anoma / namada

Rust implementation of Namada, a Proof-of-Stake L1 for interchain asset-agnostic privacy
https://namada.net
GNU General Public License v3.0
2.4k stars 956 forks source link

Remove validator address fields from vote extensions once we switch to ABCI++ #635

Open james-chf opened 2 years ago

james-chf commented 2 years ago

Once we switch to ABCI++, for vote extensions, we should be able to derive the validator's Namada address from their Tendermint address/key, rather than having to include it in the vote extension itself.

https://github.com/anoma/namada/blob/a669ca573f1d3f61b87cdcb8eba7cb9a6f872a6a/shared/src/types/vote_extensions/ethereum_events.rs#L21-L31

james-chf commented 1 year ago

Some extra context - for initial launch with Tendermint v0.37 where vote extensions are being packaged inside regular transactions, we do need the validator addresses inside the vote extensions, as we can't work them out from the Tendermint address as we won't have that.

With ABCI++ vote extensions, Tendermint will do some signature checking/replay protection for us like that a vote extension from validator X was signed by validator X's Tendermint key. While we are using vote extensions packaged inside regular transactions, we need to explicitly check that they were actually signed over by the validator specified in the address field (we will still do this application level signature check as well when we switch to ABCI++, in addition to the signature checking which Tendermint does - but we may not need the Namada address field anymore since we should be able to derive that from the Tendermint address we receive with each vote extesnion).

Currently (as of commit dc2586dc3f34586fcff02198710e929d07fd6826 in eth-bridge-integration branch), we do this application level signature check at two places: