Slash reports (#523)

* report_slashes plumbing in Substrate

Notably delays the SetRetired event until it provides a slash report or the set
after it becomes the set to report its slashes.

* Add dedicated AcceptedHandover event

* Add SlashReport TX to Tributary

* Create SlashReport TXs

* Handle SlashReport TXs

* Add logic to generate a SlashReport to the coordinator

* Route SlashReportSigner into the processor

* Finish routing the SlashReport signing/TX publication

* Add serai feature to processor's serai-client

coordinator/src/tributary/db.rs

@@ -51,10 +51,13 @@ create_db!(
     TributaryBlockNumber: (block: [u8; 32]) -> u32,
     LastHandledBlock: (genesis: [u8; 32]) -> [u8; 32],
 
+    // TODO: Revisit the point of this
     FatalSlashes: (genesis: [u8; 32]) -> Vec<[u8; 32]>,
     RemovedAsOfDkgAttempt: (genesis: [u8; 32], attempt: u32) -> Vec<[u8; 32]>,
     OfflineDuringDkg: (genesis: [u8; 32]) -> Vec<[u8; 32]>,
+    // TODO: Combine these two
     FatallySlashed: (genesis: [u8; 32], account: [u8; 32]) -> (),
+    SlashPoints: (genesis: [u8; 32], account: [u8; 32]) -> u32,
 
     VotedToRemove: (genesis: [u8; 32], voter: [u8; 32], to_remove: [u8; 32]) -> (),
     VotesToRemove: (genesis: [u8; 32], to_remove: [u8; 32]) -> u16,
@@ -73,6 +76,11 @@ create_db!(
     PlanIds: (genesis: &[u8], block: u64) -> Vec<[u8; 32]>,
 
     SignedTransactionDb: (order: &[u8], nonce: u32) -> Vec<u8>,
+
+    SlashReports: (genesis: [u8; 32], signer: [u8; 32]) -> Vec<u32>,
+    SlashReported: (genesis: [u8; 32]) -> u16,
+    SlashReportCutOff: (genesis: [u8; 32]) -> u64,
+    SlashReport: (set: ValidatorSet) -> Vec<([u8; 32], u32)>,
   }
 );
 
@@ -116,7 +124,13 @@ impl AttemptDb {
   pub fn attempt(getter: &impl Get, genesis: [u8; 32], topic: Topic) -> Option<u32> {
     let attempt = Self::get(getter, genesis, &topic);
     // Don't require explicit recognition of the Dkg topic as it starts when the chain does
-    if attempt.is_none() && ((topic == Topic::Dkg) || (topic == Topic::DkgConfirmation)) {
+    // Don't require explicit recognition of the SlashReport topic as it isn't a DoS risk and it
+    // should always happen (eventually)
+    if attempt.is_none() &&
+      ((topic == Topic::Dkg) ||
+        (topic == Topic::DkgConfirmation) ||
+        (topic == Topic::SubstrateSign(SubstrateSignableId::SlashReport)))
+    {
       return Some(0);
     }
     attempt

coordinator/src/tributary/handle.rs

@@ -738,6 +738,39 @@ impl<
         };
         self.processors.send(self.spec.set().network, msg).await;
       }
+
+      Transaction::SlashReport(points, signed) => {
+        // Uses &[] as we only need the length which is independent to who else was removed
+        let signer_range = self.spec.i(&[], signed.signer).unwrap();
+        let signer_len = u16::from(signer_range.end) - u16::from(signer_range.start);
+        if points.len() != (self.spec.validators().len() - 1) {
+          self.fatal_slash(
+            signed.signer.to_bytes(),
+            "submitted a distinct amount of slash points to participants",
+          );
+          return;
+        }
+
+        if SlashReports::get(self.txn, genesis, signed.signer.to_bytes()).is_some() {
+          self.fatal_slash(signed.signer.to_bytes(), "submitted multiple slash points");
+          return;
+        }
+        SlashReports::set(self.txn, genesis, signed.signer.to_bytes(), &points);
+
+        let prior_reported = SlashReported::get(self.txn, genesis).unwrap_or(0);
+        let now_reported = prior_reported + signer_len;
+        SlashReported::set(self.txn, genesis, &now_reported);
+
+        if (prior_reported < self.spec.t()) && (now_reported >= self.spec.t()) {
+          SlashReportCutOff::set(
+            self.txn,
+            genesis,
+            // 30 minutes into the future
+            &(u64::from(self.block_number) +
+              ((30 * 60 * 1000) / u64::from(tributary::tendermint::TARGET_BLOCK_TIME))),
+          );
+        }
+      }
     }
   }
 }

coordinator/src/tributary/scanner.rs

@@ -16,7 +16,7 @@ use serai_client::{
 
 use serai_db::DbTxn;
 
