diff --git a/Cargo.lock b/Cargo.lock index c552efe513a7..782ee2be40f0 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -6831,6 +6831,7 @@ dependencies = [ name = "polkadot-runtime-parachains" version = "0.9.8" dependencies = [ + "bitflags", "bitvec", "derive_more", "frame-benchmarking", diff --git a/primitives/src/v1/mod.rs b/primitives/src/v1/mod.rs index 0d9f429d469a..ed082707a8b0 100644 --- a/primitives/src/v1/mod.rs +++ b/primitives/src/v1/mod.rs @@ -1186,7 +1186,7 @@ pub struct DisputeStatementSet { pub type MultiDisputeStatementSet = Vec; /// The entire state of a dispute. -#[derive(Encode, Decode, Clone, RuntimeDebug)] +#[derive(Encode, Decode, Clone, RuntimeDebug, PartialEq)] pub struct DisputeState { /// A bitfield indicating all validators for the candidate. pub validators_for: BitVec, // one bit per validator. diff --git a/roadmap/implementers-guide/src/runtime/disputes.md b/roadmap/implementers-guide/src/runtime/disputes.md index 4faece7cb092..79015e4a740f 100644 --- a/roadmap/implementers-guide/src/runtime/disputes.md +++ b/roadmap/implementers-guide/src/runtime/disputes.md @@ -6,7 +6,7 @@ However, this isn't the end of the story. We are working in a forkful blockchain 1. For security, validators that misbehave shouldn't only be slashed on one fork, but on all possible forks. Validators that misbehave shouldn't be able to create a new fork of the chain when caught and get away with their misbehavior. 1. It is possible (and likely) that the parablock being contested has not appeared on all forks. -1. If a block author believes that there is a disputed parablock on a specific fork that will resolve to a reversion of the fork, that block author is better incentivized to build on a different fork which does not include that parablock. +1. If a block author believes that there is a disputed parablock on a specific fork that will resolve to a reversion of the fork, that block author has more incentive to build on a different fork which does not include that parablock. This means that in all likelihood, there is the possibility of disputes that are started on one fork of the relay chain, and as soon as the dispute resolution process starts to indicate that the parablock is indeed invalid, that fork of the relay chain will be abandoned and the dispute will never be fully resolved on that chain. @@ -42,11 +42,12 @@ Included: double_map (SessionIndex, CandidateHash) -> Option, // fewer than `byzantine_threshold + 1` validators. // // The i'th entry of the vector corresponds to the i'th validator in the session. -SpamSlots: map SessionIndex -> Vec, -// Whether the chain is frozen or not. Starts as `false`. When this is `true`, -// the chain will not accept any new parachain blocks for backing or inclusion. -// It can only be set back to `false` by governance intervention. -Frozen: bool, +SpamSlots: map SessionIndex -> Option>, +// Whether the chain is frozen or not. Starts as `None`. When this is `Some`, +// the chain will not accept any new parachain blocks for backing or inclusion, +// and its value indicates the last valid block number in the chain. +// It can only be set back to `None` by governance intervention. +Frozen: Option, ``` > `byzantine_threshold` refers to the maximum number `f` of validators which may be byzantine. The total number of validators is `n = 3f + e` where `e in { 1, 2, 3 }`. @@ -54,7 +55,8 @@ Frozen: bool, ## Session Change 1. If the current session is not greater than `config.dispute_period + 1`, nothing to do here. -1. Set `pruning_target = current_session - config.dispute_period - 1`. We add the extra `1` because we want to keep things for `config.dispute_period` _full_ sessions. The stuff at the end of the most recent session has been around for ~0 sessions, not ~1. +1. Set `pruning_target = current_session - config.dispute_period - 1`. We add the extra `1` because we want to keep things for `config.dispute_period` _full_ sessions. + The stuff at the end of the most recent session has been around for a little over 0 sessions, not a little over 1. 1. If `LastPrunedSession` is `None`, then set `LastPrunedSession` to `Some(pruning_target)` and return. 1. Otherwise, clear out all disputes, included candidates, and `SpamSlots` entries in the range `last_pruned..=pruning_target` and set `LastPrunedSession` to `Some(pruning_target)`. @@ -65,7 +67,6 @@ Frozen: bool, ## Routines * `provide_multi_dispute_data(MultiDisputeStatementSet) -> Vec<(SessionIndex, Hash)>`: - 1. Fail if any disputes in the set are duplicate or concluded before the `config.dispute_post_conclusion_acceptance_period` window relative to now. 1. Pass on each dispute statement set to `provide_dispute_data`, propagating failure. 1. Return a list of all candidates who just had disputes initiated. @@ -75,29 +76,30 @@ Frozen: bool, 1. If there is no dispute under `Disputes`, create a new `DisputeState` with blank bitfields. 1. If `concluded_at` is `Some`, and is `concluded_at + config.post_conclusion_acceptance_period < now`, return false. 1. If the overlap of the validators in the `DisputeStatementSet` and those already present in the `DisputeState` is fewer in number than `byzantine_threshold + 1` and the candidate is not present in the `Included` map - 1. increment `SpamSlots` for each validator in the `DisputeStatementSet` which is not already in the `DisputeState`. Initialize the `SpamSlots` to a zeroed vector first, if necessary. - 1. If the value for any spam slot exceeds `config.dispute_max_spam_slots`, return false. - 1. If the overlap of the validators in the `DisputeStatementSet` and those already present in the `DisputeState` is at least `byzantine_threshold + 1`, the `DisputeState` has fewer than `byzantine_threshold + 1` validators, and the candidate is not present in the `Included` map, decrement `SpamSlots` for each validator in the `DisputeState`. - 1. Import all statements into the dispute. This should fail if any statements are duplicate; if the corresponding bit for the corresponding validator is set in the dispute already. - 1. If `concluded_at` is `None`, reward all statements slightly less. + 1. increment `SpamSlots` for each validator in the `DisputeStatementSet` which is not already in the `DisputeState`. Initialize the `SpamSlots` to a zeroed vector first, if necessary. do not increment `SpamSlots` if the candidate is local. + 1. If the value for any spam slot exceeds `config.dispute_max_spam_slots`, return false. + 1. If the overlap of the validators in the `DisputeStatementSet` and those already present in the `DisputeState` is at least `byzantine_threshold + 1`, the `DisputeState` has fewer than `byzantine_threshold + 1` validators, and the candidate is not present in the `Included` map, then decrease `SpamSlots` by 1 for each validator in the `DisputeState`. + 1. Import all statements into the dispute. This should fail if any statements are duplicate or if the corresponding bit for the corresponding validator is set in the dispute already. + 1. If `concluded_at` is `None`, reward all statements. 1. If `concluded_at` is `Some`, reward all statements slightly less. - 1. If either side now has supermajority, slash the other side. This may be both sides, and we support this possibility in code, but note that this requires validators to participate on both sides which has negative expected value. Set `concluded_at` to `Some(now)`. + 1. If either side now has supermajority and did not previously, slash the other side. This may be both sides, and we support this possibility in code, but note that this requires validators to participate on both sides which has negative expected value. Set `concluded_at` to `Some(now)` if it was `None`. 1. If just concluded against the candidate and the `Included` map contains `(session, candidate)`: invoke `revert_and_freeze` with the stored block number. 1. Return true if just initiated, false otherwise. * `disputes() -> Vec<(SessionIndex, CandidateHash, DisputeState)>`: Get a list of all disputes and info about dispute state. - 1. Iterate over all disputes in `Disputes`. Set the flag according to `concluded`. + 1. Iterate over all disputes in `Disputes` and collect into a vector. * `note_included(SessionIndex, CandidateHash, included_in: BlockNumber)`: 1. Add `(SessionIndex, CandidateHash)` to the `Included` map with `included_in - 1` as the value. - 1. If there is a dispute under `(Sessionindex, CandidateHash)` with fewer than `byzantine_threshold + 1` participating validators, decrement `SpamSlots` for each validator in the `DisputeState`. + 1. If there is a dispute under `(Sessionindex, CandidateHash)` with fewer than `byzantine_threshold + 1` participating validators, decrease `SpamSlots` by 1 for each validator in the `DisputeState`. 1. If there is a dispute under `(SessionIndex, CandidateHash)` that has concluded against the candidate, invoke `revert_and_freeze` with the stored block number. * `could_be_invalid(SessionIndex, CandidateHash) -> bool`: Returns whether a candidate has a live dispute ongoing or a dispute which has already concluded in the negative. -* `is_frozen()`: Load the value of `Frozen` from storage. +* `is_frozen()`: Load the value of `Frozen` from storage. Return true if `Some` and false if `None`. -* `revert_and_freeze(BlockNumber): +* `last_valid_block()`: Load the value of `Frozen` from storage and return. None indicates that all blocks in the chain are potentially valid. + +* `revert_and_freeze(BlockNumber)`: 1. If `is_frozen()` return. - 1. issue a digest in the block header which indicates the chain is to be abandoned back to the stored block number. - 1. Set `Frozen` to true. + 1. Set `Frozen` to `Some(BlockNumber)` to indicate a rollback to the given block number is necessary. diff --git a/roadmap/implementers-guide/src/types/disputes.md b/roadmap/implementers-guide/src/types/disputes.md index becace642dfe..3043b7615abd 100644 --- a/roadmap/implementers-guide/src/types/disputes.md +++ b/roadmap/implementers-guide/src/types/disputes.md @@ -1,6 +1,6 @@ # Disputes -## DisputeStatementSet +## `DisputeStatementSet` ```rust /// A set of statements about a specific candidate. @@ -11,7 +11,7 @@ struct DisputeStatementSet { } ``` -## DisputeStatement +## `DisputeStatement` ```rust /// A statement about a candidate, to be used within some dispute resolution process. @@ -33,8 +33,8 @@ Kinds of dispute statements. Each of these can be combined with a candidate hash ```rust enum ValidDisputeStatementKind { Explicit, - BackingSeconded, - BackingValid, + BackingSeconded(Hash), + BackingValid(Hash), ApprovalChecking, } @@ -43,7 +43,7 @@ enum InvalidDisputeStatementKind { } ``` -## ExplicitDisputeStatement +## `ExplicitDisputeStatement` ```rust struct ExplicitDisputeStatement { @@ -53,7 +53,7 @@ struct ExplicitDisputeStatement { } ``` -## MultiDisputeStatementSet +## `MultiDisputeStatementSet` Sets of statements for many (zero or more) disputes. @@ -61,7 +61,7 @@ Sets of statements for many (zero or more) disputes. type MultiDisputeStatementSet = Vec; ``` -## DisputeState +## `DisputeState` ```rust struct DisputeState { diff --git a/runtime/kusama/src/lib.rs b/runtime/kusama/src/lib.rs index 21968806e88b..fe41607dda43 100644 --- a/runtime/kusama/src/lib.rs +++ b/runtime/kusama/src/lib.rs @@ -1092,6 +1092,7 @@ impl parachains_session_info::Config for Runtime {} impl parachains_inclusion::Config for Runtime { type Event = Event; + type DisputesHandler = (); type RewardValidators = parachains_reward_points::RewardValidatorsWithEraPoints; } diff --git a/runtime/parachains/Cargo.toml b/runtime/parachains/Cargo.toml index 1447e6b878bb..0a766af14c66 100644 --- a/runtime/parachains/Cargo.toml +++ b/runtime/parachains/Cargo.toml @@ -11,6 +11,7 @@ log = { version = "0.4.14", default-features = false } rustc-hex = { version = "2.1.0", default-features = false } serde = { version = "1.0.123", features = [ "derive" ], optional = true } derive_more = "0.99.14" +bitflags = "1" sp-api = { git = "https://github.com/paritytech/substrate", branch = "master", default-features = false } inherents = { package = "sp-inherents", git = "https://github.com/paritytech/substrate", branch = "master", default-features = false } diff --git a/runtime/parachains/src/disputes.rs b/runtime/parachains/src/disputes.rs new file mode 100644 index 000000000000..f7327ad2bd4f --- /dev/null +++ b/runtime/parachains/src/disputes.rs @@ -0,0 +1,2081 @@ +// Copyright 2021 Parity Technologies (UK) Ltd. +// This file is part of Polkadot. + +// Polkadot is free software: you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation, either version 3 of the License, or +// (at your option) any later version. + +// Polkadot is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. + +// You should have received a copy of the GNU General Public License +// along with Polkadot. If not, see . + +//! Runtime component for handling disputes of parachain candidates. + +use sp_std::prelude::*; +use primitives::v1::{ + byzantine_threshold, supermajority_threshold, ApprovalVote, CandidateHash, CompactStatement, + ConsensusLog, DisputeState, DisputeStatement, DisputeStatementSet, ExplicitDisputeStatement, + InvalidDisputeStatementKind, MultiDisputeStatementSet, SessionIndex, SigningContext, + ValidDisputeStatementKind, ValidatorId, ValidatorIndex, ValidatorSignature, +}; +use sp_runtime::{ + traits::{One, Zero, Saturating, AppVerify}, + DispatchError, RuntimeDebug, SaturatedConversion, +}; +use frame_support::{ensure, traits::Get, weights::Weight}; +use parity_scale_codec::{Encode, Decode}; +use bitvec::{bitvec, order::Lsb0 as BitOrderLsb0}; +use crate::{ + configuration::{self, HostConfiguration}, + initializer::SessionChangeNotification, + session_info, +}; + +/// Whether the dispute is local or remote. +#[derive(Encode, Decode, Clone, PartialEq, Eq, RuntimeDebug)] +pub enum DisputeLocation { + Local, + Remote, +} + +/// The result of a dispute, whether the candidate is deemed valid (for) or invalid (against). +#[derive(Encode, Decode, Clone, PartialEq, Eq, RuntimeDebug)] +pub enum DisputeResult { + Valid, + Invalid, +} + +/// Reward hooks for disputes. +pub trait RewardValidators { + // Give each validator a reward, likely small, for participating in the dispute. + fn reward_dispute_statement(session: SessionIndex, validators: impl IntoIterator); +} + +impl RewardValidators for () { + fn reward_dispute_statement(_: SessionIndex, _: impl IntoIterator) { } +} + +/// Punishment hooks for disputes. +pub trait PunishValidators { + /// Punish a series of validators who were for an invalid parablock. This is expected to be a major + /// punishment. + fn punish_for_invalid(session: SessionIndex, validators: impl IntoIterator); + + /// Punish a series of validators who were against a valid parablock. This is expected to be a minor + /// punishment. + fn punish_against_valid(session: SessionIndex, validators: impl IntoIterator); + + /// Punish a series of validators who were part of a dispute which never concluded. This is expected + /// to be a minor punishment. + fn punish_inconclusive(session: SessionIndex, validators: impl IntoIterator); +} + +impl PunishValidators for () { + fn punish_for_invalid(_: SessionIndex, _: impl IntoIterator) { + + } + + fn punish_against_valid(_: SessionIndex, _: impl IntoIterator) { + + } + + fn punish_inconclusive(_: SessionIndex, _: impl IntoIterator) { + + } +} + +/// Hook into disputes handling. +/// +/// Allows decoupling parachains handling from disputes so that it can +/// potentially be disabled when instantiating a specific runtime. +pub trait DisputesHandler { + /// Whether the chain is frozen, if the chain is frozen it will not accept + /// any new parachain blocks for backing or inclusion. + fn is_frozen() -> bool; + + /// Handler for filtering any dispute statements before including them as part + /// of inherent data. This can be useful to filter out ancient and duplicate + /// dispute statements. + fn filter_multi_dispute_data(statement_sets: &mut MultiDisputeStatementSet); + + /// Handle sets of dispute statements corresponding to 0 or more candidates. + /// Returns a vector of freshly created disputes. + fn provide_multi_dispute_data( + statement_sets: MultiDisputeStatementSet, + ) -> Result, DispatchError>; + + /// Note that the given candidate has been included. + fn note_included( + session: SessionIndex, + candidate_hash: CandidateHash, + included_in: BlockNumber, + ); + + /// Whether the given candidate could be invalid, i.e. there is an ongoing + /// or concluded dispute with supermajority-against. + fn could_be_invalid(session: SessionIndex, candidate_hash: CandidateHash) -> bool; + + /// Called by the initializer to initialize the configuration module. + fn initializer_initialize(now: BlockNumber) -> Weight; + + /// Called by the initializer to finalize the configuration module. + fn initializer_finalize(); + + /// Called by the initializer to note that a new session has started. + fn initializer_on_new_session(notification: &SessionChangeNotification); +} + +impl DisputesHandler for () { + fn is_frozen() -> bool { + false + } + + fn filter_multi_dispute_data(statement_sets: &mut MultiDisputeStatementSet) { + statement_sets.clear() + } + + fn provide_multi_dispute_data( + _statement_sets: MultiDisputeStatementSet, + ) -> Result, DispatchError> { + Ok(Vec::new()) + } + + fn note_included( + _session: SessionIndex, + _candidate_hash: CandidateHash, + _included_in: BlockNumber, + ) { + + } + + fn could_be_invalid(_session: SessionIndex, _candidate_hash: CandidateHash) -> bool { + false + } + + fn initializer_initialize(_now: BlockNumber) -> Weight { + 0 + } + + fn initializer_finalize() { + + } + + fn initializer_on_new_session(_notification: &SessionChangeNotification) { + + } +} + +impl DisputesHandler for pallet::Pallet { + fn is_frozen() -> bool { + pallet::Pallet::::is_frozen() + } + + fn filter_multi_dispute_data(statement_sets: &mut MultiDisputeStatementSet) { + // TODO: filter duplicate and ancient dispute statements. For now, don't import anything + // because there will be redundancies. + // + // https://github.com/paritytech/polkadot/issues/3472 + statement_sets.clear(); + } + + fn provide_multi_dispute_data( + statement_sets: MultiDisputeStatementSet, + ) -> Result, DispatchError> { + pallet::Pallet::::provide_multi_dispute_data(statement_sets) + } + + fn note_included( + session: SessionIndex, + candidate_hash: CandidateHash, + included_in: T::BlockNumber, + ) { + pallet::Pallet::::note_included(session, candidate_hash, included_in) + } + + fn could_be_invalid(session: SessionIndex, candidate_hash: CandidateHash) -> bool { + pallet::Pallet::::could_be_invalid(session, candidate_hash) + } + + fn initializer_initialize(now: T::BlockNumber) -> Weight { + pallet::Pallet::::initializer_initialize(now) + } + + fn initializer_finalize() { + pallet::Pallet::::initializer_finalize() + } + + fn initializer_on_new_session(notification: &SessionChangeNotification) { + pallet::Pallet::::initializer_on_new_session(notification) + } +} + +pub use pallet::*; +#[frame_support::pallet] +pub mod pallet { + use frame_support::pallet_prelude::*; + use super::*; + + #[pallet::config] + pub trait Config: + frame_system::Config + + configuration::Config + + session_info::Config + { + type Event: From> + IsType<::Event>; + type RewardValidators: RewardValidators; + type PunishValidators: PunishValidators; + } + + #[pallet::pallet] + pub struct Pallet(_); + + /// The last pruned session, if any. All data stored by this module + /// references sessions. + #[pallet::storage] + pub(super) type LastPrunedSession = StorageValue<_, SessionIndex>; + + /// All ongoing or concluded disputes for the last several sessions. + #[pallet::storage] + pub(super) type Disputes = StorageDoubleMap< + _, + Twox64Concat, SessionIndex, + Blake2_128Concat, CandidateHash, + DisputeState, + >; + + /// All included blocks on the chain, as well as the block number in this chain that + /// should be reverted back to if the candidate is disputed and determined to be invalid. + #[pallet::storage] + pub(super) type Included = StorageDoubleMap< + _, + Twox64Concat, SessionIndex, + Blake2_128Concat, CandidateHash, + T::BlockNumber, + >; + + /// Maps session indices to a vector indicating the number of potentially-spam disputes + /// each validator is participating in. Potentially-spam disputes are remote disputes which have + /// fewer than `byzantine_threshold + 1` validators. + /// + /// The i'th entry of the vector corresponds to the i'th validator in the session. + #[pallet::storage] + pub(super) type SpamSlots = StorageMap<_, Twox64Concat, SessionIndex, Vec>; + + /// Whether the chain is frozen. Starts as `None`. When this is `Some`, + /// the chain will not accept any new parachain blocks for backing or inclusion, + /// and its value indicates the last valid block number in the chain. + /// It can only be set back to `None` by governance intervention. + #[pallet::storage] + #[pallet::getter(fn last_valid_block)] + pub(super) type Frozen = StorageValue<_, Option, ValueQuery>; + + #[pallet::event] + #[pallet::generate_deposit(pub fn deposit_event)] + pub enum Event { + /// A dispute has been initiated. \[candidate hash, dispute location\] + DisputeInitiated(CandidateHash, DisputeLocation), + /// A dispute has concluded for or against a candidate. + /// `\[para id, candidate hash, dispute result\]` + DisputeConcluded(CandidateHash, DisputeResult), + /// A dispute has timed out due to insufficient participation. + /// `\[para id, candidate hash\]` + DisputeTimedOut(CandidateHash), + /// A dispute has concluded with supermajority against a candidate. + /// Block authors should no longer build on top of this head and should + /// instead revert to the block at the given height which is the last + /// known valid block in