solana: Durable nonce transactions resulting in an instruction error allow fee theft

Problem

Solana typically charges fees on transactions which succeed or fail with an InstructionError. In the event of the latter, the state of every modified account is also rolled back to before execution. Since a durable nonce transaction advances the stored nonce with an instruction, if the transaction fails with an InstructionError, the old stored nonce is replaced. Due to durable nonces having arbitrary lifetimes, it is infeasible to maintain a signature blacklist against each nonce value, ala. StatusCache. As such, these failed transactions can be replayed and fees charged until the stored nonce value is successfully advanced.

Proposed Solution

The stored nonce MUST advance whenever the account state or balance changes, including paying fees. This can be achieved by always storing the updated nonce accounts.

Alternatively, the stored nonce can be advanced outside the program. If this path is chosen, moving the durable nonce feature into system program should be considered.

cc/ @rob-solana