base-org / pessimism

Detect real-time threats and events on OP Stack compatible blockchains
https://base-org.github.io/pessimism/
MIT License
1.54k stars 435 forks source link

[RFC] Event/Transaction Frequency Heuristic #147

Closed epociask closed 12 months ago

epociask commented 1 year ago

Heuristic Description

NOTE - Some the provided use cases could be redundant with existing telemetry that's already leveraged by OP Stack chain operators

Context

Some system contract events that emit from OP Stack contracts occur on semi-deterministic time intervals. The same applies to some protocol transactions as well. For example, proposer submission to the L2OutputOracle typically occur around every hour on Base (see Etherscan). If this event were to not occur on its expected interval and be missed, it could be indicative of potential sequencer/protocol liveness failures. Furthermore the same could be said for an event that occurs too frequently/fast as well.

Example Use Cases

Some further examples of other potential liveness failures that could be caught via this heuristic:

  1. Anomalous batch submission failure where the BatchInbox is not being posted to by the op-batcher
  2. Proposer failure where OutputProposal events fail to post to the L2OutputOracle contract via the op-proposer
  3. Anomalous (deposit,withdrawal) bridge transaction/event frequencies could be indicative of either protocol (e.g, paused withdrawals on L1) or integration failure (e.g, crashed entry-point UIs that most users use to bridge funds to layer2).

Technical Details

There should exist some calculation policies for how an event/transaction delta is computed that is configurable via the heurisitc_params; e.g:

Additionally a type enum should supported that assumes either transaction or contract_event.