cosmos · sainoe · Nov 21, 2023 · Jun 1, 2023 · Jun 13, 2023 · Jun 13, 2023
@@ -4,6 +4,7 @@
 
 Add an entry to the unreleased provider section whenever merging a PR to main that is not targeted at a specific release. These entries will eventually be included in a provider release.
 
+* (refactor) [#1294](https://github.com/cosmos/interchain-security/pull/1294) Remove the equivocation proposal handler.
 * (feature!) [#1280](https://github.com/cosmos/interchain-security/pull/1280) provider proposal for changing reward denoms
 * (feature!) [#1244](https://github.com/cosmos/interchain-security/pull/1244) Update the default consumer unbonding period to 2 weeks.
 * (deps) [#1259](https://github.com/cosmos/interchain-security/pull/1259) Bump [cosmos-sdk](https://github.com/cosmos/cosmos-sdk) to [v0.47.5](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.5).
@@ -12,6 +13,9 @@ Add an entry to the unreleased provider section whenever merging a PR to main th
 * (deps!) [#1196](https://github.com/cosmos/interchain-security/pull/1196) Bump [ibc-go](https://github.com/cosmos/ibc-go) to [v7.2.0](https://github.com/cosmos/ibc-go/releases/tag/v7.2.0).
 * `[x/ccv/provider]` (fix) [#1076](https://github.com/cosmos/interchain-security/pull/1076) Add `InitTimeoutTimestamps` and `ExportedVscSendTimestamps` to exported genesis.
 
+### Cryptographic verification of equivocation
+* New feature enabling the provider chain to verify equivocation evidence on its own instead of trusting consumer chains, see [EPIC](https://github.com/cosmos/interchain-security/issues/732).
+
 ## [Unreleased for Consumer]
 
 Add an entry to the unreleased consumer section whenever merging a PR to main that is not targeted at a specific release. These entries will eventually be included in a consumer release.

@@ -29,7 +29,7 @@ RUN go mod tidy
 RUN make install
 
 # Get Hermes build
-FROM ghcr.io/informalsystems/hermes:1.4.1 AS hermes-builder
+FROM otacrew/hermes-ics:evidence-cmd AS hermes-builder
 
 # Get CometMock
 FROM ghcr.io/informalsystems/cometmock:v0.37.x as cometmock-builder

@@ -140,7 +140,6 @@ var (
 				ibcclientclient.UpgradeProposalHandler,
 				ibcproviderclient.ConsumerAdditionProposalHandler,
 				ibcproviderclient.ConsumerRemovalProposalHandler,
-				ibcproviderclient.EquivocationProposalHandler,
 				ibcproviderclient.ChangeRewardDenomsProposalHandler,
 			},
 		),
@@ -404,14 +403,6 @@ func New(
 		scopedIBCKeeper,
 	)
 
-	// create evidence keeper with router
-	app.EvidenceKeeper = *evidencekeeper.NewKeeper(
-		appCodec,
-		keys[evidencetypes.StoreKey],
-		app.StakingKeeper,
-		app.SlashingKeeper,
-	)
-
 	app.ProviderKeeper = ibcproviderkeeper.NewKeeper(
 		appCodec,
 		keys[providertypes.StoreKey],
@@ -424,7 +415,6 @@ func New(
 		app.StakingKeeper,
 		app.SlashingKeeper,
 		app.AccountKeeper,
-		app.EvidenceKeeper,
 		app.DistrKeeper,
 		app.BankKeeper,
 		authtypes.FeeCollectorName,
@@ -477,6 +467,16 @@ func New(
 	ibcRouter.AddRoute(providertypes.ModuleName, providerModule)
 	app.IBCKeeper.SetRouter(ibcRouter)
 
+	// create evidence keeper with router
+	evidenceKeeper := evidencekeeper.NewKeeper(
+		appCodec,
+		keys[evidencetypes.StoreKey],
+		app.StakingKeeper,
+		app.SlashingKeeper,
+	)
+
+	app.EvidenceKeeper = *evidenceKeeper
+
 	skipGenesisInvariants := cast.ToBool(appOpts.Get(crisis.FlagSkipGenesisInvariants))
 