this chain. + Revert(T::BlockNumber), + } + + #[pallet::error] + pub enum Error { + /// Duplicate dispute statement sets provided. + DuplicateDisputeStatementSets, + /// Ancient dispute statement provided. + AncientDisputeStatement, + /// Validator index on statement is out of bounds for session. + ValidatorIndexOutOfBounds, + /// Invalid signature on statement. + InvalidSignature, + /// Validator vote submitted more than once to dispute. + DuplicateStatement, + /// Too many spam slots used by some specific validator. + PotentialSpam, + } +} + +bitflags::bitflags! { + #[derive(Default)] + struct DisputeStateFlags: u8 { + const CONFIRMED = 0b0001; + const FOR_SUPERMAJORITY = 0b0010; + const AGAINST_SUPERMAJORITY = 0b0100; + } +} + +impl DisputeStateFlags { + fn from_state( + state: &DisputeState, + ) -> Self { + let n = state.validators_for.len(); + + let byzantine_threshold = byzantine_threshold(n); + let supermajority_threshold = supermajority_threshold(n); + + let mut flags = DisputeStateFlags::default(); + let all_participants = { + let mut a = state.validators_for.clone(); + *a |= state.validators_against.iter().by_val(); + a + }; + if all_participants.count_ones() > byzantine_threshold { + flags |= DisputeStateFlags::CONFIRMED; + } + + if state.validators_for.count_ones() >= supermajority_threshold { + flags |= DisputeStateFlags::FOR_SUPERMAJORITY; + } + + if state.validators_against.count_ones() >= supermajority_threshold { + flags |= DisputeStateFlags::AGAINST_SUPERMAJORITY; + } + + flags + } +} + +#[derive(PartialEq, RuntimeDebug)] +enum SpamSlotChange { + Inc, + Dec, +} + +struct ImportSummary { + // The new state, with all votes imported. + state: DisputeState, + // Changes to spam slots. Validator index paired with directional change. + spam_slot_changes: Vec<(ValidatorIndex, SpamSlotChange)>, + // Validators to slash for being (wrongly) on the AGAINST side. + slash_against: Vec, + // Validators to slash for being (wrongly) on the FOR side. + slash_for: Vec, + // New participants in the dispute. + new_participants: bitvec::vec::BitVec, + // Difference in state flags from previous. + new_flags: DisputeStateFlags, +} + +#[derive(RuntimeDebug, PartialEq, Eq)] +enum VoteImportError { + ValidatorIndexOutOfBounds, + DuplicateStatement, +} + +impl From for Error { + fn from(e: VoteImportError) -> Self { + match e { + VoteImportError::ValidatorIndexOutOfBounds => Error::::ValidatorIndexOutOfBounds, + VoteImportError::DuplicateStatement => Error::::DuplicateStatement, + } + } +} + +struct DisputeStateImporter { + state: DisputeState, + now: BlockNumber, + new_participants: bitvec::vec::BitVec, + pre_flags: DisputeStateFlags, +} + +impl DisputeStateImporter { + fn new( + state: DisputeState, + now: BlockNumber, + ) -> Self { + let pre_flags = DisputeStateFlags::from_state(&state); + let new_participants = bitvec::bitvec![BitOrderLsb0, u8; 0; state.validators_for.len()]; + + DisputeStateImporter { + state, + now, + new_participants, + pre_flags, + } + } + + fn import(&mut self, validator: ValidatorIndex, valid: bool) + -> Result<(), VoteImportError> + { + let (bits, other_bits) = if valid { + (&mut self.state.validators_for, &mut self.state.validators_against) + } else { + (&mut self.state.validators_against, &mut self.state.validators_for) + }; + + // out of bounds or already participated + match bits.get(validator.0 as usize).map(|b| *b) { + None => return Err(VoteImportError::ValidatorIndexOutOfBounds), + Some(true) => return Err(VoteImportError::DuplicateStatement), + Some(false) => {} + } + + // inefficient, and just for extra sanity. + if validator.0 as usize >= self.new_participants.len() { + return Err(VoteImportError::ValidatorIndexOutOfBounds); + } + + bits.set(validator.0 as usize, true); + + // New participants tracks those which didn't appear on either + // side of the dispute until now. So we check the other side + // and checked the first side before. + if other_bits.get(validator.0 as usize).map_or(false, |b| !*b) { + self.new_participants.set(validator.0 as usize, true); + } + + Ok(()) + } + + fn finish(mut self) -> ImportSummary { + let pre_flags = self.pre_flags; + let post_flags = DisputeStateFlags::from_state(&self.state); + + let pre_post_contains = |flags| (pre_flags.contains(flags), post_flags.contains(flags)); + + // 1. Act on confirmed flag state to inform spam slots changes. + let spam_slot_changes: Vec<_> = match pre_post_contains(DisputeStateFlags::CONFIRMED) { + (false, false) => { + // increment spam slots for all new participants. + self.new_participants.iter_ones() + .map(|i| (ValidatorIndex(i as _), SpamSlotChange::Inc)) + .collect() + } + (false, true) => { + let prev_participants = { + // all participants + let mut a = self.state.validators_for.clone(); + *a |= self.state.validators_against.iter().by_val(); + + // which are not new participants + *a &= self.new_participants.iter().by_val().map(|b| !b); + + a + }; + + prev_participants.iter_ones() + .map(|i| (ValidatorIndex(i as _), SpamSlotChange::Dec)) + .collect() + } + (true, true) | (true, false) => { + // nothing to do. (true, false) is also impossible. + Vec::new() + } + }; + + // 2. Check for fresh FOR supermajority. Only if not already concluded. + let slash_against = if let (false, true) = pre_post_contains(DisputeStateFlags::FOR_SUPERMAJORITY) { + if self.state.concluded_at.is_none() { + self.state.concluded_at = Some(self.now.clone()); + } + + // provide AGAINST voters to slash. + self.state.validators_against.iter_ones() + .map(|i| ValidatorIndex(i as _)) + .collect() + } else { + Vec::new() + }; + + // 3. Check for fresh AGAINST supermajority. + let slash_for = if let (false, true) = pre_post_contains(DisputeStateFlags::AGAINST_SUPERMAJORITY) { + if self.state.concluded_at.is_none() { + self.state.concluded_at = Some(self.now.clone()); + } + + // provide FOR voters to slash. + self.state.validators_for.iter_ones() + .map(|i| ValidatorIndex(i as _)) + .collect() + } else { + Vec::new() + }; + + ImportSummary { + state: self.state, + spam_slot_changes, + slash_against, + slash_for, + new_participants: self.new_participants, + new_flags: post_flags - pre_flags, + } + } +} + +impl Pallet { + /// Called by the initializer to initialize the disputes module. + pub(crate) fn initializer_initialize(now: T::BlockNumber) -> Weight { + let config = >::config(); + + let mut weight = 0; + for (session_index, candidate_hash, mut dispute) in >::iter() { + weight += T::DbWeight::get().reads_writes(1, 0); + + if dispute.concluded_at.is_none() + && dispute.start + config.dispute_conclusion_by_time_out_period < now + { + Self::deposit_event(Event::DisputeTimedOut(candidate_hash)); + + dispute.concluded_at = Some(now); + >::insert(session_index, candidate_hash, &dispute); + + if >::contains_key(&session_index, &candidate_hash) { + // Local disputes don't count towards spam. + + weight += T::DbWeight::get().reads_writes(1, 1); + continue; + } + + // mildly punish all validators involved. they've failed to make + // data available to others, so this is most likely spam. + SpamSlots::::mutate(session_index, |spam_slots| { + let spam_slots = match spam_slots { + Some(ref mut s) => s, + None => return, + }; + + // also reduce spam slots for all validators involved, if the dispute was unconfirmed. + // this does open us up to more spam, but only for validators who are willing + // to be punished more. + // + // it would be unexpected for any change here to occur when the dispute has not concluded + // in time, as a dispute guaranteed to have at least one honest participant should + // conclude quickly. + let participating = decrement_spam(spam_slots, &dispute); + + // Slight punishment as these validators have failed to make data available to + // others in a timely manner. + T::PunishValidators::punish_inconclusive( + session_index, + participating.iter_ones().map(|i| ValidatorIndex(i as _)), + ); + }); + + weight += T::DbWeight::get().reads_writes(2, 2); + } + } + + weight + } + + /// Called by the initializer to finalize the disputes module. + pub(crate) fn initializer_finalize() { } + + /// Called by the initializer to note a new session in the disputes module. + pub(crate) fn initializer_on_new_session(notification: &SessionChangeNotification) { + let config = >::config(); + + if notification.session_index <= config.dispute_period + 1 { + return + } + + let pruning_target = notification.session_index - config.dispute_period - 1; + + LastPrunedSession::::mutate(|last_pruned| { + let to_prune = if let Some(last_pruned) = last_pruned { + *last_pruned + 1 ..= pruning_target + } else { + pruning_target ..= pruning_target + }; + + for to_prune in to_prune { + // This should be small, as disputes are rare, so `None` is fine. + >::remove_prefix(to_prune, None); + + // This is larger, and will be extracted to the `shared` module for more proper pruning. + // TODO: https://github.com/paritytech/polkadot/issues/3469 + >::remove_prefix(to_prune, None); + SpamSlots::::remove(to_prune); + } + + *last_pruned = Some(pruning_target); + }); + } + + /// Handle sets of dispute statements corresponding to 0 or more candidates. + /// Returns a vector of freshly created disputes. + /// + /// # Warning + /// + /// This functions modifies the state when failing. It is expected to be called in inherent, + /// and to fail the extrinsic on error. As invalid inherents are not allowed, the dirty state + /// is not commited. + pub(crate) fn provide_multi_dispute_data(statement_sets: MultiDisputeStatementSet) + -> Result, DispatchError> + { + let config = >::config(); + + // Deduplicate. + { + let mut targets: Vec<_> = statement_sets.iter() + .map(|set| (set.candidate_hash.0, set.session)) + .collect(); + + targets.sort(); + + let submitted = targets.len(); + targets.dedup(); + + ensure!(submitted == targets.len(), Error::::DuplicateDisputeStatementSets); + } + + let mut fresh = Vec::with_capacity(statement_sets.len()); + for statement_set in statement_sets { + let dispute_target = (statement_set.session, statement_set.candidate_hash); + if Self::provide_dispute_data(&config, statement_set)? { + fresh.push(dispute_target); + } + } + + Ok(fresh) + } + + /// Handle a set of dispute statements corresponding to a single candidate. + /// + /// Fails if the dispute data is invalid. Returns a boolean indicating whether the + /// dispute is fresh. + fn provide_dispute_data(config: &HostConfiguration, set: DisputeStatementSet) + -> Result + { + // Dispute statement sets on any dispute which concluded + // before this point are to be rejected. + let now = >::block_number(); + let oldest_accepted = now.saturating_sub(config.dispute_post_conclusion_acceptance_period); + + // Load session info to access validators + let session_info = match >::session_info(set.session) { + Some(s) => s, + None => return Err(Error::::AncientDisputeStatement.into()), + }; + + let n_validators = session_info.validators.len(); + + // Check for ancient. + let (fresh, dispute_state) = { + if let Some(dispute_state) = >::get(&set.session, &set.candidate_hash) { + ensure!