-use processor_messages::coordinator::SubstrateSignableId;
+use processor_messages::coordinator::{SubstrateSignId, SubstrateSignableId};
 
 use tributary::{
   TransactionKind, Transaction as TributaryTransaction, TransactionError, Block, TributaryReader,
@@ -520,6 +520,24 @@ impl<
                   .await;
               }
             }
+            SubstrateSignableId::SlashReport => {
+              // If this Tributary hasn't been retired...
+              // (published SlashReport/took too long to do so)
+              if crate::RetiredTributaryDb::get(self.txn, self.spec.set()).is_none() {
+                let report = SlashReport::get(self.txn, self.spec.set())
+                  .expect("re-attempting signing a SlashReport we don't have?");
+                self
+                  .processors
+                  .send(
+                    self.spec.set().network,
+                    processor_messages::coordinator::CoordinatorMessage::SignSlashReport {
+                      id,
+                      report,
+                    },
+                  )
+                  .await;
+              }
+            }
           }
         }
         Topic::Sign(id) => {
@@ -542,6 +560,94 @@ impl<
         }
       }
     }
+
+    if Some(u64::from(self.block_number)) == SlashReportCutOff::get(self.txn, genesis) {
+      // Grab every slash report
+      let mut all_reports = vec![];
+      for (i, (validator, _)) in self.spec.validators().into_iter().enumerate() {
+        let Some(mut report) = SlashReports::get(self.txn, genesis, validator.to_bytes()) else {
+          continue;
+        };
+        // Assign them 0 points for themselves
+        report.insert(i, 0);
+        // Uses &[] as we only need the length which is independent to who else was removed
+        let signer_i = self.spec.i(&[], validator).unwrap();
+        let signer_len = u16::from(signer_i.end) - u16::from(signer_i.start);
+        // Push `n` copies, one for each of their shares
+        for _ in 0 .. signer_len {
+          all_reports.push(report.clone());
+        }
+      }
+
+      // For each participant, grab their median
+      let mut medians = vec![];
+      for p in 0 .. self.spec.validators().len() {
+        let mut median_calc = vec![];
+        for report in &all_reports {
+          median_calc.push(report[p]);
+        }
+        median_calc.sort_unstable();
+        medians.push(median_calc[median_calc.len() / 2]);
+      }
+
+      // Grab the points of the last party within the best-performing threshold
+      // This is done by first expanding the point values by the amount of shares
+      let mut sorted_medians = vec![];
+      for (i, (_, shares)) in self.spec.validators().into_iter().enumerate() {
+        for _ in 0 .. shares {
+          sorted_medians.push(medians[i]);
+        }
+      }
+      // Then performing the sort
+      sorted_medians.sort_unstable();
+      let worst_points_by_party_within_threshold = sorted_medians[usize::from(self.spec.t()) - 1];
+
+      // Reduce everyone's points by this value
+      for median in &mut medians {
+        *median = median.saturating_sub(worst_points_by_party_within_threshold);
+      }
+
+      // The threshold now has the proper incentive to report this as they no longer suffer
+      // negative effects
+      //
+      // Additionally, if all validators had degraded performance, they don't all get penalized for
+      // what's likely outside their control (as it occurred universally)
+
+      // Mark everyone fatally slashed with u32::MAX
+      for (i, (validator, _)) in self.spec.validators().into_iter().enumerate() {
+        if FatallySlashed::get(self.txn, genesis, validator.to_bytes()).is_some() {
+          medians[i] = u32::MAX;
+        }
+      }
+
+      let mut report = vec![];
+      for (i, (validator, _)) in self.spec.validators().into_iter().enumerate() {
+        if medians[i] != 0 {
+          report.push((validator.to_bytes(), medians[i]));
+        }
+      }
+
+      // This does lock in the report, meaning further slash point accumulations won't be reported
+      // They still have value to be locally tracked due to local decisions made based off
+      // accumulated slash reports
+      SlashReport::set(self.txn, self.spec.set(), &report);
+
+      // Start a signing protocol for this
+      self
+        .processors
+        .send(
+          self.spec.set().network,
+          processor_messages::coordinator::CoordinatorMessage::SignSlashReport {
+            id: SubstrateSignId {
+              session: self.spec.set().session,
+              id: SubstrateSignableId::SlashReport,
+              attempt: 0,
+            },
+            report,
+          },
+        )
+        .await;
+    }
   }
 }
 

