blockchain: separate proposal and finalized header validation - #1039
Draft
2dvorak wants to merge 2 commits into
Draft
blockchain: separate proposal and finalized header validation#10392dvorak wants to merge 2 commits into
2dvorak wants to merge 2 commits into
Conversation
verifySeals required the header author to equal the final round's proposer once permissionless is active. A locked proposal is re-proposed verbatim in later rounds, so its author seal stays with the proposer that built it while sendPreprepare stamps the current round into the header. The round byte sits in the vanity that SigHash and HeaderHash zero out, so that rewrite leaves both the author seal and the block hash intact, which is also why the lock still matches. A block that survived a round change therefore commits with an author the final round's schedule does not name, and every node refuses it on import. The live path never noticed: a proposal carries no committed seals, so verifySeals returns ErrEmptyCommittedSeals before the check and Verify ignores that error. Since the round-change timeout grows by 2^round seconds, the height cannot proceed until the original proposer's turn comes around again. Require the author to be a member of the round's committee instead. That is the one constraint the committed seals do not already carry: the block hash covers the proposer seal, so 2f+1 seals bind the author, and header.Round integrity comes from the round-bound committed-seal preimage. Pre-permissionless has always checked membership, so both branches now agree. Constraint: a locked proposal is re-proposed verbatim, so the header pairs the final round with an earlier round's author seal Rejected: accept any author whose address appears as the proposer of rounds 0..R | R+1 proposer lookups on a peer-supplied round, and it forbids nothing the committee check allows Rejected: drop the author check outright | leaves the header author unconstrained for the first time, and GetRewardAddress then returns empty for an unstaked author, which skips Rewardbase validation Confidence: high Scope-risk: narrow Directive: the membership check must precede countValidCommittedSeals, which consumes committeeSet Not-tested: a round change driven end to end through the live consensus core Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Header validation had one entry point for two callers with different inputs: the import path passes a finalized header, the consensus path a proposal, which carries no committed seals yet. The seal checks therefore had to be tolerated rather than skipped, and the author check sat behind them. Give the callers their own entry points: ValidateHeader - finalized header, all rules ValidateProposalHeader - proposal, all rules except the committed-seal ones Both share validateHeader(header, parent, withSeals). Author authorization runs either way and moves into authorizeAuthor(), which also returns the set the committed seals are counted against so both use the same one. backend.Verify calls ValidateProposalHeader and no longer tolerates ErrEmptyCommittedSeals. Proposal validation no longer inspects committed seals at all; any present in a proposal are ignored. Commit overwrites them and HeaderHash excludes them, so they cannot affect the block identity that was voted on.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
ValidateHeader(all rules) andValidateProposalHeader(all rules except the committed-seal ones).backend.Verifyuses the proposal entry point and no longer toleratesErrEmptyCommittedSeals.Depends on 1022, will be rebased after merge.
Types of changes
Checklist
I have read the CLA Document and I hereby sign the CLAin first time contribute after having read CLA$ make test)Related issues
Further comments