feat(llmq): add trustless quorum proof chain generation and verification

.gitignore

@@ -180,3 +180,4 @@ compile_commands.json
 # Linux perf profiling artifacts
 perf.data
 perf.data.old
+activity.md

src/Makefile.am

@@ -284,6 +284,8 @@ BITCOIN_CORE_H = \
   llmq/ehf_signals.h \
   llmq/options.h \
   llmq/params.h \
+  llmq/quorumproofdata.h \
+  llmq/quorumproofs.h \
   llmq/quorums.h \
   llmq/quorumsman.h \
   llmq/signhash.h \
@@ -556,6 +558,7 @@ libbitcoin_node_a_SOURCES = \
   llmq/ehf_signals.cpp \
   llmq/net_signing.cpp \
   llmq/options.cpp \
+  llmq/quorumproofs.cpp \
   llmq/quorums.cpp \
   llmq/quorumsman.cpp \
   llmq/signhash.cpp \

src/Makefile.test.include

@@ -140,6 +140,8 @@ BITCOIN_TESTS =\
   test/llmq_snapshot_tests.cpp \
   test/llmq_utils_tests.cpp \
   test/logging_tests.cpp \
+  test/quorum_proofs_tests.cpp \
+  test/quorum_proofs_regression_tests.cpp \
   test/dbwrapper_tests.cpp \
   test/validation_tests.cpp \
   test/mempool_tests.cpp \

src/evo/chainhelper.cpp

@@ -19,14 +19,15 @@ CChainstateHelper::CChainstateHelper(CEvoDB& evodb, CDeterministicMNManager& dmn
                                      llmq::CQuorumSnapshotManager& qsnapman, const ChainstateManager& chainman,
                                      const Consensus::Params& consensus_params, const CMasternodeSync& mn_sync,
                                      const CSporkManager& sporkman, const chainlock::Chainlocks& chainlocks,
-                                     const llmq::CQuorumManager& qman) :
+                                     const llmq::CQuorumManager& qman,
+                                     llmq::CQuorumProofManager& quorum_proof_manager) :
     isman{isman},
     credit_pool_manager{std::make_unique<CCreditPoolManager>(evodb, chainman)},
     m_chainlocks{chainlocks},
     ehf_manager{std::make_unique<CMNHFManager>(evodb, chainman, qman)},
     mn_payments{std::make_unique<CMNPaymentsProcessor>(dmnman, govman, chainman, consensus_params, mn_sync, sporkman)},
     special_tx{std::make_unique<CSpecialTxProcessor>(*credit_pool_manager, dmnman, *ehf_manager, qblockman, qsnapman,
-                                                     chainman, consensus_params, chainlocks, qman)}
+                                                     chainman, consensus_params, chainlocks, qman, quorum_proof_manager)}
 {}
 
 CChainstateHelper::~CChainstateHelper() = default;

src/evo/chainhelper.h

@@ -33,6 +33,7 @@ namespace llmq {
 class CInstantSendManager;
 class CQuorumBlockProcessor;
 class CQuorumManager;
+class CQuorumProofManager;
 class CQuorumSnapshotManager;
 } // namespace llmq
 namespace node {
@@ -62,7 +63,8 @@ class CChainstateHelper
                                llmq::CQuorumSnapshotManager& qsnapman, const ChainstateManager& chainman,
                                const Consensus::Params& consensus_params, const CMasternodeSync& mn_sync,
                                const CSporkManager& sporkman, const chainlock::Chainlocks& chainlocks,
-                               const llmq::CQuorumManager& qman);
+                               const llmq::CQuorumManager& qman,
+                               llmq::CQuorumProofManager& quorum_proof_manager);
     ~CChainstateHelper();
 
     /** Passthrough functions to chainlock::Chainlocks */

src/evo/specialtxman.cpp

@@ -16,6 +16,7 @@
 #include <evo/simplifiedmns.h>
 #include <llmq/blockprocessor.h>
 #include <llmq/commitment.h>
+#include <llmq/quorumproofs.h>
 #include <llmq/quorumsman.h>
 #include <llmq/utils.h>
 #include <messagesigner.h>
@@ -667,6 +668,22 @@ bool CSpecialTxProcessor::ProcessSpecialTxsInBlock(const CBlock& block, const CB
                 return false;
             }
 