coordinator/src/tributary/transaction.rs

@@ -190,6 +190,8 @@ pub enum Transaction {
     first_signer: <Ristretto as Ciphersuite>::G,
     signature: SchnorrSignature<Ristretto>,
   },
+
+  SlashReport(Vec<u32>, Signed),
 }
 
 impl Debug for Transaction {
@@ -244,6 +246,11 @@ impl Debug for Transaction {
         .field("plan", &hex::encode(plan))
         .field("tx_hash", &hex::encode(tx_hash))
         .finish_non_exhaustive(),
+      Transaction::SlashReport(points, signed) => fmt
+        .debug_struct("Transaction::SignCompleted")
+        .field("points", points)
+        .field("signed", signed)
+        .finish(),
     }
   }
 }
@@ -413,6 +420,25 @@ impl ReadWrite for Transaction {
         Ok(Transaction::SignCompleted { plan, tx_hash, first_signer, signature })
       }
 
+      11 => {
+        let mut len = [0];
+        reader.read_exact(&mut len)?;
+        let len = len[0];
+        // If the set has as many validators as MAX_KEY_SHARES_PER_SET, then the amount of distinct
+        // validators (the amount of validators reported on) will be at most
+        // `MAX_KEY_SHARES_PER_SET - 1`
+        if u32::from(len) > (serai_client::validator_sets::primitives::MAX_KEY_SHARES_PER_SET - 1) {
+          Err(io::Error::other("more points reported than allowed validator"))?;
+        }
+        let mut points = vec![0u32; len.into()];
+        for points in &mut points {
+          let mut these_points = [0; 4];
+          reader.read_exact(&mut these_points)?;
+          *points = u32::from_le_bytes(these_points);
+        }
+        Ok(Transaction::SlashReport(points, Signed::read_without_nonce(reader, 0)?))
+      }
+
       _ => Err(io::Error::other("invalid transaction type")),
     }
   }
@@ -529,6 +555,14 @@ impl ReadWrite for Transaction {
         writer.write_all(&first_signer.to_bytes())?;
         signature.write(writer)
       }
+      Transaction::SlashReport(points, signed) => {
+        writer.write_all(&[11])?;
+        writer.write_all(&[u8::try_from(points.len()).unwrap()])?;
+        for points in points {
+          writer.write_all(&points.to_le_bytes())?;
+        }
+        signed.write_without_nonce(writer)
+      }
     }
   }
 }
@@ -559,6 +593,10 @@ impl TransactionTrait for Transaction {
         TransactionKind::Signed((b"sign", data.plan, data.attempt).encode(), &data.signed)
       }
       Transaction::SignCompleted { .. } => TransactionKind::Unsigned,
+
+      Transaction::SlashReport(_, signed) => {
+        TransactionKind::Signed(b"slash_report".to_vec(), signed)
+      }
     }
   }
 
@@ -622,10 +660,13 @@ impl Transaction {
         Transaction::Sign(data) => data.label.nonce(),
 
         Transaction::SignCompleted { .. } => panic!("signing SignCompleted"),
+
+        Transaction::SlashReport(_, _) => 0,
       };
 
       (
         nonce,
+        #[allow(clippy::match_same_arms)]
         match tx {
           Transaction::RemoveParticipantDueToDkg { ref mut signed, .. } |
           Transaction::DkgCommitments { ref mut signed, .. } |
@@ -642,6 +683,8 @@ impl Transaction {
           Transaction::Sign(ref mut data) => &mut data.signed,
 
           Transaction::SignCompleted { .. } => panic!("signing SignCompleted"),
+
+          Transaction::SlashReport(_, ref mut signed) => signed,
         },
       )
     }