Skip to content
Open
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions beacon_node/beacon_chain/src/beacon_chain.rs
Original file line number Diff line number Diff line change
Expand Up @@ -6553,6 +6553,24 @@ impl<T: BeaconChainTypes> BeaconChain<T> {
}
}

/// This function provides safe and efficient multi-threaded access to the beacon proposer cache.
///
/// The arguments are:
///
/// - `shuffling_decision_block`: The block root of the decision block for the desired proposer
/// shuffling. This should be computed using one of the methods for computing proposer
/// shuffling decision roots, e.g. `BeaconState::proposer_shuffling_decision_root_at_epoch`.
/// - `proposal_epoch`: The epoch at which the proposer shuffling is required.
/// - `accessor`: A closure to run against the proposers for the selected epoch. Usually this
/// closure just grabs a single proposer, or takes the vec of proposers for the epoch.
/// - `state_provider`: A closure to compute a state suitable for determining the shuffling.
/// This closure is evaluated lazily ONLY in the case
///
/// This function makes use of closures in order to efficiently handle concurrent accesses to
/// the cache.
///
/// The error type is polymorphic, if in doubt you can use `BeaconChainError`. You might need
/// to use a turbofish if type inference can't work it out.
pub fn with_proposer_cache<V, E: From<BeaconChainError> + From<BeaconStateError>>(
&self,
shuffling_decision_block: Hash256,
Expand Down
5 changes: 3 additions & 2 deletions beacon_node/beacon_chain/src/beacon_proposer_cache.rs
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ use smallvec::SmallVec;
use state_processing::state_advance::partial_state_advance;
use std::num::NonZeroUsize;
use std::sync::Arc;
use tracing::instrument;
use types::non_zero_usize::new_non_zero_usize;
use types::{
BeaconState, BeaconStateError, ChainSpec, Epoch, EthSpec, Fork, Hash256, Slot, Unsigned,
Expand Down Expand Up @@ -199,8 +200,7 @@ pub fn compute_proposer_duties_from_head<T: BeaconChainTypes>(
.map_err(BeaconChainError::from)?;

let dependent_root = state
// The only block which decides its own shuffling is the genesis block.
.proposer_shuffling_decision_root(chain.genesis_block_root, &chain.spec)
.proposer_shuffling_decision_root(head_block_root, &chain.spec)
.map_err(BeaconChainError::from)?;

Ok((indices, dependent_root, execution_status, state.fork()))
Expand All @@ -214,6 +214,7 @@ pub fn compute_proposer_duties_from_head<T: BeaconChainTypes>(
/// - No-op if `state.current_epoch() == target_epoch`.
/// - It must be the case that `state.canonical_root() == state_root`, but this function will not
/// check that.
#[instrument(skip_all, fields(?state_root, %target_epoch, state_slot = %state.slot()), level = "debug")]
pub fn ensure_state_can_determine_proposers_for_epoch<E: EthSpec>(
state: &mut BeaconState<E>,
state_root: Hash256,
Expand Down
2 changes: 0 additions & 2 deletions beacon_node/beacon_chain/src/block_verification.rs
Original file line number Diff line number Diff line change
Expand Up @@ -950,8 +950,6 @@ impl<T: BeaconChainTypes> GossipVerifiedBlock<T> {
let proposer_shuffling_decision_block =
parent_block.proposer_shuffling_root_for_child_block(block_epoch, &chain.spec);

// We assign to a variable instead of using `if let Some` directly to ensure we drop the
// write lock before trying to acquire it again in the `else` clause.
let block_slot = block.slot();
let mut opt_parent = None;
let proposer = chain.with_proposer_cache::<_, BlockError>(
Expand Down
21 changes: 18 additions & 3 deletions beacon_node/beacon_chain/tests/store_tests.rs
Original file line number Diff line number Diff line change
Expand Up @@ -1273,19 +1273,34 @@ async fn proposer_shuffling_root_consistency_test(
#[tokio::test]
async fn proposer_shuffling_root_consistency_same_epoch() {
let spec = test_spec::<E>();
proposer_shuffling_root_consistency_test(spec, 32, 39).await;
proposer_shuffling_root_consistency_test(
spec,
4 * E::slots_per_epoch(),
5 * E::slots_per_epoch() - 1,
)
.await;
}

