fix: v30 — sync cache attestation + cost-asymmetric DoS shield + identity-bound HealthPing

ROOT CAUSES (post-v29 forensic on live testnet)
1) Empty-batch sync feedback loop: handle_blocks_batch attributed the requested
   to_height to the sender's last_block_height even when zero blocks were
   returned. Fresh genesis cluster locked into permanent SYNC mode at a phantom
   1600 ceiling, never producing the first block.
2) Cost-asymmetric DoS: an external impersonator could spend ~100 bytes/req
   firing forged dilithium handshake_proof at QUIC :10876 while the receiver
   paid TLS state + ~3.3 KB Dilithium parse + ML-DSA-65 verify per attempt.
3) HealthPing identity-squat: verify_health_ping_signature consumed the PK
   embedded in the message body. Any valid ML-DSA-65 keypair could sign
   QNET_HEALTH_PING_V1:genesis_node_001:<ts>:<h>, attach its own PK, and have
   a poisoned height accepted as authentic — the last identity-squat hole at
   the height-gossip layer.
4) /api/v1/peers was the single most-attractive enumeration / DoS target with
   no rate-limit, exhausting the warp accept queue under flood.

FIXES (all scale to hundreds of thousands of super-node identities)
A1  handle_blocks_batch attests max(actual block heights) only; empty batches
    refresh liveness without raising the cached height.
A2  get_max_peer_height + sync_blockchain_height require ≥ 2 attested peers
    before reporting a non-local network height; single-peer claims no longer
    steer sync. Initial sync target derives from this quorum-attested view.
A3  PeerInfo.last_height_attested_at TTL window (120 s). Height entries are
    accepted into network_height only when their attestation is fresh; stale
    or gossip-relayed (unauthenticated) values are excluded.
B1  Early IP-identity gate at handle_server_handshake — claimed
    genesis_node_NNN must originate from its pinned IPv4; registered super-
    node identity must match its on-chain NodeRegistration endpoint. Mismatch
    drops the connection before any Dilithium math is run. NODE_ENDPOINT_REGISTRY
    is populated by chain-applied NodeRegistration / NodeReactivation TX.
B2  Per-source-IP failed-handshake token bucket (20 fails / 60 s → 600 s
    cooldown). On the next attempt the IP is refused pre-TLS via
    incoming.refuse(). Genesis IPs are never banned. Sharded DashMap, O(1).
B3  /api/v1/peers gated through the existing check_api_rate_limit middleware.
C1  verify_health_ping_signature now resolves the verifying PK from
    CONSENSUS_PK_REGISTRY against `from` — message-supplied PK is ignored.
    Unknown identities are rejected outright.
C2  Audit of remaining identity-binding sites: VrfKeyAnnounce, BlockAttestation,
    EmptySlotAttestation, TimeoutVote already consult the registry. Mobile
    wallet/RPC paths are wallet-ownership proofs (separate domain) — left
    intact.

Scalability invariants preserved: every new lookup is O(1) DashMap (sharded,
lock-free); registry caps mirror existing CONSENSUS_PK_REGISTRY (100 K). No
hot-path scanning, no global locks, no protocol-message format changes
(wire compat with pre-v30 peers retained).

Validation: cargo check + lib tests, 147/147 pass, 0 regressions.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: AIQnetLab

development/qnet-integration/src/genesis_constants.rs

@@ -234,6 +234,73 @@ pub fn get_all_vrf_keys() -> HashMap<String, Vec<u8>> {
     VRF_PK_REGISTRY.read().clone()
 }
 
