Add gov proposal based migration trigger #3650
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,125 @@ | ||
| package app | ||
|
|
||
| import ( | ||
| "context" | ||
| "math" | ||
| "testing" | ||
| "time" | ||
|
|
||
| "github.com/sei-protocol/sei-chain/app/migration" | ||
| abci "github.com/sei-protocol/sei-chain/sei-tendermint/abci/types" | ||
| tmproto "github.com/sei-protocol/sei-chain/sei-tendermint/proto/tendermint/types" | ||
| "github.com/stretchr/testify/require" | ||
| ) | ||
|
|
||
| // TestMigrationSubspaceRegistered verifies the generic "migration" params | ||
| // subspace is wired with its key table so governance can edit | ||
| // NumKeysToMigratePerBlock via a ParameterChangeProposal. | ||
| func TestMigrationSubspaceRegistered(t *testing.T) { | ||
| a := Setup(t, false, false, false) | ||
| subspace, ok := a.ParamsKeeper.GetSubspace(migration.SubspaceName) | ||
| require.True(t, ok, "migration subspace must be registered") | ||
| require.True(t, subspace.HasKeyTable(), "migration subspace must have a key table") | ||
|
|
||
| ctx := a.NewContext(false, tmproto.Header{Height: 1, ChainID: "sei-test", Time: time.Now()}) | ||
| subspace.Set(ctx, migration.KeyNumKeysToMigratePerBlock, uint64(123)) | ||
| var got uint64 | ||
| subspace.GetIfExists(ctx, migration.KeyNumKeysToMigratePerBlock, &got) | ||
| require.Equal(t, uint64(123), got) | ||
| } | ||
|
|
||
| // TestApplyMigrationBatchSize covers the BeginBlock push: the gov param is | ||
| // read from chain state and forwarded into the SC commit store. | ||
| func TestApplyMigrationBatchSize(t *testing.T) { | ||
| a := Setup(t, false, false, false) | ||
| ctx := a.NewContext(false, tmproto.Header{Height: 1, ChainID: "sei-test", Time: time.Now()}) | ||
|
|
||
| subspace, ok := a.ParamsKeeper.GetSubspace(migration.SubspaceName) | ||
| require.True(t, ok) | ||
|
|
||
| // Unset param: the store receives the default (0 = paused). | ||
| a.applyMigrationBatchSize(ctx) | ||
| got, ok := a.rootStore.GetMigrationBatchSize() | ||
| require.True(t, ok, "SC store should track a migration batch size") | ||
| require.Equal(t, 0, got) | ||
|
|
||
| // Governance raises the rate: BeginBlock forwards the new value. | ||
| subspace.Set(ctx, migration.KeyNumKeysToMigratePerBlock, uint64(500)) | ||
| a.applyMigrationBatchSize(ctx) | ||
| got, _ = a.rootStore.GetMigrationBatchSize() | ||
| require.Equal(t, 500, got) | ||
|
|
||
| // Defense-in-depth: an out-of-range value reaching state (gov validation | ||
| // already rejects these) is clamped to the sane maximum, never overflowing | ||
| // the int cast or the migration iterator preallocation. | ||
| subspace.Set(ctx, migration.KeyNumKeysToMigratePerBlock, uint64(math.MaxUint64)) | ||
| a.applyMigrationBatchSize(ctx) | ||
| got, _ = a.rootStore.GetMigrationBatchSize() | ||
| require.Equal(t, int(migration.MaxNumKeysToMigratePerBlock), got) | ||
| } | ||
|
|
||
| // TestBeginBlockAppliesMigrationBatchSize exercises the full BeginBlock path | ||
| // (not the helper in isolation): it mimics a governance ParameterChangeProposal | ||
| // having set NumKeysToMigratePerBlock, then runs app.BeginBlock and asserts the | ||
| // new rate landed in the SC commit store. | ||
| func TestBeginBlockAppliesMigrationBatchSize(t *testing.T) { | ||
| a := Setup(t, false, false, false) | ||
| ctx := a.NewContext(false, tmproto.Header{Height: 2, ChainID: "sei-test", Time: time.Now()}) | ||
|
|
||
| // Sanity: nothing set yet, so the store is paused at 0. | ||
| before, ok := a.rootStore.GetMigrationBatchSize() | ||
| require.True(t, ok) | ||
| require.Equal(t, 0, before) | ||
|
|
||
| // Simulate the gov proposal landing in chain state. | ||
| subspace, ok := a.ParamsKeeper.GetSubspace(migration.SubspaceName) | ||
