Re-arrange coordinator/

coordinator/tributary was tributary-chain. This crate has been renamed
tributary-sdk and moved to coordinator/tributary-sdk.

coordinator/src/tributary was our instantion of a Tributary, the Transaction
type and scan task. This has been moved to coordinator/tributary.

The main reason for this was due to coordinator/main.rs becoming untidy. There
is now a collection of clean, independent APIs present in the codebase.
coordinator/main.rs is to compose them. Sometimes, these compositions are a bit
silly (reading from a channel just to forward the message to a distinct
channel). That's more than fine as the code is still readable and the value
from the cleanliness of the APIs composed far exceeds the nits from having
these odd compositions.

This breaks down a bit as we now define a global database, and have some APIs
interact with multiple other APIs.

coordinator/src/tributary was a self-contained, clean API. The recently added
task present in coordinator/tributary/mod.rs, which bound it to the rest of the
Coordinator, wasn't.

Now, coordinator/src is solely the API compositions, and all self-contained
APIs are their own crates.

coordinator/tributary-sdk/Cargo.toml

@@ -0,0 +1,49 @@
+[package]
+name = "tributary-sdk"
+version = "0.1.0"
+description = "A micro-blockchain to provide consensus and ordering to P2P communication"
+license = "AGPL-3.0-only"
+repository = "https://github.com/serai-dex/serai/tree/develop/coordinator/tributary-sdk"
+authors = ["Luke Parker <lukeparker5132@gmail.com>"]
+edition = "2021"
+rust-version = "1.81"
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
+
+[lints]
+workspace = true
+
+[dependencies]
+thiserror = { version = "2", default-features = false, features = ["std"] }
+
+subtle = { version = "^2", default-features = false, features = ["std"] }
+zeroize = { version = "^1.5", default-features = false, features = ["std"] }
+
+rand = { version = "0.8", default-features = false, features = ["std"] }
+rand_chacha = { version = "0.3", default-features = false, features = ["std"] }
+
+blake2 = { version = "0.10", default-features = false, features = ["std"] }
+transcript = { package = "flexible-transcript", path = "../../crypto/transcript", default-features = false, features = ["std", "recommended"] }
+
+ciphersuite = { package = "ciphersuite", path = "../../crypto/ciphersuite", default-features = false, features = ["std", "ristretto"] }
+schnorr = { package = "schnorr-signatures", path = "../../crypto/schnorr", default-features = false, features = ["std"] }
+
+hex = { version = "0.4", default-features = false, features = ["std"] }
+log = { version = "0.4", default-features = false, features = ["std"] }
+
+serai-db = { path = "../../common/db" }
+
+scale = { package = "parity-scale-codec", version = "3", default-features = false, features = ["std", "derive"] }
+futures-util = { version = "0.3", default-features = false, features = ["std", "sink", "channel"] }
+futures-channel = { version = "0.3", default-features = false, features = ["std", "sink"] }
+tendermint = { package = "tendermint-machine", path = "./tendermint" }
+
+tokio = { version = "1", default-features = false, features = ["sync", "time", "rt"] }
+
+[dev-dependencies]
+tokio = { version = "1", features = ["macros"] }
+
+[features]
+tests = []

coordinator/tributary-sdk/LICENSE

@@ -0,0 +1,15 @@
+AGPL-3.0-only license
+
+Copyright (c) 2023 Luke Parker
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License Version 3 as
+published by the Free Software Foundation.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program. If not, see <http://www.gnu.org/licenses/>.

coordinator/tributary-sdk/README.md

@@ -0,0 +1,3 @@
+# Tributary
+
+A verifiable, ordered broadcast layer implemented as a BFT micro-blockchain.

coordinator/tributary-sdk/src/block.rs

@@ -0,0 +1,271 @@
+use std::{
+  io,
+  collections::{VecDeque, HashSet, HashMap},
+};
+
+use thiserror::Error;
+
+use blake2::{Digest, Blake2s256};
+
+use tendermint::ext::{Network, Commit};
+
+use crate::{
+  transaction::{
+    TransactionError, Signed, TransactionKind, Transaction as TransactionTrait, GAIN,
+    verify_transaction,
+  },
+  BLOCK_SIZE_LIMIT, ReadWrite, merkle, Transaction,
+  tendermint::tx::verify_tendermint_tx,
+};
+
+#[derive(Clone, PartialEq, Eq, Debug, Error)]
+pub enum BlockError {
+  /// Block was too large.
+  #[error("block exceeded size limit")]
+  TooLargeBlock,
+  /// Header specified a parent which wasn't the chain tip.
+  #[error("header doesn't build off the chain tip")]
+  InvalidParent,
+  /// Header specified an invalid transactions merkle tree hash.
+  #[error("header transactions hash is incorrect")]
+  InvalidTransactions,
+  /// An unsigned transaction which was already added to the chain was present again.
+  #[error("an unsigned transaction which was already added to the chain was present again")]
+  UnsignedAlreadyIncluded,
+  /// A provided transaction which was already added to the chain was present again.
+  #[error("an provided transaction which was already added to the chain was present again")]
+  ProvidedAlreadyIncluded,
+  /// Transactions weren't ordered as expected (Provided, followed by Unsigned, followed by Signed).
+  #[error("transactions weren't ordered as expected (Provided, Unsigned, Signed)")]
+  WrongTransactionOrder,
+  /// The block had a provided transaction this validator has yet to be provided.
+  #[error("block had a provided transaction not yet locally provided: {0:?}")]
+  NonLocalProvided([u8; 32]),
+  /// The provided transaction was distinct from the locally provided transaction.
+  #[error("block had a distinct provided transaction")]
+  DistinctProvided,
+  /// An included transaction was invalid.
+  #[error("included transaction had an error")]
+  TransactionError(TransactionError),
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct BlockHeader {
+  pub parent: [u8; 32],
+  pub transactions: [u8; 32],
+}
+
+impl ReadWrite for BlockHeader {
+  fn read<R: io::Read>(reader: &mut R) -> io::Result<Self> {
+    let mut header = BlockHeader { parent: [0; 32], transactions: [0; 32] };
+    reader.read_exact(&mut header.parent)?;
+    reader.read_exact(&mut header.transactions)?;
+    Ok(header)
+  }
+
+  fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
+    writer.write_all(&self.parent)?;
+    writer.write_all(&self.transactions)
+  }
+}
+
+impl BlockHeader {
+  pub fn hash(&self) -> [u8; 32] {
+    Blake2s256::digest([b"tributary_block".as_ref(), &self.serialize()].concat()).into()
+  }
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct Block<T: TransactionTrait> {
+  pub header: BlockHeader,
+  pub transactions: Vec<Transaction<T>>,
+}
+
+impl<T: TransactionTrait> ReadWrite for Block<T> {
+  fn read<R: io::Read>(reader: &mut R) -> io::Result<Self> {
+    let header = BlockHeader::read(reader)?;
+
+    let mut txs = [0; 4];
+    reader.read_exact(&mut txs)?;
+    let txs = u32::from_le_bytes(txs);
+
+    let mut transactions = Vec::with_capacity(usize::try_from(txs).unwrap());
+    for _ in 0 .. txs {
+      transactions.push(Transaction::read(reader)?);
+    }
+
+    Ok(Block { header, transactions })
+  }
+
+  fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
+    self.header.write(writer)?;
+    writer.write_all(&u32::try_from(self.transactions.len()).unwrap().to_le_bytes())?;
+    for tx in &self.transactions {
+      tx.write(writer)?;
+    }
+    Ok(())
+  }
+}
+
+impl<T: TransactionTrait> Block<T> {
+  /// Create a new block.
+  ///
+  /// mempool is expected to only have valid, non-conflicting transactions, sorted by nonce.
+  pub(crate) fn new(parent: [u8; 32], provided: Vec<T>, mempool: Vec<Transaction<T>>) -> Self {
+    let mut txs = vec![];
+    for tx in provided {
+      txs.push(Transaction::Application(tx))
+    }
+
+    let mut signed = vec![];
+    let mut unsigned = vec![];
+    for tx in mempool {
+      match tx.kind() {
+        TransactionKind::Signed(_, _) => signed.push(tx),
+        TransactionKind::Unsigned => unsigned.push(tx),
+        TransactionKind::Provided(_) => panic!("provided transaction entered mempool"),
+      }
+    }
+
+    // unsigned first
+    txs.extend(unsigned);
+    // then signed
+    txs.extend(signed);
+
+    // Check TXs are sorted by nonce.
+    let nonce = |tx: &Transaction<T>| {
+      if let TransactionKind::Signed(_, Signed { nonce, .. }) = tx.kind() {
+        nonce
+      } else {
+        0
+      }
+    };
+    let mut last = 0;
+    for tx in &txs {
+      let nonce = nonce(tx);
+      if nonce < last {
+        panic!("TXs in mempool weren't ordered by nonce");
+      }
+      last = nonce;
+    }
+
+    let mut res =
+      Block { header: BlockHeader { parent, transactions: [0; 32] }, transactions: txs };
+    while res.serialize().len() > BLOCK_SIZE_LIMIT {
+      assert!(res.transactions.pop().is_some());
+    }
+    let hashes = res.transactions.iter().map(Transaction::hash).collect::<Vec<_>>();
+    res.header.transactions = merkle(&hashes);
+    res
+  }
+
+  pub fn parent(&self) -> [u8; 32] {
+    self.header.parent
+  }
+
+  pub fn hash(&self) -> [u8; 32] {
+    self.header.hash()
+  }
+
+  #[allow(clippy::too_many_arguments)]
+  pub(crate) fn verify<N: Network, G: GAIN>(
+    &self,
+    genesis: [u8; 32],
+    last_block: [u8; 32],
+    mut locally_provided: HashMap<&'static str, VecDeque<T>>,
+    get_and_increment_nonce: &mut G,
+    schema: &N::SignatureScheme,
+    commit: impl Fn(u64) -> Option<Commit<N::SignatureScheme>>,
+    provided_or_unsigned_in_chain: impl Fn([u8; 32]) -> bool,
+    allow_non_local_provided: bool,
+  ) -> Result<(), BlockError> {
+    #[derive(Clone, Copy, PartialEq, Eq, Debug)]
+    enum Order {
+      Provided,
+      Unsigned,
+      Signed,
+    }
+    impl From<Order> for u8 {
+      fn from(order: Order) -> u8 {
+        match order {
+          Order::Provided => 0,
+          Order::Unsigned => 1,
+          Order::Signed => 2,
+        }
+      }
+    }
+
+    if self.serialize().len() > BLOCK_SIZE_LIMIT {
+      Err(BlockError::TooLargeBlock)?;
+    }
+
+    if self.header.parent != last_block {
+      Err(BlockError::InvalidParent)?;
+    }
+
+    let mut last_tx_order = Order::Provided;
+    let mut included_in_block = HashSet::new();
+    let mut txs = Vec::with_capacity(self.transactions.len());
+    for tx in &self.transactions {
+      let tx_hash = tx.hash();
+      txs.push(tx_hash);
+
+      let current_tx_order = match tx.kind() {
+        TransactionKind::Provided(order) => {
+          if provided_or_unsigned_in_chain(tx_hash) {
+            Err(BlockError::ProvidedAlreadyIncluded)?;
+          }
+
+          if let Some(local) = locally_provided.get_mut(order).and_then(VecDeque::pop_front) {
+            // Since this was a provided TX, it must be an application TX
+            let Transaction::Application(tx) = tx else {
+              Err(BlockError::NonLocalProvided(txs.pop().unwrap()))?
+            };
+            if tx != &local {
+              Err(BlockError::DistinctProvided)?;
+            }
+          } else if !allow_non_local_provided {
+            Err(BlockError::NonLocalProvided(txs.pop().unwrap()))?
+          };
+
+          Order::Provided
+        }
+        TransactionKind::Unsigned => {
+          // check we don't already have the tx in the chain
+          if provided_or_unsigned_in_chain(tx_hash) || included_in_block.contains(&tx_hash) {
+            Err(BlockError::UnsignedAlreadyIncluded)?;
+          }
+          included_in_block.insert(tx_hash);
+
+          Order::Unsigned
+        }
+        TransactionKind::Signed(..) => Order::Signed,
+      };
+
+      // enforce Provided => Unsigned => Signed order
+      if u8::from(current_tx_order) < u8::from(last_tx_order) {
+        Err(BlockError::WrongTransactionOrder)?;
+      }
+      last_tx_order = current_tx_order;
+
+      match tx {
+        Transaction::Tendermint(tx) => match verify_tendermint_tx::<N>(tx, schema, &commit) {
+          Ok(()) => {}
+          Err(e) => Err(BlockError::TransactionError(e))?,
+        },
+        Transaction::Application(tx) => {
+          match verify_transaction(tx, genesis, get_and_increment_nonce) {
+            Ok(()) => {}
+            Err(e) => Err(BlockError::TransactionError(e))?,
+          }
+        }
+      }
+    }
+
+    if merkle(&txs) != self.header.transactions {
+      Err(BlockError::InvalidTransactions)?;
+    }
+
+    Ok(())
+  }
+}

coordinator/tributary-sdk/src/blockchain.rs

@@ -0,0 +1,341 @@
+use std::collections::{VecDeque, HashSet};
+
+use ciphersuite::{group::GroupEncoding, Ciphersuite, Ristretto};
+
+use serai_db::{Get, DbTxn, Db};
+
+use scale::Decode;
+
+use tendermint::ext::{Network, Commit};
+
+use crate::{
+  ReadWrite, ProvidedError, ProvidedTransactions, BlockError, Block, Mempool, Transaction,
+  transaction::{Signed, TransactionKind, TransactionError, Transaction as TransactionTrait},
+};
+
+#[derive(Debug)]
+pub(crate) struct Blockchain<D: Db, T: TransactionTrait> {
+  db: Option<D>,
+  genesis: [u8; 32],
+
+  block_number: u64,
+  tip: [u8; 32],
+  participants: HashSet<<Ristretto as Ciphersuite>::G>,
+
+  provided: ProvidedTransactions<D, T>,
+  mempool: Mempool<D, T>,
+
+  pub(crate) next_block_notifications: VecDeque<tokio::sync::oneshot::Sender<()>>,
+}
+
+impl<D: Db, T: TransactionTrait> Blockchain<D, T> {
+  fn tip_key(genesis: [u8; 32]) -> Vec<u8> {
+    D::key(b"tributary_blockchain", b"tip", genesis)
+  }
+  fn block_number_key(&self) -> Vec<u8> {
+    D::key(b"tributary_blockchain", b"block_number", self.genesis)
+  }
+  fn block_key(genesis: &[u8], hash: &[u8; 32]) -> Vec<u8> {
+    D::key(b"tributary_blockchain", b"block", [genesis, hash].concat())
+  }
+  fn block_hash_key(genesis: &[u8], block_number: u64) -> Vec<u8> {
+    D::key(b"tributary_blockchain", b"block_hash", [genesis, &block_number.to_le_bytes()].concat())
+  }
+  fn commit_key(genesis: &[u8], hash: &[u8; 32]) -> Vec<u8> {
+    D::key(b"tributary_blockchain", b"commit", [genesis, hash].concat())
+  }
+  fn block_after_key(genesis: &[u8], hash: &[u8; 32]) -> Vec<u8> {
+    D::key(b"tributary_blockchain", b"block_after", [genesis, hash].concat())
+  }
+  fn unsigned_included_key(genesis: &[u8], hash: &[u8; 32]) -> Vec<u8> {
+    D::key(b"tributary_blockchain", b"unsigned_included", [genesis, hash].concat())
+  }
+  fn provided_included_key(genesis: &[u8], hash: &[u8; 32]) -> Vec<u8> {
+    D::key(b"tributary_blockchain", b"provided_included", [genesis, hash].concat())
+  }
+  fn next_nonce_key(
+    genesis: &[u8; 32],
+    signer: &<Ristretto as Ciphersuite>::G,
+    order: &[u8],
+  ) -> Vec<u8> {
+    D::key(
+      b"tributary_blockchain",
+      b"next_nonce",
+      [genesis.as_ref(), signer.to_bytes().as_ref(), order].concat(),
+    )
+  }
+
+  pub(crate) fn new(
+    db: D,
+    genesis: [u8; 32],
+    participants: &[<Ristretto as Ciphersuite>::G],
+  ) -> Self {
+    let mut res = Self {
+      db: Some(db.clone()),
+      genesis,
+      participants: participants.iter().copied().collect(),
+
+      block_number: 0,
+      tip: genesis,
+
+      provided: ProvidedTransactions::new(db.clone(), genesis),
+      mempool: Mempool::new(db, genesis),
+
+      next_block_notifications: VecDeque::new(),
+    };
+
+    if let Some((block_number, tip)) = {
+      let db = res.db.as_ref().unwrap();
+      db.get(res.block_number_key()).map(|number| (number, db.get(Self::tip_key(genesis)).unwrap()))
+    } {
+      res.block_number = u64::from_le_bytes(block_number.try_into().unwrap());
+      res.tip.copy_from_slice(&tip);
+    }
+
+    res
+  }
+
+  pub(crate) fn tip(&self) -> [u8; 32] {
+    self.tip
+  }
+
+  pub(crate) fn block_number(&self) -> u64 {
+    self.block_number
+  }
+
+  pub(crate) fn block_from_db(db: &D, genesis: [u8; 32], block: &[u8; 32]) -> Option<Block<T>> {
+    db.get(Self::block_key(&genesis, block))
+      .map(|bytes| Block::<T>::read::<&[u8]>(&mut bytes.as_ref()).unwrap())
+  }
+
+  pub(crate) fn commit_from_db(db: &D, genesis: [u8; 32], block: &[u8; 32]) -> Option<Vec<u8>> {
+    db.get(Self::commit_key(&genesis, block))
+  }
+
+  pub(crate) fn block_hash_from_db(db: &D, genesis: [u8; 32], block: u64) -> Option<[u8; 32]> {
+    db.get(Self::block_hash_key(&genesis, block)).map(|h| h.try_into().unwrap())
+  }
+
+  pub(crate) fn commit(&self, block: &[u8; 32]) -> Option<Vec<u8>> {
+    Self::commit_from_db(self.db.as_ref().unwrap(), self.genesis, block)
+  }
+
+  pub(crate) fn block_hash(&self, block: u64) -> Option<[u8; 32]> {
+    Self::block_hash_from_db(self.db.as_ref().unwrap(), self.genesis, block)
+  }
+
+  pub(crate) fn commit_by_block_number(&self, block: u64) -> Option<Vec<u8>> {
+    self.commit(&self.block_hash(block)?)
+  }
+
+  pub(crate) fn block_after(db: &D, genesis: [u8; 32], block: &[u8; 32]) -> Option<[u8; 32]> {
+    db.get(Self::block_after_key(&genesis, block)).map(|bytes| bytes.try_into().unwrap())
+  }
+
+  pub(crate) fn locally_provided_txs_in_block(
+    db: &D,
+    genesis: &[u8; 32],
+    block: &[u8; 32],
+    order: &str,
+  ) -> bool {
+    let local_key = ProvidedTransactions::<D, T>::locally_provided_quantity_key(genesis, order);
+    let local = db.get(local_key).map_or(0, |bytes| u32::from_le_bytes(bytes.try_into().unwrap()));
+    let block_key =
+      ProvidedTransactions::<D, T>::block_provided_quantity_key(genesis, block, order);
+    let block = db.get(block_key).map_or(0, |bytes| u32::from_le_bytes(bytes.try_into().unwrap()));
+
+    local >= block
+  }
+
+  pub(crate) fn tip_from_db(db: &D, genesis: [u8; 32]) -> [u8; 32] {
+    db.get(Self::tip_key(genesis)).map_or(genesis, |bytes| bytes.try_into().unwrap())
+  }
+
+  pub(crate) fn add_transaction<N: Network>(
+    &mut self,
+    internal: bool,
+    tx: Transaction<T>,
+    schema: &N::SignatureScheme,
+  ) -> Result<bool, TransactionError> {
+    let db = self.db.as_ref().unwrap();
+    let genesis = self.genesis;
+
+    let commit = |block: u64| -> Option<Commit<N::SignatureScheme>> {
+      let hash = Self::block_hash_from_db(db, genesis, block)?;
+      // we must have a commit per valid hash
+      let commit = Self::commit_from_db(db, genesis, &hash).unwrap();
+      // commit has to be valid if it is coming from our db
+      Some(Commit::<N::SignatureScheme>::decode(&mut commit.as_ref()).unwrap())
+    };
+    let unsigned_in_chain =
+      |hash: [u8; 32]| db.get(Self::unsigned_included_key(&self.genesis, &hash)).is_some();
+
+    self.mempool.add::<N, _>(
+      |signer, order| {
+        if self.participants.contains(&signer) {
+          Some(
+            db.get(Self::next_nonce_key(&self.genesis, &signer, &order))
+              .map_or(0, |bytes| u32::from_le_bytes(bytes.try_into().unwrap())),
+          )
+        } else {
+          None
+        }
+      },
+      internal,
+      tx,
+      schema,
+      unsigned_in_chain,
+      commit,
+    )
+  }
+
+  pub(crate) fn provide_transaction(&mut self, tx: T) -> Result<(), ProvidedError> {
+    self.provided.provide(tx)
+  }
+
+  pub(crate) fn next_nonce(
+    &self,
+    signer: &<Ristretto as Ciphersuite>::G,
+    order: &[u8],
+  ) -> Option<u32> {
+    if let Some(next_nonce) = self.mempool.next_nonce_in_mempool(signer, order.to_vec()) {
+      return Some(next_nonce);
+    }
+    if self.participants.contains(signer) {
+      Some(
+        self
+          .db
+          .as_ref()
+          .unwrap()
+          .get(Self::next_nonce_key(&self.genesis, signer, order))
+          .map_or(0, |bytes| u32::from_le_bytes(bytes.try_into().unwrap())),
+      )
+    } else {
+      None
+    }
+  }
+
+  pub(crate) fn build_block<N: Network>(&mut self, schema: &N::SignatureScheme) -> Block<T> {
+    let block = Block::new(
+      self.tip,
+      self.provided.transactions.values().flatten().cloned().collect(),
+      self.mempool.block(),
+    );
+    // build_block should not return invalid blocks
+    self.verify_block::<N>(&block, schema, false).unwrap();
+    block
+  }
+
+  pub(crate) fn verify_block<N: Network>(
+    &self,
+    block: &Block<T>,
+    schema: &N::SignatureScheme,
+    allow_non_local_provided: bool,
+  ) -> Result<(), BlockError> {
+    let db = self.db.as_ref().unwrap();
+    let provided_or_unsigned_in_chain = |hash: [u8; 32]| {
+      db.get(Self::unsigned_included_key(&self.genesis, &hash)).is_some() ||
+        db.get(Self::provided_included_key(&self.genesis, &hash)).is_some()
+    };
+    let commit = |block: u64| -> Option<Commit<N::SignatureScheme>> {
+      let commit = self.commit_by_block_number(block)?;
+      // commit has to be valid if it is coming from our db
+      Some(Commit::<N::SignatureScheme>::decode(&mut commit.as_ref()).unwrap())
+    };
+
+    let mut txn_db = db.clone();
+    let mut txn = txn_db.txn();
+    let res = block.verify::<N, _>(
+      self.genesis,
+      self.tip,
+      self.provided.transactions.clone(),
+      &mut |signer, order| {
+        if self.participants.contains(signer) {
+          let key = Self::next_nonce_key(&self.genesis, signer, order);
+          let next = txn
+            .get(&key)
+            .map_or(0, |next_nonce| u32::from_le_bytes(next_nonce.try_into().unwrap()));
+          txn.put(key, (next + 1).to_le_bytes());
+          Some(next)
+        } else {
+          None
+        }
+      },
+      schema,
+      &commit,
+      provided_or_unsigned_in_chain,
+      allow_non_local_provided,
+    );
+    // Drop this TXN's changes as we're solely verifying the block
+    drop(txn);
+    res
+  }
+
+  /// Add a block.
+  pub(crate) fn add_block<N: Network>(
+    &mut self,
+    block: &Block<T>,
+    commit: Vec<u8>,
+    schema: &N::SignatureScheme,
+  ) -> Result<(), BlockError> {
+    self.verify_block::<N>(block, schema, true)?;
+
+    log::info!(
+      "adding block {} to tributary {} with {} TXs",
+      hex::encode(block.hash()),
+      hex::encode(self.genesis),
+      block.transactions.len(),
+    );
+
+    // None of the following assertions should be reachable since we verified the block
+
+    // Take it from the Option so Rust doesn't consider self as mutably borrowed thanks to the
+    // existence of the txn
+    let mut db = self.db.take().unwrap();
+    let mut txn = db.txn();
+
+    self.tip = block.hash();
+    txn.put(Self::tip_key(self.genesis), self.tip);
+
+    self.block_number += 1;
+    txn.put(self.block_number_key(), self.block_number.to_le_bytes());
+
+    txn.put(Self::block_hash_key(&self.genesis, self.block_number), self.tip);
+
+    txn.put(Self::block_key(&self.genesis, &self.tip), block.serialize());
+    txn.put(Self::commit_key(&self.genesis, &self.tip), commit);
+
+    txn.put(Self::block_after_key(&self.genesis, &block.parent()), block.hash());
+
+    for tx in &block.transactions {
+      match tx.kind() {
+        TransactionKind::Provided(order) => {
+          let hash = tx.hash();
+          self.provided.complete(&mut txn, order, self.tip, hash);
+          txn.put(Self::provided_included_key(&self.genesis, &hash), []);
+        }
+        TransactionKind::Unsigned => {
+          let hash = tx.hash();
+          // Save as included on chain
+          txn.put(Self::unsigned_included_key(&self.genesis, &hash), []);
+          // remove from the mempool
+          self.mempool.remove(&hash);
+        }
+        TransactionKind::Signed(order, Signed { signer, nonce, .. }) => {
+          let next_nonce = nonce + 1;
+          txn.put(Self::next_nonce_key(&self.genesis, &signer, &order), next_nonce.to_le_bytes());
+          self.mempool.remove(&tx.hash());
+        }
+      }
+    }
+
+    txn.commit();
+    self.db = Some(db);
+
+    for tx in self.next_block_notifications.drain(..) {
+      let _ = tx.send(());
+    }
+
+    Ok(())
+  }
+}

