fix(tx-filter): emergency EIP-7702 lockdown for the audit#838 nonce halt

[Richard1048576]

Summary

Emergency stopgap that neutralises the EIP-7702 nonce-bump executor-halt class at the pre-execution transaction filter (filter_invalid_txs), until the durable executor-skip fix (gravity-reth #388 + grevm #110) is deployed.

Gated by a compile-time const gravity_primitives::EIP7702_LOCKDOWN (currently true — this build ships the lockdown active). It is a const rather than a CLI/env flag on purpose: the toggle is consensus-critical (it changes which txs execute), so a per-node value would fork the chain — baking it into the binary makes fleet-consistency structural (the coordinated upgrade is the binary version). Revert = set it back to false and rebuild.

Three deterministic drops when active, all evaluated against certified block-start state:

	rule	closes
L1	reject every type-4 (SetCode) tx	no new delegations — covers the same-block auth-apply variant (audit#822)
L2	drop any tx from a delegated account (0xef0100… designator)	the delegated account's execution-time CREATE cannot leave a same-block stale tx (audit#838)
L3	drop any tx to a delegated account	no inbound CALL can trigger the callee's delegated CREATE

Why

The filter's in-block simulation models the 7702 authorization-apply nonce bump (audit#822), but not the execution-time CREATE bump: a delegated account A whose delegated code runs CREATE bumps A's own nonce mid-block, so a same-block current-nonce tx A@M becomes NonceTooLow and panics the executor at lib.rs:1137. This is reachable using an account delegated in any prior (permissionless) block. #387's filter stopgap only covered the same-block variant; this closes the already-delegated variant too.

Dropped txs are excluded via the existing invalid_tx_idxs path (pre-execution), so the drop itself cannot halt the chain.

Trade-off

While active, this freezes delegated accounts' tx origination and disables new 7702 usage. Revert (flip EIP7702_LOCKDOWN to false) once the skip fix (#388 + grevm #110) is deployed and 7702 can be re-enabled.

Validation

• Filter unit tests — filter_invalid_txs takes an eip7702_lockdown param, so both states are covered: L1/L2/L3, the audit#838 attack shape (X→A + A@M both dropped), and a precision test proving non-delegated traffic is unaffected.
• Full-pipeline regression test test_finding_a_lockdown_survives_grevm — drives OrderedBlock → filter_invalid_txs → executor with A genesis-delegated to a CREATE contract: with the lockdown the attack block survives (zero user txs, chain advances); without it (control) the executor panics at lib.rs:1137 with NonceTooLow{tx:0,state:1}.
• The P-13 / P-14 7702-delegation positive controls are #[ignore]'d while the lockdown ships (7702 delegation is intentionally disabled by it; un-ignore when the const is flipped back to false).

Deployment

STF change — all full nodes must upgrade together. Because the toggle is a compile-time const, every binary from this build carries the identical value, so nodes cannot diverge on it. Coordinated v1.7.5 release; flip EIP7702_LOCKDOWN back to false + rebuild to revert.

🤖 Generated with Claude Code