fix(sei-tendermint): restore proposal tx-key decode bounds (CON-334)

sei-tendermint/internal/consensus/reactor.go

@@ -86,7 +86,7 @@ const (
 	VoteChannel        = p2p.ChannelID(0x22)
 	VoteSetBitsChannel = p2p.ChannelID(0x23)
 
-	maxMsgSize = 4194304 // 4MB; NOTE: keep larger than types.PartSet sizes.
+	maxMsgSize = types.MaxConsensusMsgBytes
 )
 
 // Reactor defines a reactor for the consensus service.

sei-tendermint/internal/consensus/wireguard_test.go

@@ -12,7 +12,10 @@ import (
 	"github.com/sei-protocol/sei-chain/sei-tendermint/types"
 )
 
-const maxCommitSignatures = types.MaxVotesCount
+const (
+	maxCommitSignatures = types.MaxVotesCount
+	maxProposalTxKeys   = types.MaxTxKeysPerProposal
+)
 
 func marshal(t *testing.T, m gogoproto.Message) []byte {
 	t.Helper()
@@ -53,6 +56,28 @@ func consensusProposalMessage(lastCommit *tmproto.Commit, evidenceCommits ...*tm
 	}}
 }
 
+func consensusProposalMessageWithTxKeys(n int) *tmcons.Message {
+	txKeys := make([]*tmproto.TxKey, n)
+	for i := range txKeys {
+		txKeys[i] = &tmproto.TxKey{}
+	}
+	return &tmcons.Message{Sum: &tmcons.Message_Proposal{
+		Proposal: &tmcons.Proposal{Proposal: tmproto.Proposal{
+			TxKeys: txKeys,
+		}},
+	}}
+}
+
+func TestSchemaForMessage_AcceptsProposalTxKeysAtCap(t *testing.T) {
+	require.NoError(t, protoutils.Scan[*tmcons.Message](marshal(t,
+		consensusProposalMessageWithTxKeys(maxProposalTxKeys))))
+}
+
+func TestSchemaForMessage_RejectsProposalTxKeysOverCap(t *testing.T) {
+	require.Error(t, protoutils.Scan[*tmcons.Message](marshal(t,
+		consensusProposalMessageWithTxKeys(maxProposalTxKeys+1))))
+}
+
 func TestSchemaForMessage_AcceptsLastCommitAtCap(t *testing.T) {
 	require.NoError(t, protoutils.Scan[*tmcons.Message](marshal(t,
 		consensusProposalMessage(commitWith(maxCommitSignatures)))))

sei-tendermint/proto/tendermint/types/types.proto

@@ -95,7 +95,7 @@ message Data {
 }
 
 message TxKey {
-  bytes tx_key = 1;
+  bytes tx_key = 1 [(wireguard.max_size) = 32 /* crypto.HashSize */];
 }
 
 // Vote represents a prevote, precommit, or commit vote from validators for
@@ -162,7 +162,7 @@ message Proposal {
     (gogoproto.stdtime) = true
   ];
   bytes signature = 7;
-  repeated TxKey tx_keys = 8;
+  repeated TxKey tx_keys = 8 [(wireguard.max_count) = 116508 /* types.MaxTxKeysPerProposal */];
   EvidenceList evidence = 9;
   Commit last_commit = 10;
   Header header = 11 [(gogoproto.nullable) = false];

sei-tendermint/types/mempool.go

@@ -44,6 +44,9 @@ func TxHashFromProto(dp *tmproto.TxKey) (TxHash, error) {
 	if dp == nil {
 		return TxHash{}, errors.New("nil data")
 	}
+	if len(dp.TxKey) != sha256.Size {
+		return TxHash{}, fmt.Errorf("invalid tx hash length: %d, expected: %d", len(dp.TxKey), sha256.Size)
+	}
 	var txBzs [sha256.Size]byte
 	copy(txBzs[:], dp.TxKey)
 

sei-tendermint/types/mempool_test.go

@@ -0,0 +1,37 @@
+package types
+
+import (
+	"crypto/sha256"
+	"testing"
+
+	"github.com/sei-protocol/sei-chain/sei-tendermint/libs/utils/require"
+	tmproto "github.com/sei-protocol/sei-chain/sei-tendermint/proto/tendermint/types"
+)
+
+func TestTxHashFromProtoValidatesLength(t *testing.T) {
+	testCases := []struct {
+		name string
+		size int
+	}{
+		{name: "empty", size: 0},
+		{name: "short", size: sha256.Size - 1},
+		{name: "long", size: sha256.Size + 1},
+	}
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := TxHashFromProto(&tmproto.TxKey{TxKey: make([]byte, tc.size)})
+			require.Error(t, err)
+		})
+	}
+
+	_, err := TxHashFromProto(nil)
+	require.Error(t, err)
+
+	key := make([]byte, sha256.Size)
+	for i := range key {
+		key[i] = byte(i)
+	}
+	hash, err := TxHashFromProto(&tmproto.TxKey{TxKey: key})
+	require.NoError(t, err)
+	require.Equal(t, TxHash(key), hash)
+}

