@optimystic/db-p2p 0.21.0 → 0.24.0

package/src/dispute/dispute-service.ts

@@ -1,5 +1,5 @@
-import type { ClusterRecord, ITransactionValidator, InvalidateRequest, CommitRequest, PendRequest, CollectionId } from '@optimystic/db-core';
-import { blockIdsForTransforms, computeClusterPromiseHash, recordMembershipDigest } from '@optimystic/db-core';
+import type { ClusterRecord, Signature, ITransactionValidator, InvalidateRequest, CommitRequest, PendRequest, CollectionId } from '@optimystic/db-core';
+import { blockIdsForTransforms, computeClusterPromiseHash, clusterVoteVerificationPayload, recordMembershipDigest } from '@optimystic/db-core';
 import { buildDisputeResolutionProof, computeTargetHash, computeArbitratorSetHash, voteSigningPayload, arbitratorSetSigningPayload, VOTE_VERSION, type CertificateTarget } from './invalidation.js';
 import type { PeerId, PrivateKey } from '@libp2p/interface';
 import { sha256 } from 'multiformats/hashes/sha2';
@@ -390,6 +390,13 @@ export class DisputeService {
 			// peer's id to get that peer a FalseApproval penalty. Gate each false-approval on the approval
 			// being binding-valid (key bound to the id AND signature verifies); skip — never penalize —
 			// any approval that is unbound or invalid.
+			//
+			// For the same reason, the peer multiaddrs inside `originalRecord.peers` are deliberately
+			// NOT fed to the address book here, unlike the cluster/redirect paths (see
+			// `peer-address-book.ts`). Those paths consume a record we are an intended recipient of;
+			// a challenge's originalRecord is attacker-supplied on a path that already flags itself as
+			// unverified, so learning addresses from it would widen that surface for no gain — a
+			// disputing peer is not one we are about to need a route to.
 			const originalRecord = challenge.originalRecord;
 			const promiseHash = await this.computePromiseHash(originalRecord);
 			for (const [peerId, signature] of Object.entries(originalRecord.promises)) {
@@ -665,7 +672,7 @@ export class DisputeService {
 		record: ClusterRecord,
 		peerId: string,
 		promiseHash: string,
-		signature: { type: string; signature: string; rejectReason?: string }
+		signature: Signature
 	): Promise<boolean> {
 		const publicKey = record.peers[peerId]?.publicKey;
 		if (!publicKey?.length) return false;
@@ -675,8 +682,7 @@ export class DisputeService {
 				: publicKey;
 			if (!peerIdBindsPublicKey(peerId, keyBytes)) return false;
 			const pubKey = publicKeyFromRaw(keyBytes);
-			const payloadStr = promiseHash + ':' + signature.type + (signature.rejectReason ? ':' + signature.rejectReason : '');
-			const payload = new TextEncoder().encode(payloadStr);
+			const payload = clusterVoteVerificationPayload(promiseHash, signature);
 			const sigBytes = uint8ArrayFromString(signature.signature, 'base64url');
 			return pubKey.verify(payload, sigBytes);
 		} catch {