fix: fix start trusted set #58
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
1. Aligns the skip with the verifier’s actual trusted set.
In Tendermint light-client semantics the block you trust at height h carries forward the validator set for height h+1. When verifier evaluates the next header, it compares the commit against that next_validators set.
If the skip samples validators from height h instead of h+1, it can approve a transition that the verifier will reject, because the verifier never considers the height h set.
See the light client verifier code here.
2. Filter non-commit votes.
A commit’s voting power is defined only by signatures with
BlockIdFlag::Commit.BlockIdFlagAbsentandBlockIdFlagNilvotes don’t contribute. If the skip counts every signature including nil or absent, the tallied power can appear to hit 2/3 even though fewer than 2/3 of validators actually signed the block which will cause the verifier to later rejects it withNotEnoughTrusterror and panic.3. Check threshold for trusted validators
The original loop didn't compare the threshold against the trusted validator set's voting power.
The function still returned true as long as enough of the target set happened to be in the old validator set which causes the verifier to later rejects it with
NotEnoughTrusterror and panic.