Slash reports (#523)

* report_slashes plumbing in Substrate

Notably delays the SetRetired event until it provides a slash report or the set
after it becomes the set to report its slashes.

* Add dedicated AcceptedHandover event

* Add SlashReport TX to Tributary

* Create SlashReport TXs

* Handle SlashReport TXs

* Add logic to generate a SlashReport to the coordinator

* Route SlashReportSigner into the processor

* Finish routing the SlashReport signing/TX publication

* Add serai feature to processor's serai-client

processor/src/batch_signer.rs

@@ -213,6 +213,10 @@ impl<D: Db> BatchSigner<D> {
         panic!("BatchSigner passed CosignSubstrateBlock")
       }
 
+      CoordinatorMessage::SignSlashReport { .. } => {
+        panic!("Cosigner passed SignSlashReport")
+      }
+
       CoordinatorMessage::SubstratePreprocesses { id, preprocesses } => {
         let (session, id, attempt) = self.verify_id(&id).ok()?;
 

processor/src/cosigner.rs

@@ -124,6 +124,10 @@ impl Cosigner {
         panic!("Cosigner passed CosignSubstrateBlock")
       }
 
+      CoordinatorMessage::SignSlashReport { .. } => {
+        panic!("Cosigner passed SignSlashReport")
+      }
+
       CoordinatorMessage::SubstratePreprocesses { id, preprocesses } => {
         assert_eq!(id.session, self.session);
         let SubstrateSignableId::CosigningSubstrateBlock(block) = id.id else {

processor/src/main.rs

@@ -55,6 +55,9 @@ use cosigner::Cosigner;
 mod batch_signer;
 use batch_signer::BatchSigner;
 
+mod slash_report_signer;
+use slash_report_signer::SlashReportSigner;
+
 mod multisigs;
 use multisigs::{MultisigEvent, MultisigManager};
 
@@ -101,6 +104,7 @@ struct TributaryMutable<N: Network, D: Db> {
 
   // Solely mutated by the tributary.
   cosigner: Option<Cosigner>,
+  slash_report_signer: Option<SlashReportSigner>,
 }
 
 // Items which are mutably borrowed by Substrate.
@@ -233,59 +237,86 @@ async fn handle_coordinator_msg<D: Db, N: Network, Co: Coordinator>(
       }
     }
 
