FIP Implementation: Add support for EIP-7702 (Set Code for EOAs)

[snissn]

• Description
This PR completes the EIP‑7702 EthAccount + ref‑fvm migration in builtin‑actors. Delegation state is moved into the EthAccount actor, the EVM actor is minimalized to expose an
InvokeAsEoaWithRoot trampoline and EXTCODE* pointer virtualization, and together with ref‑fvm’s VM intercept this yields atomic “apply authorizations + execute outer call” semantics and
chain‑wide delegated execution for EOAs while preserving FEVM safety.

Related FIP PR link: filecoin-project/FIPs#1209
Related LOTUS PR link: filecoin-project/lotus#13408

Core behaviors

• EthAccount delegation state and atomic ApplyAndCall
  • Extends EthAccount state with delegate_to: Option, auth_nonce: u64, and evm_storage_root: Cid, making delegation, nonces, and authority storage global per‑EOA instead
    of EVM‑local.
  • Implements EthAccount.ApplyAndCall (FRC‑42) as the atomic EIP‑7702 entrypoint: validates an authorizationList, persists delegate_to + auth_nonce receiver‑only, and then executes
    the outer call in a single transaction. Mapping and nonce bumps persist even when the outer call reverts; the actor always exits with ExitCode::OK and returns embedded status +
    output_data.
  • Enforces receiver‑only semantics for now: all tuples must authorize the EthAccount that is the message receiver; mixed authorities are rejected.
  • Enforces a placeholder tuple cap of 64 entries per message and rejects duplicate authorities within a single authorizationList.
• VM intercept + EVM trampoline for delegated CALLs (authority context)
  • Introduces an InvokeAsEoaWithRoot trampoline on the EVM actor, used only by ref‑fvm’s VM intercept (not callable from user code) to execute delegated bytecode under authority
    context.
  • InvokeAsEoaWithRoot mounts the authority’s evm_storage_root, sets an in_authority_context flag in the EVM System, executes delegate bytecode with explicit (caller, receiver, value,
    input), and returns (output_data, new_storage_root) on success.
  • On Outcome::Return, the trampoline flushes and persists the updated storage root and restores the original contract storage; on Outcome::Revert, it restores the original storage,
    encodes the revert payload as raw bytes, and returns an unchecked error with EVM_CONTRACT_REVERTED so the VM can map it back to a reverted CALL with proper RETURNDATASIZE /
    RETURNDATACOPY semantics.
  • Authority context rules enforced in the interpreter: when in_authority_context is true, delegation is not re‑followed (depth limit = 1), and SELFDESTRUCT is treated as a no‑op for
    authority storage and balance (no tombstones, no balance moves).
• Pointer code and EXTCODE* virtualization for delegated EOAs
  • Adds shared EIP‑7702 helpers in fil_actors_evm_shared::eip7702 for the delegation indicator code:
    • EIP7702_MAGIC = 0xEF01, EIP7702_VERSION = 0x00.
    • is_eip7702_code and eip7702_delegate_address for detecting and parsing 0xEF 0x01 0x00 || delegate(20).
  • Extends the EVM interpreter’s EXTCODE* instructions to consult a new runtime helper Runtime::get_eth_delegate_to(ActorID) -> Option<[u8; 20]> when the target resolves to an
    EthAccount / account‐like actor:
    • For delegated EOAs A→B, EXTCODESIZE(A) returns 23, EXTCODECOPY(A,0,0,23) returns 0xEF 0x01 0x00 || B(20), and EXTCODEHASH(A) returns keccak(pointer_code).
    • Non‑delegated EOAs behave as before (size/hash/copy of empty code).
  • Implements decode‑robust EXTCODEHASH semantics: failure to convert the keccak hash into a BytecodeHash returns illegal_state instead of panicking; EXTCODE* never uses unwrap/expect
    along the delegated path.

