Merge branch 'devnet5-bump-leanmultisig' into devnet5-zk-alloc

Author: MegaRedHand

CLAUDE.md

@@ -254,7 +254,7 @@ actual_slot = finalized_slot + 1 + relative_index
 - Post-quantum signature scheme
 - 52-byte public keys, 3112-byte signatures
 - Epoch-based to prevent reuse
-- Aggregation via leanVM for efficiency
+- Aggregation via leanVM (previously leanMultisig) for efficiency
 
 **Signature Aggregation (Two-Phase):**
 1. **Gossip signatures**: Fresh XMSS from network → aggregate via leanVM

bin/ethlambda/src/main.rs

@@ -22,10 +22,12 @@ use std::{
     net::{IpAddr, SocketAddr},
     path::{Path, PathBuf},
     sync::Arc,
+    time::SystemTime,
 };
 use tokio_util::sync::CancellationToken;
 
 use clap::Parser;
+use ethlambda_blockchain::MILLISECONDS_PER_SLOT;
 use ethlambda_blockchain::key_manager::ValidatorKeyPair;
 use ethlambda_network_api::{InitBlockChain, InitP2P, ToBlockChainToP2PRef, ToP2PToBlockChainRef};
 use ethlambda_p2p::{Bootnode, P2P, PeerId, SwarmConfig, build_swarm, parse_enrs};
@@ -36,13 +38,16 @@ use ethlambda_types::{
     signature::ValidatorSecretKey,
     state::{State, ValidatorPubkeyBytes},
 };
+use eyre::WrapErr;
 use serde::Deserialize;
 use tracing::{error, info, warn};
 use tracing_subscriber::{EnvFilter, Layer, Registry, layer::SubscriberExt};
 
 use ethlambda_blockchain::BlockChain;
 use ethlambda_rpc::RpcConfig;
-use ethlambda_storage::{StorageBackend, Store, backend::RocksDBBackend};
+use ethlambda_storage::{
+    MAX_RESUMABLE_DB_STATE_AGE, StorageBackend, Store, backend::RocksDBBackend,
+};
 
 const ASCII_ART: &str = r#"
       _   _     _                 _         _
@@ -124,7 +129,8 @@ async fn main() -> eyre::Result<()> {
         .with_default_directive(tracing::Level::INFO.into())
         .from_env_lossy();
     let subscriber = Registry::default().with(tracing_subscriber::fmt::layer().with_filter(filter));
-    tracing::subscriber::set_global_default(subscriber).unwrap();
+    tracing::subscriber::set_global_default(subscriber)
+        .wrap_err("failed to set global tracing subscriber")?;
 
     let options = CliOptions::parse();
 
@@ -155,7 +161,12 @@ async fn main() -> eyre::Result<()> {
         return run_test_driver(rpc_config).await;
     }
 
-    let node_p2p_key = read_hex_file_bytes(&options.node_key);
+    let node_p2p_key = read_hex_file_bytes(&options.node_key).wrap_err_with(|| {
+        format!(
+            "failed to load node key from {}",
+            options.node_key.display()
+        )
+    })?;
     let p2p_socket = SocketAddr::new(IpAddr::from([0, 0, 0, 0]), options.gossipsub_port);
 
     #[cfg(all(not(target_env = "msvc"), not(feature = "zk-alloc")))]
@@ -182,17 +193,27 @@ async fn main() -> eyre::Result<()> {
     let validator_config = options.validator_config;
     let validator_keys_dir = options.hash_sig_keys_dir;
 
-    let config_yaml = std::fs::read_to_string(&config_path).expect("Failed to read config.yaml");
+    let config_yaml = std::fs::read_to_string(&config_path).wrap_err_with(|| {
+        format!(
+            "failed to read genesis config from {}",
+            config_path.display()
+        )
+    })?;
     let genesis_config: GenesisConfig =
-        serde_yaml_ng::from_str(&config_yaml).expect("Failed to parse config.yaml");
+        serde_yaml_ng::from_str(&config_yaml).wrap_err_with(|| {
+            format!(
+                "failed to parse genesis config from {}",
+                config_path.display()
+            )
+        })?;
 
     info!(
         genesis_time = genesis_config.genesis_time,
         validator_count = genesis_config.genesis_validators.len(),
         "Loaded genesis configuration"
     );
 
-    let validator_config_file = read_validator_config_file(&validator_config);
+    let validator_config_file = read_validator_config_file(&validator_config)?;
     let node_names = load_node_names(&validator_config_file);
 
