[Malleability C] hotstuff CertifiedBlock

[UlyanaAndrukhiv]

Problem description

CertifiedBlock is a Block with an acquired quorum. ID() implementation is wrong as it doesn't cover the quorum certificate, a byzantine consensus node can change the QC without being noticed by other nodes. The usage of this data structure should be reviewed to be proven safe.

flow-go/consensus/hotstuff/model/block.go

Lines 10 to 19 in edf27b0

	// Block is the HotStuff algorithm's concept of a block, which - in the bigger picture - corresponds
	// to the block header.
	type Block struct {
	View uint64
	BlockID flow.Identifier
	ProposerID flow.Identifier
	QC *flow.QuorumCertificate
	PayloadHash flow.Identifier
	Timestamp time.Time
	}

flow-go/consensus/hotstuff/model/block.go

Lines 49 to 56 in edf27b0

	// CertifiedBlock holds a certified block, which is a block and a QC that is pointing to
	// the block. A QC is the aggregated form of votes from a supermajority of HotStuff and
	// therefore proves validity of the block. A certified block satisfies:
	// Block.View == QC.View and Block.BlockID == QC.BlockID
	type CertifiedBlock struct {
	Block *Block
	CertifyingQC *flow.QuorumCertificate
	}

flow-go/consensus/hotstuff/model/block.go

Lines 72 to 76 in edf27b0

	// ID returns unique identifier for the block.
	// To avoid repeated computation, we use value from the QC.
	func (b *CertifiedBlock) ID() flow.Identifier {
	return b.Block.BlockID
	}

flow-go/model/flow/quorum_certificate.go

Lines 3 to 23 in edf27b0

	// QuorumCertificate represents a quorum certificate for a block proposal as defined in the HotStuff algorithm.
	// A quorum certificate is a collection of votes for a particular block proposal. Valid quorum certificates contain
	// signatures from a super-majority of consensus committee members.
	type QuorumCertificate struct {
	View uint64
	BlockID Identifier
	// SignerIndices encodes the HotStuff participants whose vote is included in this QC.
	// For `n` authorized consensus nodes, `SignerIndices` is an n-bit vector (padded with tailing
	// zeros to reach full bytes). We list the nodes in their canonical order, as defined by the protocol.
	SignerIndices []byte
	// For consensus cluster, the SigData is a serialization of the following fields
	// - SigType []byte, bit-vector indicating the type of sig produced by the signer.
	// - AggregatedStakingSig []byte
	// - AggregatedRandomBeaconSig []byte
	// - ReconstructedRandomBeaconSig crypto.Signature
	// For collector cluster HotStuff, SigData is simply the aggregated staking signatures
	// from all signers.
	SigData []byte
	}

Proposed solution

Change implementation of ID() so that it hashes the quorum certificate too