mirror of
https://github.com/serai-dex/serai.git
synced 2025-12-08 20:29:23 +00:00
Slash malevolent validators (#294)
* add slash tx * ignore unsigned tx replays * verify that provided evidence is valid * fix clippy + fmt * move application tx handling to another module * partially handle the tendermint txs * fix pr comments * support unsigned app txs * add slash target to the votes * enforce provided, unsigned, signed tx ordering within a block * bug fixes * add unit test for tendermint txs * bug fixes * update tests for tendermint txs * add tx ordering test * tidy up tx ordering test * cargo +nightly fmt * Misc fixes from rebasing * Finish resolving clippy * Remove sha3 from tendermint-machine * Resolve a DoS in SlashEvidence's read Also moves Evidence from Vec<Message> to (Message, Option<Message>). That should meet all requirements while being a bit safer. * Make lazy_static a dev-depend for tributary * Various small tweaks One use of sort was inefficient, sorting unsigned || signed when unsigned was already properly sorted. Given how the unsigned TXs were given a nonce of 0, an unstable sort may swap places with an unsigned TX and a signed TX with a nonce of 0 (leading to a faulty block). The extra protection added here sorts signed, then concats. * Fix Tributary tests I broke, start review on tendermint/tx.rs * Finish reviewing everything outside tests and empty_signature * Remove empty_signature empty_signature led to corrupted local state histories. Unfortunately, the API is only sane with a signature. We now use the actual signature, which risks creating a signature over a malicious message if we have ever have an invariant producing malicious messages. Prior, we only signed the message after the local machine confirmed it was okay per the local view of consensus. This is tolerated/preferred over a corrupt state history since production of such messages is already an invariant. TODOs are added to make handling of this theoretical invariant further robust. * Remove async_sequential for tokio::test There was no competition for resources forcing them to be run sequentially. * Modify block order test to be statistically significant without multiple runs * Clean tests --------- Co-authored-by: Luke Parker <lukeparker5132@gmail.com>
This commit is contained in:
akildemir
GitHub
375
coordinator/tributary/src/tendermint/mod.rs
Normal file
375
coordinator/tributary/src/tendermint/mod.rs
Normal file
@@ -0,0 +1,375 @@
|
||||
use core::ops::Deref;
|
||||
use std::{sync::Arc, collections::HashMap};
|
||||
|
||||
use async_trait::async_trait;
|
||||
|
||||
use subtle::ConstantTimeEq;
|
||||
use zeroize::{Zeroize, Zeroizing};
|
||||
|
||||
use rand::{SeedableRng, seq::SliceRandom, rngs::OsRng};
|
||||
use rand_chacha::ChaCha12Rng;
|
||||
|
||||
use transcript::{Transcript, RecommendedTranscript};
|
||||
|
||||
use ciphersuite::{
|
||||
group::{
|
||||
GroupEncoding,
|
||||
ff::{Field, PrimeField},
|
||||
},
|
||||
Ciphersuite, Ristretto,
|
||||
};
|
||||
use schnorr::SchnorrSignature;
|
||||
|
||||
use serai_db::Db;
|
||||
|
||||
use scale::{Encode, Decode};
|
||||
use tendermint::{
|
||||
SignedMessageFor,
|
||||
ext::{
|
||||
BlockNumber, RoundNumber, Signer as SignerTrait, SignatureScheme, Weights, Block as BlockTrait,
|
||||
BlockError as TendermintBlockError, Commit, Network,
|
||||
},
|
||||
SlashEvent,
|
||||
};
|
||||
|
||||
use tokio::{
|
||||
sync::RwLock,
|
||||
time::{Duration, sleep},
|
||||
};
|
||||
|
||||
use crate::{
|
||||
TENDERMINT_MESSAGE, TRANSACTION_MESSAGE, BLOCK_MESSAGE, ReadWrite,
|
||||
transaction::Transaction as TransactionTrait, Transaction, BlockHeader, Block, BlockError,
|
||||
Blockchain, P2p, tendermint::tx::SlashVote,
|
||||
};
|
||||
|
||||
pub mod tx;
|
||||
use tx::{TendermintTx, VoteSignature};
|
||||
|
||||
fn challenge(
|
||||
genesis: [u8; 32],
|
||||
key: [u8; 32],
|
||||
nonce: &[u8],
|
||||
msg: &[u8],
|
||||
