fix(chain-worker): validate canonical ASM manifests before execution

Author: storopoli

bin/strata/src/fcm.rs

@@ -100,6 +100,19 @@ impl ChainController for StrataFcmContext {
                 warn!(%block, %err, "deferring block after local worker failure");
                 Ok(BlockExecutionOutcome::Deferred(ExecutionDeferral::Storage))
             }
+            Err(WorkerError::ManifestPending { height, reason }) => {
+                debug!(%block, height, ?reason, "deferring unvalidated ASM manifest");
+                Ok(BlockExecutionOutcome::Deferred(
+                    ExecutionDeferral::Dependency,
+                ))
+            }
+            Err(WorkerError::ManifestStorage(err)) if is_retryable_database_error(&err) => {
+                warn!(%block, %err, "canonical manifest storage unavailable");
+                Ok(BlockExecutionOutcome::Deferred(ExecutionDeferral::Storage))
+            }
+            Err(err @ WorkerError::ManifestStorage(_)) => Err(err).with_context(|| {
+                format!("cannot validate block {block}: canonical manifest storage failed; repair required")
+            }),
             Err(WorkerError::StfExecution(err)) => {
                 warn!(%block, %err, "rejecting invalid block execution");
                 Ok(BlockExecutionOutcome::Rejected)

crates/chain-worker/src/context.rs

@@ -14,10 +14,11 @@ use strata_asm_checkpoint_types::CheckpointPayload;
 use strata_asm_common::AsmManifest;
 use strata_checkpoint_types::EpochSummary;
 use strata_db_types::{
+    DbResult,
     errors::DbError,
     ol_state_index::{AccountUpdateMeta, AccountUpdateRecord, InboxMessageRecord, IndexingWrites},
 };
-use strata_identifiers::{AccountId, Hash, OLBlockCommitment, OLBlockId};
+use strata_identifiers::{AccountId, Hash, L1Height, OLBlockCommitment, OLBlockId};
 use strata_msg_fmt::{Msg, MsgRef};
 use strata_node_context::NodeContext;
 use strata_ol_chain_types_v1::{
@@ -84,6 +85,7 @@ pub struct ChainWorkerContextImpl {
 
     /// Runtime parameters for OL STF execution.
     runtime_params: OLRuntimeParams,
+    l1_reorg_safe_depth: u32,
 
     /// Runtime handle
     handle: Handle,
@@ -104,6 +106,7 @@ impl ChainWorkerContextImpl {
             epoch_summary_tx,
             ol_params: nodectx.ol_params().clone(),
             runtime_params: nodectx.ol_params().runtime_params(),
+            l1_reorg_safe_depth: nodectx.config().btcio.l1_reorg_safe_depth,
             handle: nodectx.executor().handle().clone(),
         }
     }
@@ -122,6 +125,26 @@ impl ChainWorkerContextImpl {
 }
 
 impl ChainWorkerContext for ChainWorkerContextImpl {
+    fn l1_reorg_safe_depth(&self) -> u32 {
+        self.l1_reorg_safe_depth
+    }
+
+    fn canonical_l1_tip_height(&self) -> DbResult<Option<L1Height>> {
+        self.l1_block_mgr
+            .get_canonical_chain_tip()
+            .map(|tip| tip.map(|(height, _)| height))
+    }
+
+    fn canonical_manifest(&self, height: L1Height) -> DbResult<Option<AsmManifest>> {
+        let Some(id) = self
+            .l1_block_mgr
+            .get_canonical_blockid_at_height_uncached(height)?
+        else {
+            return Ok(None);
+        };
+        self.l1_block_mgr.get_block_manifest(&id)
+    }
+
     fn runtime_params(&self) -> OLRuntimeParams {
         self.runtime_params
     }

crates/chain-worker/src/errors.rs

@@ -3,7 +3,7 @@
 use strata_acct_types::AccountSerial;
 use strata_codec::CodecError;
 use strata_db_types::errors::DbError;
-use strata_identifiers::{AccountId, Buf32, Epoch, OLBlockCommitment, OLBlockId};
+use strata_identifiers::{AccountId, Buf32, Epoch, L1Height, OLBlockCommitment, OLBlockId};
 use strata_ol_state_types::StateError;
 use strata_primitives::epoch::EpochCommitment;
 use strata_snark_acct_types::Seqno;
@@ -12,9 +12,28 @@ use thiserror::Error;
 /// Return type for worker messages.
 pub type WorkerResult<T> = Result<T, WorkerError>;
 
