Tendermint: Can we prevent a peer from broadcasting malicious vote?

[melekes]

Then we can punish peer here:

https://github.com/tendermint/tendermint/blob/2a24ae90c19677e1b94c6163081a552533de90a9/consensus/state.go#L582

Otherwise, how would we know if a vote is coming from a malicious peer, not the regular peer who broadcasted this vote?

[melekes]

Or maybe we can use vote.ValidatorAddress to find guilty peer?

[milosevic]

We probably need to define (overall) correct behaviour of the peer and then define mechanisms to punish behaviour which is not according to the spec. But this probably requires a careful analysis which should probably also have game theory aspects, so that behaving according to the spec is the best strategy of rational peers.

[ebuchman]

Mostly yes, peers dont broadcast malicious votes, except on the evidence channel, which is its purpose. So a peer sending an invalid vote in consensus is grounds for punishment. But there are some "unexpected" type votes (for instance votes at the wrong height or step) that we shouldn't punish for.

Lets make a new type types/vote.go

type ErrVoteInvalid struct{
  *Vote
  msg string
}

and make all the errors we punish for an instance of that. Then we can easily check and punish the peer for invalid votes.

[ebuchman]

Replacing with https://github.com/tendermint/tendermint/issues/1327