fix(lib/grandpa): on verifying block justification, compare given block hash with finalised hash

lib/blocktree/blocktree.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/ChainSafe/gossamer/dot/types"
+
 	"github.com/ChainSafe/gossamer/lib/common"
 	"github.com/disiqueira/gotree"
 	"github.com/prometheus/client_golang/prometheus"
@@ -513,7 +514,7 @@ func (bt *BlockTree) StoreRuntime(hash common.Hash, in Runtime) {
 func (bt *BlockTree) GetBlockRuntime(hash common.Hash) (Runtime, error) {
 	ins := bt.runtimes.get(hash)
 	if ins == nil {
-		return nil, ErrFailedToGetRuntime
+		return nil, fmt.Errorf("%w for hash %s", ErrFailedToGetRuntime, hash)
 	}
 	return ins, nil
 }

lib/grandpa/errors.go

@@ -83,6 +83,9 @@ var (
 	// ErrAuthorityNotInSet is returned when a precommit within a justification is signed by a key not in the authority set
 	ErrAuthorityNotInSet = errors.New("authority is not in set")
 
+	// errFinalisedBlocksMismatch is returned when we find another block finalised in the same set id and round
+	errFinalisedBlocksMismatch = errors.New("already have finalised block with the same setID and round")
+
 	errVoteToSignatureMismatch = errors.New("votes and authority count mismatch")
 	errVoteBlockMismatch       = errors.New("block in vote is not descendant of previously finalised block")
 	errVoteFromSelf            = errors.New("got vote from ourselves")

lib/grandpa/message_handler.go

@@ -427,7 +427,13 @@ func (s *Service) VerifyBlockJustification(hash common.Hash, justification []byt
 	}
 
 	if has {
-		return nil, fmt.Errorf("already have finalised block with setID=%d and round=%d", setID, fj.Round)
+		storedFinalisedHash, err := s.blockState.GetFinalisedHash(fj.Round, setID)
+		if err != nil {
+			return nil, fmt.Errorf("getting finalised hash: %w", err)
+		}
+		if storedFinalisedHash != hash {
+			return nil, fmt.Errorf("%w, setID=%d and round=%d", errFinalisedBlocksMismatch, setID, fj.Round)
+		}
 	}
 
 	isDescendant, err := isDescendantOfHighestFinalisedBlock(s.blockState, fj.Commit.Hash)

lib/grandpa/message_handler_integration_test.go

@@ -960,6 +960,70 @@ func TestMessageHandler_VerifyBlockJustification_invalid(t *testing.T) {
 	require.EqualError(t, err, expectedErr)
 }
 
+func TestMessageHandler_VerifyBlockJustification_ErrFinalisedBlockMismatch(t *testing.T) {
+	t.Parallel()
+
+	kr, err := keystore.NewEd25519Keyring()
+	require.NoError(t, err)
+	aliceKeyPair := kr.Alice().(*ed25519.Keypair)
+
+	auths := []types.GrandpaVoter{
+		{
+			Key: *kr.Alice().Public().(*ed25519.PublicKey),
+		},
+		{
+			Key: *kr.Bob().Public().(*ed25519.PublicKey),
+		},
+		{
+			Key: *kr.Charlie().Public().(*ed25519.PublicKey),
+		},
+	}
+
+	gs, st := newTestService(t, aliceKeyPair)
+	err = st.Grandpa.SetNextChange(auths, 1)
+	require.NoError(t, err)
+
+	body, err := types.NewBodyFromBytes([]byte{0})
+	require.NoError(t, err)
+
+	block := &types.Block{
+		Header: *testHeader,
+		Body:   *body,
+	}
+
+	err = st.Block.AddBlock(block)
+	require.NoError(t, err)
+
+	setID := uint64(0)
+	round := uint64(1)
+	number := uint32(1)
+
+	err = st.Block.SetFinalisedHash(block.Header.Hash(), round, setID)
+	require.NoError(t, err)
+
+	var testHeader2 = &types.Header{
+		ParentHash: testHeader.Hash(),
+		Number:     2,
+		Digest:     newTestDigest(),
+	}
+
+	var testHash = testHeader2.Hash()
+	block2 := &types.Block{
+		Header: *testHeader2,
+		Body:   *body,
+	}
+	err = st.Block.AddBlock(block2)
+	require.NoError(t, err)
+
+	// justification fails since there is already a block finalised in this round and set id
+	precommits := buildTestJustification(t, 18, round, setID, kr, precommit)
+	just := newJustification(round, testHash, number, precommits)
+	data, err := scale.Marshal(*just)
+	require.NoError(t, err)
+	_, err = gs.VerifyBlockJustification(testHash, data)
+	require.ErrorIs(t, err, errFinalisedBlocksMismatch)
+}
+
 func Test_getEquivocatoryVoters(t *testing.T) {
 	t.Parallel()
 

lib/grandpa/state.go

@@ -21,7 +21,8 @@ type BlockState interface {
 	IsDescendantOf(parent, child common.Hash) (bool, error)
 	LowestCommonAncestor(a, b common.Hash) (common.Hash, error)
 	HasFinalisedBlock(round, setID uint64) (bool, error)
-	GetFinalisedHeader(uint64, uint64) (*types.Header, error)
+	GetFinalisedHeader(round, setID uint64) (*types.Header, error)
+	GetFinalisedHash(round, setID uint64) (common.Hash, error)
 	SetFinalisedHash(common.Hash, uint64, uint64) error
 	BestBlockHeader() (*types.Header, error)
 	GetHighestFinalisedHeader() (*types.Header, error)