@leofcoin/chain 1.8.30 → 1.9.0

package/exports/chain.js

@@ -163,8 +163,6 @@ class Transaction extends Protocol {
         transactions = await this.promiseTransactions(transactions);
         transactions = transactions.filter((tx) => tx.decoded.from === address);
         for (const transaction of transactions) {
-            if (transaction.decoded.nonce > nonce)
-                throw new Error(`a transaction with a higher nonce already exists`);
             if (transaction.decoded.nonce === nonce)
                 throw new Error(`a transaction with the same nonce already exists`);
         }
@@ -771,20 +769,30 @@ class Machine {
                     }
                     await Promise.all(promises);
                 }
+                // Helper to sort object keys for deterministic serialization
+                const sortedStringify = (obj, replacer) => {
+                    const sorted = {};
+                    const keys = Object.keys(obj).sort();
+                    for (const key of keys) {
+                        sorted[key] = obj[key];
+                    }
+                    return JSON.stringify(sorted, replacer);
+                };
                 const tasks = [
-                    stateStore.put('lastBlock', JSON.stringify(await this.lastBlock, jsonStringifyBigInt)),
-                    stateStore.put('states', JSON.stringify(state, jsonStringifyBigInt)),
-                    stateStore.put('accounts', JSON.stringify(accounts, jsonStringifyBigInt)),
-                    stateStore.put('info', JSON.stringify({
+                    stateStore.put('lastBlock', sortedStringify(await this.lastBlock, jsonStringifyBigInt)),
+                    stateStore.put('states', sortedStringify(state, jsonStringifyBigInt)),
+                    stateStore.put('accounts', sortedStringify(accounts, jsonStringifyBigInt)),
+                    stateStore.put('info', sortedStringify({
+                        nativeBurnAmount: await this.totalBurnAmount,
+                        nativeBurns: await this.nativeBurns,
                         nativeCalls: await this.nativeCalls,
                         nativeMints: await this.nativeMints,
-                        nativeBurns: await this.nativeBurns,
                         nativeTransfers: await this.nativeTransfers,
-                        totalTransactions: await this.totalTransactions,
+                        totalBlocks: await blockStore.length,
                         totalBurnAmount: await this.totalBurnAmount,
                         totalMintAmount: await this.totalMintAmount,
-                        totalTransferAmount: await this.totalTransferAmount,
-                        totalBlocks: await blockStore.length
+                        totalTransactions: await this.totalTransactions,
+                        totalTransferAmount: await this.totalTransferAmount
                     }, jsonStringifyBigInt))
                     // accountsStore.clear()
                 ];
@@ -1640,6 +1648,14 @@ class State extends Contract {
                 debug$1(`Local index ${localIndex} is ahead of remote ${remoteIndex}, skipping sync`);
                 return;
             }
+            // CRITICAL: Prevent DoS from excessive reorgs
+            const MAX_REORG_DEPTH = 6;
+            const reorgDepth = localIndex - remoteIndex;
+            if (reorgDepth > 0 && reorgDepth > MAX_REORG_DEPTH) {
+                console.warn(`[consensus-safety] Peer proposing reorg depth of ${reorgDepth} blocks ` +
+                    `(limit is ${MAX_REORG_DEPTH}). Rejecting to prevent DoS.`);
+                throw new Error(`Excessive reorg depth: ${reorgDepth} blocks (max ${MAX_REORG_DEPTH})`);
+            }
             // Use state hash comparison: only resolve if remote hash differs from local state hash
             if (localStateHash !== remoteBlockHash) {
                 if (this.wantList.length > 0) {
@@ -1700,7 +1716,15 @@ class State extends Contract {
         for (const id in globalThis.peernet.connections) {
             // @ts-ignore
             const peer = globalThis.peernet.connections[id];
-            if (peer.connected && peer.version === this.version) {
+            // CRITICAL FIX: Use semver comparison (major.minor) not exact match
+            const isVersionCompatible = () => {
+                if (!peer.version || !this.version)
+                    return false;
+                const [peerMajor, peerMinor] = peer.version.split('.');
+                const [localMajor, localMinor] = this.version.split('.');
+                return peerMajor === localMajor && peerMinor === localMinor;
+            };
+            if (peer.connected && isVersionCompatible()) {
                 const task = async () => {
                     try {
                         const result = await peer.request(node.encoded);
@@ -1734,7 +1758,15 @@ class State extends Contract {
                 throw new Error('invalid block @getLatestBlock');
             latest = { ...message.decoded, hash };
             const peer = promises[0].peer;
-            if (peer.connected && peer.version === this.version) {
+            // CRITICAL FIX: Check version compatibility using semver
+            const isVersionCompatible = () => {
+                if (!peer.version || !this.version)
+                    return false;
+                const [peerMajor, peerMinor] = peer.version.split('.');
+                const [localMajor, localMinor] = this.version.split('.');
+                return peerMajor === localMajor && peerMinor === localMinor;
+            };
+            if (peer.connected && isVersionCompatible()) {
                 let data = await new globalThis.peernet.protos['peernet-request']({
                     request: 'knownBlocks'
                 });
@@ -1742,7 +1774,11 @@ class State extends Contract {
                 try {
                     let message = await peer.request(node.encode());
                     message = await new globalThis.peernet.protos['peernet-response'](message);
-                    this.wantList.push(...message.decoded.response.blocks.filter((block) => !this.knownBlocks.includes(block)));
+                    const MAX_WANTLIST_SIZE = 1000;
+                    const incoming = message.decoded.response.blocks.filter((block) => !this.knownBlocks.includes(block));
+                    const remaining = MAX_WANTLIST_SIZE - this.wantList.length;
+                    if (remaining > 0)
+                        this.wantList.push(...incoming.slice(0, remaining));
                 }
                 catch (error) {
                     const peerId = peer?.peerId || peer?.id || peer?.address || 'unknown';
@@ -1973,6 +2009,13 @@ class VersionControl extends State {
             return this.#setCurrentVersion();
         }
     }
+    isVersionCompatible(peerVersion) {
+        if (!peerVersion || !this.version)
+            return false;
+        const [peerMajor, peerMinor] = peerVersion.split('.');
+        const [localMajor, localMinor] = this.version.split('.');
+        return peerMajor === localMajor && peerMinor === localMinor;
+    }
 }
 
 /**
@@ -2094,14 +2137,12 @@ class ConnectionMonitor {
         }
         const connectedPeers = this.connectedPeers;
         const compatiblePeers = this.compatiblePeers;
-        console.log(`🔍 Health check: ${connectedPeers.length} connected, ${compatiblePeers.length} compatible`);
-        // If a reconnection is already ongoing, skip this cycle to avoid log spam/loops
-        if (this.#reconnecting) {
-            console.log('⏭️ Health check: reconnection already in progress, skipping reconnect attempt');
-            return;
-        }
-        // If we have no connections or none are compatible, try to reconnect
-        if (connectedPeers.length === 0) {
+        const disconnectedPeers = this.disconnectedPeers;
+        console.log(`🔍 Health check: ${connectedPeers.length} connected, ${compatiblePeers.length} compatible, ${disconnectedPeers.length} negotiating`);
+        // If we have no connections or none are compatible, try to reconnect.