#[tokio::test]
async fn proposer_shuffling_root_consistency_next_epoch() {
let spec = test_spec::<E>();
proposer_shuffling_root_consistency_test(spec, 32, 47).await;
proposer_shuffling_root_consistency_test(
spec,
4 * E::slots_per_epoch(),
6 * E::slots_per_epoch() - 1,
)
.await;
}

#[tokio::test]
async fn proposer_shuffling_root_consistency_two_epochs() {
let spec = test_spec::<E>();
proposer_shuffling_root_consistency_test(spec, 32, 55).await;
proposer_shuffling_root_consistency_test(
spec,
4 * E::slots_per_epoch(),
7 * E::slots_per_epoch() - 1,
)
.await;
}

#[tokio::test]
Expand Down
17 changes: 9 additions & 8 deletions beacon_node/http_api/src/proposer_duties.rs
Original file line number Diff line number Diff line change
Expand Up @@ -103,14 +103,6 @@ fn try_proposer_duties_from_cache<T: BeaconChainTypes>(
let head_block = &head.snapshot.beacon_block;
let head_block_root = head.head_block_root();
let head_epoch = head_block.slot().epoch(T::EthSpec::slots_per_epoch());
let head_decision_root = head
.snapshot
.beacon_state
.proposer_shuffling_decision_root(head_block_root, &chain.spec)
.map_err(warp_utils::reject::beacon_state_error)?;
let execution_optimistic = chain
.is_optimistic_or_invalid_head_block(head_block)
.map_err(warp_utils::reject::unhandled_error)?;

// This code path can't handle requests for past epochs.
if head_epoch > request_epoch {
Expand All @@ -119,6 +111,15 @@ fn try_proposer_duties_from_cache<T: BeaconChainTypes>(
)));
}

let head_decision_root = head
.snapshot
.beacon_state
.proposer_shuffling_decision_root_at_epoch(request_epoch, head_block_root, &chain.spec)
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We had regressed here (in 8101) when I removed this code:

let dependent_root = match head_epoch.cmp(&request_epoch) {
// head_epoch == request_epoch
Ordering::Equal => head_decision_root,
// head_epoch < request_epoch
Ordering::Less => head_block_root,
// head_epoch > request_epoch
Ordering::Greater => {
return Err(warp_utils::reject::custom_server_error(format!(
"head epoch {} is later than request epoch {}",
head_epoch, request_epoch
)))
}
};

My intent was to replace the manual calculation of the dependent root with the unified proposer_shuffling_decision_root_at_epoch function, but I mistakenly kept using the proposer_shuffling_decision_root function which computes the decision root for the state's current epoch. At epoch boundaries, this codepath could be called with request_epoch == head_epoch + 1, in which case proposer_shuffling_decision_root would be wrong (it would be the decision block for the current epoch instead of the next).

Using proposer_shuffling_decision_root_at_epoch fixes this, and is generic over pre-Fulu vs post-Fulu. It uses the request epoch to determine the decision slot, and then uses either the passed in head_block_root or state's block roots to compute the correct root.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The impact of this is that in v8.0.0-rc.0 we might return the wrong duties for an epoch, and put a nonsensical entry into the cache. This could lead to a block proposal failure in the worst case (the VC would make a request for a block when it isn't actually the proposer), which would be caught by the proposer index checks in produce_block (which are not buggy). If the same VC holds the key for the true proposer then it might miss the proposal for that true proposer.

I think this is low impact enough that it is OK not to delay v8.0.0-rc.0 over, although we should fix it soon!

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For this to return the wrong duties in practice requires that there be an entry for (current_epoch_decision_block_root, request_epoch) in the cache. This should not happen, unless there's another bug somewhere that would add a value for this pair to the cache. As far as I can tell, there isn't (need to check the state advance).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The other way we could end up with an entry for that key is if there's a long skip on an alternate chain using that shuffling. This is also quite unlikely, but I guess could be triggered intentionally by an attacker to force some LH proposers to fail proposing temporarily.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test added in 97da066. I confirmed that this test fails when reverting this change.

.map_err(warp_utils::reject::beacon_state_error)?;
let execution_optimistic = chain
.is_optimistic_or_invalid_head_block(head_block)
.map_err(warp_utils::reject::unhandled_error)?;

chain
.beacon_proposer_cache
.lock()
Expand Down
Loading