( + dispute_state.concluded_at.as_ref().map_or(true, |c| c >= &oldest_accepted), + Error::::AncientDisputeStatement, + ); + + (false, dispute_state) + } else { + ( + true, + DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 0; n_validators], + validators_against: bitvec![BitOrderLsb0, u8; 0; n_validators], + start: now, + concluded_at: None, + } + ) + } + }; + + // Check and import all votes. + let summary = { + let mut importer = DisputeStateImporter::new(dispute_state, now); + for (statement, validator_index, signature) in &set.statements { + let validator_public = session_info.validators.get(validator_index.0 as usize) + .ok_or(Error::::ValidatorIndexOutOfBounds)?; + + // Check signature before importing. + check_signature( + &validator_public, + set.candidate_hash, + set.session, + statement, + signature, + ).map_err(|()| Error::::InvalidSignature)?; + + let valid = match statement { + DisputeStatement::Valid(_) => true, + DisputeStatement::Invalid(_) => false, + }; + + importer.import(*validator_index, valid).map_err(Error::::from)?; + } + + importer.finish() + }; + + // Apply spam slot changes. Bail early if too many occupied. + let is_local = >::contains_key(&set.session, &set.candidate_hash); + if !is_local { + let mut spam_slots: Vec = SpamSlots::::get(&set.session) + .unwrap_or_else(|| vec![0; n_validators]); + + for (validator_index, spam_slot_change) in summary.spam_slot_changes { + let spam_slot = spam_slots.get_mut(validator_index.0 as usize) + .expect("index is in-bounds, as checked above; qed"); + + match spam_slot_change { + SpamSlotChange::Inc => { + ensure!( + *spam_slot < config.dispute_max_spam_slots, + Error::::PotentialSpam, + ); + + *spam_slot += 1; + } + SpamSlotChange::Dec => { + *spam_slot = spam_slot.saturating_sub(1); + } + } + } + + SpamSlots::::insert(&set.session, spam_slots); + } + + if fresh { + Self::deposit_event(Event::DisputeInitiated( + set.candidate_hash, + if is_local { DisputeLocation::Local } else { DisputeLocation::Remote }, + )); + } + + { + if summary.new_flags.contains(DisputeStateFlags::FOR_SUPERMAJORITY) { + Self::deposit_event(Event::DisputeConcluded( + set.candidate_hash, + DisputeResult::Valid, + )); + } + + // It is possible, although unexpected, for a dispute to conclude twice. + // This would require f+1 validators to vote in both directions. + // A dispute cannot conclude more than once in each direction. + + if summary.new_flags.contains(DisputeStateFlags::AGAINST_SUPERMAJORITY) { + Self::deposit_event(Event::DisputeConcluded( + set.candidate_hash, + DisputeResult::Invalid, + )); + } + } + + // Reward statements. + T::RewardValidators::reward_dispute_statement( + set.session, + summary.new_participants.iter_ones().map(|i| ValidatorIndex(i as _)), + ); + + // Slash participants on a losing side. + { + // a valid candidate, according to 2/3. Punish those on the 'against' side. + T::PunishValidators::punish_against_valid( + set.session, + summary.slash_against, + ); + + // an invalid candidate, according to 2/3. Punish those on the 'for' side. + T::PunishValidators::punish_for_invalid( + set.session, + summary.slash_for, + ); + } + + >::insert(&set.session, &set.candidate_hash, &summary.state); + + // Freeze if just concluded against some local candidate + if summary.new_flags.contains(DisputeStateFlags::AGAINST_SUPERMAJORITY) { + if let Some(revert_to) = >::get(&set.session, &set.candidate_hash) { + Self::revert_and_freeze(revert_to); + } + } + + Ok(fresh) + } + + #[allow(unused)] + pub(crate) fn disputes() -> Vec<(SessionIndex, CandidateHash, DisputeState)> { + >::iter().collect() + } + + pub(crate) fn note_included(session: SessionIndex, candidate_hash: CandidateHash, included_in: T::BlockNumber) { + if included_in.is_zero() { return } + + let revert_to = included_in - One::one(); + + >::insert(&session, &candidate_hash, revert_to); + + // If we just included a block locally which has a live dispute, decrement spam slots + // for any involved validators, if the dispute is not already confirmed by f + 1. + if let Some(state) = >::get(&session, candidate_hash) { + SpamSlots::::mutate(&session, |spam_slots| { + if let Some(ref mut spam_slots) = *spam_slots { + decrement_spam(spam_slots, &state); + } + }); + + if has_supermajority_against(&state) { + Self::revert_and_freeze(revert_to); + } + } + } + + pub(crate) fn could_be_invalid(session: SessionIndex, candidate_hash: CandidateHash) -> bool { + >::get(&session, &candidate_hash).map_or(false, |dispute| { + // A dispute that is ongoing or has concluded with supermajority-against. + dispute.concluded_at.is_none() || has_supermajority_against(&dispute) + }) + } + + pub(crate) fn is_frozen() -> bool { + Self::last_valid_block().is_some() + } + + pub(crate) fn revert_and_freeze(revert_to: T::BlockNumber) { + if Self::last_valid_block().map_or(true, |last| last > revert_to) { + Frozen::::set(Some(revert_to)); + Self::deposit_event(Event::Revert(revert_to)); + frame_system::Pallet::::deposit_log( + ConsensusLog::Revert(revert_to.saturated_into()).into(), + ); + } + } +} + +fn has_supermajority_against(dispute: &DisputeState) -> bool { + let supermajority_threshold = supermajority_threshold(dispute.validators_against.len()); + dispute.validators_against.count_ones() >= supermajority_threshold +} + +// If the dispute had not enough validators to confirm, decrement spam slots for all the participating +// validators. +// +// Returns the set of participating validators as a bitvec. +fn decrement_spam( + spam_slots: &mut [u32], + dispute: &DisputeState, +) -> bitvec::vec::BitVec { + let byzantine_threshold = byzantine_threshold(spam_slots.len()); + + let participating = dispute.validators_for.clone() | dispute.validators_against.iter().by_val(); + let decrement_spam = participating.count_ones() <= byzantine_threshold; + for validator_index in participating.iter_ones() { + if decrement_spam { + if let Some(occupied) = spam_slots.get_mut(validator_index as usize) { + *occupied = occupied.saturating_sub(1); + } + } + } + + participating +} + +fn check_signature( + validator_public: &ValidatorId, + candidate_hash: CandidateHash, + session: SessionIndex, + statement: &DisputeStatement, + validator_signature: &ValidatorSignature, +) -> Result<(), ()> { + let payload = match *statement { + DisputeStatement::Valid(ValidDisputeStatementKind::Explicit) => { + ExplicitDisputeStatement { + valid: true, + candidate_hash, + session, + }.signing_payload() + }, + DisputeStatement::Valid(ValidDisputeStatementKind::BackingSeconded(inclusion_parent)) => { + CompactStatement::Seconded(candidate_hash).signing_payload(&SigningContext { + session_index: session, + parent_hash: inclusion_parent, + }) + }, + DisputeStatement::Valid(ValidDisputeStatementKind::BackingValid(inclusion_parent)) => { + CompactStatement::Valid(candidate_hash).signing_payload(&SigningContext { + session_index: session, + parent_hash: inclusion_parent, + }) + }, + DisputeStatement::Valid(ValidDisputeStatementKind::ApprovalChecking) => { + ApprovalVote(candidate_hash).signing_payload(session) + }, + DisputeStatement::Invalid(InvalidDisputeStatementKind::Explicit) => { + ExplicitDisputeStatement { + valid: false, + candidate_hash, + session, + }.signing_payload() + }, + }; + + if validator_signature.verify(&payload[..] , &validator_public) { + Ok(()) + } else { + Err(()) + } +} + +#[cfg(test)] +mod tests { + use super::*; + use frame_system::InitKind; + use frame_support::{assert_ok, assert_err, assert_noop, traits::{OnInitialize, OnFinalize}}; + use crate::mock::{ + new_test_ext, Test, System, AllPallets, Initializer, AccountId, MockGenesisConfig, + REWARD_VALIDATORS, PUNISH_VALIDATORS_FOR, PUNISH_VALIDATORS_AGAINST, + PUNISH_VALIDATORS_INCONCLUSIVE, + }; + use sp_core::{Pair, crypto::CryptoType}; + use primitives::v1::BlockNumber; + + // All arguments for `initializer::on_new_session` + type NewSession<'a> = (bool, SessionIndex, Vec<(&'a AccountId, ValidatorId)>, Option>); + + // Run to specific block, while calling disputes pallet hooks manually, because disputes is not + // integrated in initializer yet. + fn run_to_block<'a>( + to: BlockNumber, + new_session: impl Fn(BlockNumber) -> Option>, + ) { + while System::block_number() < to { + let b = System::block_number(); + if b != 0 { + AllPallets::on_finalize(b); + System::finalize(); + } + + System::initialize(&(b + 1), &Default::default(), &Default::default(), InitKind::Full); + AllPallets::on_initialize(b + 1); + + if let Some(new_session) = new_session(b + 1) { + Initializer::test_trigger_on_new_session( + new_session.0, + new_session.1, + new_session.2.into_iter(), + new_session.3.map(|q| q.into_iter()), + ); + } + } + } + + #[test] + fn test_dispute_state_flag_from_state() { + assert_eq!( + DisputeStateFlags::from_state(&DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 0, 0, 0, 0, 0, 0, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 0, 0, 0, 0, 0, 0, 0, 0], + start: 0, + concluded_at: None, + }), + DisputeStateFlags::default(), + ); + + assert_eq!( + DisputeStateFlags::from_state(&DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 1, 1, 1, 1, 1, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 0, 0, 0, 0, 0, 0, 0], + start: 0, + concluded_at: None, + }), + DisputeStateFlags::FOR_SUPERMAJORITY | DisputeStateFlags::CONFIRMED, + ); + + assert_eq!( + DisputeStateFlags::from_state(&DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 0, 0, 0, 0, 0, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 1, 1, 1, 1, 1, 0, 0], + start: 0, + concluded_at: None, + }), + DisputeStateFlags::AGAINST_SUPERMAJORITY | DisputeStateFlags::CONFIRMED, + ); + } + + #[test] + fn test_import_new_participant_spam_inc() { + let mut importer = DisputeStateImporter::new( + DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 1, 0, 0, 0, 0, 0, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 0, 0, 0, 0, 0, 0, 0, 0], + start: 0, + concluded_at: None, + }, + 0, + ); + + assert_err!( + importer.import(ValidatorIndex(9), true), + VoteImportError::ValidatorIndexOutOfBounds, + ); + + assert_err!( + importer.import(ValidatorIndex(0), true), + VoteImportError::DuplicateStatement, + ); + assert_ok!(importer.import(ValidatorIndex(0), false)); + + assert_ok!(importer.import(ValidatorIndex(2), true)); + assert_err!( + importer.import(ValidatorIndex(2), true), + VoteImportError::DuplicateStatement, + ); + + assert_ok!(importer.import(ValidatorIndex(2), false)); + assert_err!( + importer.import(ValidatorIndex(2), false), + VoteImportError::DuplicateStatement, + ); + + let summary = importer.finish(); + assert_eq!(summary.new_flags, DisputeStateFlags::default()); + assert_eq!