Repository navigation
[guardian-proxy] Limit each member's committee updates - #1395
Draft
0xsiddharthks wants to merge 1 commit into
Draft
0xsiddharthks wants to merge 1 commit into
0xsiddharthks wants to merge 1 commit into
Conversation
A member could resend committee updates without limit. One naming an epoch with no stored handoff costs the proxy two Sui reads each time, on the provider its allowlist refresh uses, and the enclave parses every chain it is sent. HandoffGate now takes one committee update per member every 5 seconds, whatever its outcome. The member gate sets the admitted member's TLS key on the request, and the forwarder passes it to the handoff gate. A leader retries a refused push every checkpoint, so the limit delays a handoff by at most that interval.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A committee member can resend committee updates without limit, each costing the proxy up to two Sui reads and the enclave a chain to parse. The proxy now takes one committee update per member every 5 seconds (follow-up to #1365).
Changes
HandoffGate::admittakes the calling member and refuses a second update withinUPDATE_INTERVAL.member_authsets the admitted member'sMemberKeyon the request, andForwardingpasses it to the gate.guardian_proxy_handoff_refused_totalgains therate_limitedreason.Nodes need no change. A leader retries a refused push every checkpoint, so the limit delays a handoff by at most 5 seconds.
Hops at or below the guardian's epoch are still forwarded. With this limit a resent chain reaches the enclave once per interval per member.