Fix WIRE-385 stale outbound operator rosters - #603
Open
huangminghuang wants to merge 1 commit into
Open
Conversation
Change-Id: I2fe1bac5e738da09019a96deae976fe727638b4f
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tracking
WIRE-385WNS-34— Stale Operator Roster In Outbound Attestations Due To Inline Action OrderingWhy
sysio.epoch::advance()queued slashing and termination as inline actions, then generatedOPERATORSandBATCH_OPERATOR_GROUPSattestations before those state mutations executed. A slashed or terminated operator could therefore be announced as active for the next epoch. External outposts could continue accepting that operator's signatures, creating a path to forged cross-chain messages, outpost compromise, or loss of locked funds.The issue also affected liveness: simply pruning an ineligible operator could leave a future schedule group empty. When that group became active, no operator could relay messages or advance cross-chain consensus even when healthy standbys were available.
What changed
Finish advancement through an authenticated self-inline continuation, then publish the fresh operator roster before its group schedule. Remove inactive members and repair future vacancies using healthy standbys before selecting the tail.
The tracked epoch ABI and WASM are regenerated. Withdrawal flushing, deferred queues, and emissions retain their required action ordering and inline depth.
Validation
Both source and artifact-copy contract suites pass all 729 cases; all 14 canonical local platform flows pass (2,433 report steps), including the collateral-withdrawal scenario that exposed and now verifies future-seat repair. Independent correctness, architecture, and compliance reviews pass. Exact-head SYSIO CI passes; the exact-head cross-repository e2e run is running.
Deployment notes
Deploy the companion Ethereum admission fix first: https://github.com/Wire-Network/wire-ethereum/pull/198. Current-group vacancies require roster recovery; incomplete windows remain withheld. Future-vacancy recovery can shorten normal duty spacing in larger schedules.