+        // Don't trigger reconnection if peers are still in WebRTC ICE negotiation (disconnectedPeers > 0) —
+        // reinit() would tear down the in-flight handshake.
+        if (connectedPeers.length === 0 && disconnectedPeers.length === 0) {
             console.warn('⚠️ No peer connections detected — attempting reconnection');
             await this.#attemptReconnection();
         }
@@ -2203,20 +2244,7 @@ class ConnectionMonitor {
                     console.warn('  ⚠️ peernet.start() failed:', e?.message || e);
                 }
             }
-            // Approach 3: Try client.connect if available
-            if (globalThis.peernet?.client &&
-                'connect' in globalThis.peernet.client &&
-                typeof globalThis.peernet.client.connect === 'function') {
-                console.log('  → Trying client.connect()');
-                try {
-                    await globalThis.peernet.client.connect();
-                    console.log('  ✅ client.connect() succeeded');
-                }
-                catch (e) {
-                    console.warn('  ⚠️ client.connect() failed:', e?.message || e);
-                }
-            }
-            // Approach 4: Explicitly dial star servers if available
+            // Approach 3: Explicitly dial star servers if available (only if client.reinit() didn't succeed)
             try {
                 const networkName = globalThis.peernet?.network;
                 if (networkName && typeof networkName === 'string') {
@@ -2232,11 +2260,6 @@ class ConnectionMonitor {
                                     await globalThis.peernet.client.dial(star);
                                     console.log(`  ✅ Connected to star server: ${star}`);
                                 }
-                                else if (globalThis.peernet?.client && 'connect' in globalThis.peernet.client) {
-                                    // Try connect with the star URL
-                                    await globalThis.peernet.client.connect(star);
-                                    console.log(`  ✅ Connected to star server: ${star}`);
-                                }
                             }
                             catch (e) {
                                 console.warn(`  ⚠️ Failed to dial ${star}:`, e?.message || e);
@@ -2278,14 +2301,13 @@ class ConnectionMonitor {
         });
     }
     async #attemptReconnection() {
-        if (this.#reconnecting) {
-            console.log('⏭️ Reconnection already in progress');
-            return;
-        }
         try {
             await this.#restoreNetwork();
-            // Check if reconnection was successful
-            const hasConnections = this.connectedPeers.length > 0;
+            // Check if reconnection was successful.
+            // Treat peers that are still negotiating (in connections but not yet connected) as success —
+            // they were discovered via the star and WebRTC ICE is in progress. Retrying now would call
+            // reinit() again and tear down the in-flight handshake.
+            const hasConnections = this.connectedPeers.length > 0 || this.disconnectedPeers.length > 0;
             if (hasConnections) {
                 console.log('✅ Reconnection successful, resetting backoff delay');
                 this.#reconnectDelay = 5000;
@@ -2335,35 +2357,252 @@ class Chain extends VersionControl {
     #state;
     #slotTime;
     #blockTime; // 6 second target block time
+    #epochLength; // Blocks per epoch (enables block-based epoch boundaries)
     /** {Address[]} */
     #validators;
     /** {Boolean} */
     #runningEpoch;
+    /** Block height at which current epoch started (for block-based epoch timing) */
+    #currentEpochStartHeight;
+    /** {Object} Block cache by index for conflict detection: {index: {hash, ...block}} */
+    #blocks;
     #participants;
     #participating;
     #jail;
+    #jailReleaseTimers;
     #peerConnectionRetries;
     #maxPeerRetries;
     #peerRetryDelay;
+    /** {Map} Peer reputation tracking: {peerId: {score, failures}} */
+    #peerReputations;
+    #minPeerScore;
+    #maxPeerFailures;
+    // ── Tendermint consensus state ──────────────────────────────────────────────
+    /** Current consensus round (increments when proposer is unresponsive) */
+    #consensusRound;
+    /** Timer that advances #consensusRound when the proposer doesn't propose in time */
+    #roundTimer;
+    /** prevotes collected per `height:round:blockHash` key */
+    #prevotes;
+    /** precommits collected per `height:round:blockHash` key */
+    #precommits;
+    /** Index of the last block that reached 2f+1 precommits */
+    #committedHeight;
+    /** Prevents casting duplicate prevote/precommit per height:round */
+    #castedVotes;
+    // ────────────────────────────────────────────────────────────────────────────
     #connectionMonitor;
     constructor(config) {
         super(config);
         this.#slotTime = 10000;
         this.#blockTime = 6000; // 6 second target block time
+        this.#epochLength = 10; // Blocks per epoch (enables block-based epoch boundaries)
         this.utils = {};
         /** {Address[]} */
         this.#validators = [];
         /** {Boolean} */
         this.#runningEpoch = false;
+        /** Block height at which current epoch started (for block-based epoch timing) */
+        this.#currentEpochStartHeight = 0;
+        /** {Object} Block cache by index for conflict detection: {index: {hash, ...block}} */
+        this.#blocks = {};
         this.#participants = [];
         this.#participating = false;
-        this.#jail = [];
+        this.#jail = new Set();
+        this.#jailReleaseTimers = new Map();
         this.#peerConnectionRetries = new Map();
         this.#maxPeerRetries = 5;
         this.#peerRetryDelay = 5000;
+        /** {Map} Peer reputation tracking: {peerId: {score, failures}} */
+        this.#peerReputations = new Map();
+        this.#minPeerScore = -10;
+        this.#maxPeerFailures = 100;
+        // ── Tendermint consensus state ──────────────────────────────────────────────
