@aztec/slasher 0.0.1-commit.c31f2472 → 0.0.1-commit.c52d6e7

package/src/factory/create_implementation.ts

@@ -1,142 +1,65 @@
 import { EpochCache } from '@aztec/epoch-cache';
-import {
-  EmpireSlashingProposerContract,
-  RollupContract,
-  TallySlashingProposerContract,
-} from '@aztec/ethereum/contracts';
+import { RollupContract, SlashingProposerContract } from '@aztec/ethereum/contracts';
 import type { ViemClient } from '@aztec/ethereum/types';
-import { EthAddress } from '@aztec/foundation/eth-address';
+import type { SlotNumber } from '@aztec/foundation/branded-types';
+import type { EthAddress } from '@aztec/foundation/eth-address';
 import { createLogger } from '@aztec/foundation/log';
 import { DateProvider } from '@aztec/foundation/timer';
-import type { DataStoreConfig } from '@aztec/kv-store/config';
 import { AztecLMDBStoreV2 } from '@aztec/kv-store/lmdb-v2';
 import type { SlasherConfig } from '@aztec/stdlib/interfaces/server';
-import { SlashFactoryContract } from '@aztec/stdlib/l1-contracts';
+import type { DataStoreConfig } from '@aztec/stdlib/kv-store';
 
-import { EmpireSlasherClient, type EmpireSlasherSettings } from '../empire_slasher_client.js';
 import { NullSlasherClient } from '../null_slasher_client.js';
+import { SlasherClient } from '../slasher_client.js';
 import { SlasherOffensesStore } from '../stores/offenses_store.js';
-import { SlasherPayloadsStore } from '../stores/payloads_store.js';
-import { TallySlasherClient } from '../tally_slasher_client.js';
 import type { Watcher } from '../watcher.js';
-import { getTallySlasherSettings } from './get_settings.js';
+import { getSlasherSettings } from './get_settings.js';
 
-/** Creates a slasher client implementation (either tally or empire) based on the slasher proposer type in the rollup */
+/** Creates a slasher client implementation based on the slasher proposer type in the rollup */
 export async function createSlasherImplementation(
   config: SlasherConfig & DataStoreConfig & { ethereumSlotDuration: number },
   rollup: RollupContract,
   l1Client: ViemClient,
-  slashFactoryAddress: EthAddress | undefined,
   watchers: Watcher[],
   epochCache: EpochCache,
   dateProvider: DateProvider,
   kvStore: AztecLMDBStoreV2,
+  rollupRegisteredAtL2Slot: SlotNumber,
+  ownValidators: EthAddress[] = [],
   logger = createLogger('slasher'),
 ) {
   const proposer = await rollup.getSlashingProposer();
   if (!proposer) {
     return new NullSlasherClient(config);
-  } else if (proposer.type === 'tally') {
-    return createTallySlasher(config, rollup, proposer, watchers, dateProvider, epochCache, kvStore, logger);
   } else {
-    if (!slashFactoryAddress || slashFactoryAddress.equals(EthAddress.ZERO)) {
-      throw new Error('Cannot initialize an empire-based SlasherClient without a SlashFactory address');
-    }
-    const slashFactory = new SlashFactoryContract(l1Client, slashFactoryAddress.toString());
-    return createEmpireSlasher(config, rollup, proposer, slashFactory, watchers, dateProvider, kvStore, logger);
+    return createSlasher(
+      config,
+      rollup,
+      proposer,
+      watchers,
+      dateProvider,
+      epochCache,
+      kvStore,
+      rollupRegisteredAtL2Slot,
+      ownValidators,
+      logger,
+    );
   }
 }
 
