-
Notifications
You must be signed in to change notification settings - Fork 2.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(tee): add error handling for unstable_getTeeProofs API endpoint #3321
Conversation
6793a52
to
c6c92f2
Compare
b8a9b51
to
41ce9d0
Compare
I get that exposing the zksync-era/core/node/api_server/src/web3/namespaces/unstable.rs Lines 39 to 68 in 41ce9d0
|
ece164e
to
7a534c8
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Regarding the status
field: I don't think this is a large concern as long as the corresponding RPC method is unstable.
This PR adds more information to the response of the `unstable_getTeeProofs` API endpoint, enabling the [client][1] that sent the [request][2] to determine whether it makes sense to retry fetching the TEE proof for a particular batch number. Currently, the [TEE verifier][1] – the tool for continuous SGX attestation and batch signature verification – is [stuck][3] on batches that failed to be proven and are marked as `permanently_ignored`. The tool should be able to distinguish between batches that are permanently ignored (and should be skipped) and batches that have failed but will be retried. This PR enables that distinction. Example use cases: - requesting TEE proof for a batch with the `permanently_ignored` status ``` $ curl -i -X POST -H "Content-Type: application/json" --data '{"jsonrpc": "2.0", "id": 1, "method": "unstable_getTeeProofs", "params": [14, "sgx"] }' 'http://localhost:3152' HTTP/1.1 200 OK content-type: application/json; charset=utf-8 vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: * content-length: 207 date: Tue, 26 Nov 2024 12:42:48 GMT {"jsonrpc":"2.0","result":[{"l1BatchNumber":14,"teeType":"sgx","pubkey":null,"signature":null,"proof":null,"provedAt":"2024-11-20T15:43:46.112146Z","status":"permanently_ignored","attestation":null}],"id":1} ``` - requesting TEE proof for a batch with the `failed` status ``` $ curl -i -X POST -H "Content-Type: application/json" --data '{"jsonrpc": "2.0", "id": 1, "method": "unstable_getTeeProofs", "params": [15, "sgx"] }' 'http://localhost:3152' HTTP/1.1 200 OK content-type: application/json; charset=utf-8 vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: * content-length: 194 date: Tue, 26 Nov 2024 12:44:19 GMT {"jsonrpc":"2.0","result":[{"l1BatchNumber":15,"teeType":"sgx","pubkey":null,"signature":null,"proof":null,"provedAt":"2024-11-20T15:43:46.121432Z","status":"failed","attestation":null}],"id":1} ``` - requesting TEE proof for a batch with the `generated` status ``` $ curl -i -X POST -H "Content-Type: application/json" --data '{"jsonrpc": "2.0", "id": 1, "method": "unstable_getTeeProofs", "params": [28, "sgx"] }' 'http://localhost:3152' HTTP/1.1 200 OK content-type: application/json; charset=utf-8 vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: * content-length: 229 date: Tue, 26 Nov 2024 12:45:27 GMT {"jsonrpc":"2.0","result":[{"l1BatchNumber":28,"teeType":"sgx","pubkey":"0506070809","signature":"0001020304","proof":"1011121314","provedAt":"2024-11-20T15:21:16.129128Z","status":"generated","attestation":"0403020100"}],"id":1} ``` - requesting TEE proof for a non-existent batch ``` $ curl -i -X POST -H "Content-Type: application/json" --data '{"jsonrpc": "2.0", "id": 1, "method": "unstable_getTeeProofs", "params": [1337, "sgx"] }' 'http://localhost:3152' HTTP/1.1 200 OK content-type: application/json; charset=utf-8 vary: origin, access-control-request-method, access-control-request-headers access-control-allow-origin: * content-length: 36 date: Tue, 26 Nov 2024 12:46:08 GMT {"jsonrpc":"2.0","result":[],"id":1} ``` Relevant database entries for the use cases mentioned above: ``` zksync_server_localhost_legacy=# SELECT * FROM tee_proof_generation_details WHERE l1_batch_number IN (14, 15, 28, 