+        /** Current consensus round (increments when proposer is unresponsive) */
+        this.#consensusRound = 0;
+        /** Timer that advances #consensusRound when the proposer doesn't propose in time */
+        this.#roundTimer = null;
+        /** prevotes collected per `height:round:blockHash` key */
+        this.#prevotes = new Map();
+        /** precommits collected per `height:round:blockHash` key */
+        this.#precommits = new Map();
+        /** Index of the last block that reached 2f+1 precommits */
+        this.#committedHeight = -1;
+        /** Prevents casting duplicate prevote/precommit per height:round */
+        this.#castedVotes = new Set();
         this.ready = new Promise((resolve) => {
             this.readyResolve = resolve;
         });
+        // ── Tendermint consensus handlers ────────────────────────────────────────
+        /**
+         * Publish a prevote or precommit.  Idempotent — will not cast the same
+         * vote twice for the same height:round.
+         */
+        this.#castVote = async (type, blockHash, index, round) => {
+            const voteKey = `${type}:${index}:${round}`;
+            if (this.#castedVotes.has(voteKey))
+                return;
+            this.#castedVotes.add(voteKey);
+            const from = peernet.selectedAccount;
+            const payload = new TextEncoder().encode(JSON.stringify({ blockHash, index, round, from }));
+            try {
+                globalThis.peernet.publish(`consensus:${type}`, payload);
+            }
+            catch (e) {
+                debug(`peernet publish failed: consensus:${type}`, e?.message ?? e);
+            }
+        };
+        /**
+         * Phase 2 — receive a block proposal from the designated proposer.
+         * Validates the proposer is correct for height/round, fetches + validates
+         * the block from peernet, then casts a prevote.
+         */
+        this.#handleProposal = async (payload) => {
+            try {
+                const msg = JSON.parse(new TextDecoder().decode(payload));
+                const { blockHash, index, round, from } = msg;
+                const validators = await this.#getConsensusValidators(index);
+                const expectedProposerIdx = (index + round) % validators.length;
+                if (!validators[expectedProposerIdx] || validators[expectedProposerIdx] !== from) {
+                    debug(`[consensus] Proposal from wrong proposer at height ${index} round ${round}`);
+                    return;
+                }
+                const localBlock = await this.lastBlock;
+                const localIndex = localBlock?.index !== undefined ? Number(localBlock.index) : -1;
+                if (index <= localIndex) {
+                    debug(`[consensus] Ignoring stale proposal at height ${index} (local: ${localIndex})`);
+                    return;
+                }
+                // Fetch block from peernet and verify its hash
+                try {
+                    const blockData = await globalThis.peernet.get(blockHash, 'block');
+                    const blockMessage = await new BlockMessage(blockData);
+                    const actualHash = await blockMessage.hash();
+                    if (actualHash !== blockHash) {
+                        debug(`[consensus] Block hash mismatch in proposal: expected ${blockHash}, got ${actualHash}`);
+                        return;
+                    }
+                }
+                catch (e) {
+                    debug(`[consensus] Cannot fetch proposed block ${blockHash}:`, e?.message);
+                    return;
+                }
+                this.#consensusRound = round;
+                if (this.#roundTimer) {
+                    clearTimeout(this.#roundTimer);
+                    this.#roundTimer = null;
+                }
+                if (validators.includes(peernet.selectedAccount) && !this.#isJailed(peernet.selectedAccount)) {
+                    await this.#castVote('prevote', blockHash, index, round);
+                }
+            }
+            catch (e) {
+                debug('[consensus] Error handling proposal:', e?.message);
+            }
+        };
+        /**
+         * Phase 2 — collect prevotes. Once 2f+1 prevotes are seen for a block,
+         * cast a precommit.
+         */
+        this.#handlePrevote = async (payload) => {
+            try {
+                const msg = JSON.parse(new TextDecoder().decode(payload));
+                const { blockHash, index, round, from } = msg;
+                const validators = await this.#getConsensusValidators(index);
+                if (!validators.includes(from))
+                    return;
+                const localBlock = await this.lastBlock;
+                const localIndex = localBlock?.index !== undefined ? Number(localBlock.index) : -1;
+                if (index <= localIndex)
+                    return;
+                const voteKey = `${index}:${round}:${blockHash}`;
+                if (!this.#prevotes.has(voteKey))
+                    this.#prevotes.set(voteKey, new Set());
+                this.#prevotes.get(voteKey).add(from);
+                const threshold = Math.ceil((2 * validators.length) / 3);
+                const voteCount = this.#prevotes.get(voteKey).size;
+                debug(`[consensus] Prevotes ${voteKey}: ${voteCount}/${validators.length} (need ${threshold})`);
+                if (voteCount >= threshold &&
+                    validators.includes(peernet.selectedAccount) &&
+                    !this.#isJailed(peernet.selectedAccount)) {
+                    await this.#castVote('precommit', blockHash, index, round);
+                }
+            }
+            catch (e) {
+                debug('[consensus] Error handling prevote:', e?.message);
+            }
+        };
+        /**
+         * Phase 3 — collect precommits. Once 2f+1 precommits are seen for a block,
+         * commit it: non-proposers call #addBlock, then broadcast on add-block for
+         * syncing nodes.