+// =========================================================================
+// v30.B1: NODE ENDPOINT REGISTRY — node_id → canonical IPv4 string.
+//
+// Closes the cost-asymmetric DoS where an attacker fires forged
+// handshake_proof at a victim's QUIC accept loop from any IP, forcing the
+// victim to pay TLS state + ~3.3 KB Dilithium parse per attempt. The early
+// IP-identity gate (in quic_transport.rs::handle_server_handshake) consults
+// this registry to refuse impersonation BEFORE the expensive verify step.
+//
+// Source of truth: signed NodeRegistration TX in chain state. Populated by
+// the block-apply path (cache_node_registrations_from_transactions_with_dashmap)
+// for super-node identities. Genesis identities resolve via the pinned
+// GENESIS_NODE_IPS table and do not go through this registry.
+//
+// Scalability: DashMap (sharded, lock-free O(1)). Sized for hundreds of
+// thousands of super-node identities; ~24 bytes overhead per entry.
+// =========================================================================
+
+use dashmap::DashMap;
+
+/// Capacity ceiling matches CONSENSUS_PK_REGISTRY (100K). Beyond this, eviction
+/// uses the LAST_ACTIVITY tracker that already governs PK registry eviction.
+const MAX_NODE_ENDPOINT_REGISTRY_SIZE: usize = 100_000;
+
+lazy_static::lazy_static! {
+    pub static ref NODE_ENDPOINT_REGISTRY: DashMap<String, String> = DashMap::new();
+}
+
+/// Strip an "ip:port" or "ip" endpoint to its IPv4/IPv6 part only.
+fn endpoint_ip_only(api_endpoint: &str) -> String {
+    // Accept "scheme://host:port" form too — strip scheme and trailing path.
+    let after_scheme = api_endpoint.split("://").nth(1).unwrap_or(api_endpoint);
+    let host_only = after_scheme.split('/').next().unwrap_or(after_scheme);
+    // IPv6 may use [::1]:8001 form; bracket-strip and split last colon.
+    if let Some(rest) = host_only.strip_prefix('[') {
+        if let Some(end) = rest.find(']') {
+            return rest[..end].to_string();
+        }
+    }
+    host_only.split(':').next().unwrap_or(host_only).to_string()
+}
+
+/// Register/refresh a node's canonical endpoint IP. Called on every
+/// NodeRegistration / NodeReactivation TX during block apply.
+pub fn register_node_endpoint(node_id: &str, api_endpoint: &str) {
+    let ip = endpoint_ip_only(api_endpoint);
+    if ip.is_empty() {
+        return;
+    }
+    if NODE_ENDPOINT_REGISTRY.len() >= MAX_NODE_ENDPOINT_REGISTRY_SIZE
+        && !NODE_ENDPOINT_REGISTRY.contains_key(node_id)
+    {
+        // At capacity — let LAST_ACTIVITY-driven eviction reclaim later.
+        if std::env::var("QNET_DETAILED_LOGGING").ok().as_deref() == Some("1") {
+            println!("[WARN][REG] endpoint_registry_full size={}", NODE_ENDPOINT_REGISTRY.len());
+        }
+        return;
+    }
+    NODE_ENDPOINT_REGISTRY.insert(node_id.to_string(), ip);
+}
+
+/// Lookup canonical endpoint IP for `node_id`. Returns None for unbound
+/// identities (first-contact / not-yet-registered super-nodes).
+pub fn get_node_endpoint_ip(node_id: &str) -> Option<String> {
+    NODE_ENDPOINT_REGISTRY.get(node_id).map(|e| e.value().clone())
+}
+
 // Optional genesis Dilithium anchor loader. If present, the file binds the
 // 5 genesis identities to fixed PKs via set_genesis_anchor_pks (immutable
 // once installed; any non-matching PK is rejected as a squat). Super-node

development/qnet-integration/src/node.rs

@@ -4678,11 +4678,15 @@ impl BlockchainNode {
                         node_id.clone(),
                         (node_type.clone(), wallet_address.clone(), api_endpoint.clone())
                     );
+                    // v30.B1: mirror endpoint IP into global registry for the
+                    // QUIC accept-path IP-identity gate. Chain-authenticated
+                    // (TX is signature-validated before this code path).
+                    crate::genesis_constants::register_node_endpoint(node_id, api_endpoint);
                     // Level 2: RocksDB persistent cache (forward + reverse index)
                     if let Err(e) = storage.save_node_registration(node_id, type_str, wallet_address, INITIAL_REPUTATION) {
                         eprintln!("[WARN][REG] cache_from_block_fail node={} err={}", node_id, e);
                     } else if is_info() {
-                        println!("[INFO][REG] cached_from_produced_block node={} wallet={}...", 
+                        println!("[INFO][REG] cached_from_produced_block node={} wallet={}...",
                                  node_id, &wallet_address[..wallet_address.len().min(16)]);
                     }
 

development/qnet-integration/src/quic_transport.rs

@@ -180,11 +180,160 @@ const MAX_CONNECTIONS_PER_IP_UNKNOWN: u32 = 10;
 
 /// v9.3: Check if IP belongs to a genesis node (compile-time known validators).
 fn is_genesis_ip(ip: &std::net::IpAddr) -> bool {
-    let ip_str = ip.to_string();
+    let ip_str = canonical_ip_str(ip);
     crate::genesis_constants::GENESIS_NODE_IPS.iter()
         .any(|(genesis_ip, _)| *genesis_ip == ip_str)
 }
 
