|
| 1 | +use crate::common::{ |
| 2 | + DISTINCT_RECONSTRUCTION_THRESHOLDS_PORT_SEED, ckd_domain, damgard_etal_domain, |
| 3 | + generate_ckd_app_public_key, generate_ecdsa_payload, generate_eddsa_payload, must_get_domain, |
| 4 | + must_setup_cluster, wait_metric_on_nodes, |
| 5 | +}; |
| 6 | + |
| 7 | +use e2e_tests::{CLUSTER_WAIT_TIMEOUT, metrics}; |
| 8 | +use near_mpc_contract_interface::types::{ |
| 9 | + DomainConfig, DomainId, DomainPurpose, Protocol, ReconstructionThreshold, |
| 10 | +}; |
| 11 | +use rand::SeedableRng; |
| 12 | + |
| 13 | +/// Each domain signs under its own reconstruction threshold, not the governance |
| 14 | +/// threshold. With 6 nodes and 1 killed, Cait-Sith (needs all 6) can no longer sign |
| 15 | +/// while Damgard et al. (`2t - 1 = 5`), CKD (`t = 5`) and Frost (`t = 5`) still can. |
| 16 | +#[tokio::test] |
| 17 | +#[expect(non_snake_case)] |
| 18 | +async fn distinct_reconstruction_thresholds__should_use_per_domain_threshold_when_nodes_are_down() { |
| 19 | + // Given |
| 20 | + let mut rng = rand::rngs::StdRng::seed_from_u64(0); |
| 21 | + let (mut cluster, contract_state) = |
| 22 | + must_setup_cluster(DISTINCT_RECONSTRUCTION_THRESHOLDS_PORT_SEED, |c| { |
| 23 | + c.num_nodes = 6; |
| 24 | + c.initial_participant_indices = (0..6).collect(); |
| 25 | + c.threshold = 6; |
| 26 | + c.triples_to_buffer = 2; |
| 27 | + c.presignatures_to_buffer = 2; |
| 28 | + c.domains = vec![ |
| 29 | + DomainConfig { |
| 30 | + id: DomainId(0), |
| 31 | + protocol: Protocol::CaitSith, |
| 32 | + reconstruction_threshold: ReconstructionThreshold::new(6), |
| 33 | + purpose: DomainPurpose::Sign, |
| 34 | + }, |
| 35 | + damgard_etal_domain(1, 3), |
| 36 | + ckd_domain(2, 5), |
| 37 | + DomainConfig { |
| 38 | + id: DomainId(3), |
| 39 | + protocol: Protocol::Frost, |
| 40 | + reconstruction_threshold: ReconstructionThreshold::new(5), |
| 41 | + purpose: DomainPurpose::Sign, |
| 42 | + }, |
| 43 | + ]; |
| 44 | + }) |
| 45 | + .await; |
| 46 | + |
| 47 | + let caitsith_domain = must_get_domain(&contract_state, Protocol::CaitSith); |
| 48 | + let damgard_domain = must_get_domain(&contract_state, Protocol::DamgardEtAl); |
| 49 | + let ckd_domain = must_get_domain(&contract_state, Protocol::ConfidentialKeyDerivation); |
| 50 | + let frost_domain = must_get_domain(&contract_state, Protocol::Frost); |
| 51 | + |
| 52 | + // When |
| 53 | + cluster.kill_nodes(&[5]).expect("failed to kill node 5"); |
| 54 | + |
| 55 | + // Then Damgard et al. (needs 5 signers) still signs. |
| 56 | + let outcome = cluster |
| 57 | + .send_sign_request( |
| 58 | + damgard_domain.id, |
| 59 | + generate_ecdsa_payload(&mut rng), |
| 60 | + cluster.default_user_account(), |
| 61 | + ) |
| 62 | + .await |
| 63 | + .expect("failed to submit Damgard et al. sign request"); |
| 64 | + assert!( |
| 65 | + outcome.is_success(), |
| 66 | + "Damgard et al. sign request failed with 5 of 6 nodes alive: {:?}", |
| 67 | + outcome.failure_message() |
| 68 | + ); |
| 69 | + |
| 70 | + // And CKD (its own `t = 5`, not the governance threshold of 6) still derives. |
| 71 | + let outcome = cluster |
| 72 | + .send_ckd_request( |
| 73 | + ckd_domain.id, |
| 74 | + generate_ckd_app_public_key(&mut rng), |
| 75 | + cluster.default_user_account(), |
| 76 | + ) |
| 77 | + .await |
| 78 | + .expect("failed to submit CKD request"); |
| 79 | + assert!( |
| 80 | + outcome.is_success(), |
| 81 | + "CKD request failed with 5 of its 5 required signers alive: {:?}", |
| 82 | + outcome.failure_message() |
| 83 | + ); |
| 84 | + |
| 85 | + // And Frost (its own `t = 5`) still signs. |
| 86 | + let outcome = cluster |
| 87 | + .send_sign_request( |
| 88 | + frost_domain.id, |
| 89 | + generate_eddsa_payload(&mut rng), |
| 90 | + cluster.default_user_account(), |
| 91 | + ) |
| 92 | + .await |
| 93 | + .expect("failed to submit Frost sign request"); |
| 94 | + assert!( |
| 95 | + outcome.is_success(), |
| 96 | + "Frost sign request failed with 5 of its 5 required signers alive: {:?}", |
| 97 | + outcome.failure_message() |
| 98 | + ); |
| 99 | + |
| 100 | + // And Cait-Sith (needs all 6) is unanswerable. Its request never resolves on |
| 101 | + // chain, and the yield auto-timeout outlives the JSON-RPC call, so we race the |
| 102 | + // doomed request against the surviving nodes' timeout counter rather than |
| 103 | + // awaiting it (see `timeout_metric.rs`). |
| 104 | + tokio::select! { |
| 105 | + res = wait_metric_on_nodes( |
| 106 | + &cluster, |
| 107 | + &[0, 1, 2, 3, 4], |
| 108 | + metrics::TIMEOUTS_INDEXED, |
| 109 | + |v| v >= 1, |
| 110 | + CLUSTER_WAIT_TIMEOUT, |
| 111 | + ) => res.unwrap_or_else(|_| panic!( |
| 112 | + "{} did not reach 1 on the surviving nodes — Cait-Sith request was answered \ |
| 113 | + despite only 5 of its 6 required signers being alive", |
| 114 | + metrics::TIMEOUTS_INDEXED |
| 115 | + )), |
| 116 | + _ = cluster.send_sign_request( |
| 117 | + caitsith_domain.id, |
| 118 | + generate_ecdsa_payload(&mut rng), |
| 119 | + cluster.default_user_account(), |
| 120 | + ) => panic!( |
| 121 | + "Cait-Sith sign request returned before the timeout metric — it should be \ |
| 122 | + unanswerable with only 5 of 6 required signers alive" |
| 123 | + ), |
| 124 | + } |
| 125 | +} |
0 commit comments