Implement native Notary contract #3178

AnnaShaleva · 2024-03-19T17:40:21Z

Description

Implement native Notary contract.

Close #2897.

Type of change

New feature (non-breaking change which adds functionality)

How Has This Been Tested?

Native Gas contract unit tests;
Native Notary contract unit tests.

Checklist:

My code follows the style guidelines of this project
I have performed a self-review of my code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
My changes generate no new warnings
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes
Any dependent changes have been merged and published in downstream modules:
- Neo.SmartContract.Framework: add native Notary contract API neo-devpack-dotnet#1300

Close #2896. Use a stub for native Notary contract hash since this contract is not implemented yet. Thus, technically, NotaryAssisted attribute verification will always fail on real network until native Notary is implemented. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

…ribute Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

Transactions network fee should be split between Primary node and Notary nodes. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

Once Notary contract is implemented, this hash will be replaced by a proper Notary contract hash. The exact value won't be changed since Notary contract has constant hash as any other native contract. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

No functional changes, just a refactoring for better code readability. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

Close #2897. Depends on #3175. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

vncoelho · 2024-03-19T18:05:28Z

Is this PR to be merged now or after next release?
I was planning to review current release and then merge these next feature.

roman-khimov · 2024-03-19T18:24:29Z

Is this PR to be merged now or after next release?

https://github.com/neo-project/neo/milestone/2

src/Neo/SmartContract/Native/Notary.cs

src/Neo/SmartContract/Native/GasToken.cs

src/Neo/SmartContract/Native/Notary.cs

dusmart · 2024-03-21T10:10:17Z

This contract has a Verify method which is very dangerous.

neo/src/Neo/SmartContract/Native/Notary.cs

Line 95 in 77ffe09

private bool Verify(ApplicationEngine engine, byte[] sig)

In this method, we verify that tx.Signers[1] has enough balance stored in the contract. Plus, we verify that a signature from any notary is provided.

Here is an attack vector. A malicious notary can sign as many transactions as it wants and then publish at most 500 txs on chain while tx.Signers[1] has a little balance only sufficient for one tx.

If it's not a malicious notary, someone could still get a chance to make the notary sign something multiple times and cache them then publish them at once.

By the way, do you know how many core modules will be affected by this notary feature? Is this the last PR?

src/Neo/SmartContract/Native/Notary.cs

vncoelho

I am not seeing the part of the code we discussed on Discord, @AnnaShaleva, you mentioned about a delegated powered notary signing.
"The contract itself don't send the transactions. It's a designated Notary node who is powered to send transactions on behalf of notary service users. "

I want to check that because it should be, at least, similar to the oracles design.

Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

No functional changes, just a refactoring. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

AnnaShaleva · 2024-03-21T18:29:31Z

By the way, do you know how many core modules will be affected by this notary feature? Is this the last PR?

To be able to process existing NeoFS chains that use Notary - yes, it's the last PR. But ideally in future we'd like to implement P2PNotaryRequest payload with pool (ref. nspcc-dev/neo-go#1546) and Notary service plugin (ref. nspcc-dev/neo-go#1547). We'll add related issues to neo-project later.

"The contract itself don't send the transactions. It's a designated Notary node who is powered to send transactions on behalf of notary service users. "
I want to check that because it should be, at least, similar to the oracles design.

It's a part of Notary service plugin. See the example implementation in https://github.com/nspcc-dev/neo-go/blob/master/pkg/services/notary/notary.go.

vang1ong7ang

as @dusmart said , verify method should be used with extreme caution. and is there a fork introduced?

roman-khimov · 2024-03-26T05:39:41Z

verify method should be used with extreme caution

That's a valid concern, but there are multiple ways to handle it, we'll get to it after #3175 merge.

cschuchardt88 · 2025-03-04T19:35:55Z

src/Neo/SmartContract/Native/Notary.cs

+        [ContractMethod(CpuFee = 1 << 15, RequiredCallFlags = CallFlags.ReadStates)]
+        private bool Verify(ApplicationEngine engine, byte[] sig)
+        {
+            Transaction tx = (Transaction)engine.ScriptContainer;


better to use as just in case we change ScriptContainer to something else like a block. Applications using ApplicationEngine will crash if the container is not Transaction type. Please change.

we change ScriptContainer to something else like a block

It's impossible in this context. Contract verification always uses transaction as a script container, and if (for some reason) it's not true, then transaction will be FAULTed (which is the desired behaviour).

