FOC Economic Security & Adversarial Testing Vectors

[parthshah1]

Summary

Add adversarial stress vectors to the FOC Antithesis harness that actively attack the PDP/FWSS/FilecoinPay payment pipeline from the perspective of dishonest clients and SPs. These vectors go beyond happy-path testing, they attempt to steal funds, bypass signature verification, exploit insolvency edge cases, and overwhelm the system with rapid requests.

Motivation

The M4.2 mainnet GA milestone (March 31, 2026) ships with several open items including incomplete audits, unresolved debt handling design, and known audit findings with fix PRs still open.

We need continuous adversarial testing to catch regressions and find new bugs before GA.

What We Test

Active Attacks (stress engine)

A dedicated secondary client wallet with minimal USDFC (0.06) acts as the attacker. It's isolated from the legitimate FOC lifecycle to avoid false positives.

Attack	Persona	What it does	What a finding looks like
Empty Dataset Fee	Deadbeat client	Creates empty datasets via Curio HTTP. Reads client USDFC before and after. Checks funds decreased.	Funds unchanged after confirmed dataset creation means the FWSS burn rail is not extracting the sybil fee. SP is drained 0.1 FIL per request while the client pays nothing.
Insolvency Creation	Deadbeat client	Withdraws all available USDFC from FilecoinPayV1, making the client insolvent. Then attempts to create a new dataset with zero available funds. Re-funds the wallet afterwards for future probes.	Dataset creation succeeds with zero available funds means the validatePayerOperatorApprovalAndFunds check is not enforced. SP provides storage service with zero payment guarantee.
Cross-Payer Replay	Replay attacker	Signs a CreateDataSet EIP-712 message with the attacker's key but encodes the victim (primary FOC client) as the payer in the extraData. Submits via Curio HTTP. Reads victim's funds before and after.	Victim's funds decrease without the victim ever signing means the EIP-712 signature verification does not bind the signer to the payer field. Any address can be charged by anyone who can craft valid extraData.
Burst Creation	Spammer	Fires 3-5 dataset creation requests in rapid succession via Curio HTTP without waiting for on-chain confirmation between requests. Each uses a unique clientDataSetId and fresh EIP-712 signature. Checks how many were accepted and whether fees were charged.	All requests accepted without throttling means no rate limiting exists on the Curio PDP API. An attacker can drain SP FIL at HTTP request speed.

Passive Invariants (foc-sidecar)

The sidecar runs 8 safety checks every 4 seconds against on-chain state:

Check	Type	What it catches
FPV1 solvency	Always	FilecoinPay contract holds less USDFC than the sum of all payer account balances
Rail-to-dataset mapping	Always	Payment rail's reverse mapping points to wrong or deleted dataset
Provider ID consistency	Always	On-chain provider ID from registry doesn't match the ID from DataSetCreated event
Proofset liveness	Always	Active (non-deleted) dataset reports dataSetLive = false on-chain
Deleted dataset not live	Always	Deleted dataset still reports dataSetLive = true on-chain
Proving advancement	Sometimes	Challenge epoch and proven epoch advance over time (proving pipeline working)
Piece accounting	Always	activePieceCount > leafCount for a dataset (should be impossible)
Rate consistency	Always	Dataset with active pieces has zero payment rate on its PDP rail

Architecture

• Single deck entry DoPDPGriefingProbe with random internal dispatch across attack vectors
• Secondary client wallet removed from general wallet pool (prevents nonce collision with other stress vectors)
• All attack assertions use assert.Sometimes (tolerant of Antithesis fault injection where any tx can fail)
• Read-only access to FOC primary dataset state (no interference with legitimate FOC lifecycle)
• Sidecar assertions use assert.Always for safety invariants

Future Vectors

• Settlement drain: Client withdraws USDFC right before settlement epoch, SP's settle tx reverts
• Unilateral SP termination: SP terminates client's dataset without consent
• Nonce replay after deletion: Reuse clientDataSetId after dataset is deleted
• Settlement overpayment: Verify settlement math doesn't overcharge via integer truncation
• Stale rail detection: Create and delete datasets to produce orphan rails, verify Curio doesn't get stuck (regression for pdpv0: stuck settlement transactions after confirmed on-chain but failed DB update filecoin-project/curio#922)

Branch

parth/sybil-fee

[parthshah1]

PDP Griefing and Test vector: #220

[parthshah1]

How PR #221 covers #217.

