Allow attesting to older slots

[paulhauner]

Description

#2130 resolves an immediate issue in a brute-force manner.

However, we could provide protection for the described attack whilst still allowing attestation production for some previous slots. If we have the head BeaconState then there's no reason we can't attest to earlier slots in it's current epoch or all slots in it's previous epoch (this is because the shuffling is known for these states).

This would have the affect of disabling attestations to distant slots, but still providing some support for past slots.

[kevlu93]

this one sounds interesting. wouldn't mind taking a stab at it.

[paulhauner]

this one sounds interesting. wouldn't mind taking a stab at it.

Cool! Happy to help on the review :)

[paulhauner]

One of our primary goals is to avoid state reads whilst generating an attestation. To avoid this, we presently we only allow attesting for the current slot. However, this is too strict we could also expand it to include some prior slots.

To produce an attestation we need the following things from a BeaconState:

1. The beacon committee length: easily available for prev/current/next epoch
2. The "head" root: known for SLOTS_PER_HISTORICAL_ROOT (8,192) slots in the past via state.block_roots.
3. The "source" epoch/root: state.current_justified_epoch gives us the current epoch, state.previous_justified_epoch gives us the previous epoch, next epoch is unknown.
4. The "target" epoch/root: known for SLOTS_PER_HISTORICAL_ROOT / 32 epochs in the past via state.block_roots.

Therefore, given some BeaconState (the head state in our case) it is possible to produce an attestation in the current and previous epochs without doing any state reads.

To achieve this, I think we'll need to modify some of the logic here to read values for the previous epch:

lighthouse/beacon_node/beacon_chain/src/beacon_chain.rs

Lines 961 to 968 in 3a24ca5

	pub fn produce_unaggregated_attestation_for_block(
	&self,
	slot: Slot,
	index: CommitteeIndex,
	beacon_block_root: Hash256,
	mut state: Cow<BeaconState<T::EthSpec>>,
	state_root: Hash256,
	) -> Result<Attestation<T::EthSpec>, Error> {

And then loosen this constraint:

lighthouse/beacon_node/beacon_chain/src/beacon_chain.rs

Lines 925 to 950 in 3a24ca5

	if slot >= head.beacon_block.slot() {
	self.produce_unaggregated_attestation_for_block(
	slot,
	index,
	head.beacon_block_root,
	Cow::Borrowed(&head.beacon_state),
	head.beacon_state_root(),
	)
	} else {
	// We disallow producing attestations *prior* to the current head since such an
	// attestation would require loading a `BeaconState` from disk. Loading `BeaconState`
	// from disk is very resource intensive and proposes a DoS risk from validator clients.
	//
	// Although we generally allow validator clients to do things that might harm us (i.e.,
	// we trust them), sometimes we need to protect the BN from accidental errors which
	// could cause it significant harm.
	//
	// This case is particularity harmful since the HTTP API can effectively call this
	// function an unlimited amount of times. If `n` validators all happen to call it at
	// the same time, we're going to load `n` states (and tree hash caches) into memory all
	// at once. With `n >= 10` we're looking at hundreds of MB or GBs of RAM.
	Err(Error::AttestingPriorToHead {
	head_slot: head.beacon_block.slot(),
	request_slot: slot,
	})
	}

[paulhauner]

If you're not still working on this @kevlu93, it might be a good one for @realbigsean.

[kevlu93]

Started working on this, but currently busy so haven't been able to spend time on it recently. Won't free up until after July 8. Would like to finish this but @realbigsean is more than welcome to take over

[realbigsean]

Hey @kevlu93, I'll start working on some other things might come back to this before then. But will let you know before I do

[paulhauner]

Hey all, I've had to start working on this since we're getting seeing some related errors on our Prater nodes 🙂