytes for the header; [beacon/engine/types.go:L385–L401][src22] decodes with DecodeBytes and propagates malformed BAL errors. It does not silently canonicalize a non-minimal scalar and accept it. | | [Header hash and full execution validation](https://eips.ethereum.org/EIPS/eip-7928#block-structure-modification) | [core/types/block.go:L103–L107][src23] has an optional hash field; [core/types/bal/bal_encoding.go:L122–L132][src19] computes Keccak-256 of RLP. [core/state_processor.go:L545–L557][src7] sets the built header commitment. [core/block_validator.go:L114–L134][src10] checks attached BAL/hash/structure; [core/block_validator.go:L181–L195][src10] checks the execution-produced hash. BAL is separate from the ordinary body in [core/types/block.go:L183–L187][src23]. | | [Fork transition: required starting with the first Amsterdam block; absent before it](https://eips.ethereum.org/EIPS/eip-7928#backwards-compatibility) | [params/config.go:L741–L744][src24] tests the current block's timestamp; [consensus/beacon/consensus.go:L272–L288][src25] requires the field after activation and rejects it before activation. [core/state/statedb.go:L1522–L1527][src6] enables BAL at Prepare under current rules, including the first upgraded block's system work. [eth/catalyst/api.go:L851–L889][src26] gates V4/V5 fields and fork use. No dependence on the parent already having a BAL was found in this construction path. | | [Pre/user/post index assignment](https://eips.ethereum.org/EIPS/eip-7928#blockaccessindex-assignment) | [core/state_processor.go:L117–L144][src7] uses user indices starting at one and post index transaction count plus one. [core/state_processor.go:L394–L406][src7] and [core/state_processor.go:L429–L441][src7] set pre-call index zero. [core/state_processor.go:L232–L249][src7] and [core/state_processor.go:L488–L501][src7] pass the post index to withdrawals and calls. | | [System calls and exclusion of a mere system caller](https://eips.ethereum.org/EIPS/eip-7928#scope-and-inclusion) | [core/state_processor.go:L375–L442][src7] runs both pre-calls with tracking, and [core/state_processor.go:L445–L502][src7] covers request calls. [core/vm/evm.go:L295–L329][src27] skips system-caller balance checks/value transfers; target account reads remain tracked via [core/state/statedb.go:L602–L606][src6]. Explicit bytecode access to SYSTEM_ADDRESS would still include it; merely using it as CALLER does not read its account. | | [Withdrawals: zero amounts, grouping and ordering](https://eips.ethereum.org/EIPS/eip-7928#edge-cases-normative) | [core/state_processor.go:L199–L217][src7] runs withdrawals before queues. [core/state_processor.go:L232–L250][src7] calls AddBalance for every recipient even at zero, with finalization after all withdrawals. [core/state/statedb.go:L459–L465][src6] accesses/creates its state object; [core/state/statedb.go:L839–L844][src6] suppresses unchanged balance entries. Shared-index interaction with later calls is the Candidate 2 exception. | | [Storage no-op writes against cumulative pre-transaction state](https://eips.ethereum.org/EIPS/eip-7928#storage) | [core/state/state_object.go:L185–L205][src8] consults pending storage before older origin storage. [core/state/state_object.go:L229–L250][src8] removes dirty markers on restoration. [core/state/state_object.go:L255–L284][src8] emits only remaining changed slots. [core/types/bal/bal.go:L92–L109][src9] retains earlier-index writes rather than demoting them when a later transaction only reads/no-ops. Shared-system-index netting is the Candidate 1 exception. | | [Destroyed/recreated account's storage accesses](https://eips.ethereum.org/EIPS/eip-7928#edge-cases-normative) | [core/state/state_object.go:L185–L205][src8] records the slot read **before** returning cached, pending or cleared storage, including the destructed-in-this-block zero-value branch. [core/state/statedb.go:L873–L908][src6] avoids finalizing destroyed objects' dirty storage as writes; earlier reads survive in the BAL. A recreated object's cleared storage is not fetched from the old database when its destruction marker is present. The positive-balance EIP-8246 path creates a fresh state object, so it is not the same object as the discarded dirty storage. This is a check of the read-recording and clearing paths, not an exhaustive proof of all EIP-8246 state semantics. | | [Max nonce and post-state nonce recording](https://eips.ethereum.org/EIPS/eip-7928#nonce) | [core/state_transition.go:L576–L588][src28] rejects sender overflow; [core/vm/evm.go:L506–L517][src27] rejects CREATE overflow before destination access in the internal precheck. [core/state/journal.go:L61–L69][src17] and [core/state/journal.go:L152–L160][src17] use an explicit nonce-present flag, not max-uint64 as an “unset” sentinel. [core/state/statedb.go:L842–L844][src6] records changed final nonces, and [core/types/bal/bal_encoding_rlp_generated.go:L59–L63][src20] encodes the full uint64. | | [Zero-value transfers, self-transfers