-async function createEmpireSlasher(
-  config: SlasherConfig & DataStoreConfig & { ethereumSlotDuration: number },
-  rollup: RollupContract,
-  slashingProposer: EmpireSlashingProposerContract,
-  slashFactoryContract: SlashFactoryContract,
-  watchers: Watcher[],
-  dateProvider: DateProvider,
-  kvStore: AztecLMDBStoreV2,
-  logger = createLogger('slasher'),
-): Promise<EmpireSlasherClient> {
-  if (slashingProposer.type !== 'empire') {
-    throw new Error('Slashing proposer contract is not of type Empire');
-  }
-
-  const [
-    slashingExecutionDelayInRounds,
-    slashingPayloadLifetimeInRounds,
-    slashingRoundSize,
-    slashingQuorumSize,
-    epochDuration,
-    proofSubmissionEpochs,
-    l1GenesisTime,
-    slotDuration,
-    l1StartBlock,
-    slasher,
-  ] = await Promise.all([
-    slashingProposer.getExecutionDelayInRounds(),
-    slashingProposer.getLifetimeInRounds(),
-    slashingProposer.getRoundSize(),
-    slashingProposer.getQuorumSize(),
-    rollup.getEpochDuration(),
-    rollup.getProofSubmissionEpochs(),
-    rollup.getL1GenesisTime(),
-    rollup.getSlotDuration(),
-    rollup.getL1StartBlock(),
-    rollup.getSlasherContract(),
-  ]);
-
-  const settings: EmpireSlasherSettings = {
-    slashingExecutionDelayInRounds: Number(slashingExecutionDelayInRounds),
-    slashingPayloadLifetimeInRounds: Number(slashingPayloadLifetimeInRounds),
-    slashingRoundSize: Number(slashingRoundSize),
-    slashingQuorumSize: Number(slashingQuorumSize),
-    epochDuration: Number(epochDuration),
-    proofSubmissionEpochs: Number(proofSubmissionEpochs),
-    l1GenesisTime: l1GenesisTime,
-    slotDuration: Number(slotDuration),
-    l1StartBlock,
-    ethereumSlotDuration: config.ethereumSlotDuration,
-    slashingAmounts: undefined,
-  };
-
-  const payloadsStore = new SlasherPayloadsStore(kvStore, {
-    slashingPayloadLifetimeInRounds: settings.slashingPayloadLifetimeInRounds,
-  });
-  const offensesStore = new SlasherOffensesStore(kvStore, {
-    ...settings,
-    slashOffenseExpirationRounds: config.slashOffenseExpirationRounds,
-  });
-
-  return new EmpireSlasherClient(
-    config,
-    settings,
-    slashFactoryContract,
-    slashingProposer,
-    slasher!,
-    rollup,
-    watchers,
-    dateProvider,
-    offensesStore,
-    payloadsStore,
-    logger,
-  );
-}
-
-async function createTallySlasher(
+async function createSlasher(
   config: SlasherConfig & DataStoreConfig,
   rollup: RollupContract,
-  slashingProposer: TallySlashingProposerContract,
+  slashingProposer: SlashingProposerContract,
   watchers: Watcher[],
   dateProvider: DateProvider,
   epochCache: EpochCache,
   kvStore: AztecLMDBStoreV2,
+  rollupRegisteredAtL2Slot: SlotNumber,
+  ownValidators: EthAddress[] = [],
   logger = createLogger('slasher'),
-): Promise<TallySlasherClient> {
-  if (slashingProposer.type !== 'tally') {
-    throw new Error('Slashing proposer contract is not of type tally');
-  }
-
-  const settings = await getTallySlasherSettings(rollup, slashingProposer);
+): Promise<SlasherClient> {
+  const settings = { ...(await getSlasherSettings(rollup, slashingProposer)), rollupRegisteredAtL2Slot };
   const slasher = await rollup.getSlasherContract();
 
   const offensesStore = new SlasherOffensesStore(kvStore, {
@@ -144,7 +67,7 @@ async function createTallySlasher(
     slashOffenseExpirationRounds: config.slashOffenseExpirationRounds,
   });
 
-  return new TallySlasherClient(
+  return new SlasherClient(
     config,
     settings,
     slashingProposer,
@@ -154,6 +77,7 @@ async function createTallySlasher(
     epochCache,
     dateProvider,
     offensesStore,
+    ownValidators,
     logger,
   );
 }

package/src/factory/get_settings.ts

@@ -1,15 +1,15 @@
-import type { RollupContract, TallySlashingProposerContract } from '@aztec/ethereum/contracts';
+import type { RollupContract, SlashingProposerContract } from '@aztec/ethereum/contracts';
 
-import type { TallySlasherSettings } from '../tally_slasher_client.js';
+import type { SlasherSettings } from '../slasher_client.js';
 
-export async function getTallySlasherSettings(
+export async function getSlasherSettings(
   rollup: RollupContract,
-  slashingProposer?: TallySlashingProposerContract,
-): Promise<TallySlasherSettings> {
+  slashingProposer?: SlashingProposerContract,
+): Promise<Omit<SlasherSettings, 'rollupRegisteredAtL2Slot'>> {
   if (!slashingProposer) {
     const rollupSlashingProposer = await rollup.getSlashingProposer();
-    if (!rollupSlashingProposer || rollupSlashingProposer.type !== 'tally') {
-      throw new Error('Rollup slashing proposer is not of type tally');
+    if (!rollupSlashingProposer) {
+      throw new Error('Rollup slashing proposer not found');
     }
     slashingProposer = rollupSlashingProposer;
   }
@@ -40,7 +40,7 @@ export async function getTallySlasherSettings(
     rollup.getTargetCommitteeSize(),
   ]);
 
-  const settings: TallySlasherSettings = {
+  const settings: Omit<SlasherSettings, 'rollupRegisteredAtL2Slot'> = {
     slashingExecutionDelayInRounds: Number(slashingExecutionDelayInRounds),
     slashingRoundSize: Number(slashingRoundSize),
     slashingRoundSizeInEpochs: Number(slashingRoundSizeInEpochs),

package/src/factory/index.ts

@@ -1,2 +1,2 @@
 export { createSlasherFacade as createSlasher } from './create_facade.js';
-export { getTallySlasherSettings } from './get_settings.js';
+export { getSlasherSettings } from './get_settings.js';

package/src/generated/slasher-defaults.ts

@@ -3,19 +3,21 @@
 
 /** Default slasher configuration values from network-defaults.yml */
 export const slasherDefaultEnv = {
-  SLASH_MIN_PENALTY_PERCENTAGE: 0.5,
-  SLASH_MAX_PENALTY_PERCENTAGE: 2,
   SLASH_OFFENSE_EXPIRATION_ROUNDS: 4,
-  SLASH_MAX_PAYLOAD_SIZE: 50,
+  SLASH_MAX_PAYLOAD_SIZE: 80,
   SLASH_EXECUTE_ROUNDS_LOOK_BACK: 4,
-  SLASH_PRUNE_PENALTY: 10000000000000000000,
   SLASH_DATA_WITHHOLDING_PENALTY: 10000000000000000000,
+  SLASH_DATA_WITHHOLDING_TOLERANCE_SLOTS: 3,
   SLASH_INACTIVITY_TARGET_PERCENTAGE: 0.9,
   SLASH_INACTIVITY_CONSECUTIVE_EPOCH_THRESHOLD: 1,
   SLASH_INACTIVITY_PENALTY: 10000000000000000000,
   SLASH_PROPOSE_INVALID_ATTESTATIONS_PENALTY: 10000000000000000000,
-  SLASH_ATTEST_DESCENDANT_OF_INVALID_PENALTY: 10000000000000000000,
+  SLASH_PROPOSE_DESCENDANT_OF_CHECKPOINT_WITH_INVALID_ATTESTATIONS_PENALTY: 10000000000000000000,
+  SLASH_ATTEST_INVALID_CHECKPOINT_PROPOSAL_PENALTY: 10000000000000000000,
+  SLASH_DUPLICATE_PROPOSAL_PENALTY: 0,
+  SLASH_DUPLICATE_ATTESTATION_PENALTY: 0,
   SLASH_UNKNOWN_PENALTY: 10000000000000000000,
   SLASH_INVALID_BLOCK_PENALTY: 10000000000000000000,
+  SLASH_INVALID_CHECKPOINT_PROPOSAL_PENALTY: 0,
   SLASH_GRACE_PERIOD_L2_SLOTS: 0,
 } as const;

package/src/index.ts

@@ -1,8 +1,10 @@
 export * from './config.js';
-export * from './watchers/epoch_prune_watcher.js';
+export * from './watchers/data_withholding_watcher.js';
 export * from './watchers/attestations_block_watcher.js';
-export * from './empire_slasher_client.js';
-export * from './tally_slasher_client.js';
+export * from './watchers/attested_invalid_proposal_watcher.js';
+export * from './watchers/broadcasted_invalid_checkpoint_proposal_watcher.js';
+export * from './watchers/checkpoint_equivocation_watcher.js';
+export * from './slasher_client.js';
 export * from './slash_offenses_collector.js';
 export * from './slasher_client_interface.js';
 export * from './factory/index.js';

package/src/metrics.ts

@@ -0,0 +1,59 @@
+import {
+  type Gauge,
+  Metrics,
+  type TelemetryClient,
+  type UpDownCounter,
+  createUpDownCounterWithDefault,
+} from '@aztec/telemetry-client';
+
+import { formatEther } from 'viem/utils';
+
+export class SlasherMetrics {
+  private readonly roundExecuted: UpDownCounter;
+  private readonly ownValidatorTargeted: UpDownCounter;
+  private readonly ownValidatorSlashedCount: UpDownCounter;
+  private readonly ownValidatorSlashedAmount: UpDownCounter;
+  private readonly ownValidatorCurrentRoundVotesMax: Gauge;
+  private readonly quorumSize: Gauge;
+
+  constructor(client: TelemetryClient, name = 'Slasher') {
+    const meter = client.getMeter(name);
+    this.roundExecuted = createUpDownCounterWithDefault(meter, Metrics.SLASHER_ROUND_EXECUTED_COUNT);
+    this.ownValidatorTargeted = createUpDownCounterWithDefault(meter, Metrics.SLASHER_OWN_VALIDATOR_TARGETED_COUNT);
+    this.ownValidatorSlashedCount = createUpDownCounterWithDefault(meter, Metrics.SLASHER_OWN_VALIDATOR_SLASHED_COUNT);
+    this.ownValidatorSlashedAmount = createUpDownCounterWithDefault(
+      meter,
+      Metrics.SLASHER_OWN_VALIDATOR_SLASHED_AMOUNT,
+    );
+    this.ownValidatorCurrentRoundVotesMax = meter.createGauge(Metrics.SLASHER_OWN_VALIDATOR_CURRENT_ROUND_VOTES_MAX);
+    this.quorumSize = meter.createGauge(Metrics.SLASHER_QUORUM_SIZE);
+  }
+
+  public recordRoundExecuted(): void {
+    this.roundExecuted.add(1);
+  }
+
+  /** Records the quorum a validator must reach in a round to be slashed, so dashboards can plot the threshold. */
+  public recordQuorumSize(quorum: number): void {
+    this.quorumSize.record(quorum);
+  }
+
+  /** Records that an onchain slashing vote named one of the node's own validators as a target. */
+  public recordOwnValidatorTargeted(): void {
+    this.ownValidatorTargeted.add(1);
+  }
+
+  /**
+   * Records how close the most-voted committee position held by the node's own validators is to quorum this round.
+   * Recorded as an absolute value rather than a delta so a vote seen across a round rollover cannot make it drift.
+   */
+  public recordCurrentRoundVotesMax(votes: number): void {
+    this.ownValidatorCurrentRoundVotesMax.record(votes);
+  }
+
+  /** Records an executed slash against one of the node's own validators. */
+  public recordOwnValidatorSlashed(amount: bigint): void {
+    this.ownValidatorSlashedCount.add(1);
+    this.ownValidatorSlashedAmount.add(parseFloat(formatEther(amount)));
+  }
+}

package/src/null_slasher_client.ts

@@ -1,5 +1,5 @@
 import type { SlotNumber } from '@aztec/foundation/branded-types';
-import type { Offense, ProposerSlashAction, SlashPayloadRound } from '@aztec/stdlib/slashing';
+import type { Offense, ProposerSlashAction } from '@aztec/stdlib/slashing';
 
 import type { SlasherConfig } from './config.js';
 import type { SlasherClientInterface } from './slasher_client_interface.js';
@@ -15,15 +15,11 @@ export class NullSlasherClient implements SlasherClientInterface {
     return Promise.resolve();
   }
 
-  public getSlashPayloads(): Promise<SlashPayloadRound[]> {
-    return Promise.resolve([]);
-  }
-
   public gatherOffensesForRound(_round?: bigint): Promise<Offense[]> {
     return Promise.resolve([]);
   }
 