( + summary.state, + DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 1, 0, 1, 0, 0, 0, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 1, 0, 1, 0, 0, 0, 0, 0], + start: 0, + concluded_at: None, + }, + ); + assert_eq!( + summary.spam_slot_changes, + vec![(ValidatorIndex(2), SpamSlotChange::Inc)], + ); + assert!(summary.slash_for.is_empty()); + assert!(summary.slash_against.is_empty()); + assert_eq!(summary.new_participants, bitvec![BitOrderLsb0, u8; 0, 0, 1, 0, 0, 0, 0, 0]); + } + + #[test] + fn test_import_prev_participant_spam_dec_confirmed() { + let mut importer = DisputeStateImporter::new( + DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 1, 0, 0, 0, 0, 0, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 0, 1, 0, 0, 0, 0, 0, 0], + start: 0, + concluded_at: None, + }, + 0, + ); + + assert_ok!(importer.import(ValidatorIndex(2), true)); + + let summary = importer.finish(); + assert_eq!( + summary.state, + DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 1, 0, 1, 0, 0, 0, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 0, 1, 0, 0, 0, 0, 0, 0], + start: 0, + concluded_at: None, + }, + ); + assert_eq!( + summary.spam_slot_changes, + vec![ + (ValidatorIndex(0), SpamSlotChange::Dec), + (ValidatorIndex(1), SpamSlotChange::Dec), + ], + ); + assert!(summary.slash_for.is_empty()); + assert!(summary.slash_against.is_empty()); + assert_eq!(summary.new_participants, bitvec![BitOrderLsb0, u8; 0, 0, 1, 0, 0, 0, 0, 0]); + assert_eq!(summary.new_flags, DisputeStateFlags::CONFIRMED); + } + + #[test] + fn test_import_prev_participant_spam_dec_confirmed_slash_for() { + let mut importer = DisputeStateImporter::new( + DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 1, 0, 0, 0, 0, 0, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 0, 1, 0, 0, 0, 0, 0, 0], + start: 0, + concluded_at: None, + }, + 0, + ); + + assert_ok!(importer.import(ValidatorIndex(2), true)); + assert_ok!(importer.import(ValidatorIndex(2), false)); + assert_ok!(importer.import(ValidatorIndex(3), false)); + assert_ok!(importer.import(ValidatorIndex(4), false)); + assert_ok!(importer.import(ValidatorIndex(5), false)); + assert_ok!(importer.import(ValidatorIndex(6), false)); + + let summary = importer.finish(); + assert_eq!( + summary.state, + DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 1, 0, 1, 0, 0, 0, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 0, 1, 1, 1, 1, 1, 1, 0], + start: 0, + concluded_at: Some(0), + }, + ); + assert_eq!( + summary.spam_slot_changes, + vec![ + (ValidatorIndex(0), SpamSlotChange::Dec), + (ValidatorIndex(1), SpamSlotChange::Dec), + ], + ); + assert_eq!(summary.slash_for, vec![ValidatorIndex(0), ValidatorIndex(2)]); + assert!(summary.slash_against.is_empty()); + assert_eq!(summary.new_participants, bitvec![BitOrderLsb0, u8; 0, 0, 1, 1, 1, 1, 1, 0]); + assert_eq!( + summary.new_flags, + DisputeStateFlags::CONFIRMED | DisputeStateFlags::AGAINST_SUPERMAJORITY, + ); + } + + #[test] + fn test_import_slash_against() { + let mut importer = DisputeStateImporter::new( + DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 1, 0, 1, 0, 0, 0, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 0, 1, 0, 0, 0, 0, 0, 0], + start: 0, + concluded_at: None, + }, + 0, + ); + + assert_ok!(importer.import(ValidatorIndex(3), true)); + assert_ok!(importer.import(ValidatorIndex(4), true)); + assert_ok!(importer.import(ValidatorIndex(5), false)); + assert_ok!(importer.import(ValidatorIndex(6), true)); + assert_ok!(importer.import(ValidatorIndex(7), true)); + + let summary = importer.finish(); + assert_eq!( + summary.state, + DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 1, 0, 1, 1, 1, 0, 1, 1], + validators_against: bitvec![BitOrderLsb0, u8; 0, 1, 0, 0, 0, 1, 0, 0], + start: 0, + concluded_at: Some(0), + }, + ); + assert!(summary.spam_slot_changes.is_empty()); + assert!(summary.slash_for.is_empty()); + assert_eq!(summary.slash_against, vec![ValidatorIndex(1), ValidatorIndex(5)]); + assert_eq!(summary.new_participants, bitvec![BitOrderLsb0, u8; 0, 0, 0, 1, 1, 1, 1, 1]); + assert_eq!(summary.new_flags, DisputeStateFlags::FOR_SUPERMAJORITY); + } + + // Test that punish_inconclusive is correctly called. + #[test] + fn test_initializer_initialize() { + let dispute_conclusion_by_time_out_period = 3; + let start = 10; + + let mock_genesis_config = MockGenesisConfig { + configuration: crate::configuration::GenesisConfig { + config: HostConfiguration { + dispute_conclusion_by_time_out_period, + .. Default::default() + }, + .. Default::default() + }, + .. Default::default() + }; + + new_test_ext(mock_genesis_config).execute_with(|| { + let v0 = ::Pair::generate().0; + let v1 = ::Pair::generate().0; + let v2 = ::Pair::generate().0; + let v3 = ::Pair::generate().0; + + // NOTE: v0 index will be 0 + // NOTE: v1 index will be 3 + // NOTE: v2 index will be 2 + // NOTE: v3 index will be 1 + + run_to_block( + start, + |b| { + // a new session at each block + Some(( + true, + b, + vec![(&0, v0.public()), (&1, v1.public()), (&2, v2.public()), (&3, v3.public())], + Some(vec![(&0, v0.public()), (&1, v1.public()), (&2, v2.public()), (&3, v3.public())]), + )) + } + ); + + let candidate_hash = CandidateHash(sp_core::H256::repeat_byte(1)); + + // v0 votes for 3 + let stmts = vec![ + DisputeStatementSet { + candidate_hash: candidate_hash.clone(), + session: start - 1, + statements: vec![ + ( + DisputeStatement::Valid(ValidDisputeStatementKind::Explicit), + ValidatorIndex(0), + v0.sign( + &ExplicitDisputeStatement { + valid: true, + candidate_hash: candidate_hash.clone(), + session: start - 1, + }.signing_payload() + ) + ), + ], + }, + ]; + + assert_ok!( + Pallet::::provide_multi_dispute_data(stmts), + vec![(9, candidate_hash.clone())], + ); + assert_eq!(SpamSlots::::get(start - 1), Some(vec![1, 0, 0, 0])); + + // Run to timeout period + run_to_block(start + dispute_conclusion_by_time_out_period, |_| None); + assert_eq!(SpamSlots::::get(start - 1), Some(vec![1, 0, 0, 0])); + + // Run to timeout + 1 in order to executive on_finalize(timeout) + run_to_block(start + dispute_conclusion_by_time_out_period + 1, |_| None); + assert_eq!(SpamSlots::::get(start - 1), Some(vec![0, 0, 0, 0])); + assert_eq!( + PUNISH_VALIDATORS_INCONCLUSIVE.with(|r| r.borrow()[0].clone()), + (9, vec![ValidatorIndex(0)]), + ); + }); + } + + // Test prunning works + #[test] + fn test_initializer_on_new_session() { + let dispute_period = 3; + + let mock_genesis_config = MockGenesisConfig { + configuration: crate::configuration::GenesisConfig { + config: HostConfiguration { + dispute_period, + .. Default::default() + }, + .. Default::default() + }, + .. Default::default() + }; + + new_test_ext(mock_genesis_config).execute_with(|| { + let v0 = ::Pair::generate().0; + + let candidate_hash = CandidateHash(sp_core::H256::repeat_byte(1)); + Pallet::::note_included(0, candidate_hash.clone(), 0); + Pallet::::note_included(1, candidate_hash.clone(), 1); + Pallet::::note_included(2, candidate_hash.clone(), 2); + Pallet::::note_included(3, candidate_hash.clone(), 3); + Pallet::::note_included(4, candidate_hash.clone(), 4); + Pallet::::note_included(5, candidate_hash.clone(), 5); + Pallet::::note_included(6, candidate_hash.clone(), 5); + + run_to_block( + 7, + |b| { + // a new session at each block + Some(( + true, + b, + vec![(&0, v0.public())], + Some(vec![(&0, v0.public())]), + )) + } + ); + + // current session is 7, + // we keep for dispute_period + 1 session and we remove in on_finalize + // thus we keep info for session 3, 4, 5, 6, 7. + assert_eq!(Included::::iter_prefix(0).count(), 0); + assert_eq!(Included::::iter_prefix(1).count(), 0); + assert_eq!(Included::::iter_prefix(2).count(), 0); + assert_eq!(Included::::iter_prefix(3).count(), 1); + assert_eq!(Included::::iter_prefix(4).count(), 1); + assert_eq!(Included::::iter_prefix(5).count(), 1); + assert_eq!(Included::::iter_prefix(6).count(), 1); + }); + } + + #[test] + fn test_provide_multi_dispute_data_duplicate_error() { + new_test_ext(Default::default()).execute_with(|| { + let candidate_hash_1 = CandidateHash(sp_core::H256::repeat_byte(1)); + let candidate_hash_2 = CandidateHash(sp_core::H256::repeat_byte(2)); + + let stmts = vec![ + DisputeStatementSet { + candidate_hash: candidate_hash_2, + session: 2, + statements: vec![], + }, + DisputeStatementSet { + candidate_hash: candidate_hash_1, + session: 1, + statements: vec![], + }, + DisputeStatementSet { + candidate_hash: candidate_hash_2, + session: 2, + statements: vec![], + }, + ]; + + assert_err!( + Pallet::::provide_multi_dispute_data(stmts), + DispatchError::from(Error::::DuplicateDisputeStatementSets), + ); + }) + } + + // Test: + // * wrong signature fails + // * signature is checked for correct validator + #[test] + fn test_provide_multi_dispute_is_checking_signature_correctly() { + new_test_ext(Default::default()).execute_with(|| { + let v0 = ::Pair::generate().0; + let v1 = ::Pair::generate().0; + + run_to_block( + 3, + |b| { + // a new session at each block + if b == 1 { + Some(( + true, + b, + vec![(&0, v0.public())], + Some(vec![(&0, v0.public())]), + )) + } else { + Some(( + true, + b, + vec![(&1, v1.public())], + Some(vec![(&1, v1.public())]), + )) + } + } + ); + + + let candidate_hash = CandidateHash(sp_core::H256::repeat_byte(1)); + let stmts = vec![ + DisputeStatementSet { + candidate_hash: candidate_hash.clone(), + session: 1, + statements: vec![ + ( + DisputeStatement::Valid(ValidDisputeStatementKind::Explicit), + ValidatorIndex(0), + v0.sign( + &ExplicitDisputeStatement { + valid: true, + candidate_hash: candidate_hash.clone(), + session: 1, + }.signing_payload() + ), + ), + ], + }, + ]; + + assert_ok!( + Pallet::::provide_multi_dispute_data(stmts), + vec![(1, candidate_hash.clone())], + ); + + let candidate_hash = CandidateHash(sp_core::H256::repeat_byte(1)); + let stmts = vec![ + DisputeStatementSet { + candidate_hash: candidate_hash.clone(), + session: 2, + statements: vec![ + ( + DisputeStatement::Valid(ValidDisputeStatementKind::Explicit), + ValidatorIndex(0), + v0.sign( + &ExplicitDisputeStatement { + valid: true, + candidate_hash: candidate_hash.clone(), + session: 2, + }.signing_payload() + ), + ), + ], + }, + ]; + + assert_noop!( + Pallet::::provide_multi_dispute_data(stmts), + DispatchError::from(Error::::InvalidSignature), + ); + }) + } + + #[test] + fn test_freeze_on_note_included() { + new_test_ext(Default::default()).execute_with(|| { + let v0 = ::Pair::generate().0; + + run_to_block( + 6, + |b| { + // a new session at each block + Some(( + true, + b, + vec![(&0, v0.public())], + Some(vec![(&0, v0.public())]), + )) + } + ); + + let candidate_hash = CandidateHash(sp_core::H256::repeat_byte(1)); + + // v0 votes for 3 + let stmts = vec![ + DisputeStatementSet { + candidate_hash: candidate_hash.clone(), + session: 3, + statements: vec![ + ( + DisputeStatement::Invalid(InvalidDisputeStatementKind::Explicit), + ValidatorIndex(0), + v0.sign( + &ExplicitDisputeStatement { + valid: false, + candidate_hash: candidate_hash.clone(), + session: 3, + }.signing_payload() + ) + ), + ], + }, + ]; + assert!