feat: validator node authenticate and validate blob headers #1529
Conversation
hopeyen
force-pushed
the
hope/node-blob-authenticator
branch
8 times, most recently
from
d23be41 to
9aa3353
Compare
hopeyen
force-pushed
the
hope/node-blob-authenticator
branch
5 times, most recently
from
c362715 to
a841632
Compare
hopeyen
force-pushed
the
hope/node-blob-authenticator
branch
from
a841632 to
fe701a1
Compare
| // - no encoding prover GetCommitmentsForPaddedLength check | ||
| // - directly take blob lengths (no blob data yet) | ||
| // - doesn't check every 32 bytes is a valid field element | ||
| func (s *ServerV2) validateDispersalRequest( |
There was a problem hiding this comment.
Interesting we didn't validate the blob certificates from the request before
There was a problem hiding this comment.
yeah I think we just trusted the disperser for those checks:p
node/grpc/server_v2.go
Outdated
| return nil, fmt.Errorf("failed to authenticate blob request: %v", err) | ||
| } | ||
|
|
||
| //this is the length in SYMBOLS (32 byte field elements) of the blob. it must be a power of 2 |
| // - Takes *corev2.BlobCertificate instead of DisperseBlobRequest | ||
| // - no encoding prover GetCommitmentsForPaddedLength check | ||
| // - directly take blob lengths (no blob data yet) | ||
| // - doesn't check every 32 bytes is a valid field element |
There was a problem hiding this comment.
Is it useful to check these items at validator here as well?
There was a problem hiding this comment.
It would be, but not possible, because those checks are done to the blob directly while we shouldn't make validators validate request against the blob itself
There was a problem hiding this comment.
Where is it checked?
It's generally better to check at earlier stage if there's sufficient information so we can reject invalid requests fast and cheaply.
There was a problem hiding this comment.
It isn't checked by the validators. I don't think it is possible because it requires the blob data itself:(
| @@ -141,7 +147,14 @@ func (s *ServerV2) StoreChunks(ctx context.Context, in *pb.StoreChunksRequest) ( | |||
| return nil, api.NewErrorInvalidArg(fmt.Sprintf("failed to verify request: %v", err)) | |||
| } | |||
| } | |||
|
|
|||
| if s.blobAuthenticator != nil { | |||
| for _, blob := range batch.BlobCertificates { | |||
There was a problem hiding this comment.
It may be worth checking the latency of request validation later, and this part could be parallelized if it takes a meaningful amount of time (the time spent here is contributing directly to the overall request latency)
yes! in theory nodes could blacklist a disperser as soon as a blob fails here. I think we can later utilize these for slashing dispersers |
Why are these changes needed?
https://linear.app/eigenlabs/issue/EGDA-1195/validator-node-checks-individual-dispersal-requests
Checks