Separate constructors for NewBlobRequestAuthenticator and NewPaymentStateAuthenticator

yujiezhu0 · yujiezhu0 · commit ba0a95879ceb · 2025-03-20T00:55:35.000-07:00
diff --git a/api/clients/v2/disperser_client.go b/api/clients/v2/disperser_client.go
@@ -296,15 +296,17 @@ func (c *disperserClient) GetPaymentState(ctx context.Context) (*disperser_rpc.G
 		return nil, fmt.Errorf("error getting signer's account ID: %w", err)
 	}
 
-	signature, err := c.signer.SignPaymentStateRequest()
+	timestamp := uint64(time.Now().UnixNano())
+
+	signature, err := c.signer.SignPaymentStateRequest(timestamp)
 	if err != nil {
 		return nil, fmt.Errorf("error signing payment state request: %w", err)
 	}
 
 	request := &disperser_rpc.GetPaymentStateRequest{
 		AccountId: accountID.Hex(),
 		Signature: signature,
-		Timestamp: uint64(time.Now().UnixNano()),
+		Timestamp: timestamp,
 	}
 	return c.client.GetPaymentState(ctx, request)
 }
diff --git a/api/hashing/payment_state_hashing.go b/api/hashing/payment_state_hashing.go
@@ -3,21 +3,30 @@ package hashing
 import (
 	"fmt"
 	pb "github.com/Layr-Labs/eigenda/api/grpc/disperser/v2"
+	"github.com/ethereum/go-ethereum/common"
 	"golang.org/x/crypto/sha3"
 )
 
-// HashGetPaymentStateRequest hashes the given GetPaymentStateRequest.
-func HashGetPaymentStateRequest(request *pb.GetPaymentStateRequest) ([]byte, error) {
+// HashGetPaymentStateRequestFromFields hashes the given GetPaymentStateRequest from accountId and timestamp
+func HashGetPaymentStateRequestFromFields(accountId common.Address, timestamp uint64) ([]byte, error) {
 	hasher := sha3.NewLegacyKeccak256()
 
-	// Hash the account ID
-	err := hashByteArray(hasher, []byte(request.GetAccountId()))
+	// Hash the accountId
+	err := hashByteArray(hasher, accountId.Bytes())
 	if err != nil {
 		return nil, fmt.Errorf("failed to hash account id: %w", err)
 	}
 
 	// Hash the timestamp
-	hashUint64(hasher, request.GetTimestamp())
+	hashUint64(hasher, timestamp)
 
 	return hasher.Sum(nil), nil
 }
+
+// HashGetPaymentStateRequestFromRequest hashes the given GetPaymentStateRequest from request
+func HashGetPaymentStateRequestFromRequest(request *pb.GetPaymentStateRequest) ([]byte, error) {
+	accountId := common.HexToAddress(request.GetAccountId())
+	timestamp := request.GetTimestamp()
+
+	return HashGetPaymentStateRequestFromFields(accountId, timestamp)
+}
diff --git a/core/auth/v2/auth_test.go b/core/auth/v2/auth_test.go
@@ -3,6 +3,7 @@ package v2_test
 import (
 	"crypto/sha256"
 	disperser_rpc "github.com/Layr-Labs/eigenda/api/grpc/disperser/v2"
+	"github.com/Layr-Labs/eigenda/common/replay"
 	"math/big"
 	"testing"
 	"time"
@@ -18,15 +19,16 @@ import (
 )
 
 var (
-	privateKeyHex = "0x0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
-	maxPastAge    = 5 * time.Minute
-	maxFutureAge  = 5 * time.Minute
+	privateKeyHex  = "0x0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+	maxPastAge     = 5 * time.Minute
+	maxFutureAge   = 5 * time.Minute
+	fixedTimestamp = uint64(1609459200000000000)
 )
 
 func TestAuthentication(t *testing.T) {
 	signer, err := auth.NewLocalBlobRequestSigner(privateKeyHex)
 	assert.NoError(t, err)
-	authenticator := auth.NewAuthenticator(maxPastAge, maxFutureAge)
+	blobRequestAuthenticator := auth.NewBlobRequestAuthenticator()
 
 	accountId, err := signer.GetAccountID()
 	assert.NoError(t, err)
@@ -36,14 +38,14 @@ func TestAuthentication(t *testing.T) {
 	signature, err := signer.SignBlobRequest(header)
 	assert.NoError(t, err)
 