| require.True(t, ok) | ||
| subspace.Set(ctx, migration.KeyNumKeysToMigratePerBlock, uint64(321)) | ||
|
|
||
| // Run the real BeginBlock (checkHeight=false to skip height validation). | ||
| require.NotPanics(t, func() { | ||
| a.BeginBlock(ctx, 2, nil, nil, false) | ||
| }) | ||
|
|
||
| after, _ := a.rootStore.GetMigrationBatchSize() | ||
| require.Equal(t, 321, after, "BeginBlock should push the gov param into the SC store") | ||
| } | ||
|
|
||
| // TestMigrationBatchSizeTakesEffectNextBlock is the full end-to-end timing | ||
| // check: a governance proposal committed in block N (written into the block's | ||
| // deliver state, then Commit) only changes the SC store's migration rate when | ||
| // block N+1's BeginBlock runs and reads it from committed state. | ||
| func TestMigrationBatchSizeTakesEffectNextBlock(t *testing.T) { | ||
| a := Setup(t, false, false, false) | ||
| bg := context.Background() | ||
|
|
||
| // Block 1: BeginBlock runs first (param still unset), then the gov | ||
| // proposal lands by writing into this block's deliver state, then Commit | ||
| // persists it to the committed multistore. | ||
| _, err := a.FinalizeBlock(bg, &abci.RequestFinalizeBlock{ | ||
| Header: &tmproto.Header{ChainID: "sei-test", Height: 1, Time: time.Now()}, | ||
| }) | ||
| require.NoError(t, err) | ||
|
|
||
| subspace, ok := a.ParamsKeeper.GetSubspace(migration.SubspaceName) | ||
| require.True(t, ok) | ||
| subspace.Set(a.GetContextForDeliverTx([]byte{}), migration.KeyNumKeysToMigratePerBlock, uint64(640)) | ||
|
|
||
| _, err = a.Commit(bg) | ||
| require.NoError(t, err) | ||
|
|
||
| // The param was committed in block 1, but BeginBlock(1) ran before it | ||
| // existed, so the rate is still paused at this point. | ||
| got, ok := a.rootStore.GetMigrationBatchSize() | ||
| require.True(t, ok) | ||
| require.Equal(t, 0, got, "param committed in block 1 must not take effect within block 1") | ||
|
|
||
| // Block 2: BeginBlock reads the now-committed param and applies it. | ||
| _, err = a.FinalizeBlock(bg, &abci.RequestFinalizeBlock{ | ||
| Header: &tmproto.Header{ChainID: "sei-test", Height: 2, Time: time.Now().Add(time.Second)}, | ||
| }) | ||
| require.NoError(t, err) | ||
|
|
||
| got, _ = a.rootStore.GetMigrationBatchSize() | ||
| require.Equal(t, 640, got, "migration rate must take effect on the block after the param is committed") | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| // Package migration defines the module-agnostic governance parameters | ||
| // that control the state-commitment store's background data migration | ||
| // (currently memiavl->flatkv). | ||
| // | ||
| // These live outside any business module on purpose: the migration rate | ||
| // applies to whichever stores the SC router is migrating, so it is an | ||
| // app/storage-level concern rather than EVM-specific. The value is held in a | ||
| // dedicated x/params subspace and is editable via the standard | ||
| // ParameterChangeProposal gov flow. The app reads it once per block in | ||
| // BeginBlock and pushes it into the SC commit store. | ||
| // | ||
| // Caveat: this subspace has no owning AppModule, so the x/params module's | ||
| // ExportGenesis (which only emits Fees/CosmosGas params) does not serialize | ||
| // NumKeysToMigratePerBlock. A `seid export` taken mid-migration therefore | ||
| // omits the rate, and a chain bootstrapped from that genesis re-seeds the | ||
| // default (0, paused) on the first BeginBlock. This is not consensus-fatal — | ||
| // re-issue the ParameterChangeProposal on the new chain to resume the drain — | ||
| // but operators forking/recovering via export must be aware of it. | ||
| package migration | ||
|
claude[bot] marked this conversation as resolved.