     // Resolve attestation_committee_count: CLI flag > validator-config.yaml > 1.
@@ -212,17 +233,22 @@ async fn main() -> eyre::Result<()> {
     );
     ethlambda_blockchain::metrics::set_attestation_committee_count(attestation_committee_count);
 
-    let bootnodes = read_bootnodes(&bootnodes_path);
+    let bootnodes = read_bootnodes(&bootnodes_path)?;
 
     let validator_keys =
         read_validator_keys(&validators_path, &validator_keys_dir, &options.node_id)
-            .expect("Failed to load validator keys");
+            .wrap_err("failed to load validator keys")?;
 
     let data_dir =
         std::path::absolute(&options.data_dir).unwrap_or_else(|_| options.data_dir.clone());
     info!(data_dir = %data_dir.display(), "Initializing DB");
-    std::fs::create_dir_all(&data_dir).expect("Failed to create data directory");
-    let backend = Arc::new(RocksDBBackend::open(&data_dir).expect("Failed to open RocksDB"));
+    std::fs::create_dir_all(&data_dir)
+        .wrap_err_with(|| format!("failed to create data directory {}", data_dir.display()))?;
+    let backend = Arc::new(
+        RocksDBBackend::open(&data_dir)
+            .map_err(|err| eyre::eyre!("{err}"))
+            .wrap_err_with(|| format!("failed to open RocksDB at {}", data_dir.display()))?,
+    );
 
     let store = fetch_initial_state(
         options.checkpoint_sync_url.as_deref(),
@@ -260,7 +286,7 @@ async fn main() -> eyre::Result<()> {
         is_aggregator: options.is_aggregator,
         aggregate_subnet_ids: options.aggregate_subnet_ids,
     })
-    .expect("failed to build swarm");
+    .wrap_err("failed to build swarm")?;
 
     let p2p = P2P::spawn(built, store.clone(), node_names);
 
@@ -383,9 +409,20 @@ struct ValidatorConfigEntry {
     privkey: H256,
 }
 
-fn read_validator_config_file(path: impl AsRef<Path>) -> ValidatorConfigFile {
-    let yaml = std::fs::read_to_string(&path).expect("Failed to read validator config file");
-    serde_yaml_ng::from_str(&yaml).expect("Failed to parse validator config file")
+fn read_validator_config_file(path: impl AsRef<Path>) -> eyre::Result<ValidatorConfigFile> {
+    let path = path.as_ref();
+    let yaml = std::fs::read_to_string(path).wrap_err_with(|| {
+        format!(
+            "failed to read validator config file from {}",
+            path.display()
+        )
+    })?;
+    serde_yaml_ng::from_str(&yaml).wrap_err_with(|| {
+        format!(
+            "failed to parse validator config file from {}",
+            path.display()
+        )
+    })
 }
 
 fn load_node_names(file: &ValidatorConfigFile) -> HashMap<PeerId, String> {
@@ -398,12 +435,21 @@ fn load_node_names(file: &ValidatorConfigFile) -> HashMap<PeerId, String> {
     ethlambda_p2p::derive_peer_ids(names_and_privkeys)
 }
 
-fn read_bootnodes(bootnodes_path: impl AsRef<Path>) -> Vec<Bootnode> {
-    let bootnodes_yaml =
-        std::fs::read_to_string(bootnodes_path).expect("Failed to read bootnodes file");
-    let enrs: Vec<String> =
-        serde_yaml_ng::from_str(&bootnodes_yaml).expect("Failed to parse bootnodes file");
-    parse_enrs(enrs)
+fn read_bootnodes(bootnodes_path: impl AsRef<Path>) -> eyre::Result<Vec<Bootnode>> {
+    let bootnodes_path = bootnodes_path.as_ref();
+    let bootnodes_yaml = std::fs::read_to_string(bootnodes_path).wrap_err_with(|| {
+        format!(
+            "failed to read bootnodes file from {}",
+            bootnodes_path.display()
+        )
+    })?;
+    let enrs: Vec<String> = serde_yaml_ng::from_str(&bootnodes_yaml).wrap_err_with(|| {
+        format!(
+            "failed to parse bootnodes file from {}",
+            bootnodes_path.display()
+        )
+    })?;
+    Ok(parse_enrs(enrs))
 }
 