 	// NOTE: Any module instantiated in the module manager that is later modified

@@ -74,37 +74,6 @@ Minimal example:
 }
 ```
 
-## `EquivocationProposal`
-:::tip
-`EquivocationProposal` will only be accepted on the provider chain if at least one of the consumer chains submits equivocation evidence to the provider.
-Sending equivocation evidence to the provider is handled automatically by the interchain security protocol when an equivocation infraction is detected on the consumer chain.
-:::
-
-Proposal type used to suggest slashing a validator for double signing on consumer chain.
-When proposals of this type are passed, the validator in question will be slashed for equivocation on the provider chain.
-
-:::warning
-Take note that an equivocation slash causes a validator to be tombstoned (can never re-enter the active set).
-Tombstoning a validator on the provider chain will remove the validator from the validator set of all consumer chains.
-:::
-
-Minimal example:
-```js
-{
-  "title": "Validator-1 double signed on consumerchain-1",
-  "description": "Here is more information about the infraction so you can verify it yourself",
-	// the list of equivocations that will be processed
-  "equivocations": [
-    {
-        "height": 14444680,
-        "time": "2023-02-28T20:40:00.000000Z",
-        "power": 5500000,
-        "consensus_address": "<consensus address ON THE PROVIDER>"
-    }
-  ]
-}
-```
-
 ## ChangeRewardDenomProposal
 :::tip
 `ChangeRewardDenomProposal` will only be accepted on the provider chain if at least one of the denomsToAdd or denomsToRemove fields is populated with at least one denom. Also, a denom cannot be repeated in both sets.
@@ -121,30 +90,3 @@ Minimal example:
   "denomsToRemove": []
 }
 ```
-
-### Notes
-When submitting equivocation evidence through an `EquivocationProposal` please take note that you need to use the consensus address (`valcons`) of the offending validator on the **provider chain**.
-Besides that, the `height` and the `time` fields should be mapped to the **provider chain** to avoid your evidence being rejected.
-
-Before submitting the proposal please check that the evidence is not outdated by comparing the infraction height with the `max_age_duration` and `max_age_num_blocks` consensus parameters of the **provider chain**.
-
-### Gaia example:
-```
-➜  ~ cat genesis.json | jq ".consensus_params"
-{
-  "block": {
-    ...
-  },
-  "evidence": {
-    "max_age_duration": "172800000000000",
-    "max_age_num_blocks": "1000000",
-    "max_bytes": "50000"
-  },
-  "validator": {
-    ...
-  },
-  "version": {}
-}
-```
-
-Any `EquivocationProposal` transactions that submit evidence with `height` older than `max_age_num_blocks` and `time` older than `max_age_duration` will be considered invalid.
@@ -20,17 +20,10 @@ Instead of slashing, the provider will only jail offending validator for the dur
 Slash throttling (sometimes called jail throttling) mechanism ensures that only a fraction of the validator set can be jailed at any one time to prevent malicious consumer chains from harming the provider.
 :::
 
-## Double-signing (equivocation)
-infractions are not acted upon immediately.
+# Cryptographic verification of equivocation and slashing
+The Cryptographic verification of equivocation allows external agents to submit evidences of light client and double signing attack observed on a consumer chain. When a valid evidence is received, the malicious validators will be slashed, jailed, and tombstoned on the provider.
 
-Upon receiving double signing evidence, the provider chain will take note of the evidence and allow for `EquivocationProposal` to be submitted to slash the offending validator.
-Any `EquivocationProposal`s to slash a validator that has not double signed on any of the consumer chains will be automatically rejected by the provider chain.
+The feature is outlined in [ADR-005](../adrs/adr-005-cryptographic-equivocation-verification.md) and [ADR-013](../adrs/adr-013-equivocation-slashing.md).
 
-:::info
-The offending validator will only be slashed (and tombstoned) if an `EquivocationProposal` is accepted and passed through governance.
-
-The offending validator will effectively get slashed and tombstoned on all consumer chains.
-:::
-
-<!-- markdown-link-check-disable-next-line -->
-You can find instructions on creating `EquivocationProposal`s [here](./proposals#equivocationproposal).
+By sending a `MsgSubmitConsumerMisbehaviour` or a `MsgSubmitConsumerDoubleVoting` transaction, the provider will
+ verify the reported equivocation and, if successful, slash, jail, and tombstone the malicious validator.
@@ -30,10 +30,6 @@ To ensure the security of the consumer chain, provider delegators cannot unbond
 
 If downtime is initiated by a validator on a consumer chain, a downtime packet will be relayed to the provider to jail that validator for a set amount of time. The validator who committed downtime will then miss out on staking rewards for the configured jailing period.
 