1337); l1_batch_number | status | signature | pubkey | proof | tee_type | created_at | updated_at | prover_taken_at -----------------+---------------------+--------------+--------------+--------------+----------+----------------------------+----------------------------+---------------------------- 14 | permanently_ignored | | | | sgx | 2023-11-20 15:27:47.281293 | 2024-11-20 15:43:46.112146 | 2024-11-20 15:43:46.106042 15 | failed | | | | sgx | 2024-11-20 15:27:47.287777 | 2024-11-20 15:43:46.121432 | 2024-11-20 15:43:46.115853 28 | generated | \x0001020304 | \x0506070809 | \x1011121314 | sgx | 2024-11-20 12:56:33.055642 | 2024-11-20 15:21:16.129128 | 2024-11-20 14:53:14.25949 (3 rows) ``` [1]: https://github.com/matter-labs/teepot/blob/main/bin/verify-era-proof-attestation/src/main.rs [2]: https://github.com/matter-labs/teepot/blob/1a8a9f17fa7284f83c41a63d37fe380aef6d550d/bin/verify-era-proof-attestation/src/proof.rs#L15-L21 [3]: https://grafana.matterlabs.dev/goto/unFqf57Hg?orgId=1
4ca5a10
to
facb415
Compare
Currently, the [TEE verifier][1] – the tool for continuous SGX attestation and batch signature verification – is [stuck][2] on batches that failed to be proven and are marked as `permanently_ignored`. The tool should be able to distinguish between batches that are permanently ignored (and should be skipped) and batches that have failed but will be retried. This PR enables that distinction. This commit goes hand in hand with the following PR: matter-labs/zksync-era#3321 [1]: https://github.com/matter-labs/teepot/blob/main/bin/verify-era-proof-attestation/src/main.rs [2]: https://grafana.matterlabs.dev/goto/unFqf57Hg?orgId=1
Currently, the [TEE verifier][1] – the tool for continuous SGX attestation and batch signature verification – is [stuck][2] on batches that failed to be proven and are marked as `permanently_ignored`. The tool should be able to distinguish between batches that are permanently ignored (and should be skipped) and batches that have failed but will be retried. This PR enables that distinction. This commit goes hand in hand with the following PR: matter-labs/zksync-era#3321 [1]: https://github.com/matter-labs/teepot/blob/main/bin/verify-era-proof-attestation/src/main.rs [2]: https://grafana.matterlabs.dev/goto/unFqf57Hg?orgId=1
Currently, the [TEE verifier][1] – the tool for continuous SGX attestation and batch signature verification – is [stuck][2] on batches that failed to be proven and are marked as `permanently_ignored`. The tool should be able to distinguish between batches that are permanently ignored (and should be skipped) and batches that have failed but will be retried. This PR enables that distinction. This commit goes hand in hand with the following PR: matter-labs/zksync-era#3321 [1]: https://github.com/matter-labs/teepot/blob/main/bin/verify-era-proof-attestation/src/main.rs [2]: https://grafana.matterlabs.dev/goto/unFqf57Hg?orgId=1
JFYI: this commit goes hand in hand with the following PR: matter-labs/teepot#221 (feel free to review it). @haraldh pls review/merge when you get a chance. Thanks! |
🤖 I have created a release *beep* *boop* --- ## [25.3.0](core-v25.2.0...core-v25.3.0) (2024-12-11) ### Features * change seal criteria for gateway ([#3320](#3320)) ([a0a74aa](a0a74aa)) * **contract-verifier:** Download compilers from GH automatically ([#3291](#3291)) ([a10c4ba](a10c4ba)) * integrate gateway changes for some components ([#3274](#3274)) ([cbc91e3](cbc91e3)) * **proof-data-handler:** exclude batches without object file in GCS ([#2980](#2980)) ([3e309e0](3e309e0)) * **pruning:** Record L1 batch root hash in pruning logs ([#3266](#3266)) ([7b6e590](7b6e590)) * **state-keeper:** mempool io opens batch if there is protocol upgrade tx ([#3360](#3360)) ([f6422cd](f6422cd)) * **tee:** add error handling for unstable_getTeeProofs API endpoint ([#3321](#3321)) ([26f630c](26f630c)) * **zksync_cli:** Health checkpoint improvements ([#3193](#3193)) ([440fe8d](440fe8d)) ### Bug Fixes * **api:** batch fee input scaling for `debug_traceCall` ([#3344](#3344)) ([7ace594](7ace594)) * **tee:** correct previous fix for race condition in batch locking ([#3358](#3358)) ([b12da8d](b12da8d)) * **tee:** fix race condition in batch locking ([#3342](#3342)) ([a7dc0ed](a7dc0ed)) * **tracer:** adds vm error to flatCallTracer error field if exists ([#3374](#3374)) ([5d77727](5d77727)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: zksync-era-bot <[email protected]>
…vars (#371) * feat(state-keeper): mempool io opens batch if there is protocol upgrade tx (matter-labs#3360) ## What ❔ Mempool io opens batch if there is protocol upgrade tx ## Why ❔ Currently if mempool is empty but there is protocol upgrade tx, then batch is not opened ## Checklist <!-- Check your PR fulfills the following items. --> <!-- For draft PRs check the boxes as you complete them. --> - [ ] PR title corresponds to the body of PR (we generate changelog entries from PRs). - [ ] Tests for the changes have been added / updated. - [ ] Documentation comments have been added / updated. - [ ] Code has been formatted via `zkstack dev fmt` and `zkstack dev lint`. * fix: Fixed cargo deny (matter-labs#3372) ## What ❔ Fixes cargo deny CI fail. * docs: interop docs update (matter-labs#3366) ## What ❔ <!-- What are the changes this PR brings about? --> <!-- Example: This PR adds a PR template to the repo. --> <!-- (For bigger PRs adding more context is appreciated) --> ## Why ❔ <!-- Why are these changes done? What goal do they contribute to? What are the principles behind them? --> <!-- Example: PR templates ensure PR reviewers, observers, and future iterators are in context about the evolution of repos. --> ## Checklist <!-- Check your PR fulfills the following items. --> <!-- For draft PRs check the boxes as you complete them. --> - [ ] PR title corresponds to the body of PR (we generate changelog entries from PRs). - [ ] Tests for the changes have been added / updated. - [ ] Documentation comments have been added / updated. - [ ] Code has been formatted via `zkstack dev fmt` and `zkstack dev lint`. * fix(tracer): adds vm error to flatCallTracer error field if exists (matter-labs#3374) ## What ❔ <!-- What are the changes this PR brings about? --> <!-- Example: This PR adds a PR template to the repo. --> <!-- (For bigger PRs adding more context is appreciated) --> - Updates `flatCallTracer` error to include vm error if it exists ## Why ❔ <!-- Why are these changes done? What goal do they contribute to? What are the principles behind them? --> <!-- Example: PR templates ensure PR reviewers, observers, and future iterators are in context about the evolution of repos. --> - MM has requested that if an error exists we should populate within `flatCallTracer` as this is what others do, prior to this PR it was only revert_reason introduced here: matter-labs#3306. However, if we have a vm error the error field is not populated as seen in this tx: `0x6c85bf34666dcdaa885f2bc6e95186029d2b25f2a3bbdff21c36878e2d4a19ed` which failed due to a vm panic. ## Checklist <!-- Check your PR fulfills the following items. --> <!-- For draft PRs check the boxes as you complete them. --> - [x] PR title corresponds to the body of PR (we generate changelog entries from PRs). - [ ] Tests for the changes have been added / updated. - [x] Documentation comments have been added / updated. - [x] Code has been formatted via `zkstack dev fmt` and `zkstack dev lint`. * chore(main): release core 25.3.0 (matter-labs#3313) :robot: I have created a release *beep* *boop* --- ## [25.3.0](matter-labs/zksync-era@core-v25.2.0...core-v25.3.0) (2024-12-11) ### Features * change seal criteria for gateway ([matter-labs#3320](matter-labs#3320)) ([a0a74aa](matter-labs@a0a74aa)) * **contract-verifier:** Download compilers from GH automatically ([matter-labs#3291](matter-labs#3291)) ([a10c4ba](matter-labs@a10c4ba)) * integrate gateway changes for some components ([matter-labs#3274](matter-labs#3274)) ([cbc91e3](matter-labs@cbc91e3)) * **proof-data-handler:** exclude batches without object file in GCS ([matter-labs#2980](matter-labs#2980)) ([3e309e0](matter-labs@3e309e0)) * **pruning:** Record L1 batch root hash in pruning logs ([matter-labs#3266](matter-labs#3266)) ([7b6e590](matter-labs@7b6e590)) * **state-keeper:** mempool io opens batch if there is protocol upgrade tx ([matter-labs#3360](matter-labs#3360)) ([f6422cd](matter-labs@f6422cd)) * **tee:** add error handling for unstable_getTeeProofs API endpoint ([matter-labs#3321](matter-labs#3321)) ([26f630c](matter-labs@26f630c)) * **zksync_cli:** Health checkpoint improvements ([matter-labs#3193](matter-labs#3193)) ([440fe8d](matter-labs@440fe8d)) ### Bug Fixes * **api:** batch fee input scaling for `debug_traceCall` ([matter-labs#3344](matter-labs#3344)) ([7ace594](matter-labs@7ace594)) * **tee:** correct previous fix for race condition in batch locking ([matter-labs#3358](matter-labs#3358)) ([b12da8d](matter-labs@b12da8d)) * **tee:** fix race condition in batch locking ([matter-labs#3342](matter-labs#3342)) ([a7dc0ed](matter-labs@a7dc0ed)) * **tracer:** adds vm error to flatCallTracer error field if exists ([matter-labs#3374](matter-labs#3374)) ([5d77727](matter-labs@5d77727)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: zksync-era-bot <[email protected]> * feat(eigen-client-extra-features): Fix PR comments (#369) * Add envy load * Readd proto reference * Rename blob id to request id * Make literals constants * Make point size constant * Get pool unique * Remaining comments * Fix comment * Add check for failed states * Change l1 name * Cargo lock conflicts * remove concurrent dispatcher leftovers * Solve comments (#372) * remove METRICS var * feat(eigen-client-extra-features): address PR comments (#375) * Change settlement layer for u32 * Change string to address * Remove unwraps * Remove error from name * Remove unused to bytes * Rename call for get blob data * Revert "Change string to address" This reverts commit 6dd94d4. * Change string for address * feat(eigen-client-extra-features): address PR comments (part 2) (#374) * initial commit * clippy suggestion * feat(eigen-client-extra-features): address PR comments (part 3) (#376) * use keccak256 fn * simplify get_context_block * use saturating sub * feat(eigen-client-extra-features): address PR comments (part 4) (#378) * Replace decode bytes for ethabi * Add default to eigenconfig * Change str to url * Add index to data availability table * Address comments * Change error to verificationerror * Format code * feat(eigen-client-extra-features): address PR comments (part 5) (#377) * use trait object * prevent blocking non async code * clippy suggestion --------- Co-authored-by: juan518munoz <[email protected]> --------- Co-authored-by: Gianbelinche <[email protected]> --------- Co-authored-by: Gianbelinche <[email protected]> * Format code --------- Co-authored-by: juan518munoz <[email protected]> --------- Co-authored-by: perekopskiy <[email protected]> Co-authored-by: Bruno França <[email protected]> Co-authored-by: kelemeno <[email protected]> Co-authored-by: Dustin Brickwood <[email protected]> Co-authored-by: zksync-era-bot <[email protected]> Co-authored-by: zksync-era-bot <[email protected]> Co-authored-by: Gianbelinche <[email protected]>
* feat(state-keeper): mempool io opens batch if there is protocol upgrade tx (matter-labs#3360) ## What ❔ Mempool io opens batch if there is protocol upgrade tx ## Why ❔ Currently if mempool is empty but there is protocol upgrade tx, then batch is not opened ## Checklist <!-- Check your PR fulfills the following items. --> <!-- For draft PRs check the boxes as you complete them. --> - [ ] PR title corresponds to the body of PR (we generate changelog entries from PRs). - [ ] Tests for the changes have been added / updated. - [ ] Documentation comments have been added / updated. - [ ] Code has been formatted via `zkstack dev fmt` and `zkstack dev lint`. * fix: Fixed cargo deny (matter-labs#3372) ## What ❔ Fixes cargo deny CI fail. * docs: interop docs update (matter-labs#3366) ## What ❔ <!-- What are the changes this PR brings about? --> <!-- Example: This PR adds a PR template to the repo. --> <!-- (For bigger PRs adding more context is appreciated) --> ## Why ❔ <!-- Why are these changes done? What goal do they contribute to? What are the principles behind them? --> <!-- Example: PR templates ensure PR reviewers, observers, and future iterators are in context about the evolution of repos. --> ## Checklist <!-- Check your PR fulfills the following items. --> <!-- For draft PRs check the boxes as you complete them. --> - [ ] PR title corresponds to the body of PR (we generate changelog entries from PRs). - [ ] Tests for the changes have been added / updated. - [ ] Documentation comments have been added / updated. - [ ] Code has been formatted via `zkstack dev fmt` and `zkstack dev lint`. * fix(tracer): adds vm error to flatCallTracer error field if exists (matter-labs#3374) ## What ❔ <!-- What are the changes this PR brings about? --> <!-- Example: This PR adds a PR template to the repo. --> <!-- (For bigger PRs adding more context is appreciated) --> - Updates `flatCallTracer` error to include vm error if it exists ## Why ❔ <!-- Why are these changes done? What goal do they contribute to? What are the principles behind them? --> <!-- Example: PR templates ensure PR reviewers, observers, and future iterators are in context about the evolution of repos. --> - MM has requested that if an error exists we should populate within `flatCallTracer` as this is what others do, prior to this PR it was only revert_reason introduced here: matter-labs#3306. However, if we have a vm error the error field is not populated as seen in this tx: `0x6c85bf34666dcdaa885f2bc6e95186029d2b25f2a3bbdff21c36878e2d4a19ed` which failed due to a vm panic. ## Checklist <!-- Check your PR fulfills the following items. --> <!-- For draft PRs check the boxes as you complete them. --> - [x] PR title corresponds to the body of PR (we generate changelog entries from PRs). - [ ] Tests for the changes have been added / updated. - [x] Documentation comments have been added / updated. - [x] Code has been formatted via `zkstack dev fmt` and `zkstack dev lint`. * chore(main): release core 25.3.0 (matter-labs#3313) :robot: I have created a release *beep* *boop* --- ## [25.3.0](matter-labs/zksync-era@core-v25.2.0...core-v25.3.0) (2024-12-11) ### Features * change seal criteria for gateway ([matter-labs#3320](matter-labs#3320)) ([a0a74aa](matter-labs@a0a74aa)) * **contract-verifier:** Download compilers from GH automatically ([matter-labs#3291](matter-labs#3291)) ([a10c4ba](matter-labs@a10c4ba)) * integrate gateway changes for some components ([matter-labs#3274](matter-labs#3274)) ([cbc91e3](matter-labs@cbc91e3)) * **proof-data-handler:** exclude batches without object file in GCS ([matter-labs#2980](matter-labs#2980)) ([3e309e0](matter-labs@3e309e0)) * **pruning:** Record L1 batch root hash in pruning logs ([matter-labs#3266](matter-labs#3266)) ([7b6e590](matter-labs@7b6e590)) * **state-keeper:** mempool io opens batch if there is protocol upgrade tx ([matter-labs#3360](matter-labs#3360)) ([f6422cd](matter-labs@f6422cd)) * **tee:** add error handling for