 /// One entry in `annotated_validators.yaml` as emitted by `lean-quickstart`'s
@@ -476,18 +522,26 @@ fn read_validator_keys(
     validators_path: impl AsRef<Path>,
     validator_keys_dir: impl AsRef<Path>,
     node_id: &str,
-) -> Result<HashMap<u64, ValidatorKeyPair>, String> {
+) -> eyre::Result<HashMap<u64, ValidatorKeyPair>> {
     let validators_path = validators_path.as_ref();
     let validator_keys_dir = validator_keys_dir.as_ref();
-    let validators_yaml = std::fs::read_to_string(validators_path)
-        .map_err(|err| format!("Failed to read validators file: {err}"))?;
+    let validators_yaml = std::fs::read_to_string(validators_path).wrap_err_with(|| {
+        format!(
+            "failed to read validators file from {}",
+            validators_path.display()
+        )
+    })?;
     let validator_infos: BTreeMap<String, Vec<AnnotatedValidator>> =
-        serde_yaml_ng::from_str(&validators_yaml)
-            .map_err(|err| format!("Failed to parse validators file: {err}"))?;
+        serde_yaml_ng::from_str(&validators_yaml).wrap_err_with(|| {
+            format!(
+                "failed to parse validators file from {}",
+                validators_path.display()
+            )
+        })?;
 
     let validator_vec = validator_infos
         .get(node_id)
-        .ok_or_else(|| format!("Node ID '{node_id}' not found in validators config"))?;
+        .ok_or_else(|| eyre::eyre!("node ID '{node_id}' not found in validators config"))?;
 
     let resolve_path = |file: &Path| -> PathBuf {
         if file.is_absolute() {
@@ -500,41 +554,34 @@ fn read_validator_keys(
     // Group entries per validator index, routing each to its role slot.
     let mut grouped: BTreeMap<u64, RoleSlots> = BTreeMap::new();
     for entry in validator_vec {
-        let role = classify_role(&entry.privkey_file)?;
+        let role = classify_role(&entry.privkey_file).map_err(eyre::Report::msg)?;
         let path = resolve_path(&entry.privkey_file);
         let slots = grouped.entry(entry.index).or_default();
         let target = match role {
             ValidatorKeyRole::Attestation => &mut slots.attestation,
             ValidatorKeyRole::Proposal => &mut slots.proposal,
         };
         if target.is_some() {
-            return Err(format!(
-                "validator {}: duplicate {role:?} entry",
-                entry.index
-            ));
+            eyre::bail!("validator {}: duplicate {role:?} entry", entry.index);
         }
         *target = Some(path);
     }
 
-    let load_key = |path: &Path, purpose: &str| -> Result<ValidatorSecretKey, String> {
-        let bytes = std::fs::read(path).map_err(|err| {
-            format!(
-                "Failed to read {purpose} key file {}: {err}",
-                path.display()
-            )
-        })?;
+    let load_key = |path: &Path, purpose: &str| -> eyre::Result<ValidatorSecretKey> {
+        let bytes = std::fs::read(path)
+            .wrap_err_with(|| format!("failed to read {purpose} key file {}", path.display()))?;
         ValidatorSecretKey::from_bytes(&bytes)
-            .map_err(|err| format!("Failed to parse {purpose} key {}: {err:?}", path.display()))
+            .map_err(|err| eyre::eyre!("failed to parse {purpose} key {}: {err:?}", path.display()))
     };
 
     let mut validator_keys = HashMap::new();
     for (idx, slots) in grouped {
         let att_path = slots
             .attestation
-            .ok_or_else(|| format!("validator {idx}: missing attester entry"))?;
+            .ok_or_else(|| eyre::eyre!("validator {idx}: missing attester entry"))?;
         let prop_path = slots
             .proposal
-            .ok_or_else(|| format!("validator {idx}: missing proposer entry"))?;
+            .ok_or_else(|| eyre::eyre!("validator {idx}: missing proposer entry"))?;
 
         info!(
             %node_id,
@@ -565,20 +612,13 @@ fn read_validator_keys(
     Ok(validator_keys)
 }
 
-fn read_hex_file_bytes(path: impl AsRef<Path>) -> Vec<u8> {
+fn read_hex_file_bytes(path: impl AsRef<Path>) -> eyre::Result<Vec<u8>> {
     let path = path.as_ref();
-    let Ok(file_content) = std::fs::read_to_string(path)
-        .inspect_err(|err| error!(file=%path.display(), %err, "Failed to read hex file"))
-    else {
-        std::process::exit(1);
-    };
+    let file_content = std::fs::read_to_string(path)
+        .wrap_err_with(|| format!("failed to read hex file from {}", path.display()))?;
     let hex_string = file_content.trim().trim_start_matches("0x");
-    let Ok(bytes) = hex::decode(hex_string)
-        .inspect_err(|err| error!(file=%path.display(), %err, "Failed to decode hex file"))
-    else {
-        std::process::exit(1);
-    };
-    bytes
+    hex::decode(hex_string)
+        .wrap_err_with(|| format!("failed to decode hex file from {}", path.display()))
 }
 
