Whitelist for Transaction Signers

[l-monninger]

Summary

• RFCs: $\emptyset$
• Categories: protocol-units

Enables a transaction signers whitelist.

• Adds a whitelist set to the Maptos transaction pipe which will rejected with TooManyTransactions if the signer is not whitelisted.
• This restriction on mempool ingress with the DA signer permissions Permissioned Blobs #723, prevents transactions from unauthorized signers from reaching the DA. Insofar as you permissioned proposers respect the same whitelist, whitelisting is consistent.
• Reads whitelist from lines in a file specified by the MAPTOS_INGRESS_ACCOUNT_WHITELIST environment variable or directly in the Maptos Config.

Testing

1. e2e tested.

Outstanding issues

1. There is no filtering of signers at the VM itself. It is presumed the whitelist can be appropriately applied at transaction ingress.
2. This is in memory. It is suited for a small-ish $O(10^6)$ whitelist (0.032 GB). Scale would benefit from a database, i.e., RocksDB set.

[mzabaluev]

Why does this need to be fallible? Wouldn't it be better to have Config correct on construction and whitelisted_accounts a simple getter?

[l-monninger]

I think your second line of review answers this.

[mzabaluev]

This should be done eagerly when config is initialized, not lazily in the getter which may be called multiple times.

[l-monninger]

Ideally, yes, but that requires modifying much more throughout the codebase. The approach here is to assume that the config is only responsible for providing the whitelist file path.