fuellabs / fuel-bft

Tendermint consensus in Rust

fuel-bft

A Tendermint implementation in Rust for Fuel.

fuel-bft's Issues

Find a suitable name for the repo

The implementation won't reflect the strict form of pbft but instead will be based in tendermint.

We have some differences such as the block being proposed after precommit instead of commit and the round being declared as a tuple (height, round) instead of an abstract descriptor.

Having fuel-pbft is misleading because it suggests this is a general model for pbft, when in fact this is one concrete instance of pbft.

As suggestion: fuel-polka

Use associated types

Replace trait type usages such as <<Self as Message>::Keystore as Keystore>::Digest by trait provided types so the code is more readable.

Example:

from

pub trait Message: Sized {
    type Keystore: Keystore;

    fn hash(&self) -> <<Self as Message>::Keystore as Keystore>::Digest;
}

to

pub trait Message: Sized {
    type Keystore: Keystore;
    type Digest = <<Self as Message>::Keystore as Keystore>::Digest;

    fn hash(&self) -> Self::Digest;
}

blocked by: rust-lang/rust#29661

Remove `async_trait` in favor of stdlib

Rust doesn't support async traits as of the moment.

As soon as the feature lands in stable, we should remove async_trait from our implementation in favor of the canonical implementation.

Blocked by: rust-lang/rust#44265

Originally posted by @adlerjohn in #9 (comment)

[spike] Should votes be stake weighted?

cross-reference tendermint go impl

Handle timeouts

I'm fine with merging without that for now. But eventually, this should include some kind of tokio task or executor that drives progress and handles timeouts etc.
(originally posted by @Voxelot)

Consider using `thiserror` for the error types

why not use thiserror?

Originally posted by @Voxelot in #9 (comment)

Define the timeout granularity

This deviates from tendermint-style algorithms and could lead to rounds being arbitrarily skipped. This also doesn't allow for the eventuality guarantees of tendermint:

The timeouts prevent the algorithm from blocking and waiting forever for some condition to be true, ensure that processes continuously transition between rounds, and guarantee that eventually (after GST) communication between correct processes is timely and reliable so they can decide. The last role is achieved by increasing the timeouts with every new round r, i.e,timeoutX(r) = initT imeoutX +r ∗ timeoutDelta; they are reset for every new height (consensus instance).

tendermint paper

Where timeoutX could be timeoutPropose, timeoutPrevote or timeoutPrecommit.

This means we should only increment the round after properly cycling through the appropriate steps and timeouts, rather than just taking the time since the last commit and dividing it by some constant round value. Otherwise, we won't be able to increase the timeout each round.

Additionally, we may want to consider a timeout vote in the future which would allow for ddos-resistant leader selection strategies.

Originally posted by @Voxelot in #9 (comment)

Implement Passive Mode

Listen to votes and follow the consensus for the network to import new blocks. Currently, the consensus mechanism will be idle unless it can vote (the keychain provides round public key).

Update signature primitive to generic model

We might benefit from having generic signature primitives for the consensus votes since the protocol might use validators from external networks

Originally posted by @leviathanbeak in #9 (comment)

Add validator stake to consensus metadata

Since voting power is stake weighted, we need to track validator state in the consensus metadata and use it for determining consensus thresholds.

Implement hotkey rotation

The public key of a validator might change depending on the round.

Originally posted by @adlerjohn in #9 (comment)