fix(tx-filter): EIP-7702 lockdown (audit#838) — backport #389 to branch-v1.8#408
fix(tx-filter): EIP-7702 lockdown (audit#838) — backport #389 to branch-v1.8#408Richard1048576 wants to merge 1 commit into
Conversation
Neutralise the EIP-7702 nonce-bump executor-halt class at the pre-execution transaction filter, gated by a compile-time const EIP7702_LOCKDOWN (currently `true` — this build ships it active) until the durable executor-skip fix (gravity-reth #388 + grevm #110) is deployed. Three deterministic drops against certified block-start state, applied when the lockdown is on: L1 reject every type-4 (SetCode) tx - no new delegations (covers audit#822) L2 drop any tx FROM a delegated account - its execution-time CREATE cannot leave a same-block stale tx (audit#838) L3 drop any tx TO a delegated account - no inbound CALL triggers the delegated CREATE The filter's in-block simulation models the 7702 authorization-apply nonce bump (audit#822) but not the execution-time CREATE bump (audit#838): a delegated account's current-nonce tx reached the executor as NonceTooLow and panicked it at lib.rs:1137. Dropped txs are excluded via the existing invalid_tx_idxs path, so the drop itself cannot halt the chain. EIP7702_LOCKDOWN is a compile-time const (not a CLI/env flag) because it is consensus-critical: a per-node value would fork the chain, so fleet-consistency is made structural by baking it into the binary — the coordinated upgrade IS the binary version. Set it back to false and rebuild to revert once the skip fix is deployed and 7702 can be re-enabled. Trade-off: freezes delegated accounts' tx origination and disables new 7702 usage while active. Tests: filter_invalid_txs takes an eip7702_lockdown param so the unit tests cover both states (L1/L2/L3 + the audit#838 attack shape + non-delegated-traffic-unaffected). The full-pipeline regression test test_finding_a_lockdown_survives_grevm drives OrderedBlock -> filter_invalid_txs -> executor: with the lockdown the attack block survives; without it the executor panics at lib.rs:1137 with NonceTooLow{tx:0,state:1}. The P-13/P-14 7702-delegation positive controls are #[ignore]'d while the lockdown ships (7702 delegation is disabled by it). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0c0bd2d237
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| // (#822) and the un-modelled execution-time CREATE bump (#838). REVERT (drop the flag) | ||
| // once the executor-skip fix (gravity-reth #388 + grevm #110) is deployed. | ||
| if tx.is_eip7702() { | ||
| if eip7702_lockdown { |
There was a problem hiding this comment.
With EIP7702_LOCKDOWN set to true in crates/gravity-primitives/src/config.rs:25, this branch drops every EIP-7702 tx before execution. The unignored gravity_bls_precompile_test still builds its BLS poison call as TxEip7702 (crates/pipe-exec-layer-ext-v2/execute/tests/gravity_bls_precompile_test.rs:137-140, 386-393) and then asserts the sender nonce advanced to 1 (416-420); under lockdown the filter discards that tx, so the precompile is never exercised and both BLS tests fail/lose coverage. Please switch that fixture to a non-7702 tx or gate it while lockdown is active.
Useful? React with 👍 / 👎.
1 participant
What
Backport the EIP-7702 emergency lockdown (audit#838) onto
branch-v1.8.This cherry-picks the single lockdown commit that already shipped on
branch-v1.7as #389, applied cleanly on top ofbranch-v1.8(0 conflicts). Diff is identical to #389: +644 / −51, 5 files,EIP7702_LOCKDOWN: bool = true.Why
branch-v1.8(the current deployed 1.8 line) does not carry the lockdown thatbranch-v1.7has. That is a regression with two consequences:NonceTooLowand panics it atlib.rs:1137— on an order-then-execute chain a committed block cannot be rejected, so that panic is a deterministic network-wide halt.EIP7702_LOCKDOWNis a compile-time consensus constant (deliberately not a CLI/env flag): consistency is guaranteed by every node running the same binary. A fleet split between a 1.7 build (lockdown = ban) and a 1.8 build (no lockdown = allow) diverges on the first type-4 / delegated-account tx. Restoring the lockdown onbranch-v1.8makes v1.7 → v1.8.x a rule-preserving upgrade.Scope (identical to #389)
Applied at the pre-execution
filter_invalid_txsagainst certified block-start state, gated byEIP7702_LOCKDOWN:SetCode) tx (no new delegations; covers audit#822).Dropped txs go through the existing
invalid_tx_idxspath, so the drop itself cannot halt the chain. Trade-off: freezes delegated-account tx origination and disables new 7702 usage while active — to be reverted (EIP7702_LOCKDOWN = false) once the durable executor-skip fix (gravity-reth #388 + grevm #110) is deployed.Deployment note (consensus-critical)
Because the lockdown is a compile-time const with no fork-gate, do not run a 1.8-no-lockdown build and this build side by side — cut a single patch release and roll it fleet-wide (all validators on the same binary). This build should be the 1.8 patch that ships for the Alpha activation, in place of the no-lockdown 1.8.
Verification
branch-v1.8is clean (0 conflicts); post-picktx_filter.rsis byte-identical to thebranch-v1.7version that shipped in fix(tx-filter): emergency EIP-7702 lockdown for the audit#838 nonce halt #389.cargo build+ the bundled 7702 tests (gravity_eip7702_test.rs, full-pipelinetest_finding_a_lockdown_survives_grevm) are being run on a Gravity node to confirm compile + that the audit#838 attack block survives the filter on this line. Results will be posted here.Backport of #389. Original authored commit preserved (authorship + trailer intact).