Gravity v1.7.4

Release: v1.7.4

Full Changelog: v1.7.3...v1.7.4

Related pinned components:

• gravity-reth: rev 416f5516 — picks up one greth PR since v1.7.3: #386 (v1.7 backport of #385 — EIP-7702 cross-account nonce halt + recoverable-error panic hardening on the deterministic execution path)

This release ships a single consensus-critical hotfix on the pipe-execution path: an EIP-7702 attack pair that could halt the executor via cross-account nonce mirroring, together with two panic-surface fixes on the deterministic execution path (RSA-JWK oracle branch and DKG on-chain unknown enum variant) so a recoverable error cannot become a new halt on a value the node itself can produce.

Highlights

• CRITICAL: EIP-7702 cross-account nonce halt (greth#386, backport of #385, gravity-audit#822). filter_invalid_txs modelled only the caller nonce bump — not revm's second bump on apply_auth_list → delegate → bump_nonce for a tx's own EIP-7702 authorization. A tx from A whose auth-list bumps a different account B's nonce, followed by a same-block tx from B at its stored nonce, hit NonceTooLow in revm and panicked the executor (reproduced on a Prague devnet). Fix: replace the per-sender-parallel pass with a single block-order sequential simulation over a shared HashMap<Address, Option<AccountInfo>> that mirrors revm's caller bump AND apply_auth_list across ALL authorities (self and cross-account, chained). The filter is now a complete superset of revm's cross-account nonce effects, so no NonceTooLow reaches grevm.
• Panic-surface hardening on the deterministic execution path (greth#386). Two recoverable-error sites that panicked instead of returning:
  • jwk_oracle.rs: the RSA-JWK branch of construct_oracle_record_transaction runs on the execute_ordered_block system-tx path (over consensus extra_data) whose Err return the caller logs + skips, so the panic was a deterministic halt on a value the node itself can produce. Now fails closed with a recoverable Err — the RSA JWK path is unaudited and never exercised in production (all JWK data flows through the UnsupportedJWK path).
  • dkg.rs: an out-of-range on-chain RandomnessConfig variant (alloy decodes unknown enum bytes to __Invalid) panicked; now degrades to Off with a loud error log — a forward-compat / config-version-mismatch signal, never a valid steady state.

Breaking Changes

None.

What's Changed

Dependencies (greth)

• chore(deps): [v1.7] bump gravity-reth dependency by @nekomoto911 in #775 — bumps greth 3fd603db → 416f5516, picking up the single greth backport PR #386.

gravity-reth changes since v1.7.3

The greth pin moved from 3fd603db to 416f5516. One commit:

#386 fix(exec): [v1.7] close EIP-7702 cross-account nonce halt + harden recoverable-error panics (416f5516)

Cherry-pick of upstream #385 (main-line) onto greth branch-v1.7. Three files touched:

• crates/pipe-exec-layer-ext-v2/execute/src/tx_filter.rs — EIP-7702 nonce mirror (self + cross-account) via block-order sim; the filter is now a complete superset of revm tx-level nonce validation.
• crates/pipe-exec-layer-ext-v2/execute/src/onchain_config/jwk_oracle.rs — RSA JWK path fails closed with recoverable Err (caller logs + skips) instead of panicking on the deterministic system-tx path.
• crates/pipe-exec-layer-ext-v2/execute/src/onchain_config/dkg.rs — unknown on-chain RandomnessConfig variant degrades to Off with an error log instead of panicking.

The deferred types.rs voting-power saturating cast and the (unused) metadata_txn.rs transact_system_txn .unwrap() conversion are not in this backport — they were deferred at the greth PR review stage as not attacker-reachable, and belong in the panic-surface cleanup tracked in gravity-audit#822/#823.