@aztec/validator-ha-signer 0.0.1-commit.f504929 → 0.0.1-commit.f5a9928

package/src/types.ts

@@ -2,11 +2,14 @@ import { SlotNumber } from '@aztec/foundation/branded-types';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 import { DateProvider } from '@aztec/foundation/timer';
 import {
+  type AttestationSigningContext,
+  type CheckpointProposalSigningContext,
   DutyType,
   type HAProtectedSigningContext,
   type SigningContext,
   type ValidatorHASignerConfig,
   getBlockNumberFromSigningContext as getBlockNumberFromSigningContextFromStdlib,
+  getCheckpointNumberFromSigningContext as getCheckpointNumberFromSigningContextFromStdlib,
   isHAProtectedContext,
 } from '@aztec/stdlib/ha-signing';
 import type { TelemetryClient } from '@aztec/telemetry-client';
@@ -25,8 +28,10 @@ import type {
 } from './db/types.js';
 
 export type {
+  AttestationSigningContext,
   BlockProposalDutyIdentifier,
   CheckAndRecordParams,
+  CheckpointProposalSigningContext,
   DeleteDutyParams,
   DutyIdentifier,
   DutyRow,
@@ -40,6 +45,7 @@ export type {
 export { DutyStatus, DutyType, getBlockIndexFromDutyIdentifier, normalizeBlockIndex } from './db/types.js';
 export { isHAProtectedContext };
 export { getBlockNumberFromSigningContextFromStdlib as getBlockNumberFromSigningContext };
+export { getCheckpointNumberFromSigningContextFromStdlib as getCheckpointNumberFromSigningContext };
 
 /**
  * Result of tryInsertOrGetExisting operation
@@ -70,6 +76,11 @@ export interface CreateHASignerDeps {
   dateProvider?: DateProvider;
 }
 
+/**
+ * deps for creating a local signing protection signer
+ */
+export type CreateLocalSignerWithProtectionDeps = Omit<CreateHASignerDeps, 'pool'>;
+
 /**
  * Database interface for slashing protection operations
  * This abstraction allows for different database implementations (PostgreSQL, SQLite, etc.)

package/src/validator_ha_signer.ts

@@ -9,17 +9,19 @@ import type { Buffer32 } from '@aztec/foundation/buffer';
 import { EthAddress } from '@aztec/foundation/eth-address';
 import type { Signature } from '@aztec/foundation/eth-signature';
 import { type Logger, createLogger } from '@aztec/foundation/log';
-import type { DateProvider } from '@aztec/foundation/timer';
+import { type DateProvider, executeTimeout } from '@aztec/foundation/timer';
 import {
+  type BaseSignerConfig,
   DutyType,
   type HAProtectedSigningContext,
-  type ValidatorHASignerConfig,
   getBlockNumberFromSigningContext,
+  getCheckpointNumberFromSigningContext,
 } from '@aztec/stdlib/ha-signing';
 
 import type { DutyIdentifier } from './db/types.js';
+import { SigningLockLostError } from './errors.js';
 import type { HASignerMetrics } from './metrics.js';
-import { SlashingProtectionService } from './slashing_protection_service.js';
+import { DEFAULT_MAX_STUCK_DUTIES_AGE_MS, SlashingProtectionService } from './slashing_protection_service.js';
 import type { SlashingProtectionDatabase } from './types.js';
 
 export interface ValidatorHASignerDeps {
@@ -27,6 +29,9 @@ export interface ValidatorHASignerDeps {
   dateProvider: DateProvider;
 }
 
+/** Default hard timeout (ms) for a single signer call when not configured. */
+const DEFAULT_SIGNER_CALL_TIMEOUT_MS = 30_000;
+
 /**
  * Validator High Availability Signer
  *
@@ -53,10 +58,11 @@ export class ValidatorHASigner {
 
   private readonly dateProvider: DateProvider;
   private readonly metrics: HASignerMetrics;
+  private readonly signerCallTimeoutMs: number;
 
   constructor(
     db: SlashingProtectionDatabase,
-    private readonly config: ValidatorHASignerConfig,
+    private readonly config: BaseSignerConfig,
     deps: ValidatorHASignerDeps,
   ) {
     this.log = createLogger('validator-ha-signer');
@@ -64,22 +70,31 @@ export class ValidatorHASigner {
     this.metrics = deps.metrics;
     this.dateProvider = deps.dateProvider;
 