-    CoordinatorMessage::Coordinator(msg) => {
-      let is_batch = match msg {
-        CoordinatorCoordinatorMessage::CosignSubstrateBlock { .. } => false,
-        CoordinatorCoordinatorMessage::SubstratePreprocesses { ref id, .. } |
-        CoordinatorCoordinatorMessage::SubstrateShares { ref id, .. } => {
-          matches!(&id.id, SubstrateSignableId::Batch(_))
-        }
-        CoordinatorCoordinatorMessage::BatchReattempt { .. } => true,
-      };
-      if is_batch {
-        if let Some(msg) = tributary_mutable
-          .batch_signer
-          .as_mut()
-          .expect(
-            "coordinator told us to sign a batch when we don't currently have a Substrate signer",
-          )
-          .handle(txn, msg)
+    CoordinatorMessage::Coordinator(msg) => match msg {
+      CoordinatorCoordinatorMessage::CosignSubstrateBlock { id, block_number } => {
+        let SubstrateSignableId::CosigningSubstrateBlock(block) = id.id else {
+          panic!("CosignSubstrateBlock id didn't have a CosigningSubstrateBlock")
+        };
+        let Some(keys) = tributary_mutable.key_gen.substrate_keys_by_session(id.session) else {
+          panic!("didn't have key shares for the key we were told to cosign with");
+        };
+        if let Some((cosigner, msg)) =
+          Cosigner::new(txn, id.session, keys, block_number, block, id.attempt)
         {
+          tributary_mutable.cosigner = Some(cosigner);
           coordinator.send(msg).await;
+        } else {
+          log::warn!("Cosigner::new returned None");
         }
-      } else {
-        match msg {
-          CoordinatorCoordinatorMessage::CosignSubstrateBlock { id, block_number } => {
-            let SubstrateSignableId::CosigningSubstrateBlock(block) = id.id else {
-              panic!("CosignSubstrateBlock id didn't have a CosigningSubstrateBlock")
-            };
-            let Some(keys) = tributary_mutable.key_gen.substrate_keys_by_session(id.session) else {
-              panic!("didn't have key shares for the key we were told to cosign with");
-            };
-            if let Some((cosigner, msg)) =
-              Cosigner::new(txn, id.session, keys, block_number, block, id.attempt)
-            {
-              tributary_mutable.cosigner = Some(cosigner);
+      }
+      CoordinatorCoordinatorMessage::SignSlashReport { id, report } => {
+        assert_eq!(id.id, SubstrateSignableId::SlashReport);
+        let Some(keys) = tributary_mutable.key_gen.substrate_keys_by_session(id.session) else {
+          panic!("didn't have key shares for the key we were told to perform a slash report with");
+        };
+        if let Some((slash_report_signer, msg)) =
+          SlashReportSigner::new(txn, N::NETWORK, id.session, keys, report, id.attempt)
+        {
+          tributary_mutable.slash_report_signer = Some(slash_report_signer);
+          coordinator.send(msg).await;
+        } else {
+          log::warn!("SlashReportSigner::new returned None");
+        }
+      }
+      _ => {
+        let (is_cosign, is_batch, is_slash_report) = match msg {
+          CoordinatorCoordinatorMessage::CosignSubstrateBlock { .. } |
+          CoordinatorCoordinatorMessage::SignSlashReport { .. } => (false, false, false),
+          CoordinatorCoordinatorMessage::SubstratePreprocesses { ref id, .. } |
+          CoordinatorCoordinatorMessage::SubstrateShares { ref id, .. } => (
+            matches!(&id.id, SubstrateSignableId::CosigningSubstrateBlock(_)),
+            matches!(&id.id, SubstrateSignableId::Batch(_)),
+            matches!(&id.id, SubstrateSignableId::SlashReport),
+          ),
+          CoordinatorCoordinatorMessage::BatchReattempt { .. } => (false, true, false),
+        };
+
+        if is_cosign {
+          if let Some(cosigner) = tributary_mutable.cosigner.as_mut() {
+            if let Some(msg) = cosigner.handle(txn, msg) {
               coordinator.send(msg).await;
-            } else {
-              log::warn!("Cosigner::new returned None");
             }
+          } else {
+            log::warn!(
+              "received message for cosigner yet didn't have a cosigner. {}",
+              "this is an error if we didn't reboot",
+            );
           }
-          _ => {
-            if let Some(cosigner) = tributary_mutable.cosigner.as_mut() {
-              if let Some(msg) = cosigner.handle(txn, msg) {
-                coordinator.send(msg).await;
-              }
-            } else {
-              log::warn!(
-                "received message for cosigner yet didn't have a cosigner. {}",
-                "this is an error if we didn't reboot",
-              );
+        } else if is_batch {
+          if let Some(msg) = tributary_mutable
+            .batch_signer
+            .as_mut()
+            .expect(
+              "coordinator told us to sign a batch when we don't currently have a Substrate signer",
+            )
+            .handle(txn, msg)
+          {
+            coordinator.send(msg).await;
+          }
+        } else if is_slash_report {
+          if let Some(slash_report_signer) = tributary_mutable.slash_report_signer.as_mut() {
+            if let Some(msg) = slash_report_signer.handle(txn, msg) {
+              coordinator.send(msg).await;
             }
+          } else {
+            log::warn!(
+              "received message for slash report signer yet didn't have {}",
+              "a slash report signer. this is an error if we didn't reboot",
+            );
           }
         }
       }
-    }
+    },
 
     CoordinatorMessage::Substrate(msg) => {
       match msg {
@@ -540,7 +571,7 @@ async fn boot<N: Network, D: Db, Co: Coordinator>(
 
   (
     raw_db.clone(),
-    TributaryMutable { key_gen, batch_signer, cosigner: None, signers },
+    TributaryMutable { key_gen, batch_signer, cosigner: None, slash_report_signer: None, signers },
     multisig_manager,
   )
 }

