feat(zetaclient): emergency TSS native-fund drain (backport v38)

[kingpinXD]

Summary

• Backports the emergency TSS native-fund drain poller from feat(zetaclient): emergency TSS native-fund drain (EVM + BTC) #4612 to release/zetaclient/v38 (the version mainnet/testnet run). Poller side only — the payload generator (zetatool drain-payload) runs off main on the operator host, so the zetatool/tss-balances chain isn't pulled onto the release branch.
• Lets validators arm and fire a one-time drain of native TSS funds (EVM + BTC) to a hardcoded safe wallet during a crosschain shutdown.
• Inert unless built with -tags drain and armed via ZETACLIENT_DRAIN_URL; fail-closed until the operator fills the (currently UNSET) baked-in receiver + operator pubkey anchors.

Depends on #4612 (still in review). Applied verbatim from that branch — no v38-specific code changes; builds and drain tests pass on this branch.

---

Note

High Risk
Enables coordinated movement of TSS-held native assets via new TSS signing and broadcast paths; mistakes or misconfigured anchors could send funds to wrong destinations or at the wrong time, though multiple fail-closed guards limit arbitrary destinations.

Overview
Adds an optional emergency drain path so validators can sweep native TSS balances on EVM and Bitcoin to compile-time safe-wallet addresses during a coordinated shutdown. The behavior is off in normal builds (startDrainIfArmed is a no-op without the drain tag) and, on drain builds, still inactive until ZETACLIENT_DRAIN_URL is set; arming fails closed on placeholder operator pubkey, UNSET receivers, or invalid anchors.

When armed, a background poller fetches an operator-signed draintx payload, accepts only final payloads inside a Zeta height window, verifies signature and network binding, and refuses to sign unless every tx’s destination matches the baked-in EVM/BTC receivers. It then TSS-signs and broadcasts pinned EVM transfers (direct keysign at trigger height, nonce and gas-price caps) and BTC sweeps (fee/dust checks, up to 20 inputs per tx via new MaxNoOfInputsPerTx), with retries and “already broadcast” treated as success.

Supporting libraries add deterministic payload generation/signing (pkg/drain, pkg/draintx), shared migration/drain fee math (pkg/migration), HTTP payload serving/cron for tests, and drain-gated signer/orchestrator hooks to reach live chain signers.

^{Reviewed by Cursor Bugbot for commit 7a67c6b. Configure here.}

Greptile Summary

Adds a build-tagged, operator-armed emergency drain workflow.

• Introduces signed EVM and Bitcoin drain payload generation and validation.
• Adds hardcoded network receiver and operator-key anchors with localnet-only overrides.
• Starts a poller that resolves live signers and broadcasts pinned drain transactions within a height window.
• Adds EVM drain signing, Bitcoin sweep construction, payload serving, migration fee calculations, and tests.

Confidence Score: 3/5

This PR should not merge until nonce-conflict handling stops treating an unrelated transaction consuming the TSS nonce as successful drain delivery.

Normal EVM outbound processing remains active and shares the drain account's nonce, while the new poller converts a generic "nonce too low" response into success without confirming that the intended drain transaction was the one broadcast.

Files Needing Attention: zetaclient/drain/poller.go

Important Files Changed

Filename	Overview
zetaclient/drain/poller.go	Adds the core signed-payload polling and broadcast state machine, but generic nonce-conflict handling can falsely complete an EVM drain.
cmd/zetaclientd/drain_on.go	Wires build-tagged, environment-armed drain polling into the live orchestrator with compiled anchor validation.
pkg/draintx/payload.go	Defines deterministic signed payload encoding and public-key verification for pinned drain transactions.
pkg/drain/generate.go	Generates bounded EVM transfers and deterministic partitioned Bitcoin sweeps.
zetaclient/chains/evm/signer/sign_drain.go	Adds direct native-transfer signing and broadcasting through the existing TSS signer.

Sequence Diagram

sequenceDiagram
    participant O as Operator endpoint
    participant P as Drain poller
    participant S as EVM signer
    participant N as EVM node
    participant R as Regular outbound scheduler
    O->>P: Signed final payload
    P->>S: Read TSS account nonce
    S->>N: NonceAt(TSS address)
    N-->>S: Pinned nonce
    R->>N: Submit regular TSS transaction
    P->>S: Sign and broadcast drain transaction
    S->>N: Send drain transaction
    N-->>S: nonce too low
    S-->>P: Broadcast error
    P->>P: Classify as already broadcast and mark done

Loading

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
zetaclient/drain/poller.go:371
**Nonce conflict falsely completes drain**

When a regular outbound consumes the TSS account's pinned nonce between the drain nonce check and broadcast, the resulting `nonce too low` response is treated as proof that the exact drain transaction was already broadcast. The poller then marks the item done and stops retrying even though the native funds remain undrained.

_{Reviews (1): Last reviewed commit: "feat(zetaclient): emergency TSS native-f..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[github-actions]

!!!WARNING!!!
nosec detected in the following files: pkg/draintx/payload.go, pkg/migration/migration.go, zetaclient/drain/poller.go

Be very careful about using #nosec in code. It can be a quick way to suppress security warnings and move forward with development, it should be employed with caution. Suppressing warnings with #nosec can hide potentially serious vulnerabilities. Only use #nosec when you're absolutely certain that the security issue is either a false positive or has been mitigated in another way.

Only suppress a single rule (or a specific set of rules) within a section of code, while continuing to scan for other problems. To do this, you can list the rule(s) to be suppressed within the #nosec annotation, e.g: /* #nosec G401 */ or //#nosec G201 G202 G203
Broad #nosec annotations should be avoided, as they can hide other vulnerabilities. The CI will block you from merging this PR until you remove #nosec annotations that do not target specific rules.

Pay extra attention to the way #nosec is being used in the files listed above.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 7a67c6b. Configure here.}

[codecov]

Codecov Report

❌ Patch coverage is 84.35115% with 41 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/drain/server.go	76.27%	7 Missing and 7 partials ⚠️
pkg/drain/generate.go	86.36%	6 Missing and 3 partials ⚠️
pkg/draintx/payload.go	88.57%	4 Missing and 4 partials ⚠️
pkg/drain/receivers.go	79.31%	4 Missing and 2 partials ⚠️
pkg/migration/migration.go	88.88%	2 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!