[F-2026-17736] : Derived call can commit state even when commit=false

[AryaLanjewar3005]

[F-2026-17736] DerivedEVMCallWithData Ignores commit Flag

Issue

DerivedEVMCallWithData accepts a commit bool parameter but silently ignores it in two places, causing state to always be persisted regardless of what the caller passes.

File: x/vm/keeper/call_evm.go

Bug 1 — Hardcoded true in ApplyMessageWithConfig

// pass true to commit the StateDB
res, err := k.ApplyMessageWithConfig(tmpCtx, msg, nil, true, cfg, txConfig)

The StateDB (which holds EVM balance changes, storage writes, and newly created contracts) is always told to flush its dirty state to the underlying store, regardless of the commit parameter.

Bug 2 — Unconditional commitState()

if !res.Failed() {
    commitState()
}

The cache context sandbox is always propagated back to the parent context on success, regardless of the commit parameter.

Impact

Any caller passing commit=false expects non-mutating, dry-run behavior — simulations, gas estimations, speculative IBC callback checks. Instead, both the StateDB and the cache context are committed, silently mutating chain state. The bug is invisible at the call site because the caller's context object is not directly modified; the mutation happens at the underlying store level.

There is also an internal contradiction: isFake on the EVM message is correctly set to !commit, so the EVM itself treats the execution as a simulation — but its output is still persisted.

---

Solution

Two targeted changes in x/vm/keeper/call_evm.go:

1. Pass commit into ApplyMessageWithConfig instead of hardcoded true:

res, err := k.ApplyMessageWithConfig(tmpCtx, msg, nil, commit, cfg, txConfig)

2. Gate commitState() on the commit flag:

if commit && !res.Failed() {
    commitState()
}

Behavior after fix

commit	Execution succeeds	StateDB flushed	Cache context committed
true	yes	yes	yes
true	no	yes	no
false	yes	no	no
false	no	no	no

When commit=false, execution still runs and the result is returned to the caller, but zero state changes escape to the underlying store. True dry-run semantics are restored.

Closes: #XXXX

---

Author Checklist

All items are required. Please add a note to the item if the item is not applicable and
please add links to any relevant follow up issues.

I have...

• tackled an existing issue or discussed with a team member
• left instructions on how to review the changes
• targeted the main branch