+            // Index the chainlock from cbtx for proof generation
+            // Only index if not just checking
+            // Note: We can't check ActiveChain().Contains(pindex) here because the chain tip
+            // hasn't been updated yet during ConnectBlock - the tip is updated AFTER this function returns
+            if (!fJustCheck && opt_cbTx->bestCLSignature.IsValid()) {
+                int chainlockedHeight = pindex->nHeight - static_cast<int>(opt_cbTx->bestCLHeightDiff) - 1;
+                const CBlockIndex* pChainlockedBlock = pindex->GetAncestor(chainlockedHeight);
+                if (pChainlockedBlock) {
+                    m_quorum_proof_manager.IndexChainlock(
+                        chainlockedHeight,
+                        opt_cbTx->bestCLSignature,
+                        pindex->GetBlockHash(),
+                        pindex->nHeight);
+                }
+            }
+
             int64_t nTime6_3 = GetTimeMicros();
             nTimeCbTxCL += nTime6_3 - nTime6_2;
             LogPrint(BCLog::BENCHMARK, "      - CheckCbTxBestChainlock: %.2fms [%.2fs]\n",
@@ -724,6 +741,14 @@ bool CSpecialTxProcessor::UndoSpecialTxsInBlock(const CBlock& block, const CBloc
         if (!m_qblockman.UndoBlock(block, pindex)) {
             return false;
         }
+
+        // Remove chainlock index for this block's cbtx
+        if (block.vtx.size() > 0 && block.vtx[0]->nType == TRANSACTION_COINBASE) {
+            if (const auto opt_cbTx = GetTxPayload<CCbTx>(*block.vtx[0]); opt_cbTx && opt_cbTx->bestCLSignature.IsValid()) {
+                int chainlockedHeight = pindex->nHeight - static_cast<int>(opt_cbTx->bestCLHeightDiff) - 1;
+                m_quorum_proof_manager.RemoveChainlockIndex(chainlockedHeight);
+            }
+        }
     } catch (const std::exception& e) {
         bls::bls_legacy_scheme.store(bls_legacy_scheme);
         LogPrintf("CSpecialTxProcessor::%s -- bls_legacy_scheme=%d\n", __func__, bls::bls_legacy_scheme.load());

src/evo/specialtxman.h

@@ -32,6 +32,7 @@ namespace Consensus { struct Params; }
 namespace llmq {
 class CQuorumBlockProcessor;
 class CQuorumManager;
+class CQuorumProofManager;
 class CQuorumSnapshotManager;
 } // namespace llmq
 
@@ -49,12 +50,14 @@ class CSpecialTxProcessor
     const Consensus::Params& m_consensus_params;
     const chainlock::Chainlocks& m_chainlocks;
     const llmq::CQuorumManager& m_qman;
+    llmq::CQuorumProofManager& m_quorum_proof_manager;
 
 public:
     explicit CSpecialTxProcessor(CCreditPoolManager& cpoolman, CDeterministicMNManager& dmnman, CMNHFManager& mnhfman,
                                  llmq::CQuorumBlockProcessor& qblockman, llmq::CQuorumSnapshotManager& qsnapman,
                                  const ChainstateManager& chainman, const Consensus::Params& consensus_params,
-                                 const chainlock::Chainlocks& chainlocks, const llmq::CQuorumManager& qman) :
+                                 const chainlock::Chainlocks& chainlocks, const llmq::CQuorumManager& qman,
+                                 llmq::CQuorumProofManager& quorum_proof_manager) :
         m_cpoolman(cpoolman),
         m_dmnman{dmnman},
         m_mnhfman{mnhfman},
@@ -63,7 +66,8 @@ class CSpecialTxProcessor
         m_chainman(chainman),
         m_consensus_params{consensus_params},
         m_chainlocks{chainlocks},
-        m_qman{qman}
+        m_qman{qman},
+        m_quorum_proof_manager{quorum_proof_manager}
     {
     }
 

src/init.cpp

@@ -100,6 +100,7 @@
 #include <llmq/net_signing.h>
 #include <llmq/options.h>
 #include <llmq/observer/context.h>
+#include <llmq/quorumproofs.h>
 #include <masternode/meta.h>
 #include <masternode/sync.h>
 #include <masternode/utils.h>
@@ -2162,6 +2163,15 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
 