) -> <Ristretto as Ciphersuite>::F {
|
||||
let mut transcript = RecommendedTranscript::new(b"Tributary Chain Tendermint Message");
|
||||
transcript.append_message(b"genesis", genesis);
|
||||
transcript.append_message(b"key", key);
|
||||
transcript.append_message(b"nonce", nonce);
|
||||
transcript.append_message(b"message", msg);
|
||||
|
||||
<Ristretto as Ciphersuite>::F::from_bytes_mod_order_wide(&transcript.challenge(b"schnorr").into())
|
||||
}
|
||||
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub struct Signer {
|
||||
genesis: [u8; 32],
|
||||
key: Zeroizing<<Ristretto as Ciphersuite>::F>,
|
||||
}
|
||||
|
||||
impl Signer {
|
||||
pub(crate) fn new(genesis: [u8; 32], key: Zeroizing<<Ristretto as Ciphersuite>::F>) -> Signer {
|
||||
Signer { genesis, key }
|
||||
}
|
||||
}
|
||||
|
||||
#[async_trait]
|
||||
impl SignerTrait for Signer {
|
||||
type ValidatorId = [u8; 32];
|
||||
type Signature = [u8; 64];
|
||||
|
||||
/// Returns the validator's current ID. Returns None if they aren't a current validator.
|
||||
async fn validator_id(&self) -> Option<Self::ValidatorId> {
|
||||
Some((Ristretto::generator() * self.key.deref()).to_bytes())
|
||||
}
|
||||
|
||||
/// Sign a signature with the current validator's private key.
|
||||
async fn sign(&self, msg: &[u8]) -> Self::Signature {
|
||||
let mut nonce = Zeroizing::new(RecommendedTranscript::new(b"Tributary Chain Tendermint Nonce"));
|
||||
nonce.append_message(b"genesis", self.genesis);
|
||||
nonce.append_message(b"key", Zeroizing::new(self.key.deref().to_repr()).as_ref());
|
||||
nonce.append_message(b"message", msg);
|
||||
let mut nonce = nonce.challenge(b"nonce");
|
||||
|
||||
let mut nonce_arr = [0; 64];
|
||||
nonce_arr.copy_from_slice(nonce.as_ref());
|
||||
|
||||
let nonce_ref: &mut [u8] = nonce.as_mut();
|
||||
nonce_ref.zeroize();
|
||||
let nonce_ref: &[u8] = nonce.as_ref();
|
||||
assert_eq!(nonce_ref, [0; 64].as_ref());
|
||||
|
||||
let nonce =
|
||||
Zeroizing::new(<Ristretto as Ciphersuite>::F::from_bytes_mod_order_wide(&nonce_arr));
|
||||
nonce_arr.zeroize();
|
||||
|
||||
assert!(!bool::from(nonce.ct_eq(&<Ristretto as Ciphersuite>::F::ZERO)));
|
||||
|
||||
let challenge = challenge(
|
||||
self.genesis,
|
||||
(Ristretto::generator() * self.key.deref()).to_bytes(),
|
||||
(Ristretto::generator() * nonce.deref()).to_bytes().as_ref(),
|
||||
msg,
|
||||
);
|
||||
|
||||
let sig = SchnorrSignature::<Ristretto>::sign(&self.key, nonce, challenge).serialize();
|
||||
|
||||
let mut res = [0; 64];
|
||||
res.copy_from_slice(&sig);
|
||||
res
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub struct Validators {
|
||||
genesis: [u8; 32],
|
||||
total_weight: u64,
|
||||
weights: HashMap<[u8; 32], u64>,
|
||||
robin: Vec<[u8; 32]>,
|
||||
}
|
||||
|
||||
impl Validators {
|
||||
pub(crate) fn new(
|
||||
genesis: [u8; 32],
|
||||
validators: Vec<(<Ristretto as Ciphersuite>::G, u64)>,
|
||||
) -> Option<Validators> {
|
||||
let mut total_weight = 0;
|
||||
let mut weights = HashMap::new();
|
||||
|
||||
let mut transcript = RecommendedTranscript::new(b"Round Robin Randomization");
|
||||
let mut robin = vec![];
|
||||
for (validator, weight) in validators {
|
||||
let validator = validator.to_bytes();
|
||||
if weight == 0 {
|
||||
return None;
|
||||
}
|
||||
total_weight += weight;
|
||||
weights.insert(validator, weight);
|
||||
|
||||
transcript.append_message(b"validator", validator);
|
||||
transcript.append_message(b"weight", weight.to_le_bytes());
|
||||
robin.extend(vec![validator; usize::try_from(weight).unwrap()]);
|
||||
}
|
||||
robin.shuffle(&mut ChaCha12Rng::from_seed(transcript.rng_seed(b"robin")));
|
||||
|
||||
Some(Validators { genesis, total_weight, weights, robin })
|
||||
}
|
||||
}
|
||||
|
||||
impl SignatureScheme for Validators {
|
||||
type ValidatorId = [u8; 32];
|
||||
type Signature = [u8; 64];
|
||||
// TODO: Use half-aggregation.