Signature and domain

• AuthorizationKeccak signing domain
  • Uses the EIP‑7702 authorization domain separator 0x05 and defines the signing preimage as:
    • AuthorizationKeccak = keccak256(0x05 || rlp([chain_id, address(20), nonce])).
  • EthAccount::recover_authority reconstructs this preimage, hashes it, and applies recover_secp_public_key to derive the authority’s Ethereum address (last 20 bytes of the keccak of
    the uncompressed pubkey).
• Signature validity requirements
  • yParity ∈ {0,1}; other values are rejected as illegal_argument.
  • Accepts minimally‑encoded big‑endian r/s with lengths 1..32 bytes; left‑pads them to 32 bytes to form the r || s || v signature.
  • Rejects r/s with length >32 bytes, as well as zero r or zero s, with precise illegal_argument errors.
  • Enforces the usual low‑s condition by comparing s against secp256k1 n/2 after left‑padding to 32 bytes.
• Chain ID rules
  • chain_id must be 0 or match the local rt.chain_id(); all other values are rejected as illegal_argument("invalid chain id").

Pre‑existence policy and safety

• Pre‑existence and authority restrictions
  • For each tuple in authorizationList, EthAccount.ApplyAndCall resolves the recovered authority to an ID‑address and rejects the tuple if the authority resolves to an EVM contract
    actor (builtin type == EVM), mirroring the “code must be empty/pointer” rule.
  • Rejects duplicate authority entries within a single message to avoid ambiguous nonce semantics.
  • Current behavior is receiver‑only: authority must equal the EthAccount’s own EOA address; tuples authorizing other accounts are rejected as illegal_argument.
• Authority context safety invariants
  • VM intercept uses InvokeAsEoaWithRoot to execute delegated code with depth=1; when in_authority_context is set, the EVM interpreter does not re‑follow delegation or recurse into
    additional authority contexts.
  • In authority context, SELFDESTRUCT is a no‑op with respect to the authority’s mapping and balance; state and balances remain intact and only the delegated code’s regular storage
    updates are considered.
  • Delegated CALL revert data is surfaced as revert payloads via EVM_CONTRACT_REVERTED; callers observe success=0, correct RETURNDATASIZE, and non‑zero‑fill RETURNDATACOPY behavior.

Gas behavior

• ApplyAndCall and outer call
  • EthAccount.ApplyAndCall forwards all remaining gas to the outer call (no 63/64 cap), matching Ethereum’s top‑level behavior. The FVM send is invoked with no explicit gas limit,
    letting the VM forward the full available budget.
  • The outer call can target either an EVM contract (via the InvokeEVM entrypoint) or a non‑EVM actor (via METHOD_SEND with no params); in both cases, the callee’s ExitCode is mapped
    into the embedded status field while EthAccount itself always returns ExitCode::OK.
• Subcalls and delegated execution
  • Inside the EVM interpreter, CALL/STATICCALL still honor EIP‑150’s 63/64 gas clamp; nothing in this PR changes the subcall gas model.
  • Emission of the synthetic Delegated(address) event from the VM intercept is best‑effort: under extreme gas tightness, the event may be dropped in favor of preserving callee execution
    budget.
• Refunds
  • Refund plumbing hooks are staged in the actor code but use conservative placeholder caps; numeric refund constants and their integration with Lotus’ gas estimation will be finalized
    once the EIP‑7702 gas schedule settles.

New capabilities

• EthAccount.ApplyAndCall entrypoint implementing EIP‑7702 atomic “apply + call” semantics for EOAs, with receiver‑only, per‑EOA nonce tracking, and persistent delegation mapping.
• EIP‑7702 delegation indicator code helpers (0xEF 0x01 0x00 || delegate(20)) shared between EthAccount, EVM, and ref‑fvm.
• EVM InvokeAsEoaWithRoot trampoline used by the VM intercept to run delegate code under authority context with a separate authority storage root.
• EXTCODESIZE/HASH/COPY virtualization for delegated EOAs, driven by the new get_eth_delegate_to runtime helper.
• Internal persistence of EIP‑7702 state in EthAccount: delegate_to, auth_nonce, and evm_storage_root, with mapping and nonces persisting even when outer calls revert.