     ChainstateManager& chainman = *Assert(node.chainman);
 
+    // Migrate chainlock index for quorum proof generation (one-time on first run after upgrade)
+    if (node.llmq_ctx && node.llmq_ctx->quorum_proof_manager) {
+        LOCK(cs_main);
+        node.llmq_ctx->quorum_proof_manager->MigrateChainlockIndex(chainman.ActiveChain(), chainparams);
+        // Migrate quorum proof data index for fast proof chain generation
+        node.llmq_ctx->quorum_proof_manager->MigrateQuorumProofIndex(chainman.ActiveChain(), chainparams,
+                                                                       chainman.m_blockman);
+    }
+
     assert(!node.dstxman);
     node.dstxman = std::make_unique<CDSTXManager>(*node.chainlocks);
 

src/llmq/blockprocessor.cpp

@@ -8,6 +8,8 @@
 #include <evo/specialtx.h>
 #include <llmq/commitment.h>
 #include <llmq/options.h>
+#include <llmq/quorumproofdata.h>
+#include <llmq/quorumproofs.h>
 #include <llmq/utils.h>
 #include <util/helpers.h>
 #include <util/std23.h>
@@ -18,6 +20,7 @@
 #include <consensus/params.h>
 #include <consensus/validation.h>
 #include <deploymentstatus.h>
+#include <hash.h>
 #include <net.h>
 #include <primitives/block.h>
 #include <primitives/transaction.h>
@@ -230,6 +233,78 @@ bool CQuorumBlockProcessor::ProcessBlock(const CBlock& block, gsl::not_null<cons
         }
     }
 
+    // Store quorum proof data for fast proof chain generation (only for actual block processing, not just checking)
+    if (!fJustCheck) {
+        // Get active commitments up to this block's previous block (matching CalcCbTxMerkleRootQuorums logic)
+        auto commitmentsMap = GetMinedAndActiveCommitmentsUntilBlock(pindex->pprev);
+
+        // Collect all commitment hashes for merkle root calculation
+        std::vector<uint256> allCommitmentHashes;
+        for (const auto& [type, blockIndexes] : commitmentsMap) {
+            for (const auto* blockIndex : blockIndexes) {
+                uint256 commitmentHash = GetMinedCommitmentHash(type, blockIndex->GetBlockHash());
+                if (commitmentHash != uint256::ZERO) {
+                    allCommitmentHashes.push_back(commitmentHash);
+                }
+            }
+        }
+
+        // Add commitments from current block
+        for (size_t i = 1; i < block.vtx.size(); ++i) {
+            const auto& tx = block.vtx[i];
+            if (tx->IsSpecialTxVersion() && tx->nType == TRANSACTION_QUORUM_COMMITMENT) {
+                const auto opt_qc = GetTxPayload<CFinalCommitmentTxPayload>(*tx);
+                if (opt_qc && !opt_qc->commitment.IsNull()) {
+                    allCommitmentHashes.push_back(::SerializeHash(opt_qc->commitment));
+                }
+            }
+        }
+
+        // Sort to match CalcCbTxMerkleRootQuorums
+        std::sort(allCommitmentHashes.begin(), allCommitmentHashes.end());
+
+        // Build coinbase merkle proof (same for all commitments in this block)
+        std::vector<uint256> txHashes;
+        txHashes.reserve(block.vtx.size());
+        for (const auto& tx : block.vtx) {
+            txHashes.push_back(tx->GetHash());
+        }
+        auto [cbPath, cbSide] = BuildMerkleProofPath(txHashes, 0);
+
+        // Store proof data for each non-null commitment in this block
+        for (const auto& [type, qc] : qcs) {
+            if (qc.IsNull()) continue;
+
+            // Find commitment hash in sorted list
+            uint256 targetHash = ::SerializeHash(qc);
+            auto it = std::find(allCommitmentHashes.begin(), allCommitmentHashes.end(), targetHash);
+            if (it == allCommitmentHashes.end()) {
+                LogPrint(BCLog::LLMQ, "[ProcessBlock] Could not find commitment hash for %s in active set\n",
+                         qc.quorumHash.ToString());
+                continue;
+            }
+            size_t targetIndex = std::distance(allCommitmentHashes.begin(), it);
+
+            // Build quorum merkle proof
+            auto [qPath, qSide] = BuildMerkleProofPath(allCommitmentHashes, targetIndex);
+
+            // Store proof data
+            QuorumProofData proofData;
+            proofData.quorumMerkleProof.merklePath = std::move(qPath);
+            proofData.quorumMerkleProof.merklePathSide = std::move(qSide);
+            proofData.coinbaseTx = block.vtx[0];
+            proofData.coinbaseMerklePath = cbPath;  // Copy since reused
+            proofData.coinbaseMerklePathSide = cbSide;
+            proofData.header = block.GetBlockHeader();
+
+            auto proofKey = std::make_pair(DB_QUORUM_PROOF_DATA, std::make_pair(qc.llmqType, qc.quorumHash));
+            m_evoDb.Write(proofKey, proofData);
+
+            LogPrint(BCLog::LLMQ, "[ProcessBlock] Stored proof data for quorum %s type=%d\n",
+                     qc.quorumHash.ToString(), std23::to_underlying(qc.llmqType));
+        }
+    }
+
     m_evoDb.Write(DB_BEST_BLOCK_UPGRADE, blockHash);
 
