Verify speculative base against stored state_id only#145
Merged
ikehara merged 3 commits intoJun 12, 2026
Merged
Conversation
added 3 commits
June 11, 2026 19:56
The stitch-phase base verification recomputed the expected prev_state_id with gen_state_id_from_any over the raw caller-supplied Anys. Light clients derive state IDs from a canonicalized client state (e.g. latest_height/frozen reset before hashing), and that canonicalization is ELC-specific and only available inside the enclave, so the recomputed hash never matches the enclave-observed prev_state_id for any ELC whose canonicalization is not the identity. This made every explicit-state speculative batch fail with BaseStateMismatch at the stitch phase. Drop the raw recompute and rely on the remaining checks: the supplied (client_state, consensus_state) bytes are pinned to the canonical store, and the enclave-observed prev_state_id must match the height-indexed state_id stored by the in-enclave light client at create/update time.
9189c57
into
feature/explicit-state-parallelization
2 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The stitch-phase base verification in
verify_expected_base_state_in_txrecomputes the expectedprev_state_idwithgen_state_id_from_anyover the raw caller-supplied Anys. Light clients derive state IDs from a canonicalized client state (e.g.latest_height/frozenreset before hashing — seetendermint-lcand other ELCs), and that canonicalization is ELC-specific and only available inside the enclave.As a result, the recomputed hash never matches the enclave-observed
prev_state_idfor any light client whose canonicalization is not the identity, and every explicit-state speculative batch deterministically fails at the stitch phase withBaseStateMismatch.The existing unit tests did not catch this because the test helper (
state_id_for_base_state) andmock-lc'sgen_state_idboth hash the raw Anys without canonicalization, so they were self-consistent with the buggy recompute.Fix
client_statebytes == stored canonicalclient_stateconsensus_statebytes == stored canonicalconsensus_stateatprev_heightprev_state_id== height-indexedstate_idstored by the in-enclave light client at create/update timestate_iddiffers from the raw-Any hash, so the asymmetry cannot reappear.state_idcheck.Testing
cargo test -p service(38 passed, includes the new regression test)cargo test -p enclave-apicargo clippy -p enclave-api -p service --tests(only a pre-existinglarge_enum_variantwarning inscheduler.rs, untouched by this PR)