@leofcoin/chain 1.10.7 → 1.10.8

package/exports/browser/chain.js

@@ -10181,6 +10181,46 @@ const validateChainLink = (localTip, incoming) => {
   return "append";
 };
 
+const BLOCK_REWARD = 150n;
+const validateCanonicalValidatorSet = (blockIndex, expectedValidators, validators) => {
+  const actualValidators = validators.map(({ address }) => address);
+  const canonicalExpected = [...new Set(expectedValidators)].sort();
+  if (actualValidators.length !== canonicalExpected.length || actualValidators.some((address, index) => address !== canonicalExpected[index])) {
+    throw new Error(
+      `Block ${blockIndex} validator set mismatch: expected ${canonicalExpected.join(",")}, got ${actualValidators.join(",")}`
+    );
+  }
+};
+const validateBlockEconomics = (block, calculatedFees) => {
+  if (block.validators.length === 0) {
+    throw new Error(`Block ${block.index} cannot distribute rewards without validators`);
+  }
+  if (block.reward !== BLOCK_REWARD) {
+    throw new Error(`Block ${block.index} has invalid base reward: expected ${BLOCK_REWARD}, got ${block.reward}`);
+  }
+  if (block.fees !== calculatedFees) {
+    throw new Error(`Block ${block.index} has invalid fees: expected ${calculatedFees}, got ${block.fees}`);
+  }
+  const validatorCount = BigInt(block.validators.length);
+  const expectedReward = calculatedFees / validatorCount + BLOCK_REWARD / validatorCount;
+  for (const validator of block.validators) {
+    if (validator.reward !== expectedReward) {
+      throw new Error(
+        `Block ${block.index} has an invalid reward for validator ${validator.address}: expected ${expectedReward}, got ${validator.reward}`
+      );
+    }
+  }
+};
+
+const resolveTransactionReference = async (expectedHash, transactionData) => {
+  const transaction = transactionData instanceof TransactionMessage ? transactionData : new TransactionMessage(transactionData);
+  const actualHash = await transaction.hash();
+  if (actualHash !== expectedHash) {
+    throw new Error(`Transaction hash mismatch: expected ${expectedHash}, got ${actualHash}`);
+  }
+  return transaction;
+};
+
 const consensusSignableData = (validatorsAddress, type, message) => ({
   from: String(message.from),
   to: validatorsAddress,
@@ -10348,8 +10388,23 @@ class Chain extends VersionControl {
             debug(`[consensus] Block hash mismatch in proposal: expected ${blockHash}, got ${actualHash}`);
             return;
           }
+          if (BigInt(blockMessage.decoded.index) !== index) {
+            debug(`[consensus] Proposal height ${index} does not match block height ${blockMessage.decoded.index}`);
+            return;
+          }
+          if (blockMessage.decoded.producer !== from) {
+            debug(`[consensus] Proposal sender ${from} does not match block producer ${blockMessage.decoded.producer}`);
+            return;
+          }
+          validateChainLink(localBlock, {
+            index: Number(blockMessage.decoded.index),
+            hash: actualHash,
+            previousHash: String(blockMessage.decoded.previousHash)
+          });
+          await this.#validateBlockValidators(blockMessage);
+          await this.#resolveBlockTransactions(blockMessage);
         } catch (e) {
-          debug(`[consensus] Cannot fetch proposed block ${blockHash}:`, e?.message);
+          debug(`[consensus] Invalid proposed block ${blockHash}:`, e?.message);
           return;
         }
         this.#consensusRound = Number(round);
@@ -10604,15 +10659,21 @@ class Chain extends VersionControl {
     if (new Set(validatorAddresses).size !== validatorAddresses.length) {
       throw new Error(`Block ${blockMessage.decoded.index} validators contain duplicates`);
     }
-    const validatorCount = BigInt(validators.length);
-    const expectedReward = blockMessage.decoded.fees / validatorCount + blockMessage.decoded.reward / validatorCount;
-    for (const validator of validators) {
-      if (validator.reward !== expectedReward) {
-        throw new Error(
-          `Block ${blockMessage.decoded.index} has an invalid reward for validator ${validator.address}: expected ${expectedReward}, got ${validator.reward}`
-        );
-      }
-    }
+    const expectedValidators = await this.staticCall(addresses.validators, "validators");
+    validateCanonicalValidatorSet(blockMessage.decoded.index, expectedValidators, validators);
+  }
+  async #resolveBlockTransactions(blockMessage) {
+    const transactions = await Promise.all(
+      blockMessage.decoded.transactions.map(async (expectedHash) => {
+        const data = await globalThis.peernet.get(expectedHash, "transaction");
+        const transaction = await resolveTransactionReference(expectedHash, data);
+        await this.validateTransactionSignature(transaction);
+        return transaction;
+      })
+    );
+    const calculatedFees = (await Promise.all(transactions.map((transaction) => calculateFee(transaction.decoded)))).reduce((total, fee) => total + BigInt(fee), 0n);
+    validateBlockEconomics(blockMessage.decoded, calculatedFees);
+    return transactions;
   }
   /** Check if the next block will cross an epoch boundary (block-based timing) */
   #isEpochBoundary(blockHeight) {
@@ -11111,13 +11172,7 @@ class Chain extends VersionControl {
     }
     console.log(`[chain] \u2705 Block data integrity verified: ${hash}`);
     await this.#validateBlockValidators(blockMessage);
-    const transactions = await Promise.all(
-      blockMessage.decoded.transactions.map(async (hash2) => {
-        const data = await peernet.get(hash2, "transaction");
-        return new TransactionMessage(data);
-      })
-    );
-    await Promise.all(transactions.map((transaction) => this.validateTransactionSignature(transaction)));
+    const transactions = await this.#resolveBlockTransactions(blockMessage);
     await Promise.all(
       blockMessage.decoded.transactions.map(async (transactionHash) => {
         if (await transactionPoolStore.has(transactionHash)) await transactionPoolStore.delete(transactionHash);
@@ -11243,7 +11298,7 @@ class Chain extends VersionControl {
       fees: BigInt(0),
       timestamp,
       previousHash: "",
-      reward: BigInt(150),
+      reward: BLOCK_REWARD,
       index: 0,
       producer: "",
       producerProof: "",

package/exports/chain.js

@@ -2276,6 +2276,46 @@ const validateChainLink = (localTip, incoming) => {
   return "append";
 };
 
+const BLOCK_REWARD = 150n;
+const validateCanonicalValidatorSet = (blockIndex, expectedValidators, validators) => {
+  const actualValidators = validators.map(({ address }) => address);
+  const canonicalExpected = [...new Set(expectedValidators)].sort();
+  if (actualValidators.length !== canonicalExpected.length || actualValidators.some((address, index) => address !== canonicalExpected[index])) {
+    throw new Error(
+      `Block ${blockIndex} validator set mismatch: expected ${canonicalExpected.join(",")}, got ${actualValidators.join(",")}`
+    );
+  }
+};
+const validateBlockEconomics = (block, calculatedFees) => {
+  if (block.validators.length === 0) {
+    throw new Error(`Block ${block.index} cannot distribute rewards without validators`);
+  }
+  if (block.reward !== BLOCK_REWARD) {
+    throw new Error(`Block ${block.index} has invalid base reward: expected ${BLOCK_REWARD}, got ${block.reward}`);
+  }
+  if (block.fees !== calculatedFees) {
+    throw new Error(`Block ${block.index} has invalid fees: expected ${calculatedFees}, got ${block.fees}`);
+  }
+  const validatorCount = BigInt(block.validators.length);
+  const expectedReward = calculatedFees / validatorCount + BLOCK_REWARD / validatorCount;
+  for (const validator of block.validators) {
+    if (validator.reward !== expectedReward) {
+      throw new Error(
+        `Block ${block.index} has an invalid reward for validator ${validator.address}: expected ${expectedReward}, got ${validator.reward}`
+      );
+    }
+  }
+};
+
+const resolveTransactionReference = async (expectedHash, transactionData) => {
+  const transaction = transactionData instanceof TransactionMessage ? transactionData : new TransactionMessage(transactionData);
+  const actualHash = await transaction.hash();
+  if (actualHash !== expectedHash) {
+    throw new Error(`Transaction hash mismatch: expected ${expectedHash}, got ${actualHash}`);
+  }
+  return transaction;
+};
+
 const consensusSignableData = (validatorsAddress, type, message) => ({
   from: String(message.from),
   to: validatorsAddress,
@@ -2443,8 +2483,23 @@ class Chain extends VersionControl {
             debug(`[consensus] Block hash mismatch in proposal: expected ${blockHash}, got ${actualHash}`);
             return;
           }
+          if (BigInt(blockMessage.decoded.index) !== index) {
+            debug(`[consensus] Proposal height ${index} does not match block height ${blockMessage.decoded.index}`);
+            return;
+          }
+          if (blockMessage.decoded.producer !== from) {
+            debug(`[consensus] Proposal sender ${from} does not match block producer ${blockMessage.decoded.producer}`);
+            return;
+          }
+          validateChainLink(localBlock, {
+            index: Number(blockMessage.decoded.index),
+            hash: actualHash,
+            previousHash: String(blockMessage.decoded.previousHash)
+          });
+          await this.#validateBlockValidators(blockMessage);
+          await this.#resolveBlockTransactions(blockMessage);
         } catch (e) {