processor/src/slash_report_signer.rs

@@ -0,0 +1,293 @@
+use core::fmt;
+use std::collections::HashMap;
+
+use rand_core::OsRng;
+
+use frost::{
+  curve::Ristretto,
+  ThresholdKeys, FrostError,
+  algorithm::Algorithm,
+  sign::{
+    Writable, PreprocessMachine, SignMachine, SignatureMachine, AlgorithmMachine,
+    AlgorithmSignMachine, AlgorithmSignatureMachine,
+  },
+};
+use frost_schnorrkel::Schnorrkel;
+
+use log::{info, warn};
+
+use serai_client::{
+  Public,
+  primitives::NetworkId,
+  validator_sets::primitives::{Session, ValidatorSet, report_slashes_message},
+};
+
+use messages::coordinator::*;
+use crate::{Get, DbTxn, create_db};
+
+create_db! {
+  SlashReportSignerDb {
+    Completed: (session: Session) -> (),
+    Attempt: (session: Session, attempt: u32) -> (),
+  }
+}
+
+type Preprocess = <AlgorithmMachine<Ristretto, Schnorrkel> as PreprocessMachine>::Preprocess;
+type SignatureShare = <AlgorithmSignMachine<Ristretto, Schnorrkel> as SignMachine<
+  <Schnorrkel as Algorithm<Ristretto>>::Signature,
+>>::SignatureShare;
+
+pub struct SlashReportSigner {
+  network: NetworkId,
+  session: Session,
+  keys: Vec<ThresholdKeys<Ristretto>>,
+  report: Vec<([u8; 32], u32)>,
+
+  attempt: u32,
+  #[allow(clippy::type_complexity)]
+  preprocessing: Option<(Vec<AlgorithmSignMachine<Ristretto, Schnorrkel>>, Vec<Preprocess>)>,
+  #[allow(clippy::type_complexity)]
+  signing: Option<(AlgorithmSignatureMachine<Ristretto, Schnorrkel>, Vec<SignatureShare>)>,
+}
+
+impl fmt::Debug for SlashReportSigner {
+  fn fmt(&self, fmt: &mut fmt::Formatter<'_>) -> fmt::Result {
+    fmt
+      .debug_struct("SlashReportSigner")
+      .field("session", &self.session)
+      .field("report", &self.report)
+      .field("attempt", &self.attempt)
+      .field("preprocessing", &self.preprocessing.is_some())
+      .field("signing", &self.signing.is_some())
+      .finish_non_exhaustive()
+  }
+}
+
+impl SlashReportSigner {
+  pub fn new(
+    txn: &mut impl DbTxn,
+    network: NetworkId,
+    session: Session,
+    keys: Vec<ThresholdKeys<Ristretto>>,
+    report: Vec<([u8; 32], u32)>,
+    attempt: u32,
+  ) -> Option<(SlashReportSigner, ProcessorMessage)> {
+    assert!(!keys.is_empty());
+
+    if Completed::get(txn, session).is_some() {
+      return None;
+    }
+
+    if Attempt::get(txn, session, attempt).is_some() {
+      warn!(
+        "already attempted signing slash report for session {:?}, attempt #{}. {}",
+        session, attempt, "this is an error if we didn't reboot",
+      );
+      return None;
+    }
+    Attempt::set(txn, session, attempt, &());
+
+    info!("signing slash report for session {:?} with attempt #{}", session, attempt);
+
+    let mut machines = vec![];
+    let mut preprocesses = vec![];
+    let mut serialized_preprocesses = vec![];
+    for keys in &keys {
+      // b"substrate" is a literal from sp-core
+      let machine = AlgorithmMachine::new(Schnorrkel::new(b"substrate"), keys.clone());
+
+      let (machine, preprocess) = machine.preprocess(&mut OsRng);
+      machines.push(machine);
+      serialized_preprocesses.push(preprocess.serialize().try_into().unwrap());
+      preprocesses.push(preprocess);
+    }
+    let preprocessing = Some((machines, preprocesses));
+
+    let substrate_sign_id =
+      SubstrateSignId { session, id: SubstrateSignableId::SlashReport, attempt };
+
+    Some((
+      SlashReportSigner { network, session, keys, report, attempt, preprocessing, signing: None },
+      ProcessorMessage::SlashReportPreprocess {
+        id: substrate_sign_id,
+        preprocesses: serialized_preprocesses,
+      },
+    ))
+  }
+
+  #[must_use]
+  pub fn handle(
+    &mut self,
+    txn: &mut impl DbTxn,
+    msg: CoordinatorMessage,
+  ) -> Option<ProcessorMessage> {
+    match msg {
+      CoordinatorMessage::CosignSubstrateBlock { .. } => {
+        panic!("SlashReportSigner passed CosignSubstrateBlock")
+      }
+
+      CoordinatorMessage::SignSlashReport { .. } => {
+        panic!("SlashReportSigner passed SignSlashReport")
+      }
+
+      CoordinatorMessage::SubstratePreprocesses { id, preprocesses } => {
+        assert_eq!(id.session, self.session);
+        assert_eq!(id.id, SubstrateSignableId::SlashReport);
+        if id.attempt != self.attempt {
+          panic!("given preprocesses for a distinct attempt than SlashReportSigner is signing")
+        }
+
+        let (machines, our_preprocesses) = match self.preprocessing.take() {
+          // Either rebooted or RPC error, or some invariant
+          None => {
+            warn!("not preprocessing. this is an error if we didn't reboot");
+            return None;
+          }
+          Some(preprocess) => preprocess,
+        };
+
+        let mut parsed = HashMap::new();
+        for l in {
+          let mut keys = preprocesses.keys().copied().collect::<Vec<_>>();
+          keys.sort();
+          keys
+        } {
+          let mut preprocess_ref = preprocesses.get(&l).unwrap().as_slice();
+          let Ok(res) = machines[0].read_preprocess(&mut preprocess_ref) else {
+            return Some(ProcessorMessage::InvalidParticipant { id, participant: l });