Testing
EthAccount / ApplyAndCall

• Happy‑path ApplyAndCall: tuples validate, delegation mapping and nonces update, and the outer call returns embedded status and output_data that reflect the callee’s exit code and return
  value.
• Tuple validation negatives: invalid chainId (not 0 or local), invalid yParity, zero or over‑32‑byte r/s, high‑s values, empty authorizationList, and lists exceeding the tuple cap (64)
  all fail with explicit illegal_argument errors.
• Nonce and receiver semantics: first‑time authorities default to nonce 0; applying nonce 0 initializes tracking, and subsequent tuples must match the stored nonce. Receiver‑mismatched
  authorities and duplicate authorities in a single message are rejected.
• Pre‑existence policy: delegations are rejected when the recovered authority resolves to an EVM contract actor.
• Atomicity: mapping and nonce increments persist even when the outer call reverts (status=0); unit tests assert that delegation state is not rolled back on outer‑call failure.
• Value transfer: when value transfer to the EVM callee fails, ApplyAndCall returns status=0 and propagates revert data via the embedded return structure, while keeping the delegation
  mapping and nonces intact.
• Outer call routing: tests cover routing to EVM contracts via InvokeEVM (with calldata round‑trip) and to non‑EVM actors via METHOD_SEND, asserting that status/returndata are mapped
  correctly.

EVM / delegated context and EXTCODE*

• Pointer semantics: unit tests validate that for A→B delegation, EXTCODESIZE(A) == 23, EXTCODECOPY returns 0xEF 0x01 0x00 || B(20), and EXTCODEHASH(A) equals keccak(pointer_code) when
  get_eth_delegate_to returns a delegate. Non‑delegated EOAs and not‑found addresses still behave as empty code.
• Authority context: tests exercise InvokeAsEoaWithRoot to ensure the authority storage root is mounted, updated on success, restored on revert, and that in_authority_context prevents
  nested delegation and treats SELFDESTRUCT as a no‑op for authority mapping and balances.
• Decode robustness: EXTCODEHASH and delegated paths avoid unwrap/expect; failures to construct BytecodeHash or encode revert payloads surface as illegal_state errors rather than panics.

Implementation notes

• Delegation state is now owned by EthAccount and globally visible; the historical EVM‑local delegation map, per‑authority nonce map, and per‑authority storage root maps have been removed.
• The EVM actor is minimalized for 7702: InvokeAsEoa and ApplyAndCall are removed from the live dispatch (only stubs remain for binary method‑number compatibility), and all delegated
  execution goes through InvokeAsEoaWithRoot invoked by the VM intercept.
• Delegation bytecode magic and version are centralized in fil_actors_evm_shared::eip7702 as EIP7702_MAGIC / EIP7702_VERSION, and used consistently by EXTCODE* and tests.
• The Delegated(address) event (topic keccak("Delegated(address)"), data = 32‑byte ABI word with the authority address in the last 20 bytes) is emitted by ref‑fvm’s VM intercept;
  builtin‑actors provides the authority context and pointer semantics that the VM relies on.
• EIP‑7702 is always active in this bundle; there is no runtime network‑version gating on this branch. Activation is via bundle deployment only.

Remaining TODOs

• Finalize refund constants and wire them through to Lotus’ gas estimation once the EIP‑7702 gas schedule is stable; keep current behavior conservative and purely behavioral.
• Continue tightening invariants and API shapes: prefer explicit error paths over decode leniency and keep illegal_state for any malformed delegated metadata observed inside the actor.
• Maintain and extend ApplyAndCall CBOR fuzzing to cover additional edge cases and ensure R/S padding interop with Lotus’ minimally‑encoded signatures.
• Expand EthAccount/EVM storage‑lifecycle coverage (multi‑delegate switch and clear‑then‑re‑delegate scenarios) to fully lock in authority storage semantics.
• End‑to‑end validation with Lotus + ref‑fvm once the updated wasm bundle is integrated: verify receipts attribution (authorizationList, delegatedTo, Delegated(address)), atomic status
  propagation from the embedded return, delegated CALL behavior, and gas/refund behavior through JSON‑RPC.
• Coordinate with the parallel FIP track for tipset‑wide multi‑stage execution (reserve‑then‑refund gas model) to prevent same‑account drain‑then‑burn and avoid miner‑charged gas in
  pathological 7702 flows.