+/// v30.B1: render `IpAddr` as the canonical dotted/colon string used by the
+/// pinned tables (IPv4-mapped IPv6 collapsed to IPv4). Without this an
+/// IPv4-mapped form (`::ffff:1.2.3.4`) would never match the IPv4 string in
+/// `GENESIS_NODE_IPS` and a legitimate IPv4 peer arriving over an IPv6
+/// socket would be falsely rejected by the IP-identity gate.
+#[inline]
+fn canonical_ip_str(ip: &std::net::IpAddr) -> String {
+    match ip {
+        std::net::IpAddr::V4(v4) => v4.to_string(),
+        std::net::IpAddr::V6(v6) => match v6.to_ipv4_mapped() {
+            Some(v4) => v4.to_string(),
+            None => v6.to_string(),
+        },
+    }
+}
+
+// ============================================================================
+// v30.B1/B2: cost-asymmetric DoS killer — early IP-identity gate + per-IP
+// failed-handshake token bucket.
+//
+// Attack model: attacker sends ~100-byte UDP datagrams to the QUIC accept
+// port; victim pays TLS state + ~3.3 KB Dilithium parse + ML-DSA-65 verify
+// per attempt. Without this gate a 5-6 pkt/s flood from a single IP costs
+// the receiver tens of thousands of Dilithium verifies per hour. With it
+// the attacker is refused before TLS handshake completes; CPU cost on the
+// receiver collapses to a single DashMap lookup + counter bump.
+//
+// Two independent layers:
+//   B1 (IP-identity gate): once the wire handshake is deserialised, the
+//       claimed node_id is checked against either the pinned genesis IP
+//       table OR the registered endpoint registry. Mismatch is conclusive
+//       impersonation evidence — drop without paying for Dilithium verify.
+//   B2 (per-IP fail bucket): every failed handshake from a non-genesis IP
+//       increments a sliding-window counter; on threshold breach the IP is
+//       refused at accept time for a cooldown period. Genesis IPs are
+//       NEVER banned (consensus path is privileged).
+//
+// Scalability: DashMap is sharded → O(1) under contention; ban entries are
+// ~40 bytes; even with a million unique attacker IPs total RAM stays under
+// 50 MB. Cleanup is implicit: window rollover + cooldown expiry are checked
+// inline, so stale entries clear themselves on next touch.
+// ============================================================================
+
+const HANDSHAKE_FAIL_WINDOW_SECS: u64 = 60;
+const HANDSHAKE_FAIL_THRESHOLD: u64 = 20;
+const HANDSHAKE_FAIL_BAN_SECS: u64 = 600;
+
+struct HandshakeFailState {
+    fail_count: AtomicU64,
+    window_start_secs: AtomicU64,
+    banned_until_secs: AtomicU64,
+}
+
+impl Default for HandshakeFailState {
+    fn default() -> Self {
+        Self {
+            fail_count: AtomicU64::new(0),
+            window_start_secs: AtomicU64::new(0),
+            banned_until_secs: AtomicU64::new(0),
+        }
+    }
+}
+
+static HANDSHAKE_FAIL_TRACKER: once_cell::sync::Lazy<
+    DashMap<std::net::IpAddr, HandshakeFailState>
+> = once_cell::sync::Lazy::new(DashMap::new);
+
+#[inline]
+fn unix_secs_now() -> u64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs()
+}
+
+/// True if `ip` is in active cooldown — caller refuses the connection
+/// before any TLS state is allocated. Genesis IPs always return false.
+fn is_handshake_ip_banned(ip: std::net::IpAddr) -> bool {
+    if is_genesis_ip(&ip) {
+        return false;
+    }
+    HANDSHAKE_FAIL_TRACKER
+        .get(&ip)
+        .map(|s| s.banned_until_secs.load(Ordering::Relaxed) > unix_secs_now())
+        .unwrap_or(false)
+}
+
+/// Record one failed handshake from `ip`. Window rollover and cooldown
+/// promotion happen inline. Genesis IPs are exempt.
+fn record_handshake_fail(ip: std::net::IpAddr) {
+    if is_genesis_ip(&ip) {
+        return;
+    }
+    let now = unix_secs_now();
+    let entry = HANDSHAKE_FAIL_TRACKER.entry(ip).or_default();
+    let window_start = entry.window_start_secs.load(Ordering::Relaxed);
+    if window_start == 0 || now.saturating_sub(window_start) > HANDSHAKE_FAIL_WINDOW_SECS {
+        entry.window_start_secs.store(now, Ordering::Relaxed);
+        entry.fail_count.store(1, Ordering::Relaxed);
+        return;
+    }
+    let new_count = entry.fail_count.fetch_add(1, Ordering::Relaxed) + 1;
+    if new_count >= HANDSHAKE_FAIL_THRESHOLD
+        && entry.banned_until_secs.load(Ordering::Relaxed) <= now
+    {
+        entry.banned_until_secs.store(now + HANDSHAKE_FAIL_BAN_SECS, Ordering::Relaxed);
+        if crate::node::is_warn() {
+            println!(
+                "[WARN][QUIC] ip_fail_ban ip={} fails={} window={}s cooldown={}s",
+                ip, new_count, HANDSHAKE_FAIL_WINDOW_SECS, HANDSHAKE_FAIL_BAN_SECS
+            );
+        }
+    }
+}
+
+/// Clear fail counter on a confirmed-successful handshake — promotes the
+/// IP back to clean state and removes any residual ban.
+fn clear_handshake_fail(ip: std::net::IpAddr) {
+    HANDSHAKE_FAIL_TRACKER.remove(&ip);
+}
+
+/// v30.B1: bind claimed node_id to allowed source IP. Returns true if the
+/// gate permits the connection to proceed to Dilithium verification.
+///
+///   * `genesis_node_NNN` MUST originate from its pinned IPv4 in
+///     `GENESIS_NODE_IPS` — the 5-entry table is the singular source of
+///     truth; any other source is impersonation.
+///   * Super-node identity present in `NODE_ENDPOINT_REGISTRY` MUST match
+///     the registered endpoint IP — populated by chain-authenticated
+///     NodeRegistration TX during block apply (O(1) DashMap).
+///   * Unbound identity (no registry record yet) is admitted: this is the
+///     first-contact / TOFV window where the peer is about to register via
+///     a signed VrfKeyAnnounce or NodeRegistration TX. The cryptographic
+///     floor (verify_handshake_proof) still gates everything they assert.
+fn ip_identity_gate(claimed_node_id: &str, peer_ip: std::net::IpAddr) -> bool {
+    let peer_ip_str = canonical_ip_str(&peer_ip);
+    if claimed_node_id.starts_with("genesis_node_") {
+        match crate::genesis_constants::genesis_ip_for_node_id(claimed_node_id) {
+            Some(expected) => expected == peer_ip_str,
+            None => false,
+        }
+    } else {
+        match crate::genesis_constants::get_node_endpoint_ip(claimed_node_id) {
+            Some(expected) => expected == peer_ip_str,
+            None => true,
+        }
+    }
+}
+
 /// v9.2: TOFU pin lifetime (24 hours). After this, the pin expires and re-pins
 /// on next connection. This handles cert rotation on rolling restarts:
 /// node restarts with new self-signed cert → peers accept after TTL expires.
@@ -890,6 +1039,19 @@ impl QuicTransport {
 
