[ON HOLD] Reject solution containing outside-of-auction order

crates/autopilot/src/domain/settlement/mod.rs

@@ -32,6 +32,10 @@ impl Settlement {
     /// id.
     const META_DATA_LEN: usize = 8;
 
+    pub fn order_uids(&self) -> impl Iterator<Item = &order::OrderUid> {
+        self.trades.iter().map(|trade| trade.order_uid())
+    }
+
     pub fn native_surplus(&self, prices: &auction::Prices) -> Result<eth::Ether, trade::Error> {
         self.trades
             .iter()

crates/autopilot/src/domain/settlement/trade.rs

@@ -43,6 +43,10 @@ impl Trade {
         }
     }
 
+    pub fn order_uid(&self) -> &domain::OrderUid {
+        &self.order_uid
+    }
+
     /// CIP38 score defined as surplus + protocol fee
     ///
     /// Denominated in NATIVE token

crates/autopilot/src/infra/persistence/mod.rs

@@ -6,6 +6,7 @@ use {
     },
     anyhow::Context,
     chrono::Utc,
+    database::byte_array::ByteArray,
     number::conversions::big_decimal_to_u256,
     primitive_types::H256,
     std::{collections::HashMap, sync::Arc},
@@ -167,6 +168,34 @@ impl Persistence {
 
         Ok(prices)
     }
+
+    /// Returns true if none of the given orders exist in the database.
+    pub async fn orders_do_not_exist(
+        &self,
+        order_uids: &[domain::OrderUid],
+    ) -> Result<bool, Error> {
+        let mut ex = self
+            .postgres
+            .pool
+            .begin()
+            .await
+            .context("begin")
+            .map_err(Error::DbError)?;
+
+        let order_exist = database::orders::orders_do_not_exist(
+            &mut ex,
+            order_uids
+                .iter()
+                .map(|uid| ByteArray(uid.0))
+                .collect::<Vec<_>>()
+                .as_slice(),
+        )
+        .await
+        .context("fetch")
+        .map_err(Error::DbError)?;
+
+        Ok(order_exist)
+    }
 }
 
 #[derive(Debug, thiserror::Error)]

crates/autopilot/src/run_loop.rs

@@ -1,7 +1,7 @@
 use {
     crate::{
         database::competition::Competition,
-        domain::{self, auction::order::Class, OrderUid},
+        domain::{self, auction::order::Class, settlement::Settlement, OrderUid},
         infra::{
             self,
             solvers::dto::{reveal, settle, solve},
@@ -141,6 +141,23 @@ impl RunLoop {
                 }
             };
 
+            // validate solution
+            let settlement = match Settlement::new(
+                &revealed.calldata.internalized.clone().into(),
+                self.eth.contracts().settlement_domain_separator(),
+            ) {
+                Ok(settlement) => settlement,
+                Err(err) => {
+                    tracing::error!(driver = %driver.name, ?err, "unexpected calldata format");
+                    return;
+                }
+            };
+
+            if !self.validate_settlement(&auction, &settlement).await {
+                tracing::error!(driver = %driver.name, "invalid settlement");
+                return;
+            }
+
             let order_uids = solution.order_ids().copied().collect();
             self.persistence
                 .store_order_events(order_uids, OrderEventLabel::Considered);
@@ -348,6 +365,32 @@ impl RunLoop {
         .collect()
     }
 
+    /// Settlement is allowed to contain orders that are part of the Auction or
+    /// JIT orders.
+    async fn validate_settlement(
+        &self,
+        auction: &domain::Auction,
+        settlement: &Settlement,
+    ) -> bool {
+        let auction_orders = auction.orders.iter().map(|o| o.uid).collect::<HashSet<_>>();
+
+        // all JIT orders will be non_auction_orders
+        let non_auction_orders = settlement
+            .order_uids()
+            .filter(|order| !auction_orders.contains(order))
+            .cloned()
+            .collect::<Vec<_>>();
+
+        // make sure all non-auction orders are also non-database
+        self.persistence
+            .orders_do_not_exist(&non_auction_orders)
+            .await
+            .unwrap_or_else(|err| {
+                tracing::warn!(?err, "failed to check if all orders exist");
+                false
+            })
+    }
+
     /// Computes a driver's solutions for the solver competition.
     async fn solve(
         &self,

crates/database/src/orders.rs

@@ -755,6 +755,27 @@ pub async fn user_orders_with_quote(
         .await
 }
 
+pub async fn orders_do_not_exist(
+    ex: &mut PgConnection,
+    uids: &[OrderUid],
+) -> Result<bool, sqlx::Error> {
+    if uids.is_empty() {
+        return Ok(true);
+    }
+
+    let mut query_builder =
+        QueryBuilder::new("SELECT NOT EXISTS (SELECT 1 FROM orders WHERE uid IN (");
+
+    let mut separated = query_builder.separated(", ");
+    for value_type in uids {
+        separated.push_bind(value_type);
+    }
+    separated.push_unseparated(")) ");
+
+    let query = query_builder.build_query_scalar();
+    query.fetch_one(ex).await
+}
+
 #[cfg(test)]
 mod tests {
     use {
@@ -1891,4 +1912,33 @@ mod tests {
             .unwrap();
         assert_eq!(full_order.full_app_data, Some(full_app_data));
     }
+
+    #[tokio::test]
+    #[ignore]
+    async fn postgres_all_orders_not_exist() {
+        let mut db = PgConnection::connect("postgresql://").await.unwrap();
+        let mut db = db.begin().await.unwrap();
+        crate::clear_DANGER_(&mut db).await.unwrap();
+
+        let order1 = Order {
+            uid: ByteArray([1; 56]),
+            ..Default::default()
+        };
+        let order2 = Order {
+            uid: ByteArray([2; 56]),
+            ..Default::default()
+        };
+
+        assert!(orders_do_not_exist(&mut db, &[order1.uid, order2.uid])
+            .await
+            .unwrap());
+
+        insert_order(&mut db, &order2).await.unwrap();
+
+        assert!(orders_do_not_exist(&mut db, &[order1.uid]).await.unwrap());
+        assert!(!orders_do_not_exist(&mut db, &[order2.uid]).await.unwrap());
+        assert!(!orders_do_not_exist(&mut db, &[order1.uid, order2.uid])
+            .await
+            .unwrap());
+    }
 }