[gjermundgaraba]

Description

Stacked on #1588. The QBFT light client freezes on both kinds of misbehaviour it detects, but only fixture tests showed it. Two e2e tests now forge evidence on a live four-validator chain, seal it with a quorum of its validator keys, and submit it through the router as a Headers misbehaviour message.

• Tests (e2e/besu_misbehaviour_test.go): TestBesuQBFTClient_DoubleSignFreeze pairs a header with a copy at the same height carrying another state root; TestBesuQBFTClient_TimeNonMonotonicityFreeze pairs a header with the next one resealed at its timestamp. Each requires the client's event and frozen state, a FrozenClientState revert for an otherwise valid update, and the next transfer to stay pending.
• Sealing (cli/besu/header.go): SealHeader sets a header's validators and reseals it under a consensus. Signers must be distinct validators of the set, so it never silently drops a seal.
• Helper (e2e/internal/e2etest/besu.go): BesuHeaders reads a managed Besu chain's headers, waiting with the chain's timing, and seals forged ones with its validator keys.
• Signer.BroadcastTx returns the receipt, so tests can read its logs.

Part of FOU-1903 (Linear).

Verification

• Both misbehaviour tests pass in complete mode against Besu 26.5.0, on top of the full stack (test(e2e): generate the Besu light-client fixtures from the e2e harness #1590).
• TestSealHeader covers both consensuses, a signer outside the set and a repeated signer. go test ./... in cli, both lint targets and refgen.py all --check pass.

---

• Linked to GitHub issue with discussion and accepted design, OR link to spec that describes this work. (Linear FOU-1903)
• Include changelog entry when appropriate (e.g. chores should be omitted from changelog). (n/a: CHANGELOG.md only tracks the spec)
• Wrote unit and e2e tests if relevant.
• Updated documentation (docs/) if anything is changed. (e2e/README.md, e2e/test-matrix.md)
• Added godoc comments if relevant.
• Self-reviewed Files changed in the GitHub PR explorer.
• Provide a conventional commit message to follow the repository standards.

🤖 Generated with Claude Code

[linear-code]

FOU-1903

[github-actions]

Vulnerable dependencies

2 advisories across 2 libraries need attention, 2 accepted.

🚨 Needs attention

github.com/cosmos/evm

In use: v0.7.3 — reached from e2e

Advisory	CVE	Fixed in	Summary
GO-2025-3684	—	no fix yet	Cosmos EVM Allows Partial Precompile State Writes in github.com/cosmos/evm

Go standard library

In use: go1.26.9 — reached from cli, e2e, gen/go/solidity-abi

Advisory	CVE	Fixed in	Summary
GO-2026-6809	CVE-2026-111943	go1.26.10	Distrust compromised intermediate certificates in crypto/x509

Run make vulncheck for the call paths. Either upgrade the library, or add the
advisory to .govulncheck-ignore with a reason if no fix exists yet.

Accepted

Listed in .govulncheck-ignore with a reason.

github.com/pion/dtls/v2

In use: v2.2.12 — reached from cli

Advisory	CVE	Fixed in	Summary
GO-2026-4479	CVE-2026-26014	no fix yet	Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls

golang.org/x/crypto

In use: v0.57.0 — reached from cli, e2e

Advisory	CVE	Fixed in	Summary
GO-2026-5932	—	no fix yet	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

_{From make vulncheck-json on this run: logs.}

[greptile-apps]

Confidence Score: 5/5

[Low impact] The PR appears safe to merge; no actionable issues were found.

Summary

Adds live QBFT tests for double-sign and non-increasing-time evidence.

• Besu headers can be resealed with a chosen validator set.
• Live Besu tests trace misbehaviour evidence through to stuck packets.

Diagram

sequenceDiagram
  participant Test
  participant Source as Source Besu chain
  participant Router as Destination router
  participant Client as QBFT client
  Test->>Source: Read honest headers
  Test->>Test: Forge and seal conflicting evidence
  Test->>Router: submitMisbehaviour
  Router->>Client: Check both headers
  Client-->>Test: Event and frozen state
  Test->>Router: Submit honest update
  Client-->>Test: FrozenClientState
  Test->>Source: Send another transfer
  Test->>Test: Check transfer stays pending

Loading

_{Reviews (2) · Last reviewed commit: "test(e2e): freeze a Besu QBFT client wit..." · Reviewed by Greptile}

[gjermundgaraba]

@greptile review