unstable_getTeeProofs API endpoint ([matter-labs#3321](matter-labs#3321)) ([26f630c](matter-labs@26f630c)) * **zksync_cli:** Health checkpoint improvements ([matter-labs#3193](matter-labs#3193)) ([440fe8d](matter-labs@440fe8d)) ### Bug Fixes * **api:** batch fee input scaling for `debug_traceCall` ([matter-labs#3344](matter-labs#3344)) ([7ace594](matter-labs@7ace594)) * **tee:** correct previous fix for race condition in batch locking ([matter-labs#3358](matter-labs#3358)) ([b12da8d](matter-labs@b12da8d)) * **tee:** fix race condition in batch locking ([matter-labs#3342](matter-labs#3342)) ([a7dc0ed](matter-labs@a7dc0ed)) * **tracer:** adds vm error to flatCallTracer error field if exists ([matter-labs#3374](matter-labs#3374)) ([5d77727](matter-labs@5d77727)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: zksync-era-bot <[email protected]> * feat(eigen-client-extra-features): Fix PR comments (#369) * Add envy load * Readd proto reference * Rename blob id to request id * Make literals constants * Make point size constant * Get pool unique * Remaining comments * Fix comment * Add check for failed states * Change l1 name * Cargo lock conflicts * remove concurrent dispatcher leftovers * Solve comments (#372) * Remove eigen client for external crate * Add real repo * remove METRICS var * Change proxy name and remove generic * feat(eigen-client-extra-features): address PR comments (#375) * Change settlement layer for u32 * Change string to address * Remove unwraps * Remove error from name * Remove unused to bytes * Rename call for get blob data * Revert "Change string to address" This reverts commit 6dd94d4. * Change string for address * feat(eigen-client-extra-features): address PR comments (part 2) (#374) * initial commit * clippy suggestion * feat(eigen-client-extra-features): address PR comments (part 3) (#376) * use keccak256 fn * simplify get_context_block * use saturating sub * feat(eigen-client-extra-features): address PR comments (part 4) (#378) * Replace decode bytes for ethabi * Add default to eigenconfig * Change str to url * Add index to data availability table * Address comments * Change error to verificationerror * Format code * feat(eigen-client-extra-features): address PR comments (part 5) (#377) * use trait object * prevent blocking non async code * clippy suggestion --------- Co-authored-by: juan518munoz <[email protected]> --------- Co-authored-by: Gianbelinche <[email protected]> --------- Co-authored-by: Gianbelinche <[email protected]> * Format code --------- Co-authored-by: juan518munoz <[email protected]> * Fix compilation * Update branch --------- Co-authored-by: perekopskiy <[email protected]> Co-authored-by: Bruno França <[email protected]> Co-authored-by: kelemeno <[email protected]> Co-authored-by: Dustin Brickwood <[email protected]> Co-authored-by: zksync-era-bot <[email protected]> Co-authored-by: zksync-era-bot <[email protected]> Co-authored-by: Juan Munoz <[email protected]> Co-authored-by: juan518munoz <[email protected]>
What ❔
This PR adds more information to the response of the
unstable_getTeeProofs
API endpoint, enabling the client that sent the request to determine whether it makes sense to retry fetching the TEE proof for a particular batch number.Why ❔
Currently, the TEE verifier – the tool for continuous SGX attestation and batch signature verification – is stuck on batches that failed to be proven and are marked as
permanently_ignored
. The tool should be able to distinguish between batches that are permanently ignored (and should be skipped) and batches that have failed but will be retried. This PR enables that distinction.Example use cases:
permanently_ignored
statusfailed
statusgenerated
statusRelevant database entries for the use cases mentioned above:
Checklist
zkstack dev fmt
andzkstack dev lint
.