coordinator/tributary-sdk/src/lib.rs

@@ -0,0 +1,388 @@
+use core::{marker::PhantomData, fmt::Debug, future::Future};
+use std::{sync::Arc, io};
+
+use zeroize::Zeroizing;
+
+use ciphersuite::{Ciphersuite, Ristretto};
+
+use scale::Decode;
+use futures_channel::mpsc::UnboundedReceiver;
+use futures_util::{StreamExt, SinkExt};
+use ::tendermint::{
+  ext::{BlockNumber, Commit, Block as BlockTrait, Network},
+  SignedMessageFor, SyncedBlock, SyncedBlockSender, SyncedBlockResultReceiver, MessageSender,
+  TendermintMachine, TendermintHandle,
+};
+
+pub use ::tendermint::Evidence;
+
+use serai_db::Db;
+
+use tokio::sync::RwLock;
+
+mod merkle;
+pub(crate) use merkle::*;
+
+pub mod transaction;
+pub use transaction::{TransactionError, Signed, TransactionKind, Transaction as TransactionTrait};
+
+use crate::tendermint::tx::TendermintTx;
+
+mod provided;
+pub(crate) use provided::*;
+pub use provided::ProvidedError;
+
+mod block;
+pub use block::*;
+
+mod blockchain;
+pub(crate) use blockchain::*;
+
+mod mempool;
+pub(crate) use mempool::*;
+
+pub mod tendermint;
+pub(crate) use crate::tendermint::*;
+
+#[cfg(any(test, feature = "tests"))]
+pub mod tests;
+
+/// Size limit for an individual transaction.
+// This needs to be big enough to participate in a 101-of-150 eVRF DKG with each element taking
+// `MAX_KEY_LEN`. This also needs to be big enough to pariticpate in signing 520 Bitcoin inputs
+// with 49 key shares, and signing 120 Monero inputs with 49 key shares.
+// TODO: Add a test for these properties
+pub const TRANSACTION_SIZE_LIMIT: usize = 2_000_000;
+/// Amount of transactions a single account may have in the mempool.
+pub const ACCOUNT_MEMPOOL_LIMIT: u32 = 50;
+/// Block size limit.
+// This targets a growth limit of roughly 30 GB a day, under load, in order to prevent a malicious
+// participant from flooding disks and causing out of space errors in order processes.
+pub const BLOCK_SIZE_LIMIT: usize = 2_001_000;
+
+pub(crate) const TENDERMINT_MESSAGE: u8 = 0;
+pub(crate) const TRANSACTION_MESSAGE: u8 = 1;
+
+#[allow(clippy::large_enum_variant)]
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub enum Transaction<T: TransactionTrait> {
+  Tendermint(TendermintTx),
+  Application(T),
+}
+
+impl<T: TransactionTrait> ReadWrite for Transaction<T> {
+  fn read<R: io::Read>(reader: &mut R) -> io::Result<Self> {
+    let mut kind = [0];
+    reader.read_exact(&mut kind)?;
+    match kind[0] {
+      0 => {
+        let tx = TendermintTx::read(reader)?;
+        Ok(Transaction::Tendermint(tx))
+      }
+      1 => {
+        let tx = T::read(reader)?;
+        Ok(Transaction::Application(tx))
+      }
+      _ => Err(io::Error::other("invalid transaction type")),
+    }
+  }
+  fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
+    match self {
+      Transaction::Tendermint(tx) => {
+        writer.write_all(&[0])?;
+        tx.write(writer)
+      }
+      Transaction::Application(tx) => {
+        writer.write_all(&[1])?;
+        tx.write(writer)
+      }
+    }
+  }
+}
+
+impl<T: TransactionTrait> Transaction<T> {
+  pub fn hash(&self) -> [u8; 32] {
+    match self {
+      Transaction::Tendermint(tx) => tx.hash(),
+      Transaction::Application(tx) => tx.hash(),
+    }
+  }
+
+  pub fn kind(&self) -> TransactionKind {
+    match self {
+      Transaction::Tendermint(tx) => tx.kind(),
+      Transaction::Application(tx) => tx.kind(),
+    }
+  }
+}
+
+/// An item which can be read and written.
+pub trait ReadWrite: Sized {
+  fn read<R: io::Read>(reader: &mut R) -> io::Result<Self>;
+  fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()>;
+
+  fn serialize(&self) -> Vec<u8> {
+    // BlockHeader is 64 bytes and likely the smallest item in this system
+    let mut buf = Vec::with_capacity(64);
+    self.write(&mut buf).unwrap();
+    buf
+  }
+}
+
+pub trait P2p: 'static + Send + Sync + Clone {
+  /// Broadcast a message to all other members of the Tributary with the specified genesis.
+  ///
+  /// The Tributary will re-broadcast consensus messages on a fixed interval to ensure they aren't
+  /// prematurely dropped from the P2P layer. THe P2P layer SHOULD perform content-based
+  /// deduplication to ensure a sane amount of load.
+  fn broadcast(&self, genesis: [u8; 32], msg: Vec<u8>) -> impl Send + Future<Output = ()>;
+}
+
+impl<P: P2p> P2p for Arc<P> {
+  fn broadcast(&self, genesis: [u8; 32], msg: Vec<u8>) -> impl Send + Future<Output = ()> {
+    P::broadcast(self, genesis, msg)
+  }
+}
+
+#[derive(Clone)]
+pub struct Tributary<D: Db, T: TransactionTrait, P: P2p> {
+  db: D,
+
+  genesis: [u8; 32],
+  network: TendermintNetwork<D, T, P>,
+
+  synced_block: Arc<RwLock<SyncedBlockSender<TendermintNetwork<D, T, P>>>>,
+  synced_block_result: Arc<RwLock<SyncedBlockResultReceiver>>,
+  messages: Arc<RwLock<MessageSender<TendermintNetwork<D, T, P>>>>,
+}
+
+impl<D: Db, T: TransactionTrait, P: P2p> Tributary<D, T, P> {
+  pub async fn new(
+    db: D,
+    genesis: [u8; 32],
+    start_time: u64,
+    key: Zeroizing<<Ristretto as Ciphersuite>::F>,
+    validators: Vec<(<Ristretto as Ciphersuite>::G, u64)>,
+    p2p: P,
+  ) -> Option<Self> {
+    log::info!("new Tributary with genesis {}", hex::encode(genesis));
+
+    let validators_vec = validators.iter().map(|validator| validator.0).collect::<Vec<_>>();
+
+    let signer = Arc::new(Signer::new(genesis, key));
+    let validators = Arc::new(Validators::new(genesis, validators)?);
+
+    let mut blockchain = Blockchain::new(db.clone(), genesis, &validators_vec);
+    let block_number = BlockNumber(blockchain.block_number());
+
+    let start_time = if let Some(commit) = blockchain.commit(&blockchain.tip()) {
+      Commit::<Validators>::decode(&mut commit.as_ref()).unwrap().end_time
+    } else {
+      start_time
+    };
+    let proposal = TendermintBlock(
+      blockchain.build_block::<TendermintNetwork<D, T, P>>(&validators).serialize(),
+    );
+    let blockchain = Arc::new(RwLock::new(blockchain));
+
+    let network = TendermintNetwork { genesis, signer, validators, blockchain, p2p };
+
+    let TendermintHandle { synced_block, synced_block_result, messages, machine } =
+      TendermintMachine::new(
+        db.clone(),
+        network.clone(),
+        genesis,
+        block_number,
+        start_time,
+        proposal,
+      )
+      .await;
+    tokio::spawn(machine.run());
+
+    Some(Self {
+      db,
+      genesis,
+      network,
+      synced_block: Arc::new(RwLock::new(synced_block)),
+      synced_block_result: Arc::new(RwLock::new(synced_block_result)),
+      messages: Arc::new(RwLock::new(messages)),
+    })
+  }
+
+  pub fn block_time() -> u32 {
+    TendermintNetwork::<D, T, P>::block_time()
+  }
+
+  pub fn genesis(&self) -> [u8; 32] {
+    self.genesis
+  }
+
+  pub async fn block_number(&self) -> u64 {
+    self.network.blockchain.read().await.block_number()
+  }
+  pub async fn tip(&self) -> [u8; 32] {
+    self.network.blockchain.read().await.tip()
+  }
+
+  pub fn reader(&self) -> TributaryReader<D, T> {
+    TributaryReader(self.db.clone(), self.genesis, PhantomData)
+  }
+
+  pub async fn provide_transaction(&self, tx: T) -> Result<(), ProvidedError> {
+    self.network.blockchain.write().await.provide_transaction(tx)
+  }
+
+  pub async fn next_nonce(
+    &self,
+    signer: &<Ristretto as Ciphersuite>::G,
+    order: &[u8],
+  ) -> Option<u32> {
+    self.network.blockchain.read().await.next_nonce(signer, order)
+  }
+
+  // Returns Ok(true) if new, Ok(false) if an already present unsigned, or the error.
+  // Safe to be &self since the only meaningful usage of self is self.network.blockchain which
+  // successfully acquires its own write lock
+  pub async fn add_transaction(&self, tx: T) -> Result<bool, TransactionError> {
+    let tx = Transaction::Application(tx);
+    let mut to_broadcast = vec![TRANSACTION_MESSAGE];
+    tx.write(&mut to_broadcast).unwrap();
+    let res = self.network.blockchain.write().await.add_transaction::<TendermintNetwork<D, T, P>>(
+      true,
+      tx,
+      &self.network.signature_scheme(),
+    );
+    if res == Ok(true) {
+      self.network.p2p.broadcast(self.genesis, to_broadcast).await;
+    }
+    res
+  }
+
+  async fn sync_block_internal(
+    &self,
+    block: Block<T>,
+    commit: Vec<u8>,
+    result: &mut UnboundedReceiver<bool>,
+  ) -> bool {
+    let (tip, block_number) = {
+      let blockchain = self.network.blockchain.read().await;
+      (blockchain.tip(), blockchain.block_number())
+    };
+
+    if block.header.parent != tip {
+      log::debug!("told to sync a block whose parent wasn't our tip");
+      return false;
+    }
+
+    let block = TendermintBlock(block.serialize());
+    let mut commit_ref = commit.as_ref();
+    let Ok(commit) = Commit::<Arc<Validators>>::decode(&mut commit_ref) else {
+      log::error!("sent an invalidly serialized commit");
+      return false;
+    };
+    // Storage DoS vector. We *could* truncate to solely the relevant portion, trying to save this,
+    // yet then we'd have to test the truncation was performed correctly.
+    if !commit_ref.is_empty() {
+      log::error!("sent an commit with additional data after it");
+      return false;
+    }
+    if !self.network.verify_commit(block.id(), &commit) {
+      log::error!("sent an invalid commit");
+      return false;
+    }
+
+    let number = BlockNumber(block_number + 1);
+    self.synced_block.write().await.send(SyncedBlock { number, block, commit }).await.unwrap();
+    result.next().await.unwrap()
+  }
+
+  // Sync a block.
+  // TODO: Since we have a static validator set, we should only need the tail commit?
+  pub async fn sync_block(&self, block: Block<T>, commit: Vec<u8>) -> bool {
+    let mut result = self.synced_block_result.write().await;
+    self.sync_block_internal(block, commit, &mut result).await
+  }
+
+  // Return true if the message should be rebroadcasted.
+  pub async fn handle_message(&self, msg: &[u8]) -> bool {
+    match msg.first() {
+      Some(&TRANSACTION_MESSAGE) => {
+        let Ok(tx) = Transaction::read::<&[u8]>(&mut &msg[1 ..]) else {
+          log::error!("received invalid transaction message");
+          return false;
+        };
+
+        // TODO: Sync mempools with fellow peers
+        // Can we just rebroadcast transactions not included for at least two blocks?
+        let res =
+          self.network.blockchain.write().await.add_transaction::<TendermintNetwork<D, T, P>>(
+            false,
+            tx,
+            &self.network.signature_scheme(),
+          );
+        log::debug!("received transaction message. valid new transaction: {res:?}");
+        res == Ok(true)
+      }
+
+      Some(&TENDERMINT_MESSAGE) => {
+        let Ok(msg) =
+          SignedMessageFor::<TendermintNetwork<D, T, P>>::decode::<&[u8]>(&mut &msg[1 ..])
+        else {
+          log::error!("received invalid tendermint message");
+          return false;
+        };
+
+        self.messages.write().await.send(msg).await.unwrap();
+        false
+      }
+
+      _ => false,
+    }
+  }
+
+  /// Get a Future which will resolve once the next block has been added.
+  pub async fn next_block_notification(
+    &self,
+  ) -> impl Send + Sync + core::future::Future<Output = Result<(), impl Send + Sync>> {
+    let (tx, rx) = tokio::sync::oneshot::channel();
+    self.network.blockchain.write().await.next_block_notifications.push_back(tx);
+    rx
+  }
+}
+
+#[derive(Clone)]
+pub struct TributaryReader<D: Db, T: TransactionTrait>(D, [u8; 32], PhantomData<T>);
+impl<D: Db, T: TransactionTrait> TributaryReader<D, T> {
+  pub fn genesis(&self) -> [u8; 32] {
+    self.1
+  }
+
+  // Since these values are static once set, they can be safely read from the database without lock
+  // acquisition
+  pub fn block(&self, hash: &[u8; 32]) -> Option<Block<T>> {
+    Blockchain::<D, T>::block_from_db(&self.0, self.1, hash)
+  }
+  pub fn commit(&self, hash: &[u8; 32]) -> Option<Vec<u8>> {
+    Blockchain::<D, T>::commit_from_db(&self.0, self.1, hash)
+  }
+  pub fn parsed_commit(&self, hash: &[u8; 32]) -> Option<Commit<Validators>> {
+    self.commit(hash).map(|commit| Commit::<Validators>::decode(&mut commit.as_ref()).unwrap())
+  }
+  pub fn block_after(&self, hash: &[u8; 32]) -> Option<[u8; 32]> {
+    Blockchain::<D, T>::block_after(&self.0, self.1, hash)
+  }
+  pub fn time_of_block(&self, hash: &[u8; 32]) -> Option<u64> {
+    self
+      .commit(hash)
+      .map(|commit| Commit::<Validators>::decode(&mut commit.as_ref()).unwrap().end_time)
+  }
+
+  pub fn locally_provided_txs_in_block(&self, hash: &[u8; 32], order: &str) -> bool {
+    Blockchain::<D, T>::locally_provided_txs_in_block(&self.0, &self.1, hash, order)
+  }
+
+  // This isn't static, yet can be read with only minor discrepancy risks
+  pub fn tip(&self) -> [u8; 32] {
+    Blockchain::<D, T>::tip_from_db(&self.0, self.1)
+  }
+}

coordinator/tributary-sdk/src/mempool.rs

@@ -0,0 +1,259 @@
+use std::collections::HashMap;
+
+use ciphersuite::{Ciphersuite, Ristretto};
+
+use serai_db::{DbTxn, Db};
+
+use tendermint::ext::{Network, Commit};
+
+use crate::{
+  ACCOUNT_MEMPOOL_LIMIT, ReadWrite,
+  transaction::{
+    Signed, TransactionKind, TransactionError, Transaction as TransactionTrait, verify_transaction,
+  },
+  tendermint::tx::verify_tendermint_tx,
+  Transaction,
+};
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub(crate) struct Mempool<D: Db, T: TransactionTrait> {
+  db: D,
+  genesis: [u8; 32],
+
+  last_nonce_in_mempool: HashMap<(<Ristretto as Ciphersuite>::G, Vec<u8>), u32>,
+  txs: HashMap<[u8; 32], Transaction<T>>,
+  txs_per_signer: HashMap<<Ristretto as Ciphersuite>::G, u32>,
+}
+
+impl<D: Db, T: TransactionTrait> Mempool<D, T> {
+  fn transaction_key(&self, hash: &[u8]) -> Vec<u8> {
+    D::key(b"tributary_mempool", b"transaction", [self.genesis.as_ref(), hash].concat())
+  }
+  fn current_mempool_key(&self) -> Vec<u8> {
+    D::key(b"tributary_mempool", b"current", self.genesis)
+  }
+
+  // save given tx to the mempool db
+  fn save_tx(&mut self, tx: Transaction<T>) {
+    let tx_hash = tx.hash();
+    let transaction_key = self.transaction_key(&tx_hash);
+    let current_mempool_key = self.current_mempool_key();
+    let mut current_mempool = self.db.get(&current_mempool_key).unwrap_or(vec![]);
+
+    let mut txn = self.db.txn();
+    txn.put(transaction_key, tx.serialize());
+    current_mempool.extend(tx_hash);
+    txn.put(current_mempool_key, current_mempool);
+    txn.commit();
+
+    self.txs.insert(tx_hash, tx);
+  }
+
+  fn unsigned_already_exist(
+    &self,
+    hash: [u8; 32],
+    unsigned_in_chain: impl Fn([u8; 32]) -> bool,
+  ) -> bool {
+    unsigned_in_chain(hash) || self.txs.contains_key(&hash)
+  }
+
+  pub(crate) fn new(db: D, genesis: [u8; 32]) -> Self {
+    let mut res = Mempool {
+      db,
+      genesis,
+      last_nonce_in_mempool: HashMap::new(),
+      txs: HashMap::new(),
+      txs_per_signer: HashMap::new(),
+    };
+
+    let current_mempool = res.db.get(res.current_mempool_key()).unwrap_or(vec![]);
+
+    for hash in current_mempool.chunks(32) {
+      let hash: [u8; 32] = hash.try_into().unwrap();
+      let tx: Transaction<T> =
+        Transaction::read::<&[u8]>(&mut res.db.get(res.transaction_key(&hash)).unwrap().as_ref())
+          .unwrap();
+      debug_assert_eq!(tx.hash(), hash);
+
+      match tx {
+        Transaction::Tendermint(tx) => {
+          res.txs.insert(hash, Transaction::Tendermint(tx));
+        }
+        Transaction::Application(tx) => match tx.kind() {
+          TransactionKind::Signed(order, Signed { signer, nonce, .. }) => {
+            let amount = *res.txs_per_signer.get(&signer).unwrap_or(&0) + 1;
+            res.txs_per_signer.insert(signer, amount);
+
+            if let Some(prior_nonce) =
+              res.last_nonce_in_mempool.insert((signer, order.clone()), nonce)
+            {
+              assert_eq!(prior_nonce, nonce - 1);
+            }
+
+            res.txs.insert(hash, Transaction::Application(tx));
+          }
+          TransactionKind::Unsigned => {
+            res.txs.insert(hash, Transaction::Application(tx));
+          }
+          _ => panic!("mempool database had a provided transaction"),
+        },
+      }
+    }
+
+    res
+  }
+
+  // Returns Ok(true) if new, Ok(false) if an already present unsigned, or the error.
+  pub(crate) fn add<
+    N: Network,
+    F: FnOnce(<Ristretto as Ciphersuite>::G, Vec<u8>) -> Option<u32>,
+  >(
+    &mut self,
+    blockchain_next_nonce: F,
+    internal: bool,
+    tx: Transaction<T>,
+    schema: &N::SignatureScheme,
+    unsigned_in_chain: impl Fn([u8; 32]) -> bool,
+    commit: impl Fn(u64) -> Option<Commit<N::SignatureScheme>>,
+  ) -> Result<bool, TransactionError> {
+    match &tx {
+      Transaction::Tendermint(tendermint_tx) => {
+        // All Tendermint transactions should be unsigned
+        assert_eq!(TransactionKind::Unsigned, tendermint_tx.kind());
+
+        // check we have the tx in the pool/chain
+        if self.unsigned_already_exist(tx.hash(), unsigned_in_chain) {
+          return Ok(false);
+        }
+
+        // verify the tx
+        verify_tendermint_tx::<N>(tendermint_tx, schema, commit)?;
+      }
+      Transaction::Application(app_tx) => {
+        match app_tx.kind() {
+          TransactionKind::Signed(order, Signed { signer, .. }) => {
+            // Get the nonce from the blockchain
+            let Some(blockchain_next_nonce) = blockchain_next_nonce(signer, order.clone()) else {
+              // Not a participant
+              Err(TransactionError::InvalidSigner)?
+            };
+            let mut next_nonce = blockchain_next_nonce;
+
+            if let Some(mempool_last_nonce) =
+              self.last_nonce_in_mempool.get(&(signer, order.clone()))
+            {
+              assert!(*mempool_last_nonce >= blockchain_next_nonce);
+              next_nonce = *mempool_last_nonce + 1;
+            }
+
+            // If we have too many transactions from this sender, don't add this yet UNLESS we are
+            // this sender
+            let amount_in_pool = *self.txs_per_signer.get(&signer).unwrap_or(&0) + 1;
+            if !internal && (amount_in_pool > ACCOUNT_MEMPOOL_LIMIT) {
+              Err(TransactionError::TooManyInMempool)?;
+            }
+
+            verify_transaction(app_tx, self.genesis, &mut |_, _| Some(next_nonce))?;
+            self.last_nonce_in_mempool.insert((signer, order.clone()), next_nonce);
+            self.txs_per_signer.insert(signer, amount_in_pool);
+          }
+          TransactionKind::Unsigned => {
+            // check we have the tx in the pool/chain
+            if self.unsigned_already_exist(tx.hash(), unsigned_in_chain) {
+              return Ok(false);
+            }
+
+            app_tx.verify()?;
+          }
+          TransactionKind::Provided(_) => Err(TransactionError::ProvidedAddedToMempool)?,
+        }
+      }
+    }
+
+    // Save the TX to the pool
+    self.save_tx(tx);
+    Ok(true)
+  }
+
+  // Returns None if the mempool doesn't have a nonce tracked.
+  pub(crate) fn next_nonce_in_mempool(
+    &self,
+    signer: &<Ristretto as Ciphersuite>::G,
+    order: Vec<u8>,
+  ) -> Option<u32> {
+    self.last_nonce_in_mempool.get(&(*signer, order)).copied().map(|nonce| nonce + 1)
+  }
+
+  /// Get transactions to include in a block.
+  pub(crate) fn block(&mut self) -> Vec<Transaction<T>> {
+    let mut unsigned = vec![];
+    let mut signed = vec![];
+    for hash in self.txs.keys().copied().collect::<Vec<_>>() {
+      let tx = &self.txs[&hash];
+
+      match tx.kind() {
+        TransactionKind::Signed(_, Signed { .. }) => {
+          signed.push(tx.clone());
+        }
+        TransactionKind::Unsigned => {
+          unsigned.push(tx.clone());
+        }
+        _ => panic!("provided transaction entered mempool"),
+      }
+    }
+
+    // Sort signed by nonce
+    let nonce = |tx: &Transaction<T>| {
+      if let TransactionKind::Signed(_, Signed { nonce, .. }) = tx.kind() {
+        nonce
+      } else {
+        unreachable!()
+      }
+    };
+    signed.sort_by(|a, b| nonce(a).partial_cmp(&nonce(b)).unwrap());
+
+    // unsigned first, then signed.
+    unsigned.append(&mut signed);
+    unsigned
+  }
+
+  /// Remove a transaction from the mempool.
+  pub(crate) fn remove(&mut self, tx: &[u8; 32]) {
+    let transaction_key = self.transaction_key(tx);
+    let current_mempool_key = self.current_mempool_key();
+    let current_mempool = self.db.get(&current_mempool_key).unwrap_or(vec![]);
+
+    let mut i = 0;
+    while i < current_mempool.len() {
+      if &current_mempool[i .. (i + 32)] == tx {
+        break;
+      }
+      i += 32;
+    }
+
+    // This doesn't have to be atomic with any greater operation
+    let mut txn = self.db.txn();
+    txn.del(transaction_key);
+    if i != current_mempool.len() {
+      txn
+        .put(current_mempool_key, [&current_mempool[.. i], &current_mempool[(i + 32) ..]].concat());
+    }
+    txn.commit();
+
+    if let Some(tx) = self.txs.remove(tx) {
+      if let TransactionKind::Signed(order, Signed { signer, nonce, .. }) = tx.kind() {
+        let amount = *self.txs_per_signer.get(&signer).unwrap() - 1;
+        self.txs_per_signer.insert(signer, amount);
+
+        if self.last_nonce_in_mempool.get(&(signer, order.clone())) == Some(&nonce) {
+          self.last_nonce_in_mempool.remove(&(signer, order));
+        }
+      }
+    }
+  }
+
+  #[cfg(test)]
+  pub(crate) fn txs(&self) -> &HashMap<[u8; 32], Transaction<T>> {
+    &self.txs
+  }
+}

