fix(consensus): equivocation detection + round-jump guard for order votes#727
Open
keanji-x wants to merge 1 commit into
Open
fix(consensus): equivocation detection + round-jump guard for order votes#727keanji-x wants to merge 1 commit into
keanji-x wants to merge 1 commit into
Conversation
…ump guard in process_order_vote_msg Closes #41 and #43 (gravity-audit). #41: PendingOrderVotes had no per-author tracking, so a Byzantine validator could submit order votes for multiple conflicting LedgerInfo digests in the same round and have its voting power counted in each bucket. Mirror the dedup pattern from PendingVotes: - Add `author_to_li_digest: HashMap<Author, HashValue>` to PendingOrderVotes. - In `insert_order_vote`, detect equivocation (same author, different digest) and return EquivocateVote with a SecurityEvent::ConsensusEquivocatingVote log. - Garbage-collect author entries alongside their digest entries. #43: process_order_vote_msg was the only message handler that didn't call ensure_round_and_sync_up, so a Byzantine validator could ship an OrderVoteMsg with a valid QC many rounds ahead of our local state, fast-forward our round via the embedded QC's side-effect, then have the attached order vote accepted for a round we never sequentially processed. Since OrderVoteMsg carries no SyncInfo, the minimal equivalent guard is to snapshot pre-state highest_ordered_round before the QC insertion and reject the order vote if it would jump that window by more than MAX_ORDER_VOTE_ROUND_JUMP. This is a slice of upstream aptos-core PR #14637 ("Sync up QC in order vote message"); we deliberately do NOT take the verified_quorum_cert type refactor, which conflicts heavily with our tree. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Minimal surgical fixes for two related gravity-audit findings in the order-vote path:
PendingOrderVotesnow tracksauthor -> LedgerInfo digestand detects equivocation, mirroringPendingVotes::insert_vote. A Byzantine validator can no longer split its voting power across conflicting ordering candidates.process_order_vote_msgnow snapshotshighest_ordered_roundbefore the embedded QC is inserted and rejects votes whose round jumps more thanMAX_ORDER_VOTE_ROUND_JUMPpast that snapshot. Closes the fast-forward window where a single valid QC could be used to land an order vote for a round we never sequentially processed.Why minimal (not a full backport of upstream #14637)
Upstream aptos-core PR #14637 covers both findings, but does so by reshaping
li_digest_to_votesinto a(QuorumCert, OrderVoteStatus)map and plumbingverified_quorum_cert: Option<QuorumCert>throughinsert_order_vote. That refactor conflicts on ~164 lines in our vendored consensus and changes call sites we'd then have to re-audit. This PR keeps the original types and only adds the security checks.Test plan
cargo check -p aptos-consensus --testspasses.MAX_ORDER_VOTE_ROUND_JUMPvalue is safe vs. legitimate validator sync flows.SecurityEvent::ConsensusEquivocatingVotechannel asPendingVotes.🤖 Generated with Claude Code