-  public getPendingOffenses(): Promise<Offense[]> {
+  public getOffenses(): Promise<Offense[]> {
     return Promise.resolve([]);
   }
 

package/src/own_validator_slash_monitor.ts

@@ -0,0 +1,184 @@
+import type { SlashVoteTarget, SlashingProposerContract } from '@aztec/ethereum/contracts';
+import { uniqueBy } from '@aztec/foundation/collection';
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import { createLogger } from '@aztec/foundation/log';
+import { SerialQueue } from '@aztec/foundation/queue';
+
+import type { Hex } from 'viem';
+
+import type { SlasherMetrics } from './metrics.js';
+
+/**
+ * Watches slashing activity that targets the node's own validators: warns and counts on every vote naming one of
+ * them, tracks how close the current round's tally is to quorum, and reports executed slashes. Does nothing when
+ * the node runs no validators. Lifecycle calls must be sequential: start() before events are wired, and stop()
+ * awaited before any restart.
+ */
+export class OwnValidatorSlashMonitor {
+  /**
+   * Tally for the single round being tracked (votes are only ever cast for the current round). `nextVoteIndex` is
+   * the cursor: the index of the first vote in the round not yet processed, advanced from the indices the VoteCast
+   * events carry. It is undefined until the first event of a round that started mid-round, whose own vote is then
+   * the first one counted, so votes cast before the node subscribed are never replayed into the cumulative metrics.
+   * The tally is per flattened committee position because that is the unit the contract tallies quorum by.
+   */
+  private state: { round: bigint; nextVoteIndex: bigint | undefined; countByPosition: Map<number, number> } = {
+    round: -1n,
+    nextVoteIndex: undefined,
+    countByPosition: new Map(),
+  };
+
+  /**
+   * All vote processing runs through this queue, one job at a time in arrival order. Serialization is what makes
+   * the cursor sound: without it, concurrent event handlers could process the same index twice or emit warnings
+   * with out-of-order running tallies. Replaced on every start(), since a queue that has been ended cannot run
+   * jobs again.
+   */
+  private queue = new SerialQueue();
+
+  private stopped = false;
+
+  constructor(
+    private readonly slashingProposer: SlashingProposerContract,
+    private readonly settings: { slashingQuorumSize: number },
+    private readonly ownValidators: EthAddress[],
+    private readonly metrics: SlasherMetrics,
+    private readonly log = createLogger('slasher:own-validators'),
+  ) {
+    this.queue.start();
+  }
+
+  private get enabled(): boolean {
+    return this.ownValidators.length > 0;
+  }
+
+  /**
+   * Starts tracking at the given round, leaving the cursor unset so the round's votes already cast are skipped:
+   * replaying them would warn about votes the operator can no longer react to sooner, and would double-count
+   * cumulative counters across restarts.
+   */
+  public start(currentRound: bigint): void {
+    if (!this.enabled) {
+      return;
+    }
+    this.stopped = false;
+    this.queue = new SerialQueue();
+    this.queue.start();
+    this.state = { round: currentRound, nextVoteIndex: undefined, countByPosition: new Map() };
+    this.metrics.recordQuorumSize(this.settings.slashingQuorumSize);
+    this.metrics.recordCurrentRoundVotesMax(0);
+  }
+
+  /** Stops processing and waits for any in-flight drain, so no warning or metric is emitted after shutdown. */
+  public async stop(): Promise<void> {
+    this.stopped = true;
+    // Jobs already queued are no-ops now that the flag is set, so end() runs through them at no cost while still
+    // settling the promises their callers hold, where cancel() would discard them and leave those promises pending.
+    await this.queue.end();
+  }
+
+  /**
+   * Called by the round monitor clock. Strictly greater so the clock catching up to a round an event already rolled
+   * to keeps the tally.
+   */
+  public handleNewRound(round: bigint): void {
+    if (this.enabled && round > this.state.round) {
+      this.rollTo(round);
+    }
+  }
+
+  /**
+   * Called on each VoteCast event with the index the event carries. Reads every vote from the cursor up to that
+   * index, so an event delivery that never arrived is healed by the next one.
+   */