+          };
+          if !preprocess_ref.is_empty() {
+            return Some(ProcessorMessage::InvalidParticipant { id, participant: l });
+          }
+          parsed.insert(l, res);
+        }
+        let preprocesses = parsed;
+
+        // Only keep a single machine as we only need one to get the signature
+        let mut signature_machine = None;
+        let mut shares = vec![];
+        let mut serialized_shares = vec![];
+        for (m, machine) in machines.into_iter().enumerate() {
+          let mut preprocesses = preprocesses.clone();
+          for (i, our_preprocess) in our_preprocesses.clone().into_iter().enumerate() {
+            if i != m {
+              assert!(preprocesses.insert(self.keys[i].params().i(), our_preprocess).is_none());
+            }
+          }
+
+          let (machine, share) = match machine.sign(
+            preprocesses,
+            &report_slashes_message(
+              &ValidatorSet { network: self.network, session: self.session },
+              &self
+                .report
+                .clone()
+                .into_iter()
+                .map(|(validator, points)| (Public(validator), points))
+                .collect::<Vec<_>>(),
+            ),
+          ) {
+            Ok(res) => res,
+            Err(e) => match e {
+              FrostError::InternalError(_) |
+              FrostError::InvalidParticipant(_, _) |
+              FrostError::InvalidSigningSet(_) |
+              FrostError::InvalidParticipantQuantity(_, _) |
+              FrostError::DuplicatedParticipant(_) |
+              FrostError::MissingParticipant(_) => unreachable!(),
+
+              FrostError::InvalidPreprocess(l) | FrostError::InvalidShare(l) => {
+                return Some(ProcessorMessage::InvalidParticipant { id, participant: l })
+              }
+            },
+          };
+          if m == 0 {
+            signature_machine = Some(machine);
+          }
+
+          let mut share_bytes = [0; 32];
+          share_bytes.copy_from_slice(&share.serialize());
+          serialized_shares.push(share_bytes);
+
+          shares.push(share);
+        }
+        self.signing = Some((signature_machine.unwrap(), shares));
+
+        // Broadcast our shares
+        Some(ProcessorMessage::SubstrateShare { id, shares: serialized_shares })
+      }
+
+      CoordinatorMessage::SubstrateShares { id, shares } => {
+        assert_eq!(id.session, self.session);
+        assert_eq!(id.id, SubstrateSignableId::SlashReport);
+        if id.attempt != self.attempt {
+          panic!("given preprocesses for a distinct attempt than SlashReportSigner is signing")
+        }
+
+        let (machine, our_shares) = match self.signing.take() {
+          // Rebooted, RPC error, or some invariant
+          None => {
+            // If preprocessing has this ID, it means we were never sent the preprocess by the
+            // coordinator
+            if self.preprocessing.is_some() {
+              panic!("never preprocessed yet signing?");
+            }
+
+            warn!("not preprocessing. this is an error if we didn't reboot");
+            return None;
+          }
+          Some(signing) => signing,
+        };
+
+        let mut parsed = HashMap::new();
+        for l in {
+          let mut keys = shares.keys().copied().collect::<Vec<_>>();
+          keys.sort();
+          keys
+        } {
+          let mut share_ref = shares.get(&l).unwrap().as_slice();
+          let Ok(res) = machine.read_share(&mut share_ref) else {
+            return Some(ProcessorMessage::InvalidParticipant { id, participant: l });
+          };
+          if !share_ref.is_empty() {
+            return Some(ProcessorMessage::InvalidParticipant { id, participant: l });
+          }
+          parsed.insert(l, res);
+        }
+        let mut shares = parsed;
+
+        for (i, our_share) in our_shares.into_iter().enumerate().skip(1) {
+          assert!(shares.insert(self.keys[i].params().i(), our_share).is_none());
+        }
+
+        let sig = match machine.complete(shares) {
+          Ok(res) => res,
+          Err(e) => match e {
+            FrostError::InternalError(_) |
+            FrostError::InvalidParticipant(_, _) |
+            FrostError::InvalidSigningSet(_) |
+            FrostError::InvalidParticipantQuantity(_, _) |
+            FrostError::DuplicatedParticipant(_) |
+            FrostError::MissingParticipant(_) => unreachable!(),
+
+            FrostError::InvalidPreprocess(l) | FrostError::InvalidShare(l) => {
+              return Some(ProcessorMessage::InvalidParticipant { id, participant: l })
+            }
+          },
+        };
+
+        info!("signed slash report for session {:?} with attempt #{}", self.session, id.attempt);
+
+        Completed::set(txn, self.session, &());
+
+        Some(ProcessorMessage::SignedSlashReport {
+          session: self.session,
+          signature: sig.to_bytes().to_vec(),
+        })
+      }
+      CoordinatorMessage::BatchReattempt { .. } => {
+        panic!("BatchReattempt passed to SlashReportSigner")
+      }
+    }
+  }
+}