Skip to content

feat(beefy): allow non-consecutive validator set updates within a trusting period#1802

Draft
yrong wants to merge 2 commits into
mainfrom
ron/beefy-non-consecutive-validator-update
Draft

feat(beefy): allow non-consecutive validator set updates within a trusting period#1802
yrong wants to merge 2 commits into
mainfrom
ron/beefy-non-consecutive-validator-update

Conversation

@yrong

@yrong yrong commented Jun 29, 2026

Copy link
Copy Markdown
Contributor

Context

#1137 (comment)

Permit a commitment from a later session to be authenticated against the current validator set (a "skip-ahead"), instead of requiring a consecutive handover per session. This is gated to remain safe:

  • canSkipAhead requires the id to be strictly ahead of the next set AND the era to be confirmed-stable (current.root == next.root), so signatures legitimately verify against the current root.
  • A skip is only allowed while the current set is within trustingPeriod (14 days, < Polkadot's 28-day unbonding) measured by Ethereum's block.timestamp, so the set is provably still bonded and its honest-supermajority assumption holds. Past the window it reverts TrustingPeriodExpired.
  • applySkip fast-forwards the current id (root preserved) and loads next from the leaf, but never refreshes currentSetActivatedAt, preventing a ratchet of the trust window. Genuine handovers re-anchor it, which keeps skips available across long eras (every era boundary forces a witnessed handover).

Wired into submitInitial, submitFinal, submitFiatShamir and createFiatShamirFinalBitfield.

Note: the relayer Go binding needs regenerating for the new currentSetActivatedAt and trustingPeriod getters.

…sting period

Permit a commitment from a later session to be authenticated against the current
validator set (a "skip-ahead"), instead of requiring a consecutive handover per
session. This is gated to remain safe:

- canSkipAhead requires the id to be strictly ahead of the next set AND the era to
  be confirmed-stable (current.root == next.root), so signatures legitimately
  verify against the current root.
- A skip is only allowed while the current set is within `trustingPeriod`
  (14 days, < Polkadot's 28-day unbonding) measured by Ethereum's block.timestamp,
  so the set is provably still bonded and its honest-supermajority assumption holds.
  Past the window it reverts TrustingPeriodExpired.
- applySkip fast-forwards the current id (root preserved) and loads next from the
  leaf, but never refreshes currentSetActivatedAt, preventing a ratchet of the
  trust window. Genuine handovers re-anchor it, which keeps skips available across
  long eras (every era boundary forces a witnessed handover).

Wired into submitInitial, submitFinal, submitFiatShamir and
createFiatShamirFinalBitfield. Adds BeefyClientSkipAhead.t.sol covering the
interactive skip success (id advances, root preserved, no ratchet), window-expiry
rejection on both paths, era-change-pending rejection, stale-id rejection, and
handover re-anchoring.

Note: the relayer Go binding needs regenerating for the new currentSetActivatedAt
and trustingPeriod getters.
@codecov

codecov Bot commented Jun 29, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 80.55556% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.70%. Comparing base (161ae16) to head (1792528).
⚠️ Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
contracts/src/BeefyClient.sol 80.55% 6 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1802      +/-   ##
==========================================
- Coverage   78.90%   78.70%   -0.21%     
==========================================
  Files          24       24              
  Lines         986     1019      +33     
  Branches      187      197      +10     
==========================================
+ Hits          778      802      +24     
- Misses        185      191       +6     
- Partials       23       26       +3     
Flag Coverage Δ
solidity 78.70% <80.55%> (-0.21%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant