Vouch for the blocks a block refers to#6602
Closed
afck wants to merge 4 commits into
Closed
Conversation
Rename pre_checkpoint_block_trust to vouched_blocks and generalize it: whenever a block is accepted (executed or preprocessed), the hashes it commits to via previous_block_hash and previous_message_blocks are recorded as vouched, unless the referenced block is already in block_hashes. A certificate whose hash is vouched is accepted regardless of its possibly revoked epoch, and the mark is consumed on acceptance. The eager marks subsume the child-block lookup in ensure_epoch_trusted, which now only checks for an earlier acceptance of the same block. This lets a receiver re-certify a sender's old messages by downloading only the message-bearing blocks: when the oldest block collected by download_sender_block_with_sending_ancestors is from a revoked epoch, the client preprocesses the collected chain in decreasing height order first, so that each block vouches for the previous message block it commits to — instead of falling back to downloading all contiguous descendants.
A block committing to a different hash at a height where we already accepted a block is proof that a committee equivocated. Reject it with ChainError::ConflictingCertifiedBlocks before it is written to storage, and log the conflict at ERROR level: it means the network is in trouble.
Accepting a block now also vouches for the event blocks it commits to, and the sparse event-block download preprocesses newest-first when the oldest collected block's epoch has been revoked. Subscribers can therefore re-certify an old event without downloading the publisher's intermediate blocks.
Wrap the epoch-revocation lookup in a helper instead of repeating the storage call and its error mapping, and let vouch_for_block_references compute the block hash itself.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Re-certifying a revoked-epoch block by walking its descendants means downloading every block in between, even though almost none of them are needed: on a sparse chain, a receiver may care about two message blocks a thousand heights apart.
Proposal
Blocks already commit to the hashes of the blocks they refer to:
previous_message_blockspoints at the last block that sent a message to a given recipient,previous_event_blocksat the last block that emitted an event on a given stream. Treat those the same way as the parent hash: when a block is accepted, vouch for everything it commits to. A receiver can then re-certify an old sender block by downloading only the message-bearing blocks, and a subscriber only the event-bearing ones — preprocessing them newest-first, so each block vouches for the next-older one.A block that commits to a different hash than the one already accepted at that height is proof that a committee equivocated. Reject it before it is written to storage, and log the conflict at ERROR level.
Test Plan
CI, plus unit tests that re-certify a revoked-epoch block through a
previous_message_blockslink and through aprevious_event_blockslink, asserting in both cases that the blocks in between are never downloaded. Conflicting certified blocks are covered by a worker test.Release Plan
Links