coordinator/tributary-sdk/src/merkle.rs

@@ -0,0 +1,31 @@
+use blake2::{Digest, Blake2s256};
+
+pub(crate) fn merkle(hash_args: &[[u8; 32]]) -> [u8; 32] {
+  let mut hashes = Vec::with_capacity(hash_args.len());
+  for hash in hash_args {
+    hashes.push(Blake2s256::digest([b"leaf_hash".as_ref(), hash].concat()));
+  }
+
+  let zero = [0; 32];
+  let mut interim;
+  while hashes.len() > 1 {
+    interim = Vec::with_capacity((hashes.len() + 1) / 2);
+
+    let mut i = 0;
+    while i < hashes.len() {
+      interim.push(Blake2s256::digest(
+        [
+          b"branch_hash".as_ref(),
+          hashes[i].as_ref(),
+          hashes.get(i + 1).map_or(zero.as_ref(), AsRef::as_ref),
+        ]
+        .concat(),
+      ));
+      i += 2;
+    }
+
+    hashes = interim;
+  }
+
+  hashes.first().copied().map_or(zero, Into::into)
+}

coordinator/tributary-sdk/src/provided.rs

@@ -0,0 +1,191 @@
+use std::collections::{VecDeque, HashMap};
+
+use thiserror::Error;
+
+use serai_db::{Get, DbTxn, Db};
+
+use crate::transaction::{TransactionKind, TransactionError, Transaction, verify_transaction};
+
+#[derive(Clone, PartialEq, Eq, Debug, Error)]
+pub enum ProvidedError {
+  /// The provided transaction's kind wasn't Provided
+  #[error("transaction wasn't a provided transaction")]
+  NotProvided,
+  /// The provided transaction was invalid
+  #[error("provided transaction was invalid")]
+  InvalidProvided(TransactionError),
+  /// Transaction was already provided
+  #[error("transaction was already provided")]
+  AlreadyProvided,
+  /// Local transaction mismatches the on-chain provided
+  #[error("local provides mismatches on-chain provided")]
+  LocalMismatchesOnChain,
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct ProvidedTransactions<D: Db, T: Transaction> {
+  db: D,
+  genesis: [u8; 32],
+
+  pub(crate) transactions: HashMap<&'static str, VecDeque<T>>,
+}
+
+impl<D: Db, T: Transaction> ProvidedTransactions<D, T> {
+  fn transaction_key(&self, hash: &[u8]) -> Vec<u8> {
+    D::key(b"tributary_provided", b"transaction", [self.genesis.as_ref(), hash].concat())
+  }
+  fn current_provided_key(&self) -> Vec<u8> {
+    D::key(b"tributary_provided", b"current", self.genesis)
+  }
+  pub(crate) fn locally_provided_quantity_key(genesis: &[u8; 32], order: &str) -> Vec<u8> {
+    D::key(b"tributary_provided", b"local_quantity", [genesis, order.as_bytes()].concat())
+  }
+  pub(crate) fn on_chain_provided_quantity_key(genesis: &[u8; 32], order: &str) -> Vec<u8> {
+    D::key(b"tributary_provided", b"on_chain_quantity", [genesis, order.as_bytes()].concat())
+  }
+  pub(crate) fn block_provided_quantity_key(
+    genesis: &[u8; 32],
+    block: &[u8; 32],
+    order: &str,
+  ) -> Vec<u8> {
+    D::key(b"tributary_provided", b"block_quantity", [genesis, block, order.as_bytes()].concat())
+  }
+
+  pub(crate) fn on_chain_provided_key(genesis: &[u8; 32], order: &str, id: u32) -> Vec<u8> {
+    D::key(
+      b"tributary_provided",
+      b"on_chain_tx",
+      [genesis, order.as_bytes(), &id.to_le_bytes()].concat(),
+    )
+  }
+
+  pub(crate) fn new(db: D, genesis: [u8; 32]) -> Self {
+    let mut res = ProvidedTransactions { db, genesis, transactions: HashMap::new() };
+
+    let currently_provided = res.db.get(res.current_provided_key()).unwrap_or(vec![]);
+    let mut i = 0;
+    while i < currently_provided.len() {
+      let tx = T::read::<&[u8]>(
+        &mut res.db.get(res.transaction_key(&currently_provided[i .. (i + 32)])).unwrap().as_ref(),
+      )
+      .unwrap();
+
+      let TransactionKind::Provided(order) = tx.kind() else {
+        panic!("provided transaction saved to disk wasn't provided");
+      };
+
+      if !res.transactions.contains_key(order) {
+        res.transactions.insert(order, VecDeque::new());
+      }
+      res.transactions.get_mut(order).unwrap().push_back(tx);
+
+      i += 32;
+    }
+
+    res
+  }
+
+  /// Provide a transaction for inclusion in a block.
+  pub(crate) fn provide(&mut self, tx: T) -> Result<(), ProvidedError> {
+    let TransactionKind::Provided(order) = tx.kind() else { Err(ProvidedError::NotProvided)? };
+
+    match verify_transaction(&tx, self.genesis, &mut |_, _| None) {
+      Ok(()) => {}
+      Err(e) => Err(ProvidedError::InvalidProvided(e))?,
+    }
+    let tx_hash = tx.hash();
+
+    // Check it wasn't already provided
+    let provided_key = self.transaction_key(&tx_hash);
+    if self.db.get(&provided_key).is_some() {
+      Err(ProvidedError::AlreadyProvided)?;
+    }
+
+    // get local and on-chain tx numbers
+    let local_key = Self::locally_provided_quantity_key(&self.genesis, order);
+    let mut local_quantity =
+      self.db.get(&local_key).map_or(0, |bytes| u32::from_le_bytes(bytes.try_into().unwrap()));
+    let on_chain_key = Self::on_chain_provided_quantity_key(&self.genesis, order);
+    let on_chain_quantity =
+      self.db.get(on_chain_key).map_or(0, |bytes| u32::from_le_bytes(bytes.try_into().unwrap()));
+
+    let current_provided_key = self.current_provided_key();
+
+    // This would have a race-condition with multiple calls to provide, though this takes &mut self
+    // peventing multiple calls at once
+    let mut txn = self.db.txn();
+    txn.put(provided_key, tx.serialize());
+
+    let this_provided_id = local_quantity;
+
+    local_quantity += 1;
+    txn.put(local_key, local_quantity.to_le_bytes());
+
+    if this_provided_id < on_chain_quantity {
+      // Verify against the on-chain version
+      if tx_hash.as_ref() !=
+        txn.get(Self::on_chain_provided_key(&self.genesis, order, this_provided_id)).unwrap()
+      {
+        Err(ProvidedError::LocalMismatchesOnChain)?;
+      }
+      txn.commit();
+    } else {
+      let mut currently_provided = txn.get(&current_provided_key).unwrap_or(vec![]);
+      currently_provided.extend(tx_hash);
+      txn.put(current_provided_key, currently_provided);
+      txn.commit();
+
+      if !self.transactions.contains_key(order) {
+        self.transactions.insert(order, VecDeque::new());
+      }
+      self.transactions.get_mut(order).unwrap().push_back(tx);
+    }
+
+    Ok(())
+  }
+
+  /// Complete a provided transaction, no longer proposing it nor voting for its validity.
+  pub(crate) fn complete(
+    &mut self,
+    txn: &mut D::Transaction<'_>,
+    order: &'static str,
+    block: [u8; 32],
+    tx: [u8; 32],
+  ) {
+    if let Some(next_tx) = self.transactions.get_mut(order).and_then(VecDeque::pop_front) {
+      assert_eq!(next_tx.hash(), tx);
+
+      let current_provided_key = self.current_provided_key();
+      let mut currently_provided = txn.get(&current_provided_key).unwrap();
+
+      // Find this TX's hash
+      let mut i = 0;
+      loop {
+        if currently_provided[i .. (i + 32)] == tx {
+          assert_eq!(&currently_provided.drain(i .. (i + 32)).collect::<Vec<_>>(), &tx);
+          break;
+        }
+
+        i += 32;
+        if i >= currently_provided.len() {
+          panic!("couldn't find completed TX in currently provided");
+        }
+      }
+
+      txn.put(current_provided_key, currently_provided);
+    }
+
+    // bump the on-chain tx number.
+    let on_chain_key = Self::on_chain_provided_quantity_key(&self.genesis, order);
+    let block_order_key = Self::block_provided_quantity_key(&self.genesis, &block, order);
+    let mut on_chain_quantity =
+      self.db.get(&on_chain_key).map_or(0, |bytes| u32::from_le_bytes(bytes.try_into().unwrap()));
+
+    let this_provided_id = on_chain_quantity;
+    txn.put(Self::on_chain_provided_key(&self.genesis, order, this_provided_id), tx);
+
+    on_chain_quantity += 1;
+    txn.put(on_chain_key, on_chain_quantity.to_le_bytes());
+    txn.put(block_order_key, on_chain_quantity.to_le_bytes());
+  }
+}

coordinator/tributary-sdk/src/tendermint/mod.rs

@@ -0,0 +1,424 @@
+use core::{ops::Deref, future::Future};
+use std::{sync::Arc, collections::HashMap};
+
+use subtle::ConstantTimeEq;
+use zeroize::{Zeroize, Zeroizing};
+
+use rand::{SeedableRng, seq::SliceRandom};
+use rand_chacha::ChaCha12Rng;
+
+use transcript::{Transcript, RecommendedTranscript};
+
+use ciphersuite::{
+  group::{
+    GroupEncoding,
+    ff::{Field, PrimeField},
+  },
+  Ciphersuite, Ristretto,
+};
+use schnorr::{
+  SchnorrSignature,
+  aggregate::{SchnorrAggregator, SchnorrAggregate},
+};
+
+use serai_db::Db;
+
+use scale::{Encode, Decode};
+use tendermint::{
+  SignedMessageFor,
+  ext::{
+    BlockNumber, RoundNumber, Signer as SignerTrait, SignatureScheme, Weights, Block as BlockTrait,
+    BlockError as TendermintBlockError, Commit, Network,
+  },
+  SlashEvent,
+};
+
+use tokio::sync::RwLock;
+
+use crate::{
+  TENDERMINT_MESSAGE, TRANSACTION_MESSAGE, ReadWrite, transaction::Transaction as TransactionTrait,
+  Transaction, BlockHeader, Block, BlockError, Blockchain, P2p,
+};
+
+pub mod tx;
+use tx::TendermintTx;
+
+const DST: &[u8] = b"Tributary Tendermint Commit Aggregator";
+
+fn challenge(
+  genesis: [u8; 32],
+  key: [u8; 32],
+  nonce: &[u8],
+  msg: &[u8],
+) -> <Ristretto as Ciphersuite>::F {
+  let mut transcript = RecommendedTranscript::new(b"Tributary Chain Tendermint Message");
+  transcript.append_message(b"genesis", genesis);
+  transcript.append_message(b"key", key);
+  transcript.append_message(b"nonce", nonce);
+  transcript.append_message(b"message", msg);
+
+  <Ristretto as Ciphersuite>::F::from_bytes_mod_order_wide(&transcript.challenge(b"schnorr").into())
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct Signer {
+  genesis: [u8; 32],
+  key: Zeroizing<<Ristretto as Ciphersuite>::F>,
+}
+
+impl Signer {
+  pub(crate) fn new(genesis: [u8; 32], key: Zeroizing<<Ristretto as Ciphersuite>::F>) -> Signer {
+    Signer { genesis, key }
+  }
+}
+
+impl SignerTrait for Signer {
+  type ValidatorId = [u8; 32];
+  type Signature = [u8; 64];
+
+  /// Returns the validator's current ID. Returns None if they aren't a current validator.
+  fn validator_id(&self) -> impl Send + Future<Output = Option<Self::ValidatorId>> {
+    async move { Some((Ristretto::generator() * self.key.deref()).to_bytes()) }
+  }
+
+  /// Sign a signature with the current validator's private key.
+  fn sign(&self, msg: &[u8]) -> impl Send + Future<Output = Self::Signature> {
+    async move {
+      let mut nonce =
+        Zeroizing::new(RecommendedTranscript::new(b"Tributary Chain Tendermint Nonce"));
+      nonce.append_message(b"genesis", self.genesis);
+      nonce.append_message(b"key", Zeroizing::new(self.key.deref().to_repr()).as_ref());
+      nonce.append_message(b"message", msg);
+      let mut nonce = nonce.challenge(b"nonce");
+
+      let mut nonce_arr = [0; 64];
+      nonce_arr.copy_from_slice(nonce.as_ref());
+
+      let nonce_ref: &mut [u8] = nonce.as_mut();
+      nonce_ref.zeroize();
+      let nonce_ref: &[u8] = nonce.as_ref();
+      assert_eq!(nonce_ref, [0; 64].as_ref());
+
+      let nonce =
+        Zeroizing::new(<Ristretto as Ciphersuite>::F::from_bytes_mod_order_wide(&nonce_arr));
+      nonce_arr.zeroize();
+
+      assert!(!bool::from(nonce.ct_eq(&<Ristretto as Ciphersuite>::F::ZERO)));
+
+      let challenge = challenge(
+        self.genesis,
+        (Ristretto::generator() * self.key.deref()).to_bytes(),
+        (Ristretto::generator() * nonce.deref()).to_bytes().as_ref(),
+        msg,
+      );
+
+      let sig = SchnorrSignature::<Ristretto>::sign(&self.key, nonce, challenge).serialize();
+
+      let mut res = [0; 64];
+      res.copy_from_slice(&sig);
+      res
+    }
+  }
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct Validators {
+  genesis: [u8; 32],
+  total_weight: u64,
+  weights: HashMap<[u8; 32], u64>,
+  robin: Vec<[u8; 32]>,
+}
+
+impl Validators {
+  pub(crate) fn new(
+    genesis: [u8; 32],
+    validators: Vec<(<Ristretto as Ciphersuite>::G, u64)>,
+  ) -> Option<Validators> {
+    let mut total_weight = 0;
+    let mut weights = HashMap::new();
+
+    let mut transcript = RecommendedTranscript::new(b"Round Robin Randomization");
+    let mut robin = vec![];
+    for (validator, weight) in validators {
+      let validator = validator.to_bytes();
+      if weight == 0 {
+        return None;
+      }
+      total_weight += weight;
+      weights.insert(validator, weight);
+
+      transcript.append_message(b"validator", validator);
+      transcript.append_message(b"weight", weight.to_le_bytes());
+      robin.extend(vec![validator; usize::try_from(weight).unwrap()]);
+    }
+    robin.shuffle(&mut ChaCha12Rng::from_seed(transcript.rng_seed(b"robin")));
+
+    Some(Validators { genesis, total_weight, weights, robin })
+  }
+}
+
+impl SignatureScheme for Validators {
+  type ValidatorId = [u8; 32];
+  type Signature = [u8; 64];
+  type AggregateSignature = Vec<u8>;
+  type Signer = Arc<Signer>;
+
+  #[must_use]
+  fn verify(&self, validator: Self::ValidatorId, msg: &[u8], sig: &Self::Signature) -> bool {
+    if !self.weights.contains_key(&validator) {
+      return false;
+    }
+    let Ok(validator_point) = Ristretto::read_G::<&[u8]>(&mut validator.as_ref()) else {
+      return false;
+    };
+    let Ok(actual_sig) = SchnorrSignature::<Ristretto>::read::<&[u8]>(&mut sig.as_ref()) else {
+      return false;
+    };
+    actual_sig.verify(validator_point, challenge(self.genesis, validator, &sig[.. 32], msg))
+  }
+
+  fn aggregate(
+    &self,
+    validators: &[Self::ValidatorId],
+    msg: &[u8],
+    sigs: &[Self::Signature],
+  ) -> Self::AggregateSignature {
+    assert_eq!(validators.len(), sigs.len());
+
+    let mut aggregator = SchnorrAggregator::<Ristretto>::new(DST);
+    for (key, sig) in validators.iter().zip(sigs) {
+      let actual_sig = SchnorrSignature::<Ristretto>::read::<&[u8]>(&mut sig.as_ref()).unwrap();
+      let challenge = challenge(self.genesis, *key, actual_sig.R.to_bytes().as_ref(), msg);
+      aggregator.aggregate(challenge, actual_sig);
+    }
+
+    let aggregate = aggregator.complete().unwrap();
+    aggregate.serialize()
+  }
+
+  #[must_use]
+  fn verify_aggregate(
+    &self,
+    signers: &[Self::ValidatorId],
+    msg: &[u8],
+    sig: &Self::AggregateSignature,
+  ) -> bool {
+    let Ok(aggregate) = SchnorrAggregate::<Ristretto>::read::<&[u8]>(&mut sig.as_slice()) else {
+      return false;
+    };
+
+    if signers.len() != aggregate.Rs().len() {
+      return false;
+    }
+
+    let mut challenges = vec![];
+    for (key, nonce) in signers.iter().zip(aggregate.Rs()) {
+      challenges.push(challenge(self.genesis, *key, nonce.to_bytes().as_ref(), msg));
+    }
+
+    aggregate.verify(
+      DST,
+      signers
+        .iter()
+        .zip(challenges)
+        .map(|(s, c)| (<Ristretto as Ciphersuite>::read_G(&mut s.as_slice()).unwrap(), c))
+        .collect::<Vec<_>>()
+        .as_slice(),
+    )
+  }
+}
+
+impl Weights for Validators {
+  type ValidatorId = [u8; 32];
+
+  fn total_weight(&self) -> u64 {
+    self.total_weight
+  }
+  fn weight(&self, validator: Self::ValidatorId) -> u64 {
+    self.weights[&validator]
+  }
+  fn proposer(&self, block: BlockNumber, round: RoundNumber) -> Self::ValidatorId {
+    let block = usize::try_from(block.0).unwrap();
+    let round = usize::try_from(round.0).unwrap();
+    // If multiple rounds are used, a naive block + round would cause the same index to be chosen
+    // in quick succession.
+    // Accordingly, if we use additional rounds, jump halfway around.
+    // While this is still game-able, it's not explicitly reusing indexes immediately after each
+    // other.
+    self.robin
+      [(block + (if round == 0 { 0 } else { round + (self.robin.len() / 2) })) % self.robin.len()]
+  }
+}
+
+#[derive(Clone, PartialEq, Eq, Debug, Encode, Decode)]
+pub struct TendermintBlock(pub Vec<u8>);
+impl BlockTrait for TendermintBlock {
+  type Id = [u8; 32];
+  fn id(&self) -> Self::Id {
+    BlockHeader::read::<&[u8]>(&mut self.0.as_ref()).unwrap().hash()
+  }
+}
+
+#[derive(Clone, Debug)]
+pub struct TendermintNetwork<D: Db, T: TransactionTrait, P: P2p> {
+  pub(crate) genesis: [u8; 32],
+
+  pub(crate) signer: Arc<Signer>,
+  pub(crate) validators: Arc<Validators>,
+  pub(crate) blockchain: Arc<RwLock<Blockchain<D, T>>>,
+
+  pub(crate) p2p: P,
+}
+
+pub const BLOCK_PROCESSING_TIME: u32 = 999;
+pub const LATENCY_TIME: u32 = 1667;
+pub const TARGET_BLOCK_TIME: u32 = BLOCK_PROCESSING_TIME + (3 * LATENCY_TIME);
+
+impl<D: Db, T: TransactionTrait, P: P2p> Network for TendermintNetwork<D, T, P> {
+  type Db = D;
+
+  type ValidatorId = [u8; 32];
+  type SignatureScheme = Arc<Validators>;
+  type Weights = Arc<Validators>;
+  type Block = TendermintBlock;
+
+  // These are in milliseconds and create a six-second block time.
+  // The block time is the latency on message delivery (where a message is some piece of data
+  // embedded in a transaction) times three plus the block processing time, hence why it should be
+  // kept low.
+  const BLOCK_PROCESSING_TIME: u32 = BLOCK_PROCESSING_TIME;
+  const LATENCY_TIME: u32 = LATENCY_TIME;
+
+  fn signer(&self) -> Arc<Signer> {
+    self.signer.clone()
+  }
+  fn signature_scheme(&self) -> Arc<Validators> {
+    self.validators.clone()
+  }
+  fn weights(&self) -> Arc<Validators> {
+    self.validators.clone()
+  }
+
+  fn broadcast(&mut self, msg: SignedMessageFor<Self>) -> impl Send + Future<Output = ()> {
+    async move {
+      let mut to_broadcast = vec![TENDERMINT_MESSAGE];
+      to_broadcast.extend(msg.encode());
+      self.p2p.broadcast(self.genesis, to_broadcast).await
+    }
+  }
+
+  fn slash(
+    &mut self,
+    validator: Self::ValidatorId,
+    slash_event: SlashEvent,
+  ) -> impl Send + Future<Output = ()> {
+    async move {
+      log::error!(
+        "validator {} triggered a slash event on tributary {} (with evidence: {})",
+        hex::encode(validator),
+        hex::encode(self.genesis),
+        matches!(slash_event, SlashEvent::WithEvidence(_)),
+      );
+
+      let signer = self.signer();
+      let Some(tx) = (match slash_event {
+        SlashEvent::WithEvidence(evidence) => {
+          // create an unsigned evidence tx
+          Some(TendermintTx::SlashEvidence(evidence))
+        }
+        SlashEvent::Id(_reason, _block, _round) => {
+          // TODO: Increase locally observed slash points
+          None
+        }
+      }) else {
+        return;
+      };
+
+      // add tx to blockchain and broadcast to peers
+      let mut to_broadcast = vec![TRANSACTION_MESSAGE];
+      tx.write(&mut to_broadcast).unwrap();
+      if self.blockchain.write().await.add_transaction::<Self>(
+        true,
+        Transaction::Tendermint(tx),
+        &self.signature_scheme(),
+      ) == Ok(true)
+      {
+        self.p2p.broadcast(signer.genesis, to_broadcast).await;
+      }
+    }
+  }
+
+  fn validate(
+    &self,
+    block: &Self::Block,
+  ) -> impl Send + Future<Output = Result<(), TendermintBlockError>> {
+    async move {
+      let block =
+        Block::read::<&[u8]>(&mut block.0.as_ref()).map_err(|_| TendermintBlockError::Fatal)?;
+      self
+        .blockchain
+        .read()
+        .await
+        .verify_block::<Self>(&block, &self.signature_scheme(), false)
+        .map_err(|e| match e {
+          BlockError::NonLocalProvided(_) => TendermintBlockError::Temporal,
+          _ => {
+            log::warn!("Tributary Tendermint validate returning BlockError::Fatal due to {e:?}");
+            TendermintBlockError::Fatal
+          }
+        })
+    }
+  }
+
+  fn add_block(
+    &mut self,
+    serialized_block: Self::Block,
+    commit: Commit<Self::SignatureScheme>,
+  ) -> impl Send + Future<Output = Option<Self::Block>> {
+    async move {
+      let invalid_block = || {
+        // There's a fatal flaw in the code, it's behind a hard fork, or the validators turned
+        // malicious
+        // All justify a halt to then achieve social consensus from
+        // TODO: Under multiple validator sets, a small validator set turning malicious knocks
+        // off the entire network. That's an unacceptable DoS.
+        panic!("validators added invalid block to tributary {}", hex::encode(self.genesis));
+      };
+
+      // Tendermint should only produce valid commits
+      assert!(self.verify_commit(serialized_block.id(), &commit));
+
+      let Ok(block) = Block::read::<&[u8]>(&mut serialized_block.0.as_ref()) else {
+        return invalid_block();
+      };
+
+      let encoded_commit = commit.encode();
+      loop {
+        let block_res = self.blockchain.write().await.add_block::<Self>(
+          &block,
+          encoded_commit.clone(),
+          &self.signature_scheme(),
+        );
+        match block_res {
+          Ok(()) => {
+            // If we successfully added this block, break
+            break;
+          }
+          Err(BlockError::NonLocalProvided(hash)) => {
+            log::error!(
+              "missing provided transaction {} which other validators on tributary {} had",
+              hex::encode(hash),
+              hex::encode(self.genesis)
+            );
+            tokio::time::sleep(core::time::Duration::from_secs(5)).await;
+          }
+          _ => return invalid_block(),
+        }
+      }
+
+      Some(TendermintBlock(
+        self.blockchain.write().await.build_block::<Self>(&self.signature_scheme()).serialize(),
+      ))
+    }
+  }
+}

coordinator/tributary-sdk/src/tendermint/tx.rs

@@ -0,0 +1,76 @@
+use std::io;
+
+use scale::{Encode, Decode, IoReader};
+
+use blake2::{Digest, Blake2s256};
+
+use ciphersuite::{Ciphersuite, Ristretto};
+
+use crate::{
+  transaction::{Transaction, TransactionKind, TransactionError},
+  ReadWrite,
+};
+
+use tendermint::{
+  verify_tendermint_evidence,
+  ext::{Network, Commit},
+};
+
+pub use tendermint::{Evidence, decode_signed_message};
+
+#[allow(clippy::large_enum_variant)]
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub enum TendermintTx {
+  SlashEvidence(Evidence),
+}
+
+impl ReadWrite for TendermintTx {
+  fn read<R: io::Read>(reader: &mut R) -> io::Result<Self> {
+    Evidence::decode(&mut IoReader(reader))
+      .map(TendermintTx::SlashEvidence)
+      .map_err(|_| io::Error::new(io::ErrorKind::InvalidData, "invalid evidence format"))
+  }
+
+  fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
+    match self {
+      TendermintTx::SlashEvidence(ev) => writer.write_all(&ev.encode()),
+    }
+  }
+}
+
+impl Transaction for TendermintTx {
+  fn kind(&self) -> TransactionKind {
+    // There's an assert elsewhere in the codebase expecting this behavior
+    // If we do want to add Provided/Signed TendermintTxs, review the implications carefully
+    TransactionKind::Unsigned
+  }
+
+  fn hash(&self) -> [u8; 32] {
+    Blake2s256::digest(self.serialize()).into()
+  }
+
+  fn sig_hash(&self, _genesis: [u8; 32]) -> <Ristretto as Ciphersuite>::F {
+    match self {
+      TendermintTx::SlashEvidence(_) => panic!("sig_hash called on slash evidence transaction"),
+    }
+  }
+
+  fn verify(&self) -> Result<(), TransactionError> {
+    Ok(())
+  }
+}
+
+pub(crate) fn verify_tendermint_tx<N: Network>(
+  tx: &TendermintTx,
+  schema: &N::SignatureScheme,
+  commit: impl Fn(u64) -> Option<Commit<N::SignatureScheme>>,
+) -> Result<(), TransactionError> {
+  tx.verify()?;
+
+  match tx {
+    TendermintTx::SlashEvidence(ev) => verify_tendermint_evidence::<N>(ev, schema, commit)
+      .map_err(|_| TransactionError::InvalidContent)?,
+  }
+
+  Ok(())
+}

coordinator/tributary-sdk/src/tests/block.rs

@@ -0,0 +1,140 @@
+use std::{sync::Arc, io, collections::HashMap, fmt::Debug};
+
+use blake2::{Digest, Blake2s256};
+use ciphersuite::{
+  group::{ff::Field, Group},
+  Ciphersuite, Ristretto,
+};
+use schnorr::SchnorrSignature;
+
+use serai_db::MemDb;
+use tendermint::ext::Commit;
+
+use crate::{
+  ReadWrite, BlockError, Block, Transaction,
+  tests::p2p::DummyP2p,
+  transaction::{TransactionError, Signed, TransactionKind, Transaction as TransactionTrait},
+  tendermint::{TendermintNetwork, Validators},
+};
+
+type N = TendermintNetwork<MemDb, NonceTransaction, DummyP2p>;
+
+// A transaction solely defined by its nonce and a distinguisher (to allow creating distinct TXs
+// sharing a nonce).
+#[derive(Clone, PartialEq, Eq, Debug)]
+struct NonceTransaction(u32, u8, Signed);
+
+impl NonceTransaction {
+  fn new(nonce: u32, distinguisher: u8) -> Self {
+    NonceTransaction(
+      nonce,
+      distinguisher,
+      Signed {
+        signer: <Ristretto as Ciphersuite>::G::identity(),
+        nonce,
+        signature: SchnorrSignature::<Ristretto> {
+          R: <Ristretto as Ciphersuite>::G::identity(),
+          s: <Ristretto as Ciphersuite>::F::ZERO,
+        },
+      },
+    )
+  }
+}
+
+impl ReadWrite for NonceTransaction {
+  fn read<R: io::Read>(reader: &mut R) -> io::Result<Self> {
+    let mut nonce = [0; 4];
+    reader.read_exact(&mut nonce)?;
+    let nonce = u32::from_le_bytes(nonce);
+
+    let mut distinguisher = [0];
+    reader.read_exact(&mut distinguisher)?;
+
+    Ok(NonceTransaction::new(nonce, distinguisher[0]))
+  }
+
+  fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
+    writer.write_all(&self.0.to_le_bytes())?;
+    writer.write_all(&[self.1])
+  }
+}
+
+impl TransactionTrait for NonceTransaction {
+  fn kind(&self) -> TransactionKind {
+    TransactionKind::Signed(vec![], self.2.clone())
+  }
+
+  fn hash(&self) -> [u8; 32] {
+    Blake2s256::digest([self.0.to_le_bytes().as_ref(), &[self.1]].concat()).into()
+  }
+
+  fn verify(&self) -> Result<(), TransactionError> {
+    Ok(())
+  }
+}
+
+#[test]
+fn empty_block() {
+  const GENESIS: [u8; 32] = [0xff; 32];
+  const LAST: [u8; 32] = [0x01; 32];
+  let validators = Arc::new(Validators::new(GENESIS, vec![]).unwrap());
+  let commit = |_: u64| -> Option<Commit<Arc<Validators>>> {
+    Some(Commit::<Arc<Validators>> { end_time: 0, validators: vec![], signature: vec![] })
+  };
+  let provided_or_unsigned_in_chain = |_: [u8; 32]| false;
+  Block::<NonceTransaction>::new(LAST, vec![], vec![])
+    .verify::<N, _>(
+      GENESIS,
+      LAST,
+      HashMap::new(),
+      &mut |_, _| None,
+      &validators,
+      commit,
+      provided_or_unsigned_in_chain,
+      false,
+    )
+    .unwrap();
+}
+
+#[test]
+fn duplicate_nonces() {
+  const GENESIS: [u8; 32] = [0xff; 32];
+  const LAST: [u8; 32] = [0x01; 32];
+
+  let validators = Arc::new(Validators::new(GENESIS, vec![]).unwrap());
+
+  // Run once without duplicating a nonce, and once with, so that's confirmed to be the faulty
+  // component
+  for i in [1, 0] {
+    let mut mempool = vec![];
+    let mut insert = |tx: NonceTransaction| mempool.push(Transaction::Application(tx));
+    insert(NonceTransaction::new(0, 0));
+    insert(NonceTransaction::new(i, 1));
+
+    let commit = |_: u64| -> Option<Commit<Arc<Validators>>> {
+      Some(Commit::<Arc<Validators>> { end_time: 0, validators: vec![], signature: vec![] })
+    };
+    let provided_or_unsigned_in_chain = |_: [u8; 32]| false;
+
+    let mut last_nonce = 0;
+    let res = Block::new(LAST, vec![], mempool).verify::<N, _>(
+      GENESIS,
+      LAST,
+      HashMap::new(),
+      &mut |_, _| {
+        let res = last_nonce;
+        last_nonce += 1;
+        Some(res)
+      },
+      &validators,
+      commit,
+      provided_or_unsigned_in_chain,
+      false,
+    );
+    if i == 1 {
+      res.unwrap();
+    } else {
+      assert_eq!(res, Err(BlockError::TransactionError(TransactionError::InvalidNonce)));
+    }
+  }
+}