|
||||
type AggregateSignature = Vec<[u8; 64]>;
|
||||
type Signer = Arc<Signer>;
|
||||
|
||||
#[must_use]
|
||||
fn verify(&self, validator: Self::ValidatorId, msg: &[u8], sig: &Self::Signature) -> bool {
|
||||
if !self.weights.contains_key(&validator) {
|
||||
return false;
|
||||
}
|
||||
let Ok(validator_point) = Ristretto::read_G::<&[u8]>(&mut validator.as_ref()) else {
|
||||
return false;
|
||||
};
|
||||
let Ok(actual_sig) = SchnorrSignature::<Ristretto>::read::<&[u8]>(&mut sig.as_ref()) else {
|
||||
return false;
|
||||
};
|
||||
actual_sig.verify(validator_point, challenge(self.genesis, validator, &sig[.. 32], msg))
|
||||
}
|
||||
|
||||
fn aggregate(sigs: &[Self::Signature]) -> Self::AggregateSignature {
|
||||
sigs.to_vec()
|
||||
}
|
||||
|
||||
#[must_use]
|
||||
fn verify_aggregate(
|
||||
&self,
|
||||
signers: &[Self::ValidatorId],
|
||||
msg: &[u8],
|
||||
sig: &Self::AggregateSignature,
|
||||
) -> bool {
|
||||
for (signer, sig) in signers.iter().zip(sig.iter()) {
|
||||
if !self.verify(*signer, msg, sig) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
true
|
||||
}
|
||||
}
|
||||
|
||||
impl Weights for Validators {
|
||||
type ValidatorId = [u8; 32];
|
||||
|
||||
fn total_weight(&self) -> u64 {
|
||||
self.total_weight
|
||||
}
|
||||
fn weight(&self, validator: Self::ValidatorId) -> u64 {
|
||||
self.weights[&validator]
|
||||
}
|
||||
fn proposer(&self, block: BlockNumber, round: RoundNumber) -> Self::ValidatorId {
|
||||
let block = usize::try_from(block.0).unwrap();
|
||||
let round = usize::try_from(round.0).unwrap();
|
||||
// If multiple rounds are used, a naive block + round would cause the same index to be chosen
|
||||
// in quick succession.
|
||||
// Accordingly, if we use additional rounds, jump halfway around.
|
||||
// While this is still game-able, it's not explicitly reusing indexes immediately after each
|
||||
// other.
|
||||
self.robin
|
||||
[(block + (if round == 0 { 0 } else { round + (self.robin.len() / 2) })) % self.robin.len()]
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone, PartialEq, Eq, Debug, Encode, Decode)]
|
||||
pub struct TendermintBlock(pub Vec<u8>);
|
||||
impl BlockTrait for TendermintBlock {
|
||||
type Id = [u8; 32];
|
||||
fn id(&self) -> Self::Id {
|
||||
BlockHeader::read::<&[u8]>(&mut self.0.as_ref()).unwrap().hash()
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug)]
|
||||
pub struct TendermintNetwork<D: Db, T: TransactionTrait, P: P2p> {
|
||||
pub(crate) genesis: [u8; 32],
|
||||
|
||||
pub(crate) signer: Arc<Signer>,
|
||||
pub(crate) validators: Arc<Validators>,
|
||||
pub(crate) blockchain: Arc<RwLock<Blockchain<D, T>>>,
|
||||
|
||||
pub(crate) p2p: P,
|
||||
}
|
||||
|
||||
#[async_trait]
|
||||
impl<D: Db, T: TransactionTrait, P: P2p> Network for TendermintNetwork<D, T, P> {
|
||||
type ValidatorId = [u8; 32];
|
||||
type SignatureScheme = Arc<Validators>;
|
||||
type Weights = Arc<Validators>;
|
||||
type Block = TendermintBlock;
|
||||
|
||||
// These are in seconds and create a six-second block time.