Im asking is to

Transaction tx = engine.ScriptContainer as Transaction; if (tx is null) return false;

No reason to crash. https://github.com/neo-project/proposals/blob/ff39b57eb67981b1ec7f0b244ec053aacdb7139a/nep-30.mediawiki#user-content-verify says it must return boolean, not crash and must check System.Runtime.GetTrigger

Security is number one priority

It's not a security issue, but for better user experience we can do it. Fixed.

If it crashes it becomes caughtexception and someone can use trycatch and push true to the stack in a signature.

src/Neo/SmartContract/Native/Notary.cs

tests/Neo.UnitTests/Extensions/Nep17NativeContractExtensions.cs

Wi1l-B0t · 2025-03-05T01:25:50Z

src/Neo/SmartContract/Native/Notary.cs

+                    nFees += (long)nKeys + 1;
+                    if (tx.Sender == Hash)
+                    {
+                        var payer = tx.Signers[1];


Won't it be out of range here?

It won't, it is guaranteed by Notary's Verify method.

But if contrainer is null this will fail. Unless verify is fixed with #3178 (comment)

Wi1l-B0t · 2025-03-05T01:27:15Z

src/Neo/SmartContract/Native/Notary.cs

+        [ContractMethod(CpuFee = 1 << 15, RequiredCallFlags = CallFlags.States)]
+        private void SetMaxNotValidBeforeDelta(ApplicationEngine engine, uint value)
+        {
+            if (value > engine.ProtocolSettings.MaxValidUntilBlockIncrement / 2 || value < ProtocolSettings.Default.ValidatorsCount) throw new FormatException(string.Format("MaxNotValidBeforeDelta cannot be more than {0} or less than {1}", engine.ProtocolSettings.MaxValidUntilBlockIncrement / 2, ProtocolSettings.Default.ValidatorsCount));


This line is too long.

Click on the wrong button

shargon · 2025-03-05T11:06:14Z

src/Neo/SmartContract/Native/Notary.cs

+            Transaction tx = (Transaction)engine.ScriptContainer;
+            if (tx.GetAttribute<NotaryAssisted>() is null) return false;


Suggested change

Transaction tx = (Transaction)engine.ScriptContainer;

if (tx.GetAttribute<NotaryAssisted>() is null) return false;

var tx = engine.ScriptContainer as Transaction;

if (tx?.GetAttribute<NotaryAssisted>() is null) return false;

Do you still think that it's needed? See #3178 (comment), please.

I think it's better, impossible, but don't hurt and compatible with both cases

Thank you @shargon #3178 (comment)

Co-authored-by: Will <201105916+Wi1l-B0t@users.noreply.github.com>

No functional changes. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

Wi1l-B0t · 2025-03-06T00:55:08Z

src/Neo/SmartContract/Native/Notary.cs

+            var additionalParams = (Array)data;
+            if (additionalParams.Count() != 2) throw new FormatException("`data` parameter should be an array of 2 elements");


OnNEP17Payment may be called by the contract.
So the data may not be an Array, and this line will throw an InvalidCastException if not an Array.
It's OK even if InvalidCastException?

Suggested change

var additionalParams = (Array)data;

if (additionalParams.Count() != 2) throw new FormatException("`data` parameter should be an array of 2 elements");

var additionalParams = data as Array;

if (additionalParams is null || additionalParams.Count() != 2)

throw new FormatException("`data` parameter should be an array of 2 elements");

This should be object type aka Any

OnNEP17Payment may be called by the contract.

It's impossible because several lines below we have a check that ensures that calling context is GasToken contract.

So the data may not be an Array

But even when the caller is GasToken, it's possible that data has an unexpected format, so you're right here.

It's OK even if InvalidCastException?

Yes, it's OK, the main point here is that exception will be thrown anyway and execution is aborted. But from user's PoW it's always nice to see a well-formatted exception message instead of just InvalidCastException, hence I've updated this code.

shargon · 2025-03-06T14:10:25Z

src/Neo/SmartContract/Native/Notary.cs

+        {
+            long nFees = 0;
+            ECPoint[] notaries = null;
+            foreach (Transaction tx in engine.PersistingBlock.Transactions)


We can check if PersistingBlock is null, neo express debugger fail with something similar in the past.