     return true;
@@ -399,6 +474,9 @@ bool CQuorumBlockProcessor::UndoBlock(const CBlock& block, gsl::not_null<const C
 
         m_evoDb.Erase(std::make_pair(DB_MINED_COMMITMENT, std::make_pair(qc.llmqType, qc.quorumHash)));
 
+        // Also erase the cached proof data
+        m_evoDb.Erase(std::make_pair(DB_QUORUM_PROOF_DATA, std::make_pair(qc.llmqType, qc.quorumHash)));
+
         const auto& llmq_params_opt = Params().GetLLMQ(qc.llmqType);
         assert(llmq_params_opt.has_value());
 
@@ -525,6 +603,61 @@ std::pair<CFinalCommitment, uint256> CQuorumBlockProcessor::GetMinedCommitment(C
     return ret;
 }
 
+uint256 CQuorumBlockProcessor::GetMinedCommitmentHash(Consensus::LLMQType llmqType, const uint256& quorumHash) const
+{
+    auto key = std::make_pair(DB_MINED_COMMITMENT, std::make_pair(llmqType, quorumHash));
+    CDataStream ssKey(SER_DISK, CLIENT_VERSION);
+    ssKey << key;
+
+    // Fast path: try to read raw data from disk to avoid deserializing BLS keys
+    CDataStream ssValue(SER_DISK, CLIENT_VERSION);
+    if (m_evoDb.GetRawDB().ReadDataStream(ssKey, ssValue)) {
+        // The data in DB is std::pair<CFinalCommitment, uint256>
+        // It's serialized as: [CFinalCommitment serialized data][uint256 serialized data]
+        // uint256 is exactly 32 bytes
+        if (ssValue.size() > 32) {
+            // We just want the hash of the CFinalCommitment part
+            // SerializeHash uses SER_GETHASH, but we have SER_DISK bytes.
+            // CFinalCommitment serialization is identical for both (as long as nVersion matches).
+            // We trust the data in DB is consistent.
+            return Hash(MakeByteSpan(ssValue).first(ssValue.size() - 32));
+        }
+    }
+
+    // Fallback: use slow path (read from memory/cache or if disk read failed)
+    // This will deserialize the full object
+    auto [commitment, _] = GetMinedCommitment(llmqType, quorumHash);
+    if (commitment.IsNull()) {
+        return uint256::ZERO;
+    }
+    return ::SerializeHash(commitment);
+}
+
+uint256 CQuorumBlockProcessor::GetMinedCommitmentBlockHash(Consensus::LLMQType llmqType, const uint256& quorumHash) const
+{
+    auto key = std::make_pair(DB_MINED_COMMITMENT, std::make_pair(llmqType, quorumHash));
+    CDataStream ssKey(SER_DISK, CLIENT_VERSION);
+    ssKey << key;
+
+    // Fast path: try to read raw data from disk
+    CDataStream ssValue(SER_DISK, CLIENT_VERSION);
+    if (m_evoDb.GetRawDB().ReadDataStream(ssKey, ssValue)) {
+        // The data in DB is std::pair<CFinalCommitment, uint256>
+        // It's serialized as: [CFinalCommitment serialized data][uint256 serialized data]
+        // uint256 is exactly 32 bytes and it is at the end
+        if (ssValue.size() >= 32) {
+             uint256 blockHash;
+             // Read last 32 bytes
+             std::memcpy(blockHash.begin(), ssValue.data() + ssValue.size() - 32, 32);
+             return blockHash;
+        }
+    }
+
+    // Fallback: use slow path
+    auto [_, blockHash] = GetMinedCommitment(llmqType, quorumHash);
+    return blockHash;
+}
+
 // The returned quorums are in reversed order, so the most recent one is at index 0
 std::vector<const CBlockIndex*> CQuorumBlockProcessor::GetMinedCommitmentsUntilBlock(Consensus::LLMQType llmqType, gsl::not_null<const CBlockIndex*> pindex, size_t maxCount) const
 {