+  public handleVoteCast(round: bigint, voteIndex: bigint): Promise<void> {
+    if (!this.enabled || this.stopped) {
+      return Promise.resolve();
+    }
+    // Errors are logged rather than propagated: callers fire and forget, and a failed read is retried by the drain
+    // the next event triggers.
+    return this.queue
+      .put(() => this.drainVotesTo(round, voteIndex))
+      .catch(err => this.log.error('Error processing slashing votes', err));
+  }
+
+  /** Reports executed slashes against own validators. Called with the Slashed events already fetched by the client. */
+  public handleSlashes(round: bigint, slashes: { attester: EthAddress; amount: bigint }[], l1BlockHash: Hex): void {
+    if (!this.enabled || this.stopped) {
+      return;
+    }
+    for (const { attester, amount } of slashes.filter(slash => this.isOwnValidator(slash.attester))) {
+      this.log.warn(`Own validator ${attester} was slashed for ${amount}`, {
+        round,
+        validator: attester.toString(),
+        amount,
+        l1BlockHash,
+      });
+      this.metrics.recordOwnValidatorSlashed(amount);
+    }
+  }
+
+  /** Processes votes [cursor, voteIndex] of a round, in order, advancing the cursor after each success. */
+  private async drainVotesTo(round: bigint, voteIndex: bigint): Promise<void> {
+    if (this.stopped) {
+      return; // enqueued before stop() but not yet started: emit nothing and read nothing after shutdown
+    }
+    if (round < this.state.round) {
+      return; // a vote for a round that already closed can no longer reach quorum
+    }
+    if (round > this.state.round) {
+      this.rollTo(round); // the event beat the round-monitor clock to the boundary
+    }
+
+    // The first event of a round tracked from mid-round counts its own vote only: earlier ones predate the subscription
+    const from = this.state.nextVoteIndex ?? voteIndex;
+    if (voteIndex < from) {
+      return; // a duplicate or out-of-order delivery of a vote already processed
+    }
+
+    for (let index = from; index <= voteIndex; index++) {
+      const vote = await this.slashingProposer.getVoteAt(round, index);
+      if (this.stopped || round !== this.state.round) {
+        return; // stopped, or rolled mid-drain: either way this vote must no longer be counted
+      }
+      this.processVote(round, vote);
+      // Advanced only after successful processing, so a failed read is retried on the next event
+      this.state.nextVoteIndex = index + 1n;
+    }
+  }
+
+  private processVote(round: bigint, vote: SlashVoteTarget[]): void {
+    const own = vote.filter(target => this.isOwnValidator(target.validator));
+    for (const { position } of own) {
+      this.state.countByPosition.set(position, (this.state.countByPosition.get(position) ?? 0) + 1);
+    }
+
+    // Warn once per (vote, validator) at the validator's highest position tally: the operator cares about the
+    // validator, not which of its committee seats is being voted on. No slash amount (the amount voted is not
+    // necessarily the amount slashed) and no proposer (a catch-up drain cannot attribute votes to proposers).
+    const quorum = this.settings.slashingQuorumSize;
+    for (const { validator } of uniqueBy(own, target => target.validator.toString())) {
+      const votes = Math.max(
+        ...own.filter(t => t.validator.equals(validator)).map(t => this.state.countByPosition.get(t.position)!),
+      );
+      this.metrics.recordOwnValidatorTargeted();
+      this.log.warn(
+        `Own validator ${validator} targeted by slashing vote (${votes} of ${quorum} votes needed to slash)`,
+        { round, validator: validator.toString(), votes, quorum },
+      );
+    }
+
+    this.metrics.recordCurrentRoundVotesMax(Math.max(0, ...this.state.countByPosition.values()));
+  }
+
+  /** Starts a fresh tally, zeroing the gauge so a quiet round does not keep the previous round's value. */
+  private rollTo(round: bigint): void {
+    this.state = { round, nextVoteIndex: 0n, countByPosition: new Map() };
+    this.metrics.recordCurrentRoundVotesMax(0);
+    this.metrics.recordQuorumSize(this.settings.slashingQuorumSize); // keeps the gauge fresh across export cycles
+  }
+
+  private isOwnValidator(address: EthAddress): boolean {
+    return this.ownValidators.some(validator => validator.equals(address));
+  }
+}