Secp256k1 signature verification (BandChain)

[greg-szabo]

Crate

relayer
relayer-cli

Summary of Bug

hermes seems to be incompatible with chains that use tendermint/PubKeySecp256k1 keys.

Version

commit ID: 3da7dc12c060271176c8a8870aa399a8eea64820
(master as of opening the issue)

Steps to Reproduce

1. Add the secp256k1 feature to the tendermint dependency in relayer-cli/Cargo.toml
2. Build (cargo build --release)
3. Set up two chains (for example gaiad and band testnets)
4. Add keys to hermes (gm hermes keys)

Run create channel ("/opt/bin/hermes_3da7dc12c060271176c8a8870aa399a8eea64820_secp" create channel ibc-0 ibc-8 --port-a transfer --port-b transfer)

Result (see the warning messages with "received corrupt message" and the final error message):

Jul 06 15:47:26.211  INFO using default configuration from '/root/.hermes/config.toml'
Jul 06 15:47:26.228  WARN Hermes health check failed for service tendermint::ServiceClient on the gRPC interface of chain ibc-0:https://localhost:27002/; caused by: transport error: error trying to connect: received corrupt message
Jul 06 15:47:26.229  WARN some Hermes features may not work in this mode!
Jul 06 15:47:26.230 TRACE subscribing to query: tm.event = 'Tx' chain.id=ibc-0
Jul 06 15:47:26.231 TRACE subscribing to query: tm.event = 'NewBlock' chain.id=ibc-0
Jul 06 15:47:26.232 TRACE subscribed to all queries chain.id=ibc-0
Jul 06 15:47:26.233 DEBUG starting event monitor chain.id=ibc-0
Jul 06 15:47:26.237  WARN Hermes health check failed for service tendermint::ServiceClient on the gRPC interface of chain ibc-8:https://localhost:27082/; caused by: transport error: error trying to connect: received corrupt message
Jul 06 15:47:26.237  WARN some Hermes features may not work in this mode!
Jul 06 15:47:26.239 TRACE subscribing to query: tm.event = 'Tx' chain.id=ibc-8
Jul 06 15:47:26.239 TRACE subscribing to query: tm.event = 'NewBlock' chain.id=ibc-8
Jul 06 15:47:26.240 TRACE subscribed to all queries chain.id=ibc-8
Jul 06 15:47:26.241  INFO Creating new clients, new connection, and a new channel with order ORDER_UNORDERED
Jul 06 15:47:26.241 DEBUG starting event monitor chain.id=ibc-8
Jul 06 15:47:26.251 ERROR [ibc-8 -> ibc-0:07-tendermint-0]  failed CreateClient: error raised while creating client: failed while building client state from src chain (ibc-8) with error: GRPC error: transport error: error trying to connect: received corrupt message
Error: error raised while creating client: Create client failed (ClientCreate("failed while building client state from src chain (ibc-8) with error: GRPC error: transport error: error trying to connect: received corrupt message"))

ALTERNATIVELY, you can just start the hermes relayer and get:
("/opt/bin/hermes_3da7dc12c060271176c8a8870aa399a8eea64820_secp" start)

