* governor listen to quorum gossip
* governor listen to quorum gossip
* Fix build error in tests
* See p2p from other guardians in devnet
* Fix test broke during merge
* Change delete function being used
* Don't reload duplicates on startup
We currently run the cleanup loop every 30 seconds, which means that
once 5 minutes have passed for an observation without quorum we will
send out re-observation requests to the p2p network every 30 seconds.
This is a bit excessive so limit sending these requests out to once
every 5 minutes.
When processing pending observations, the `handleCleanup` function
checks if we already have a stored quorum VAA and deletes the in-memory
observation if one is found. If a stored quorum VAA is not found, then
we're supposed to continue evaluating the other conditions and take
the appropriate action. This was implemented using a `fallthrough`
statement.
Unfortunately, this is not how `fallthrough` works. `fallthrough`
simply tells the compiler to execute the body of the next branch in
the switch block, *without evaluating the condition*. It also doesn't
evaluate the conditions for any of the other branches in the switch.
In practice what this meant is that for local observations that didn't
have quorum we would always take the first branch, fall through to the
second branch, and then exit the switch. Only once we had a quorum
(`s.submitted == true`) would we actually consider any of the other
branches in the switch. It also meant that there was no case where we
would take the branch for re-observing messages that hadn't reached
quorum.
Fix this by moving the stored quorum VAA check into an if statement and
then falling through to the switch statement if one is not found.
The wormhole sdk is a new go module in the sdk/ directory. This
initially contains the *_consts.go files from the common package in the
top-level sdk package and the entire vaa package as a sub-package.
For go reasons this needs to be in the sdk directory itself (rather than
a sdk/go subdir). To prevent the go tooling from looking into the other
non-go subdirs, add an empty go.mod file in each one. See
golang issue 42965 for more details on why we can't have nice
things (I'm deliberately not linking to stop github from spamming that
issue).
Currently if an observation hasn't reached quorum within 5 minutes, the
processor will re-broadcast the signed local observation to the other
guardians in the network. However if not enough guardians actually
observed the original tx, then no amount of re-broadcasting will help
the network reach quorum.
Fix this issue by sending a re-observation request whenever we
re-broadcast a signed local observation. This ensures that any
guardians that missed the tx the first time it happened have a chance to
re-observe it and help the network reach quorum.
* Rebase
* Reload from db on start up
Change-Id: I1deac9db28ad1157ea7e0c84af41c35b38497f4e
* Console commands
Change-Id: Ic242038312b7c837443a2df8823f100b3cdffd77
* Query prices from CoinGecko
Change-Id: I9a8c282ba374d32ef7045d11979a27ede3c52827
* Move chain config to separate file
Change-Id: I6a790eca765bce1f2caf48134e225df5c4daff15
* More code cleanup
Change-Id: Id12affa78cdc2d394d6dab0c53bb7ad06df8007e
* Few minor tweaks
Change-Id: I6cb511599d669e0b3d716d9f314ac0f26935ee92
* Create separate tests for different packages
Change-Id: Idb4da6817c9daad2a7420abc11bdaa702ae056dc
* Fix lint errors
Change-Id: I137c9e7e4574aee9c9fec22e91e19eee0e86a349
* Simplify chainlock message tests
* Add more governor db test coverage
* Next batch of review rework
Change-Id: Ife54852fca6c6990d1ffb3d60a8dd7f49d526f0a
* Still more rework
Change-Id: I43a8aa7fa4e1a7cea4d7fde68c963123c1ca8d53
* More rework
Change-Id: I9382412af4ffeda74967a834a6b0195a9d28b720
* Fix lint errors
Change-Id: Idaafce9b0314192557b7207911375d000bac5ae2
* Add rest and prometheus support
Change-Id: Ib870ed7eb305ef1ebbf6a7cedabc665c37c19171
* Add separate configs for testnet and devnet
Change-Id: I76b11d8940a8dc9935b3f276a008ed20ef60b850
* Update mainnet tokens to fix decimals
Change-Id: Iab018827766bc7748038b7be2f51342afb79b87c
* Let small enqueued VAAs go out when big ones can't
Change-Id: I7d3ef88d4579702d0c6ff4eaf5a8524799610ff6
* Tweak testnet config parameters
Change-Id: Id2c54151a7183ab3fb4af8060929198f6021ba4e
* Rework / enhancements from testnet testing
Change-Id: I1387b1d22667fa6ffe0bb1832dbc0b31196505d3
* Use known emitter maps
Change-Id: If330ee9d30ac3c2d1c6dca674f7777dc759de230
* Fix typo and out of date comments
Change-Id: I54a19792104ccc6ca023020303a710ef3ba18f74
Co-authored-by: claudijd <jclaudius@jumptrading.com>
We need to reuse almost all of the gossip infrastructure for accounting
transactions, with the only difference being that accounting will use a
`Transfer` message rather than a `VAA`.
