ssvlabs / ssv-spec Goto Github PK

How do we ensure, in protocol, that change operator doesn't cause slashing.
For example we can sync the new group with the highest decided and put that in their slashing db

depends on #40

a decided msg (quorum of commit msgs) should always terminate the instance

used for restricting calling start instance once on qbft

Move key management out from ssv node
Currently remote signers do not include an IsSlashable call so the ssv node needs to manage internal slashing protection

TODO

• #35
  #16
  #15
  #14
  #8
  #7
  #24
  #25
  #27
  #34
  #52
  #55
  #60
  #61
  #65
  #88
  #113
  #115
  #121

Signers in all signed objects should be unique (no duplicates)

• QBFT signed messages
• SignedPartialSignatureMessage
• PartialSignatureMessage

Should the contract indicate if the operators sign blinded blocks or regular blocks?

A commit message should be added to the container if valid: height, type and signature.
This will allow to achieve a quorum and terminate the instance whenever there is a quorum regardless of when commit messages arrive: late, future and decided messages.

This pends a discussion with Roberto

Current spec holds the graffiti in the share data, that needs to be represented in the contracts

// SignBeaconObject returns signature and root.
SignBeaconObject(obj ssz.HashRoot, domain spec.Domain, pk []byte) (Signature, []byte, error)

Should follow up a spec

It will enable starting height from 0 and make it uint

Includes:

• #20
• #38
• #41
• #54
• #111
• #63
• #62
• #112
• #90
• #91

• #37

Between nodes sync protocol:

• highest decided
• highest change round within instance
• decided history sync (for archive nodes)
• #65
• spec test for 2 decided msgs with different signers, should error on the second one
• spec test for 2 decided msgs, first with 2f+1 signers and the other with >2f+1
• spec test as the above just reverse order

per ssvlabs/SIPs#5

https://entethalliance.github.io/client-spec/qbft_spec.html#dfn-qbftspecification (function roundTimeout(round:nat):nat)

Current SSV runner is too complicated, it needs to be generalized to all duties and with a clear pipeline for all duties

Check and evaluate different topologies, based on topologies that are detailed here.

Currently the included round change justification includes all round change msgs, we should only include relevant quorum

Includes

• [ ] Using group primitives for handling validator registration, fee, etc
• [ ] Focusing on reusability of groups for multi validator registration
• #28
• [ ] Support fee recipient
• #67

Decided with 3 returns decided true and than when receive decided with 4 also return decided true

There is no use case in which the PartialSignatureMessage signer is different than the SignedPartialSignatureMessage signer

• qbft controller should be able to process past messages
• Past messages are restricted to commit msgs (late commit) and decided msg with a higher number of signers

• Process message (controller and instance)
• Prepare (a few tests)
• upon timeout
• upon decided
• check for duplicated msgs with different sorted signers (results in different roots I think)
• Spec test late messages for stored instances that decided already
• #59
• signed msg signer 0
• #118

Missing test for instance that start from height higher than 0. in case of previews decided in storage

otherwise it's an attack vector and complicates the code significantly

When a node decides it should broadcast a post consensus msg with decided justifications in it so when another node receives it it can serve both as a post consensus partial signature but also as a decided msg.

This can reduce msg overhead

• Use libP2P scale test as infra for testing networking configs
• Scale, test various configs and iterate for optimal params for libp2p
• This benchmark will change the configs in a separate PR

• can't pass sub committee index in msg, nothing guarantees correctness, need to fetch it when reconstructing and match to signed root

For example
https://github.com/bloxapp/ssv-experiments/blob/master/ssz_encoding/ssv/base_runner.go

Go over all pubsub and libp2p configs and align/ explain differences from eth networking spec

Finalize implementation of DKG

qbft signed commit messages can have multiple signers, a decided message is just a commit msg with 2f+1 signers.
Should consider removing it, just use qbft signed messages

When uponRoundChange is called we should check if the msg is valid and also the justification is.
When round changes are checked in isProposalJustification the justifications are not checked (as part of proposal check)

we should separate the 2 checks so we can add round change justifications as part of the new SignedMessageHeader SIP
https://github.com/bloxapp/ssv-experiments/blob/master/ssz_encoding/qbft/messages.go#L82-L89

NEW

• - Runner tests
  • - duties
    • attester
    • proposer
    • aggregator
    • sync committee
    • sync committee aggregator
    • pre consensus justifications
  • pre consensus
  • post consensus
  • consensus
    -[ ] Value Check
    -[X] attestation
    -[ ] aggregation
    -[ ] proposer
    -[ ] sync committee
    -[ ] sync committee aggregator
• Messages - cancelled as moved to new ssz struct and to types
• [ ]dutyexe
  • wrong duty role
• messages - move relevant tests to types (as we moved partial sig structs to types)
• Validator
  • process msg func tests
• partial sig container
• Types
  • shares
• #36
• #40
• #65
• #61
• #59

Currently decided is handled by the instance which doesn't enable accepting higher height decided msgs.

• Move decided handling to controller
• enable decided from >= current instance
• If deciding higher decided should we sync the rest of the instances?

Consensys/qbft-formal-spec-and-verification@clarify_specification_behaviour...fix_liveness_issue_in_validating_proposal_justification

First round should be 0 not 1

Harden the node against malicious P2P activity (remember an attacker can also register his own validator with 3 malicious nodes and 1 honest node to attack)

• DDOS protection
• RPC sync rate limit
• Decided f+1 sync trigger (attacker sending multiple f+1 msgs with higher height)
• DKG requests rate limit
• voluntary exit rate limit

A node receiving a decided msg from a higher height should trigger sync

• beacon network tests
• consensus data (all in implement mode)
• crypto full spec tests for all functions
• encryption full spec tests for all functions
• eth1 deposit full spec tests for all function
• message id functions spec tests
• SSVMessage encoding decoding spec tests
• partial sig msg encoding/ decoding spec tests
• partial sig msg get root spec tests
• partial sig msg validation func spec tests
• share encoding/ decoding spec tests
• share quorum functions spec tests
• ssz full spec tests for all structs