|
||||
// The block time is the latency on message delivery (where a message is some piece of data
|
||||
// embedded in a transaction), hence why it should be kept low.
|
||||
const BLOCK_PROCESSING_TIME: u32 = 3;
|
||||
const LATENCY_TIME: u32 = 1;
|
||||
|
||||
fn signer(&self) -> Arc<Signer> {
|
||||
self.signer.clone()
|
||||
}
|
||||
fn signature_scheme(&self) -> Arc<Validators> {
|
||||
self.validators.clone()
|
||||
}
|
||||
fn weights(&self) -> Arc<Validators> {
|
||||
self.validators.clone()
|
||||
}
|
||||
|
||||
async fn broadcast(&mut self, msg: SignedMessageFor<Self>) {
|
||||
let mut to_broadcast = vec![TENDERMINT_MESSAGE];
|
||||
to_broadcast.extend(msg.encode());
|
||||
self.p2p.broadcast(self.genesis, to_broadcast).await
|
||||
}
|
||||
|
||||
async fn slash(&mut self, validator: Self::ValidatorId, slash_event: SlashEvent<Self>) {
|
||||
log::error!(
|
||||
"validator {} triggered a slash event on tributary {} (with evidence: {})",
|
||||
hex::encode(validator),
|
||||
hex::encode(self.genesis),
|
||||
matches!(slash_event, SlashEvent::WithEvidence(_, _)),
|
||||
);
|
||||
|
||||
let signer = self.signer();
|
||||
let tx = match slash_event {
|
||||
SlashEvent::WithEvidence(m1, m2) => {
|
||||
// create an unsigned evidence tx
|
||||
TendermintTx::SlashEvidence((m1, m2).encode())
|
||||
}
|
||||
SlashEvent::Id(reason, block, round) => {
|
||||
// create a signed vote tx
|
||||
let mut tx = TendermintTx::SlashVote(SlashVote {
|
||||
id: (reason, block, round).encode().try_into().unwrap(),
|
||||
target: validator.encode().try_into().unwrap(),
|
||||
sig: VoteSignature::default(),
|
||||
});
|
||||
tx.sign(&mut OsRng, signer.genesis, &signer.key);
|
||||
tx
|
||||
}
|
||||
};
|
||||
|
||||
// add tx to blockchain and broadcast to peers
|
||||
// TODO: Make a function out of this following block
|
||||
let mut to_broadcast = vec![TRANSACTION_MESSAGE];
|
||||
tx.write(&mut to_broadcast).unwrap();
|
||||
if self.blockchain.write().await.add_transaction::<Self>(
|
||||
true,
|
||||
Transaction::Tendermint(tx),
|
||||
self.signature_scheme(),
|
||||
) {
|
||||
self.p2p.broadcast(signer.genesis, to_broadcast).await;
|
||||
}
|
||||
}
|
||||
|
||||
async fn validate(&mut self, block: &Self::Block) -> Result<(), TendermintBlockError> {
|
||||
let block =
|
||||
Block::read::<&[u8]>(&mut block.0.as_ref()).map_err(|_| TendermintBlockError::Fatal)?;
|
||||
self.blockchain.read().await.verify_block::<Self>(&block, self.signature_scheme()).map_err(
|
||||
|e| match e {
|
||||
BlockError::NonLocalProvided(_) => TendermintBlockError::Temporal,
|
||||
_ => TendermintBlockError::Fatal,
|
||||
},
|
||||
)
|
||||
}
|
||||
|
||||
async fn add_block(
|
||||
&mut self,
|
||||
serialized_block: Self::Block,
|
||||
commit: Commit<Self::SignatureScheme>,
|
||||
) -> Option<Self::Block> {
|
||||
let invalid_block = || {
|
||||
// There's a fatal flaw in the code, it's behind a hard fork, or the validators turned
|
||||
// malicious
|
||||
// All justify a halt to then achieve social consensus from
|
||||
// TODO: Under multiple validator sets, a small validator set turning malicious knocks
|
||||
// off the entire network. That's an unacceptable DoS.
