mirror of
https://github.com/Xahau/xahaud.git
synced 2026-07-24 15:40:08 +00:00
b4208459cf
Bound proposal-carried export signature blobs before hashing them during proposal precheck, and apply the same size cap at export signature harvest as defense in depth. Cap the unverified export-signature cache by distinct tx hash while leaving verified signatures and existing entries ungated, so real exports can still reach quorum. Domain-separate Hook RNG using the actual strong/weak execution role at draw time, and document the residual commit/reveal withholding bias across all entropy tiers.
54 lines
2.4 KiB
C++
54 lines
2.4 KiB
C++
#ifndef RIPPLE_PROTOCOL_ENTROPY_TIER_H_INCLUDED
|
|
#define RIPPLE_PROTOCOL_ENTROPY_TIER_H_INCLUDED
|
|
|
|
#include <cstdint>
|
|
|
|
namespace ripple {
|
|
|
|
/// Which gate the ledger's entropy passed. Stored in sfEntropyTier (UINT8)
|
|
/// on the ttCONSENSUS_ENTROPY pseudo-transaction and the ConsensusEntropy
|
|
/// ledger entry.
|
|
///
|
|
/// EntropyCount says how many validators contributed; EntropyTier says which
|
|
/// gate the result passed. Values are strength-ordered so consumers can gate
|
|
/// with a numeric comparison (tier >= required).
|
|
///
|
|
/// RESIDUAL BIAS — applies to EVERY tier, including participant_aligned and
|
|
/// validator_quorum, not just the fallback. This is a commit/reveal scheme: a
|
|
/// validator can withhold its reveal until after observing peers' reveals,
|
|
/// choosing between two outcomes (its contribution in vs. out) — up to one bit
|
|
/// of influence per withholder, and colluding withholders near a threshold can
|
|
/// instead force a downgrade to a lower tier. These tiers bound and *label*
|
|
/// manipulation (it is observable and limited); they are NOT bias-resistant
|
|
/// against a colluding validator minority. Applications that need that
|
|
/// guarantee (e.g. high-value lotteries) must layer additional mechanisms on
|
|
/// top (VRF / threshold-BLS style constructions).
|
|
enum EntropyTier : std::uint8_t {
|
|
/// No usable entropy (reserved; a fresh ConsensusEntropy entry should
|
|
/// always carry one of the tiers below).
|
|
entropyTierNone = 0,
|
|
|
|
/// Consensus-bound deterministic fallback: derived from already-agreed
|
|
/// round inputs (parent ledger hash, base tx set hash, sequence) under
|
|
/// HashPrefix::entropyFallback when no agreed reveal set reaches either
|
|
/// participant_aligned or validator_quorum. Unpredictable in practice but
|
|
/// user-influenceable via transaction submission — never suitable for
|
|
/// value-bearing outcomes.
|
|
entropyTierConsensusFallback = 1,
|
|
|
|
/// Participant-aligned sub-quorum entropy: the agreed reveal set aligned at
|
|
/// the tier-2 participant threshold — below the 80% validator quorum but at
|
|
/// or above the equivocation-intersection floor over the original
|
|
/// (pre-nUNL)
|
|
/// view. Weaker than validator_quorum; opt-in for hooks via min_tier.
|
|
entropyTierParticipantAligned = 2,
|
|
|
|
/// Validator commit/reveal entropy whose sidecar set passed the
|
|
/// active-validator-view quorum alignment gate.
|
|
entropyTierValidatorQuorum = 3,
|
|
};
|
|
|
|
} // namespace ripple
|
|
|
|
#endif
|