-### Equivocation (Double Sign) Slashing
-
-Evidence of equivocation must be submitted to provider governance and be voted on. This behavior is an extra safeguard before a validator is slashed, and may be replaced by a more automated system in the future.
-
 ### Tokenomics and Rewards
 
 Consumer chains are free to create their own native token which can be used for fees, and can be created on the consumer chain in the form of inflationary rewards. These rewards can be used to incentivize user behavior, for example, LPing or staking. A portion of these fees and rewards will be sent to provider chain stakers, but that proportion is completely customizable by the developers, and subject to governance.

@@ -91,7 +91,7 @@ More information is available in [Downtime Slashing documentation](../features/s
 :::
 
 ## Double-signing Infractions
-To learn more about equivocation handling in replicated security check out the [Slashing](../features/slashing.md#double-signing-equivocation) and [EquivocationProposal](../features/proposals.md#equivocationproposal) documentation sections
+To learn more about equivocation handling in replicated security check out the [Slashing](../features/slashing.md) documentation section.
 
 ## Key assignment
 Validators can use different consensus keys on the provider and each of the consumer chains. The consumer chain consensus key must be registered on the provider before use.

@@ -1,4 +1,4 @@
 syntax = "proto3";

 package interchain_security.ccv.provider.v1;

@@ -12,7 +12,6 @@
 import "ibc/core/client/v1/client.proto";
 import "ibc/lightclients/tendermint/v1/tendermint.proto";
 import "tendermint/crypto/keys.proto";
-import "cosmos/evidence/v1beta1/evidence.proto";
 import "cosmos/base/v1beta1/coin.proto";
 
 //
@@ -103,19 +102,6 @@
       [ (gogoproto.stdtime) = true, (gogoproto.nullable) = false ];
 }
 
-// EquivocationProposal is a governance proposal on the provider chain to
-// punish a validator for equivocation on a consumer chain.
-// 
-// This type is only used internally to the consumer CCV module.  
-message EquivocationProposal {
-  // the title of the proposal
-  string title = 1;
-  // the description of the proposal
-  string description = 2;
-  // the list of equivocations that will be processed
-  repeated cosmos.evidence.v1beta1.Equivocation equivocations = 3;
-}
-
 // ChangeRewardDenomsProposal is a governance proposal on the provider chain to
 // mutate the set of denoms accepted by the provider as rewards.
 message ChangeRewardDenomsProposal {

@@ -7,11 +7,15 @@ import "google/api/annotations.proto";
 import "gogoproto/gogo.proto";
 import "cosmos_proto/cosmos.proto";
 import "google/protobuf/any.proto";
+import "ibc/lightclients/tendermint/v1/tendermint.proto";
+import "tendermint/types/evidence.proto";
+
 
 // Msg defines the Msg service.
 service Msg {
-  rpc AssignConsumerKey(MsgAssignConsumerKey)
-      returns (MsgAssignConsumerKeyResponse);
+  rpc AssignConsumerKey(MsgAssignConsumerKey) returns (MsgAssignConsumerKeyResponse);
+  rpc SubmitConsumerMisbehaviour(MsgSubmitConsumerMisbehaviour) returns (MsgSubmitConsumerMisbehaviourResponse);
+  rpc SubmitConsumerDoubleVoting(MsgSubmitConsumerDoubleVoting) returns (MsgSubmitConsumerDoubleVotingResponse);
 }
 
 message MsgAssignConsumerKey {
@@ -28,3 +32,33 @@ message MsgAssignConsumerKey {
 }
 
