check for maybe EOA at start and spawn

packages/contracts/src/libraries/LibUtils.sol

@@ -137,4 +137,13 @@ library LibUtils {
     }
     return false;
   }
+
+  /**
+   * @dev Only meant as a temporary measure:
+   * can be circumvented (although it's harder if the check is used across 2+ txs),
+   * and doesn't combine well with account abstraction
+   */
+  function isMaybeEOA(address target) internal view returns (bool) {
+    return target.code.length == 0;
+  }
 }

packages/contracts/src/systems/progression/SpawnSystem.sol

@@ -12,6 +12,7 @@ contract SpawnSystem is System {
    */
   function spawn(string memory _name) public returns (bytes32 playerEntity) {
     require(!LibUtils.stringEq(_name, ""), "name empty");
+    require(LibUtils.isMaybeEOA(_msgSender()), "sender not EOA");
 
     playerEntity = LibUtils.addressToEntityKey(_msgSender());
 

packages/contracts/src/systems/progression/StartSystem.sol

@@ -13,6 +13,8 @@ contract StartSystem is System {
    * @return podEntity Id of pod entity
    */
   function start() public returns (bytes32 podEntity) {
+    require(LibUtils.isMaybeEOA(_msgSender()), "sender not EOA");
+
     bytes32 playerEntity = LibUtils.addressToEntityKey(_msgSender());
 
     // todo: check that player is spawned