Update EIP-7702: Proxy the storage of a delegation to its unique deleterminstic keys

EIPS/eip-7702.md

@@ -117,9 +117,22 @@
 
 An alternative to adding chain ID could be to sign over the code the address points to. This seems to have the benefit of both minimizing the on-chain size of auth tuples while retaining specificity of the actual code running in the account. One unfortunate issue of this format though is that it imposes a database lookup to determine the signer of each auth tuple. This imposition itself seems to create enough complexity in transaction propagation that it is decided to avoid and simply sign over address directly.
 
+#### Delegation Storage
+
+Considering that the delegation from one contract to another contract may cause conflicts and corrupt the storage with a broken contract at the least and a compromised contract at the worst, it is prudent to separate the storage of each delegation in deterministic way.
+
+To this effect, the delegated EOA's storage keys should be proxied (accessed or written) at `keccak256(key||address)`. So essentially we use this key modification for `SLOAD` and `SSTORE` operations for the delegated EOA's orignal key but still writing into EOA storage.
+
+With this method:
+
+* if EOA is delegated to a new address, it (essentially) starts with clean storage
+* if the contract is delegated back to a previous `address`, the EVM will be able to _re-attach_ its old storage.
+
+Again for the purpose of [EIP-158](../eip-158.md) cleanup, this storage should be considered attached to the EOA address.
+
 #### In-protocol revocation
 
-Unlike previous versions of this EIP and EIPs similar, the delegation designation can be revoked at anytime signing and sending a EIP-7702 authorization to a new target with the account's current nonce. Without such action, a delegation will remain valid in perpetuity.
+Unlike previous versions of this EIP, the delegation designation can be revoked at anytime by signing and sending an EIP-7702 authorization to a new target with the account's current nonce. Without such action, a delegation will remain valid in perpetuity.
 
 ### Self-sponsoring: allowing `tx.origin` to set code
 
@@ -166,14 +179,14 @@
 
 ### Secure delegation
 
 The following is a non-exhaustive list of checks/pitfalls/conditions that delegate contracts *should* be wary of and require a signature over from the account's authority:
 
  * Replay protection -- (ex. a nonce) should be implemented by the delegate and signed over. Without it, a malicious actor can reuse a signature, repeating its effects.
  * `value` -- without it, a malicious sponsor could cause unexpected effects in the callee.
  * `gas` -- without it, a malicious sponsor could cause the callee to run out of gas and fail, griefing the sponsee.
  * `target` / `calldata` -- without them, a malicious actor may call arbitrary functions in arbitrary contracts.
 
 A poorly implemented delegate can *allow a malicious actor to take near complete control over a signer's EOA*.
 
 ### Setting code as `tx.origin`