Skip to content

fix(consensus): centralize reward bookkeeping in apply path (fork-gated) #782

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
github-actions merged 3 commits into from
Jun 3, 2026
Merged

fix(consensus): centralize reward bookkeeping in apply path (fork-gated) #782

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
30a853f
fix(consensus): centralize reward bookkeeping in apply path (fork-gated)
satyakwok Jun 3, 2026
61d4a2e
fix(consensus): also centralize run_epoch_bookkeeping under the same …
satyakwok Jun 3, 2026
402ce9d
chore: bump 2.2.26 → 2.2.27 + CHANGELOG (reward-apply-path fork)
satyakwok Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,30 @@ This project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

## [2.2.27] — 2026-06-04 — Deterministic per-block bookkeeping (fork-gated)

### Consensus — reward/epoch bookkeeping moved to the apply path

Root cause of the 2026-06-03 testnet 4-way state drift (only
`PROTOCOL_TREASURY` diverged): reward distribution, liveness recording,
epoch accounting, and epoch-boundary rotation/slashing ran in 5 separate
network/finalize receive paths instead of the deterministic block-apply
path. Uneven path coverage applied a block's bookkeeping a per-node-variable
number of times → `pending_rewards`/`delegator_rewards` (hence the treasury
balance) and `epoch_state` drifted → `state_root` divergence (masked because
`state_root` is excluded from the block hash).

Fix (PR #782): the full bundle (`record_block_signatures` +
`distribute_reward` + `epoch_manager.record_block` + `run_epoch_bookkeeping`)
now runs exactly once inside `apply_block_pass2`, keyed off the committed
block's justification, before `update_trie_for_block`. The 5 receive-path
copies are gated off post-fork.

Fork-gated by `REWARD_APPLY_PATH_HEIGHT` (default `u64::MAX` on both nets):
pre-fork is bit-identical to today; post-fork the bookkeeping is
deterministic regardless of how a block arrived. Consensus-changing —
activate only via halt-all + state-root-aligned + simul-start.

## [2.2.26] — 2026-06-03 — BFT block-hash consistency + fork detection

### Consensus — Bug B: block hash now correct before BFT voting
Expand Down
38 changes: 19 additions & 19 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ members = [".", "crates/sentrix-primitives", "crates/sentrix-wallet", "crates/se
# `version.workspace = true`. Same goes for edition/license/repository so
# they can't drift across crates.
[workspace.package]
version = "2.2.26"
version = "2.2.27"
edition = "2024"
license = "BUSL-1.1"
repository = "https://github.com/sentrix-labs/sentrix"
Expand Down
166 changes: 93 additions & 73 deletions bin/sentrix/src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2332,55 +2332,66 @@ async fn cmd_start(
bc.latest_block().ok().cloned();

// ── Post-block Voyager bookkeeping ──
let reward = bc.get_block_reward();
bc.epoch_manager.record_block(reward);

let active =
bc.stake_registry.active_set.clone();
// #253: liveness-signers bug — the old
// `signers = vec![proposer]` marked every
// non-proposer as MISSED each block, so on
// a 4-validator BFT chain each validator
// signed only 25% of blocks vs the 30%
// MIN_SIGNED_PER_WINDOW threshold, driving
// deterministic cascade-jail every 14400
// blocks (~80min). Correct model: every
// precommit signer in the justification
// signed the block, not just the proposer.
let signers: Vec<String> = justification
.precommits
.iter()
.map(|p| p.validator.clone())
.collect();
bc.slashing.record_block_signatures(
&active, &signers, height,
);