+/// Explains why canonical ASM provenance cannot yet be established.
+#[derive(Clone, Copy, Debug)]
+pub enum ManifestPendingReason {
+    MissingTip,
+    NotBuried,
+    MissingManifest,
+}
+
 /// Errors that can occur during chain worker operations.
 #[derive(Debug, Error)]
 pub enum WorkerError {
+    /// Canonical L1/ASM data does not yet validate a carried manifest.
+    #[error("ASM manifest at height {height} is pending: {reason:?}")]
+    ManifestPending {
+        height: L1Height,
+        reason: ManifestPendingReason,
+    },
+
+    /// A canonical validation read failed; this is not an invalid block verdict.
+    #[error("failed to read canonical ASM provenance: {0}")]
+    ManifestStorage(#[source] DbError),
+
     /// Block not found in database.
     #[error("missing OL block {0}")]
     MissingOLBlock(OLBlockId),

crates/chain-worker/src/lib.rs

@@ -20,6 +20,7 @@ mod handle;
 mod message;
 mod mmr_prefill;
 mod output;
+mod provenance;
 mod service;
 mod state;
 mod traits;
@@ -28,7 +29,7 @@ mod traits;
 mod tests;
 
 pub use context::ChainWorkerContextImpl;
-pub use errors::{WorkerError, WorkerResult};
+pub use errors::{ManifestPendingReason, WorkerError, WorkerResult};
 pub use handle::ChainWorkerHandle;
 pub use message::ChainWorkerMessage;
 pub use mmr_prefill::{prefill_l1_block_refs_mmr, prefill_l1_block_refs_mmr_blocking};

crates/chain-worker/src/provenance.rs

@@ -0,0 +1,57 @@
+//! Runtime validation of complete ASM manifests against stable canonical L1 history.
+
+use strata_asm_common::AsmManifest;
+use strata_identifiers::L1Height;
+use strata_ol_stf_v1::{ExecError, validate_manifest_heights};
+
+use crate::{ChainWorkerContext, ManifestPendingReason, WorkerError, WorkerResult};
+
+/// Validates the entire range before the STF can buffer even its first log.
+///
+/// Reorgs beyond the configured L1 depth are unsupported. Restricting reads to the
+/// buried prefix makes the range coherent without trusting cached height mappings.
+pub(crate) fn validate_manifests(
+    ctx: &impl ChainWorkerContext,
+    last_height: L1Height,
+    manifests: &[AsmManifest],
+) -> WorkerResult<()> {
+    // Validate every height first; a later malformed height is not a missing dependency.
+    validate_manifest_heights(last_height, manifests)?;
+
+    let Some(first) = manifests.first() else {
+        return Ok(());
+    };
+
+    let tip = ctx
+        .canonical_l1_tip_height()
+        .map_err(WorkerError::ManifestStorage)?
+        .ok_or(WorkerError::ManifestPending {
+            height: first.height(),
+            reason: ManifestPendingReason::MissingTip,
+        })?;
+    let buried_tip = tip.checked_sub(ctx.l1_reorg_safe_depth().saturating_sub(1));
+
+    for manifest in manifests {
+        let height = manifest.height();
+        if buried_tip.is_none_or(|tip| height > tip) {
+            return Err(WorkerError::ManifestPending {
+                height,
+                reason: ManifestPendingReason::NotBuried,
+            });
+        }
+
+        let canonical = ctx
+            .canonical_manifest(height)
+            .map_err(WorkerError::ManifestStorage)?
+            .ok_or(WorkerError::ManifestPending {
+                height,
+                reason: ManifestPendingReason::MissingManifest,
+            })?;
+
+        if canonical.compute_hash() != manifest.compute_hash() {
+            return Err(ExecError::AsmManifestContentMismatch { height }.into());
+        }
+    }
+
+    Ok(())
+}

crates/chain-worker/src/state.rs

@@ -35,7 +35,10 @@ use strata_ol_state_types::{
     IAccountState, ISnarkAccountState, IStateAccessor, StateError, StateResult,
 };
 use strata_ol_state_types_v1::{IStateBatchApplicable, OLStateV1, WriteBatch};
-use strata_ol_stf_v1::{BlockInfo, EpochInfo, apply_da_epoch, verify_block};
+use strata_ol_stf_v1::{
+    BlockInfo, EpochInfo, apply_da_epoch, verify_block, verify_block_structure,
+    verify_header_continuity,
+};
 use strata_primitives::{epoch::EpochCommitment, l1::L1BlockCommitment};
 use strata_service::ServiceState;
 use strata_snark_acct_types::Seqno;
@@ -45,6 +48,7 @@ use crate::{
     ChainWorkerContextImpl,
     errors::{WorkerError, WorkerResult},
     output::OLBlockExecutionOutput,
+    provenance::validate_manifests,
     traits::ChainWorkerContext,
 };
 
