apollo_consensus_orchestrator: add SNIP-35 proposer-validator symmetry tests

Author: sirandreww-starkware

Cargo.lock

@@ -77,6 +77,8 @@ metrics-exporter-prometheus.workspace = true
 mockall.workspace = true
 mockito.workspace = true
 num-bigint.workspace = true
+rand.workspace = true
+rand_chacha.workspace = true
 rstest.workspace = true
 serde_json.workspace = true
 

crates/apollo_consensus_orchestrator/Cargo.toml

@@ -816,7 +816,7 @@ impl ConsensusContext for SequencerConsensusContext {
                         .map(GasPrice)
                         .unwrap_or(self.l2_gas_price),
                     starknet_version: StarknetVersion::LATEST,
-                    fee_actual: self.compute_fee_actual(),
+                    fee_actual: compute_fee_actual(&self.fee_proposals_window, init.height),
                 };
                 self.validate_current_round_proposal(
                     init,
@@ -1086,7 +1086,7 @@ impl ConsensusContext for SequencerConsensusContext {
                 .map(GasPrice)
                 .unwrap_or(self.l2_gas_price),
             starknet_version: StarknetVersion::LATEST,
-            fee_actual: self.compute_fee_actual(),
+            fee_actual: compute_fee_actual(&self.fee_proposals_window, init.height),
         };
         self.validate_current_round_proposal(
             init,

crates/apollo_consensus_orchestrator/src/sequencer_consensus_context.rs

@@ -1,5 +1,7 @@
 use std::collections::BTreeMap;
 
+use rand::{Rng, SeedableRng};
+use rand_chacha::ChaCha8Rng;
 use rstest::rstest;
 use starknet_api::block::{BlockNumber, GasPrice};
 
@@ -8,6 +10,11 @@ use crate::snip35::{
     compute_fee_proposal,
     compute_fee_target,
     FeeProposalInfo,
+    FEE_PROPOSAL_MARGIN_PPT,
+    ORACLE_L2_GAS_FLOOR_MAX_FRI,
+    ORACLE_L2_GAS_FLOOR_MIN_FRI,
+    PPT_DENOMINATOR,
+    TARGET_ATTO_USD_PER_L2_GAS,
 };
 
 #[test]
@@ -149,8 +156,8 @@ fn test_compute_fee_proposal(
 #[test]
 fn test_compute_fee_actual_u128_max_does_not_overflow() {
     // Naive (a+b)/2 would overflow when a and b are near u128::MAX.
-    let proposals = vec![GasPrice(u128::MAX); 10];
-    assert_eq!(compute_fee_actual(&proposals, 10), Some(GasPrice(u128::MAX)));
+    let window = window_from((0u64..10).map(|h| (h, Some(GasPrice(u128::MAX)))));
+    assert_eq!(compute_fee_actual(&window, BlockNumber(10)), Some(GasPrice(u128::MAX)));
 }
 
 #[test]
@@ -183,7 +190,62 @@ fn test_compute_fee_target_monotonic_in_strk_price() {
 #[test]
 fn test_compute_fee_actual_lone_adversary_cannot_skew_median() {
     // With 9 honest values and 1 outlier, median resists the adversary.
-    let mut window = vec![GasPrice(1_000_000); 9];
-    window.push(GasPrice(u128::MAX / 2));
-    assert_eq!(compute_fee_actual(&window, 10), Some(GasPrice(1_000_000)));
+    let window = window_from(
+        (0u64..9)
+            .map(|h| (h, Some(GasPrice(1_000_000))))
+            .chain(std::iter::once((9u64, Some(GasPrice(u128::MAX / 2))))),
+    );
+    assert_eq!(compute_fee_actual(&window, BlockNumber(10)), Some(GasPrice(1_000_000)));
+}
+
+/// The validator's accept predicate. Must stay in sync with
+/// `validate_proposal::is_proposal_init_valid` SNIP-35 bounds check.
+fn validator_accepts(fee_actual: GasPrice, fee_proposal: GasPrice, margin_ppt: u128) -> bool {
+    let lower = fee_actual.0.saturating_mul(PPT_DENOMINATOR) / (PPT_DENOMINATOR + margin_ppt);
+    let upper = fee_actual.0.saturating_mul(PPT_DENOMINATOR + margin_ppt) / PPT_DENOMINATOR;
+    fee_proposal.0 >= lower && fee_proposal.0 <= upper
+}
+
+#[test]
+fn test_malicious_high_fee_proposal_rejected() {
+    // Upper bound for fee_actual=1_000_000 with margin=2ppt is 1_002_000.
+    let fee_actual = GasPrice(1_000_000);
+    assert!(validator_accepts(fee_actual, GasPrice(1_002_000), 2));
+    for proposal in [1_002_001u128, 1_003_000, 2_000_000, u128::MAX] {
+        assert!(!validator_accepts(fee_actual, GasPrice(proposal), 2), "accepted {proposal}");
+    }
+}
+
+#[test]
+fn test_malicious_low_fee_proposal_rejected() {
+    // Lower bound for fee_actual=1_000_000 with margin=2ppt is 998_003.
+    let fee_actual = GasPrice(1_000_000);
+    assert!(validator_accepts(fee_actual, GasPrice(998_003), 2));
+    for proposal in [998_002u128, 500_000, 1, 0] {
+        assert!(!validator_accepts(fee_actual, GasPrice(proposal), 2), "accepted {proposal}");
+    }
+}
+
+#[test]
+fn test_honest_proposer_always_passes_validation_fuzzed() {
+    // Consensus safety: whatever compute_fee_proposal produces, the validator accepts.
+    let mut rng = ChaCha8Rng::seed_from_u64(0xDEADBEEF);
+    for _ in 0..10_000 {
+        let fee_actual_value = rng.gen_range(1u128..1_000_000_000_000_000_000);
+        let strk_usd_rate = rng.gen_range(1u128..2 * 10u128.pow(18));
+        let fee_actual = GasPrice(fee_actual_value);
+        let target = compute_fee_target(
+            TARGET_ATTO_USD_PER_L2_GAS,
+            strk_usd_rate,
+            ORACLE_L2_GAS_FLOOR_MIN_FRI,
+            ORACLE_L2_GAS_FLOOR_MAX_FRI,
+        );
+        let oracle_result = if rng.gen_bool(0.1) { None } else { Some(target) };
+        let proposal = compute_fee_proposal(oracle_result, fee_actual, FEE_PROPOSAL_MARGIN_PPT);
+        assert!(
+            validator_accepts(fee_actual, proposal, FEE_PROPOSAL_MARGIN_PPT),
+            "fee_actual={fee_actual_value} rate={strk_usd_rate} proposal={}",
+            proposal.0
+        );
+    }
 }