 message MsgAssignConsumerKeyResponse {}
+
+
+// MsgSubmitConsumerMisbehaviour defines a message that reports a light client attack,
+//  also known as a misbehaviour, observed on a consumer chain
+message MsgSubmitConsumerMisbehaviour {
+  option (gogoproto.equal) = false;
+  option (gogoproto.goproto_getters) = false;
+  string submitter = 1;
+  // The Misbehaviour of the consumer chain wrapping 
+  // two conflicting IBC headers 
+  ibc.lightclients.tendermint.v1.Misbehaviour misbehaviour = 2;
+}
+
+message MsgSubmitConsumerMisbehaviourResponse {}
+
+
+// MsgSubmitConsumerDoubleVoting defines a message that reports 
+// a double signing infraction observed on a consumer chain
+message MsgSubmitConsumerDoubleVoting {
+  option (gogoproto.equal) = false;
+  option (gogoproto.goproto_getters) = false;
+  string submitter = 1;
+  // The equivocation of the consumer chain wrapping 
+  // an evidence of a validator that signed two conflicting votes
+  tendermint.types.DuplicateVoteEvidence duplicate_vote_evidence = 2;
+  // The light client header of the infraction block
+  ibc.lightclients.tendermint.v1.Header infraction_block_header = 3;
+}
+
+message MsgSubmitConsumerDoubleVotingResponse {}
@@ -66,7 +66,6 @@ func GetActionGen() *rapid.Generator[any] {
 		GetSubmitConsumerAdditionProposalActionGen().AsAny(),
 		GetSubmitConsumerRemovalProposalActionGen().AsAny(),
 		GetSubmitParamChangeProposalActionGen().AsAny(),
-		GetSubmitEquivocationProposalActionGen().AsAny(),
 		GetVoteGovProposalActionGen().AsAny(),
 		GetStartConsumerChainActionGen().AsAny(),
 		GetAddChainToRelayerActionGen().AsAny(),
@@ -90,6 +89,9 @@ func GetActionGen() *rapid.Generator[any] {
 		CreateLightClientEquivocationAttackActionGen().AsAny(),
 		CreateLightClientAmnesiaAttackActionGen().AsAny(),
 		CreateLightClientLunaticAttackActionGen().AsAny(),
+		GetStartConsumerEvidenceDetectorActionGen().AsAny(),
+		GetForkConsumerChainActionGen().AsAny(),
+		GetUpdateLightClientActionGen().AsAny(),
 	)
 }
 
@@ -208,7 +210,7 @@ func GetStartChainActionGen() *rapid.Generator[StartChainAction] {
 			Chain:          GetChainIDGen().Draw(t, "Chain"),
 			Validators:     GetStartChainValidatorsGen().Draw(t, "Validators"),
 			GenesisChanges: rapid.String().Draw(t, "GenesisChanges"),
-			SkipGentx:      rapid.Bool().Draw(t, "SkipGentx"),
+			IsConsumer:     rapid.Bool().Draw(t, "IsConsumer"),
 		}
 	})
 }
@@ -279,19 +281,6 @@ func GetSubmitParamChangeProposalActionGen() *rapid.Generator[submitParamChangeL
 	})
 }
 
-func GetSubmitEquivocationProposalActionGen() *rapid.Generator[submitEquivocationProposalAction] {
-	return rapid.Custom(func(t *rapid.T) submitEquivocationProposalAction {
-		return submitEquivocationProposalAction{
-			Chain:   GetChainIDGen().Draw(t, "Chain"),
-			From:    GetValidatorIDGen().Draw(t, "From"),
-			Deposit: rapid.Uint().Draw(t, "Deposit"),
-			Height:  rapid.Int64().Draw(t, "Height"),
-			Time:    GetTimeGen().Draw(t, "Time"),
-			Power:   rapid.Int64().Draw(t, "Power"),
-		}
-	})
-}
-
 func TestMarshalAndUnmarshalTime(t *testing.T) {
 	rapid.Check(t, func(t *rapid.T) {
 		time1 := GetTimeGen().Draw(t, "time")
@@ -499,3 +488,33 @@ func GetSlashThrottleDequeueActionGen() *rapid.Generator[slashThrottleDequeueAct
 		}
 	})
 }
+
+func GetForkConsumerChainActionGen() *rapid.Generator[forkConsumerChainAction] {
+	return rapid.Custom(func(t *rapid.T) forkConsumerChainAction {
+		return forkConsumerChainAction{
+			ConsumerChain: GetChainIDGen().Draw(t, "ConsumerChain"),
+			ProviderChain: GetChainIDGen().Draw(t, "ProviderChain"),
+			Validator:     GetValidatorIDGen().Draw(t, "Validator"),
+			RelayerConfig: rapid.String().Draw(t, "RelayerConfig"),
+		}
+	})
+}
+
+func GetStartConsumerEvidenceDetectorActionGen() *rapid.Generator[startConsumerEvidenceDetectorAction] {
+	return rapid.Custom(func(t *rapid.T) startConsumerEvidenceDetectorAction {
+		return startConsumerEvidenceDetectorAction{
+			Chain: GetChainIDGen().Draw(t, "Chain"),
+		}
+	})
+}
+
+func GetUpdateLightClientActionGen() *rapid.Generator[updateLightClientAction] {
+	return rapid.Custom(func(t *rapid.T) updateLightClientAction {
+		return updateLightClientAction{
+			Chain:         GetChainIDGen().Draw(t, "Chain"),
+			HostChain:     GetChainIDGen().Draw(t, "HostChain"),
+			RelayerConfig: rapid.String().Draw(t, "RelayerConfig"),
+			ClientID:      rapid.String().Draw(t, "ClientID"),
+		}
+	})
+}