fix(chain-worker): validate canonical ASM manifests before execution

Author: storopoli

bin/strata/src/fcm.rs

@@ -100,6 +100,19 @@ impl ChainController for StrataFcmContext {
                 warn!(%block, %err, "deferring block after local worker failure");
                 Ok(BlockExecutionOutcome::Deferred(ExecutionDeferral::Storage))
             }
+            Err(WorkerError::ManifestPending { height, reason }) => {
+                debug!(%block, height, ?reason, "deferring unvalidated ASM manifest");
+                Ok(BlockExecutionOutcome::Deferred(
+                    ExecutionDeferral::Dependency,
+                ))
+            }
+            Err(WorkerError::ManifestStorage(err)) if is_retryable_database_error(&err) => {
+                warn!(%block, %err, "canonical manifest storage unavailable");
+                Ok(BlockExecutionOutcome::Deferred(ExecutionDeferral::Storage))
+            }
+            Err(err @ WorkerError::ManifestStorage(_)) => Err(err).with_context(|| {
+                format!("cannot validate block {block}: canonical manifest storage failed; repair required")
+            }),
             Err(WorkerError::StfExecution(err)) => {
                 warn!(%block, %err, "rejecting invalid block execution");
                 Ok(BlockExecutionOutcome::Rejected)

crates/chain-worker/src/context.rs

@@ -14,10 +14,13 @@ use strata_asm_checkpoint_types::CheckpointPayload;
 use strata_asm_common::AsmManifest;
 use strata_checkpoint_types::EpochSummary;
 use strata_db_types::{
+    DbResult,
     errors::DbError,
     ol_state_index::{AccountUpdateMeta, AccountUpdateRecord, InboxMessageRecord, IndexingWrites},
 };
-use strata_identifiers::{AccountId, Hash, L1BlockCommitment, OLBlockCommitment, OLBlockId};
+use strata_identifiers::{
+    AccountId, Hash, L1BlockCommitment, L1Height, OLBlockCommitment, OLBlockId,
+};
 use strata_msg_fmt::{Msg, MsgRef};
 use strata_node_context::NodeContext;
 use strata_ol_chain_types_v1::{
@@ -86,6 +89,7 @@ pub struct ChainWorkerContextImpl {
 
     /// Runtime parameters for OL STF execution.
     runtime_params: OLRuntimeParams,
+    l1_reorg_safe_depth: u32,
 
     /// Runtime handle
     handle: Handle,
@@ -106,6 +110,7 @@ impl ChainWorkerContextImpl {
             epoch_summary_tx,
             ol_params: nodectx.ol_params().clone(),
             runtime_params: nodectx.ol_params().runtime_params(),
+            l1_reorg_safe_depth: nodectx.config().btcio.l1_reorg_safe_depth,
             handle: nodectx.executor().handle().clone(),
         }
     }
@@ -124,6 +129,26 @@ impl ChainWorkerContextImpl {
 }
 
 impl ChainWorkerContext for ChainWorkerContextImpl {
+    fn l1_reorg_safe_depth(&self) -> u32 {
+        self.l1_reorg_safe_depth
+    }
+
+    fn canonical_l1_tip_height(&self) -> DbResult<Option<L1Height>> {
+        self.l1_block_mgr
+            .get_canonical_chain_tip()
+            .map(|tip| tip.map(|(height, _)| height))
+    }
+
+    fn canonical_manifest(&self, height: L1Height) -> DbResult<Option<AsmManifest>> {
+        let Some(id) = self
+            .l1_block_mgr
+            .get_canonical_blockid_at_height_uncached(height)?
+        else {
+            return Ok(None);
+        };
+        self.l1_block_mgr.get_block_manifest(&id)
+    }
+
     fn runtime_params(&self) -> OLRuntimeParams {
         self.runtime_params
     }

crates/chain-worker/src/errors.rs

@@ -15,9 +15,28 @@ use thiserror::Error;
 /// Return type for worker messages.
 pub type WorkerResult<T> = Result<T, WorkerError>;
 
