AddLockSig gas griefing against solver

[arkoc]

Report from Hexens

When a user deposits funds via the commit function and provides a signature, the relayer calls
the addLockSig function to verif y the signature and then initializes the hashlock and timelock.
If htlc.sender is a contract, the function calls isValidSignature to verif y the signature using the
ERC-1271 standard.

Additionally, with the recent EIP-7702: Set Code for EOAs update, externally owned accounts
(EOAs) can now temporarily act as smart contracts.
An attacker could exploit this logic by triggering a call to isValidSignature and deploying a
contract with meaningless or gas-intensive logic. This causes the relayer to unnecessarily
consume gas executing the attacker's contract code.

The above code executes the solver's addLockSig function, and since there are no restrictions
on gas usage, there is a potential risk that the relayer's gas could be completely exhausted.

Remediation:
Consider to employ some limit to the amount of gas for the transaction in the solver code, as
automatic estimation might lead to gas griefing.