feat: cap bundler surcharge if all solvers fail

src/contracts/atlas/GasAccounting.sol

@@ -359,8 +359,16 @@ abstract contract GasAccounting is SafetyLocks {
             // If no successful solvers, only collect partial surcharges from solver's fault failures (if any)
             uint256 _solverSurcharge = solverSurcharge();
             if (_solverSurcharge > 0) {
-                // NOTE: This only works when BUNDLER_SURCHARGE > ATLAS_SURCHARGE.
                 netAtlasGasSurcharge = _solverSurcharge.getAtlasPortionFromTotalSurcharge();
+
+                // When no winning solvers, bundler max refund is 80% of metacall gas cost. The remaining 20% can be
+                // collected through storage refunds. Any excess bundler surcharge is instead taken as Atlas surcharge.
+                uint256 _bundlerSurcharge = _solverSurcharge - netAtlasGasSurcharge;
+                uint256 _maxBundlerRefund = adjustedClaims.withoutBundlerSurcharge().maxBundlerRefund();
+                if (_bundlerSurcharge > _maxBundlerRefund) {
+                    netAtlasGasSurcharge += _bundlerSurcharge - _maxBundlerRefund;
+                }
+
                 adjustedWithdrawals += netAtlasGasSurcharge;
                 S_cumulativeSurcharge = _surcharge + netAtlasGasSurcharge;
             }

src/contracts/libraries/AccountingMath.sol

@@ -5,6 +5,7 @@ library AccountingMath {
     // Gas Accounting public constants
     uint256 internal constant _ATLAS_SURCHARGE_RATE = 1_000_000; // out of 10_000_000 = 10%
     uint256 internal constant _BUNDLER_SURCHARGE_RATE = 1_000_000; // out of 10_000_000 = 10%
+    uint256 internal constant _MAX_BUNDLER_REFUND_RATE = 8_000_000; // out of 10_000_000 = 80%
     uint256 internal constant _SOLVER_GAS_LIMIT_BUFFER_PERCENTAGE = 500_000; // out of 10_000_000 = 5%
     uint256 internal constant _SCALE = 10_000_000; // 10_000_000 / 10_000_000 = 100%
     uint256 internal constant _FIXED_GAS_OFFSET = 85_000;
@@ -30,6 +31,12 @@ library AccountingMath {
         atlasSurcharge = totalSurcharge * _ATLAS_SURCHARGE_RATE / (_ATLAS_SURCHARGE_RATE + _BUNDLER_SURCHARGE_RATE);
     }
 
+    // NOTE: This max should only be applied when there are no winning solvers.
+    // Set to 80% of the metacall gas cost, because the remaining 20% can be collected through storage refunds.
+    function maxBundlerRefund(uint256 metacallGasCost) internal pure returns (uint256 maxRefund) {
+        maxRefund = metacallGasCost * _MAX_BUNDLER_REFUND_RATE / _SCALE;
+    }
+
     function solverGasLimitScaledDown(
         uint256 solverOpGasLimit,
         uint256 dConfigGasLimit

test/FLOnline.t.sol

@@ -51,8 +51,9 @@ contract FastLaneOnlineTest is BaseTest {
         bool solverFour;
     }
 
-    uint256 constant SURCHARGE_PER_SOLVER_IF_ALL_FAIL = 28_000e9; // 28k Gwei (avg, differs for ERC20/native in/out)
-    uint256 constant ERR_MARGIN = 0.15e18; // 15% error margin
+    // Only Atlas surcharge kept if all fail, bundler surcharge paid to bundler
+    uint256 constant SURCHARGE_PER_SOLVER_IF_ALL_FAIL = 14_000e9; // 14k Gwei (avg, differs for ERC20/native in/out)
+    uint256 constant ERR_MARGIN = 0.22e18; // 22% error margin
     address internal constant NATIVE_TOKEN = address(0);
 
     address protocolGuildWallet = 0x25941dC771bB64514Fc8abBce970307Fb9d477e9;
@@ -61,7 +62,6 @@ contract FastLaneOnlineTest is BaseTest {
 
     uint256 goodSolverBidETH = 1.2 ether; // more than baseline swap amountOut if tokenOut is WETH/ETH
     uint256 goodSolverBidDAI = 3100e18; // more than baseline swap amountOut if tokenOut is DAI
-    uint256 defaultMsgValue = 1e16; // 0.01 ETH for bundler gas, treated as donation
     uint256 defaultGasLimit = 2_000_000;
     uint256 defaultGasPrice;
     uint256 defaultDeadlineBlock;
@@ -1291,9 +1291,6 @@ contract FastLaneOnlineTest is BaseTest {
         beforeVars.solverTwoRep = flOnline.solverReputation(solverTwoEOA);
         beforeVars.solverThreeRep = flOnline.solverReputation(solverThreeEOA);
 
-        // adjust userTokenInBalance if native token - exclude gas treated as donation
-        if (nativeTokenIn) beforeVars.userTokenInBalance -= defaultMsgValue;
-
         uint256 txGasUsed;
         uint256 estAtlasGasSurcharge = gasleft(); // Reused below during calculations
 
@@ -1459,10 +1456,9 @@ contract FastLaneOnlineTest is BaseTest {
         newArgs.deadline = defaultDeadlineBlock;
         newArgs.gas = defaultGasLimit;
         newArgs.maxFeePerGas = defaultGasPrice;
-        newArgs.msgValue = defaultMsgValue;
 
         // Add amountUserSells of ETH to the msg.value of the fastOnlineSwap call
-        if (nativeTokenIn) newArgs.msgValue += swapIntent.amountUserSells;
+        if (nativeTokenIn) newArgs.msgValue = swapIntent.amountUserSells;
     }
 
     function _buildBaselineCall(