src/llmq/blockprocessor.h

@@ -83,6 +83,8 @@ class CQuorumBlockProcessor
     bool HasMinedCommitment(Consensus::LLMQType llmqType, const uint256& quorumHash) const
         EXCLUSIVE_LOCKS_REQUIRED(!minableCommitmentsCs);
     std::pair<CFinalCommitment, uint256> GetMinedCommitment(Consensus::LLMQType llmqType, const uint256& quorumHash) const;
+    uint256 GetMinedCommitmentHash(Consensus::LLMQType llmqType, const uint256& quorumHash) const;
+    uint256 GetMinedCommitmentBlockHash(Consensus::LLMQType llmqType, const uint256& quorumHash) const;
 
     std::vector<const CBlockIndex*> GetMinedCommitmentsUntilBlock(Consensus::LLMQType llmqType, gsl::not_null<const CBlockIndex*> pindex, size_t maxCount) const;
     std::map<Consensus::LLMQType, std::vector<const CBlockIndex*>> GetMinedAndActiveCommitmentsUntilBlock(gsl::not_null<const CBlockIndex*> pindex) const;

src/llmq/context.cpp

@@ -7,6 +7,7 @@
 #include <bls/bls_worker.h>
 #include <instantsend/instantsend.h>
 #include <llmq/blockprocessor.h>
+#include <llmq/quorumproofs.h>
 #include <llmq/quorumsman.h>
 #include <llmq/signing.h>
 #include <llmq/snapshot.h>
@@ -22,6 +23,7 @@ LLMQContext::LLMQContext(CDeterministicMNManager& dmnman, CEvoDB& evo_db, CSpork
                                                                          *qsnapman, bls_threads)},
     qman{std::make_unique<llmq::CQuorumManager>(*bls_worker, dmnman, evo_db, *quorum_block_processor, *qsnapman,
                                                 chainman, db_params)},
+    quorum_proof_manager{std::make_unique<llmq::CQuorumProofManager>(evo_db, *quorum_block_processor)},
     sigman{std::make_unique<llmq::CSigningManager>(*qman, db_params, max_recsigs_age)},
     isman{std::make_unique<llmq::CInstantSendManager>(chainlocks, chainman.ActiveChainstate(), *sigman, sporkman,
                                                       mempool, mn_sync, db_params)}

src/llmq/context.h

@@ -26,6 +26,7 @@ namespace llmq {
 class CInstantSendManager;
 class CQuorumBlockProcessor;
 class CQuorumManager;
+class CQuorumProofManager;
 class CQuorumSnapshotManager;
 class CSigningManager;
 } // namespace llmq
@@ -54,6 +55,7 @@ struct LLMQContext {
     const std::unique_ptr<llmq::CQuorumSnapshotManager> qsnapman;
     const std::unique_ptr<llmq::CQuorumBlockProcessor> quorum_block_processor;
     const std::unique_ptr<llmq::CQuorumManager> qman;
+    const std::unique_ptr<llmq::CQuorumProofManager> quorum_proof_manager;
     const std::unique_ptr<llmq::CSigningManager> sigman;
     const std::unique_ptr<llmq::CInstantSendManager> isman;
 };