+         */
+        this.#handlePrecommit = async (payload) => {
+            try {
+                const msg = JSON.parse(new TextDecoder().decode(payload));
+                const { blockHash, index, round, from } = msg;
+                const validators = await this.#getConsensusValidators(index);
+                if (!validators.includes(from))
+                    return;
+                if (index <= this.#committedHeight)
+                    return;
+                const voteKey = `${index}:${round}:${blockHash}`;
+                if (!this.#precommits.has(voteKey))
+                    this.#precommits.set(voteKey, new Set());
+                this.#precommits.get(voteKey).add(from);
+                const threshold = Math.ceil((2 * validators.length) / 3);
+                const voteCount = this.#precommits.get(voteKey).size;
+                debug(`[consensus] Precommits ${voteKey}: ${voteCount}/${validators.length} (need ${threshold})`);
+                if (voteCount >= threshold && index > this.#committedHeight) {
+                    this.#committedHeight = index;
+                    this.#consensusRound = 0;
+                    // Prune vote state for committed and older heights
+                    for (const key of [...this.#prevotes.keys()]) {
+                        if (Number(key.split(':')[0]) <= index)
+                            this.#prevotes.delete(key);
+                    }
+                    for (const key of [...this.#precommits.keys()]) {
+                        if (Number(key.split(':')[0]) <= index)
+                            this.#precommits.delete(key);
+                    }
+                    for (const key of [...this.#castedVotes]) {
+                        if (Number(key.split(':')[1]) <= index)
+                            this.#castedVotes.delete(key);
+                    }
+                    // Non-proposers add the block to local state now.
+                    // Proposers already committed state in #createBlock() and their
+                    // lastBlock.index === index, so the guard below skips them.
+                    const currentBlock = await this.lastBlock;
+                    const currentIndex = currentBlock?.index !== undefined ? Number(currentBlock.index) : -1;
+                    if (index > currentIndex) {
+                        debug(`[consensus] ✅ Committing block ${blockHash} at height ${index}`);
+                        try {
+                            const blockData = await globalThis.peernet.get(blockHash, 'block');
+                            await this.#addBlock(blockData);
+                        }
+                        catch (e) {
+                            debug(`[consensus] Failed to commit block ${blockHash}:`, e?.message);
+                        }
+                    }
+                    else {
+                        debug(`[consensus] ✅ Block ${blockHash} at height ${index} already committed (proposer path)`);
+                    }
+                    // Broadcast committed block so syncing / non-participating nodes can catch up
+                    try {
+                        const blockData = await globalThis.peernet.get(blockHash, 'block');
+                        globalThis.peernet.publish('add-block', blockData);
+                        globalThis.pubsub.publish('add-block', blockData);
+                    }
+                    catch (e) {
+                        debug('[consensus] Failed to broadcast committed block:', e?.message);
+                    }
+                }
+            }
+            catch (e) {
+                debug('[consensus] Error handling precommit:', e?.message);
+            }
+        };
+        // ─────────────────────────────────────────────────────────────────────────
         this.#addTransaction = async (message) => {
             const transaction = new TransactionMessage(message);
             const hash = await transaction.hash();
@@ -2387,17 +2626,149 @@ class Chain extends VersionControl {
     #sleep(ms) {
         return new Promise((resolve) => setTimeout(resolve, ms));
     }
+    async #recordPeerFailure(peerId, reason) {
+        if (!this.#peerReputations.has(peerId)) {
+            this.#peerReputations.set(peerId, { score: 0, failures: [] });
+        }
+        const rep = this.#peerReputations.get(peerId);
+        rep.score -= 1;
+        rep.failures.push(`${Date.now()}: ${reason}`);
+        if (rep.failures.length > this.#maxPeerFailures) {
+            rep.failures.shift();
+        }
+        if (rep.score < this.#minPeerScore) {
+            console.warn(`[peer-ban] Peer ${peerId} banned after ${rep.failures.length} failures`);
+            // Disconnect and don't reconnect
+            try {
+                await globalThis.peernet.disconnect(peerId);
+            }
+            catch (e) {
+                debug(`Failed to disconnect peer ${peerId}`);
+            }
+        }
+    }
+    #isJailed(address) {
+        return typeof address === 'string' && this.#jail.has(address);
+    }
+    async #getConsensusValidators(nextBlockIndex) {
+        const localBlock = await this.lastBlock;
+        const localIndex = localBlock?.index !== undefined ? Number(localBlock.index) : -1;
+        if (Array.isArray(localBlock?.validators) &&
+            localBlock.validators.length > 0 &&
+            (nextBlockIndex === undefined || nextBlockIndex === localIndex + 1)) {
+            return [
+                ...new Set(localBlock.validators
+                    .map((validator) => validator.address)
+                    .filter((address) => Boolean(address)))
+            ].sort();
+        }
+        const validators = (await this.staticCall(addresses.validators, 'validators'));
+        return [...new Set(validators)].sort();
+    }
+    #validateBlockValidators(blockMessage) {
+        const validators = blockMessage.decoded.validators || [];
+        if (!Array.isArray(validators) || validators.length === 0) {
+            throw new Error(`Block ${blockMessage.decoded.index} does not include validators`);
+        }
+        // Validate protocol version compatibility
+        if (!blockMessage.decoded.protocolVersion || typeof blockMessage.decoded.protocolVersion !== 'string') {
+            throw new Error(`Block ${blockMessage.decoded.index} does not have a valid protocolVersion field`);
+        }
+        if (!this.isVersionCompatible(blockMessage.decoded.protocolVersion)) {
+            throw new Error(`Block ${blockMessage.decoded.index} uses incompatible protocol version: ${blockMessage.decoded.protocolVersion} ` +
+                `(local: ${this.version}). Major.minor version must match.`);
+        }
+        // Validate producer field
+        if (!blockMessage.decoded.producer || typeof blockMessage.decoded.producer !== 'string') {
