feat(ADR-028): refunding transaction fee for certain txs #125

SebastianElvis · 2024-10-03T01:55:52Z

Resolves https://github.com/babylonlabs-io/pm/issues/64

This PR introduces the functionality of refunding fee for certain txs, including BTC headers/checkpoints in BTC timestamping protocol, and finality signature, BTC delegation inclusion proof, covenant signatures, undelegation, selective slashing evidence in BTC staking protocol.

The implementation leverages a new key-only KV store in the incentive module for storing refundable messages, and a new PostHandler for refunding a tx if all msgs in it are refundable.

Along the way, this PR also adds dependency from BTC light client / BTC staking modules to the incentive module, and adds relevant e2e tests to ensure that the tx fee refunding indeed works.

test/e2e/configurer/chain/commands.go

RafilxTenfen · 2024-10-03T11:54:59Z

x/incentive/keeper/refund_tx_decorator.go

+ // if all messages in the tx are refundable, refund the tx
+ if len(refundableMsgHashList) == len(tx.GetMsgs()) {
+ err := d.k.RefundTx(ctx, feeTx)
+ if err != nil {


why not return the error if it fails to refund?

If this returns error then the tx will be rejected and all resulting state transition will be reverted. It's a bit unexpected to fail the tx due to fee refund, but tbh not sure if it's a good thing to do. If RefundTx fails it might mean something is really wrong. Will think more about it tmr

RafilxTenfen

LGTM, nice PR!
Only a few questions, but no blockers

RafilxTenfen · 2024-10-03T11:57:08Z

x/incentive/keeper/refundable_msg_index.go

KonradStaniec · 2024-10-04T05:29:13Z

CHANGELOG.md

@@ -41,6 +41,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)

 ### State Machine Breaking

+* [#125](https://github.com/babylonlabs-io/babylon/pull/125) Implement ADR-028 and


this should go to unreleased

KonradStaniec · 2024-10-04T05:36:04Z

x/btccheckpoint/keeper/msg_server.go

@@ -92,6 +92,11 @@ func (ms msgServer) InsertBTCSpvProof(ctx context.Context, req *types.MsgInsertB
 return nil, err
 }

+ // At this point, the BTC checkpoint is considered the first valid submission


this is not exactly true as it may be as well not first submission. If the intention is to refund only first one, the place to do so would be elsewere.

On the other hand, I thought we want to refund all valid submissions ?

Yeah this is a typo we want to refund all valid submissions (more specifically, every unique pair of BTC txs). Will clarify in a follow-up

KonradStaniec · 2024-10-04T05:39:53Z

x/btcstaking/keeper/msg_server.go

@@ -466,6 +470,14 @@ func (ms msgServer) AddCovenantSigs(goCtx context.Context, req *types.MsgAddCove
 params,
 )

+ // at this point, the covenant signatures are verified and are not duplicated.
+ // Thus, we can safely consider this message as refundable
+ // NOTE: currently we refund tx fee for covenant signatures even if the BTC


hmm this is not entirely true tbh. We have check for quorum super early in the handler:

if btcDel.HasCovenantQuorums(params.CovenantQuorum) { ms.Logger(ctx).Debug("Received covenant signature after achieving quorum", "covenant pk", req.Pk.MarshalHex()) return &types.MsgAddCovenantSigsResponse{}, nil }

so this won't be refunded. And refunding it would require a bit of refactor.

Either way I think we cannot refund such case, as then covenant committe member could send his signature forever and bloating chain with it.

Hmm I see. So this won't get refunded in the current impl

I actually think we should refund when covenant quorum is reached. Otherwise for each BTC delegation the covenant member has a rough probability of (covenant size - covenant quorum) / covenant size to pay some tx fee, so running a covenant emulator won't be free. But the goal of refunding is to ensure running covenant emulator does not incur tx fee.

Either way I think we cannot refund such case, as then covenant committe member could send his signature forever and bloating chain with it.

Does this attack vector exist? for each BTC delegation a covenant member can only send 1 valid covenant signature, and subsequent ones will be rejected and won't get refunded (ref).

oh you are right.

So if we reject duplicates early and not refund them this is fine.

Though handler need refactor either way, as we should refund signatures after quorum only if they are valid and pass all checks.

KonradStaniec · 2024-10-04T05:56:19Z

x/incentive/keeper/refund_tx_decorator.go

+ // iterate over all messages in the tx, and record whether they are refundable
+ for _, msg := range tx.GetMsgs() {
+ msgHash := types.HashMsg(msg)
+ if d.k.HasRefundableMsg(ctx, msgHash) {


I think we need to filter our the duplicated form the message list or do refunds only in case when there is 1 message in transaction.