|
||||
panic!("validators added invalid block to tributary {}", hex::encode(self.genesis));
|
||||
};
|
||||
|
||||
// Tendermint should only produce valid commits
|
||||
assert!(self.verify_commit(serialized_block.id(), &commit));
|
||||
|
||||
let Ok(block) = Block::read::<&[u8]>(&mut serialized_block.0.as_ref()) else {
|
||||
return invalid_block();
|
||||
};
|
||||
|
||||
let encoded_commit = commit.encode();
|
||||
loop {
|
||||
let block_res = self.blockchain.write().await.add_block::<Self>(
|
||||
&block,
|
||||
encoded_commit.clone(),
|
||||
self.signature_scheme(),
|
||||
);
|
||||
match block_res {
|
||||
Ok(()) => {
|
||||
// If we successfully added this block, broadcast it
|
||||
// TODO: Move this under the coordinator once we set up on new block notifications?
|
||||
let mut msg = serialized_block.0;
|
||||
msg.insert(0, BLOCK_MESSAGE);
|
||||
msg.extend(encoded_commit);
|
||||
self.p2p.broadcast(self.genesis, msg).await;
|
||||
break;
|
||||
}
|
||||
Err(BlockError::NonLocalProvided(hash)) => {
|
||||
log::error!(
|
||||
"missing provided transaction {} which other validators on tributary {} had",
|
||||
hex::encode(hash),
|
||||
hex::encode(self.genesis)
|
||||
);
|
||||
sleep(Duration::from_secs(Self::block_time().into())).await;
|
||||
}
|
||||
_ => return invalid_block(),
|
||||
}
|
||||
}
|
||||
|
||||
Some(TendermintBlock(
|
||||
self.blockchain.write().await.build_block::<Self>(self.signature_scheme()).serialize(),
|
||||
))
|
||||
}
|
||||
}
|
||||
347
coordinator/tributary/src/tendermint/tx.rs
Normal file
347
coordinator/tributary/src/tendermint/tx.rs
Normal file
@@ -0,0 +1,347 @@
|
||||
use core::ops::Deref;
|
||||
use std::{io, vec, default::Default};
|
||||
|
||||
use scale::Decode;
|
||||
|
||||
use zeroize::Zeroizing;
|
||||
|
||||
use blake2::{Digest, Blake2s256, Blake2b512};
|
||||
|
||||
use rand::{RngCore, CryptoRng};
|
||||
|
||||
use ciphersuite::{
|
||||
group::{GroupEncoding, ff::Field},
|
||||
Ciphersuite, Ristretto,
|
||||
};
|
||||
use schnorr::SchnorrSignature;
|
||||
|
||||
use crate::{
|
||||
transaction::{Transaction, TransactionKind, TransactionError},
|
||||
ReadWrite,
|
||||
};
|
||||
|
||||
use tendermint::{
|
||||
SignedMessageFor, Data,
|
||||
round::RoundData,
|
||||
time::CanonicalInstant,
|
||||
commit_msg,
|
||||
ext::{Network, Commit, RoundNumber, SignatureScheme},
|
||||
};
|
||||
|
||||
/// Signing data for a slash vote.
|
||||
///
|
||||
/// The traditional Signed uses a nonce, whereas votes aren't required/expected to be ordered.
|
||||
/// Accordingly, a simple uniqueness check works instead.
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub struct VoteSignature {
|
||||
pub signer: <Ristretto as Ciphersuite>::G,
|
||||
pub signature: SchnorrSignature<Ristretto>,
|
||||
}
|
||||
|
||||
impl ReadWrite for VoteSignature {
|
||||
fn read<R: io::Read>(reader: &mut R) -> io::Result<Self> {
|
||||
let signer = Ristretto::read_G(reader)?;
|
||||
let signature = SchnorrSignature::<Ristretto>::read(reader)?;
|
||||
|
||||
Ok(VoteSignature { signer, signature })
|
||||
}
|
||||
|
||||
fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
|
||||
writer.write_all(&self.signer.to_bytes())?;
|
||||
self.signature.write(writer)
|
||||
}
|
||||
}
|
||||
|
||||
impl Default for VoteSignature {
|
||||
fn default() -> Self {
|
||||
VoteSignature {
|
||||
signer: Ristretto::generator(),
|
||||
signature: SchnorrSignature::<Ristretto>::read(&mut [0; 64].as_slice()).unwrap(),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// A vote to slash a malicious validator.
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub struct SlashVote {
|
||||
pub id: [u8; 13], // vote id(slash event id)
|
||||
pub target: [u8; 32], // who to slash
|
||||
pub sig: VoteSignature, // signature
|
||||
}
|
||||
|
||||
impl ReadWrite for SlashVote {
|
||||
fn read<R: io::Read>(reader: &mut R) -> io::Result<Self> {
|
||||
let mut id = [0; 13];
|
||||
let mut target = [0; 32];
|
||||
reader.read_exact(&mut id)?;
|
||||
reader.read_exact(&mut target)?;
|
||||
let sig = VoteSignature::read(reader)?;
|
||||
|
||||
Ok(SlashVote { id, target, sig })
|
||||
}
|
||||
|
||||
fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
|
||||
writer.write_all(&self.id)?;
|
||||
writer.write_all(&self.target)?;
|
||||
self.sig.write(writer)
|
||||
}
|
||||
}
|
||||
|
||||
#[allow(clippy::large_enum_variant)]
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub enum TendermintTx {
|
||||
SlashEvidence(Vec<u8>),
|
||||
// TODO: should the SlashVote.sig be directly in the enum
|
||||
// like as in (SlashVote, sig) since the sig is sig of the tx.
|
||||
SlashVote(SlashVote),
|
||||
}
|
||||
|
||||
impl ReadWrite for TendermintTx {
|
||||
fn read<R: io::Read>(reader: &mut R) -> io::Result<Self> {
|
||||
let mut kind = [0];
|
||||
reader.read_exact(&mut kind)?;
|
||||
match kind[0] {
|
||||
0 => {
|
||||
let mut len = [0; 4];
|
||||
reader.read_exact(&mut len)?;
|
||||
let mut len =
|
||||
usize::try_from(u32::from_le_bytes(len)).expect("running on a 16-bit system?");
|
||||
|
||||
let mut data = vec![];
|
||||
|
||||
// Read chunk-by-chunk so a claimed 4 GB length doesn't cause a 4 GB allocation
|
||||
// While we could check the length is sane, that'd require we know what a sane length is
|
||||
// We'd also have to maintain that length's sanity even as other parts of the codebase,
|
||||
// and even entire crates, change
|
||||
// This is fine as it'll eventually hit the P2P message size limit, yet doesn't require
|
||||
// knowing it nor does it make any assumptions
|
||||
const CHUNK_LEN: usize = 1024;
|
||||
let mut chunk = [0; CHUNK_LEN];
|
||||
while len > 0 {
|
||||
let to_read = len.min(CHUNK_LEN);
|
||||
data.reserve(to_read);
|
||||
reader.read_exact(&mut chunk[.. to_read])?;
|
||||
data.extend(&chunk[.. to_read]);
|
||||
len -= to_read;
|
||||
}
|
||||
Ok(TendermintTx::SlashEvidence(data))
|
||||
}
|
||||
1 => {
|
||||
let vote = SlashVote::read(reader)?;
|
||||
Ok(TendermintTx::SlashVote(vote))
|
||||
}
|
||||
_ => Err(io::Error::new(io::ErrorKind::Other, "invalid transaction type")),
|
||||
}
|
||||
}
|
||||
|
||||
fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
|
||||
match self {
|
||||
TendermintTx::SlashEvidence(ev) => {
|
||||
writer.write_all(&[0])?;
|
||||
writer.write_all(&u32::try_from(ev.len()).unwrap().to_le_bytes())?;
|
||||
writer.write_all(ev)
|
||||
}
|
||||
TendermintTx::SlashVote(vote) => {
|
||||
writer.write_all(&[1])?;
|
||||
vote.write(writer)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl Transaction for TendermintTx {
|
||||
fn kind(&self) -> TransactionKind<'_> {
|
||||
// There's an assert elsewhere in the codebase expecting this behavior
|
||||
// If we do want to add Provided/Signed TendermintTxs, review the implications carefully
|
||||
TransactionKind::Unsigned
|
||||
}
|
||||
|
||||
fn hash(&self) -> [u8; 32] {
|
||||
let mut tx = self.serialize();
|
||||
if let TendermintTx::SlashVote(vote) = self {
|
||||
// Make sure the part we're cutting off is the signature
|
||||
assert_eq!(tx.drain((tx.len() - 64) ..).collect::<Vec<_>>(), vote.sig.signature.serialize());
|
||||
}
|
||||
Blake2s256::digest(tx).into()
|
||||
}
|
||||
|
||||
fn sig_hash(&self, genesis: [u8; 32]) -> <Ristretto as Ciphersuite>::F {
|
||||
match self {
|
||||
TendermintTx::SlashEvidence(_) => panic!("sig_hash called on slash evidence transaction"),
|
||||
TendermintTx::SlashVote(vote) => {
|
||||
let signature = &vote.sig.signature;
|
||||
<Ristretto as Ciphersuite>::F::from_bytes_mod_order_wide(
|
||||
&Blake2b512::digest(
|
||||
[genesis.as_ref(), &self.hash(), signature.R.to_bytes().as_ref()].concat(),
|
||||
)
|
||||
.into(),
|
||||
)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn verify(&self) -> Result<(), TransactionError> {
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
impl TendermintTx {
|
||||
// Sign a transaction
|
||||
pub fn sign<R: RngCore + CryptoRng>(
|
||||
&mut self,
|
||||
rng: &mut R,
|
||||
genesis: [u8; 32],
|
||||
key: &Zeroizing<<Ristretto as Ciphersuite>::F>,
|
||||
) {
|
||||
fn signature(tx: &mut TendermintTx) -> Option<&mut VoteSignature> {
|
||||
match tx {
|
||||
TendermintTx::SlashVote(vote) => Some(&mut vote.sig),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
signature(self).unwrap().signer = Ristretto::generator() * key.deref();
|
||||
|
||||
let sig_nonce = Zeroizing::new(<Ristretto as Ciphersuite>::F::random(rng));
|
||||
signature(self).unwrap().signature.R =
|
||||
<Ristretto as Ciphersuite>::generator() * sig_nonce.deref();
|
||||
|
||||
let sig_hash = self.sig_hash(genesis);
|
||||
|
||||
signature(self).unwrap().signature =
|
||||
SchnorrSignature::<Ristretto>::sign(key, sig_nonce, sig_hash);
|
||||
}
|
||||
}
|
||||
|
||||
pub fn decode_evidence<N: Network>(
|
||||
mut ev: &[u8],
|
||||
) -> Result<(SignedMessageFor<N>, Option<SignedMessageFor<N>>), TransactionError> {
|
||||
<(SignedMessageFor<N>, Option<SignedMessageFor<N>>)>::decode(&mut ev).map_err(|_| {
|
||||
dbg!("failed to decode");
|
||||
TransactionError::InvalidContent
|
||||
})
|
||||
}
|
||||
|
||||
// TODO: Move this into tendermint-machine
|
||||
// TODO: Strongly type Evidence, instead of having two messages and no idea what's supposedly
|
||||
// wrong with them. Doing so will massively simplify the auditability of this (as this
|
||||
// re-implements an entire foreign library's checks for malicious behavior).
|
||||
pub(crate) fn verify_tendermint_tx<N: Network>(
|
||||
tx: &TendermintTx,
|
||||
genesis: [u8; 32],
|
||||
schema: N::SignatureScheme,
|
||||
commit: impl Fn(u32) -> Option<Commit<N::SignatureScheme>>,
|
||||
) -> Result<(), TransactionError> {
|
||||
tx.verify()?;
|
||||
|
||||
match tx {
|
||||
TendermintTx::SlashEvidence(ev) => {
|
||||
let (first, second) = decode_evidence::<N>(ev)?;
|
||||
|
||||
// verify that evidence messages are signed correctly
|
||||
if !first.verify_signature(&schema) {
|
||||
Err(TransactionError::InvalidSignature)?
|
||||
}
|
||||
let first = first.msg;
|
||||
|
||||
if let Some(second) = second {
|
||||
if !second.verify_signature(&schema) {
|
||||
Err(TransactionError::InvalidSignature)?
