Relayer: Cross-chain equivocation fishing #1493

Lederstrumpf · 2025-06-10T08:05:41Z

Implements cross-chain equivocation fishing by the relayer: fishes for both future block & fork equivocations and reports them.

Monitoring for submit_init calls on Ethereum:

If the commitment is to a block with height greater than what is finalized on the canonical relay chain, reports an equivocation via Beefy.report_future_block_voting.
If the commitment's mmr payload diverges from the mmr payload of the canonical relay chain block at height commitment.BlockNumber, reports an equivocation via Beefy.report_fork_voting.

Uses the mmr_generateAncestryProof method introduced in paritytech/polkadot-sdk#9295, so please review using the SDK PR's branch rhmb/add-generate-ancestry-proof-mmr-rpc-call.

To test with smoketest, first instantiate local testnet:

pushd $SNOWBRIDGE_ROOT
nix develop .
pushd ./web/packages/test/ && ./scripts/start-services.sh

Then run the smoketest malicious_payload, which crafts a malicious payload that is signed by at least one validator.

pushd $SNOWBRIDGE_ROOT
pushd ./smoketest
./make-bindings.sh
# either run only equivocation tests
cargo test --test malicious_payload -- --nocapture
# or run full test suite
./run-tests.sh

List of PRs this one depends on:

1. subscribes to NewTicket events 2. get the tx hash from a NewTicket event and retrieves the tx call data from the Ethereum client 3. queries the relay chain for the canonical MMR payload and compares these two results (currently only in log)

Flake lock file updates: • Updated input 'flake-utils': 'github:numtide/flake-utils/b1d9ab70662946ef0850d488da1c9019f3a9752a?narHash=sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ%3D' (2024-03-11) → 'github:numtide/flake-utils/11707dc2f618dd54ca8739b309ec4fc024de578b?narHash=sha256-l0KFg5HjrsfsO/JpG%2Br7fRrqm12kzFHyUHqHCVpMMbI%3D' (2024-11-13) • Updated input 'foundry': 'github:shazow/foundry.nix/d84c83b1c1722c8742b3d2d84c9386814d75384e?narHash=sha256-wEDJdvwRZF2ErQ33nQ0Lqn/48XrPbaadv56/bM2MSZU%3D' (2024-08-03) → 'github:shazow/foundry.nix/33a209625b9e31227a5f11417e95a3ac7264d811?narHash=sha256-aLWyhJx2cO/M3/QLoDBpsObFfjC9e/VEN6HtaI0U6IA%3D' (2025-02-04) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/8a3354191c0d7144db9756a74755672387b702ba?narHash=sha256-Grh5PF0%2BgootJfOJFenTTxDTYPidA3V28dqJ/WV7iis%3D' (2024-08-18) → 'github:NixOS/nixpkgs/c6e957d81b96751a3d5967a0fd73694f303cc914?narHash=sha256-nLivjIygCiqLp5QcL7l56Tca/elVqM9FG1hGd9ZSsrg%3D' (2025-02-03)

pinned version from 2024-09-03

subxt metadata --url http://127.0.0.1:9944 --pallets Beefy > westend_relaychain_metadata.scale

subxt metadata --url http://127.0.0.1:9944 --pallets Beefy --runtime-apis '' > westend_relaychain_metadata.scale

relay chain state is irrelevant for crafting malicious payload

utility module is available on penpal on latest polkadot-sdk master, so no need for the prior availability handling.

temp: uses own branch until Snowfork/go-substrate-rpc-client#68 is merged

yrong · 2025-07-24T11:22:00Z

go.work.sum

+github.com/lederstrumpf/go-substrate-rpc-client/v4 v4.2.0-alpha.1 h1:95S1KXEfRQxr6M/U4LMTjE5MMTYKY61PodtLUp0+Psc=
+github.com/lederstrumpf/go-substrate-rpc-client/v4 v4.2.0-alpha.1/go.mod h1:x8Svd6jMXFQ+OMNsXX6Y8FlSZShBwGnsCMEXiJj3WtE=


It seems we’re using a forked gsrpc repo — is that for encoding/decoding the new AncestryProof types? If possible, could you also link the upstream PR?

the upstream PR to your gsrpc repo is this one: Snowfork/go-substrate-rpc-client#68

I've just added an explicit list of PRs this one depends on to this PR's description

web/packages/test-helpers/src/configureE2E.ts

relayer/relays/fisherman/beefy-listener.go

Co-authored-by: Ron <yrong1997@gmail.com>

For the proof to be accepted, it's crucial that the payload (MMR root) contained in the header matches the ancestry proof's best MMR root. If the best block happened to get updated between both calls, this may not be the case. Ergo: use the block hash of the header provided in the equivocation proof for the ancestry proof generation call. Co-authored-by: Ron <yrong1997@gmail.com>

Flake lock file updates: • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/c6e957d81b96751a3d5967a0fd73694f303cc914?narHash=sha256-nLivjIygCiqLp5QcL7l56Tca/elVqM9FG1hGd9ZSsrg%3D' (2025-02-03) → 'github:NixOS/nixpkgs/fc02ee70efb805d3b2865908a13ddd4474557ecf?narHash=sha256-i%2BCQV2rPmP8wHxj0aq4siYyohHwVlsh40kV89f3nw1s%3D' (2025-07-23)

yrong · 2025-07-28T04:24:34Z

@Lederstrumpf Awesome! I've tested this PR with a local setup, and the malicious_payload smoke test worked as expected - thanks for the contribution!

However, I noticed one issue: due to some of the refactoring in this PR, it seems the HRMP channels are sometimes not being built. I’ve proposed a potential fix and also included a few other minor improvements in a follow-up PR here: Lederstrumpf#1.

Please take a look and let me know if it makes sense.

yrong · 2025-07-28T06:32:45Z

relayer/relays/fisherman/beefy-listener.go

+			// TODO: for slashing, we may want to
+			// 1. scan older blocks as well if the latest BEEFY commitment stored on Ethereum doesn't match the commitment at that block # on the relay chain
+			// 2. potentially scan older blocks even if latest BEEFY commitment is sound (honest relayers may have saved the day, but the adversaries should still be slashed)
+			// 3. scan older tickets as well, since they may have optimistically tried their luck on the subsampling without a `submitFinal` call
+			// in all cases, this scan should not go past the slashability horizon, i.e. only be performed where the validators are still bonded
+			// this may also have to query the relay chain for any reported equivocations


I agree that we may need a seperate scanning process. Another reason is that the fisherman relay may not always work reliably - if it gets stuck for any reason, the adversary could potentially escape slashing during that time.

alistair-singh and others added 30 commits December 7, 2024 05:02

fix tests and add all tests to run-tests

49aac41

lock down tokens to agents

e7981aa

add BeefyClient contract binding

5cc39f0

parse submitInitial fully

4193ce9

format payload data & log proof

645a337

add malicious payload test: fail InvalidCommitment

b08b962

retrieve current validator_set_id from relaychain

bc4c410

hardcode validator address & merkle proof

7d0d270

parse signature (still invalid)

0944e8a

pin foundry.nix to last known working monthly

646e21d

pinned version from 2024-09-03

add sp deps

63a363f

use correct authority's signature

86f203a

use block number from relay chain

0bc1bca

calculate validator proofs

1e83aad

correctly set bitfield

c75ad16

limit to malicious signers & make signer dynamic

e007c3b

try submit using all malicious signers

4839693

rename metadata polkadot->westend

4d0f361

strip generated metadata to only Beefy pallet

4431854

subxt metadata --url http://127.0.0.1:9944 --pallets Beefy > westend_relaychain_metadata.scale

strip metadata of runtime apis

1037930

subxt metadata --url http://127.0.0.1:9944 --pallets Beefy --runtime-apis '' > westend_relaychain_metadata.scale

submitFinal: fail on CommitmentNotRelevant

3db6e2a

use correct payload id ("mh")