Active Attacks

Issue Attack	PR File	Function	Status
Empty Dataset Fee	griefing_vectors.go	doGriefDispatch() → sybil fee sub-action	Checks USDFC before/after dataset creation, asserts fundsDecreased
Insolvency Creation	griefing_vectors.go	doGriefDispatch() → insolvency sub-action	Withdraws all USDFC, attempts dataset creation with zero funds, re-funds wallet
Cross-Payer Replay	griefing_vectors.go	doGriefDispatch() → replay sub-action	Signs EIP-712 with attacker key but encodes victim as payer, checks victim funds unchanged
Burst Creation	griefing_vectors.go	doGriefDispatch() → burst sub-action	Fires 3-5 rapid dataset creates, checks acceptance count and fee deduction

Passive Invariants (foc-sidecar)

Issue Check	PR File	Assertion
FPV1 solvency	assertions.go	assert.Always(solvent, "FilecoinPay holds sufficient USDFC")
Rail-to-dataset mapping	assertions.go	assert.Always(consistent, "Rail-to-dataset reverse mapping is consistent")
Provider ID consistency	assertions.go	assert.Always(consistent, "Provider ID matches registry for dataset")
Proofset liveness	assertions.go	assert.Always(live, "Active proofset is live on-chain")
Deleted dataset not live	assertions.go	assert.Always(!live, "Deleted proofset is not live")
Proving advancement	assertions.go	assert.Sometimes(true, "Proving period advances") + assert.Sometimes(true, "Dataset proof submitted")
Piece accounting	assertions.go	assert.Always(consistent, "Active piece count does not exceed leaf count")
Rate consistency	assertions.go	assert.Always(hasRate, "Active dataset rail has non-zero payment rate")

New sidecar checks not in the original issue:

• Lockup-vs-funds: lockup <= funds for every payer
• Deleted-dataset rail termination: endEpoch set on deleted dataset rails

Future Vectors (from issue)

Issue Future Vector	Status	PR File
Settlement drain	Implemented	foc_payment_security.go — settles rail, checks lockup doesn't increase, double-settlement idempotency
Nonce replay after deletion	Implemented	foc_piece_security.go → attackNonceReplay() — reuses previous addPieces nonce
Settlement overpayment	Implemented	foc_payment_security.go — verifies no extra deduction on double settle
Stale rail detection / orphan rails	Implemented	foc_resilience.go — creates empty datasets, checks orphan rail billing
Unilateral SP termination	Implemented	foc_piece_security.go — full terminate phase, verifies piece addition blocked post-termination

Additional Vectors (not in original issue)

• Cross-dataset piece injection (foc_piece_security.go → attackCrossDataset()): Signs addPieces for the griefing dataset but submits to the primary FOC dataset
• Double piece deletion (foc_piece_security.go → attackDoubleDeletion()): Deletes the same pieceID that was already deleted
• Nonexistent piece deletion (foc_piece_security.go → attackNonexistentDelete()): Deletes a piece ID that doesn't exist
• Third-party deposit inflation (foc_payment_security.go): Attacker deposits to victim's account, assert.Always(!inflated) verifies no account inflation
• Curio HTTP resilience (foc_resilience.go): Malformed HTTP requests to Curio PDP API, assert.Always(pingOK, "Curio survives malformed HTTP")

Architecture

• 4 deck entries: DoPDPGriefingProbe, DoFOCPieceSecurityProbe, DoFOCPaymentSecurityProbe, DoFOCResilienceProbe
• Secondary attacker wallet isolated from main FOC lifecycle (prevents nonce collision)
• All attack assertions use assert.Sometimes (tolerant of Antithesis fault injection where any tx can fail)
• Sidecar assertions use assert.Always for safety invariants
• Read-only access to FOC primary dataset state (no interference with legitimate lifecycle)