coordinator/tributary-sdk/src/tests/blockchain.rs

@@ -0,0 +1,540 @@
+use core::ops::Deref;
+use std::{
+  collections::{VecDeque, HashMap},
+  sync::Arc,
+  io,
+};
+
+use zeroize::Zeroizing;
+use rand::rngs::OsRng;
+
+use blake2::{Digest, Blake2s256};
+
+use ciphersuite::{group::ff::Field, Ciphersuite, Ristretto};
+
+use serai_db::{DbTxn, Db, MemDb};
+
+use crate::{
+  ReadWrite, TransactionKind,
+  transaction::Transaction as TransactionTrait,
+  TransactionError, Transaction, ProvidedError, ProvidedTransactions, merkle, BlockError, Block,
+  Blockchain,
+  tendermint::{TendermintNetwork, Validators, Signer, TendermintBlock},
+  tests::{
+    ProvidedTransaction, SignedTransaction, random_provided_transaction, p2p::DummyP2p,
+    new_genesis, random_evidence_tx,
+  },
+};
+
+type N = TendermintNetwork<MemDb, SignedTransaction, DummyP2p>;
+
+fn new_blockchain<T: TransactionTrait>(
+  genesis: [u8; 32],
+  participants: &[<Ristretto as Ciphersuite>::G],
+) -> (MemDb, Blockchain<MemDb, T>) {
+  let db = MemDb::new();
+  let blockchain = Blockchain::new(db.clone(), genesis, participants);
+  assert_eq!(blockchain.tip(), genesis);
+  assert_eq!(blockchain.block_number(), 0);
+  (db, blockchain)
+}
+
+#[test]
+fn block_addition() {
+  let genesis = new_genesis();
+  let validators = Arc::new(Validators::new(genesis, vec![]).unwrap());
+  let (db, mut blockchain) = new_blockchain::<SignedTransaction>(genesis, &[]);
+  let block = blockchain.build_block::<N>(&validators);
+
+  assert_eq!(block.header.parent, genesis);
+  assert_eq!(block.header.transactions, [0; 32]);
+  blockchain.verify_block::<N>(&block, &validators, false).unwrap();
+  assert!(blockchain.add_block::<N>(&block, vec![], &validators).is_ok());
+  assert_eq!(blockchain.tip(), block.hash());
+  assert_eq!(blockchain.block_number(), 1);
+  assert_eq!(
+    Blockchain::<MemDb, SignedTransaction>::block_after(&db, genesis, &block.parent()).unwrap(),
+    block.hash()
+  );
+}
+
+#[test]
+fn invalid_block() {
+  let genesis = new_genesis();
+  let validators = Arc::new(Validators::new(genesis, vec![]).unwrap());
+  let (_, mut blockchain) = new_blockchain::<SignedTransaction>(genesis, &[]);
+
+  let block = blockchain.build_block::<N>(&validators);
+
+  // Mutate parent
+  {
+    #[allow(clippy::redundant_clone)] // False positive
+    let mut block = block.clone();
+    block.header.parent = Blake2s256::digest(block.header.parent).into();
+    assert!(blockchain.verify_block::<N>(&block, &validators, false).is_err());
+  }
+
+  // Mutate transactions merkle
+  {
+    let mut block = block;
+    block.header.transactions = Blake2s256::digest(block.header.transactions).into();
+    assert!(blockchain.verify_block::<N>(&block, &validators, false).is_err());
+  }
+
+  let key = Zeroizing::new(<Ristretto as Ciphersuite>::F::random(&mut OsRng));
+  let tx = crate::tests::signed_transaction(&mut OsRng, genesis, &key, 0);
+
+  // Not a participant
+  {
+    // Manually create the block to bypass build_block's checks
+    let block = Block::new(blockchain.tip(), vec![], vec![Transaction::Application(tx.clone())]);
+    assert_eq!(block.header.transactions, merkle(&[tx.hash()]));
+    assert!(blockchain.verify_block::<N>(&block, &validators, false).is_err());
+  }
+
+  // Run the rest of the tests with them as a participant
+  let (_, blockchain) = new_blockchain(genesis, &[tx.1.signer]);
+
+  // Re-run the not a participant block to make sure it now works
+  {
+    let block = Block::new(blockchain.tip(), vec![], vec![Transaction::Application(tx.clone())]);
+    assert_eq!(block.header.transactions, merkle(&[tx.hash()]));
+    blockchain.verify_block::<N>(&block, &validators, false).unwrap();
+  }
+
+  {
+    // Add a valid transaction
+    let (_, mut blockchain) = new_blockchain(genesis, &[tx.1.signer]);
+    blockchain
+      .add_transaction::<N>(true, Transaction::Application(tx.clone()), &validators)
+      .unwrap();
+    let mut block = blockchain.build_block::<N>(&validators);
+    assert_eq!(block.header.transactions, merkle(&[tx.hash()]));
+    blockchain.verify_block::<N>(&block, &validators, false).unwrap();
+
+    // And verify mutating the transactions merkle now causes a failure
+    block.header.transactions = merkle(&[]);
+    assert!(blockchain.verify_block::<N>(&block, &validators, false).is_err());
+  }
+
+  {
+    // Invalid nonce
+    let tx = crate::tests::signed_transaction(&mut OsRng, genesis, &key, 5);
+    // Manually create the block to bypass build_block's checks
+    let block = Block::new(blockchain.tip(), vec![], vec![Transaction::Application(tx)]);
+    assert!(blockchain.verify_block::<N>(&block, &validators, false).is_err());
+  }
+
+  {
+    // Invalid signature
+    let (_, mut blockchain) = new_blockchain(genesis, &[tx.1.signer]);
+    blockchain.add_transaction::<N>(true, Transaction::Application(tx), &validators).unwrap();
+    let mut block = blockchain.build_block::<N>(&validators);
+    blockchain.verify_block::<N>(&block, &validators, false).unwrap();
+    match &mut block.transactions[0] {
+      Transaction::Application(tx) => {
+        tx.1.signature.s += <Ristretto as Ciphersuite>::F::ONE;
+      }
+      _ => panic!("non-signed tx found"),
+    }
+    assert!(blockchain.verify_block::<N>(&block, &validators, false).is_err());
+
+    // Make sure this isn't because the merkle changed due to the transaction hash including the
+    // signature (which it explicitly isn't allowed to anyways)
+    assert_eq!(block.header.transactions, merkle(&[block.transactions[0].hash()]));
+  }
+}
+
+#[test]
+fn signed_transaction() {
+  let genesis = new_genesis();
+  let validators = Arc::new(Validators::new(genesis, vec![]).unwrap());
+  let key = Zeroizing::new(<Ristretto as Ciphersuite>::F::random(&mut OsRng));
+  let tx = crate::tests::signed_transaction(&mut OsRng, genesis, &key, 0);
+  let signer = tx.1.signer;
+
+  let (_, mut blockchain) = new_blockchain::<SignedTransaction>(genesis, &[signer]);
+  assert_eq!(blockchain.next_nonce(&signer, &[]), Some(0));
+
+  let test = |blockchain: &mut Blockchain<MemDb, SignedTransaction>,
+              mempool: Vec<Transaction<SignedTransaction>>| {
+    let tip = blockchain.tip();
+    for tx in mempool.clone() {
+      let Transaction::Application(tx) = tx else {
+        panic!("tendermint tx found");
+      };
+      let next_nonce = blockchain.next_nonce(&signer, &[]).unwrap();
+      blockchain.add_transaction::<N>(true, Transaction::Application(tx), &validators).unwrap();
+      assert_eq!(next_nonce + 1, blockchain.next_nonce(&signer, &[]).unwrap());
+    }
+    let block = blockchain.build_block::<N>(&validators);
+    assert_eq!(block, Block::new(blockchain.tip(), vec![], mempool.clone()));
+    assert_eq!(blockchain.tip(), tip);
+    assert_eq!(block.header.parent, tip);
+
+    // Make sure all transactions were included
+    assert_eq!(block.transactions, mempool);
+    // Make sure the merkle was correct
+    assert_eq!(
+      block.header.transactions,
+      merkle(&mempool.iter().map(Transaction::hash).collect::<Vec<_>>())
+    );
+
+    // Verify and add the block
+    blockchain.verify_block::<N>(&block, &validators, false).unwrap();
+    assert!(blockchain.add_block::<N>(&block, vec![], &validators).is_ok());
+    assert_eq!(blockchain.tip(), block.hash());
+  };
+
+  // Test with a single nonce
+  test(&mut blockchain, vec![Transaction::Application(tx)]);
+  assert_eq!(blockchain.next_nonce(&signer, &[]), Some(1));
+
+  // Test with a flood of nonces
+  let mut mempool = vec![];
+  for nonce in 1 .. 64 {
+    mempool.push(Transaction::Application(crate::tests::signed_transaction(
+      &mut OsRng, genesis, &key, nonce,
+    )));
+  }
+  test(&mut blockchain, mempool);
+  assert_eq!(blockchain.next_nonce(&signer, &[]), Some(64));
+}
+
+#[test]
+fn provided_transaction() {
+  let genesis = new_genesis();
+  let validators = Arc::new(Validators::new(genesis, vec![]).unwrap());
+  let (db, mut blockchain) = new_blockchain::<ProvidedTransaction>(genesis, &[]);
+
+  let tx = random_provided_transaction(&mut OsRng, "order1");
+
+  // This should be providable
+  let mut temp_db = MemDb::new();
+  let mut txs = ProvidedTransactions::<_, ProvidedTransaction>::new(temp_db.clone(), genesis);
+  txs.provide(tx.clone()).unwrap();
+  assert_eq!(txs.provide(tx.clone()), Err(ProvidedError::AlreadyProvided));
+  assert_eq!(
+    ProvidedTransactions::<_, ProvidedTransaction>::new(temp_db.clone(), genesis).transactions,
+    HashMap::from([("order1", VecDeque::from([tx.clone()]))]),
+  );
+  let mut txn = temp_db.txn();
+  txs.complete(&mut txn, "order1", [0u8; 32], tx.hash());
+  txn.commit();
+  assert!(ProvidedTransactions::<_, ProvidedTransaction>::new(db.clone(), genesis)
+    .transactions
+    .is_empty());
+
+  // case we have the block's provided txs in our local as well
+  {
+    // Non-provided transactions should fail verification because we don't have them locally.
+    let block = Block::new(blockchain.tip(), vec![tx.clone()], vec![]);
+    assert!(blockchain.verify_block::<N>(&block, &validators, false).is_err());
+
+    // Provided transactions should pass verification
+    blockchain.provide_transaction(tx.clone()).unwrap();
+    blockchain.verify_block::<N>(&block, &validators, false).unwrap();
+
+    // add_block should work for verified blocks
+    assert!(blockchain.add_block::<N>(&block, vec![], &validators).is_ok());
+
+    let block = Block::new(blockchain.tip(), vec![tx.clone()], vec![]);
+
+    // The provided transaction should no longer considered provided but added to chain,
+    // causing this error
+    assert_eq!(
+      blockchain.verify_block::<N>(&block, &validators, false),
+      Err(BlockError::ProvidedAlreadyIncluded)
+    );
+  }
+
+  // case we don't have the block's provided txs in our local
+  {
+    let tx1 = random_provided_transaction(&mut OsRng, "order1");
+    let tx2 = random_provided_transaction(&mut OsRng, "order1");
+    let tx3 = random_provided_transaction(&mut OsRng, "order2");
+    let tx4 = random_provided_transaction(&mut OsRng, "order2");
+
+    // add_block DOES NOT fail for unverified provided transactions if told to add them,
+    // since now we can have them later.
+    let block1 = Block::new(blockchain.tip(), vec![tx1.clone(), tx3.clone()], vec![]);
+    assert!(blockchain.add_block::<N>(&block1, vec![], &validators).is_ok());
+
+    // in fact, we can have many blocks that have provided txs that we don't have locally.
+    let block2 = Block::new(blockchain.tip(), vec![tx2.clone(), tx4.clone()], vec![]);
+    assert!(blockchain.add_block::<N>(&block2, vec![], &validators).is_ok());
+
+    // make sure we won't return ok for the block before we actually got the txs
+    let TransactionKind::Provided(order) = tx1.kind() else { panic!("tx wasn't provided") };
+    assert!(!Blockchain::<MemDb, ProvidedTransaction>::locally_provided_txs_in_block(
+      &db,
+      &genesis,
+      &block1.hash(),
+      order
+    ));
+    // provide the first tx
+    blockchain.provide_transaction(tx1).unwrap();
+    // it should be ok for this order now, since the second tx has different order.
+    assert!(Blockchain::<MemDb, ProvidedTransaction>::locally_provided_txs_in_block(
+      &db,
+      &genesis,
+      &block1.hash(),
+      order
+    ));
+
+    // give the second tx
+    let TransactionKind::Provided(order) = tx3.kind() else { panic!("tx wasn't provided") };
+    assert!(!Blockchain::<MemDb, ProvidedTransaction>::locally_provided_txs_in_block(
+      &db,
+      &genesis,
+      &block1.hash(),
+      order
+    ));
+    blockchain.provide_transaction(tx3).unwrap();
+    // it should be ok now for the first block
+    assert!(Blockchain::<MemDb, ProvidedTransaction>::locally_provided_txs_in_block(
+      &db,
+      &genesis,
+      &block1.hash(),
+      order
+    ));
+
+    // provide the second block txs
+    let TransactionKind::Provided(order) = tx4.kind() else { panic!("tx wasn't provided") };
+    // not ok yet
+    assert!(!Blockchain::<MemDb, ProvidedTransaction>::locally_provided_txs_in_block(
+      &db,
+      &genesis,
+      &block2.hash(),
+      order
+    ));
+    blockchain.provide_transaction(tx4).unwrap();
+    // ok now
+    assert!(Blockchain::<MemDb, ProvidedTransaction>::locally_provided_txs_in_block(
+      &db,
+      &genesis,
+      &block2.hash(),
+      order
+    ));
+
+    // provide the second block txs
+    let TransactionKind::Provided(order) = tx2.kind() else { panic!("tx wasn't provided") };
+    assert!(!Blockchain::<MemDb, ProvidedTransaction>::locally_provided_txs_in_block(
+      &db,
+      &genesis,
+      &block2.hash(),
+      order
+    ));
+    blockchain.provide_transaction(tx2).unwrap();
+    assert!(Blockchain::<MemDb, ProvidedTransaction>::locally_provided_txs_in_block(
+      &db,
+      &genesis,
+      &block2.hash(),
+      order
+    ));
+  }
+}
+
+#[tokio::test]
+async fn tendermint_evidence_tx() {
+  let genesis = new_genesis();
+  let key = Zeroizing::new(<Ristretto as Ciphersuite>::F::random(&mut OsRng));
+  let signer = Signer::new(genesis, key.clone());
+  let signer_id = Ristretto::generator() * key.deref();
+  let validators = Arc::new(Validators::new(genesis, vec![(signer_id, 1)]).unwrap());
+
+  let (_, mut blockchain) = new_blockchain::<SignedTransaction>(genesis, &[]);
+
+  let test = |blockchain: &mut Blockchain<MemDb, SignedTransaction>,
+              mempool: Vec<Transaction<SignedTransaction>>,
+              validators: Arc<Validators>| {
+    let tip = blockchain.tip();
+    for tx in mempool.clone() {
+      let Transaction::Tendermint(tx) = tx else {
+        panic!("non-tendermint tx found");
+      };
+      blockchain.add_transaction::<N>(true, Transaction::Tendermint(tx), &validators).unwrap();
+    }
+    let block = blockchain.build_block::<N>(&validators);
+    assert_eq!(blockchain.tip(), tip);
+    assert_eq!(block.header.parent, tip);
+
+    // Make sure all transactions were included
+    for bt in &block.transactions {
+      assert!(mempool.contains(bt));
+    }
+
+    // Verify and add the block
+    blockchain.verify_block::<N>(&block, &validators, false).unwrap();
+    assert!(blockchain.add_block::<N>(&block, vec![], &validators).is_ok());
+    assert_eq!(blockchain.tip(), block.hash());
+  };
+
+  // test with single tx
+  let tx = random_evidence_tx::<N>(signer.into(), TendermintBlock(vec![0x12])).await;
+  test(&mut blockchain, vec![Transaction::Tendermint(tx)], validators);
+
+  // test with multiple txs
+  let mut mempool: Vec<Transaction<SignedTransaction>> = vec![];
+  let mut signers = vec![];
+  for _ in 0 .. 5 {
+    let key = Zeroizing::new(<Ristretto as Ciphersuite>::F::random(&mut OsRng));
+    let signer = Signer::new(genesis, key.clone());
+    let signer_id = Ristretto::generator() * key.deref();
+    signers.push((signer_id, 1));
+    mempool.push(Transaction::Tendermint(
+      random_evidence_tx::<N>(signer.into(), TendermintBlock(vec![0x12])).await,
+    ));
+  }
+
+  // update validators
+  let validators = Arc::new(Validators::new(genesis, signers).unwrap());
+  test(&mut blockchain, mempool, validators);
+}
+
+#[tokio::test]
+async fn block_tx_ordering() {
+  #[derive(Debug, PartialEq, Eq, Clone)]
+  enum SignedTx {
+    Signed(Box<SignedTransaction>),
+    Provided(Box<ProvidedTransaction>),
+  }
+  impl ReadWrite for SignedTx {
+    fn read<R: io::Read>(reader: &mut R) -> io::Result<Self> {
+      let mut kind = [0];
+      reader.read_exact(&mut kind)?;
+      match kind[0] {
+        0 => Ok(SignedTx::Signed(Box::new(SignedTransaction::read(reader)?))),
+        1 => Ok(SignedTx::Provided(Box::new(ProvidedTransaction::read(reader)?))),
+        _ => Err(io::Error::other("invalid transaction type")),
+      }
+    }
+
+    fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
+      match self {
+        SignedTx::Signed(signed) => {
+          writer.write_all(&[0])?;
+          signed.write(writer)
+        }
+        SignedTx::Provided(pro) => {
+          writer.write_all(&[1])?;
+          pro.write(writer)
+        }
+      }
+    }
+  }
+
+  impl TransactionTrait for SignedTx {
+    fn kind(&self) -> TransactionKind {
+      match self {
+        SignedTx::Signed(signed) => signed.kind(),
+        SignedTx::Provided(pro) => pro.kind(),
+      }
+    }
+
+    fn hash(&self) -> [u8; 32] {
+      match self {
+        SignedTx::Signed(signed) => signed.hash(),
+        SignedTx::Provided(pro) => pro.hash(),
+      }
+    }
+
+    fn verify(&self) -> Result<(), TransactionError> {
+      Ok(())
+    }
+  }
+
+  let genesis = new_genesis();
+  let key = Zeroizing::new(<Ristretto as Ciphersuite>::F::random(&mut OsRng));
+
+  // signer
+  let signer = crate::tests::signed_transaction(&mut OsRng, genesis, &key, 0).1.signer;
+  let validators = Arc::new(Validators::new(genesis, vec![(signer, 1)]).unwrap());
+
+  let (_, mut blockchain) = new_blockchain::<SignedTx>(genesis, &[signer]);
+  let tip = blockchain.tip();
+
+  // add txs
+  let mut mempool = vec![];
+  let mut provided_txs = vec![];
+  for i in 0 .. 128 {
+    let signed_tx = Transaction::Application(SignedTx::Signed(Box::new(
+      crate::tests::signed_transaction(&mut OsRng, genesis, &key, i),
+    )));
+    blockchain.add_transaction::<N>(true, signed_tx.clone(), &validators).unwrap();
+    mempool.push(signed_tx);
+
+    let unsigned_tx = Transaction::Tendermint(
+      random_evidence_tx::<N>(
+        Signer::new(genesis, key.clone()).into(),
+        TendermintBlock(vec![u8::try_from(i).unwrap()]),
+      )
+      .await,
+    );
+    blockchain.add_transaction::<N>(true, unsigned_tx.clone(), &validators).unwrap();
+    mempool.push(unsigned_tx);
+
+    let provided_tx =
+      SignedTx::Provided(Box::new(random_provided_transaction(&mut OsRng, "order1")));
+    blockchain.provide_transaction(provided_tx.clone()).unwrap();
+    provided_txs.push(provided_tx);
+  }
+  let block = blockchain.build_block::<N>(&validators);
+
+  assert_eq!(blockchain.tip(), tip);
+  assert_eq!(block.header.parent, tip);
+
+  // Make sure all transactions were included
+  assert_eq!(block.transactions.len(), 3 * 128);
+  for bt in &block.transactions[128 ..] {
+    assert!(mempool.contains(bt));
+  }
+
+  // check the tx order
+  let txs = &block.transactions;
+  for tx in txs.iter().take(128) {
+    assert!(matches!(tx.kind(), TransactionKind::Provided(..)));
+  }
+  for tx in txs.iter().take(128).skip(128) {
+    assert!(matches!(tx.kind(), TransactionKind::Unsigned));
+  }
+  for tx in txs.iter().take(128).skip(256) {
+    assert!(matches!(tx.kind(), TransactionKind::Signed(..)));
+  }
+
+  // should be a valid block
+  blockchain.verify_block::<N>(&block, &validators, false).unwrap();
+
+  // Unsigned before Provided
+  {
+    let mut block = block.clone();
+    // Doesn't use swap to preserve the order of Provided, as that's checked before kind ordering
+    let unsigned = block.transactions.remove(128);
+    block.transactions.insert(0, unsigned);
+    assert_eq!(
+      blockchain.verify_block::<N>(&block, &validators, false).unwrap_err(),
+      BlockError::WrongTransactionOrder
+    );
+  }
+
+  // Signed before Provided
+  {
+    let mut block = block.clone();
+    let signed = block.transactions.remove(256);
+    block.transactions.insert(0, signed);
+    assert_eq!(
+      blockchain.verify_block::<N>(&block, &validators, false).unwrap_err(),
+      BlockError::WrongTransactionOrder
+    );
+  }
+
+  // Signed before Unsigned
+  {
+    let mut block = block;
+    block.transactions.swap(128, 256);
+    assert_eq!(
+      blockchain.verify_block::<N>(&block, &validators, false).unwrap_err(),
+      BlockError::WrongTransactionOrder
+    );
+  }
+}

coordinator/tributary-sdk/src/tests/mempool.rs

@@ -0,0 +1,199 @@
+use std::{sync::Arc, collections::HashMap};
+
+use zeroize::Zeroizing;
+use rand::{RngCore, rngs::OsRng};
+
+use ciphersuite::{group::ff::Field, Ciphersuite, Ristretto};
+
+use tendermint::ext::Commit;
+
+use serai_db::MemDb;
+
+use crate::{
+  transaction::{TransactionError, Transaction as TransactionTrait},
+  tendermint::{TendermintBlock, Validators, Signer, TendermintNetwork},
+  ACCOUNT_MEMPOOL_LIMIT, Transaction, Mempool,
+  tests::{SignedTransaction, signed_transaction, p2p::DummyP2p, random_evidence_tx},
+};
+
+type N = TendermintNetwork<MemDb, SignedTransaction, DummyP2p>;
+
+fn new_mempool<T: TransactionTrait>() -> ([u8; 32], MemDb, Mempool<MemDb, T>) {
+  let mut genesis = [0; 32];
+  OsRng.fill_bytes(&mut genesis);
+  let db = MemDb::new();
+  (genesis, db.clone(), Mempool::new(db, genesis))
+}
+
+#[tokio::test]
+async fn mempool_addition() {
+  let (genesis, db, mut mempool) = new_mempool::<SignedTransaction>();
+  let commit = |_: u64| -> Option<Commit<Arc<Validators>>> {
+    Some(Commit::<Arc<Validators>> { end_time: 0, validators: vec![], signature: vec![] })
+  };
+  let unsigned_in_chain = |_: [u8; 32]| false;
+  let key = Zeroizing::new(<Ristretto as Ciphersuite>::F::random(&mut OsRng));
+
+  let first_tx = signed_transaction(&mut OsRng, genesis, &key, 0);
+  let signer = first_tx.1.signer;
+  assert_eq!(mempool.next_nonce_in_mempool(&signer, vec![]), None);
+
+  // validators
+  let validators = Arc::new(Validators::new(genesis, vec![(signer, 1)]).unwrap());
+
+  // Add TX 0
+  assert!(mempool
+    .add::<N, _>(
+      &|_, _| Some(0),
+      true,
+      Transaction::Application(first_tx.clone()),
+      &validators,
+      unsigned_in_chain,
+      commit,
+    )
+    .unwrap());
+  assert_eq!(mempool.next_nonce_in_mempool(&signer, vec![]), Some(1));
+
+  // add a tendermint evidence tx
+  let evidence_tx =
+    random_evidence_tx::<N>(Signer::new(genesis, key.clone()).into(), TendermintBlock(vec![]))
+      .await;
+  assert!(mempool
+    .add::<N, _>(
+      &|_, _| None,
+      true,
+      Transaction::Tendermint(evidence_tx.clone()),
+      &validators,
+      unsigned_in_chain,
+      commit,
+    )
+    .unwrap());
+
+  // Test reloading works
+  assert_eq!(mempool, Mempool::new(db, genesis));
+
+  // Adding them again should fail
+  assert_eq!(
+    mempool.add::<N, _>(
+      &|_, _| Some(0),
+      true,
+      Transaction::Application(first_tx.clone()),
+      &validators,
+      unsigned_in_chain,
+      commit,
+    ),
+    Err(TransactionError::InvalidNonce)
+  );
+  assert_eq!(
+    mempool.add::<N, _>(
+      &|_, _| None,
+      true,
+      Transaction::Tendermint(evidence_tx.clone()),
+      &validators,
+      unsigned_in_chain,
+      commit,
+    ),
+    Ok(false)
+  );
+
+  // Do the same with the next nonce
+  let second_tx = signed_transaction(&mut OsRng, genesis, &key, 1);
+  assert_eq!(
+    mempool.add::<N, _>(
+      &|_, _| Some(0),
+      true,
+      Transaction::Application(second_tx.clone()),
+      &validators,
+      unsigned_in_chain,
+      commit,
+    ),
+    Ok(true)
+  );
+  assert_eq!(mempool.next_nonce_in_mempool(&signer, vec![]), Some(2));
+  assert_eq!(
+    mempool.add::<N, _>(
+      &|_, _| Some(0),
+      true,
+      Transaction::Application(second_tx.clone()),
+      &validators,
+      unsigned_in_chain,
+      commit,
+    ),
+    Err(TransactionError::InvalidNonce)
+  );
+
+  // If the mempool doesn't have a nonce for an account, it should successfully use the
+  // blockchain's
+  let second_key = Zeroizing::new(<Ristretto as Ciphersuite>::F::random(&mut OsRng));
+  let tx = signed_transaction(&mut OsRng, genesis, &second_key, 2);
+  let second_signer = tx.1.signer;
+  assert_eq!(mempool.next_nonce_in_mempool(&second_signer, vec![]), None);
+  assert!(mempool
+    .add::<N, _>(
+      &|_, _| Some(2),
+      true,
+      Transaction::Application(tx.clone()),
+      &validators,
+      unsigned_in_chain,
+      commit
+    )
+    .unwrap());
+  assert_eq!(mempool.next_nonce_in_mempool(&second_signer, vec![]), Some(3));
+
+  // Getting a block should work
+  assert_eq!(mempool.block().len(), 4);
+
+  // Removing should successfully prune
+  mempool.remove(&tx.hash());
+
+  assert_eq!(
+    mempool.txs(),
+    &HashMap::from([
+      (first_tx.hash(), Transaction::Application(first_tx)),
+      (second_tx.hash(), Transaction::Application(second_tx)),
+      (evidence_tx.hash(), Transaction::Tendermint(evidence_tx))
+    ])
+  );
+}
+
+#[test]
+fn too_many_mempool() {
+  let (genesis, _, mut mempool) = new_mempool::<SignedTransaction>();
+  let validators = Arc::new(Validators::new(genesis, vec![]).unwrap());
+  let commit = |_: u64| -> Option<Commit<Arc<Validators>>> {
+    Some(Commit::<Arc<Validators>> { end_time: 0, validators: vec![], signature: vec![] })
+  };
+  let unsigned_in_chain = |_: [u8; 32]| false;
+  let key = Zeroizing::new(<Ristretto as Ciphersuite>::F::random(&mut OsRng));
+
+  // We should be able to add transactions up to the limit
+  for i in 0 .. ACCOUNT_MEMPOOL_LIMIT {
+    assert!(mempool
+      .add::<N, _>(
+        &|_, _| Some(0),
+        false,
+        Transaction::Application(signed_transaction(&mut OsRng, genesis, &key, i)),
+        &validators,
+        unsigned_in_chain,
+        commit,
+      )
+      .unwrap());
+  }
+  // Yet adding more should fail
+  assert_eq!(
+    mempool.add::<N, _>(
+      &|_, _| Some(0),
+      false,
+      Transaction::Application(signed_transaction(
+        &mut OsRng,
+        genesis,
+        &key,
+        ACCOUNT_MEMPOOL_LIMIT
+      )),
+      &validators,
+      unsigned_in_chain,
+      commit,
+    ),
+    Err(TransactionError::TooManyInMempool)
+  );
+}

coordinator/tributary-sdk/src/tests/merkle.rs

@@ -0,0 +1,34 @@
+use std::collections::HashSet;
+
+use rand::{RngCore, rngs::OsRng};
+
+#[test]
+fn merkle() {
+  let mut used = HashSet::new();
+  // Test this produces a unique root
+  let mut test = |hashes: &[[u8; 32]]| {
+    let hash = crate::merkle(hashes);
+    assert!(!used.contains(&hash));
+    used.insert(hash);
+  };
+
+  // Zero should be a special case which return 0
+  assert_eq!(crate::merkle(&[]), [0; 32]);
+  test(&[]);
+
+  let mut one = [0; 32];
+  OsRng.fill_bytes(&mut one);
+  let mut two = [0; 32];
+  OsRng.fill_bytes(&mut two);
+  let mut three = [0; 32];
+  OsRng.fill_bytes(&mut three);
+
+  // Make sure it's deterministic
+  assert_eq!(crate::merkle(&[one]), crate::merkle(&[one]));
+
+  // Test a few basic structures
+  test(&[one]);
+  test(&[one, two]);
+  test(&[one, two, three]);
+  test(&[one, three]);
+}

coordinator/tributary-sdk/src/tests/mod.rs

@@ -0,0 +1,17 @@
+#[cfg(test)]
+mod tendermint;
+
+mod transaction;
+pub use transaction::*;
+
+#[cfg(test)]
+mod merkle;
+
+#[cfg(test)]
+mod block;
+#[cfg(test)]
+mod blockchain;
+#[cfg(test)]
+mod mempool;
+#[cfg(test)]
+mod p2p;

coordinator/tributary-sdk/src/tests/p2p.rs

@@ -0,0 +1,12 @@
+use core::future::Future;
+
+pub use crate::P2p;
+
+#[derive(Clone, Debug)]
+pub struct DummyP2p;
+
+impl P2p for DummyP2p {
+  fn broadcast(&self, _: [u8; 32], _: Vec<u8>) -> impl Send + Future<Output = ()> {
+    async move { unimplemented!() }
+  }
+}

coordinator/tributary-sdk/src/tests/tendermint.rs

@@ -0,0 +1,30 @@
+use core::future::Future;
+
+use tendermint::ext::Network;
+
+use crate::{
+  P2p, TendermintTx,
+  tendermint::{TARGET_BLOCK_TIME, TendermintNetwork},
+};
+
+#[test]
+fn assert_target_block_time() {
+  use serai_db::MemDb;
+
+  #[derive(Clone, Debug)]
+  pub struct DummyP2p;
+
+  impl P2p for DummyP2p {
+    fn broadcast(&self, _: [u8; 32], _: Vec<u8>) -> impl Send + Future<Output = ()> {
+      async move { unimplemented!() }
+    }
+  }
+
+  // Type paremeters don't matter here since we only need to call the block_time()
+  // and it only relies on the constants of the trait implementation. block_time() is in seconds,
+  // TARGET_BLOCK_TIME is in milliseconds.
+  assert_eq!(
+    <TendermintNetwork<MemDb, TendermintTx, DummyP2p> as Network>::block_time(),
+    TARGET_BLOCK_TIME / 1000
+  )
+}

