Summary
Every node already computes and signs a complete anchor rollback witness, under an external challenger's nonce, in its activation-handshake attestation — and nothing retains it across restarts. An external monitor that stores the maximum ever seen per operator would detect a class of rollback that is otherwise structurally undetectable, with no protocol change and no code change on the node.
This came out of the #4222 analysis. Recording it because the detection material is fully built and only the consumer is missing.
What is already exported
The signed attestation carries currentAnchorRevision, stateGeneration, certifiedFloorRevision, certifiedFloorGeneration, trustCertificateSequence, anchorServiceEpoch, both restartable headrooms, anchorRotationWarning, and stateAnchorPoisoned.
Why it matters
The certified floor bounds the anchor service and the signer process. It does not bound the operator — every artifact naming the floor is a local file the operator owns (see the "What the floor does not bound" section added to docs/development/frost-anchor-rotation.adoc in #4226). A colluding anchor service plus a rolled-back operator is undetected by design today, because the node's own durable witness sits in the same store directory as the state it is meant to protect and is rolled back in the same act.
A monitor outside both trust domains, retaining per-operator maxima, is the cheapest thing that notices.
Three monitors, none needing a protocol change
- Max-ever-seen per operator on
trustCertificateSequence, anchorServiceEpoch and the certified floor pair. A decrease is a downgrade.
- Revision-budget reconciliation — compare attested revision growth against what the admission arithmetic predicts. Excess revisions imply a writer other than this node on the stream.
- Fleet correlation of
stateAnchorPoisoned and anchor errors — simultaneous multi-operator failure is the shared-anchor-instance tell.
A fourth, out of band: compare OnlineKeyHash across operators. Equality reveals a single shared response key, and therefore a single point of acknowledgement forgery.
Scope
No node change required. This is monitoring infrastructure plus a decision about who runs it — which overlaps the open anchor-service tenancy questions in #4222.
Summary
Every node already computes and signs a complete anchor rollback witness, under an external challenger's nonce, in its activation-handshake attestation — and nothing retains it across restarts. An external monitor that stores the maximum ever seen per operator would detect a class of rollback that is otherwise structurally undetectable, with no protocol change and no code change on the node.
This came out of the #4222 analysis. Recording it because the detection material is fully built and only the consumer is missing.
What is already exported
The signed attestation carries
currentAnchorRevision,stateGeneration,certifiedFloorRevision,certifiedFloorGeneration,trustCertificateSequence,anchorServiceEpoch, both restartable headrooms,anchorRotationWarning, andstateAnchorPoisoned.Why it matters
The certified floor bounds the anchor service and the signer process. It does not bound the operator — every artifact naming the floor is a local file the operator owns (see the "What the floor does not bound" section added to
docs/development/frost-anchor-rotation.adocin #4226). A colluding anchor service plus a rolled-back operator is undetected by design today, because the node's own durable witness sits in the same store directory as the state it is meant to protect and is rolled back in the same act.A monitor outside both trust domains, retaining per-operator maxima, is the cheapest thing that notices.
Three monitors, none needing a protocol change
trustCertificateSequence,anchorServiceEpochand the certified floor pair. A decrease is a downgrade.stateAnchorPoisonedand anchor errors — simultaneous multi-operator failure is the shared-anchor-instance tell.A fourth, out of band: compare
OnlineKeyHashacross operators. Equality reveals a single shared response key, and therefore a single point of acknowledgement forgery.Scope
No node change required. This is monitoring infrastructure plus a decision about who runs it — which overlaps the open anchor-service tenancy questions in #4222.