-          debug(`[consensus] Cannot fetch proposed block ${blockHash}:`, e?.message);
+          debug(`[consensus] Invalid proposed block ${blockHash}:`, e?.message);
           return;
         }
         this.#consensusRound = Number(round);
@@ -2699,15 +2754,21 @@ class Chain extends VersionControl {
     if (new Set(validatorAddresses).size !== validatorAddresses.length) {
       throw new Error(`Block ${blockMessage.decoded.index} validators contain duplicates`);
     }
-    const validatorCount = BigInt(validators.length);
-    const expectedReward = blockMessage.decoded.fees / validatorCount + blockMessage.decoded.reward / validatorCount;
-    for (const validator of validators) {
-      if (validator.reward !== expectedReward) {
-        throw new Error(
-          `Block ${blockMessage.decoded.index} has an invalid reward for validator ${validator.address}: expected ${expectedReward}, got ${validator.reward}`
-        );
-      }
-    }
+    const expectedValidators = await this.staticCall(addresses.validators, "validators");
+    validateCanonicalValidatorSet(blockMessage.decoded.index, expectedValidators, validators);
+  }
+  async #resolveBlockTransactions(blockMessage) {
+    const transactions = await Promise.all(
+      blockMessage.decoded.transactions.map(async (expectedHash) => {
+        const data = await globalThis.peernet.get(expectedHash, "transaction");
+        const transaction = await resolveTransactionReference(expectedHash, data);
+        await this.validateTransactionSignature(transaction);
+        return transaction;
+      })
+    );
+    const calculatedFees = (await Promise.all(transactions.map((transaction) => calculateFee(transaction.decoded)))).reduce((total, fee) => total + BigInt(fee), 0n);
+    validateBlockEconomics(blockMessage.decoded, calculatedFees);
+    return transactions;
   }
   /** Check if the next block will cross an epoch boundary (block-based timing) */
   #isEpochBoundary(blockHeight) {
@@ -3206,13 +3267,7 @@ class Chain extends VersionControl {
     }
     console.log(`[chain] \u2705 Block data integrity verified: ${hash}`);
     await this.#validateBlockValidators(blockMessage);
-    const transactions = await Promise.all(
-      blockMessage.decoded.transactions.map(async (hash2) => {
-        const data = await peernet.get(hash2, "transaction");
-        return new TransactionMessage(data);
-      })
-    );
-    await Promise.all(transactions.map((transaction) => this.validateTransactionSignature(transaction)));
+    const transactions = await this.#resolveBlockTransactions(blockMessage);
     await Promise.all(
       blockMessage.decoded.transactions.map(async (transactionHash) => {
         if (await transactionPoolStore.has(transactionHash)) await transactionPoolStore.delete(transactionHash);
@@ -3338,7 +3393,7 @@ class Chain extends VersionControl {
       fees: BigInt(0),
       timestamp,
       previousHash: "",
-      reward: BigInt(150),
+      reward: BLOCK_REWARD,
       index: 0,
       producer: "",
       producerProof: "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leofcoin/chain",
-  "version": "1.10.7",
+  "version": "1.10.8",
   "description": "Official javascript implementation",
   "private": false,
   "exports": {