@@ -324,10 +328,37 @@ fn fetch_block_with_parent(
     Ok((block, parent_header, parent_commitment))
 }
 
+/// Validates all block inputs without executing or persisting state.
+fn validate_block_inputs(
+    ctx: &impl ChainWorkerContext,
+    block: &OLBlockV1,
+    parent_header: Option<&OLBlockHeaderV1>,
+    parent_state: &impl IStateAccessor,
+) -> WorkerResult<()> {
+    verify_header_continuity(block.header(), parent_header)?;
+    verify_block_structure(block.header(), block.body())?;
+    if let Some(container) = block.body().manifests() {
+        validate_manifests(ctx, parent_state.last_l1_height(), container.manifests())?;
+    }
+    Ok(())
+}
+
+/// Loads the parent state used by input validation and STF execution.
+fn fetch_parent_state(
+    ctx: &impl ChainWorkerContext,
+    parent_commitment: OLBlockCommitment,
+) -> WorkerResult<MemoryStateBaseLayer> {
+    let parent_state = ctx
+        .fetch_ol_state(parent_commitment)?
+        .ok_or(WorkerError::MissingPreState(parent_commitment))?;
+    Ok(MemoryStateBaseLayer::new(parent_state))
+}
+
 /// Executes the STF on a block and returns the execution output.
 ///
 /// This fetches parent state, builds the state stack, runs verification,
 /// and extracts the resulting write batch and indexer writes.
+/// Callers classify failures; pending canonical manifests are expected during L1 catch-up.
 #[instrument(
     skip_all,
     fields(
@@ -336,7 +367,6 @@ fn fetch_block_with_parent(
         is_terminal = block.header().is_terminal(),
         %parent_commitment,
     ),
-    err,
 )]
 fn execute_stf(
     ctx: &impl ChainWorkerContext,
@@ -345,11 +375,8 @@ fn execute_stf(
     parent_header: Option<&OLBlockHeaderV1>,
     parent_commitment: OLBlockCommitment,
 ) -> WorkerResult<(OLBlockExecutionOutput, OLStateV1)> {
-    // Fetch parent state and wrap in MemoryStateBaseLayer for IStateAccessor
-    let parent_state_raw = ctx
-        .fetch_ol_state(parent_commitment)?
-        .ok_or(WorkerError::MissingPreState(parent_commitment))?;
-    let parent_state = MemoryStateBaseLayer::new(parent_state_raw);
+    let parent_state = fetch_parent_state(ctx, parent_commitment)?;
+    validate_block_inputs(ctx, block, parent_header, &parent_state)?;
 
     // Execute and extract outputs
     let (write_batch, indexer_writes, logs) =

crates/chain-worker/src/tests/apply_checkpoint.rs

@@ -29,8 +29,10 @@ use strata_asm_checkpoint_types::{
 use strata_asm_common::AsmManifest;
 use strata_checkpoint_types::EpochSummary;
 use strata_codec::encode_to_vec;
+use strata_db_types::DbResult;
 use strata_identifiers::{
-    BRIDGE_GATEWAY_ACCT_SERIAL, Buf32, Epoch, EpochCommitment, OLBlockCommitment, OLBlockId,
+    BRIDGE_GATEWAY_ACCT_SERIAL, Buf32, Epoch, EpochCommitment, L1Height, OLBlockCommitment,
+    OLBlockId,
 };
 use strata_ol_chain_types_v1::{
     MAX_SEALING_MANIFEST_COUNT, OLBlockHeaderV1, OLBlockV1, OLLog as ChainOLLog,
@@ -76,6 +78,16 @@ impl MockChainWorkerContext {
 }
 
 impl ChainWorkerContext for MockChainWorkerContext {
+    fn l1_reorg_safe_depth(&self) -> u32 {
+        1
+    }
+    fn canonical_l1_tip_height(&self) -> DbResult<Option<L1Height>> {
+        Ok(self.manifests.keys().max().copied())
+    }
+    fn canonical_manifest(&self, height: L1Height) -> DbResult<Option<AsmManifest>> {
+        Ok(self.manifests.get(&height).cloned())
+    }
+
     fn runtime_params(&self) -> OLRuntimeParams {
         self.runtime_params
     }