                 let peer_addr = incoming.remote_address();
 
+                // v30.B2: per-source-IP failed-handshake ban — refuse pre-TLS
+                // for IPs that crossed the fail threshold within the rolling
+                // window. Reclaims the TLS state + Dilithium parse cost an
+                // attacker would otherwise extract per packet. Genesis IPs
+                // are never banned by design (consensus must stay reachable).
+                if is_handshake_ip_banned(peer_addr.ip()) {
+                    incoming.refuse();
+                    if crate::node::is_debug() {
+                        println!("[DBG][QUIC] pre_tls_ip_banned ip={}", peer_addr.ip());
+                    }
+                    continue;
+                }
+
                 // FIX R23-P5: Global connection limit check BEFORE TLS handshake.
                 // Previously only checked post-handshake (line ~910), wasting TLS CPU.
                 const MAX_TOTAL_CONNECTIONS: usize = 500;
@@ -966,6 +1128,7 @@ impl QuicTransport {
                             Ok(Ok(connection)) => {
                                 let hs = Self::handle_server_handshake(
                                     &connection,
+                                    peer_addr,
                                     &node_id_clone,
                                     &cert_serial_clone,
                                     &node_type_clone
@@ -1131,35 +1294,55 @@ impl QuicTransport {
     /// v2.24: Added timeout to prevent hanging connections
     /// v9.7: Returns (node_id, cert_serial, node_type, block_height) — height enables
     /// immediate BEST_PEER_HEIGHT update instead of waiting 15s for first HealthPing.
+    /// v30.B1: `peer_addr` is now part of the signature — the early IP-identity
+    /// gate binds the claimed `node_id` to its registered source IP and rejects
+    /// impersonation before paying for the Dilithium verify (~3.3 KB parse +
+    /// ML-DSA-65 math). Any Err exit increments the per-IP fail counter so
+    /// repeat offenders trip the pre-TLS ban at the accept loop.
     async fn handle_server_handshake(
         conn: &Connection,
+        peer_addr: SocketAddr,
         our_node_id: &str,
         our_cert_serial: &str,
         our_node_type: &str,
     ) -> Result<(String, String, String, u64), String> {
         // v2.24: Timeout for entire handshake (prevents "aborted by peer" errors)
         let handshake_timeout = Duration::from_secs(CONNECT_TIMEOUT_SECS);
-        
-        tokio::time::timeout(handshake_timeout, async {
+
+        let result = tokio::time::timeout(handshake_timeout, async {
             // Accept bidirectional stream for handshake
             let (mut send, mut recv) = conn.accept_bi().await
                 .map_err(|e| format!("Accept stream failed: {}", e))?;
-            
+
             // Receive peer's handshake
             let mut len_buf = [0u8; 4];
             recv.read_exact(&mut len_buf).await.map_err(|e| format!("Read len failed: {}", e))?;
             let len = u32::from_be_bytes(len_buf) as usize;
-            
+
             if len > MAX_MESSAGE_SIZE {
                 return Err(format!("Handshake too large: {}", len));
             }
-            
+
             let mut data = vec![0u8; len];
             recv.read_exact(&mut data).await.map_err(|e| format!("Read data failed: {}", e))?;
-            
+
             // v9.7: Backward-compatible deserialization (supports pre-v9.7 nodes)
             let peer_handshake = deserialize_handshake(&data)?;
 
