You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

35 lines
1.8 KiB

lite2: light client with weak subjectivity (#3989) Refs #1771 ADR: https://github.com/tendermint/tendermint/blob/master/docs/architecture/adr-044-lite-client-with-weak-subjectivity.md ## Commits: * add Verifier and VerifyCommitTrusting * add two more checks make trustLevel an option * float32 for trustLevel * check newHeader time * started writing lite Client * unify Verify methods * ensure h2.Header.bfttime < h1.Header.bfttime + tp * move trust checks into Verify function * add more comments * more docs * started writing tests * unbonding period failures * tests are green * export ErrNewHeaderTooFarIntoFuture * make golangci happy * test for non-adjusted headers * more precision * providers and stores * VerifyHeader and VerifyHeaderAtHeight funcs * fix compile errors * remove lastVerifiedHeight, persist new trusted header * sequential verification * remove TrustedStore option * started writing tests for light client * cover basic cases for linear verification * bisection tests PASS * rename BisectingVerification to SkippingVerification * refactor the code * add TrustedHeader method * consolidate sequential verification tests * consolidate skipping verification tests * rename trustedVals to trustedNextVals * start writing docs * ValidateTrustLevel func and ErrOldHeaderExpired error * AutoClient and example tests * fix errors * update doc * remove ErrNewHeaderTooFarIntoFuture This check is unnecessary given existing a) ErrOldHeaderExpired b) h2.Time > now checks. * return an error if we're at more recent height * add comments * add LastSignedHeaderHeight method to Store I think it's fine if Store tracks last height * copy over proxy from old lite package * make TrustedHeader return latest if height=0 * modify LastSignedHeaderHeight to return an error if no headers exist * copy over proxy impl * refactor proxy and start http lite client * Tx and BlockchainInfo methods * Block method * commit method * code compiles again * lite client compiles * extract updateLiteClientIfNeededTo func * move final parts * add placeholder for tests * force usage of lite http client in proxy * comment out query tests for now * explicitly mention tp: trusting period * verify nextVals in VerifyHeader * refactor bisection * move the NextValidatorsHash check into updateTrustedHeaderAndVals + update the comment * add ConsensusParams method to RPC client * add ConsensusParams to rpc/mock/client * change trustLevel type to a new cmn.Fraction type + update SkippingVerification comment * stress out trustLevel is only used for non-adjusted headers * fixes after Fede's review Co-authored-by: Federico Kunze <31522760+fedekunze@users.noreply.github.com> * compare newHeader with a header from an alternative provider * save pivot header Refs https://github.com/tendermint/tendermint/pull/3989#discussion_r349122824 * check header can still be trusted in TrustedHeader Refs https://github.com/tendermint/tendermint/pull/3989#discussion_r349101424 * lite: update Validators and Block endpoints - Block no longer contains BlockMeta - Validators now accept two additional params: page and perPage * make linter happy
5 years ago
  1. /*
  2. Package lite provides a light client implementation.
  3. The concept of light clients was introduced in the Bitcoin white paper. It
  4. describes a watcher of distributed consensus process that only validates the
  5. consensus algorithm and not the state machine transactions within.
  6. Tendermint light clients allow bandwidth & compute-constrained devices, such as
  7. smartphones, low-power embedded chips, or other blockchains to efficiently
  8. verify the consensus of a Tendermint blockchain. This forms the basis of safe
  9. and efficient state synchronization for new network nodes and inter-blockchain
  10. communication (where a light client of one Tendermint instance runs in another
  11. chain's state machine).
  12. In a network that is expected to reliably punish validators for misbehavior by
  13. slashing bonded stake and where the validator set changes infrequently, clients
  14. can take advantage of this assumption to safely synchronize a lite client
  15. without downloading the intervening headers.
  16. Light clients (and full nodes) operating in the Proof Of Stake context need a
  17. trusted block height from a trusted source that is no older than 1 unbonding
  18. window plus a configurable evidence submission synchrony bound. This is called
  19. weak subjectivity.
  20. Weak subjectivity is required in Proof of Stake blockchains because it is
  21. costless for an attacker to buy up voting keys that are no longer bonded and
  22. fork the network at some point in its prior history. See Vitalik's post at
  23. [Proof of Stake: How I Learned to Love Weak
  24. Subjectivity](https://blog.ethereum.org/2014/11/25/proof-stake-learned-love-weak-subjectivity/).
  25. NOTE: Tendermint provides a somewhat different (stronger) light client model
  26. than Bitcoin under eclipse, since the eclipsing node(s) can only fool the light
  27. client if they have two-thirds of the private keys from the last root-of-trust.
  28. */
  29. package lite