c62f1a7

test: finalSubmit takes over bridge

05147d8

only use beefy client as source of truth

537866a

relay chain state is irrelevant for crafting malicious payload

log bitfielt, commitment, and decoded tx calls

0faf988

check MMR payload: invalidity test: burn balance

1279e9a

cleanup

d332fb5

only relayer 0 is honest

c1bfe8b

Lederstrumpf added 5 commits July 20, 2025 20:36

switch back to go relayer fishing

176ff7d

copy {parachain->fisherman}-relay.json

a884565

fix fisherman initialization & use standalone conf

ce2f5ca

cleanup

f8bd045

Merge remote-tracking branch 'origin/main' into rob/relayer-fishing

e2a41f2

Lederstrumpf mentioned this pull request Jul 21, 2025

add generateAncestryProofResponse Snowfork/go-substrate-rpc-client#68

Open

Lederstrumpf added 2 commits July 22, 2025 00:14

handle penpal txs if utility module missing

28ac776

move malicious_payload test into v2 suite

33e1a05

Lederstrumpf marked this pull request as ready for review July 21, 2025 22:19

Lederstrumpf added 2 commits July 22, 2025 00:20

foundry: follow monthly channel again

dec3ed2

symlink malicious_payload for PR testing

b4887c9

Lederstrumpf mentioned this pull request Jul 23, 2025

Add mmr_generateAncestryProof rpc call paritytech/polkadot-sdk#9295

Open

Lederstrumpf added 3 commits July 23, 2025 13:02

deduplicate penpal transactions

63efd2c

utility module is available on penpal on latest polkadot-sdk master, so no need for the prior availability handling.

move GenerateAncestryProofResponse gunk to rpc lib

4811c55

temp: uses own branch until Snowfork/go-substrate-rpc-client#68 is merged

add TODO

4d87f0b

yrong reviewed Jul 24, 2025

View reviewed changes

web/packages/test-helpers/src/configureE2E.ts Outdated Show resolved Hide resolved

yrong reviewed Jul 24, 2025

View reviewed changes

web/packages/test-helpers/src/configureE2E.ts Outdated Show resolved Hide resolved

yrong reviewed Jul 24, 2025

View reviewed changes

relayer/relays/fisherman/beefy-listener.go Outdated Show resolved Hide resolved

Lederstrumpf and others added 2 commits July 25, 2025 10:41

refactor & add missing authorization call

4f06b28

add missing txs from Snowfork#1492 & Snowfork#1526

d11db21

Co-authored-by: Ron <yrong1997@gmail.com>

Lederstrumpf force-pushed the rob/relayer-fishing branch from 7647ad2 to d11db21 Compare July 25, 2025 08:50

Lederstrumpf and others added 5 commits July 25, 2025 11:24

update npm dependencies

09c37e2

init-smoketests: only checkout lodestar if !exist

736a0ea

update go.sum with temp gsrpc fork

400b9a5

Lederstrumpf mentioned this pull request Jul 25, 2025

refactor: configureE2E.ts #1533

Open

yrong reviewed Jul 28, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Relayer: Cross-chain equivocation fishing #1493

Relayer: Cross-chain equivocation fishing #1493

Uh oh!

Lederstrumpf commented Jun 10, 2025 •

edited

Loading

Uh oh!

yrong Jul 24, 2025

Uh oh!

Lederstrumpf Jul 24, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yrong commented Jul 28, 2025 •

edited

Loading

Uh oh!

yrong Jul 28, 2025

Uh oh!

Uh oh!

		github.com/lederstrumpf/go-substrate-rpc-client/v4 v4.2.0-alpha.1 h1:95S1KXEfRQxr6M/U4LMTjE5MMTYKY61PodtLUp0+Psc=
		github.com/lederstrumpf/go-substrate-rpc-client/v4 v4.2.0-alpha.1/go.mod h1:x8Svd6jMXFQ+OMNsXX6Y8FlSZShBwGnsCMEXiJj3WtE=

Relayer: Cross-chain equivocation fishing #1493

Are you sure you want to change the base?

Relayer: Cross-chain equivocation fishing #1493

Uh oh!

Conversation

Lederstrumpf commented Jun 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yrong Jul 24, 2025

Choose a reason for hiding this comment

Uh oh!

Lederstrumpf Jul 24, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yrong commented Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yrong Jul 28, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Lederstrumpf commented Jun 10, 2025 •

edited

Loading

yrong commented Jul 28, 2025 •

edited

Loading