sei-tendermint/types/proposal.go

@@ -18,6 +18,19 @@ var (
 	ErrInvalidBlockPartHash      = errors.New("error invalid block part hash")
 )
 
+const (
+	// MaxConsensusMsgBytes is the largest message the consensus channels accept.
+	MaxConsensusMsgBytes = 4194304 // 4MB; NOTE: keep larger than types.PartSet sizes.
+
+	// txKeyEntryBytes is the encoded size of one populated Proposal.tx_keys
+	// entry: the field tag and length prefix of the repeated field, plus a TxKey
+	// holding one crypto.HashSize digest behind its own tag and length prefix.
+	txKeyEntryBytes = 1 + 1 + 1 + 1 + crypto.HashSize
+
+	// MaxTxKeysPerProposal is the largest number of tx keys a Proposal can carry
+	MaxTxKeysPerProposal = MaxConsensusMsgBytes / txKeyEntryBytes
+)
+
 // Proposal defines a block proposal for the consensus.
 // It refers to the block by BlockID field.
 // It must be signed by the correct proposer for the given Height/Round

sei-tendermint/types/wireguard_test.go

@@ -6,12 +6,16 @@ import (
 	gogoproto "github.com/gogo/protobuf/proto"
 	"github.com/stretchr/testify/require"
 
+	"github.com/sei-protocol/sei-chain/sei-tendermint/crypto"
 	"github.com/sei-protocol/sei-chain/sei-tendermint/internal/protoutils"
 	tmproto "github.com/sei-protocol/sei-chain/sei-tendermint/proto/tendermint/types"
 	"github.com/sei-protocol/sei-chain/sei-tendermint/types"
 )
 
-const maxCommitSignatures = types.MaxVotesCount
+const (
+	maxCommitSignatures = types.MaxVotesCount
+	txKeySize           = crypto.HashSize
+)
 
 func marshal(t *testing.T, m gogoproto.Message) []byte {
 	t.Helper()
@@ -54,6 +58,37 @@ func lcaeEvidence(n int) *tmproto.Evidence {
 	return &ev
 }
 
+func txKeyWith(n int) *tmproto.TxKey {
+	return &tmproto.TxKey{TxKey: make([]byte, n)}
+}
+
+func proposalSizeWithTxKeys(t *testing.T, n int) int {
+	t.Helper()
+	txKeys := make([]*tmproto.TxKey, n)
+	for i := range txKeys {
+		txKeys[i] = txKeyWith(txKeySize)
+	}
+	return len(marshal(t, &tmproto.Proposal{TxKeys: txKeys}))
+}
+
+// MaxTxKeysPerProposal must sit just above the largest tx key count the
+// consensus channel can carry. The transport enforces that budget while
+// reassembling a message, before the wireguard scan runs, so a cap at or above
+// this point can only reject proposals that were never deliverable. The lower
+// bound keeps the cap tight enough to still bound decode work.
+func TestMaxTxKeysPerProposalExceedsEveryDeliverableProposal(t *testing.T) {
+	require.Greater(t, proposalSizeWithTxKeys(t, types.MaxTxKeysPerProposal), types.MaxConsensusMsgBytes)
+	require.LessOrEqual(t, proposalSizeWithTxKeys(t, types.MaxTxKeysPerProposal-1), types.MaxConsensusMsgBytes)
+}
+
+func TestSchemaForTxKey_AcceptsAtCap(t *testing.T) {
+	require.NoError(t, protoutils.Scan[*tmproto.TxKey](marshal(t, txKeyWith(txKeySize))))
+}
+
+func TestSchemaForTxKey_RejectsOverCap(t *testing.T) {
+	require.Error(t, protoutils.Scan[*tmproto.TxKey](marshal(t, txKeyWith(txKeySize+1))))
+}
+
 func TestSchemaForBlock_AcceptsLastCommitAtCap(t *testing.T) {
 	require.NoError(t, protoutils.Scan[*tmproto.Block](marshal(t,
 		consensusAssembledBlock(commitWith(maxCommitSignatures)))))