(Pallet::::provide_multi_dispute_data(stmts).is_ok()); + + Pallet::::note_included(3, candidate_hash.clone(), 3); + assert_eq!(Frozen::::get(), Some(2)); + }); + } + + #[test] + fn test_freeze_provided_against_supermajority_for_included() { + new_test_ext(Default::default()).execute_with(|| { + let v0 = ::Pair::generate().0; + + run_to_block( + 6, + |b| { + // a new session at each block + Some(( + true, + b, + vec![(&0, v0.public())], + Some(vec![(&0, v0.public())]), + )) + } + ); + + let candidate_hash = CandidateHash(sp_core::H256::repeat_byte(1)); + + Pallet::::note_included(3, candidate_hash.clone(), 3); + + // v0 votes for 3 + let stmts = vec![ + DisputeStatementSet { + candidate_hash: candidate_hash.clone(), + session: 3, + statements: vec![ + ( + DisputeStatement::Invalid(InvalidDisputeStatementKind::Explicit), + ValidatorIndex(0), + v0.sign( + &ExplicitDisputeStatement { + valid: false, + candidate_hash: candidate_hash.clone(), + session: 3, + }.signing_payload() + ) + ), + ], + }, + ]; + assert!(Pallet::::provide_multi_dispute_data(stmts).is_ok()); + + assert_eq!(Frozen::::get(), Some(2)); + }); + } + + // tests for: + // * provide_multi_dispute: with success scenario + // * disputes: correctness of datas + // * could_be_invalid: correctness of datas + // * note_included: decrement spam correctly + // * spam slots: correctly incremented and decremented + // * ensure rewards and punishment are correctly called. + #[test] + fn test_provide_multi_dispute_success_and_other() { + new_test_ext(Default::default()).execute_with(|| { + let v0 = ::Pair::generate().0; + let v1 = ::Pair::generate().0; + let v2 = ::Pair::generate().0; + let v3 = ::Pair::generate().0; + + // NOTE: v0 index will be 0 + // NOTE: v1 index will be 3 + // NOTE: v2 index will be 2 + // NOTE: v3 index will be 1 + + run_to_block( + 6, + |b| { + // a new session at each block + Some(( + true, + b, + vec![(&0, v0.public()), (&1, v1.public()), (&2, v2.public()), (&3, v3.public())], + Some(vec![(&0, v0.public()), (&1, v1.public()), (&2, v2.public()), (&3, v3.public())]), + )) + } + ); + + let candidate_hash = CandidateHash(sp_core::H256::repeat_byte(1)); + + // v0 votes for 3 + let stmts = vec![ + DisputeStatementSet { + candidate_hash: candidate_hash.clone(), + session: 3, + statements: vec![ + ( + DisputeStatement::Valid(ValidDisputeStatementKind::Explicit), + ValidatorIndex(0), + v0.sign( + &ExplicitDisputeStatement { + valid: true, + candidate_hash: candidate_hash.clone(), + session: 3, + }.signing_payload() + ) + ), + ], + }, + ]; + + assert_ok!( + Pallet::::provide_multi_dispute_data(stmts), + vec![(3, candidate_hash.clone())], + ); + assert_eq!(SpamSlots::::get(3), Some(vec![1, 0, 0, 0])); + + // v1 votes for 4 and for 3 + let stmts = vec![ + DisputeStatementSet { + candidate_hash: candidate_hash.clone(), + session: 4, + statements: vec![ + ( + DisputeStatement::Valid(ValidDisputeStatementKind::Explicit), + ValidatorIndex(3), + v1.sign( + &ExplicitDisputeStatement { + valid: true, + candidate_hash: candidate_hash.clone(), + session: 4, + }.signing_payload() + ) + ), + ], + }, + DisputeStatementSet { + candidate_hash: candidate_hash.clone(), + session: 3, + statements: vec![ + ( + DisputeStatement::Valid(ValidDisputeStatementKind::Explicit), + ValidatorIndex(3), + v1.sign( + &ExplicitDisputeStatement { + valid: true, + candidate_hash: candidate_hash.clone(), + session: 3, + }.signing_payload() + ), + ), + ], + }, + ]; + + assert_ok!( + Pallet::::provide_multi_dispute_data(stmts), + vec![(4, candidate_hash.clone())], + ); + assert_eq!(SpamSlots::::get(3), Some(vec![0, 0, 0, 0])); // Confirmed as no longer spam + assert_eq!(SpamSlots::::get(4), Some(vec![0, 0, 0, 1])); + + // v3 votes against 3 and for 5 + let stmts = vec![ + DisputeStatementSet { + candidate_hash: candidate_hash.clone(), + session: 3, + statements: vec![ + ( + DisputeStatement::Invalid(InvalidDisputeStatementKind::Explicit), + ValidatorIndex(1), + v3.sign( + &ExplicitDisputeStatement { + valid: false, + candidate_hash: candidate_hash.clone(), + session: 3, + }.signing_payload() + ), + ), + ], + }, + DisputeStatementSet { + candidate_hash: candidate_hash.clone(), + session: 5, + statements: vec![ + ( + DisputeStatement::Valid(ValidDisputeStatementKind::Explicit), + ValidatorIndex(1), + v3.sign( + &ExplicitDisputeStatement { + valid: true, + candidate_hash: candidate_hash.clone(), + session: 5, + }.signing_payload() + ), + ), + ], + }, + ]; + assert_ok!( + Pallet::::provide_multi_dispute_data(stmts), + vec![(5, candidate_hash.clone())], + ); + assert_eq!(SpamSlots::::get(3), Some(vec![0, 0, 0, 0])); + assert_eq!(SpamSlots::::get(4), Some(vec![0, 0, 0, 1])); + assert_eq!(SpamSlots::::get(5), Some(vec![0, 1, 0, 0])); + + // v2 votes for 3 and againt 5 + let stmts = vec![ + DisputeStatementSet { + candidate_hash: candidate_hash.clone(), + session: 3, + statements: vec![ + ( + DisputeStatement::Valid(ValidDisputeStatementKind::Explicit), + ValidatorIndex(2), + v2.sign( + &ExplicitDisputeStatement { + valid: true, + candidate_hash: candidate_hash.clone(), + session: 3, + }.signing_payload() + ) + ), + ], + }, + DisputeStatementSet { + candidate_hash: candidate_hash.clone(), + session: 5, + statements: vec![ + ( + DisputeStatement::Invalid(InvalidDisputeStatementKind::Explicit), + ValidatorIndex(2), + v2.sign( + &ExplicitDisputeStatement { + valid: false, + candidate_hash: candidate_hash.clone(), + session: 5, + }.signing_payload() + ), + ), + ], + }, + ]; + assert_ok!(Pallet::::provide_multi_dispute_data(stmts), vec![]); + assert_eq!(SpamSlots::::get(3), Some(vec![0, 0, 0, 0])); + assert_eq!(SpamSlots::::get(4), Some(vec![0, 0, 0, 1])); + assert_eq!(SpamSlots::::get(5), Some(vec![0, 0, 0, 0])); + + // v0 votes for 5 + let stmts = vec![ + DisputeStatementSet { + candidate_hash: candidate_hash.clone(), + session: 5, + statements: vec![ + ( + DisputeStatement::Invalid(InvalidDisputeStatementKind::Explicit), + ValidatorIndex(0), + v0.sign( + &ExplicitDisputeStatement { + valid: false, + candidate_hash: candidate_hash.clone(), + session: 5, + }.signing_payload() + ), + ), + ], + }, + ]; + + assert_ok!(Pallet::::provide_multi_dispute_data(stmts), vec![]); + assert_eq!(SpamSlots::::get(3), Some(vec![0, 0, 0, 0])); + assert_eq!(SpamSlots::::get(4), Some(vec![0, 0, 0, 1])); + assert_eq!(SpamSlots::::get(5), Some(vec![0, 0, 0, 0])); + + // v1 votes for 5 + let stmts = vec![ + DisputeStatementSet { + candidate_hash: candidate_hash.clone(), + session: 5, + statements: vec![ + ( + DisputeStatement::Invalid(InvalidDisputeStatementKind::Explicit), + ValidatorIndex(3), + v1.sign( + &ExplicitDisputeStatement { + valid: false, + candidate_hash: candidate_hash.clone(), + session: 5, + }.signing_payload() + ) + ), + ], + }, + ]; + + assert_ok!( + Pallet::::provide_multi_dispute_data(stmts), + vec![], + ); + assert_eq!(SpamSlots::::get(3), Some(vec![0, 0, 0, 0])); + assert_eq!(SpamSlots::::get(4), Some(vec![0, 0, 0, 1])); + assert_eq!(SpamSlots::::get(5), Some(vec![0, 0, 0, 0])); + + assert_eq!( + Pallet::::disputes(), + vec![ + ( + 5, + candidate_hash.clone(), + DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 0, 1, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 1, 0, 1, 1], + start: 6, + concluded_at: Some(6), // 3 vote against + } + ), + ( + 3, + candidate_hash.clone(), + DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 1, 0, 1, 1], + validators_against: bitvec![BitOrderLsb0, u8; 0, 1, 0, 0], + start: 6, + concluded_at: Some(6), // 3 vote for + } + ), + ( + 4, + candidate_hash.clone(), + DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 0, 0, 0, 1], + validators_against: bitvec![BitOrderLsb0, u8; 0, 0, 0, 0], + start: 6, + concluded_at: None, + } + ), + ] + ); + + assert_eq!(Pallet::::could_be_invalid(3, candidate_hash.clone()), false); // It has 3 votes for + assert_eq!(Pallet::::could_be_invalid(4, candidate_hash.clone()), true); + assert_eq!(Pallet::::could_be_invalid(5, candidate_hash.clone()), true); + + // Ensure inclusion removes spam slots + assert_eq!(SpamSlots::::get(4), Some(vec![0, 0, 0, 1])); + Pallet::::note_included(4, candidate_hash.clone(), 4); + assert_eq!(SpamSlots::::get(4), Some(vec![0, 0, 0, 0])); + + // Ensure the reward_validator function was correctly called + assert_eq!( + REWARD_VALIDATORS.with(|r| r.borrow().clone()), + vec![ + (3, vec![ValidatorIndex(0)]), + (4, vec![ValidatorIndex(3)]), + (3, vec![ValidatorIndex(3)]), + (3, vec![ValidatorIndex(1)]), + (5, vec![ValidatorIndex(1)]), + (3, vec![ValidatorIndex(2)]), + (5, vec![ValidatorIndex(2)]), + (5, vec![ValidatorIndex(0)]), + (5, vec![ValidatorIndex(3)]), + ], + ); + + // Ensure punishment against is called + assert_eq!( + PUNISH_VALIDATORS_AGAINST.with(|r| r.borrow().clone()), + vec![ + (3, vec![]), + (4, vec![]), + (3, vec![]), + (3, vec![]), + (5, vec![]), + (3, vec![ValidatorIndex(1)]), + (5, vec![]), + (5, vec![]), + (5, vec![]), + ], + ); + + // Ensure punishment for is called + assert_eq!( + PUNISH_VALIDATORS_FOR.with(|r| r.borrow().clone()), + vec![ + (3, vec![]), + (4, vec![]), + (3, vec![]), + (3, vec![]), + (5, vec![]), + (3, vec![]), + (5, vec![]), + (5, vec![]), + (5, vec![ValidatorIndex(1)]), + ], + ); + }) + } + + #[test] + fn test_revert_and_freeze() { + new_test_ext(Default::default()).execute_with(|| { + // events are ignored for genesis block + System::set_block_number(1); + + Frozen::::put(Some(0)); + assert_noop!( + { + Pallet::::revert_and_freeze(0); + Result::<(), ()>::Err(()) // Just a small trick in order to use assert_noop. + }, + (), + ); + + Frozen::::kill(); + Pallet::::revert_and_freeze(0); + + assert_eq!(Frozen::::get(), Some(0)); + assert_eq!(System::digest().logs[0], ConsensusLog::Revert(0).into()); + System::assert_has_event(Event::Revert(0).into()); + }) + } + + #[test] + fn test_revert_and_freeze_merges() { + new_test_ext(Default::default()).execute_with(|| { + Frozen::::put(Some(10)); + assert_noop!( + { + Pallet::::revert_and_freeze(10); + Result::<(), ()>::Err(()) // Just a small trick in order to use assert_noop. + }, + (), + ); + + Pallet::::revert_and_freeze(8); + assert_eq!(Frozen::::get(), Some(8)); + }) + } + + #[test] + fn test_has_supermajority_against() { + assert_eq!( + has_supermajority_against(&DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 1, 1, 0, 0, 0, 0, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 1, 1, 1, 1, 1, 0, 0, 0], + start: 0, + concluded_at: None, + }), + false, + ); + + assert_eq!( + has_supermajority_against(&DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 1, 1, 0, 0, 0, 0, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 1, 1, 1, 1, 1, 1, 0, 0], + start: 0, + concluded_at: None, + }), + true, + ); + } + + #[test] + fn test_decrement_spam() { + let original_spam_slots = vec![0, 1, 2, 3, 4, 5, 6, 7]; + + // Test confirm is no-op + let mut spam_slots = original_spam_slots.clone(); + let dispute_state_confirm = DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 1, 1, 0, 0, 0, 0, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 1, 0, 1, 0, 0, 0, 0, 0], + start: 0, + concluded_at: None, + }; + assert_eq!