feat: slash truncated checkpoint proposals (#23250)

Fix A-520

Author: alexghr

spartan/aztec-node/templates/_pod-template.yaml

@@ -237,6 +237,10 @@ spec:
         - name: SLASH_INVALID_BLOCK_PENALTY
           value: {{ .Values.node.slash.invalidBlockPenalty | quote }}
         {{- end }}
+        {{- if .Values.node.slash.invalidCheckpointProposalPenalty }}
+        - name: SLASH_INVALID_CHECKPOINT_PROPOSAL_PENALTY
+          value: {{ .Values.node.slash.invalidCheckpointProposalPenalty | quote }}
+        {{- end }}
         {{- if .Values.node.slash.proposeInvalidAttestationsPenalty }}
         - name: SLASH_PROPOSE_INVALID_ATTESTATIONS_PENALTY
           value: {{ .Values.node.slash.proposeInvalidAttestationsPenalty | quote }}

spartan/aztec-node/values.yaml

@@ -152,6 +152,7 @@ node:
     inactivityPenalty: ""
     inactivityTargetPercentage: ""
     invalidBlockPenalty: ""
+    invalidCheckpointProposalPenalty: ""
     proposeInvalidAttestationsPenalty: ""
     attestDescendantOfInvalidPenalty: ""
     attestInvalidCheckpointProposalPenalty: ""

spartan/environments/network-defaults.yml

@@ -143,6 +143,8 @@ slasher: &slasher
   SLASH_UNKNOWN_PENALTY: 10e18
   # Penalty for broadcasting an invalid block.
   SLASH_INVALID_BLOCK_PENALTY: 10e18
+  # Penalty for broadcasting an invalid checkpoint proposal.
+  SLASH_INVALID_CHECKPOINT_PROPOSAL_PENALTY: 0
   # L2 slots grace period before considering an offense expired.
   SLASH_GRACE_PERIOD_L2_SLOTS: 0
 
@@ -247,6 +249,7 @@ networks:
     SLASH_ATTEST_INVALID_CHECKPOINT_PROPOSAL_PENALTY: 10e18
     SLASH_UNKNOWN_PENALTY: 10e18
     SLASH_INVALID_BLOCK_PENALTY: 10e18
+    SLASH_INVALID_CHECKPOINT_PROPOSAL_PENALTY: 0
     SLASH_GRACE_PERIOD_L2_SLOTS: 0
     ENABLE_VERSION_CHECK: true
 
@@ -293,6 +296,7 @@ networks:
     SLASH_ATTEST_INVALID_CHECKPOINT_PROPOSAL_PENALTY: 10e18
     SLASH_UNKNOWN_PENALTY: 10e18
     SLASH_INVALID_BLOCK_PENALTY: 10e18
+    SLASH_INVALID_CHECKPOINT_PROPOSAL_PENALTY: 0
     SLASH_GRACE_PERIOD_L2_SLOTS: 64
     ENABLE_VERSION_CHECK: true
 
@@ -353,4 +357,5 @@ networks:
     SLASH_ATTEST_INVALID_CHECKPOINT_PROPOSAL_PENALTY: 2000e18
     SLASH_UNKNOWN_PENALTY: 2000e18
     SLASH_INVALID_BLOCK_PENALTY: 2000e18
+    SLASH_INVALID_CHECKPOINT_PROPOSAL_PENALTY: 0
     SLASH_GRACE_PERIOD_L2_SLOTS: 1200

spartan/scripts/deploy_network.sh

@@ -595,6 +595,7 @@ SLASH_ATTEST_DESCENDANT_OF_INVALID_PENALTY = ${SLASH_ATTEST_DESCENDANT_OF_INVALI
 SLASH_ATTEST_INVALID_CHECKPOINT_PROPOSAL_PENALTY = ${SLASH_ATTEST_INVALID_CHECKPOINT_PROPOSAL_PENALTY:-null}
 SLASH_UNKNOWN_PENALTY = ${SLASH_UNKNOWN_PENALTY:-null}
 SLASH_INVALID_BLOCK_PENALTY = ${SLASH_INVALID_BLOCK_PENALTY:-null}
+SLASH_INVALID_CHECKPOINT_PROPOSAL_PENALTY = ${SLASH_INVALID_CHECKPOINT_PROPOSAL_PENALTY:-null}
 SLASH_OFFENSE_EXPIRATION_ROUNDS = ${SLASH_OFFENSE_EXPIRATION_ROUNDS:-null}
 SLASH_MAX_PAYLOAD_SIZE = ${SLASH_MAX_PAYLOAD_SIZE:-null}
 OTEL_COLLECTOR_ENDPOINT = "${OTEL_COLLECTOR_ENDPOINT}"