Jul 06 15:49:10.051  INFO using default configuration from '/root/.hermes/config.toml'
Jul 06 15:49:10.052  INFO telemetry service running, exposing metrics at 127.0.0.1:3001/metrics
Jul 06 15:49:10.054  INFO Hermes has started
Jul 06 15:49:10.081  WARN Hermes health check failed for service tendermint::ServiceClient on the gRPC interface of chain ibc-0:https://localhost:27002/; caused by: transport error: error trying to connect: received corrupt message
Jul 06 15:49:10.081  WARN some Hermes features may not work in this mode!
Jul 06 15:49:10.083 TRACE subscribing to query: tm.event = 'Tx' chain.id=ibc-0
Jul 06 15:49:10.086 TRACE subscribing to query: tm.event = 'NewBlock' chain.id=ibc-0
Jul 06 15:49:10.086 TRACE subscribed to all queries chain.id=ibc-0
Jul 06 15:49:10.087 DEBUG starting event monitor chain.id=ibc-0
Jul 06 15:49:10.087 TRACE spawned chain runtime for chain identifier ibc-0
Jul 06 15:49:10.091  WARN Hermes health check failed for service tendermint::ServiceClient on the gRPC interface of chain ibc-8:https://localhost:27082/; caused by: transport error: error trying to connect: received corrupt message
Jul 06 15:49:10.091  WARN some Hermes features may not work in this mode!
Jul 06 15:49:10.093 TRACE subscribing to query: tm.event = 'Tx' chain.id=ibc-8
Jul 06 15:49:10.094 TRACE subscribing to query: tm.event = 'NewBlock' chain.id=ibc-8
Jul 06 15:49:10.094 TRACE subscribed to all queries chain.id=ibc-8
Jul 06 15:49:10.095 TRACE spawned chain runtime for chain identifier ibc-8
Jul 06 15:49:10.095 DEBUG starting event monitor chain.id=ibc-8
Jul 06 15:49:10.097 ERROR skipping workers for chain ibc-0. reason: failed to query clients with error: GRPC error: transport error: error trying to connect: received corrupt message
Jul 06 15:49:10.099 ERROR skipping workers for chain ibc-8. reason: failed to query clients with error: GRPC error: transport error: error trying to connect: received corrupt message

(These last two error messages are somewhat concerning since ibc-0 should not have GRPC issues. It is possible that the issue is with adding the secp256k1 feature in general...)

relayer-cli/Cargo.toml update example (only the last line):

[dependencies.tendermint]
version = "=0.20.0"
features = ["secp256k1"]

gm.toml for the two example chains:

[global]
  gaiad_binary = "/opt/bin/gaiad_4.2.1"
  ports_start_at = 27090
  [global.hermes]
    binary = "/opt/bin/hermes_3da7dc12c060271176c8a8870aa399a8eea64820_secp"
    log_level = "trace"
[ibc-0]
  add_to_hermes = true
  ports_start_at = 27000
[ibc-8]
  add_to_hermes = true
  gaiad_binary = "/opt/bin/bandd"
  hdpath = "m/44'/494'/0'/0/0"
  ports_start_at = 27080

.hermes/config.toml:

[global]
strategy = 'packets'
log_level = 'trace'

[telemetry]
enabled = true
host = '127.0.0.1'
port = 3001

[[chains]]
id='ibc-0'
rpc_addr='http://localhost:27000'
grpc_addr='https://localhost:27002'
websocket_addr='ws://localhost:27000/websocket'
rpc_timeout='1s'
account_prefix='cosmos'
key_name='wallet'
store_prefix='ibc'
gas_price = { price = 0.001, denom = 'stake' }
max_gas=500000
clock_drift='5s'
trusting_period='14days'

[chains.trust_threshold]
numerator='1'
denominator='3'

[[chains]]
id='ibc-8'
rpc_addr='http://localhost:27080'
grpc_addr='https://localhost:27082'
websocket_addr='ws://localhost:27080/websocket'
rpc_timeout='1s'
account_prefix='band'
key_name='wallet'
store_prefix='ibc'
gas_price = { price = 0.001, denom = 'uband' }
max_gas=500000
clock_drift='5s'
trusting_period='14days'

[chains.trust_threshold]
numerator='1'
denominator='3'

Acceptance Criteria

• chains with scp256k1 keys can be used without errors

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate milestone (priority) applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned

[lyqingye]

I also encountered this problem. My chain uses ed25519, but band chain uses secp256k1

[lyqingye]

I think this is because the tendermint publickey type of bandchain is secp256k1, but the public key of tendermint-rs[0.21.0] does not support signature verification of secp256k1.
https://github.com/informalsystems/tendermint-rs/blob/master/tendermint/src/public_key.rs#L153

[RiccardoM]

Is there any update on this? We need this as well to integrate with Band Protocol

[RiccardoM]

Update: informalsystems/tendermint-rs#962 has just been merged into master. It should be used to solve this

[lyqingye]

pretty good

[romac]

I just followed @greg-szabo's instructions using Hermes built from the branch at #1339, and I was able to create a channel between Gaia and Band, as well as relay packets between the two chains. Will mark this issue as closed when we merge 1339.

Please keep an eye on #1231 as well, as it seems we may still have issues with BandChain, ie. when its sends packets at EndBlock.