+/// Explains why canonical ASM provenance cannot yet be established.
+#[derive(Clone, Copy, Debug)]
+pub enum ManifestPendingReason {
+    MissingTip,
+    NotBuried,
+    MissingManifest,
+}
+
 /// Errors that can occur during chain worker operations.
 #[derive(Debug, Error)]
 pub enum WorkerError {
+    /// Canonical L1/ASM data does not yet validate a carried manifest.
+    #[error("ASM manifest at height {height} is pending: {reason:?}")]
+    ManifestPending {
+        height: L1Height,
+        reason: ManifestPendingReason,
+    },
+
+    /// A canonical validation read failed; this is not an invalid block verdict.
+    #[error("failed to read canonical ASM provenance: {0}")]
+    ManifestStorage(#[source] DbError),
+
     /// Block not found in database.
     #[error("missing OL block {0}")]
     MissingOLBlock(OLBlockId),

crates/chain-worker/src/lib.rs

@@ -20,6 +20,7 @@ mod handle;
 mod message;
 mod mmr_prefill;
 mod output;
+mod provenance;
 mod service;
 mod state;
 mod traits;
@@ -28,7 +29,7 @@ mod traits;
 mod tests;
 
 pub use context::ChainWorkerContextImpl;
-pub use errors::{WorkerError, WorkerResult};
+pub use errors::{ManifestPendingReason, WorkerError, WorkerResult};
 pub use handle::ChainWorkerHandle;
 pub use message::ChainWorkerMessage;
 pub use mmr_prefill::{prefill_l1_block_refs_mmr, prefill_l1_block_refs_mmr_blocking};

crates/chain-worker/src/provenance.rs

@@ -0,0 +1,58 @@
+//! Runtime validation of complete ASM manifests against stable canonical L1 history.
+
+use strata_asm_common::AsmManifest;
+use strata_identifiers::L1Height;
+use strata_ol_stf::{ExecError, OLSpecId, validate_manifest_heights};
+
+use crate::{ChainWorkerContext, ManifestPendingReason, WorkerError, WorkerResult};
+
+/// Validates the entire range before the STF can buffer even its first log.
+///
+/// Reorgs beyond the configured L1 depth are unsupported. Restricting reads to the
+/// buried prefix makes the range coherent without trusting cached height mappings.
+pub(crate) fn validate_manifests(
+    ctx: &impl ChainWorkerContext,
+    spec: OLSpecId,
+    last_height: L1Height,
+    manifests: &[AsmManifest],
+) -> WorkerResult<()> {
+    // Validate every height first; a later malformed height is not a missing dependency.
+    validate_manifest_heights(spec, last_height, manifests)?;
+
+    let Some(first) = manifests.first() else {
+        return Ok(());
+    };
+
+    let tip = ctx
+        .canonical_l1_tip_height()
+        .map_err(WorkerError::ManifestStorage)?
+        .ok_or(WorkerError::ManifestPending {
+            height: first.height(),
+            reason: ManifestPendingReason::MissingTip,
+        })?;
+    let buried_tip = tip.checked_sub(ctx.l1_reorg_safe_depth().saturating_sub(1));
+
+    for manifest in manifests {
+        let height = manifest.height();
+        if buried_tip.is_none_or(|tip| height > tip) {
+            return Err(WorkerError::ManifestPending {
+                height,
+                reason: ManifestPendingReason::NotBuried,
+            });
+        }
+
+        let canonical = ctx
+            .canonical_manifest(height)
+            .map_err(WorkerError::ManifestStorage)?
+            .ok_or(WorkerError::ManifestPending {
+                height,
+                reason: ManifestPendingReason::MissingManifest,
+            })?;
+
+        if canonical.compute_hash() != manifest.compute_hash() {
+            return Err(ExecError::AsmManifestContentMismatch { height }.into());
+        }
+    }
+
+    Ok(())
+}

crates/chain-worker/src/state.rs

@@ -37,7 +37,8 @@ use strata_ol_state_types::{
 use strata_ol_state_types_v1::{IStateBatchApplicable, OLStateV1, WriteBatch};
 use strata_ol_stf::{
     BlockInfo, EpochDaReplayError, EpochInfo, EpochSpecSelectionError, OLSpecId, apply_da_epoch,
-    select_next_epoch_spec, verify_block,
+    select_next_epoch_spec, sequencer::verify_block_structure, verify_block,
+    verify_header_continuity,
 };
 use strata_primitives::epoch::EpochCommitment;
 use strata_service::ServiceState;
@@ -48,6 +49,7 @@ use crate::{
     ChainWorkerContextImpl,
     errors::{WorkerError, WorkerResult},
     output::OLBlockExecutionOutput,
+    provenance::validate_manifests,
     traits::ChainWorkerContext,
 };
 
