Add a cosigning protocol to ensure finalizations are unique (#433)

* Add a function to deterministically decide which Serai blocks should be co-signed

Has a 5 minute latency between co-signs, also used as the maximal latency
before a co-sign is started.

* Get all active tributaries we're in at a specific block

* Add and route CosignSubstrateBlock, a new provided TX

* Split queued cosigns per network

* Rename BatchSignId to SubstrateSignId

* Add SubstrateSignableId, a meta-type for either Batch or Block, and modularize around it

* Handle the CosignSubstrateBlock provided TX

* Revert substrate_signer.rs to develop (and patch to still work)

Due to SubstrateSigner moving when the prior multisig closes, yet cosigning
occurring with the most recent key, a single SubstrateSigner can be reused.
We could manage multiple SubstrateSigners, yet considering the much lower
specifications for cosigning, I'd rather treat it distinctly.

* Route cosigning through the processor

* Add note to rename SubstrateSigner post-PR

I don't want to do so now in order to preserve the diff's clarity.

* Implement cosign evaluation into the coordinator

* Get tests to compile

* Bug fixes, mark blocks without cosigners available as cosigned

* Correct the ID Batch preprocesses are saved under, add log statements

* Create a dedicated function to handle cosigns

* Correct the flow around Batch verification/queueing

Verifying `Batch`s could stall when a `Batch` was signed before its
predecessors/before the block it's contained in was cosigned (the latter being
inevitable as we can't sign a block containing a signed batch before signing
the batch).

Now, Batch verification happens on a distinct async task in order to not block
the handling of processor messages. This task is the sole caller of verify in
order to ensure last_verified_batch isn't unexpectedly mutated.

When the processor message handler needs to access it, or needs to queue a
Batch, it associates the DB TXN with a lock preventing the other task from
doing so.

This lock, as currently implemented, is a poor and inefficient design. It
should be modified to the pattern used for cosign management. Additionally, a
new primitive of a DB-backed channel may be immensely valuable.

Fixes a standing potential deadlock and a deadlock introduced with the
cosigning protocol.

* Working full-stack tests

After the last commit, this only required extending a timeout.

* Replace "co-sign" with "cosign" to make finding text easier

* Update the coordinator tests to support cosigning

* Inline prior_batch calculation to prevent panic on rotation

Noticed when doing a final review of the branch.

coordinator/src/p2p.rs

@@ -8,6 +8,9 @@ use std::{
 
 use async_trait::async_trait;
 
+use scale::{Encode, Decode};
+use serai_client::primitives::NetworkId;
+
 use serai_db::Db;
 
 use tokio::{
@@ -37,12 +40,20 @@ use crate::{Transaction, Block, Tributary, ActiveTributary, TributaryEvent};
 // TODO: Use distinct topics
 const LIBP2P_TOPIC: &str = "serai-coordinator";
 
+#[derive(Clone, Copy, PartialEq, Eq, Hash, Debug, Encode, Decode)]
+pub struct CosignedBlock {
+  pub network: NetworkId,
+  pub block: [u8; 32],
+  pub signature: [u8; 64],
+}
+
 #[derive(Clone, Copy, PartialEq, Eq, Hash, Debug)]
 pub enum P2pMessageKind {
   KeepAlive,
   Tributary([u8; 32]),
   Heartbeat([u8; 32]),
   Block([u8; 32]),
+  CosignedBlock,
 }
 
 impl P2pMessageKind {
@@ -64,6 +75,9 @@ impl P2pMessageKind {
         res.extend(genesis);
         res
       }
+      P2pMessageKind::CosignedBlock => {
+        vec![4]
+      }
     }
   }
 
@@ -87,6 +101,7 @@ impl P2pMessageKind {
         reader.read_exact(&mut genesis).ok()?;
         P2pMessageKind::Block(genesis)
       }),
+      4 => Some(P2pMessageKind::CosignedBlock),
       _ => None,
     }
   }
@@ -122,6 +137,7 @@ pub trait P2p: Send + Sync + Clone + fmt::Debug + TributaryP2p {
         P2pMessageKind::Tributary(genesis) => format!("Tributary({})", hex::encode(genesis)),
         P2pMessageKind::Heartbeat(genesis) => format!("Heartbeat({})", hex::encode(genesis)),
         P2pMessageKind::Block(genesis) => format!("Block({})", hex::encode(genesis)),
+        P2pMessageKind::CosignedBlock => "CosignedBlock".to_string(),
       }
     );
     self.broadcast_raw(actual_msg).await;
@@ -148,6 +164,7 @@ pub trait P2p: Send + Sync + Clone + fmt::Debug + TributaryP2p {
         P2pMessageKind::Tributary(genesis) => format!("Tributary({})", hex::encode(genesis)),
         P2pMessageKind::Heartbeat(genesis) => format!("Heartbeat({})", hex::encode(genesis)),
         P2pMessageKind::Block(genesis) => format!("Block({})", hex::encode(genesis)),
+        P2pMessageKind::CosignedBlock => "CosignedBlock".to_string(),
       }
     );
     Message { sender, kind, msg }
@@ -433,6 +450,7 @@ pub async fn heartbeat_tributaries_task<D: Db, P: P2p>(
 
 pub async fn handle_p2p_task<D: Db, P: P2p>(
   p2p: P,
+  cosign_channel: mpsc::UnboundedSender<CosignedBlock>,
   mut tributary_event: broadcast::Receiver<TributaryEvent<D, P>>,
 ) {
   let channels = Arc::new(RwLock::new(HashMap::<_, mpsc::UnboundedSender<Message<P>>>::new()));
@@ -562,6 +580,8 @@ pub async fn handle_p2p_task<D: Db, P: P2p>(
                         res
                       );
                     }
+
+                    P2pMessageKind::CosignedBlock => unreachable!(),
                   }
                 }
               }
@@ -596,6 +616,14 @@ pub async fn handle_p2p_task<D: Db, P: P2p>(
           channel.send(msg).unwrap();
         }
       }
+      P2pMessageKind::CosignedBlock => {
+        let mut msg_ref: &[u8] = msg.msg.as_ref();
+        let Ok(msg) = CosignedBlock::decode(&mut scale::IoReader(&mut msg_ref)) else {
+          log::error!("received CosignedBlock message with invalidly serialized contents");
+          continue;
+        };
+        cosign_channel.send(msg).unwrap();
+      }
     }
   }
 }