Check the execution receipt received from network properly #236

liuchengxu · 2022-01-29T14:06:35Z

This PR is mainly for making the locally produced execution receipt persistent for a while so that the executor can compare it with the external ER and propose a fraud proof in case of any invalid state transition in the external ER.

The first 3 commits are basically about some refactorings, and then the core of this PR follows. Making it a draft due to these TODOs, but the other commits are ready to be reviewed.

TODOs:

~~Better approach than using sleep() while waiting for the local ER~~, acceptable for now, will have to see if it's usable for the early stage.(Ref Check the execution receipt received from network properly #236 (comment)).
Prune the too old ERs.

cumulus/client/cirrus-executor/src/aux_schema.rs

cumulus/client/cirrus-executor/src/lib.rs

nazar-pc

Overall, I think we need something like orphan ERs in this case to handle it gracefully, but it is definitely tricky to do in a way that is DoS resistant

cumulus/client/cirrus-executor/src/processor.rs

cumulus/client/cirrus-executor/src/lib.rs

cumulus/client/cirrus-executor/src/aux_schema.rs

cumulus/client/cirrus-executor/src/lib.rs

nazar-pc · 2022-01-29T17:19:23Z

cumulus/client/cirrus-executor/src/lib.rs

+			rx.recv()??
+		};
+
+		// TODO: What happens for this obvious error?


Same as in any other case, you compare trace item one by one and generate fraud proof for item that is wrong or missing

There is a possible case that an external ER that contains all the valid roots and some extra ones? In that case comparing on the iterator won't detect it, but I believe the block will still fail in the verification somewhere else.

Everything is possible, adversary can create whatever ER they want 🙂

cumulus/client/cirrus-executor/src/lib.rs

cumulus/client/cirrus-executor/src/processor.rs

Fixes #236 (comment)

cumulus/client/cirrus-executor/Cargo.toml

cumulus/client/cirrus-executor/src/processor.rs

cumulus/client/cirrus-executor/src/aux_schema.rs

Fixes #236 (comment)

liuchengxu · 2022-02-08T07:39:53Z

@nazar-pc This PR is ready for another review, the last 4 commits are new since your last review.

nazar-pc

Some comments, but nothing critical

nazar-pc · 2022-02-09T05:21:52Z

cumulus/client/cirrus-executor/src/aux_schema.rs

+		let mut to_delete_block_number = first_saved_receipt;
+		while to_delete_block_number < new_first_saved_receipt {


to_delete_block_number is basically from and new_first_saved_receipt is basically to.

Instead of transforming those into Block::Header::Number, I'd convert them into subspace_core_primitives::BlockNumber and iterated over the range of numbers instead, that would be easier to read rather than manually incrementing stuff.

Converting to subspace_core_primitives::BlockNumber might be helpful to simplify the loop, but you have to convert it back to Number as the encode for u32 and Block::Header::Number is different(discovered by the existing test, perhaps the compact of codec is related, I didn't look into this) unless you want to use u32 as the part of the final key to insert into the store.

I think it is fine to use BlockNumber as a final key. Also it might be different in tests (I see that often tests use u64 for block number), but should be the same in production since we use u32 everywhere as a block number otherwise.

cumulus/client/cirrus-executor/src/aux_schema.rs

nazar-pc · 2022-02-09T05:28:13Z

cumulus/client/cirrus-executor/src/aux_schema.rs

@@ -47,18 +59,28 @@ pub(super) fn write_execution_receipt<Backend: AuxStore, Block: BlockT>(
 		new_first_saved_receipt = block_number.saturating_sub((PRUNING_DEPTH - 1).saturated_into());


In these cases I would honestly prefer .expect() since we don't expect these numbers to ever be beyond u32::MAX.

Feel free to refactor it directly as I don't see another style that is satisfying to me using expect() :P.

cumulus/client/cirrus-executor/src/processor.rs

cumulus/client/cirrus-executor/src/merkle_tree.rs

Refactor `ExecutionReceipt`: - Rename `state_transition_root` to `trace_root`. - Include the list of all storage roots in the execution as `trace`.

Only the authority executors are allowed to participate the election, the winner of which will be able to broadcast the exeuction recepit to the network, and then we could run an authority executor node and a full executor node locally.

Fixes #236 (comment)

We have to use the block number as key because the time is measured in block number only.

Store the execution receipt by block hash, use another storage for tracking the associated block number to have knowledge of if it's too old and should be pruned. This commit also removes the deletion of local ER even it's correctly validated, now the obsolete ERs will be removed soly according to the prune depth.

