Conversation
shamil-gadelshin
added
the
skip-cargo-audit
| /// Storage map for encrypted extrinsics to be executed in on_initialize. | ||
| /// Uses u32 index for O(1) insertion and removal. | ||
| #[pallet::storage] | ||
| pub type PendingExtrinsics<T: Config> = | ||
| StorageMap<_, Identity, u32, PendingExtrinsic<T>, OptionQuery>; |
There was a problem hiding this comment.
This is maybe one of the rare case where we could use a CountedStorageMap
| /// Maximum size of a single encoded call. | ||
| pub type MaxCallSize = ConstU32<8192>; |
There was a problem hiding this comment.
I'm not sure if this is the correct naming here because it seems to be the ciphertext, which may be bigger than the actual call, maybe something like MaxCiphertextSize or MaxEncryptedCallSize ?
| fn remove_pending_extrinsic<T: Config>(index: u32, weight: &mut Weight) { | ||
| PendingExtrinsics::<T>::remove(index); | ||
| PendingExtrinsicCount::<T>::mutate(|c| *c = c.saturating_sub(1)); | ||
| *weight = weight.saturating_add(T::DbWeight::get().writes(2)); |
| /// The encoded call data. | ||
| pub call: BoundedVec<u8, MaxCallSize>, |
There was a problem hiding this comment.
Same here, probably more explicit name like encrypted_call?
| let call = match T::ExtrinsicDecryptor::decrypt(&pending.call) { | ||
| Ok(call) => call, | ||
| Err(_) => { | ||
| remove_pending_extrinsic::<T>(index, &mut weight); | ||
|
|
||
| Self::deposit_event(Event::ExtrinsicDecodeFailed { index }); | ||
|
|
||
| continue; | ||
| } | ||
| }; |
| } | ||
|
|
||
| #[test] | ||
| fn on_initialize_handles_dispatch_failure() { |
There was a problem hiding this comment.
test name is on_initialize_handles_dispatch_failure but we check success on multiple calls?
There was a problem hiding this comment.
Overall the design is good. My only concern is that the inner call is never charged for, the user gets free execution for whatever is inside. This could probably be fixed by implementing an additional check when trying to execute the call similar to what the ChargeTransactionPayment extension does and reject it if fee can't be paid, could even be done through a DispatchExtension.
JohnReedV
left a comment
JohnReedV
left a comment
There was a problem hiding this comment.
Looks good to me. Didn't see anything in addition to Loris’s comments.
3 participants
This PR introduces infrastructure for the upcoming MEV Shield V2 feature. The idea is to accumulate encrypted extrinsics in a queue and decrypt them in the next block during the
on_initializephase. Encryption and decryption areoutside the scope of this PR and abstracted via the
ExtrinsicDecryptortrait. Protective limits include encrypted call size (const), queue size, weight for extrinsic execution, and lifetime in the queue.PR features
on_initializehook to process pending encrypted extrinsics with configurable weight limits, extrinsic lifetime, and queue sizestore_encryptedextrinsic for queuing encrypted calls for deferred executionset_max_pending_extrinsics_number,set_on_initialize_weight, andset_stored_extrinsic_lifetimeExtrinsicDecryptortrait for decrypting stored extrinsics before dispatch, with expiration, weight budgeting, and event loggingDetails
New Storage Items
PendingExtrinsics— map of queued encrypted extrinsics awaiting executionNextPendingExtrinsicIndex/PendingExtrinsicCount— auto-increment index and live count for the queueMaxPendingExtrinsicsLimit— configurable max queue depth (default: 100)OnInitializeWeight— configurable max weight budget for on_initialize processing (default: 500B ref_time, capped at 2T)ExtrinsicLifetime— configurable max age in blocks before expiration (default: 10)New Extrinsics
store_encrypted— signed extrinsic to queue an encrypted callset_max_pending_extrinsics_number— root-only, sets queue limitset_on_initialize_weight— root-only, sets weight budget with absolute max guardset_stored_extrinsic_lifetime— root-only, sets expiration windowProcessing Logic (
on_initialize)Iterates pending extrinsics in insertion order. For each entry:
ExtrinsicExpiredis emittedExtrinsicDecodeFailedis emittedExtrinsicPostponed)Other Changes
RuntimeCallandExtrinsicDecryptorassociated types to pallet_shield::ConfigT::RuntimeCallincheck_mortality.rsto resolve ambiguity betweenframe_system::Configandpallet_shield::ConfigUnit Test Plan
store_encrypted(success, queue full, event emission)set_max_pending_extrinsics_number(root-only, value persistence)set_on_initialize_weight(root-only, absolute max rejection)set_stored_extrinsic_lifetime(root-only, value persistence)on_initializeprocessing (dispatch, expiration, weight limits, decode failures)Benchmarks
To be added after the initial review.