Make the observation stored in the processor state generic so that it
can be either a VAA or a Transfer. The rest of the code is shared.
* Add more comprehensive structs unit-tests
* Make VerifySignatures fail on duplicate addresses
* Adjust duplicate detection to guard on signatures instead of addresses
* Add monotonic check in VerifySignatures
* Move logic into VerifySignatures and add more test cases
* Add a paranoid check for duplicate signers
* Make VerifySignatures unit-tests less contrived
* Add more verify signature test cases
* Refactor VerifySignatures tests
* Add VerifySignature fuzz tests
* Add tc.result checking instead of hardcoded true
* Change comparison so it throws debug on failure for fuzz tests
* Add unit-tests for observation signature logic
* Fix comment typos
* Refactor observation tests
* Add missing test case
* Fix VAAInvalidSignatures test case label
* Clean up unit-tests for observation and structs
* Change errorString convention in test
* Format Signature Verification Test Cases
* Remove unnecessary casting
* Add multi-signer same key cases
* Fix err usage in test cases
* Remove duplicate getVAA
Fixes https://github.com/certusone/wormhole/issues/685.
Example occurrence this fixes: https://i.imgur.com/gZWKf1n.png
Possible future optimizations include:
- Ignore late messages in the processor (but we can only ignore
them post settlement time, so we need the cleanup logic regardless).
- Ignoring late observations from other nodes.
- Using the stored VAA to calculate misses.
- Drop incomplete local observations. However, this is not trivial
since we do not know the message ID for those.
commit-id:47e1e59f
This avoids gossip spam and false positive Discord notifications
when a connected node catches up and late observations are made.
Change-Id: If9562661487d3d3d5138d27298b005f278f9e9ce
This allows us to associate an observation from the log
for messages that the local node did not observe.
Change-Id: I6ece7bfe3e6b878bdb7ee4ac03c81cb424a329b3
Optional metadata for debugging. Allows tying a received observation
to an on-chain transaction even if the node missed the observation.
Change-Id: Ie50c10c8ab7f65469555674d90645f91092fb2e3
In cases where we observed a VAA, there is no possibility of gossip DoS.
Increase the timeout to 24 hours to facilitate manual interventions
(like submission of governance VAAs or node restarts/catchup).
Keep the existing five minute timeout for observation-less VAAs.
Change-Id: Ic626108190bd60cf812daadbe191b31cc48c7296
rustfmt appears to be a little more complicated since it wants to
download dependencies and needs nightly Rust.
Change-Id: Ia348def30a6459ae2ab6c29a8c3a413216f5eb4b
Ensure there's no core vs. token bridge ambiguity.
Breaking changes to the CLI:
* "guardiand bridge" CLI is now "guardiand node"
* --solanaBridgeAddress is now --solanaContract
* --bridgeKey is now --guardianKey
The Heartbeat proto message had one of its fields renamed from
BridgeAddress to ContractAddress, but this won't break the wire
format and the only consumer appears to be the CLI.
Change includes a "go mod tidy" - it insisted.
Change-Id: Id8b312827737f07f2d5f3944ebce469d946e7f51
Jonathan Claudius
bruce-riley
Bruce Riley
Paul Noel
tbjump
Chirantan Ekbote
Hendrik Hofstadt
justinschuldt
Leo
justinschuldt