+            throw new Error(`Block ${blockMessage.decoded.index} does not have a valid producer field`);
+        }
+        // Validate producerProof field
+        if (!blockMessage.decoded.producerProof || typeof blockMessage.decoded.producerProof !== 'string') {
+            throw new Error(`Block ${blockMessage.decoded.index} does not have a valid producerProof field`);
+        }
+        // Verify producer is in validators list
+        const producerIsValidator = validators.some(v => v.address === blockMessage.decoded.producer);
+        if (!producerIsValidator) {
+            throw new Error(`Block ${blockMessage.decoded.index} producer ${blockMessage.decoded.producer} is not in validators list`);
+        }
+        const addresses = validators.map((validator) => validator.address);
+        if (addresses.some((address) => typeof address !== 'string' || address.length === 0)) {
+            throw new Error(`Block ${blockMessage.decoded.index} includes an invalid validator address`);
+        }
+        const canonicalAddresses = [...addresses].sort();
+        if (canonicalAddresses.some((address, index) => address !== addresses[index])) {
+            throw new Error(`Block ${blockMessage.decoded.index} validators are not canonically sorted`);
+        }
+        if (new Set(addresses).size !== addresses.length) {
+            throw new Error(`Block ${blockMessage.decoded.index} validators contain duplicates`);
+        }
+        const validatorCount = BigInt(validators.length);
+        const expectedReward = blockMessage.decoded.fees / validatorCount + blockMessage.decoded.reward / validatorCount;
+        for (const validator of validators) {
+            if (validator.reward !== expectedReward) {
+                throw new Error(`Block ${blockMessage.decoded.index} has an invalid reward for validator ${validator.address}: ` +
+                    `expected ${expectedReward}, got ${validator.reward}`);
+            }
+        }
+    }
+    /** Check if the next block will cross an epoch boundary (block-based timing) */
+    #isEpochBoundary(blockHeight) {
+        return (blockHeight + 1) % this.#epochLength === 0;
+    }
+    /** Handle epoch transition when a block crosses epoch boundary */
+    async #handleEpochBoundary(blockHeight) {
+        if (!this.#isEpochBoundary(blockHeight))
+            return;
+        // Epoch boundary crossed: update epoch start, reset round, trigger validator rotation
+        this.#currentEpochStartHeight = blockHeight + 1;
+        this.#consensusRound = 0;
+        debug(`[consensus] Epoch boundary at block ${blockHeight}: new epoch starts at height ${this.#currentEpochStartHeight}`);
+        // If we're participating as a validator, trigger immediate epoch to determine new proposer
+        if (this.#participating && !this.#runningEpoch) {
+            await this.#runEpoch();
+        }
+    }
     async #runEpoch() {
         if (this.#runningEpoch)
             return;
         this.#runningEpoch = true;
         console.log('epoch');
-        const validators = await this.staticCall(addresses.validators, 'validators');
+        const validators = await this.#getConsensusValidators();
         console.log({ validators });
+        if (this.#isJailed(peernet.selectedAccount)) {
+            this.#runningEpoch = false;
+            return;
+        }
         if (!validators.includes(peernet.selectedAccount)) {
             this.#runningEpoch = false;
             return;
         }
+        // Phase 1: Deterministic proposer selection
+        // proposer = validators[(nextBlockIndex + round) % validators.length]
+        const localBlock = await this.lastBlock;
+        const nextIndex = (localBlock?.index !== undefined ? Number(localBlock.index) : -1) + 1;
+        const proposerIdx = (nextIndex + this.#consensusRound) % validators.length;
+        const isProposer = validators[proposerIdx] === peernet.selectedAccount;
+        if (!isProposer) {
+            // Non-proposer: start round-advance timer in case proposer is unresponsive
+            if (!this.#roundTimer) {
+                this.#roundTimer = setTimeout(async () => {
+                    this.#roundTimer = null;
+                    this.#consensusRound++;
+                    debug(`[consensus] Round timed out, advancing to round ${this.#consensusRound}`);
+                    this.#runningEpoch = false;
+                    if (this.#participating)
+                        await this.#runEpoch();
+                }, this.#slotTime);
+            }
+            this.#runningEpoch = false;
+            return;
+        }
+        // We are the proposer — clear any stale round-advance timer
+        if (this.#roundTimer) {
+            clearTimeout(this.#roundTimer);
+            this.#roundTimer = null;
+        }
         const start = Date.now();
         try {
             await this.#createBlock();
@@ -2482,6 +2853,10 @@ class Chain extends VersionControl {
         globalThis.peernet.subscribe('send-transaction', this.#sendTransaction.bind(this));
         globalThis.peernet.subscribe('add-transaction', this.#addTransaction.bind(this));
         globalThis.peernet.subscribe('validator:timeout', this.#validatorTimeout.bind(this));
+        // Tendermint consensus topics
+        globalThis.peernet.subscribe('consensus:propose', this.#handleProposal.bind(this));
+        globalThis.peernet.subscribe('consensus:prevote', this.#handlePrevote.bind(this));
+        globalThis.peernet.subscribe('consensus:precommit', this.#handlePrecommit.bind(this));
         globalThis.pubsub.subscribe('peer:connected', this.#peerConnected.bind(this));
         globalThis.pubsub.publish('chain:ready', true);
         console.log('[chain] init:done');
@@ -2497,11 +2872,44 @@ class Chain extends VersionControl {
         await globalThis.transactionPoolStore.delete(hash);
     }
     async #validatorTimeout(validatorInfo) {
-        setTimeout(() => {
-            this.#jail.splice(this.#jail.indexOf(validatorInfo.address), 1);
-        }, validatorInfo.timeout);
-        this.#jail.push(validatorInfo.address);
-    }
+        const address = validatorInfo?.address;
+        if (!address)
+            return;
+        const timeout = Math.min(Math.max(Number(validatorInfo.timeout) || 0, 0), 60 * 60 * 1000);
+        const existingRelease = this.#jailReleaseTimers.get(address);
+        if (existingRelease)
+            clearTimeout(existingRelease);
+        this.#jail.add(address);
+        const releaseTimer = setTimeout(() => {
+            this.#jail.delete(address);
+            this.#jailReleaseTimers.delete(address);
+        }, timeout);
+        this.#jailReleaseTimers.set(address, releaseTimer);
+    }
+    // ── Tendermint consensus handlers ────────────────────────────────────────
+    /**
+     * Publish a prevote or precommit.  Idempotent — will not cast the same
+     * vote twice for the same height:round.