This particular part of the code is ported from

neo/src/Neo/SmartContract/Native/GasToken.cs

Line 42 in 74330d9

foreach (Transaction tx in engine.PersistingBlock.Transactions)

And we need to be unified with the behaviour. So we either fix it in both places or keep it as is.

shargon · 2025-03-06T14:11:18Z

src/Neo/SmartContract/Native/Notary.cs

+                    {
+                        var payer = tx.Signers[1];
+                        var balance = engine.SnapshotCache.GetAndChange(CreateStorageKey(Prefix_Deposit, payer.Account))?.GetInteroperable<Deposit>();
+                        balance.Amount -= tx.SystemFee + tx.NetworkFee;


balance can be null

Theoretically it's not much different from GAS contract being unable to write the fee off the sender balance, valid blocks shouldn't allow for that.

Anyone can call ApplicationEngine with whatever parameters they want. This needs to be fixed. This will crash testing environments. Safely is number one priority.

It can't. For a single transaction it is guaranteed by verify method of this contract:

neo/src/Neo/SmartContract/Native/Notary.cs

Line 117 in bb153eb

if (balance is null || balance.Amount.CompareTo(tx.NetworkFee + tx.SystemFee) < 0) return false;

For multiple transactions in block it will be guaranteed by the mempool extension (not a part of this PR).

verify is a CaughtException. So catch it then what?

src/Neo/SmartContract/Native/Notary.cs

Throw FormatException instead of InvalidCastException on invalid data passed to OnNEP17Payment. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

src/Neo/SmartContract/Native/Notary.cs

Return `false` in case if execution container for `verify` is not a transaction. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

Wi1l-B0t · 2025-03-11T00:48:31Z

src/Neo/SmartContract/Native/Notary.cs

+            if (deposit is null) return false;
+            if (till < deposit.Till) return false;


Suggested change

if (deposit is null) return false;

if (till < deposit.Till) return false;

if (deposit is null || till < deposit.Till) return false;

Wi1l-B0t · 2025-03-11T01:00:42Z

src/Neo/SmartContract/Native/Notary.cs

+    {
+        /// <summary>
+        /// A default value for maximum allowed NotValidBeforeDelta. It is set to be
+        /// 20 rounds for 7 validators, a little more than half an hour for 15-seconds blocks.


A block will be 3 seconds. Does this const value need to be adjusted?

Let's keep the default value as it as is for now, it's just a default. And then we'll customize it for different networks, e.g. Mainnet is still running with 15-seconds blocks and NeoFS networks are running with 1-second blocks.

No functional changes, just a refactoring. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

AnnaShaleva · 2025-03-11T16:40:31Z

@neo-project/core review, please.

AnnaShaleva and others added 8 commits March 6, 2024 12:00

Payloads: add doc to CalculateNetworkFee method of NotaryAssisted att…

acec1b0

…ribute Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

Native: add NotaryAssisted attributes handler to Gas OnPersist

1508d4f

Transactions network fee should be split between Primary node and Notary nodes. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

Payloads: adjust comment to NotaryAssisted attribute

8b547c9

Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

Merge branch 'master' into notary-assisted

00b54ff

Payloads: replace hard-coded Notary hash value with calculated one

24135ff

No functional changes, just a refactoring for better code readability. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

Native: implement native Notary contract

77ffe09

Close #2897. Depends on #3175. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

AnnaShaleva requested review from shargon, Jim8y, vncoelho, roman-khimov and superboyiii March 19, 2024 17:40

AnnaShaleva added the Waiting for Review label Mar 19, 2024

dusmart reviewed Mar 20, 2024

View reviewed changes

src/Neo/SmartContract/Native/Notary.cs Outdated Show resolved Hide resolved

cschuchardt88 requested changes Mar 21, 2024

View reviewed changes

Hecate2 reviewed Mar 21, 2024

View reviewed changes

src/Neo/SmartContract/Native/Notary.cs Show resolved Hide resolved

cschuchardt88 reviewed Mar 21, 2024

View reviewed changes

src/Neo/SmartContract/Native/Notary.cs Show resolved Hide resolved

cschuchardt88 requested changes Mar 21, 2024

View reviewed changes

src/Neo/SmartContract/Native/Notary.cs Outdated Show resolved Hide resolved

vncoelho reviewed Mar 21, 2024

View reviewed changes

AnnaShaleva mentioned this pull request Mar 21, 2024

Implement NotaryAssisted transaction attribute #3175

Merged

12 tasks

AnnaShaleva added 2 commits March 21, 2024 21:01

Native: fix typo in the exception message

cb4bdda

Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

Native: use more syntactic sugar

8f9f5f7

No functional changes, just a refactoring. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

vang1ong7ang suggested changes Mar 26, 2024

View reviewed changes

Merge branch 'master' into notary-contract

5ee1855

AnnaShaleva added Hardfork and removed Wait Technical Committee labels Mar 4, 2025

cschuchardt88 reviewed Mar 4, 2025

View reviewed changes

Wi1l-B0t reviewed Mar 5, 2025

View reviewed changes

tests/Neo.UnitTests/Extensions/Nep17NativeContractExtensions.cs Outdated Show resolved Hide resolved