@@ -331,10 +333,44 @@ fn fetch_block_with_parent(
     Ok((block, parent_header, parent_commitment))
 }
 
+/// Validates all block inputs without executing or persisting state.
+fn validate_block_inputs(
+    spec: OLSpecId,
+    ctx: &impl ChainWorkerContext,
+    block: &OLBlockV1,
+    parent_header: Option<&OLBlockHeaderV1>,
+    parent_state: &impl IStateAccessor,
+) -> WorkerResult<()> {
+    verify_header_continuity(spec, block.header(), parent_header)?;
+    verify_block_structure(spec, block.header(), block.body())?;
+    if let Some(container) = block.body().manifests() {
+        validate_manifests(
+            ctx,
+            spec,
+            parent_state.last_l1_height(),
+            container.manifests(),
+        )?;
+    }
+    Ok(())
+}
+
+/// Loads the parent state used by input validation and STF execution, keeping its
+/// spec versions.
+fn fetch_parent_state(
+    ctx: &impl ChainWorkerContext,
+    parent_commitment: OLBlockCommitment,
+) -> WorkerResult<MemoryStateBaseLayer<OLStateV1>> {
+    let parent_state = ctx
+        .fetch_ol_state(parent_commitment)?
+        .ok_or(WorkerError::MissingPreState(parent_commitment))?;
+    Ok(MemoryStateBaseLayer::from_container(parent_state))
+}
+
 /// Executes the STF on a block and returns the execution output.
 ///
 /// This fetches parent state, builds the state stack, runs verification,
 /// and extracts the resulting write batch and indexer writes.
+/// Callers classify failures; pending canonical manifests are expected during L1 catch-up.
 #[instrument(
     skip_all,
     fields(
@@ -344,7 +380,6 @@ fn fetch_block_with_parent(
         is_terminal = block.header().is_terminal(),
         %parent_commitment,
     ),
-    err,
 )]
 fn execute_stf(
     ctx: &impl ChainWorkerContext,
@@ -354,12 +389,8 @@ fn execute_stf(
     parent_header: Option<&OLBlockHeaderV1>,
     parent_commitment: OLBlockCommitment,
 ) -> WorkerResult<(OLBlockExecutionOutput, OLStateContainer)> {
-    // Fetch parent state and build its state accessor, keeping its spec
-    // versions.
-    let parent_state_raw = ctx
-        .fetch_ol_state(parent_commitment)?
-        .ok_or(WorkerError::MissingPreState(parent_commitment))?;
-    let parent_state = MemoryStateBaseLayer::from_container(parent_state_raw);
+    let parent_state = fetch_parent_state(ctx, parent_commitment)?;
+    validate_block_inputs(spec, ctx, block, parent_header, &parent_state)?;
 
     // Execute and extract outputs
     let (write_batch, indexer_writes, logs) =

crates/chain-worker/src/tests/apply_checkpoint.rs

@@ -29,8 +29,9 @@ use strata_asm_checkpoint_types::{
 use strata_asm_common::AsmManifest;
 use strata_checkpoint_types::EpochSummary;
 use strata_codec::encode_to_vec;
+use strata_db_types::DbResult;
 use strata_identifiers::{
-    BRIDGE_GATEWAY_ACCT_SERIAL, Buf32, Epoch, EpochCommitment, L1BlockCommitment,
+    BRIDGE_GATEWAY_ACCT_SERIAL, Buf32, Epoch, EpochCommitment, L1BlockCommitment, L1Height,
     OLBlockCommitment, OLBlockId,
 };
 use strata_ol_chain_types_v1::{
@@ -82,6 +83,16 @@ impl MockChainWorkerContext {
 }
 
 impl ChainWorkerContext for MockChainWorkerContext {
+    fn l1_reorg_safe_depth(&self) -> u32 {
+        1
+    }
+    fn canonical_l1_tip_height(&self) -> DbResult<Option<L1Height>> {
+        Ok(self.manifests.keys().max().copied())
+    }
+    fn canonical_manifest(&self, height: L1Height) -> DbResult<Option<AsmManifest>> {
+        Ok(self.manifests.get(&height).cloned())
+    }
+
     fn runtime_params(&self) -> OLRuntimeParams {
         self.runtime_params
     }