coordinator/tributary-sdk/src/tests/transaction/mod.rs

@@ -0,0 +1,220 @@
+use core::ops::Deref;
+use std::{sync::Arc, io};
+
+use zeroize::Zeroizing;
+use rand::{RngCore, CryptoRng, rngs::OsRng};
+
+use blake2::{Digest, Blake2s256};
+
+use ciphersuite::{
+  group::{ff::Field, Group},
+  Ciphersuite, Ristretto,
+};
+use schnorr::SchnorrSignature;
+
+use scale::Encode;
+
+use ::tendermint::{
+  ext::{Network, Signer as SignerTrait, SignatureScheme, BlockNumber, RoundNumber},
+  SignedMessageFor, DataFor, Message, SignedMessage, Data, Evidence,
+};
+
+use crate::{
+  transaction::{Signed, TransactionError, TransactionKind, Transaction, verify_transaction},
+  ReadWrite,
+  tendermint::{tx::TendermintTx, Validators, Signer},
+};
+
+#[cfg(test)]
+mod signed;
+
+#[cfg(test)]
+mod tendermint;
+
+pub fn random_signed<R: RngCore + CryptoRng>(rng: &mut R) -> Signed {
+  Signed {
+    signer: <Ristretto as Ciphersuite>::G::random(&mut *rng),
+    nonce: u32::try_from(rng.next_u64() >> 32 >> 1).unwrap(),
+    signature: SchnorrSignature::<Ristretto> {
+      R: <Ristretto as Ciphersuite>::G::random(&mut *rng),
+      s: <Ristretto as Ciphersuite>::F::random(rng),
+    },
+  }
+}
+
+pub fn random_signed_with_nonce<R: RngCore + CryptoRng>(rng: &mut R, nonce: u32) -> Signed {
+  let mut signed = random_signed(rng);
+  signed.nonce = nonce;
+  signed
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct ProvidedTransaction(pub Vec<u8>);
+
+impl ReadWrite for ProvidedTransaction {
+  fn read<R: io::Read>(reader: &mut R) -> io::Result<Self> {
+    let mut len = [0; 4];
+    reader.read_exact(&mut len)?;
+    let mut data = vec![0; usize::try_from(u32::from_le_bytes(len)).unwrap()];
+    reader.read_exact(&mut data)?;
+    Ok(ProvidedTransaction(data))
+  }
+
+  fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
+    writer.write_all(&u32::try_from(self.0.len()).unwrap().to_le_bytes())?;
+    writer.write_all(&self.0)
+  }
+}
+
+impl Transaction for ProvidedTransaction {
+  fn kind(&self) -> TransactionKind {
+    match self.0[0] {
+      1 => TransactionKind::Provided("order1"),
+      2 => TransactionKind::Provided("order2"),
+      _ => panic!("unknown order"),
+    }
+  }
+
+  fn hash(&self) -> [u8; 32] {
+    Blake2s256::digest(self.serialize()).into()
+  }
+
+  fn verify(&self) -> Result<(), TransactionError> {
+    Ok(())
+  }
+}
+
+pub fn random_provided_transaction<R: RngCore + CryptoRng>(
+  rng: &mut R,
+  order: &str,
+) -> ProvidedTransaction {
+  let mut data = vec![0; 512];
+  rng.fill_bytes(&mut data);
+  data[0] = match order {
+    "order1" => 1,
+    "order2" => 2,
+    _ => panic!("unknown order"),
+  };
+  ProvidedTransaction(data)
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct SignedTransaction(pub Vec<u8>, pub Signed);
+
+impl ReadWrite for SignedTransaction {
+  fn read<R: io::Read>(reader: &mut R) -> io::Result<Self> {
+    let mut len = [0; 4];
+    reader.read_exact(&mut len)?;
+    let mut data = vec![0; usize::try_from(u32::from_le_bytes(len)).unwrap()];
+    reader.read_exact(&mut data)?;
+
+    Ok(SignedTransaction(data, Signed::read(reader)?))
+  }
+
+  fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
+    writer.write_all(&u32::try_from(self.0.len()).unwrap().to_le_bytes())?;
+    writer.write_all(&self.0)?;
+    self.1.write(writer)
+  }
+}
+
+impl Transaction for SignedTransaction {
+  fn kind(&self) -> TransactionKind {
+    TransactionKind::Signed(vec![], self.1.clone())
+  }
+
+  fn hash(&self) -> [u8; 32] {
+    let serialized = self.serialize();
+    Blake2s256::digest(&serialized[.. (serialized.len() - 64)]).into()
+  }
+
+  fn verify(&self) -> Result<(), TransactionError> {
+    Ok(())
+  }
+}
+
+pub fn signed_transaction<R: RngCore + CryptoRng>(
+  rng: &mut R,
+  genesis: [u8; 32],
+  key: &Zeroizing<<Ristretto as Ciphersuite>::F>,
+  nonce: u32,
+) -> SignedTransaction {
+  let mut data = vec![0; 512];
+  rng.fill_bytes(&mut data);
+
+  let signer = <Ristretto as Ciphersuite>::generator() * **key;
+
+  let mut tx =
+    SignedTransaction(data, Signed { signer, nonce, signature: random_signed(rng).signature });
+
+  let sig_nonce = Zeroizing::new(<Ristretto as Ciphersuite>::F::random(rng));
+  tx.1.signature.R = Ristretto::generator() * sig_nonce.deref();
+  tx.1.signature = SchnorrSignature::sign(key, sig_nonce, tx.sig_hash(genesis));
+
+  verify_transaction(&tx, genesis, &mut |_, _| Some(tx.1.nonce)).unwrap();
+
+  tx
+}
+
+pub fn random_signed_transaction<R: RngCore + CryptoRng>(
+  rng: &mut R,
+) -> ([u8; 32], SignedTransaction) {
+  let mut genesis = [0; 32];
+  rng.fill_bytes(&mut genesis);
+
+  let key = Zeroizing::new(<Ristretto as Ciphersuite>::F::random(&mut *rng));
+  // Shift over an additional bit to ensure it won't overflow when incremented
+  let nonce = u32::try_from(rng.next_u64() >> 32 >> 1).unwrap();
+
+  (genesis, signed_transaction(rng, genesis, &key, nonce))
+}
+
+pub fn new_genesis() -> [u8; 32] {
+  let mut genesis = [0; 32];
+  OsRng.fill_bytes(&mut genesis);
+  genesis
+}
+
+pub async fn tendermint_meta() -> ([u8; 32], Signer, [u8; 32], Arc<Validators>) {
+  // signer
+  let genesis = new_genesis();
+  let signer =
+    Signer::new(genesis, Zeroizing::new(<Ristretto as Ciphersuite>::F::random(&mut OsRng)));
+  let validator_id = signer.validator_id().await.unwrap();
+
+  // schema
+  let signer_pub =
+    <Ristretto as Ciphersuite>::read_G::<&[u8]>(&mut validator_id.as_slice()).unwrap();
+  let validators = Arc::new(Validators::new(genesis, vec![(signer_pub, 1)]).unwrap());
+
+  (genesis, signer, validator_id, validators)
+}
+
+pub async fn signed_from_data<N: Network>(
+  signer: <N::SignatureScheme as SignatureScheme>::Signer,
+  signer_id: N::ValidatorId,
+  block_number: u64,
+  round_number: u32,
+  data: DataFor<N>,
+) -> SignedMessageFor<N> {
+  let msg = Message {
+    sender: signer_id,
+    block: BlockNumber(block_number),
+    round: RoundNumber(round_number),
+    data,
+  };
+  let sig = signer.sign(&msg.encode()).await;
+  SignedMessage { msg, sig }
+}
+
+pub async fn random_evidence_tx<N: Network>(
+  signer: <N::SignatureScheme as SignatureScheme>::Signer,
+  b: N::Block,
+) -> TendermintTx {
+  // Creates a TX with an invalid valid round number
+  // TODO: Use a random failure reason
+  let data = Data::Proposal(Some(RoundNumber(0)), b);
+  let signer_id = signer.validator_id().await.unwrap();
+  let signed = signed_from_data::<N>(signer, signer_id, 0, 0, data).await;
+  TendermintTx::SlashEvidence(Evidence::InvalidValidRound(signed.encode()))
+}

coordinator/tributary-sdk/src/tests/transaction/signed.rs

@@ -0,0 +1,84 @@
+use rand::rngs::OsRng;
+
+use blake2::{Digest, Blake2s256};
+
+use ciphersuite::{group::ff::Field, Ciphersuite, Ristretto};
+
+use crate::{
+  ReadWrite,
+  transaction::{Signed, Transaction, verify_transaction},
+  tests::{random_signed, random_signed_transaction},
+};
+
+#[test]
+fn serialize_signed() {
+  let signed = random_signed(&mut rand::rngs::OsRng);
+  assert_eq!(Signed::read::<&[u8]>(&mut signed.serialize().as_ref()).unwrap(), signed);
+}
+
+#[test]
+fn sig_hash() {
+  let (genesis, tx1) = random_signed_transaction(&mut OsRng);
+  assert!(tx1.sig_hash(genesis) != tx1.sig_hash(Blake2s256::digest(genesis).into()));
+
+  let (_, tx2) = random_signed_transaction(&mut OsRng);
+  assert!(tx1.hash() != tx2.hash());
+  assert!(tx1.sig_hash(genesis) != tx2.sig_hash(genesis));
+}
+
+#[test]
+fn signed_transaction() {
+  let (genesis, tx) = random_signed_transaction(&mut OsRng);
+
+  // Mutate various properties and verify it no longer works
+
+  // Different genesis
+  assert!(verify_transaction(&tx, Blake2s256::digest(genesis).into(), &mut |_, _| Some(
+    tx.1.nonce
+  ))
+  .is_err());
+
+  // Different data
+  {
+    let mut tx = tx.clone();
+    tx.0 = Blake2s256::digest(tx.0).to_vec();
+    assert!(verify_transaction(&tx, genesis, &mut |_, _| Some(tx.1.nonce)).is_err());
+  }
+
+  // Different signer
+  {
+    let mut tx = tx.clone();
+    tx.1.signer += Ristretto::generator();
+    assert!(verify_transaction(&tx, genesis, &mut |_, _| Some(tx.1.nonce)).is_err());
+  }
+
+  // Different nonce
+  {
+    #[allow(clippy::redundant_clone)] // False positive?
+    let mut tx = tx.clone();
+    tx.1.nonce = tx.1.nonce.wrapping_add(1);
+    assert!(verify_transaction(&tx, genesis, &mut |_, _| Some(tx.1.nonce)).is_err());
+  }
+
+  // Different signature
+  {
+    let mut tx = tx.clone();
+    tx.1.signature.R += Ristretto::generator();
+    assert!(verify_transaction(&tx, genesis, &mut |_, _| Some(tx.1.nonce)).is_err());
+  }
+  {
+    let mut tx = tx.clone();
+    tx.1.signature.s += <Ristretto as Ciphersuite>::F::ONE;
+    assert!(verify_transaction(&tx, genesis, &mut |_, _| Some(tx.1.nonce)).is_err());
+  }
+
+  // Sanity check the original TX was never mutated and is valid
+  verify_transaction(&tx, genesis, &mut |_, _| Some(tx.1.nonce)).unwrap();
+}
+
+#[test]
+fn invalid_nonce() {
+  let (genesis, tx) = random_signed_transaction(&mut OsRng);
+
+  assert!(verify_transaction(&tx, genesis, &mut |_, _| Some(tx.1.nonce.wrapping_add(1)),).is_err());
+}

coordinator/tributary-sdk/src/tests/transaction/tendermint.rs

@@ -0,0 +1,300 @@
+use std::sync::Arc;
+
+use zeroize::Zeroizing;
+use rand::{RngCore, rngs::OsRng};
+
+use ciphersuite::{Ristretto, Ciphersuite, group::ff::Field};
+
+use scale::Encode;
+
+use tendermint::{
+  time::CanonicalInstant,
+  round::RoundData,
+  Data, commit_msg, Evidence,
+  ext::{RoundNumber, Commit, Signer as SignerTrait},
+};
+
+use serai_db::MemDb;
+
+use crate::{
+  ReadWrite,
+  tendermint::{
+    tx::{TendermintTx, verify_tendermint_tx},
+    TendermintBlock, Signer, Validators, TendermintNetwork,
+  },
+  tests::{
+    p2p::DummyP2p, SignedTransaction, random_evidence_tx, tendermint_meta, signed_from_data,
+  },
+};
+
+type N = TendermintNetwork<MemDb, SignedTransaction, DummyP2p>;
+
+#[tokio::test]
+async fn serialize_tendermint() {
+  // make a tendermint tx with random evidence
+  let (_, signer, _, _) = tendermint_meta().await;
+  let tx = random_evidence_tx::<N>(signer.into(), TendermintBlock(vec![])).await;
+  let res = TendermintTx::read::<&[u8]>(&mut tx.serialize().as_ref()).unwrap();
+  assert_eq!(res, tx);
+}
+
+#[tokio::test]
+async fn invalid_valid_round() {
+  // signer
+  let (_, signer, signer_id, validators) = tendermint_meta().await;
+  let commit = |_: u64| -> Option<Commit<Arc<Validators>>> {
+    Some(Commit::<Arc<Validators>> { end_time: 0, validators: vec![], signature: vec![] })
+  };
+
+  let valid_round_tx = |valid_round| {
+    let signer = signer.clone();
+    async move {
+      let data = Data::Proposal(valid_round, TendermintBlock(vec![]));
+      let signed = signed_from_data::<N>(signer.clone().into(), signer_id, 0, 0, data).await;
+      (signed.clone(), TendermintTx::SlashEvidence(Evidence::InvalidValidRound(signed.encode())))
+    }
+  };
+
+  // This should be invalid evidence if a valid valid round is specified
+  let (_, tx) = valid_round_tx(None).await;
+  assert!(verify_tendermint_tx::<N>(&tx, &validators, commit).is_err());
+
+  // If an invalid valid round is specified (>= current), this should be invalid evidence
+  let (mut signed, tx) = valid_round_tx(Some(RoundNumber(0))).await;
+
+  // should pass
+  verify_tendermint_tx::<N>(&tx, &validators, commit).unwrap();
+
+  // change the signature
+  let mut random_sig = [0u8; 64];
+  OsRng.fill_bytes(&mut random_sig);
+  signed.sig = random_sig;
+  let tx = TendermintTx::SlashEvidence(Evidence::InvalidValidRound(signed.encode()));
+
+  // should fail
+  assert!(verify_tendermint_tx::<N>(&tx, &validators, commit).is_err());
+}
+
+#[tokio::test]
+async fn invalid_precommit_signature() {
+  let (_, signer, signer_id, validators) = tendermint_meta().await;
+  let commit = |i: u64| -> Option<Commit<Arc<Validators>>> {
+    assert_eq!(i, 0);
+    Some(Commit::<Arc<Validators>> { end_time: 0, validators: vec![], signature: vec![] })
+  };
+
+  let precommit = |precommit| {
+    let signer = signer.clone();
+    async move {
+      let signed =
+        signed_from_data::<N>(signer.clone().into(), signer_id, 1, 0, Data::Precommit(precommit))
+          .await;
+      (signed.clone(), TendermintTx::SlashEvidence(Evidence::InvalidPrecommit(signed.encode())))
+    }
+  };
+
+  // Empty Precommit should fail.
+  assert!(verify_tendermint_tx::<N>(&precommit(None).await.1, &validators, commit).is_err());
+
+  // valid precommit signature should fail.
+  let block_id = [0x22u8; 32];
+  let last_end_time =
+    RoundData::<N>::new(RoundNumber(0), CanonicalInstant::new(commit(0).unwrap().end_time))
+      .end_time();
+  let commit_msg = commit_msg(last_end_time.canonical(), block_id.as_ref());
+
+  assert!(verify_tendermint_tx::<N>(
+    &precommit(Some((block_id, signer.clone().sign(&commit_msg).await))).await.1,
+    &validators,
+    commit
+  )
+  .is_err());
+
+  // any other signature can be used as evidence.
+  {
+    let (mut signed, tx) = precommit(Some((block_id, signer.sign(&[]).await))).await;
+    verify_tendermint_tx::<N>(&tx, &validators, commit).unwrap();
+
+    // So long as we can authenticate where it came from
+    let mut random_sig = [0u8; 64];
+    OsRng.fill_bytes(&mut random_sig);
+    signed.sig = random_sig;
+    let tx = TendermintTx::SlashEvidence(Evidence::InvalidPrecommit(signed.encode()));
+    assert!(verify_tendermint_tx::<N>(&tx, &validators, commit).is_err());
+  }
+}
+
+#[tokio::test]
+async fn evidence_with_prevote() {
+  let (_, signer, signer_id, validators) = tendermint_meta().await;
+  let commit = |_: u64| -> Option<Commit<Arc<Validators>>> {
+    Some(Commit::<Arc<Validators>> { end_time: 0, validators: vec![], signature: vec![] })
+  };
+
+  let prevote = |block_id| {
+    let signer = signer.clone();
+    async move {
+      // it should fail for all reasons.
+      let mut txs = vec![];
+      txs.push(TendermintTx::SlashEvidence(Evidence::InvalidPrecommit(
+        signed_from_data::<N>(signer.clone().into(), signer_id, 0, 0, Data::Prevote(block_id))
+          .await
+          .encode(),
+      )));
+      txs.push(TendermintTx::SlashEvidence(Evidence::InvalidValidRound(
+        signed_from_data::<N>(signer.clone().into(), signer_id, 0, 0, Data::Prevote(block_id))
+          .await
+          .encode(),
+      )));
+      // Since these require a second message, provide this one again
+      // ConflictingMessages can be fired for actually conflicting Prevotes however
+      txs.push(TendermintTx::SlashEvidence(Evidence::ConflictingMessages(
+        signed_from_data::<N>(signer.clone().into(), signer_id, 0, 0, Data::Prevote(block_id))
+          .await
+          .encode(),
+        signed_from_data::<N>(signer.clone().into(), signer_id, 0, 0, Data::Prevote(block_id))
+          .await
+          .encode(),
+      )));
+      txs
+    }
+  };
+
+  // No prevote message alone should be valid as slash evidence at this time
+  for prevote in prevote(None).await {
+    assert!(verify_tendermint_tx::<N>(&prevote, &validators, commit).is_err());
+  }
+  for prevote in prevote(Some([0x22u8; 32])).await {
+    assert!(verify_tendermint_tx::<N>(&prevote, &validators, commit).is_err());
+  }
+}
+
+#[tokio::test]
+async fn conflicting_msgs_evidence_tx() {
+  let (genesis, signer, signer_id, validators) = tendermint_meta().await;
+  let commit = |i: u64| -> Option<Commit<Arc<Validators>>> {
+    assert_eq!(i, 0);
+    Some(Commit::<Arc<Validators>> { end_time: 0, validators: vec![], signature: vec![] })
+  };
+
+  // Block b, round n
+  let signed_for_b_r = |block, round, data| {
+    let signer = signer.clone();
+    async move { signed_from_data::<N>(signer.clone().into(), signer_id, block, round, data).await }
+  };
+
+  // Proposal
+  {
+    // non-conflicting data should fail
+    let signed_1 = signed_for_b_r(0, 0, Data::Proposal(None, TendermintBlock(vec![0x11]))).await;
+    let tx = TendermintTx::SlashEvidence(Evidence::ConflictingMessages(
+      signed_1.encode(),
+      signed_1.encode(),
+    ));
+    assert!(verify_tendermint_tx::<N>(&tx, &validators, commit).is_err());
+
+    // conflicting data should pass
+    let signed_2 = signed_for_b_r(0, 0, Data::Proposal(None, TendermintBlock(vec![0x22]))).await;
+    let tx = TendermintTx::SlashEvidence(Evidence::ConflictingMessages(
+      signed_1.encode(),
+      signed_2.encode(),
+    ));
+    verify_tendermint_tx::<N>(&tx, &validators, commit).unwrap();
+
+    // Except if it has a distinct round number, as we don't check cross-round conflicts
+    // (except for Precommit)
+    let signed_2 = signed_for_b_r(0, 1, Data::Proposal(None, TendermintBlock(vec![0x22]))).await;
+    let tx = TendermintTx::SlashEvidence(Evidence::ConflictingMessages(
+      signed_1.encode(),
+      signed_2.encode(),
+    ));
+    verify_tendermint_tx::<N>(&tx, &validators, commit).unwrap_err();
+
+    // Proposals for different block numbers should also fail as evidence
+    let signed_2 = signed_for_b_r(1, 0, Data::Proposal(None, TendermintBlock(vec![0x22]))).await;
+    let tx = TendermintTx::SlashEvidence(Evidence::ConflictingMessages(
+      signed_1.encode(),
+      signed_2.encode(),
+    ));
+    verify_tendermint_tx::<N>(&tx, &validators, commit).unwrap_err();
+  }
+
+  // Prevote
+  {
+    // non-conflicting data should fail
+    let signed_1 = signed_for_b_r(0, 0, Data::Prevote(Some([0x11; 32]))).await;
+    let tx = TendermintTx::SlashEvidence(Evidence::ConflictingMessages(
+      signed_1.encode(),
+      signed_1.encode(),
+    ));
+    assert!(verify_tendermint_tx::<N>(&tx, &validators, commit).is_err());
+
+    // conflicting data should pass
+    let signed_2 = signed_for_b_r(0, 0, Data::Prevote(Some([0x22; 32]))).await;
+    let tx = TendermintTx::SlashEvidence(Evidence::ConflictingMessages(
+      signed_1.encode(),
+      signed_2.encode(),
+    ));
+    verify_tendermint_tx::<N>(&tx, &validators, commit).unwrap();
+
+    // Except if it has a distinct round number, as we don't check cross-round conflicts
+    // (except for Precommit)
+    let signed_2 = signed_for_b_r(0, 1, Data::Prevote(Some([0x22; 32]))).await;
+    let tx = TendermintTx::SlashEvidence(Evidence::ConflictingMessages(
+      signed_1.encode(),
+      signed_2.encode(),
+    ));
+    verify_tendermint_tx::<N>(&tx, &validators, commit).unwrap_err();
+
+    // Proposals for different block numbers should also fail as evidence
+    let signed_2 = signed_for_b_r(1, 0, Data::Prevote(Some([0x22; 32]))).await;
+    let tx = TendermintTx::SlashEvidence(Evidence::ConflictingMessages(
+      signed_1.encode(),
+      signed_2.encode(),
+    ));
+    verify_tendermint_tx::<N>(&tx, &validators, commit).unwrap_err();
+  }
+
+  // msgs from different senders should fail
+  {
+    let signed_1 = signed_for_b_r(0, 0, Data::Proposal(None, TendermintBlock(vec![0x11]))).await;
+
+    let signer_2 =
+      Signer::new(genesis, Zeroizing::new(<Ristretto as Ciphersuite>::F::random(&mut OsRng)));
+    let signed_id_2 = signer_2.validator_id().await.unwrap();
+    let signed_2 = signed_from_data::<N>(
+      signer_2.into(),
+      signed_id_2,
+      0,
+      0,
+      Data::Proposal(None, TendermintBlock(vec![0x22])),
+    )
+    .await;
+
+    let tx = TendermintTx::SlashEvidence(Evidence::ConflictingMessages(
+      signed_1.encode(),
+      signed_2.encode(),
+    ));
+
+    // update schema so that we don't fail due to invalid signature
+    let signer_pub =
+      <Ristretto as Ciphersuite>::read_G::<&[u8]>(&mut signer_id.as_slice()).unwrap();
+    let signer_pub_2 =
+      <Ristretto as Ciphersuite>::read_G::<&[u8]>(&mut signed_id_2.as_slice()).unwrap();
+    let validators =
+      Arc::new(Validators::new(genesis, vec![(signer_pub, 1), (signer_pub_2, 1)]).unwrap());
+
+    assert!(verify_tendermint_tx::<N>(&tx, &validators, commit).is_err());
+  }
+
+  // msgs with different steps should fail
+  {
+    let signed_1 = signed_for_b_r(0, 0, Data::Proposal(None, TendermintBlock(vec![]))).await;
+    let signed_2 = signed_for_b_r(0, 0, Data::Prevote(None)).await;
+    let tx = TendermintTx::SlashEvidence(Evidence::ConflictingMessages(
+      signed_1.encode(),
+      signed_2.encode(),
+    ));
+    assert!(verify_tendermint_tx::<N>(&tx, &validators, commit).is_err());
+  }
+}