… the root list

…te_roots()` Using `parent_hash` is wrong because we need to call the api on top of the newly created best block to get the intermediate roots for this just executed block.

liuchengxu requested review from nazar-pc and rg3l3dr January 29, 2022 14:06

i1i1 reviewed Jan 29, 2022

View reviewed changes

cumulus/client/cirrus-executor/src/aux_schema.rs Outdated Show resolved Hide resolved

cumulus/client/cirrus-executor/src/lib.rs Show resolved Hide resolved

cumulus/client/cirrus-executor/src/lib.rs Show resolved Hide resolved

nazar-pc reviewed Jan 29, 2022

View reviewed changes

liuchengxu added a commit that referenced this pull request Jan 30, 2022

Use Merkle Tree instead of Merkle Patricia Tree for execution trace

efd84d7

Fixes #236 (comment)

liuchengxu added a commit that referenced this pull request Jan 30, 2022

Use Merkle Tree instead of Merkle Patricia Tree for execution trace

e0631d3

Fixes #236 (comment)

liuchengxu force-pushed the check-external-ER branch from efd84d7 to e0631d3 Compare January 30, 2022 12:16

nazar-pc reviewed Jan 31, 2022

View reviewed changes

liuchengxu force-pushed the check-external-ER branch 2 times, most recently from 67f06be to 65320d4 Compare January 31, 2022 10:05

liuchengxu added a commit that referenced this pull request Feb 2, 2022

Use Merkle Tree instead of Merkle Patricia Tree for execution trace

2800f46

Fixes #236 (comment)

liuchengxu force-pushed the check-external-ER branch from 65320d4 to 86236f0 Compare February 2, 2022 06:06

liuchengxu marked this pull request as ready for review February 2, 2022 06:06

liuchengxu requested review from nazar-pc, i1i1 and ozgunozerk February 2, 2022 06:09

liuchengxu added a commit that referenced this pull request Feb 2, 2022

Use Merkle Tree instead of Merkle Patricia Tree for execution trace

511f5ce

Fixes #236 (comment)

liuchengxu force-pushed the check-external-ER branch 2 times, most recently from 7e0b1d9 to 7381b67 Compare February 2, 2022 18:47

liuchengxu added a commit that referenced this pull request Feb 4, 2022

Use Merkle Tree instead of Merkle Patricia Tree for execution trace

d4fc857

Fixes #236 (comment)

liuchengxu force-pushed the check-external-ER branch from 41d70fd to d3e1903 Compare February 4, 2022 13:18

liuchengxu added a commit that referenced this pull request Feb 8, 2022

Use Merkle Tree instead of Merkle Patricia Tree for execution trace

c1f9e49

Fixes #236 (comment)

liuchengxu force-pushed the check-external-ER branch from d3e1903 to 5363a50 Compare February 8, 2022 05:22

nazar-pc reviewed Feb 9, 2022

View reviewed changes

i1i1 previously approved these changes Feb 9, 2022

View reviewed changes

liuchengxu added 4 commits February 9, 2022 17:10

Include the list of storage roots in ExecutionReceipt

8e11150

Refactor `ExecutionReceipt`: - Rename `state_transition_root` to `trace_root`. - Include the list of all storage roots in the execution as `trace`.

Reduce Executor generics by merging runtime_api into client

4934c1c

Write local ER to disk and check external ER against the local one

2856ded

liuchengxu added 8 commits February 9, 2022 17:10

Remove the validated local execution receipt from disk

d983d4d

Apply the suggestions from code review

992cfb2

Use Merkle Tree instead of Merkle Patricia Tree for execution trace

0098a20

Fixes #236 (comment)

Prune the too old execution receipts while writing a new one

c383418

We have to use the block number as key because the time is measured in block number only.

Replicate the state root when constructing the trace merkle tree from…

b22f827

… the root list

Merge the BS generic parameter into Client in Executor struct

9ccc995

Use the new best_hash instead of parent_hash when calling `intermedia…

be7a07c

…te_roots()` Using `parent_hash` is wrong because we need to call the api on top of the newly created best block to get the intermediate roots for this just executed block.

liuchengxu dismissed i1i1’s stale review via 81eeeca February 9, 2022 09:11

liuchengxu force-pushed the check-external-ER branch from 5363a50 to 81eeeca Compare February 9, 2022 09:11

Apply the suggstions from code review

872b1b4

liuchengxu force-pushed the check-external-ER branch from 81eeeca to 872b1b4 Compare February 9, 2022 09:18

i1i1 approved these changes Feb 9, 2022

View reviewed changes

nazar-pc approved these changes Feb 9, 2022

View reviewed changes

liuchengxu merged commit adffe34 into main Feb 9, 2022

liuchengxu deleted the check-external-ER branch February 9, 2022 16:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Check the execution receipt received from network properly #236

Check the execution receipt received from network properly #236

liuchengxu commented Jan 29, 2022 •

edited

Loading

nazar-pc left a comment

nazar-pc Jan 29, 2022

liuchengxu Jan 30, 2022

nazar-pc Jan 30, 2022

liuchengxu commented Feb 8, 2022

nazar-pc left a comment

nazar-pc Feb 9, 2022

liuchengxu Feb 9, 2022

nazar-pc Feb 9, 2022

nazar-pc Feb 9, 2022

liuchengxu Feb 9, 2022

		let mut to_delete_block_number = first_saved_receipt;
		while to_delete_block_number < new_first_saved_receipt {

		@@ -47,18 +59,28 @@ pub(super) fn write_execution_receipt<Backend: AuxStore, Block: BlockT>(
		new_first_saved_receipt = block_number.saturating_sub((PRUNING_DEPTH - 1).saturated_into());

Check the execution receipt received from network properly #236

Check the execution receipt received from network properly #236

Conversation

liuchengxu commented Jan 29, 2022 • edited Loading

nazar-pc left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liuchengxu commented Feb 8, 2022

nazar-pc left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liuchengxu commented Jan 29, 2022 •

edited

Loading