( + DisputeStateFlags::from_state(&dispute_state_confirm), + DisputeStateFlags::CONFIRMED + ); + assert_eq!( + decrement_spam(spam_slots.as_mut(), &dispute_state_confirm), + bitvec![BitOrderLsb0, u8; 1, 1, 1, 0, 0, 0, 0, 0], + ); + assert_eq!(spam_slots, original_spam_slots); + + // Test not confirm is decreasing spam + let mut spam_slots = original_spam_slots.clone(); + let dispute_state_no_confirm = DisputeState { + validators_for: bitvec![BitOrderLsb0, u8; 1, 0, 0, 0, 0, 0, 0, 0], + validators_against: bitvec![BitOrderLsb0, u8; 1, 0, 1, 0, 0, 0, 0, 0], + start: 0, + concluded_at: None, + }; + assert_eq!( + DisputeStateFlags::from_state(&dispute_state_no_confirm), + DisputeStateFlags::default() + ); + assert_eq!( + decrement_spam(spam_slots.as_mut(), &dispute_state_no_confirm), + bitvec![BitOrderLsb0, u8; 1, 0, 1, 0, 0, 0, 0, 0], + ); + assert_eq!(spam_slots, vec![0, 1, 1, 3, 4, 5, 6, 7]); + } + + #[test] + fn test_check_signature() { + let validator_id = ::Pair::generate().0; + let wrong_validator_id = ::Pair::generate().0; + + let session = 0; + let wrong_session = 1; + let candidate_hash = CandidateHash(sp_core::H256::repeat_byte(1)); + let wrong_candidate_hash = CandidateHash(sp_core::H256::repeat_byte(2)); + let inclusion_parent = sp_core::H256::repeat_byte(3); + let wrong_inclusion_parent = sp_core::H256::repeat_byte(4); + + let statement_1 = DisputeStatement::Valid(ValidDisputeStatementKind::Explicit); + let statement_2 = DisputeStatement::Valid( + ValidDisputeStatementKind::BackingSeconded(inclusion_parent.clone()) + ); + let wrong_statement_2 = DisputeStatement::Valid( + ValidDisputeStatementKind::BackingSeconded(wrong_inclusion_parent.clone()) + ); + let statement_3 = DisputeStatement::Valid( + ValidDisputeStatementKind::BackingValid(inclusion_parent.clone()) + ); + let wrong_statement_3 = DisputeStatement::Valid( + ValidDisputeStatementKind::BackingValid(wrong_inclusion_parent.clone()) + ); + let statement_4 = DisputeStatement::Valid(ValidDisputeStatementKind::ApprovalChecking); + let statement_5 = DisputeStatement::Invalid(InvalidDisputeStatementKind::Explicit); + + let signed_1 = validator_id.sign( + &ExplicitDisputeStatement { + valid: true, + candidate_hash: candidate_hash.clone(), + session, + }.signing_payload() + ); + let signed_2 = validator_id.sign( + &CompactStatement::Seconded(candidate_hash.clone()) + .signing_payload(&SigningContext { + session_index: session, + parent_hash: inclusion_parent.clone() + }) + ); + let signed_3 = validator_id.sign( + &CompactStatement::Valid(candidate_hash.clone()) + .signing_payload(&SigningContext { + session_index: session, + parent_hash: inclusion_parent.clone() + }) + ); + let signed_4 = validator_id.sign( + &ApprovalVote(candidate_hash.clone()).signing_payload(session) + ); + let signed_5 = validator_id.sign( + &ExplicitDisputeStatement { + valid: false, + candidate_hash: candidate_hash.clone(), + session, + }.signing_payload() + ); + + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_1, &signed_1).is_ok()); + assert!(check_signature(&wrong_validator_id.public(), candidate_hash, session, &statement_1, &signed_1).is_err()); + assert!(check_signature(&validator_id.public(), wrong_candidate_hash, session, &statement_1, &signed_1).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, wrong_session, &statement_1, &signed_1).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_2, &signed_1).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_3, &signed_1).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_4, &signed_1).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_5, &signed_1).is_err()); + + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_2, &signed_2).is_ok()); + assert!(check_signature(&wrong_validator_id.public(), candidate_hash, session, &statement_2, &signed_2).is_err()); + assert!(check_signature(&validator_id.public(), wrong_candidate_hash, session, &statement_2, &signed_2).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, wrong_session, &statement_2, &signed_2).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &wrong_statement_2, &signed_2).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_1, &signed_2).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_3, &signed_2).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_4, &signed_2).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_5, &signed_2).is_err()); + + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_3, &signed_3).is_ok()); + assert!(check_signature(&wrong_validator_id.public(), candidate_hash, session, &statement_3, &signed_3).is_err()); + assert!(check_signature(&validator_id.public(), wrong_candidate_hash, session, &statement_3, &signed_3).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, wrong_session, &statement_3, &signed_3).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &wrong_statement_3, &signed_3).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_1, &signed_3).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_2, &signed_3).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_4, &signed_3).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_5, &signed_3).is_err()); + + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_4, &signed_4).is_ok()); + assert!(check_signature(&wrong_validator_id.public(), candidate_hash, session, &statement_4, &signed_4).is_err()); + assert!(check_signature(&validator_id.public(), wrong_candidate_hash, session, &statement_4, &signed_4).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, wrong_session, &statement_4, &signed_4).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_1, &signed_4).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_2, &signed_4).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_3, &signed_4).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_5, &signed_4).is_err()); + + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_5, &signed_5).is_ok()); + assert!(check_signature(&wrong_validator_id.public(), candidate_hash, session, &statement_5, &signed_5).is_err()); + assert!(check_signature(&validator_id.public(), wrong_candidate_hash, session, &statement_5, &signed_5).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, wrong_session, &statement_5, &signed_5).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_1, &signed_5).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_2, &signed_5).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_3, &signed_5).is_err()); + assert!(check_signature(&validator_id.public(), candidate_hash, session, &statement_4, &signed_5).is_err()); + } +} diff --git a/runtime/parachains/src/inclusion.rs b/runtime/parachains/src/inclusion.rs index e6e159b6ee22..e5beab3734d3 100644 --- a/runtime/parachains/src/inclusion.rs +++ b/runtime/parachains/src/inclusion.rs @@ -35,7 +35,7 @@ use parity_scale_codec::{Encode, Decode}; use bitvec::{order::Lsb0 as BitOrderLsb0, vec::BitVec}; use sp_runtime::{DispatchError, traits::{One, Saturating}}; -use crate::{configuration, paras, dmp, ump, hrmp, shared, scheduler::CoreAssignment}; +use crate::{configuration, disputes, paras, dmp, ump, hrmp, shared, scheduler::CoreAssignment}; /// A bitfield signed by a validator indicating that it is keeping its piece of the erasure-coding /// for any backed candidates referred to by a `1` bit available. @@ -118,6 +118,7 @@ pub trait Config: + configuration::Config { type Event: From> + Into<::Event>; + type DisputesHandler: disputes::DisputesHandler; type RewardValidators: RewardValidators; } @@ -238,7 +239,7 @@ impl Module { expected_bits: usize, unchecked_bitfields: UncheckedSignedAvailabilityBitfields, core_lookup: impl Fn(CoreIndex) -> Option, - ) -> Result, DispatchError> { + ) -> Result, DispatchError> { let validators = shared::Module::::active_validator_keys(); let session_index = shared::Module::::session_index(); @@ -247,7 +248,6 @@ impl Module { .map(|core_para| core_para.map(|p| (p, PendingAvailability::::get(&p)))) .collect(); - // do sanity checks on the bitfields: // 1. no more than one bitfield per validator // 2. bitfields are ascending by validator index. @@ -368,15 +368,12 @@ impl Module { pending_availability.backing_group, ); - freed_cores.push(pending_availability.core); + freed_cores.push((pending_availability.core, pending_availability.hash)); } else { >::insert(¶_id, &pending_availability); } } - // TODO: pass available candidates onwards to validity module once implemented. - // https://github.com/paritytech/polkadot/issues/1251 - Ok(freed_cores) } @@ -754,6 +751,28 @@ impl Module { cleaned_up_cores } + /// Cleans up all paras pending availability that are in the given list of disputed candidates. + /// + /// Returns a vector of cleaned-up core IDs. + pub(crate) fn collect_disputed(disputed: Vec) -> Vec { + let mut cleaned_up_ids = Vec::new(); + let mut cleaned_up_cores = Vec::new(); + + for (para_id, pending_record) in >::iter() { + if disputed.contains(&pending_record.hash) { + cleaned_up_ids.push(para_id); + cleaned_up_cores.push(pending_record.core); + } + } + + for para_id in cleaned_up_ids { + let _ = >::take(¶_id); + let _ = ::take(¶_id); + } + + cleaned_up_cores + } + /// Forcibly enact the candidate with the given ID as though it had been deemed available /// by bitfields. /// @@ -2553,4 +2572,6 @@ mod tests { assert!