-    if (!config.haSigningEnabled) {
-      // this shouldn't happen, the validator should use different signer for non-HA setups
-      throw new Error('Validator HA Signer is not enabled in config');
-    }
+    // Clamp the signer-call timeout below half the stuck-duty max age. This maintains the
+    // invariant that an in-flight signing always times out and releases its SIGNING row well before
+    // stuck-duty cleanup could consider it stuck, so cleanup can never delete a live duty (only
+    // signWithProtection writes SIGNING rows, and every path through it is bounded by this timeout).
+    // If timers misbehave anyway, the recordSuccess-returns-false throw is the backstop: the duty
+    // fails instead of broadcasting an unprotected signature.
+    const maxStuckDutiesAgeMs = config.maxStuckDutiesAgeMs ?? DEFAULT_MAX_STUCK_DUTIES_AGE_MS;
+    this.signerCallTimeoutMs = Math.min(
+      config.signerCallTimeoutMs ?? DEFAULT_SIGNER_CALL_TIMEOUT_MS,
+      maxStuckDutiesAgeMs / 2,
+    );
 
     if (!config.nodeId || config.nodeId === '') {
       throw new Error('NODE_ID is required for high-availability setups');
     }
-    this.rollupAddress = config.l1Contracts.rollupAddress;
+    this.rollupAddress = config.rollupAddress;
     this.slashingProtection = new SlashingProtectionService(db, config, {
       metrics: deps.metrics,
       dateProvider: deps.dateProvider,
     });
+
     this.log.info('Validator HA Signer initialized with slashing protection', {
       nodeId: config.nodeId,
       rollupAddress: this.rollupAddress.toString(),
+      signerCallTimeoutMs: this.signerCallTimeoutMs,
     });
   }
 
@@ -130,17 +145,29 @@ export class ValidatorHASigner {
     // Acquire lock and get the token for ownership verification
     // DutyAlreadySignedError and SlashingProtectionError may be thrown here and are recorded in the service
     const blockNumber = getBlockNumberFromSigningContext(context);
+    const checkpointNumber = getCheckpointNumberFromSigningContext(context);
     const lockToken = await this.slashingProtection.checkAndRecord({
       ...dutyIdentifier,
       blockNumber,
+      checkpointNumber,
       messageHash: messageHash.toString(),
       nodeId: this.config.nodeId,
     });
 
-    // Perform signing
+    // Perform signing under a hard timeout. If the signer hangs, executeTimeout aborts and rejects;
+    // the orphaned signFn promise resolving later is discarded (never broadcast). A timeout takes the
+    // same failure path as any signing error: release the lock so the duty can be retried safely.
     let signature: Signature;
     try {
-      signature = await signFn(messageHash);
+      signature = await executeTimeout(
+        () => signFn(messageHash),
+        this.signerCallTimeoutMs,
+        () =>
+          new Error(
+            `Signing operation for ${dutyType} at slot ${context.slot} timed out after ` +
+              `${this.signerCallTimeoutMs}ms`,
+          ),
+      );
     } catch (error: any) {
       // Delete duty to allow retry (only succeeds if we own the lock)
       await this.slashingProtection.deleteDuty({ ...dutyIdentifier, lockToken });
@@ -148,13 +175,21 @@ export class ValidatorHASigner {
       throw error;
     }
 
-    // Record success (only succeeds if we own the lock)
-    await this.slashingProtection.recordSuccess({
+    // Record success (only succeeds if we still own the lock).
+    // A false result means our SIGNING row is gone or no longer ours (e.g. deleted by stuck-duty
+    // cleanup while signing was slow). We must not broadcast this signature: without a protection
+    // record, a later attempt for the same duty with different data would sign freely (slashable).
+    // Do not delete the duty here - we no longer own it, and another node may legitimately hold it.
+    const recorded = await this.slashingProtection.recordSuccess({
       ...dutyIdentifier,
       signature,
       nodeId: this.config.nodeId,
       lockToken,
     });
+    if (!recorded) {
+      this.metrics.recordSigningError(dutyType);
+      throw new SigningLockLostError(context.slot, dutyType, this.config.nodeId);
+    }
 
     const duration = this.dateProvider.now() - startTime;
     this.metrics.recordSigningSuccess(dutyType, duration);