-	err = authenticator.AuthenticateBlobRequest(header, signature)
+	err = blobRequestAuthenticator.AuthenticateBlobRequest(header, signature)
 	assert.NoError(t, err)
 }
 
 func TestAuthenticationFail(t *testing.T) {
 	signer, err := auth.NewLocalBlobRequestSigner(privateKeyHex)
 	assert.NoError(t, err)
-	authenticator := auth.NewAuthenticator(maxPastAge, maxFutureAge)
+	blobRequestAuthenticator := auth.NewBlobRequestAuthenticator()
 
 	accountId, err := signer.GetAccountID()
 	assert.NoError(t, err)
@@ -58,7 +60,7 @@ func TestAuthenticationFail(t *testing.T) {
 	signature, err := signer.SignBlobRequest(header)
 	assert.NoError(t, err)
 
-	err = authenticator.AuthenticateBlobRequest(header, signature)
+	err = blobRequestAuthenticator.AuthenticateBlobRequest(header, signature)
 	assert.Error(t, err)
 }
 
@@ -122,42 +124,43 @@ func testHeader(t *testing.T, accountID gethcommon.Address) *corev2.BlobHeader {
 func TestAuthenticatePaymentStateRequestValid(t *testing.T) {
 	signer, err := auth.NewLocalBlobRequestSigner(privateKeyHex)
 	assert.NoError(t, err)
-	authenticator := auth.NewAuthenticator(maxPastAge, maxFutureAge)
+	paymentStateAuthenticator := auth.NewPaymentStateAuthenticator(maxPastAge, maxFutureAge)
+	paymentStateAuthenticator.ReplayGuardian = replay.NewNoOpReplayGuardian()
 
-	signature, err := signer.SignPaymentStateRequest()
+	signature, err := signer.SignPaymentStateRequest(fixedTimestamp)
 	assert.NoError(t, err)
+	assert.NotNil(t, signature)
 
 	accountId, err := signer.GetAccountID()
 	assert.NoError(t, err)
 
 	request := mockGetPaymentStateRequest(accountId, signature)
 
-	err = authenticator.AuthenticatePaymentStateRequest(accountId, request)
+	err = paymentStateAuthenticator.AuthenticatePaymentStateRequest(accountId, request)
 	assert.NoError(t, err)
 }
 
 func TestAuthenticatePaymentStateRequestInvalidSignatureLength(t *testing.T) {
-	authenticator := auth.NewAuthenticator(maxPastAge, maxFutureAge)
+	paymentStateAuthenticator := auth.NewPaymentStateAuthenticator(maxPastAge, maxFutureAge)
 	request := mockGetPaymentStateRequest(gethcommon.HexToAddress("0x123"), []byte{1, 2, 3})
 
-	err := authenticator.AuthenticatePaymentStateRequest(gethcommon.HexToAddress("0x123"), request)
+	err := paymentStateAuthenticator.AuthenticatePaymentStateRequest(gethcommon.HexToAddress("0x123"), request)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "signature length is unexpected")
 }
 
 func TestAuthenticatePaymentStateRequestInvalidPublicKey(t *testing.T) {
-	authenticator := auth.NewAuthenticator(maxPastAge, maxFutureAge)
+	paymentStateAuthenticator := auth.NewPaymentStateAuthenticator(maxPastAge, maxFutureAge)
 	request := mockGetPaymentStateRequest(gethcommon.Address{}, make([]byte, 65))
-
-	err := authenticator.AuthenticatePaymentStateRequest(gethcommon.Address{}, request)
+	err := paymentStateAuthenticator.AuthenticatePaymentStateRequest(gethcommon.Address{}, request)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "failed to recover public key from signature")
 }
 
 func TestAuthenticatePaymentStateRequestSignatureMismatch(t *testing.T) {
 	signer, err := auth.NewLocalBlobRequestSigner(privateKeyHex)
 	assert.NoError(t, err)
-	authenticator := auth.NewAuthenticator(maxPastAge, maxFutureAge)
+	paymentStateAuthenticator := auth.NewPaymentStateAuthenticator(maxPastAge, maxFutureAge)
 
 	// Create a different signer with wrong private key
 	wrongSigner, err := auth.NewLocalBlobRequestSigner("0x0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcded")
@@ -167,20 +170,20 @@ func TestAuthenticatePaymentStateRequestSignatureMismatch(t *testing.T) {
 	accountId, err := signer.GetAccountID()
 	assert.NoError(t, err)
 