|
||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| paramtypes "github.com/sei-protocol/sei-chain/sei-cosmos/x/params/types" | ||
| ) | ||
|
|
||
| // SubspaceName is the x/params subspace that holds storage-migration controls. | ||
| const SubspaceName = "migration" | ||
|
|
||
| // KeyNumKeysToMigratePerBlock is the param key for the number of keys the | ||
| // in-flight SC migration advances per block. | ||
| var KeyNumKeysToMigratePerBlock = []byte("NumKeysToMigratePerBlock") | ||
|
|
||
| // DefaultNumKeysToMigratePerBlock leaves the migration paused. While it is 0 | ||
| // (the default until a gov proposal raises it) the SC store does no migration | ||
| // work; this param is the sole source of the per-block rate. | ||
| const DefaultNumKeysToMigratePerBlock uint64 = 0 | ||
|
|
||
| // MaxNumKeysToMigratePerBlock bounds the governance-controlled rate. The value | ||
| // flows into MemiavlMigrationIterator.NextBatch, which preallocates a slice of | ||
| // that capacity; an unbounded uint64 (e.g. a fat-fingered or malicious | ||
| // proposal) would deterministically panic (makeslice: cap out of range) or OOM | ||
| // every validator at the same height — an unrecoverable chain halt. 1,000,000 | ||
| // keys/block is far above any realistic drain rate yet caps the preallocation | ||
| // at a safe size, so we reject anything larger at proposal-validation time. | ||
| const MaxNumKeysToMigratePerBlock uint64 = 1_000_000 | ||
|
|
||
| // ParamKeyTable returns the key table for the migration subspace. | ||
| func ParamKeyTable() paramtypes.KeyTable { | ||
| return paramtypes.NewKeyTable( | ||
| paramtypes.NewParamSetPair(KeyNumKeysToMigratePerBlock, new(uint64), validateNumKeysToMigratePerBlock), | ||
| ) | ||
| } | ||
|
|
||
| // validateNumKeysToMigratePerBlock type-checks the value and bounds it to | ||
| // MaxNumKeysToMigratePerBlock. 0 means "paused"; any rate in [0, max] is a | ||
| // valid (consensus-deterministic) value. Rejecting oversized values here, at | ||
| // proposal-submission time, keeps them out of chain state where they would | ||
| // otherwise OOM/panic every validator (see MaxNumKeysToMigratePerBlock). | ||
| func validateNumKeysToMigratePerBlock(i interface{}) error { | ||
| v, ok := i.(uint64) | ||
| if !ok { | ||
| return fmt.Errorf("invalid parameter type: %T", i) | ||
| } | ||
| if v > MaxNumKeysToMigratePerBlock { | ||
| return fmt.Errorf( | ||
| "NumKeysToMigratePerBlock must be <= %d, got %d", | ||
| MaxNumKeysToMigratePerBlock, v, | ||
| ) | ||
| } | ||
| return nil | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[blocker]
applyMigrationBatchSizewrites to committed state in BeginBlock: when the param is unset it callssubspace.Set(...), adding a key to the x/params store and changing the AppHash at the first block the new binary runs. That is state-machine-breaking and would diverge nodes on a rolling/uncoordinated upgrade, which seems at odds with the PR'snon-app-hash-breakinglabel. Consider seeding the param via an upgrade handler / InitGenesis instead of lazily here, or confirm this ships at a coordinated upgrade height.