coordinator/tributary-sdk/src/transaction.rs

@@ -0,0 +1,218 @@
+use core::fmt::Debug;
+use std::io;
+
+use zeroize::Zeroize;
+use thiserror::Error;
+
+use blake2::{Digest, Blake2b512};
+
+use ciphersuite::{
+  group::{Group, GroupEncoding},
+  Ciphersuite, Ristretto,
+};
+use schnorr::SchnorrSignature;
+
+use crate::{TRANSACTION_SIZE_LIMIT, ReadWrite};
+
+#[derive(Clone, PartialEq, Eq, Debug, Error)]
+pub enum TransactionError {
+  /// Transaction exceeded the size limit.
+  #[error("transaction is too large")]
+  TooLargeTransaction,
+  /// Transaction's signer isn't a participant.
+  #[error("invalid signer")]
+  InvalidSigner,
+  /// Transaction's nonce isn't the prior nonce plus one.
+  #[error("invalid nonce")]
+  InvalidNonce,
+  /// Transaction's signature is invalid.
+  #[error("invalid signature")]
+  InvalidSignature,
+  /// Transaction's content is invalid.
+  #[error("transaction content is invalid")]
+  InvalidContent,
+  /// Transaction's signer has too many transactions in the mempool.
+  #[error("signer has too many transactions in the mempool")]
+  TooManyInMempool,
+  /// Provided Transaction added to mempool.
+  #[error("provided transaction added to mempool")]
+  ProvidedAddedToMempool,
+}
+
+/// Data for a signed transaction.
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct Signed {
+  pub signer: <Ristretto as Ciphersuite>::G,
+  pub nonce: u32,
+  pub signature: SchnorrSignature<Ristretto>,
+}
+
+impl ReadWrite for Signed {
+  fn read<R: io::Read>(reader: &mut R) -> io::Result<Self> {
+    let signer = Ristretto::read_G(reader)?;
+
+    let mut nonce = [0; 4];
+    reader.read_exact(&mut nonce)?;
+    let nonce = u32::from_le_bytes(nonce);
+    if nonce >= (u32::MAX - 1) {
+      Err(io::Error::other("nonce exceeded limit"))?;
+    }
+
+    let mut signature = SchnorrSignature::<Ristretto>::read(reader)?;
+    if signature.R.is_identity().into() {
+      // Anyone malicious could remove this and try to find zero signatures
+      // We should never produce zero signatures though meaning this should never come up
+      // If it does somehow come up, this is a decent courtesy
+      signature.zeroize();
+      Err(io::Error::other("signature nonce was identity"))?;
+    }
+
+    Ok(Signed { signer, nonce, signature })
+  }
+
+  fn write<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
+    // This is either an invalid signature or a private key leak
+    if self.signature.R.is_identity().into() {
+      Err(io::Error::other("signature nonce was identity"))?;
+    }
+    writer.write_all(&self.signer.to_bytes())?;
+    writer.write_all(&self.nonce.to_le_bytes())?;
+    self.signature.write(writer)
+  }
+}
+
+impl Signed {
+  pub fn read_without_nonce<R: io::Read>(reader: &mut R, nonce: u32) -> io::Result<Self> {
+    let signer = Ristretto::read_G(reader)?;
+
+    let mut signature = SchnorrSignature::<Ristretto>::read(reader)?;
+    if signature.R.is_identity().into() {
+      // Anyone malicious could remove this and try to find zero signatures
+      // We should never produce zero signatures though meaning this should never come up
+      // If it does somehow come up, this is a decent courtesy
+      signature.zeroize();
+      Err(io::Error::other("signature nonce was identity"))?;
+    }
+
+    Ok(Signed { signer, nonce, signature })
+  }
+
+  pub fn write_without_nonce<W: io::Write>(&self, writer: &mut W) -> io::Result<()> {
+    // This is either an invalid signature or a private key leak
+    if self.signature.R.is_identity().into() {
+      Err(io::Error::other("signature nonce was identity"))?;
+    }
+    writer.write_all(&self.signer.to_bytes())?;
+    self.signature.write(writer)
+  }
+}
+
+#[allow(clippy::large_enum_variant)]
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub enum TransactionKind {
+  /// This transaction should be provided by every validator, in an exact order.
+  ///
+  /// The contained static string names the orderer to use. This allows two distinct provided
+  /// transaction kinds, without a synchronized order, to be ordered within their own kind without
+  /// requiring ordering with each other.
+  ///
+  /// The only malleability is in when this transaction appears on chain. The block producer will
+  /// include it when they have it. Block verification will fail for validators without it.
+  ///
+  /// If a supermajority of validators produce a commit for a block with a provided transaction
+  /// which isn't locally held, the block will be added to the local chain. When the transaction is
+  /// locally provided, it will be compared for correctness to the on-chain version
+  ///
+  /// In order to ensure TXs aren't accidentally provided multiple times, all provided transactions
+  /// must have a unique hash which is also unique to all Unsigned transactions.
+  Provided(&'static str),
+
+  /// An unsigned transaction, only able to be included by the block producer.
+  ///
+  /// Once an Unsigned transaction is included on-chain, it may not be included again. In order to
+  /// have multiple Unsigned transactions with the same values included on-chain, some distinct
+  /// nonce must be included in order to cause a distinct hash.
+  ///
+  /// The hash must also be unique with all Provided transactions.
+  Unsigned,
+
+  /// A signed transaction.
+  Signed(Vec<u8>, Signed),
+}
+
+// TODO: Should this be renamed TransactionTrait now that a literal Transaction exists?
+// Or should the literal Transaction be renamed to Event?
+pub trait Transaction: 'static + Send + Sync + Clone + Eq + Debug + ReadWrite {
+  /// Return what type of transaction this is.
+  fn kind(&self) -> TransactionKind;
+
+  /// Return the hash of this transaction.
+  ///
+  /// The hash must NOT commit to the signature.
+  fn hash(&self) -> [u8; 32];
+
+  /// Perform transaction-specific verification.
+  fn verify(&self) -> Result<(), TransactionError>;
+
+  /// Obtain the challenge for this transaction's signature.
+  ///
+  /// Do not override this unless you know what you're doing.
+  ///
+  /// Panics if called on non-signed transactions.
+  fn sig_hash(&self, genesis: [u8; 32]) -> <Ristretto as Ciphersuite>::F {
+    match self.kind() {
+      TransactionKind::Signed(order, Signed { signature, .. }) => {
+        <Ristretto as Ciphersuite>::F::from_bytes_mod_order_wide(
+          &Blake2b512::digest(
+            [
+              b"Tributary Signed Transaction",
+              genesis.as_ref(),
+              &self.hash(),
+              order.as_ref(),
+              signature.R.to_bytes().as_ref(),
+            ]
+            .concat(),
+          )
+          .into(),
+        )
+      }
+      _ => panic!("sig_hash called on non-signed transaction"),
+    }
+  }
+}
+
+pub trait GAIN: FnMut(&<Ristretto as Ciphersuite>::G, &[u8]) -> Option<u32> {}
+impl<F: FnMut(&<Ristretto as Ciphersuite>::G, &[u8]) -> Option<u32>> GAIN for F {}
+
+pub(crate) fn verify_transaction<F: GAIN, T: Transaction>(
+  tx: &T,
+  genesis: [u8; 32],
+  get_and_increment_nonce: &mut F,
+) -> Result<(), TransactionError> {
+  if tx.serialize().len() > TRANSACTION_SIZE_LIMIT {
+    Err(TransactionError::TooLargeTransaction)?;
+  }
+
+  tx.verify()?;
+
+  match tx.kind() {
+    TransactionKind::Provided(_) | TransactionKind::Unsigned => {}
+    TransactionKind::Signed(order, Signed { signer, nonce, signature }) => {
+      if let Some(next_nonce) = get_and_increment_nonce(&signer, &order) {
+        if nonce != next_nonce {
+          Err(TransactionError::InvalidNonce)?;
+        }
+      } else {
+        // Not a participant
+        Err(TransactionError::InvalidSigner)?;
+      }
+
+      // TODO: Use a batch verification here
+      if !signature.verify(signer, tx.sig_hash(genesis)) {
+        Err(TransactionError::InvalidSignature)?;
+      }
+    }
+  }
+
+  Ok(())
+}

coordinator/tributary-sdk/tendermint/Cargo.toml

@@ -0,0 +1,33 @@
+[package]
+name = "tendermint-machine"
+version = "0.2.0"
+description = "An implementation of the Tendermint state machine in Rust"
+license = "MIT"
+repository = "https://github.com/serai-dex/serai/tree/develop/coordinator/tendermint"
+authors = ["Luke Parker <lukeparker5132@gmail.com>"]
+edition = "2021"
+rust-version = "1.81"
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
+
+[lints]
+workspace = true
+
+[dependencies]
+thiserror = { version = "2", default-features = false, features = ["std"] }
+
+hex = { version = "0.4", default-features = false, features = ["std"] }
+log = { version = "0.4", default-features = false, features = ["std"] }
+
+parity-scale-codec = { version = "3", default-features = false, features = ["std", "derive"] }
+
+futures-util = { version = "0.3", default-features = false, features = ["std", "async-await-macro", "sink", "channel"] }
+futures-channel = { version = "0.3", default-features = false, features = ["std", "sink"] }
+patchable-async-sleep = { version = "0.1", path = "../../../common/patchable-async-sleep", default-features = false }
+
+serai-db = { path = "../../../common/db", version = "0.1", default-features = false }
+
+[dev-dependencies]
+tokio = { version = "1", features = ["sync", "rt-multi-thread", "macros"] }

coordinator/tributary-sdk/tendermint/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022-2023 Luke Parker
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

coordinator/tributary-sdk/tendermint/README.md

@@ -0,0 +1,61 @@
+# Tendermint
+
+An implementation of the Tendermint state machine in Rust.
+
+This is solely the state machine, intended to be mapped to any arbitrary system.
+It supports an arbitrary signature scheme, weighting, and block definition
+accordingly. It is not intended to work with the Cosmos SDK, solely to be an
+implementation of the [academic protocol](https://arxiv.org/pdf/1807.04938.pdf).
+
+### Caveats
+
+- Only SCALE serialization is supported currently. Ideally, everything from
+  SCALE to borsh to bincode would be supported. SCALE was chosen due to this
+  being under Serai, which uses Substrate, which uses SCALE. Accordingly, when
+  deciding which of the three (mutually incompatible) options to support...
+
+- The only supported runtime is tokio due to requiring a `sleep` implementation.
+  Ideally, the runtime choice will be moved to a feature in the future.
+
+- It is possible for `add_block` to be called on a block which failed (or never
+  went through in the first place) validation. This is a break from the paper
+  which is accepted here. This is for two reasons.
+
+  1) Serai needing this functionality.
+  2) If a block is committed which is invalid, either there's a malicious
+     majority now defining consensus OR the local node is malicious by virtue of
+     being faulty. Considering how either represents a fatal circumstance,
+     except with regards to system like Serai which have their own logic for
+     pseudo-valid blocks, it is accepted as a possible behavior with the caveat
+     any consumers must be aware of it. No machine will vote nor precommit to a
+     block it considers invalid, so for a network with an honest majority, this
+     is a non-issue.
+
+### Paper
+
+The [paper](https://arxiv.org/abs/1807.04938) describes the algorithm with
+pseudocode on page 6. This pseudocode isn't directly implementable, nor does it
+specify faulty behavior. Instead, it's solely a series of conditions which
+trigger events in order to successfully achieve consensus.
+
+The included pseudocode segments can be minimally described as follows:
+
+```
+01-09 Init
+10-10 StartRound(0)
+11-21 StartRound
+22-27 Fresh proposal
+28-33 Proposal building off a valid round with prevotes
+34-35 2f+1 prevote -> schedule timeout prevote
+36-43 First proposal with prevotes -> precommit Some
+44-46 2f+1 nil prevote -> precommit nil
+47-48 2f+1 precommit -> schedule timeout precommit
+49-54 First proposal with precommits -> finalize
+55-56 f+1 round > local round, jump
+57-60 on timeout propose
+61-64 on timeout prevote
+65-67 on timeout precommit
+```
+
+The corresponding Rust code implementing these tasks are marked with their
+related line numbers.

coordinator/tributary-sdk/tendermint/src/block.rs

@@ -0,0 +1,208 @@
+use std::{
+  sync::Arc,
+  collections::{HashSet, HashMap},
+};
+
+use serai_db::{Get, DbTxn, Db};
+
+use crate::{
+  time::CanonicalInstant,
+  ext::{RoundNumber, BlockNumber, Block, Network},
+  round::RoundData,
+  message_log::MessageLog,
+  Step, Data, DataFor, Message, MessageFor,
+};
+
+pub(crate) struct BlockData<N: Network> {
+  db: N::Db,
+  genesis: [u8; 32],
+
+  pub(crate) number: BlockNumber,
+  pub(crate) validator_id: Option<N::ValidatorId>,
+  pub(crate) our_proposal: Option<N::Block>,
+
+  pub(crate) log: MessageLog<N>,
+  pub(crate) slashes: HashSet<N::ValidatorId>,
+  // We track the end times of each round for two reasons:
+  // 1) Knowing the start time of the next round
+  // 2) Validating precommits, which include the end time of the round which produced it
+  // This HashMap contains the end time of the round we're currently in and every round prior
+  pub(crate) end_time: HashMap<RoundNumber, CanonicalInstant>,
+
+  pub(crate) round: Option<RoundData<N>>,
+
+  pub(crate) locked: Option<(RoundNumber, <N::Block as Block>::Id)>,
+  pub(crate) valid: Option<(RoundNumber, N::Block)>,
+}
+
+impl<N: Network> BlockData<N> {
+  pub(crate) fn new(
+    db: N::Db,
+    genesis: [u8; 32],
+    weights: Arc<N::Weights>,
+    number: BlockNumber,
+    validator_id: Option<N::ValidatorId>,
+    our_proposal: Option<N::Block>,
+  ) -> BlockData<N> {
+    BlockData {
+      db,
+      genesis,
+
+      number,
+      validator_id,
+      our_proposal,
+
+      log: MessageLog::new(weights),
+      slashes: HashSet::new(),
+      end_time: HashMap::new(),
+
+      // The caller of BlockData::new is expected to be populated after by the caller
+      round: None,
+
+      locked: None,
+      valid: None,
+    }
+  }
+
+  pub(crate) fn round(&self) -> &RoundData<N> {
+    self.round.as_ref().unwrap()
+  }
+
+  pub(crate) fn round_mut(&mut self) -> &mut RoundData<N> {
+    self.round.as_mut().unwrap()
+  }
+
+  // Populate the end time up to the specified round
+  // This is generally used when moving to the next round, where this will only populate one time,
+  // yet is also used when jumping rounds (when 33% of the validators are on a round ahead of us)
+  pub(crate) fn populate_end_time(&mut self, round: RoundNumber) {
+    // Starts from the current round since we only start the current round once we have have all
+    // the prior time data
+    for r in (self.round().number.0 + 1) ..= round.0 {
+      self.end_time.insert(
+        RoundNumber(r),
+        RoundData::<N>::new(RoundNumber(r), self.end_time[&RoundNumber(r - 1)]).end_time(),
+      );
+    }
+  }
+
+  // Start a new round. Optionally takes in the time for when this is the first round, and the time
+  // isn't simply the time of the prior round (yet rather the prior block). Returns the proposal
+  // data, if we are the proposer.
+  pub(crate) fn new_round(
+    &mut self,
+    round: RoundNumber,
+    proposer: N::ValidatorId,
+    time: Option<CanonicalInstant>,
+  ) -> Option<DataFor<N>> {
+    debug_assert_eq!(round.0 == 0, time.is_some());
+
+    // If this is the first round, we don't have a prior round's end time to use as the start
+    // We use the passed in time instead
+    // If this isn't the first round, ensure we have the prior round's end time by populating the
+    // map with all rounds till this round
+    // This can happen we jump from round x to round x+n, where n != 1
+    // The paper says to do so whenever you observe a sufficient amount of peers on a higher round
+    if round.0 != 0 {
+      self.populate_end_time(round);
+    }
+
+    // L11-13
+    self.round = Some(RoundData::<N>::new(
+      round,
+      time.unwrap_or_else(|| self.end_time[&RoundNumber(round.0 - 1)]),
+    ));
+    self.end_time.insert(round, self.round().end_time());
+
+    // L14-21
+    if Some(proposer) == self.validator_id {
+      let (round, block) = self.valid.clone().unzip();
+      block.or_else(|| self.our_proposal.clone()).map(|block| Data::Proposal(round, block))
+    } else {
+      self.round_mut().set_timeout(Step::Propose);
+      None
+    }
+  }
+
+  // Transform Data into an actual Message, using the contextual data from this block
+  pub(crate) fn message(&mut self, data: DataFor<N>) -> Option<MessageFor<N>> {
+    debug_assert_eq!(
+      self.round().step,
+      match data.step() {
+        Step::Propose | Step::Prevote => Step::Propose,
+        Step::Precommit => Step::Prevote,
+      },
+    );
+    // Tendermint always sets the round's step to whatever it just broadcasted
+    // Consolidate all of those here to ensure they aren't missed by an oversight
+    // 27, 33, 41, 46, 60, 64
+    self.round_mut().step = data.step();
+
+    // Only return a message to if we're actually a current validator
+    let round_number = self.round().number;
+    let res = self.validator_id.map(|validator_id| Message {
+      sender: validator_id,
+      block: self.number,
+      round: round_number,
+      data,
+    });
+
+    if let Some(res) = res.as_ref() {
+      const LATEST_BLOCK_KEY: &[u8] = b"tendermint-machine-sent_block";
+      const LATEST_ROUND_KEY: &[u8] = b"tendermint-machine-sent_round";
+      const PROPOSE_KEY: &[u8] = b"tendermint-machine-sent_propose";
+      const PEVOTE_KEY: &[u8] = b"tendermint-machine-sent_prevote";
+      const PRECOMMIT_KEY: &[u8] = b"tendermint-machine-sent_commit";
+
+      let genesis = self.genesis;
+      let key = |prefix: &[u8]| [prefix, &genesis].concat();
+
+      let mut txn = self.db.txn();
+
+      // Ensure we haven't prior sent a message for a future block/round
+      let last_block_or_round = |txn: &mut <N::Db as Db>::Transaction<'_>, prefix, current| {
+        let key = key(prefix);
+        let latest =
+          u64::from_le_bytes(txn.get(key.as_slice()).unwrap_or(vec![0; 8]).try_into().unwrap());
+        if latest > current {
+          None?;
+        }
+        if current > latest {
+          txn.put(&key, current.to_le_bytes());
+          return Some(true);
+        }
+        Some(false)
+      };
+      let new_block = last_block_or_round(&mut txn, LATEST_BLOCK_KEY, self.number.0)?;
+      if new_block {
+        // Delete the latest round key
+        txn.del(key(LATEST_ROUND_KEY));
+      }
+      let new_round = last_block_or_round(&mut txn, LATEST_ROUND_KEY, round_number.0.into())?;
+      if new_block || new_round {
+        // Delete the messages for the old round
+        txn.del(key(PROPOSE_KEY));
+        txn.del(key(PEVOTE_KEY));
+        txn.del(key(PRECOMMIT_KEY));
+      }
+
+      // Check we haven't sent this message within this round
+      let msg_key = key(match res.data.step() {
+        Step::Propose => PROPOSE_KEY,
+        Step::Prevote => PEVOTE_KEY,
+        Step::Precommit => PRECOMMIT_KEY,
+      });
+      if txn.get(&msg_key).is_some() {
+        assert!(!new_block);
+        assert!(!new_round);
+        None?;
+      }
+      // Put that we're sending this message to the DB
+      txn.put(&msg_key, []);
+
+      txn.commit();
+    }
+
+    res
+  }
+}