Consider case, if finality provider woud create transactions with finality votes:

First vote would be valid finality vote which would be indexable for refund

All other votes would be duplicates

Transaction would be successful as duplicated vote is not an error:

if err == nil && existingSig.Equals(req.FinalitySig) { ms.Logger(ctx).Debug("Received duplicated finiality vote", "block height", req.BlockHeight, "finality provider", req.FpBtcPk) // exactly same vote already exists, return success to the provider return &types.MsgAddFinalitySigResponse{}, nil }

Now finality provider can bloat the ledger for free i.e he can send transactions with 100 duplicated votes and not pay anything.

In this example, upon duplicated finality signature the function will return directly without calling IndexRefundableMsg, so this condition won't be met and the tx won't get refunded. Or did I miss anything?

Per offline discussion, this is an issue: the problem is that these messages share the same hash and then all of them are considered refundable in the posthandler. Will address this issue by doing the following:

deduplicate hashes in posthandler before comparing the length

return error upon duplicated finality signature to be extra safe, as this gets more sensitive in security

This follow-up PR fixes the comments in #125, including - changelog and typo comments in BTCCheckpoint module - allow covenant signatures after covenant quorum are reached, and return error if the covenant signature is duplicated. This is to ensure covenants won't have operational cost when submitting covenant sig late, and avoid refunding to duplicated covenant signatures - reject duplicated finality signature. This is to avoid refunding to duplicated covenant signatures - add a dedup check in the PostHandler, to ensure one won't exploit the refunding by having many duplicated messages in a single tx. Also added a fuzz test for this.

init

f2e5a54

SebastianElvis changed the title ~~feat(ADR-028): refunding transaction fee for certain messages~~ feat(ADR-028): refunding transaction fee for certain txs Oct 3, 2024

SebastianElvis added 6 commits October 3, 2024 12:02

fix tests

147c276

e2e

bdfd748

more refundable tx

73735ff

fix e2e

c538635

refund btc header submission

98ffde5

test failure case

420e263

SebastianElvis marked this pull request as ready for review October 3, 2024 07:30

SebastianElvis requested a review from a team as a code owner October 3, 2024 07:30

SebastianElvis requested review from KonradStaniec, RafilxTenfen, gitferry, Lazar955 and a team and removed request for a team October 3, 2024 07:30

RafilxTenfen reviewed Oct 3, 2024

View reviewed changes

test/e2e/configurer/chain/commands.go Show resolved Hide resolved

RafilxTenfen reviewed Oct 3, 2024

View reviewed changes

RafilxTenfen approved these changes Oct 3, 2024

View reviewed changes

x/incentive/keeper/refundable_msg_index.go

Copy link

Contributor

RafilxTenfen Oct 3, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💯

SebastianElvis reacted with thumbs up emoji

SebastianElvis merged commit 6e5210d into main Oct 4, 2024
18 checks passed

KonradStaniec reviewed Oct 4, 2024

View reviewed changes

SebastianElvis mentioned this pull request Oct 4, 2024

chore: tx fee refunding follow-up #130

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(ADR-028): refunding transaction fee for certain txs #125

feat(ADR-028): refunding transaction fee for certain txs #125

SebastianElvis commented Oct 3, 2024 •

edited

Loading

RafilxTenfen Oct 3, 2024

SebastianElvis Oct 3, 2024

RafilxTenfen left a comment •

edited

Loading

RafilxTenfen Oct 3, 2024

KonradStaniec Oct 4, 2024

KonradStaniec Oct 4, 2024

SebastianElvis Oct 4, 2024

KonradStaniec Oct 4, 2024

SebastianElvis Oct 4, 2024

KonradStaniec Oct 4, 2024

KonradStaniec Oct 4, 2024 •

edited

Loading

SebastianElvis Oct 4, 2024

SebastianElvis Oct 4, 2024 •

edited

Loading

		@@ -41,6 +41,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)

		### State Machine Breaking

		* [#125](https://github.com/babylonlabs-io/babylon/pull/125) Implement ADR-028 and

feat(ADR-028): refunding transaction fee for certain txs #125

feat(ADR-028): refunding transaction fee for certain txs #125

Conversation

SebastianElvis commented Oct 3, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

RafilxTenfen left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

KonradStaniec Oct 4, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SebastianElvis Oct 4, 2024 • edited Loading

Choose a reason for hiding this comment

SebastianElvis commented Oct 3, 2024 •

edited

Loading

RafilxTenfen left a comment •

edited

Loading

KonradStaniec Oct 4, 2024 •

edited

Loading

SebastianElvis Oct 4, 2024 •

edited

Loading