+            // v30.B1: early IP-identity gate. Reject impersonation BEFORE
+            // the ~ms Dilithium verify pass. Genesis identity from a non-
+            // pinned IP and registered super-node identity from a different
+            // IP than its on-chain endpoint are conclusively rejected.
+            if !ip_identity_gate(&peer_handshake.node_id, peer_addr.ip()) {
+                if crate::node::is_warn() {
+                    println!(
+                        "[WARN][HANDSHAKE] ip_identity_gate_reject side=server node={} src_ip={} action=close",
+                        peer_handshake.node_id, peer_addr.ip()
+                    );
+                }
+                return Err("ip_identity_gate_reject".to_string());
+            }
+
             // v19: Verify peer's Dilithium identity proof BEFORE sending ours.
             // On Err the connection is aborted — we never reveal our own proof
             // to a peer that supplied a bogus one. On Ok(false) we proceed
@@ -1175,6 +1358,20 @@ impl QuicTransport {
                         println!("[INFO][HANDSHAKE] dilithium_proof_verified side=server node={} h={}",
                                  peer_handshake.node_id, peer_handshake.block_height);
                     }
+                    // v30.A3: Dilithium-verified handshake binds (node_id, block_height)
+                    // as an authenticated tuple — attest peer height immediately so the
+                    // sync state machine sees real network state without waiting for the
+                    // first HealthPing tick. Non-zero heights only; h=0 leaves the
+                    // attestation unset so a fresh-cluster cold start does not falsely
+                    // declare consensus on "everyone at 0".
+                    if peer_handshake.block_height > 0 {
+                        if let Some(p2p) = crate::node::try_get_p2p() {
+                            p2p.update_peer_last_seen_with_height(
+                                &peer_handshake.node_id,
+                                Some(peer_handshake.block_height),
+                            );
+                        }
+                    }
                 }
                 Ok(false) => {
                     // v19.1: Advisory admit. Three causes possible (in order
@@ -1239,7 +1436,26 @@ impl QuicTransport {
 
             // v9.7: Return height from handshake for immediate BEST_PEER_HEIGHT update
             Ok((peer_handshake.node_id, peer_handshake.cert_serial, peer_handshake.node_type, peer_handshake.block_height))
-        }).await.map_err(|_| "Handshake timeout".to_string())?
+        }).await;
+
+        // v30.B2: account success/failure for the per-IP fail bucket. A
+        // verified handshake clears any residual ban; any error path (gate
+        // reject, proof reject, timeout, malformed wire) bumps the counter
+        // so a repeat offender trips the pre-TLS ban at the accept loop.
+        match result {
+            Ok(Ok(outcome)) => {
+                clear_handshake_fail(peer_addr.ip());
+                Ok(outcome)
+            }
+            Ok(Err(e)) => {
+                record_handshake_fail(peer_addr.ip());
+                Err(e)
+            }
+            Err(_) => {
+                record_handshake_fail(peer_addr.ip());
+                Err("Handshake timeout".to_string())
+            }
+        }
     }
 
     /// Handle incoming streams from a connection