|
||||
}
|
||||
let second = second.msg;
|
||||
|
||||
// 2 types of evidence here
|
||||
// 1- multiple distinct messages for the same block + round + step
|
||||
// 2- precommitted to multiple blocks
|
||||
|
||||
// Make sure they're distinct messages, from the same sender, within the same block
|
||||
if (first == second) || (first.sender != second.sender) || (first.block != second.block) {
|
||||
Err(TransactionError::InvalidContent)?;
|
||||
}
|
||||
|
||||
// Distinct messages within the same step
|
||||
if (first.round == second.round) && (first.data.step() == second.data.step()) {
|
||||
return Ok(());
|
||||
}
|
||||
|
||||
// check whether messages are precommits to different blocks
|
||||
// The inner signatures don't need to be verified since the outer signatures were
|
||||
// While the inner signatures may be invalid, that would've yielded a invalid precommit
|
||||
// signature slash instead of distinct precommit slash
|
||||
if let Data::Precommit(Some((h1, _))) = first.data {
|
||||
if let Data::Precommit(Some((h2, _))) = second.data {
|
||||
if h1 == h2 {
|
||||
Err(TransactionError::InvalidContent)?;
|
||||
}
|
||||
return Ok(());
|
||||
}
|
||||
}
|
||||
|
||||
// No fault identified
|
||||
Err(TransactionError::InvalidContent)?
|
||||
}
|
||||
|
||||
// 2 types of evidence can be here
|
||||
// 1- invalid commit signature
|
||||
// 2- vr number that was greater than or equal to the current round
|
||||
match &first.data {
|
||||
Data::Proposal(vr, _) => {
|
||||
// check the vr
|
||||
if vr.is_none() || vr.unwrap().0 < first.round.0 {
|
||||
Err(TransactionError::InvalidContent)?
|
||||
}
|
||||
}
|
||||
Data::Precommit(Some((id, sig))) => {
|
||||
// TODO: We need to be passed in the genesis time to handle this edge case
|
||||
if first.block.0 == 0 {
|
||||
todo!("invalid precommit signature on first block")
|
||||
}
|
||||
|
||||
// get the last commit
|
||||
// TODO: Why do we use u32 when Tendermint uses u64?
|
||||
let prior_commit = match u32::try_from(first.block.0 - 1) {
|
||||
Ok(n) => match commit(n) {
|
||||
Some(c) => c,
|
||||
// If we have yet to sync the block in question, we will return InvalidContent based
|
||||
// on our own temporal ambiguity
|
||||
// This will also cause an InvalidContent for anything using a non-existent block,
|
||||
// yet that's valid behavior
|
||||
// TODO: Double check the ramifications of this
|
||||
_ => Err(TransactionError::InvalidContent)?,
|
||||
},
|
||||
_ => Err(TransactionError::InvalidContent)?,
|
||||
};
|
||||
|
||||
// calculate the end time till the msg round
|
||||
let mut last_end_time = CanonicalInstant::new(prior_commit.end_time);
|
||||
for r in 0 ..= first.round.0 {
|
||||
last_end_time = RoundData::<N>::new(RoundNumber(r), last_end_time).end_time();
|
||||
}
|
||||
|
||||
// verify that the commit was actually invalid
|
||||
if schema.verify(first.sender, &commit_msg(last_end_time.canonical(), id.as_ref()), sig) {
|
||||
Err(TransactionError::InvalidContent)?
|
||||
}
|
||||
}
|
||||
_ => Err(TransactionError::InvalidContent)?,
|
||||
}
|
||||
}
|
||||
TendermintTx::SlashVote(vote) => {
|
||||
// TODO: verify the target is actually one of our validators?
|
||||
// this shouldn't be a problem because if the target isn't valid, no one else
|
||||
// gonna vote on it. But we still have to think about spam votes.
|
||||
|
||||
// TODO: we need to check signer is a participant
|
||||
|
||||
// TODO: Move this into the standalone TendermintTx verify
|
||||
let sig = &vote.sig;
|
||||
// verify the tx signature
|
||||
// TODO: Use Schnorr half-aggregation and a batch verification here
|
||||
if !sig.signature.verify(sig.signer, tx.sig_hash(genesis)) {
|
||||
Err(TransactionError::InvalidSignature)?;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
Reference in New Issue
Block a user