+     */
+    #castVote;
+    /**
+     * Phase 2 — receive a block proposal from the designated proposer.
+     * Validates the proposer is correct for height/round, fetches + validates
+     * the block from peernet, then casts a prevote.
+     */
+    #handleProposal;
+    /**
+     * Phase 2 — collect prevotes. Once 2f+1 prevotes are seen for a block,
+     * cast a precommit.
+     */
+    #handlePrevote;
+    /**
+     * Phase 3 — collect precommits. Once 2f+1 precommits are seen for a block,
+     * commit it: non-proposers call #addBlock, then broadcast on add-block for
+     * syncing nodes.
+     */
+    #handlePrecommit;
+    // ─────────────────────────────────────────────────────────────────────────
     #addTransaction;
     async #prepareRequest(request) {
         let node = await new globalThis.peernet.protos['peernet-request']({ request });
@@ -2557,17 +2965,7 @@ class Chain extends VersionControl {
         debug(`peer connected: ${peerId}`);
         const peer = peernet.getConnection(peerId);
         debug(`peer connected with version ${peer.version}`);
-        // todo handle version changes
-        // for now just do nothing if version doesn't match
-        debug(`peer connected with version ${peer.version}`);
-        const compatibleVersion = () => {
-            if (!peer.version || !this.version)
-                return false;
-            const [peerMajor, peerMinor] = peer.version.split('.');
-            const [localMajor, localMinor] = this.version.split('.');
-            return peerMajor === localMajor && peerMinor === localMinor;
-        };
-        if (!compatibleVersion()) {
+        if (!this.isVersionCompatible(peer.version)) {
             debug(`versions don't match`);
             return;
         }
@@ -2581,9 +2979,19 @@ class Chain extends VersionControl {
         catch (error) {
             const peerName = peer?.peerId || peer?.id || peer?.address || peerId || 'unknown';
             debug(`lastBlock request failed: ${peerName}:`, error?.message ?? error);
+            await this.#recordPeerFailure(peerId, `lastBlock request failed: ${error?.message ?? error}`);
             return;
         }
+        // CRITICAL: Validate the peer's claimed block height is not unreasonably ahead of our local chain
+        // This prevents Byzantine nodes from claiming a fake chain length to steer our sync
         const localBlock = await this.lastBlock;
+        const MAX_SYNC_AHEAD = 100_000;
+        if (lastBlock?.index > (localBlock?.index ?? 0) + MAX_SYNC_AHEAD) {
+            const peerName = peer?.peerId || peer?.id || peer?.address || peerId || 'unknown';
+            debug(`Peer ${peerName} claims unreasonable block height ${lastBlock.index} (local: ${localBlock?.index ?? 0})`);
+            await this.#recordPeerFailure(peerId, `unreasonable lastBlock index: ${lastBlock.index}`);
+            return;
+        }
         if (!lastBlock || !lastBlock.hash || lastBlock.hash === '0x0') {
             debug(`peer has no lastBlock: ${peerId}`);
             return;
@@ -2601,14 +3009,20 @@ class Chain extends VersionControl {
                             console.log(e);
                         }
                     }
-                    if (knownBlocksResponse.blocks)
-                        for (const hash of knownBlocksResponse.blocks) {
-                            this.wantList.push(hash);
+                    const MAX_WANTLIST_SIZE = 1000;
+                    if (knownBlocksResponse.blocks) {
+                        const remaining = MAX_WANTLIST_SIZE - this.wantList.length;
+                        if (remaining > 0) {
+                            for (const hash of knownBlocksResponse.blocks.slice(0, remaining)) {
+                                this.wantList.push(hash);
+                            }
                         }
+                    }
                 }
                 catch (error) {
                     const peerName = peer?.peerId || peer?.id || peer?.address || peerId || 'unknown';
                     debug(`knownBlocks request failed: ${peerName}:`, error?.message ?? error);
+                    await this.#recordPeerFailure(peerId, `knownBlocks request failed: ${error?.message ?? error}`);
                     return;
                 }
             }
@@ -2651,6 +3065,7 @@ class Chain extends VersionControl {
         catch (error) {
             const peerName = peer?.peerId || peer?.id || peer?.address || peerId || 'unknown';
             debug(`stateInfo/syncChain failed: ${peerName}:`, error?.message ?? error);
+            await this.#recordPeerFailure(peerId, `stateInfo/syncChain failed: ${error?.message ?? error}`);
             return;
         }
     }
@@ -2687,26 +3102,55 @@ class Chain extends VersionControl {
         const receivedEncoded = block instanceof BlockMessage ? block.encoded : block;
         const blockMessage = await new BlockMessage(block);
         const hash = await blockMessage.hash();
-        // Verify data integrity: re-encode should produce the same bytes
-        const canonicalEncoded = blockMessage.encoded;
-        if (receivedEncoded.length === canonicalEncoded.length) {
-            let mismatch = false;
-            for (let i = 0; i < receivedEncoded.length; i++) {
-                if (receivedEncoded[i] !== canonicalEncoded[i]) {
-                    mismatch = true;
-                    break;
-                }
+        // CRITICAL: VALIDATE BEFORE TOUCHING STATE
+        // 1. Check for duplicate blocks at same height
+        const blockIndex = Number(blockMessage.decoded.index);
+        const existingBlockAtHeight = this.#blocks[blockIndex];
+        if (existingBlockAtHeight) {
+            if (existingBlockAtHeight.hash !== hash) {
+                console.error(`[CONSENSUS ALERT] Conflicting blocks at height ${blockIndex}:`);
+                console.error(`  Local:  ${existingBlockAtHeight.hash}`);
+                console.error(`  Remote: ${hash}`);
+                throw new Error(`Block conflict detected at index ${blockIndex}`);
+            }
+            // Already have this exact block, skip
+            debug(`Block already in store: ${hash}`);
+            return;
+        }
+        // 2. Verify previous hash chain integrity
+        if (blockIndex > 0) {
+            const previousBlockInfo = this.#blocks[blockIndex - 1];
+            if (!previousBlockInfo) {
+                throw new Error(`Missing parent block at index ${blockIndex - 1}`);
             }
-            if (mismatch) {
-                console.warn(`[chain] ⚠️  Block data corrupted in transit: encoded bytes don't match canonical form for block #${blockMessage.decoded.index}`);
+            if (previousBlockInfo.hash !== blockMessage.decoded.previousHash) {
+                throw new Error(`previousHash mismatch at index ${blockIndex}: ` +
+                    `expected ${previousBlockInfo.hash}, got ${blockMessage.decoded.previousHash}`);
             }
-            else {
-                console.log(`[chain] ✅ Block data integrity verified via codec: ${hash}`);
+        }
+        else if (blockMessage.decoded.previousHash !== '0x0') {
+            throw new Error(`Genesis block (index 0) must have previousHash='0x0'`);
+        }
+        // 3. Verify data integrity
+        const canonicalEncoded = blockMessage.encoded;
+        const byteLengthMatch = receivedEncoded.length === canonicalEncoded.length;
+        if (!byteLengthMatch) {
+            throw new Error(`[FATAL] Block data size mismatch: received ${receivedEncoded.length} bytes ` +
+                `but canonical encoding is ${canonicalEncoded.length} bytes for block #${blockMessage.decoded.index}`);
+        }
+        let mismatch = false;
+        for (let i = 0; i < receivedEncoded.length; i++) {
+            if (receivedEncoded[i] !== canonicalEncoded[i]) {
+                mismatch = true;
+                break;
             }
         }
-        else {
-            console.warn(`[chain] ⚠️  Block data size mismatch: received ${receivedEncoded.length} bytes but canonical is ${canonicalEncoded.length} bytes for block #${blockMessage.decoded.index}`);
+        if (mismatch) {
+            throw new Error(`[FATAL] Block data corrupted in transit for block #${blockIndex} hash ${hash}`);
         }
+        console.log(`[chain] ✅ Block data integrity verified: ${hash}`);
+        this.#validateBlockValidators(blockMessage);
+        // NOW SAFE TO PROCEED with transaction processing
         const transactions = await Promise.all(blockMessage.decoded.transactions
             // @ts-ignore
             .map(async (hash) => {
@@ -2715,24 +3159,34 @@ class Chain extends VersionControl {
             return new TransactionMessage(data);
         }));
         await globalThis.blockStore.put(hash, blockMessage.encoded);
+        // Cache block for conflict detection
+        this.#blocks[blockIndex] = {
+            hash,
+            ...blockMessage.decoded
+        };
         debug(`added block: ${hash}`);
         let promises = [];
         let contracts = [];
-        const normalTransactions = [];
-        const priorityransactions = [];
-        for (const transaction of transactions) {
+        // Combine and sort all transactions deterministically
+        const allTransactions = transactions.sort((a, b) => {
+            // Primary: by priority (true first)
+            if (a.decoded.priority !== b.decoded.priority) {
+                return (b.decoded.priority ? 1 : 0) - (a.decoded.priority ? 1 : 0);
+            }
+            // Secondary: by nonce
+            const nonceDiff = (a.decoded?.nonce ?? 0) - (b.decoded?.nonce ?? 0);
+            if (nonceDiff !== 0)
+                return nonceDiff;
+            // Tertiary: in stable order (insertion order preserved)
+            return 0;
+        });
+        // Execute sequentially (NOT concurrently) to ensure deterministic state
+        for (const transaction of allTransactions) {
             if (!contracts.includes(transaction.decoded.to)) {
                 contracts.push(transaction.decoded.to);
             }
-            if (transaction.decoded.priority)
-                priorityransactions.push(transaction);
-            else
-                normalTransactions.push(transaction);
-        }
-        for (const transaction of priorityransactions.sort((a, b) => a.decoded.nonce - b.decoded.nonce)) {
             await this.#handleTransaction(transaction, []);
         }
-        await Promise.all(normalTransactions.map((transaction) => this.#handleTransaction(transaction, [])));
         // for (let transaction of transactionsMessages) {
         //   // await transactionStore.put(transaction.hash, transaction.encoded)
         //   if (!contracts.includes(transaction.to)) {
@@ -2757,6 +3211,15 @@ class Chain extends VersionControl {
             await Promise.all(Object.entries(noncesByAddress).map(([from, nonce]) => globalThis.accountsStore.put(from, String(nonce))));
             if ((await this.lastBlock).index < Number(blockMessage.decoded.index)) {
                 await this.machine.addLoadedBlock({ ...blockMessage.decoded, loaded: true, hash: await blockMessage.hash() });
+                // Record validator snapshot at this block height for future consensus queries
+                try {
+                    await this.call(addresses.validators, 'recordValidatorSnapshot', [blockMessage.decoded.index]);
+                }
+                catch (snapshotError) {
+                    debug(`failed to record validator snapshot: ${snapshotError?.message ?? snapshotError}`);
+                }
+                // Check if this block crosses epoch boundary and handle transition
+                await this.#handleEpochBoundary(Number(blockMessage.decoded.index));
                 await this.updateState(blockMessage);
             }
             globalThis.pubsub.publish('block-processed', blockMessage.decoded);
@@ -2848,23 +3311,31 @@ class Chain extends VersionControl {
             timestamp,
             previousHash: '',
             reward: BigInt(150),
-            index: 0
+            index: 0,
+            producer: '',
+            producerProof: '',
+            protocolVersion: this.version
         };
         const latestTransactions = await this.machine.latestTransactions();
         // exclude failing tx
         transactions = await this.promiseTransactions(transactions);
-        const normalTransactions = [];
-        const priorityransactions = [];
-        for (const transaction of transactions) {
-            if (transaction.decoded.priority)
-                priorityransactions.push(transaction);
-            else
-                normalTransactions.push(transaction);
-        }
-        for (const transaction of priorityransactions.sort((a, b) => a.decoded.nonce - b.decoded.nonce)) {
+        // Combine priority and normal transactions, then sort deterministically
+        const allTransactions = transactions.sort((a, b) => {
+            // Primary: by priority (true first)
+            if (a.decoded.priority !== b.decoded.priority) {
+                return (b.decoded.priority ? 1 : 0) - (a.decoded.priority ? 1 : 0);
+            }
+            // Secondary: by nonce
+            const nonceDiff = (a.decoded?.nonce ?? 0) - (b.decoded?.nonce ?? 0);
+            if (nonceDiff !== 0)
+                return nonceDiff;
+            // Tertiary: in stable order (insertion order preserved)
+            return 0;
+        });
+        // Execute sequentially (NOT concurrently) to ensure deterministic state
+        for (const transaction of allTransactions) {
             await this.#handleTransaction(transaction, latestTransactions, block);
         }
-        await Promise.all(normalTransactions.map((transaction) => this.#handleTransaction(transaction, latestTransactions, block)));
         // don't add empty block
         if (block.transactions.length === 0)
             return;
@@ -2882,7 +3353,7 @@ class Chain extends VersionControl {
         }
         for (const validator of validators) {
             const peer = peers[validator];
-            if (peer && peer.connected && peer.version === this.version) {
+            if (peer && peer.connected && this.isVersionCompatible(peer.version)) {
                 let data = await new BWRequestMessage();
                 const node = await globalThis.peernet.prepareMessage(data.encoded);
                 try {
@@ -2922,26 +3393,54 @@ class Chain extends VersionControl {
         // block.timestamp = Date.now()
         // block.reward = block.reward.toString()
         // block.fees = block.fees.toString()
+        // CRITICAL FIX: Sort validators deterministically to avoid encoding divergence
+        // Use canonical validator set from contract, sorted by address
+        const canonicalValidators = (await this.staticCall(addresses.validators, 'validators'));
+        const sortedValidators = [...canonicalValidators].sort();
+        // Apply reward to all canonical validators (deterministic)
+        block.validators = sortedValidators.map((validatorAddress) => ({
+            address: validatorAddress,
+            reward: block.fees / BigInt(sortedValidators.length) + block.reward / BigInt(sortedValidators.length)
+        }));
         try {
             await Promise.all(block.transactions.map(async (transaction) => {
                 await globalThis.transactionStore.put(transaction, await transactionPoolStore.get(transaction));
                 await globalThis.transactionPoolStore.delete(transaction);
             }));
+            // Set producer to current account
+            block.producer = globalThis.peernet.selectedAccount || '';
+            // Sign block hash to authenticate producer (producer must be the proposer)
+            if (block.producer && this.keypair) {
+                const blockHashInput = JSON.stringify({
+                    index: block.index,
+                    previousHash: block.previousHash,
+                    timestamp: block.timestamp,
+                    validators: block.validators.map(v => v.address).sort()
+                });
+                block.producerProof = await signTransaction(blockHashInput, this.keypair);
+            }
             let blockMessage = await new BlockMessage(block);
             const hash = await blockMessage.hash();
             await globalThis.peernet.put(hash, blockMessage.encoded, 'block');
             await this.machine.addLoadedBlock({ ...blockMessage.decoded, loaded: true, hash: await blockMessage.hash() });
             await this.updateState(blockMessage);
             debug(`created block: ${hash} @${block.index}`);
-            // Publish canonical encoded form via codec interface
-            console.log(`[chain] 📤 Publishing block #${block.index} | hash: ${hash} | encoded bytes: ${blockMessage.encoded.length}`);
+            // Phase 2: announce proposal for consensus voting instead of direct add-block
+            console.log(`[consensus] 📤 Proposing block #${block.index} | hash: ${hash} | round: ${this.#consensusRound}`);
+            const proposalPayload = new TextEncoder().encode(JSON.stringify({
+                blockHash: hash,
+                index: block.index,
+                round: this.#consensusRound,
+                from: peernet.selectedAccount
+            }));
             try {
-                globalThis.peernet.publish('add-block', blockMessage.encoded);
+                globalThis.peernet.publish('consensus:propose', proposalPayload);
             }
             catch (publishError) {
-                debug('peernet publish failed: add-block', publishError?.message ?? publishError);
+                debug('peernet publish failed: consensus:propose', publishError?.message ?? publishError);
             }
-            globalThis.pubsub.publish('add-block', blockMessage.encoded);
+            // Proposer casts their own prevote immediately
+            await this.#castVote('prevote', hash, block.index, this.#consensusRound);
         }
         catch (error) {
             console.log(error);