Optimization: evaluate js-libp2p gossipsub instead of hand-rolled SWIM gossip (inc-2a re-implemented its native auth/peer-scoring)

[jhfnetboy]

Problem

The DVT gossip layer (src/modules/gossip/gossip.service.ts) is a hand-rolled SWIM (heartbeat / suspicion / cleanup) over raw WebSocket, plus a bespoke co-sign transport. Rule ② inc-2a spent 5 Codex review rounds hardening heartbeat authentication, peer/DoS rate-limiting, Sybil gating, and replay protection — all of which are native features of mature gossip libraries. We are reinventing the wheel on a security-critical path.

Industry solutions researched

Option	What it gives us for free	Fit
js-libp2p + @chainsafe/libp2p-gossipsub	Message signing + validation (= our heartbeat BLS auth), peer scoring (= our per-conn/global verify budgets + Sybil gating), mesh construction, flood/dedup, WebSocket transport. v1.1, actively maintained (release within 3 months, updated Jun 2026). Used by every Ethereum consensus client (Lighthouse/Prysm/Teku/Nimbus).	★★★ DVT is an Ethereum-adjacent BLS validator network — same ecosystem, same threat model
HashiCorp memberlist / Serf (Go, SWIM)	Canonical SWIM: indirect probing, incarnation numbers, Lifeguard anti-flap.	✗ Go, not Node; would need a JS port
swim-js / @swim	SWIM membership in JS	△ less maintained than libp2p

What inc-2a re-implemented that gossipsub provides natively

• Heartbeat BLS signature + keccak256(EIP-2537(pubkey))==nodeId binding → gossipsub signed messages + peer identity.
• Per-connection + fleet-scaled global verify budget, ledger cap, Sybil registration-gating → gossipsub peer scoring (gossip/publish/graylist thresholds).
• Monotonic anti-replay, domain-separation tag → gossipsub message-id dedup + validation.

Recommendation

Evaluate migrating the gossip layer to js-libp2p + gossipsub (spike, then decide):

• Pros: battle-tested on the exact threat model, deletes hundreds of lines of security-critical hand-rolled code, interop, active maintenance.
• Cons: heavier dependency tree; the DVT co-sign transport + offline liveness ledger would be re-modelled as gossipsub topics + application message handlers; migration + re-test cost; must confirm the WebSocket-over-cloudflared transport works under libp2p.
• Lighter alternative if a full libp2p migration is too heavy: adopt memberlist-style SWIM improvements (indirect probing, incarnation numbers, Lifeguard) on the current transport.

Suggested next step

A time-boxed spike: stand up a 3-node @chainsafe/libp2p-gossipsub mesh with WebSocket transport, publish/subscribe a "heartbeat" + "slash-cosign" topic, and confirm peer scoring + signed messages replace the inc-2a hand-rolled auth. Compare against the current gossip before committing to a migration.

Filed from the rule ② inc-2a work (PR #195), where the hand-rolled heartbeat auth needed 5 adversarial-review rounds — strong signal we should lean on gossipsub instead.

Refs: https://github.com/ChainSafe/js-libp2p-gossipsub · https://www.npmjs.com/package/@chainsafe/libp2p-gossipsub · https://github.com/libp2p/specs/blob/master/pubsub/gossipsub/gossipsub-v1.1.md