-	signature, err := wrongSigner.SignPaymentStateRequest()
+	signature, err := wrongSigner.SignPaymentStateRequest(uint64(time.Now().UnixNano()))
 	assert.NoError(t, err)
 
 	request := mockGetPaymentStateRequest(accountId, signature)
 
-	err = authenticator.AuthenticatePaymentStateRequest(accountId, request)
+	err = paymentStateAuthenticator.AuthenticatePaymentStateRequest(accountId, request)
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "signature doesn't match with provided public key")
 }
 
 func TestAuthenticatePaymentStateRequestCorruptedSignature(t *testing.T) {
 	signer, err := auth.NewLocalBlobRequestSigner(privateKeyHex)
 	assert.NoError(t, err)
-	authenticator := auth.NewAuthenticator(maxPastAge, maxFutureAge)
+	paymentStateAuthenticator := auth.NewPaymentStateAuthenticator(maxPastAge, maxFutureAge)
 
 	accountId, err := signer.GetAccountID()
 	assert.NoError(t, err)
@@ -193,14 +196,14 @@ func TestAuthenticatePaymentStateRequestCorruptedSignature(t *testing.T) {
 	signature[0] ^= 0x01
 	request := mockGetPaymentStateRequest(accountId, signature)
 
-	err = authenticator.AuthenticatePaymentStateRequest(accountId, request)
+	err = paymentStateAuthenticator.AuthenticatePaymentStateRequest(accountId, request)
 	assert.Error(t, err)
 }
 
 func mockGetPaymentStateRequest(accountId gethcommon.Address, signature []byte) *disperser_rpc.GetPaymentStateRequest {
 	return &disperser_rpc.GetPaymentStateRequest{
 		AccountId: accountId.Hex(),
 		Signature: signature,
-		Timestamp: uint64(time.Now().UnixNano()),
+		Timestamp: fixedTimestamp,
 	}
 }
diff --git a/core/auth/v2/authenticator.go b/core/auth/v2/authenticator.go
@@ -15,12 +15,22 @@ import (
 )
 
 type authenticator struct {
-	replayGuardian replay.ReplayGuardian
+	ReplayGuardian replay.ReplayGuardian
 }
 
-func NewAuthenticator(maxTimeInPast, maxTimeInFuture time.Duration) *authenticator {
+// NewBlobRequestAuthenticator creates an authenticator for blob requests.
+// ReplayGuardian is not used for blob requests.
+func NewBlobRequestAuthenticator() *authenticator {
 	return &authenticator{
-		replayGuardian: replay.NewReplayGuardian(time.Now, maxTimeInPast, maxTimeInFuture),
+		ReplayGuardian: nil, // Not needed for blob requests
+	}
+}
+
+// NewPaymentStateAuthenticator creates an authenticator for payment state requests,
+// which requires replay protection.
+func NewPaymentStateAuthenticator(maxTimeInPast, maxTimeInFuture time.Duration) *authenticator {
+	return &authenticator{
+		ReplayGuardian: replay.NewReplayGuardian(time.Now, maxTimeInPast, maxTimeInFuture),
 	}
 }
 
@@ -54,7 +64,7 @@ func (*authenticator) AuthenticateBlobRequest(header *core.BlobHeader, signature
 }
 
 // AuthenticatePaymentStateRequest verifies the signature of the payment state request
-// The signature is signed over the byte representation of the account ID
+// The signature is signed over the byte representation of the account ID and requestHash
 // See implementation of BlobRequestSigner.SignPaymentStateRequest for more details
 func (a *authenticator) AuthenticatePaymentStateRequest(accountAddr common.Address, request *pb.GetPaymentStateRequest) error {
 	sig := request.GetSignature()
@@ -63,10 +73,14 @@ func (a *authenticator) AuthenticatePaymentStateRequest(accountAddr common.Addre
 		return fmt.Errorf("signature length is unexpected: %d", len(sig))
 	}
 
-	timestamp := request.GetTimestamp()
+	requestHash, err := hashing.HashGetPaymentStateRequestFromRequest(request)
+	if err != nil {
+		return fmt.Errorf("failed to hash request: %w", err)
+	}
+	accountAddrWithHash := append(accountAddr.Bytes(), requestHash...)
+	hash := sha256.Sum256(accountAddrWithHash)
 
 	// Verify the signature
-	hash := sha256.Sum256(accountAddr.Bytes())
 	sigPublicKeyECDSA, err := crypto.SigToPub(hash[:], sig)
 	if err != nil {
 		return fmt.Errorf("failed to recover public key from signature: %v", err)
@@ -78,12 +92,8 @@ func (a *authenticator) AuthenticatePaymentStateRequest(accountAddr common.Addre
 		return errors.New("signature doesn't match with provided public key")
 	}
 
