Skip to content

consensus/istanbul: apply the import body rules in backend.Verify - #1028

Open
hyunsooda wants to merge 1 commit into
kaiachain:devfrom
hyunsooda:fix/verify-proposal-body-rules
Open

consensus/istanbul: apply the import body rules in backend.Verify#1028
hyunsooda wants to merge 1 commit into
kaiachain:devfrom
hyunsooda:fix/verify-proposal-body-rules

Conversation

@hyunsooda

@hyunsooda hyunsooda commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Proposed changes

Problem

  • backend.Verify checked the tx root but not two body rules ValidateBody enforces on import: that every tx is priced at or above the header's base fee, and that the header's blobGasUsed agrees with the body. The tx root only commits to the list the proposer chose, and ValidateHeader never sees the body.
  • A proposal breaking either rule is PREPARE/COMMIT-ed by honest validators and only refused later on import.

Fix

  • Apply both rules in Verify, as the EIP-7934 size cap already is. That cap now runs before the transaction loop so a block breaking several rules reports the same error the import path would.

Types of changes

  • 🐛 Bug fix
  • ✨ Non-hardfork changes (node upgrade not required)
  • 💥 Hardfork / consensus-breaking changes
  • 🧪 Test improvements
  • 🧰 CI / build tool
  • ♻️ Chore / Refactor / Non-functional changes

Checklist

  • 📖 I have read the CONTRIBUTING GUIDELINES doc
  • 📝 I have signed in the PR comment I have read the CLA Document and I hereby sign the CLA in first time contribute after having read CLA
  • 🟢 Lint and unit tests pass locally with my changes ($ make test)

Related issues

Further comments

Verify checked the tx root but not the two body rules ValidateBody enforces on
import: that every transaction is priced at or above the header's base fee, and
that the header's blobGasUsed agrees with the number of blobs in the body. The
tx root only commits to the transaction list the proposer chose, so it does not
detect either violation, and ValidateHeader cannot detect the second one because
it never sees the body. A proposal breaking either rule is therefore PREPARE and
COMMIT-ed by honest validators and only refused later on import, costing a round.

Apply both rules in Verify, as the EIP-7934 size cap already is. That cap now
runs before the transaction loop so a block violating several rules reports the
same error the import path would.

Constraint: honest proposals must keep passing; both checks mirror ValidateBody
  verbatim so a block accepted on import is accepted here
Rejected: call ValidateBody from Verify | it also returns ErrKnownBlock and
  ErrPrunedAncestor, which are meaningless or wrong for a proposal
Rejected: extract one body validator shared by both paths | needs the
  deterministic half of ValidateBody split out, and changes the tx-root error
  sentinel Verify already returns
Confidence: high
Scope-risk: narrow
Not-tested: a proposal breaking these rules over a real consensus round

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@hyunsooda hyunsooda self-assigned this Aug 10, 2026
@hyunsooda hyunsooda changed the title jconsensus/istanbul: apply the import body rules in backend.Verify consensus/istanbul: apply the import body rules in backend.Verify Aug 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant