Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(slashing-protection): limit min-max surround epoch lookback to 4096 #5454

Merged
merged 1 commit into from
May 3, 2023
Merged

fix(slashing-protection): limit min-max surround epoch lookback to 4096 #5454

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion packages/validator/src/slashingProtection/minMaxSurround/minMaxSurround.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,29 @@ import {SurroundAttestationError, SurroundAttestationErrorCode} from "./errors.j
// surround vote checking with min-max surround
// https://github.com/protolambda/eth2-surround#min-max-surround

/**
* Number of epochs in the past to check for surrounding attestations.
*
* This value can be limited to a reasonable high amount as Lodestar does not solely rely on this strategy but also
* implements the minimal strategy which has been formally proven to be safe (https://github.com/michaelsproul/slashing-proofs).
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minimal strategy refers to conditions 4 and 5 from EIP-3076 and is implemented in Lodestar

lodestar/packages/validator/src/slashingProtection/attestation/index.ts

Lines 99 to 121 in 3ed8d04

// Refuse to sign any attestation with:
// - source.epoch < min(att.source_epoch for att in data.signed_attestations if att.pubkey == attester_pubkey), OR
// - target_epoch <= min(att.target_epoch for att in data.signed_attestations if att.pubkey == attester_pubkey)
// (spec v4, Slashing Protection Database Interchange Format)
const attestationLowerBound = await this.attestationLowerBound.get(pubKey);
if (attestationLowerBound) {
const {minSourceEpoch, minTargetEpoch} = attestationLowerBound;
if (attestation.sourceEpoch < minSourceEpoch) {
throw new InvalidAttestationError({
code: InvalidAttestationErrorCode.SOURCE_LESS_THAN_LOWER_BOUND,
sourceEpoch: attestation.sourceEpoch,
minSourceEpoch,
});
}
if (attestation.targetEpoch <= minTargetEpoch) {
throw new InvalidAttestationError({
code: InvalidAttestationErrorCode.TARGET_LESS_THAN_OR_EQ_LOWER_BOUND,
targetEpoch: attestation.targetEpoch,
minTargetEpoch,
});
}
}

*
* Limiting this value is required due to practical reasons as otherwise there would be a min-span DB read and write
* for each validator from current epoch until genesis which massively increases DB size and causes I/O lag, resulting in
* instability on first startup with an empty DB. See https://github.com/ChainSafe/lodestar/issues/5356 for more details.
*
* The value 4096 has been chosen as it is the default used by slashers (https://lighthouse-book.sigmaprime.io/slasher.html#history-length)
* and is generally higher than the weak subjectivity period. However, it would still be risky if we just relied on min-max surround
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right now, the weak subjectivity period for goerli is 3686 epochs and for mainnet 3442 epochs.

* for slashing protection, as slashers can be configured to collect slashable attestations over a longer period.
*/
const DEFAULT_MAX_EPOCH_LOOKBACK = 4096;

export class MinMaxSurround implements IMinMaxSurround {
private store: IDistanceStore;
private maxEpochLookback: number;

constructor(store: IDistanceStore, options?: {maxEpochLookback?: number}) {
this.store = store;
this.maxEpochLookback = options?.maxEpochLookback ?? Infinity;
this.maxEpochLookback = options?.maxEpochLookback ?? DEFAULT_MAX_EPOCH_LOOKBACK;
}

async assertNoSurround(pubKey: BLSPubkey, attestation: MinMaxSurroundAttestation): Promise<void> {
Expand Down