This PR brings builtin‑actors into alignment with the EthAccount‑centric, VM‑intercept‑driven EIP‑7702 design: atomic apply‑and‑call transactions, globally consistent delegation semantics
for EOAs, and EXTCODE* pointer projection are all implemented in a way that is consistent with Ethereum where possible and safe under the FEVM execution and gas model.

[snissn]

I added a test that confirms that the evm actor is the wrong context to store the account -> delegate mapping. The evm actor has one instance per smart contract not a global scope. Next i'll move the mapping to the ethaddress actor and move delegation logic to the fvm repo

commit:
ffb7c97

summary:

• Setup a VM and an “authority” EOA A
  - Build a standalone TestVM with system singletons: ../builtin-actors/test_vm/src/lib.rs:126
  - Derive A’s 20-byte ETH address from a fixed pubkey so it’s deterministic: ../builtin-actors/actors/evm/tests/
  eoa_pointer_mapping_global.rs:60
  - Make A resolve as an account (not a contract) by installing a placeholder actor with A’s delegated f4: ../builtin-
  actors/actors/evm/tests/eoa_pointer_mapping_global.rs:68

  • Deploy three EVM actors: M, C, D
    • Helper creates EVM actors via EAM.CreateExternal and returns ID + ETH address: ../builtin-actors/actors/evm/tests/
      eoa_pointer_mapping_global.rs:33
    • M (manager) — where we’ll apply the mapping: ../builtin-actors/actors/evm/tests/eoa_pointer_mapping_global.rs:85
    • C (caller) — tiny contract that returns EXTCODESIZE(A): ../builtin-actors/actors/evm/tests/
      eoa_pointer_mapping_global.rs:88, ../builtin-actors/actors/evm/tests/eoa_pointer_mapping_global.rs:103
    • D (delegate) — code doesn’t matter for EXTCODESIZE: ../builtin-actors/actors/evm/tests/
      eoa_pointer_mapping_global.rs:106
  • Make the inner signature recover to A
    • Override TestVM’s secp pubkey recovery so any signature resolves to our fixed pubkey (hence authority A): ../
      builtin-actors/actors/evm/tests/eoa_pointer_mapping_global.rs:109
  • Apply A→D via ApplyAndCall on M
    • Build a single tuple (chain_id=0, yParity=0, r/s dummy bytes, delegate=D) with nonce=0: ../builtin-actors/actors/
      evm/tests/eoa_pointer_mapping_global.rs:113
    • Call M.ApplyAndCall with a no-op outer call so only delegation is applied: ../builtin-actors/actors/evm/tests/
      eoa_pointer_mapping_global.rs:126
  • From C, check EXTCODESIZE(A)
    • Invoke C with input selecting the EXTCODESIZE(A) branch: ../builtin-actors/actors/evm/tests/
      eoa_pointer_mapping_global.rs:139
    • Decode return bytes and read the size: ../builtin-actors/actors/evm/tests/eoa_pointer_mapping_global.rs:160
    • Assert it equals 23 — the size of the 7702 pointer code “0xEF 0x01 0x00 || 20-byte delegate”: ../builtin-actors/
      actors/evm/tests/eoa_pointer_mapping_global.rs:166

  Why it fails today (and that’s the point)

  • The 7702 mapping is stored in M’s local state. C’s EXTCODESIZE(A) consults C’s local map (empty), so it returns 0
    instead of 23.
  • This proves the map is per-contract, not global/singleton as AGENTS.md specifies.