-	requestHash, err := hashing.HashGetPaymentStateRequest(request)
-	if err != nil {
-		return fmt.Errorf("failed to hash request: %w", err)
-	}
-
-	if err := a.replayGuardian.VerifyRequest(requestHash, time.Unix(0, int64(timestamp))); err != nil {
+	timestamp := request.GetTimestamp()
+	if err := a.ReplayGuardian.VerifyRequest(requestHash, time.Unix(0, int64(timestamp))); err != nil {
 		return fmt.Errorf("failed to verify request: %v", err)
 	}
 
diff --git a/core/auth/v2/signer.go b/core/auth/v2/signer.go
@@ -4,6 +4,7 @@ import (
 	"crypto/ecdsa"
 	"crypto/sha256"
 	"fmt"
+	"github.com/Layr-Labs/eigenda/api/hashing"
 
 	core "github.com/Layr-Labs/eigenda/core/v2"
 	"github.com/ethereum/go-ethereum/common"
@@ -44,13 +45,19 @@ func (s *LocalBlobRequestSigner) SignBlobRequest(header *core.BlobHeader) ([]byt
 	return sig, nil
 }
 
-func (s *LocalBlobRequestSigner) SignPaymentStateRequest() ([]byte, error) {
+func (s *LocalBlobRequestSigner) SignPaymentStateRequest(timestamp uint64) ([]byte, error) {
 	accountId, err := s.GetAccountID()
 	if err != nil {
 		return nil, fmt.Errorf("failed to get account ID: %v", err)
 	}
 
-	hash := sha256.Sum256(accountId.Bytes())
+	requestHash, err := hashing.HashGetPaymentStateRequestFromFields(accountId, timestamp)
+	if err != nil {
+		return nil, fmt.Errorf("failed to hash request: %w", err)
+	}
+
+	accountIdWithHash := append(accountId.Bytes(), requestHash...)
+	hash := sha256.Sum256(accountIdWithHash)
 	// Sign the account ID using the private key
 	sig, err := crypto.Sign(hash[:], s.PrivateKey)
 	if err != nil {
@@ -77,7 +84,7 @@ func (s *LocalNoopSigner) SignBlobRequest(header *core.BlobHeader) ([]byte, erro
 	return nil, fmt.Errorf("noop signer cannot sign blob request")
 }
 
-func (s *LocalNoopSigner) SignPaymentStateRequest() ([]byte, error) {
+func (s *LocalNoopSigner) SignPaymentStateRequest(timestamp uint64) ([]byte, error) {
 	return nil, fmt.Errorf("noop signer cannot sign payment state request")
 }
 
diff --git a/core/auth/v2/signer_test.go b/core/auth/v2/signer_test.go
@@ -2,8 +2,10 @@ package v2
 
 import (
 	"crypto/sha256"
+	"github.com/Layr-Labs/eigenda/api/hashing"
 	"math/big"
 	"testing"
+	"time"
 
 	corev1 "github.com/Layr-Labs/eigenda/core"
 	core "github.com/Layr-Labs/eigenda/core/v2"
@@ -108,16 +110,20 @@ func TestSignPaymentStateRequest(t *testing.T) {
 	accountID, err := signer.GetAccountID()
 	require.NoError(t, err)
 
-	signature, err := signer.SignPaymentStateRequest()
+	fixedTimestamp := uint64(1609459200000000000)
+	signature, err := signer.SignPaymentStateRequest(fixedTimestamp)
 	require.NoError(t, err)
 	require.NotNil(t, signature)
 
-	hash := sha256.Sum256(accountID.Bytes())
-	// Recover the public key from the signature
+	requestHash, err := hashing.HashGetPaymentStateRequestFromFields(accountID, fixedTimestamp)
+	require.NoError(t, err)
+
+	accountIdWithHash := append(accountID.Bytes(), requestHash...)
+	hash := sha256.Sum256(accountIdWithHash)
+
 	pubKey, err := crypto.SigToPub(hash[:], signature)
 	require.NoError(t, err)
 
-	// Verify that the recovered address matches the signer's address
 	recoveredAddr := crypto.PubkeyToAddress(*pubKey).Hex()
 	assert.Equal(t, expectedAddr, recoveredAddr)
 }
@@ -133,7 +139,7 @@ func TestNoopSigner(t *testing.T) {
 	})
 
 	t.Run("SignPaymentStateRequest", func(t *testing.T) {
-		sig, err := signer.SignPaymentStateRequest()
+		sig, err := signer.SignPaymentStateRequest(uint64(time.Now().UnixNano()))
 		assert.Error(t, err)
 		assert.Nil(t, sig)
 		assert.Equal(t, "noop signer cannot sign payment state request", err.Error())
diff --git a/core/v2/auth.go b/core/v2/auth.go
@@ -12,6 +12,6 @@ type BlobRequestAuthenticator interface {
 
 type BlobRequestSigner interface {
 	SignBlobRequest(header *BlobHeader) ([]byte, error)
-	SignPaymentStateRequest() ([]byte, error)
+	SignPaymentStateRequest(timestamp uint64) ([]byte, error)
 	GetAccountID() (gethcommon.Address, error)
 }
diff --git a/disperser/apiserver/disperse_blob_v2.go b/disperser/apiserver/disperse_blob_v2.go
@@ -209,7 +209,7 @@ func (s *DispersalServerV2) validateDispersalRequest(
 		return nil, fmt.Errorf("invalid blob version %d; valid blob versions are: %v", blobHeaderProto.GetVersion(), onchainState.BlobVersionParameters.Keys())
 	}
 
-	if err = s.authenticator.AuthenticateBlobRequest(blobHeader, signature); err != nil {
+	if err = s.blobRequestAuthenticator.AuthenticateBlobRequest(blobHeader, signature); err != nil {
 		return nil, fmt.Errorf("authentication failed: %w", err)
 	}
 
diff --git a/disperser/apiserver/server_v2.go b/disperser/apiserver/server_v2.go
diff --git a/disperser/apiserver/server_v2_test.go b/disperser/apiserver/server_v2_test.go
diff --git a/disperser/cmd/apiserver/main.go b/disperser/cmd/apiserver/main.go

Original file line number	Diff line number	Diff line change
`@@ -296,15 +296,17 @@ func (c disperserClient) GetPaymentState(ctx context.Context) (disperser_rpc.G`
`296`	`296`	`return nil, fmt.Errorf("error getting signer's account ID: %w", err)`
`297`	`297`	`}`
`298`	`298`
`299`		`- signature, err := c.signer.SignPaymentStateRequest()`
	`299`	`+ timestamp := uint64(time.Now().UnixNano())`
	`300`	`+`
	`301`	`+ signature, err := c.signer.SignPaymentStateRequest(timestamp)`
`300`	`302`	`if err != nil {`
`301`	`303`	`return nil, fmt.Errorf("error signing payment state request: %w", err)`
`302`	`304`	`}`
`303`	`305`
`304`	`306`	`request := &disperser_rpc.GetPaymentStateRequest{`
`305`	`307`	`AccountId: accountID.Hex(),`
`306`	`308`	`Signature: signature,`
`307`		`- Timestamp: uint64(time.Now().UnixNano()),`
	`309`	`+ Timestamp: timestamp,`
`308`	`310`	`}`
`309`	`311`	`return c.client.GetPaymentState(ctx, request)`
`310`	`312`	`}`
Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,6 @@ type BlobRequestAuthenticator interface {`
`12`	`12`
`13`	`13`	`type BlobRequestSigner interface {`
`14`	`14`	`SignBlobRequest(header *BlobHeader) ([]byte, error)`
`15`		`- SignPaymentStateRequest() ([]byte, error)`
	`15`	`+ SignPaymentStateRequest(timestamp uint64) ([]byte, error)`
`16`	`16`	`GetAccountID() (gethcommon.Address, error)`
`17`	`17`	`}`
Original file line number	Diff line number	Diff line change
`@@ -209,7 +209,7 @@ func (s *DispersalServerV2) validateDispersalRequest(`
`209`	`209`	`return nil, fmt.Errorf("invalid blob version %d; valid blob versions are: %v", blobHeaderProto.GetVersion(), onchainState.BlobVersionParameters.Keys())`
`210`	`210`	`}`
`211`	`211`
`212`		`- if err = s.authenticator.AuthenticateBlobRequest(blobHeader, signature); err != nil {`
	`212`	`+ if err = s.blobRequestAuthenticator.AuthenticateBlobRequest(blobHeader, signature); err != nil {`
`213`	`213`	`return nil, fmt.Errorf("authentication failed: %w", err)`
`214`	`214`	`}`
`215`	`215`