and net-zero balances](https://eips.ethereum.org/EIPS/eip-7928#balance-balance_changes) | [core/state/statedb.go:L602–L606][src6] records access independently of mutation; [core/state/journal.go:L139–L150][src17] preserves the first balance within a transaction; [core/state/statedb.go:L825–L853][src6] compares the final value. A self-transfer restoring balance therefore creates no balance change, while touched addresses remain. [core/vm/evm.go:L303–L329][src27] still accesses a zero-value call recipient. Candidate 2 concerns multiple finalized scopes, not this within-transaction path. | | [Refunds, fees, exceptional halts and coinbase](https://eips.ethereum.org/EIPS/eip-7928#edge-cases-normative) | [core/state_transition.go:L795–L818][src28] settles/refunds gas before crediting fees; [core/state_processor.go:L278–L295][src7] finalizes afterward. [core/state/statedb.go:L766–L768][src6] reverts the mutation journal while read tracking is outside that journal. [core/state/statedb.go:L835–L853][src6] compares final metadata after rollback. Fee accounting accesses coinbase even for a zero fee, consistent with the EIP's “accessed for another reason” exception. Empty blocks do not enter the per-transaction fee-credit path. | | [Gas validation before target/slot access; delegation failures](https://eips.ethereum.org/EIPS/eip-7928#gas-validation-before-state-access) | [core/vm/gas_table.go:L680–L710][src29] checks both SSTORE sentry and repriced access cost before the slot read. [core/vm/gas_table.go:L648–L674][src29] guards SELFDESTRUCT beneficiary access. [core/vm/operations_acl.go:L371–L425][src30] and [core/vm/operations_acl.go:L471–L515][src30] charge pre-access costs before target code and delegated-target reads; the delegated target is explicitly recorded after its own successful charge and before depth/balance failure. | | [Precompiles and tx access lists](https://eips.ethereum.org/EIPS/eip-7928#scope-and-inclusion) | [core/vm/evm.go:L301–L333][src27] touches a CALL target through Exist before precompile dispatch. [core/state/statedb.go:L1495–L1527][src6] warms EIP-2930 addresses/slots separately from the newly created BAL, so unused tx-access-list entries do not automatically become BAL entries. | | [BAL item limit and index width](https://eips.ethereum.org/EIPS/eip-7928#block-access-list-size-constraint) | [core/types/bal/bal_encoding.go:L96–L119][src19] counts one address plus each distinct read/write slot and divides gas limit by BALItemCost; [core/types/bal/bal_encoding.go:L147–L150][src19] and [core/types/bal/bal_encoding.go:L208–L212][src19] use uint32 indices and uint64 nonces. The numeric constant is 2000 at [params/protocol_params.go:L213–L221][src31]. | ## Known-bug search and public-test limits GitHub issue search was run without an `is:open`/`is:closed` restriction, so both issues and PRs, open and closed, were included. Exact queries and result totals: - `repo:ethereum/go-ethereum 7928` — 42. - `repo:ethereum/go-ethereum BAL nonce` — 22. - `repo:ethereum/go-ethereum BAL selfdestruct` — 9. - `repo:ethereum/go-ethereum BAL encoding` — 16. - `repo:ethereum/go-ethereum BAL system` — 28. - `repo:ethereum/execution-specs "Test Release Tracker" "glamsterdam-devnet"` — 24 (includes some other devnet trackers that mention Glamsterdam). The relevant known matches are linked in each candidate. I read issue bodies/comments and PR merge-status metadata for the closest Geth matches, and read the Glamsterdam tracker bodies listed in the URL ledger. The tracker search itself is not a guarantee of exhaustive issue indexing. Search-engine queries also run: - `site:github.com/ethereum/go-ethereum "BAL" "nonce"` - `site:github.com/ethereum/go-ethereum "BAL" "selfdestruct"` - `site:github.com/ethereum/execution-specs "Test Release Tracker" "glamsterdam-devnet"` - `site:hive.ethpandaops.io glamsterdam geth` - `site:hive.ethpandaops.io "bal_post_execution_calls_net_storage_at_last_index"` - `site:hive.ethpandaops.io "bal_withdrawals_and_dequeues_net_balance_at_last_index"` - `site:hive.ethpandaops.io "geth" "net_storage"` **Hive check: no matching run found/verified, not a pass claim.** The [dashboard](https://hive.ethpandaops.io/) and [Glamsterdam group](https://hive.ethpandaops.io/#/group/glamsterdam) exposed no text/results through the page reader; direct HTTP access to the root returned 403. Attempts at the older BAL listing and a Glamsterdam path also failed. Search found an older Erigon log but no exact matching Geth case. It cannot establish status at the pinned Geth commit. **Execution-spec-tests evidence:** the pinned reference test expectations and Geth's own skips are direct evidence. Tracker #3217 includes PR #3566 and later encoding/recreation/max-nonce coverage. I did not run fixtures or clients, and do not infer that all tests pass from a release or tracker checkbox. Reports of historical Erigon/Nethermind passes in issue #35894 are attributed reports only. **Coverage limits:** no new discrepancy survived