spartan/terraform/deploy-aztec-infra/main.tf

@@ -209,6 +209,7 @@ locals {
     "validator.slash.attestInvalidCheckpointProposalPenalty"       = var.SLASH_ATTEST_INVALID_CHECKPOINT_PROPOSAL_PENALTY
     "validator.slash.unknownPenalty"                              = var.SLASH_UNKNOWN_PENALTY
     "validator.slash.invalidBlockPenalty"                         = var.SLASH_INVALID_BLOCK_PENALTY
+    "validator.slash.invalidCheckpointProposalPenalty"             = var.SLASH_INVALID_CHECKPOINT_PROPOSAL_PENALTY
     "validator.slash.offenseExpirationRounds"                     = var.SLASH_OFFENSE_EXPIRATION_ROUNDS
     "validator.slash.maxPayloadSize"                              = var.SLASH_MAX_PAYLOAD_SIZE
     "validator.node.env.TRANSACTIONS_DISABLED"                    = var.TRANSACTIONS_DISABLED

spartan/terraform/deploy-aztec-infra/variables.tf

@@ -520,6 +520,12 @@ variable "SLASH_INVALID_BLOCK_PENALTY" {
   nullable    = true
 }
 
+variable "SLASH_INVALID_CHECKPOINT_PROPOSAL_PENALTY" {
+  description = "The slash invalid checkpoint proposal penalty"
+  type        = string
+  nullable    = true
+}
+
 variable "SLASH_OFFENSE_EXPIRATION_ROUNDS" {
   description = "The slash offense expiration rounds"
   type        = string

yarn-project/aztec-node/src/aztec-node/server.ts

@@ -42,6 +42,7 @@ import {
 import { PublicContractsDB, PublicProcessorFactory } from '@aztec/simulator/server';
 import {
   AttestationsBlockWatcher,
+  BroadcastedInvalidCheckpointProposalWatcher,
   EpochPruneWatcher,
   type SlasherClientInterface,
   type Watcher,
@@ -720,6 +721,7 @@ export class AztecNodeService implements AztecNode, AztecNodeAdmin, AztecNodeDeb
       let validatorsSentinel: Awaited<ReturnType<typeof createSentinel>> | undefined;
       let epochPruneWatcher: EpochPruneWatcher | undefined;
       let attestationsBlockWatcher: AttestationsBlockWatcher | undefined;
+      let broadcastedInvalidCheckpointProposalWatcher: BroadcastedInvalidCheckpointProposalWatcher | undefined;
 
       if (!proverOnly) {
         validatorsSentinel = await createSentinel(epochCache, archiver, p2pClient, config);
@@ -739,6 +741,15 @@ export class AztecNodeService implements AztecNode, AztecNodeAdmin, AztecNodeDeb
           watchers.push(epochPruneWatcher);
         }
 
+        if (config.slashBroadcastedInvalidCheckpointProposalPenalty > 0n) {
+          broadcastedInvalidCheckpointProposalWatcher = new BroadcastedInvalidCheckpointProposalWatcher(
+            p2pClient,
+            epochCache,
+            config,
+          );
+          watchers.push(broadcastedInvalidCheckpointProposalWatcher);
+        }
+
         // We assume we want to slash for invalid attestations unless all max penalties are set to 0
         if (config.slashProposeInvalidAttestationsPenalty > 0n || config.slashAttestDescendantOfInvalidPenalty > 0n) {
           attestationsBlockWatcher = new AttestationsBlockWatcher(archiver, epochCache, config);
@@ -762,6 +773,10 @@ export class AztecNodeService implements AztecNode, AztecNodeAdmin, AztecNodeDeb
             await attestationsBlockWatcher.start();
             started.push(attestationsBlockWatcher);
           }
+          if (broadcastedInvalidCheckpointProposalWatcher) {
+            await broadcastedInvalidCheckpointProposalWatcher.start();
+            started.push(broadcastedInvalidCheckpointProposalWatcher);
+          }
           log.info(`All p2p services started`);
         })
         .catch(err => log.error('Failed to start p2p services after archiver sync', err));