// V4 Step 2: pay every signer pro-rata
// by stake, not just the proposer. Extract
// (validator, stake_weight) tuples from the
// justification's precommit list.
let reward_signers: Vec<(String, u64)> =
justification
// Reward / liveness / epoch-record bundle:
// pre-fork only. Post REWARD_APPLY_PATH_HEIGHT
// this runs once in apply_block_pass2, so the
// validator-finalize copy is skipped.
if !sentrix::core::fork_heights::is_reward_apply_path_height(height) {
let reward = bc.get_block_reward();
bc.epoch_manager.record_block(reward);

let active =
bc.stake_registry.active_set.clone();
// #253: liveness-signers bug — the old
// `signers = vec![proposer]` marked every
// non-proposer as MISSED each block, so on
// a 4-validator BFT chain each validator
// signed only 25% of blocks vs the 30%
// MIN_SIGNED_PER_WINDOW threshold, driving
// deterministic cascade-jail every 14400
// blocks (~80min). Correct model: every
// precommit signer in the justification
// signed the block, not just the proposer.
let signers: Vec<String> = justification
.precommits
.iter()
.map(|p| {
(
p.validator.clone(),
p.stake_weight,
)
})
.map(|p| p.validator.clone())
.collect();
let validator_fee = 0;
let _ =
bc.stake_registry.distribute_reward(
&proposer,
&reward_signers,
reward,
validator_fee,
bc.slashing.record_block_signatures(
&active, &signers, height,
);

bc.run_epoch_bookkeeping(height);
// V4 Step 2: pay every signer pro-rata
// by stake, not just the proposer. Extract
// (validator, stake_weight) tuples from the
// justification's precommit list.
let reward_signers: Vec<(String, u64)> =
justification
.precommits
.iter()
.map(|p| {
(
p.validator.clone(),
p.stake_weight,
)
})
.collect();
let validator_fee = 0;
let _ =
bc.stake_registry.distribute_reward(
&proposer,
&reward_signers,
reward,
validator_fee,
);
}

// Epoch boundary transition — pre-fork
// only; post REWARD_APPLY_PATH_HEIGHT it
// runs in apply_block_pass2.
if !sentrix::core::fork_heights::is_reward_apply_path_height(height) {
bc.run_epoch_bookkeeping(height);
}

tracing::info!(
"BFT finalized height={} round={}",
Expand Down Expand Up @@ -2940,39 +2951,48 @@ async fn cmd_start(
let updated = bc.latest_block().ok().cloned();

// ── Post-block Voyager bookkeeping ──
let reward = bc.get_block_reward();
bc.epoch_manager.record_block(reward);

let active = bc.stake_registry.active_set.clone();
// #253: see the sibling site above for rationale.
// Peer-finalize branch — same fix, same model.
let signers: Vec<String> = justification
.precommits
.iter()
.map(|p| p.validator.clone())
.collect();
bc.slashing.record_block_signatures(
&active, &signers, height,
);

// V4 Step 2 — see sibling site above for rationale.
let reward_signers: Vec<(String, u64)> =
justification
// Reward / liveness / epoch-record bundle: pre-fork
// only. Post REWARD_APPLY_PATH_HEIGHT it runs once in
// apply_block_pass2; skip the peer-finalize copy.
if !sentrix::core::fork_heights::is_reward_apply_path_height(height) {
let reward = bc.get_block_reward();
bc.epoch_manager.record_block(reward);

let active = bc.stake_registry.active_set.clone();
// #253: see the sibling site above for rationale.
// Peer-finalize branch — same fix, same model.
let signers: Vec<String> = justification
.precommits
.iter()
.map(|p| {
(p.validator.clone(), p.stake_weight)
})
.map(|p| p.validator.clone())
.collect();
let validator_fee = 0;
let _ = bc.stake_registry.distribute_reward(
&proposer,
&reward_signers,
reward,
validator_fee,
);
bc.slashing.record_block_signatures(
&active, &signers, height,
);

bc.run_epoch_bookkeeping(height);
// V4 Step 2 — see sibling site above for rationale.
let reward_signers: Vec<(String, u64)> =
justification
.precommits
.iter()
.map(|p| {
(p.validator.clone(), p.stake_weight)
})
.collect();
let validator_fee = 0;
let _ = bc.stake_registry.distribute_reward(
&proposer,
&reward_signers,
reward,
validator_fee,
);
}

// Epoch boundary transition — pre-fork only; post
// REWARD_APPLY_PATH_HEIGHT it runs in apply_block_pass2.
if !sentrix::core::fork_heights::is_reward_apply_path_height(height) {
bc.run_epoch_bookkeeping(height);
}

tracing::info!(
"BFT finalized height={} round={}",
Expand Down
Loading
Loading