 /// Fetch the initial state for the node.
@@ -617,6 +657,30 @@ async fn fetch_initial_state(
     };
 
     // Checkpoint sync path
+
+    // Prefer resuming from a fresh on-disk state to avoid re-downloading what we already have.
+    if let Some(store) = Store::from_db_state(backend.clone(), genesis.genesis_time) {
+        let now_ms = SystemTime::UNIX_EPOCH
+            .elapsed()
+            .expect("already past the unix epoch")
+            .as_millis() as u64;
+        let current_slot =
+            now_ms.saturating_sub(genesis.genesis_time * 1000) / MILLISECONDS_PER_SLOT;
+        let finalized_slot = store.latest_finalized().slot;
+        let gap = current_slot.saturating_sub(finalized_slot);
+        if gap <= MAX_RESUMABLE_DB_STATE_AGE {
+            info!(
+                finalized_slot,
+                current_slot, gap, "Resuming from existing DB state"
+            );
+            return Ok(store);
+        }
+        warn!(
+            finalized_slot,
+            current_slot, gap, "Existing DB state is stale; falling through to checkpoint sync"
+        );
+    }
+
     info!(%checkpoint_url, "Starting checkpoint sync");
 
     // The state and block are fetched in parallel; if the peer advances

crates/blockchain/src/block_builder.rs

@@ -364,10 +364,14 @@ fn score_entry(
     let total = prior_count + new_voters.len();
     let crosses_2_3 = 3 * total >= 2 * validator_count;
 
-    // 3SF-mini finalization requires no slot strictly between source.slot
-    // and target.slot to still be justifiable (so source and target are
-    // consecutive justified checkpoints in the projected post-state).
+    // 3SF-mini finalization requires the source to lie past the finalized
+    // boundary (a source at or behind it is already final and must not
+    // re-finalize) and no slot strictly between source.slot and target.slot to
+    // still be justifiable (so source and target are consecutive justified
+    // checkpoints in the projected post-state). Mirrors `try_finalize` in the
+    // state transition.
     let finalizes = crosses_2_3
+        && att_data.source.slot > projected_finalized_slot
         && (att_data.source.slot + 1..att_data.target.slot)
             .all(|s| !slot_is_justifiable_after(s, projected_finalized_slot));
 
@@ -683,6 +687,52 @@ mod tests {
         bits
     }
 
+    /// Regression (leanSpec #802): a supermajority entry whose source sits at
+    /// the finalized boundary must be scored `Justify`, not `Finalize`. Such a
+    /// source is already final, so it advances nothing; the empty scan range
+    /// `(source.slot + 1..target.slot)` would otherwise make `.all(...)`
+    /// vacuously true and mis-tier the entry as a finalizer.
+    #[test]
+    fn score_entry_does_not_finalize_source_at_boundary() {
+        const NUM_VALIDATORS: usize = 4;
+        const FINALIZED_SLOT: u64 = 4;
+
+        // Source at the finalized boundary, target one slot ahead (empty scan).
+        let att_data = AttestationData {
+            slot: 7,
+            head: Checkpoint {
+                slot: 5,
+                root: H256([5u8; 32]),
+            },
+            target: Checkpoint {
+                slot: 5,
+                root: H256([5u8; 32]),
+            },
+            source: Checkpoint {
+                slot: FINALIZED_SLOT,
+                root: H256([4u8; 32]),
+            },
+        };
+
+        // Supermajority (3 of 4) so the entry crosses 2/3.
+        let proofs = vec![TypeOneMultiSignature::empty(make_bits(&[0, 1, 2]))];
+
+        let (score, _) = score_entry(
+            &att_data,
+            &proofs,
+            &HashMap::new(),
+            FINALIZED_SLOT,
+            NUM_VALIDATORS,
+        )
+        .expect("entry contributes new voters");
+
+        assert_eq!(
+            score.tier,
+            Tier::Justify,
+            "source at the finalized boundary must justify, not finalize"
+        );
+    }
+
     /// Regression test for https://github.com/lambdaclass/ethlambda/issues/259
     ///
     /// Simulates a stall scenario by populating the payload pool with 50