coordinator/tributary-sdk/tendermint/src/ext.rs

@@ -0,0 +1,307 @@
+use core::{hash::Hash, fmt::Debug, future::Future};
+use std::{sync::Arc, collections::HashSet};
+
+use thiserror::Error;
+
+use parity_scale_codec::{Encode, Decode};
+
+use crate::{SignedMessageFor, SlashEvent, commit_msg};
+
+/// An alias for a series of traits required for a type to be usable as a validator ID,
+/// automatically implemented for all types satisfying those traits.
+pub trait ValidatorId:
+  Send + Sync + Clone + Copy + PartialEq + Eq + Hash + Debug + Encode + Decode
+{
+}
+impl<V: Send + Sync + Clone + Copy + PartialEq + Eq + Hash + Debug + Encode + Decode> ValidatorId
+  for V
+{
+}
+
+/// An alias for a series of traits required for a type to be usable as a signature,
+/// automatically implemented for all types satisfying those traits.
+pub trait Signature: Send + Sync + Clone + PartialEq + Eq + Debug + Encode + Decode {}
+impl<S: Send + Sync + Clone + PartialEq + Eq + Debug + Encode + Decode> Signature for S {}
+
+// Type aliases which are distinct according to the type system
+
+/// A struct containing a Block Number, wrapped to have a distinct type.
+#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug, Encode, Decode)]
+pub struct BlockNumber(pub u64);
+/// A struct containing a round number, wrapped to have a distinct type.
+#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug, Encode, Decode)]
+pub struct RoundNumber(pub u32);
+
+/// A signer for a validator.
+pub trait Signer: Send + Sync {
+  // Type used to identify validators.
+  type ValidatorId: ValidatorId;
+  /// Signature type.
+  type Signature: Signature;
+
+  /// Returns the validator's current ID. Returns None if they aren't a current validator.
+  fn validator_id(&self) -> impl Send + Future<Output = Option<Self::ValidatorId>>;
+  /// Sign a signature with the current validator's private key.
+  fn sign(&self, msg: &[u8]) -> impl Send + Future<Output = Self::Signature>;
+}
+
+impl<S: Signer> Signer for Arc<S> {
+  type ValidatorId = S::ValidatorId;
+  type Signature = S::Signature;
+
+  fn validator_id(&self) -> impl Send + Future<Output = Option<Self::ValidatorId>> {
+    self.as_ref().validator_id()
+  }
+
+  fn sign(&self, msg: &[u8]) -> impl Send + Future<Output = Self::Signature> {
+    self.as_ref().sign(msg)
+  }
+}
+
+/// A signature scheme used by validators.
+pub trait SignatureScheme: Send + Sync + Clone {
+  // Type used to identify validators.
+  type ValidatorId: ValidatorId;
+  /// Signature type.
+  type Signature: Signature;
+  /// Type representing an aggregate signature. This would presumably be a BLS signature,
+  /// yet even with Schnorr signatures
+  /// [half-aggregation is possible](https://eprint.iacr.org/2021/350).
+  /// It could even be a threshold signature scheme, though that's currently unexpected.
+  type AggregateSignature: Signature;
+
+  /// Type representing a signer of this scheme.
+  type Signer: Signer<ValidatorId = Self::ValidatorId, Signature = Self::Signature>;
+
+  /// Verify a signature from the validator in question.
+  #[must_use]
+  fn verify(&self, validator: Self::ValidatorId, msg: &[u8], sig: &Self::Signature) -> bool;
+
+  /// Aggregate signatures.
+  /// It may panic if corrupted data passed in.
+  fn aggregate(
+    &self,
+    validators: &[Self::ValidatorId],
+    msg: &[u8],
+    sigs: &[Self::Signature],
+  ) -> Self::AggregateSignature;
+  /// Verify an aggregate signature for the list of signers.
+  #[must_use]
+  fn verify_aggregate(
+    &self,
+    signers: &[Self::ValidatorId],
+    msg: &[u8],
+    sig: &Self::AggregateSignature,
+  ) -> bool;
+}
+
+impl<S: SignatureScheme> SignatureScheme for Arc<S> {
+  type ValidatorId = S::ValidatorId;
+  type Signature = S::Signature;
+  type AggregateSignature = S::AggregateSignature;
+  type Signer = S::Signer;
+
+  fn verify(&self, validator: Self::ValidatorId, msg: &[u8], sig: &Self::Signature) -> bool {
+    self.as_ref().verify(validator, msg, sig)
+  }
+
+  fn aggregate(
+    &self,
+    validators: &[Self::ValidatorId],
+    msg: &[u8],
+    sigs: &[Self::Signature],
+  ) -> Self::AggregateSignature {
+    self.as_ref().aggregate(validators, msg, sigs)
+  }
+
+  #[must_use]
+  fn verify_aggregate(
+    &self,
+    signers: &[Self::ValidatorId],
+    msg: &[u8],
+    sig: &Self::AggregateSignature,
+  ) -> bool {
+    self.as_ref().verify_aggregate(signers, msg, sig)
+  }
+}
+
+/// A commit for a specific block.
+///
+/// The list of validators have weight exceeding the threshold for a valid commit.
+#[derive(PartialEq, Debug, Encode, Decode)]
+pub struct Commit<S: SignatureScheme> {
+  /// End time of the round which created this commit, used as the start time of the next block.
+  pub end_time: u64,
+  /// Validators participating in the signature.
+  pub validators: Vec<S::ValidatorId>,
+  /// Aggregate signature.
+  pub signature: S::AggregateSignature,
+}
+
+impl<S: SignatureScheme> Clone for Commit<S> {
+  fn clone(&self) -> Self {
+    Self {
+      end_time: self.end_time,
+      validators: self.validators.clone(),
+      signature: self.signature.clone(),
+    }
+  }
+}
+
+/// Weights for the validators present.
+pub trait Weights: Send + Sync {
+  type ValidatorId: ValidatorId;
+
+  /// Total weight of all validators.
+  fn total_weight(&self) -> u64;
+  /// Weight for a specific validator.
+  fn weight(&self, validator: Self::ValidatorId) -> u64;
+  /// Threshold needed for BFT consensus.
+  fn threshold(&self) -> u64 {
+    ((self.total_weight() * 2) / 3) + 1
+  }
+  /// Threshold preventing BFT consensus.
+  fn fault_threshold(&self) -> u64 {
+    (self.total_weight() - self.threshold()) + 1
+  }
+
+  /// Weighted round robin function.
+  fn proposer(&self, block: BlockNumber, round: RoundNumber) -> Self::ValidatorId;
+}
+
+impl<W: Weights> Weights for Arc<W> {
+  type ValidatorId = W::ValidatorId;
+
+  fn total_weight(&self) -> u64 {
+    self.as_ref().total_weight()
+  }
+
+  fn weight(&self, validator: Self::ValidatorId) -> u64 {
+    self.as_ref().weight(validator)
+  }
+
+  fn proposer(&self, block: BlockNumber, round: RoundNumber) -> Self::ValidatorId {
+    self.as_ref().proposer(block, round)
+  }
+}
+
+/// Simplified error enum representing a block's validity.
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Error, Encode, Decode)]
+pub enum BlockError {
+  /// Malformed block which is wholly invalid.
+  #[error("invalid block")]
+  Fatal,
+  /// Valid block by syntax, with semantics which may or may not be valid yet are locally
+  /// considered invalid. If a block fails to validate with this, a slash will not be triggered.
+  #[error("invalid block under local view")]
+  Temporal,
+}
+
+/// Trait representing a Block.
+pub trait Block: Send + Sync + Clone + PartialEq + Eq + Debug + Encode + Decode {
+  // Type used to identify blocks. Presumably a cryptographic hash of the block.
+  type Id: Send + Sync + Copy + Clone + PartialEq + Eq + AsRef<[u8]> + Debug + Encode + Decode;
+
+  /// Return the deterministic, unique ID for this block.
+  fn id(&self) -> Self::Id;
+}
+
+/// Trait representing the distributed system Tendermint is providing consensus over.
+pub trait Network: Sized + Send + Sync {
+  /// The database used to back this.
+  type Db: serai_db::Db;
+
+  // Type used to identify validators.
+  type ValidatorId: ValidatorId;
+  /// Signature scheme used by validators.
+  type SignatureScheme: SignatureScheme<ValidatorId = Self::ValidatorId>;
+  /// Object representing the weights of validators.
+  type Weights: Weights<ValidatorId = Self::ValidatorId>;
+  /// Type used for ordered blocks of information.
+  type Block: Block;
+
+  /// Maximum block processing time in milliseconds.
+  ///
+  /// This should include both the time to download the block and the actual processing time.
+  ///
+  /// BLOCK_PROCESSING_TIME + (3 * LATENCY_TIME) must be divisible by 1000.
+  // TODO: Redefine as Duration
+  const BLOCK_PROCESSING_TIME: u32;
+  /// Network latency time in milliseconds.
+  ///
+  /// BLOCK_PROCESSING_TIME + (3 * LATENCY_TIME) must be divisible by 1000.
+  const LATENCY_TIME: u32;
+
+  /// The block time, in seconds. Defined as the processing time plus three times the latency.
+  fn block_time() -> u32 {
+    let raw = Self::BLOCK_PROCESSING_TIME + (3 * Self::LATENCY_TIME);
+    let res = raw / 1000;
+    assert_eq!(res * 1000, raw);
+    res
+  }
+
+  /// Return a handle on the signer in use, usable for the entire lifetime of the machine.
+  fn signer(&self) -> <Self::SignatureScheme as SignatureScheme>::Signer;
+  /// Return a handle on the signing scheme in use, usable for the entire lifetime of the machine.
+  fn signature_scheme(&self) -> Self::SignatureScheme;
+  /// Return a handle on the validators' weights, usable for the entire lifetime of the machine.
+  fn weights(&self) -> Self::Weights;
+
+  /// Verify a commit for a given block. Intended for use when syncing or when not an active
+  /// validator.
+  #[must_use]
+  fn verify_commit(
+    &self,
+    id: <Self::Block as Block>::Id,
+    commit: &Commit<Self::SignatureScheme>,
+  ) -> bool {
+    if commit.validators.iter().collect::<HashSet<_>>().len() != commit.validators.len() {
+      return false;
+    }
+
+    if !self.signature_scheme().verify_aggregate(
+      &commit.validators,
+      &commit_msg(commit.end_time, id.as_ref()),
+      &commit.signature,
+    ) {
+      return false;
+    }
+
+    let weights = self.weights();
+    commit.validators.iter().map(|v| weights.weight(*v)).sum::<u64>() >= weights.threshold()
+  }
+
+  /// Broadcast a message to the other validators.
+  ///
+  /// If authenticated channels have already been established, this will double-authenticate.
+  /// Switching to unauthenticated channels in a system already providing authenticated channels is
+  /// not recommended as this is a minor, temporal inefficiency, while downgrading channels may
+  /// have wider implications.
+  fn broadcast(&mut self, msg: SignedMessageFor<Self>) -> impl Send + Future<Output = ()>;
+
+  /// Trigger a slash for the validator in question who was definitively malicious.
+  ///
+  /// The exact process of triggering a slash is undefined and left to the network as a whole.
+  fn slash(
+    &mut self,
+    validator: Self::ValidatorId,
+    slash_event: SlashEvent,
+  ) -> impl Send + Future<Output = ()>;
+
+  /// Validate a block.
+  fn validate(&self, block: &Self::Block) -> impl Send + Future<Output = Result<(), BlockError>>;
+
+  /// Add a block, returning the proposal for the next one.
+  ///
+  /// It's possible a block, which was never validated or even failed validation, may be passed
+  /// here if a supermajority of validators did consider it valid and created a commit for it.
+  ///
+  /// This deviates from the paper which will have a local node refuse to decide on a block it
+  /// considers invalid. This library acknowledges the network did decide on it, leaving handling
+  /// of it to the network, and outside of this scope.
+  fn add_block(
+    &mut self,
+    block: Self::Block,
+    commit: Commit<Self::SignatureScheme>,
+  ) -> impl Send + Future<Output = Option<Self::Block>>;
+}

coordinator/tributary-sdk/tendermint/src/message_log.rs

@@ -0,0 +1,74 @@
+use std::{sync::Arc, collections::HashMap};
+
+use parity_scale_codec::Encode;
+
+use crate::{ext::*, RoundNumber, Step, DataFor, SignedMessageFor, Evidence};
+
+type RoundLog<N> = HashMap<<N as Network>::ValidatorId, HashMap<Step, SignedMessageFor<N>>>;
+pub(crate) struct MessageLog<N: Network> {
+  weights: Arc<N::Weights>,
+  round_participation: HashMap<RoundNumber, u64>,
+  participation: HashMap<(RoundNumber, Step), u64>,
+  message_instances: HashMap<(RoundNumber, DataFor<N>), u64>,
+  pub(crate) log: HashMap<RoundNumber, RoundLog<N>>,
+}
+
+impl<N: Network> MessageLog<N> {
+  pub(crate) fn new(weights: Arc<N::Weights>) -> MessageLog<N> {
+    MessageLog {
+      weights,
+      round_participation: HashMap::new(),
+      participation: HashMap::new(),
+      message_instances: HashMap::new(),
+      log: HashMap::new(),
+    }
+  }
+
+  // Returns true if it's a new message
+  pub(crate) fn log(&mut self, signed: SignedMessageFor<N>) -> Result<bool, Evidence> {
+    let msg = &signed.msg;
+    // Clarity, and safety around default != new edge cases
+    let round = self.log.entry(msg.round).or_insert_with(HashMap::new);
+    let msgs = round.entry(msg.sender).or_insert_with(HashMap::new);
+
+    // Handle message replays without issue. It's only multiple messages which is malicious
+    let step = msg.data.step();
+    if let Some(existing) = msgs.get(&step) {
+      if existing.msg.data != msg.data {
+        log::debug!(
+          target: "tendermint",
+          "Validator sent multiple messages for the same block + round + step"
+        );
+        Err(Evidence::ConflictingMessages(existing.encode(), signed.encode()))?;
+      }
+      return Ok(false);
+    }
+
+    // Since we have a new message, update the participation
+    let sender_weight = self.weights.weight(msg.sender);
+    if msgs.is_empty() {
+      *self.round_participation.entry(msg.round).or_insert_with(|| 0) += sender_weight;
+    }
+    *self.participation.entry((msg.round, step)).or_insert_with(|| 0) += sender_weight;
+    *self.message_instances.entry((msg.round, msg.data.clone())).or_insert_with(|| 0) +=
+      sender_weight;
+
+    msgs.insert(step, signed);
+    Ok(true)
+  }
+
+  // Get the participation in a given round
+  pub(crate) fn round_participation(&self, round: RoundNumber) -> u64 {
+    *self.round_participation.get(&round).unwrap_or(&0)
+  }
+
+  // Check if a supermajority of nodes have participated on a specific step
+  pub(crate) fn has_participation(&self, round: RoundNumber, step: Step) -> bool {
+    *self.participation.get(&(round, step)).unwrap_or(&0) >= self.weights.threshold()
+  }
+
+  // Check if consensus has been reached on a specific piece of data
+  pub(crate) fn has_consensus(&self, round: RoundNumber, data: &DataFor<N>) -> bool {
+    *self.message_instances.get(&(round, data.clone())).unwrap_or(&0) >= self.weights.threshold()
+  }
+}

coordinator/tributary-sdk/tendermint/src/round.rs

@@ -0,0 +1,93 @@
+use std::{
+  marker::PhantomData,
+  time::{Duration, Instant},
+  collections::HashMap,
+};
+
+use futures_util::{FutureExt, future};
+use patchable_async_sleep::sleep;
+
+use crate::{
+  time::CanonicalInstant,
+  Step,
+  ext::{RoundNumber, Network},
+};
+
+pub struct RoundData<N: Network> {
+  _network: PhantomData<N>,
+  pub number: RoundNumber,
+  pub start_time: CanonicalInstant,
+  pub step: Step,
+  pub timeouts: HashMap<Step, Instant>,
+}
+
+impl<N: Network> RoundData<N> {
+  pub fn new(number: RoundNumber, start_time: CanonicalInstant) -> Self {
+    RoundData {
+      _network: PhantomData,
+      number,
+      start_time,
+      step: Step::Propose,
+      timeouts: HashMap::new(),
+    }
+  }
+
+  fn timeout(&self, step: Step) -> CanonicalInstant {
+    let adjusted_block = N::BLOCK_PROCESSING_TIME * (self.number.0 + 1);
+    let adjusted_latency = N::LATENCY_TIME * (self.number.0 + 1);
+    let offset = Duration::from_millis(
+      (match step {
+        Step::Propose => adjusted_block + adjusted_latency,
+        Step::Prevote => adjusted_block + (2 * adjusted_latency),
+        Step::Precommit => adjusted_block + (3 * adjusted_latency),
+      })
+      .into(),
+    );
+    self.start_time + offset
+  }
+
+  pub fn end_time(&self) -> CanonicalInstant {
+    self.timeout(Step::Precommit)
+  }
+
+  pub(crate) fn set_timeout(&mut self, step: Step) {
+    let timeout = self.timeout(step).instant();
+    self.timeouts.entry(step).or_insert(timeout);
+  }
+
+  // Poll all set timeouts, returning the Step whose timeout has just expired
+  pub(crate) async fn timeout_future(&self) -> Step {
+    /*
+    let now = Instant::now();
+    log::trace!(
+      target: "tendermint",
+      "getting timeout_future, from step {:?}, off timeouts: {:?}",
+      self.step,
+      self.timeouts.iter().map(|(k, v)| (k, v.duration_since(now))).collect::<HashMap<_, _>>()
+    );
+    */
+
+    let timeout_future = |step| {
+      let timeout = self.timeouts.get(&step).copied();
+      (async move {
+        if let Some(timeout) = timeout {
+          sleep(timeout.saturating_duration_since(Instant::now())).await;
+        } else {
+          future::pending::<()>().await;
+        }
+        step
+      })
+      .fuse()
+    };
+    let propose_timeout = timeout_future(Step::Propose);
+    let prevote_timeout = timeout_future(Step::Prevote);
+    let precommit_timeout = timeout_future(Step::Precommit);
+    futures_util::pin_mut!(propose_timeout, prevote_timeout, precommit_timeout);
+
+    futures_util::select_biased! {
+      step = propose_timeout => step,
+      step = prevote_timeout => step,
+      step = precommit_timeout => step,
+    }
+  }
+}

coordinator/tributary-sdk/tendermint/src/time.rs

@@ -0,0 +1,44 @@
+use core::ops::Add;
+use std::time::{UNIX_EPOCH, SystemTime, Instant, Duration};
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub struct CanonicalInstant {
+  /// Time since the epoch.
+  time: u64,
+  /// An Instant synchronized with the above time.
+  instant: Instant,
+}
+
+pub(crate) fn sys_time(time: u64) -> SystemTime {
+  UNIX_EPOCH + Duration::from_secs(time)
+}
+
+impl CanonicalInstant {
+  pub fn new(time: u64) -> CanonicalInstant {
+    // This is imprecise yet should be precise enough, as it'll resolve within a few ms
+    let instant_now = Instant::now();
+    let sys_now = SystemTime::now();
+
+    // If the time is in the future, this will be off by that much time
+    let elapsed = sys_now.duration_since(sys_time(time)).unwrap_or(Duration::ZERO);
+    // Except for the fact this panics here
+    let synced_instant = instant_now.checked_sub(elapsed).unwrap();
+
+    CanonicalInstant { time, instant: synced_instant }
+  }
+
+  pub fn canonical(&self) -> u64 {
+    self.time
+  }
+
+  pub fn instant(&self) -> Instant {
+    self.instant
+  }
+}
+
+impl Add<Duration> for CanonicalInstant {
+  type Output = CanonicalInstant;
+  fn add(self, duration: Duration) -> CanonicalInstant {
+    CanonicalInstant { time: self.time + duration.as_secs(), instant: self.instant + duration }
+  }
+}

coordinator/tributary-sdk/tendermint/tests/ext.rs

@@ -0,0 +1,202 @@
+use core::future::Future;
+use std::{
+  sync::Arc,
+  time::{UNIX_EPOCH, SystemTime, Duration},
+};
+
+use parity_scale_codec::{Encode, Decode};
+
+use futures_util::sink::SinkExt;
+use tokio::{sync::RwLock, time::sleep};
+
+use serai_db::MemDb;
+
+use tendermint_machine::{
+  ext::*, SignedMessageFor, SyncedBlockSender, SyncedBlockResultReceiver, MessageSender,
+  SlashEvent, TendermintMachine, TendermintHandle,
+};
+
+type TestValidatorId = u16;
+type TestBlockId = [u8; 4];
+
+struct TestSigner(u16);
+impl Signer for TestSigner {
+  type ValidatorId = TestValidatorId;
+  type Signature = [u8; 32];
+
+  fn validator_id(&self) -> impl Send + Future<Output = Option<TestValidatorId>> {
+    async move { Some(self.0) }
+  }
+
+  fn sign(&self, msg: &[u8]) -> impl Send + Future<Output = [u8; 32]> {
+    async move {
+      let mut sig = [0; 32];
+      sig[.. 2].copy_from_slice(&self.0.to_le_bytes());
+      sig[2 .. (2 + 30.min(msg.len()))].copy_from_slice(&msg[.. 30.min(msg.len())]);
+      sig
+    }
+  }
+}
+
+#[derive(Clone)]
+struct TestSignatureScheme;
+impl SignatureScheme for TestSignatureScheme {
+  type ValidatorId = TestValidatorId;
+  type Signature = [u8; 32];
+  type AggregateSignature = Vec<[u8; 32]>;
+  type Signer = TestSigner;
+
+  #[must_use]
+  fn verify(&self, validator: u16, msg: &[u8], sig: &[u8; 32]) -> bool {
+    (sig[.. 2] == validator.to_le_bytes()) && (sig[2 ..] == [msg, &[0; 30]].concat()[.. 30])
+  }
+
+  fn aggregate(
+    &self,
+    _: &[Self::ValidatorId],
+    _: &[u8],
+    sigs: &[Self::Signature],
+  ) -> Self::AggregateSignature {
+    sigs.to_vec()
+  }
+
+  #[must_use]
+  fn verify_aggregate(
+    &self,
+    signers: &[TestValidatorId],
+    msg: &[u8],
+    sigs: &Vec<[u8; 32]>,
+  ) -> bool {
+    assert_eq!(signers.len(), sigs.len());
+    for sig in signers.iter().zip(sigs.iter()) {
+      assert!(self.verify(*sig.0, msg, sig.1));
+    }
+    true
+  }
+}
+
+struct TestWeights;
+impl Weights for TestWeights {
+  type ValidatorId = TestValidatorId;
+
+  fn total_weight(&self) -> u64 {
+    4
+  }
+  fn weight(&self, id: TestValidatorId) -> u64 {
+    [1; 4][usize::from(id)]
+  }
+
+  fn proposer(&self, number: BlockNumber, round: RoundNumber) -> TestValidatorId {
+    TestValidatorId::try_from((number.0 + u64::from(round.0)) % 4).unwrap()
+  }
+}
+
+#[derive(Clone, PartialEq, Eq, Debug, Encode, Decode)]
+struct TestBlock {
+  id: TestBlockId,
+  valid: Result<(), BlockError>,
+}
+
+impl Block for TestBlock {
+  type Id = TestBlockId;
+
+  fn id(&self) -> TestBlockId {
+    self.id
+  }
+}
+
+#[allow(clippy::type_complexity)]
+struct TestNetwork(
+  u16,
+  Arc<RwLock<Vec<(MessageSender<Self>, SyncedBlockSender<Self>, SyncedBlockResultReceiver)>>>,
+);
+
+impl Network for TestNetwork {
+  type Db = MemDb;
+
+  type ValidatorId = TestValidatorId;
+  type SignatureScheme = TestSignatureScheme;
+  type Weights = TestWeights;
+  type Block = TestBlock;
+
+  const BLOCK_PROCESSING_TIME: u32 = 2000;
+  const LATENCY_TIME: u32 = 1000;
+
+  fn signer(&self) -> TestSigner {
+    TestSigner(self.0)
+  }
+
+  fn signature_scheme(&self) -> TestSignatureScheme {
+    TestSignatureScheme
+  }
+
+  fn weights(&self) -> TestWeights {
+    TestWeights
+  }
+
+  async fn broadcast(&mut self, msg: SignedMessageFor<Self>) {
+    for (messages, _, _) in self.1.write().await.iter_mut() {
+      messages.send(msg.clone()).await.unwrap();
+    }
+  }
+
+  async fn slash(&mut self, id: TestValidatorId, event: SlashEvent) {
+    println!("Slash for {id} due to {event:?}");
+  }
+
+  async fn validate(&self, block: &TestBlock) -> Result<(), BlockError> {
+    block.valid
+  }
+
+  async fn add_block(
+    &mut self,
+    block: TestBlock,
+    commit: Commit<TestSignatureScheme>,
+  ) -> Option<TestBlock> {
+    println!("Adding {:?}", &block);
+    assert!(block.valid.is_ok());
+    assert!(self.verify_commit(block.id(), &commit));
+    Some(TestBlock { id: (u32::from_le_bytes(block.id) + 1).to_le_bytes(), valid: Ok(()) })
+  }
+}
+
+impl TestNetwork {
+  async fn new(
+    validators: usize,
+    start_time: u64,
+  ) -> Arc<RwLock<Vec<(MessageSender<Self>, SyncedBlockSender<Self>, SyncedBlockResultReceiver)>>>
+  {
+    let arc = Arc::new(RwLock::new(vec![]));
+    {
+      let mut write = arc.write().await;
+      for i in 0 .. validators {
+        let i = u16::try_from(i).unwrap();
+        let TendermintHandle { messages, synced_block, synced_block_result, machine } =
+          TendermintMachine::new(
+            MemDb::new(),
+            TestNetwork(i, arc.clone()),
+            [0; 32],
+            BlockNumber(1),
+            start_time,
+            TestBlock { id: 1u32.to_le_bytes(), valid: Ok(()) },
+          )
+          .await;
+        tokio::spawn(machine.run());
+        write.push((messages, synced_block, synced_block_result));
+      }
+    }
+    arc
+  }
+}
+
+#[tokio::test]
+async fn test_machine() {
+  TestNetwork::new(4, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs()).await;
+  sleep(Duration::from_secs(30)).await;
+}
+
+#[tokio::test]
+async fn test_machine_with_historic_start_time() {
+  TestNetwork::new(4, SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() - 60).await;
+  sleep(Duration::from_secs(30)).await;
+}