(::iter().collect::>().is_empty()); }); } + + // TODO [now]: test `collect_disputed` } diff --git a/runtime/parachains/src/initializer.rs b/runtime/parachains/src/initializer.rs index 21e3c2612061..870962e62ebe 100644 --- a/runtime/parachains/src/initializer.rs +++ b/runtime/parachains/src/initializer.rs @@ -25,6 +25,7 @@ use frame_support::traits::{Randomness, OneSessionHandler}; use parity_scale_codec::{Encode, Decode}; use crate::{ configuration::{self, HostConfiguration}, + disputes::DisputesHandler, shared, paras, scheduler, inclusion, session_info, dmp, ump, hrmp, }; @@ -127,7 +128,7 @@ pub mod pallet { // - Scheduler // - Inclusion // - SessionInfo - // - Validity + // - Disputes // - DMP // - UMP // - HRMP @@ -137,6 +138,7 @@ pub mod pallet { scheduler::Module::::initializer_initialize(now) + inclusion::Module::::initializer_initialize(now) + session_info::Module::::initializer_initialize(now) + + T::DisputesHandler::initializer_initialize(now) + dmp::Module::::initializer_initialize(now) + ump::Module::::initializer_initialize(now) + hrmp::Module::::initializer_initialize(now); @@ -151,6 +153,7 @@ pub mod pallet { hrmp::Module::::initializer_finalize(); ump::Module::::initializer_finalize(); dmp::Module::::initializer_finalize(); + T::DisputesHandler::initializer_finalize(); session_info::Module::::initializer_finalize(); inclusion::Module::::initializer_finalize(); scheduler::Module::::initializer_finalize(); @@ -234,6 +237,7 @@ impl Pallet { scheduler::Module::::initializer_on_new_session(¬ification); inclusion::Module::::initializer_on_new_session(¬ification); session_info::Module::::initializer_on_new_session(¬ification); + T::DisputesHandler::initializer_on_new_session(¬ification); dmp::Module::::initializer_on_new_session(¬ification, &outgoing_paras); ump::Module::::initializer_on_new_session(¬ification, &outgoing_paras); hrmp::Module::::initializer_on_new_session(¬ification, &outgoing_paras); @@ -268,6 +272,20 @@ impl Pallet { } } + + // Allow to trigger on_new_session in tests, this is needed as long as pallet_session is not + // implemented in mock. + #[cfg(test)] + pub(crate) fn test_trigger_on_new_session<'a, I: 'a>( + changed: bool, + session_index: SessionIndex, + validators: I, + queued: Option, + ) + where I: Iterator + { + Self::on_new_session(changed, session_index, validators, queued) + } } impl sp_runtime::BoundToRuntimeAppPublic for Pallet { diff --git a/runtime/parachains/src/lib.rs b/runtime/parachains/src/lib.rs index 98014340f21e..e4341405886a 100644 --- a/runtime/parachains/src/lib.rs +++ b/runtime/parachains/src/lib.rs @@ -23,6 +23,7 @@ #![cfg_attr(not(feature = "std"), no_std)] pub mod configuration; +pub mod disputes; pub mod shared; pub mod inclusion; pub mod initializer; diff --git a/runtime/parachains/src/mock.rs b/runtime/parachains/src/mock.rs index f6af2be9711a..1c54ff6c5ae1 100644 --- a/runtime/parachains/src/mock.rs +++ b/runtime/parachains/src/mock.rs @@ -21,7 +21,9 @@ use sp_core::H256; use sp_runtime::traits::{ BlakeTwo256, IdentityLookup, }; -use primitives::v1::{AuthorityDiscoveryId, Balance, BlockNumber, Header, ValidatorIndex}; +use primitives::v1::{ + AuthorityDiscoveryId, Balance, BlockNumber, Header, ValidatorIndex, SessionIndex, +}; use frame_support::parameter_types; use frame_support::traits::GenesisBuild; use frame_support_test::TestRandomness; @@ -29,7 +31,7 @@ use std::cell::RefCell; use std::collections::HashMap; use crate::{ inclusion, scheduler, dmp, ump, hrmp, session_info, paras, configuration, - initializer, shared, + initializer, shared, disputes, }; type UncheckedExtrinsic = frame_system::mocking::MockUncheckedExtrinsic; @@ -53,6 +55,7 @@ frame_support::construct_runtime!( Ump: ump::{Pallet, Call, Storage, Event}, Hrmp: hrmp::{Pallet, Call, Storage, Event}, SessionInfo: session_info::{Pallet, Call, Storage}, + Disputes: disputes::{Pallet, Storage, Event}, } ); @@ -62,6 +65,8 @@ parameter_types! { frame_system::limits::BlockWeights::simple_max(4 * 1024 * 1024); } +pub type AccountId = u64; + impl frame_system::Config for Test { type BaseCallFilter = frame_support::traits::AllowAll; type BlockWeights = BlockWeights; @@ -136,10 +141,59 @@ impl crate::hrmp::Config for Test { type Currency = pallet_balances::Pallet; } +impl crate::disputes::Config for Test { + type Event = Event; + type RewardValidators = Self; + type PunishValidators = Self; +} + +thread_local! { + pub static REWARD_VALIDATORS: RefCell)>> = RefCell::new(Vec::new()); + pub static PUNISH_VALIDATORS_FOR: RefCell)>> = RefCell::new(Vec::new()); + pub static PUNISH_VALIDATORS_AGAINST: RefCell)>> = RefCell::new(Vec::new()); + pub static PUNISH_VALIDATORS_INCONCLUSIVE: RefCell)>> = RefCell::new(Vec::new()); +} + +impl crate::disputes::RewardValidators for Test { + fn reward_dispute_statement( + session: SessionIndex, + validators: impl IntoIterator + ) { + REWARD_VALIDATORS.with(|r| r.borrow_mut().push((session, validators.into_iter().collect()))) + } +} + +impl crate::disputes::PunishValidators for Test { + fn punish_for_invalid( + session: SessionIndex, + validators: impl IntoIterator, + ) { + PUNISH_VALIDATORS_FOR + .with(|r| r.borrow_mut().push((session, validators.into_iter().collect()))) + } + + fn punish_against_valid( + session: SessionIndex, + validators: impl IntoIterator, + ) { + PUNISH_VALIDATORS_AGAINST + .with(|r| r.borrow_mut().push((session, validators.into_iter().collect()))) + } + + fn punish_inconclusive( + session: SessionIndex, + validators: impl IntoIterator, + ) { + PUNISH_VALIDATORS_INCONCLUSIVE + .with(|r| r.borrow_mut().push((session, validators.into_iter().collect()))) + } +} + impl crate::scheduler::Config for Test { } impl crate::inclusion::Config for Test { type Event = Event; + type DisputesHandler = Disputes; type RewardValidators = TestRewardValidators; } diff --git a/runtime/parachains/src/paras_inherent.rs b/runtime/parachains/src/paras_inherent.rs index 551a7a1f55b3..4e26c1916c5b 100644 --- a/runtime/parachains/src/paras_inherent.rs +++ b/runtime/parachains/src/paras_inherent.rs @@ -35,8 +35,10 @@ use frame_support::{ }; use frame_system::ensure_none; use crate::{ + disputes::DisputesHandler, inclusion, scheduler::{self, FreedReason}, + shared, ump, }; @@ -68,6 +70,8 @@ decl_error! { /// The hash of the submitted parent header doesn't correspond to the saved block hash of /// the parent. InvalidParentHeader, + /// Potentially invalid candidate. + CandidateCouldBeInvalid, } } @@ -99,7 +103,7 @@ decl_module! { bitfields: signed_bitfields, backed_candidates, parent_header, - disputes: _, + disputes, } = data; ensure_none(origin)?; @@ -112,6 +116,36 @@ decl_module! { Error::::InvalidParentHeader, ); + // Handle disputes logic. + let current_session = >::session_index(); + let freed_disputed: Vec<(_, FreedReason)> = { + let fresh_disputes = T::DisputesHandler::provide_multi_dispute_data(disputes)?; + if T::DisputesHandler::is_frozen() { + // The relay chain we are currently on is invalid. Proceed no further on parachains. + Included::set(Some(())); + return Ok(Some( + MINIMAL_INCLUSION_INHERENT_WEIGHT + ).into()); + } + + let any_current_session_disputes = fresh_disputes.iter() + .any(|(s, _)| s == ¤t_session); + + if any_current_session_disputes { + let current_session_disputes: Vec<_> = fresh_disputes.iter() + .filter(|(s, _)| s == ¤t_session) + .map(|(_, c)| *c) + .collect(); + + >::collect_disputed(current_session_disputes) + .into_iter() + .map(|core| (core, FreedReason::Concluded)) + .collect() + } else { + Vec::new() + } + }; + // Process new availability bitfields, yielding any availability cores whose // work has now concluded. let expected_bits = >::availability_cores().len(); @@ -121,6 +155,12 @@ decl_module! { >::core_para, )?; + // Inform the disputes module of all included candidates. + let now = >::block_number(); + for (_, candidate_hash) in &freed_concluded { + T::DisputesHandler::note_included(current_session, *candidate_hash, now); + } + // Handle timeouts for any availability core work. let availability_pred = >::availability_timeout_predicate(); let freed_timeout = if let Some(pred) = availability_pred { @@ -130,8 +170,12 @@ decl_module! { }; // Schedule paras again, given freed cores, and reasons for freeing. - let freed = freed_concluded.into_iter().map(|c| (c, FreedReason::Concluded)) - .chain(freed_timeout.into_iter().map(|c| (c, FreedReason::TimedOut))); + let mut freed = freed_disputed.into_iter() + .chain(freed_concluded.into_iter().map(|(c, _hash)| (c, FreedReason::Concluded))) + .chain(freed_timeout.into_iter().map(|c| (c, FreedReason::TimedOut))) + .collect::>(); + + freed.sort_unstable_by_key(|pair| pair.0); // sort by core index >::clear(); >::schedule( @@ -142,6 +186,17 @@ decl_module! { let backed_candidates = limit_backed_candidates::(backed_candidates); let backed_candidates_len = backed_candidates.len() as Weight; + // Refuse to back any candidates that are disputed or invalid. + for candidate in &backed_candidates { + ensure!( + !T::DisputesHandler::could_be_invalid( + current_session, + candidate.candidate.hash(), + ), + Error::::CandidateCouldBeInvalid, + ); + } + // Process backed candidates according to scheduled cores. let parent_storage_root = parent_header.state_root().clone(); let occupied = >::process_candidates( @@ -216,7 +271,7 @@ impl ProvideInherent for Module { const INHERENT_IDENTIFIER: InherentIdentifier = PARACHAINS_INHERENT_IDENTIFIER; fn create_inherent(data: &InherentData) -> Option { - let inherent_data: ParachainsInherentData + let mut inherent_data: ParachainsInherentData = match data.get_data(&Self::INHERENT_IDENTIFIER) { Ok(Some(d)) => d, @@ -231,6 +286,9 @@ impl ProvideInherent for Module { } }; + // filter out any unneeded dispute statements + T::DisputesHandler::filter_multi_dispute_data(&mut inherent_data.disputes); + // Sanity check: session changes can invalidate an inherent, and we _really_ don't want that to happen. // See github.com/paritytech/polkadot/issues/1327 let inherent_data = match Self::enter( diff --git a/runtime/rococo/src/lib.rs b/runtime/rococo/src/lib.rs index a416d87fe89d..b8fabf54b58e 100644 --- a/runtime/rococo/src/lib.rs +++ b/runtime/rococo/src/lib.rs @@ -589,6 +589,7 @@ impl runtime_parachains::inclusion::RewardValidators for RewardValidators { impl parachains_inclusion::Config for Runtime { type Event = Event; + type DisputesHandler = (); type RewardValidators = RewardValidators; } diff --git a/runtime/test-runtime/src/lib.rs b/runtime/test-runtime/src/lib.rs index 70efad71b232..5570dbbac74a 100644 --- a/runtime/test-runtime/src/lib.rs +++ b/runtime/test-runtime/src/lib.rs @@ -36,6 +36,7 @@ use polkadot_runtime_parachains::dmp as parachains_dmp; use polkadot_runtime_parachains::ump as parachains_ump; use polkadot_runtime_parachains::hrmp as parachains_hrmp; use polkadot_runtime_parachains::scheduler as parachains_scheduler; +use polkadot_runtime_parachains::disputes as parachains_disputes; use polkadot_runtime_parachains::runtime_api_impl::v1 as runtime_impl; use primitives::v1::{ @@ -455,9 +456,16 @@ impl parachains_shared::Config for Runtime {} impl parachains_inclusion::Config for Runtime { type Event = Event; + type DisputesHandler = ParasDisputes; type RewardValidators = RewardValidatorsWithEraPoints; } +impl parachains_disputes::Config for Runtime { + type Event = Event; + type RewardValidators = (); + type PunishValidators = (); +} + impl parachains_paras_inherent::Config for Runtime {} impl parachains_initializer::Config for Runtime { @@ -537,6 +545,7 @@ construct_runtime! { SessionInfo: parachains_session_info::{Pallet, Call, Storage}, Hrmp: parachains_hrmp::{Pallet, Call, Storage, Event}, Ump: parachains_ump::{Pallet, Call, Storage, Event}, + ParasDisputes: parachains_disputes::{Pallet, Storage, Event}, Sudo: pallet_sudo::{Pallet, Call, Storage, Config, Event}, } diff --git a/runtime/westend/src/lib.rs b/runtime/westend/src/lib.rs index e904f6e6d482..0ee78b5d19c4 100644 --- a/runtime/westend/src/lib.rs +++ b/runtime/westend/src/lib.rs @@ -765,6 +765,7 @@ impl parachains_session_info::Config for Runtime {} impl parachains_inclusion::Config for Runtime { type Event = Event; + type DisputesHandler = (); type RewardValidators = parachains_reward_points::RewardValidatorsWithEraPoints; }