fix(exec): EIP-7702 delegate-then-CREATE nonce-halt stopgap + defensive hardening

[Richard1048576]

⚠️ Stacked on #385. The tx_filter stopgap builds on that PR's block-order sequential
filter, so this branch contains #385's commits too. Until #385 lands on main, the diff
below also shows #385's changes; GitHub recomputes it to just the files here once #385
merges. The net-new change is the single commit cb8745a816.

Three hardening changes on the deterministic ordered-block execution path (the executor
panics on any tx-level InvalidTransaction, which halts every validator).

1. CREATE-halt stopgap — tx_filter (gravity-audit#838)

A 7702 authority delegated in-block to a non-zero delegate can, if its delegated code
runs CREATE/CREATE2, have its nonce bumped a second time during execution — an
effect the filter cannot model without executing (nonce change (1) caller bump and (2) 7702
authorization bump are modelled; (3) execution-induced CREATE bump is not). A same-block
follow-up tx that the filter admits is then NonceTooLow in revm → executor panic → halt.
Reproduced (unit-level): filter admits [tx1, tx2], revm returns NonceTooLow{tx:1,state:2}.

This drops every later same-block tx from an account delegated earlier in the block
(halt-safe over-rejection), keeping the NonceTooLow → panic path unreachable for this
vector.

• Known gap (documented in code): does not cover an account already delegated at block
  start that is then called via an inner call the filter cannot see; closing that fully would
  require rejecting all delegated-EOA txs, which breaks legitimate 7702. The complete fix is
  executor-side (do not panic on a tx-level InvalidTransaction) — tracked in #838 / #823.
• Not RPC-reachable: the required future-nonce follow-up tx is parked in reth's queued
  sub-pool and never proposed, so this vector needs a byzantine block proposer, not an
  ordinary RPC user (analysis in #838).

2. onchain_config/metadata_txn — return Result instead of .unwrap()

The free transact_system_txn helper returned (SystemTxnResult, EvmState) and .unwrap()ed
transact_raw. It now returns Result. Defensive only — no production caller today (the live
path uses the executor method), so wiring it into the live path later cannot reintroduce a
halt.

3. onchain_config/types — saturating voting-power casts (gravity-audit#823)

Validator voting-power to::<u64/u128>() (panics on overflow) → saturating_to + a saturating
fold, so a pathological votingPower cannot overflow-panic on the epoch-boundary
NewEpochEvent path. A safety net: the clamp is only reachable above ~1.8e19 tokens for a
single validator (far past total supply).

Verification

Built and run on a Prague single-node devnet:

• 28 tx_filter unit tests pass, including a new test_filter_drops_later_tx_from_in_block_delegated_authority; no regression in the existing 27.
• Prague e2e suite passes. The only "failure" is the halt-repro test (test_eip7702_authority_nonce_halt) correctly not halting on the fixed binary (head 574→735, setcode mined, stale tx dropped) — an inverted test whose "failure" confirms the fix. All P-B 7702, fix/survival, cross-account, and EIP-2935 tests pass.

Also folded in — oracle replay-revert log level (was #359)

Absorbs the standalone #359 into this execute-layer PR (closing #359). On mainnet a
benign system-tx revert was logged at ERROR: a duplicate / already-committed oracle
attestation rejected by NativeOracle's sequential-nonce replay guard
(NonceNotSequential, selector 0x32e429cd; legacy NonceNotIncreasing 0xc778b1a4) —
the guard working as intended. This tripped alerting and masked real failures.

execute_ordered_block now decodes the revert selector, classifies severity, and logs
recoverable system-tx reverts at WARN; unknown / fatal reverts stay ERROR.
Touches lib.rs (the log site) + onchain_config/errors.rs (selector decode + severity).
Compiles clean (cargo check -p reth-pipe-exec-layer-ext-v2).

Related

• fix(exec): close EIP-7702 cross-account nonce halt + harden recoverable-error panics #385 — the block-order filter this stacks on (EIP-7702 authorization-bump halt, #822).
• gravity-audit#838 — the CREATE-bump variant this stopgaps + its byzantine-only reachability.
• gravity-audit#823 — the durable executor-side fix (graceful handling instead of panic).
• fix(execute): decode NativeOracle NonceNotSequential; log oracle-nonce replay reverts at WARN not ERROR #359 — oracle replay-revert log level, folded into this PR (closed as standalone).

🤖 Generated with Claude Code