the inspected ordinary transaction paths. The two retained candidates were already public and depend on mutable/custom predeploy state. Header/genesis special cases, BAL retention/pruning, sync protocols and parallel-execution internals were not exhaustively audited. The live-code restriction was assessed for EIP-7928 BAL logic, and no client was executed or local machine configuration inspected. ## URL ledger The following lists fetched/read URLs, including failed requests. Code citations above use immutable GitHub blob links; their raw counterparts were used for line-numbered reading. Repository tree listings were used only to locate public files. Search-result snippets were read as search results, not treated as proof of an unvisited page. ### Raw pinned source reads - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ### Public GitHub API reads - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ### Published pages, dashboard attempts and search-result pages read - - - - - - - - - - - - - - - The unpinned Geth pages above appeared in search snippets only; all code conclusions were checked against the pinned raw source. The old Erigon log was a search result only and is not evidence for either candidate. The non-existent Geth operations_amsterdam.go request returned 404. API requests for execution-specs master and the dashboard failures are recorded above; no content is attributed to a failed fetch. URLs merely appearing inside fetched issue bodies were not followed unless listed. No search-engine results URL was supplied by the search tool; its exact query strings are listed in the preceding section. [src1]: https://github.com/ethereum/execution-specs/blob/7f2f4c9bf6d73b09ecb8b24eb14d08bf0cf0247b/src/ethereum/forks/amsterdam/block_access_lists.py [src2]: https://github.com/ethereum/execution-specs/blob/master/src/ethereum/forks/amsterdam/block_access_lists.py [src3]: https://github.com/ethereum/EIPs/blob/d4c575521d99ec881a444ab3af604e684b5f0743/EIPS/eip-7928.md [src4]: https://github.com/ethereum/EIPs/blob/d4c575521d99ec881a444ab3af604e684b5f0743/EIPS/eip-7773.md [src5]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/params/chainspecs/mainnet.json [src6]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/core/state/statedb.go [src7]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/core/state_processor.go [src8]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/core/state/state_object.go [src9]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/core/types/bal/bal.go [src10]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/core/block_validator.go [src11]: https://github.com/ethereum/execution-specs/blob/7f2f4c9bf6d73b09ecb8b24eb14d08bf0cf0247b/tests/amsterdam/eip7928_block_level_access_lists/test_block_access_lists_cross_index.py [src12]: https://github.com/NethermindEth/nethermind/blob/d48833af88ec4224c86afadd1c596e8f619c406b/src/Nethermind/Nethermind.Consensus/Processing/BlockAccessListManager.SystemContracts.cs [src13]: https://github.com/NethermindEth/nethermind/blob/d48833af88ec4224c86afadd1c596e8f619c406b/src/Nethermind/Nethermind.Consensus/Processing/BlockAccessListManager.TxProcessorPool.cs [src14]: https://github.com/NethermindEth/nethermind/blob/d48833af88ec4224c86afadd1c596e8f619c406b/src/Nethermind/Nethermind.Core/BlockAccessLists/AccountChangesAtIndex.cs [src15]: https://github.com/NethermindEth/nethermind/blob/d48833af88ec4224c86afadd1c596e8f619c406b/src/Nethermind/Nethermind.Core/BlockAccessLists/BlockAccessListAtIndex.cs [src16]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/tests/block_test.go [src17]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/core/state/journal.go [src18]: https://github.com/NethermindEth/nethermind/blob/d48833af88ec4224c86afadd1c596e8f619c406b/src/Nethermind/Nethermind.Core/BlockAccessLists/GeneratedAccountChanges.cs [src19]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/core/types/bal/bal_encoding.go [src20]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/core/types/bal/bal_encoding_rlp_generated.go [src21]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/rlp/decode.go [src22]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/beacon/engine/types.go [src23]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/core/types/block.go [src24]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/params/config.go [src25]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/consensus/beacon/consensus.go [src26]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/eth/catalyst/api.go [src27]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/core/vm/evm.go [src28]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/core/state_transition.go [src29]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/core/vm/gas_table.go [src30]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/core/vm/operations_acl.go [src31]: https://github.com/ethereum/go-ethereum/blob/8817f99f92852f8ac53e596de6202dd9e3494065/params/protocol_params.go