fix: disallow account creation for core resources address

Author: andygolay

aptos-move/framework/aptos-framework/sources/account.move

@@ -201,7 +201,7 @@ module aptos_framework::account {
 
         // NOTE: @core_resources gets created via a `create_account` call, so we do not include it below.
         assert!(
-            new_address != @vm_reserved && new_address != @aptos_framework && new_address != @aptos_token,
+            new_address != @vm_reserved && new_address != @aptos_framework && new_address != @aptos_token && new_address != @0xa550c18,
             error::invalid_argument(ECANNOT_RESERVED_ADDRESS)
         );
 
@@ -1573,4 +1573,10 @@ module aptos_framework::account {
         let event = CoinRegisterEvent { type_info: type_info::type_of<SadFakeCoin>() };
         assert!(!event::was_event_emitted_by_handle(eventhandle, &event), 3);
     }
+
+    #[test]
+    #[expected_failure(abort_code = 65541, location = Self)]
+    public entry fun test_cannot_create_account_at_core_resources_address() {
+        create_account(@0xa550c18);
+    }
 }

aptos-move/framework/aptos-framework/sources/genesis.move

@@ -529,7 +529,9 @@ module aptos_framework::genesis {
         assert!(coin::balance<AptosCoin>(addr0) == 12345, 2);
     }
 
+    /// Expected to fail after post-l1-merge release; it's okay because we will not regenesis.
     #[test(aptos_framework = @0x1, root = @0xabcd)]
+    #[expected_failure(abort_code = 65541, location = aptos_framework::account)]
     fun test_create_root_account(aptos_framework: &signer) {
         use aptos_framework::aggregator_factory;
         use aptos_framework::object;