Wi1l-B0t previously approved these changes Mar 5, 2025

View reviewed changes

Wi1l-B0t self-requested a review March 5, 2025 01:29

shargon reviewed Mar 5, 2025

View reviewed changes

shargon and others added 3 commits March 5, 2025 12:07

clean usings

08162ec

Update tests/Neo.UnitTests/Extensions/Nep17NativeContractExtensions.cs

c9ce04b

Co-authored-by: Will <201105916+Wi1l-B0t@users.noreply.github.com>

Notary: improve long line format

bb153eb

No functional changes. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

AnnaShaleva requested review from shargon and cschuchardt88 March 5, 2025 17:40

Wi1l-B0t reviewed Mar 6, 2025

View reviewed changes

shargon reviewed Mar 6, 2025

View reviewed changes

Notary: prettify exception thrown on unexpected OnNEP17Payment data

516ca30

Throw FormatException instead of InvalidCastException on invalid data passed to OnNEP17Payment. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

shargon reviewed Mar 6, 2025

View reviewed changes

src/Neo/SmartContract/Native/Notary.cs Show resolved Hide resolved

AnnaShaleva force-pushed the notary-contract branch from 6647a4f to 516ca30 Compare March 6, 2025 15:56

AnnaShaleva added 2 commits March 6, 2025 19:02

Notary: don't FAULT execution in case of non-tx verification container

af09772

Return `false` in case if execution container for `verify` is not a transaction. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

Merge branch 'master' into notary-contract

30521fa

AnnaShaleva requested review from shargon and Wi1l-B0t March 6, 2025 16:07

Merge branch 'master' into notary-contract

8c57a7f

Wi1l-B0t reviewed Mar 11, 2025

View reviewed changes

cschuchardt88 and others added 2 commits March 10, 2025 21:11

Merge branch 'master' into notary-contract

59520ca

Notary: unify deposit lock validity check

61e2bbe

No functional changes, just a refactoring. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>

AnnaShaleva requested a review from Wi1l-B0t March 11, 2025 16:39

Merge branch 'master' into notary-contract

eba8f98

		Transaction tx = (Transaction)engine.ScriptContainer;
		if (tx.GetAttribute<NotaryAssisted>() is null) return false;

		var additionalParams = (Array)data;
		if (additionalParams.Count() != 2) throw new FormatException("`data` parameter should be an array of 2 elements");

		if (deposit is null) return false;
		if (till < deposit.Till) return false;

	if (deposit is null) return false;
	if (till < deposit.Till) return false;
	if (deposit is null \|\| till < deposit.Till) return false;

Implement native Notary contract #3178

Are you sure you want to change the base?

Implement native Notary contract #3178

Conversation

AnnaShaleva commented Mar 19, 2024 • edited Loading

Description

Type of change

How Has This Been Tested?

Checklist:

vncoelho commented Mar 19, 2024

roman-khimov commented Mar 19, 2024

dusmart commented Mar 21, 2024

vncoelho left a comment • edited Loading

Choose a reason for hiding this comment

AnnaShaleva commented Mar 21, 2024

vang1ong7ang left a comment

Choose a reason for hiding this comment

roman-khimov commented Mar 26, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cschuchardt88 Mar 6, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cschuchardt88 Mar 6, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Wi1l-B0t Mar 6, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cschuchardt88 Mar 6, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cschuchardt88 Mar 6, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

AnnaShaleva commented Mar 11, 2025

AnnaShaleva commented Mar 19, 2024 •

edited

Loading

vncoelho left a comment •

edited

Loading

cschuchardt88 Mar 6, 2025 •

edited

Loading

cschuchardt88 Mar 6, 2025 •

edited

Loading

Wi1l-B0t Mar 6, 2025 •

edited

Loading

cschuchardt88 Mar 6, 2025 •

edited

Loading

cschuchardt88 Mar 6, 2025 •

edited

Loading