0xOmarA/vault-access

.github/actions/setup-env/action.yml

@@ -13,7 +13,7 @@ runs:
       uses: RDXWorks-actions/toolchain@master
       with:
         # IMPORTANT: This version should match the version in radixdlt-scrypto on respective branch
-        toolchain: 1.81.0
+        toolchain: 1.92.0
         default: true
         target: ${{inputs.cross-compile-to-windows == 'true' && 'x86_64-pc-windows-msvc' || ''}}
 

.github/workflows/add-artifacts-to-release.yml

@@ -92,7 +92,7 @@ jobs:
       - uses: RDXWorks-actions/toolchain@master
         with:
           profile: minimal
-          toolchain: stable
+          toolchain: 1.92.0
           override: true
       - name: Install Rust Targets
         run: |

Dockerfile

@@ -52,14 +52,14 @@ RUN apt-get update \
     docker.io=20.10.24+dfsg1-1+deb12u1+b6 \
     libssl-dev=3.0.20-1~deb12u2 \
     pkg-config=1.8.1-1 \
-    unzip=6.0-28 \
+    unzip=6.0-28+deb12u1 \
     wget=${WGET_VERSION} \
     software-properties-common=0.99.30-4.1~deb12u1 \
   && apt-get install -y --no-install-recommends \
-    openjdk-17-jdk=17.0.19+10-1~deb12u2 \
-    openjdk-17-jre=17.0.19+10-1~deb12u2 \
-    openjdk-17-jdk-headless=17.0.19+10-1~deb12u2 \
-    openjdk-17-jre-headless=17.0.19+10-1~deb12u2 \
+    openjdk-17-jdk=17.0.20.1+1-1~deb12u1 \
+    openjdk-17-jre=17.0.20.1+1-1~deb12u1 \
+    openjdk-17-jdk-headless=17.0.20.1+1-1~deb12u1 \
+    openjdk-17-jre-headless=17.0.20.1+1-1~deb12u1 \
   && apt-get clean \
   && rm -rf /var/lib/apt/lists/*
 
@@ -141,7 +141,7 @@ RUN apt-get update \
 # We fix the version of Rust here to ensure that we can update it without having
 # issues with the caching layers containing outdated versions which aren't compatible.
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o rustup.sh \
-  && sh rustup.sh -y --target 1.88.0-aarch64-unknown-linux-gnu,1.88.0-x86_64-unknown-linux-gnu --default-toolchain 1.88.0
+  && sh rustup.sh -y --target aarch64-unknown-linux-gnu,x86_64-unknown-linux-gnu --default-toolchain 1.92.0
 
 # RUN "$HOME/.cargo/bin/cargo" install sccache --version 0.7.4
 
@@ -262,7 +262,7 @@ LABEL org.opencontainers.image.authors="devops@radixdlt.com"
 # - https://packages.debian.org/bookworm/libc6
 RUN apt-get update -y \
   && apt-get -y --no-install-recommends install \
-    openjdk-17-jre-headless=17.0.19+10-1~deb12u2 \
+    openjdk-17-jre-headless=17.0.20.1+1-1~deb12u1 \
     # https://security-tracker.debian.org/tracker/CVE-2023-38545
     curl=7.88.1-10+deb12u15 \
     gettext-base=0.21-12 \

cli-tools/build.gradle

@@ -136,6 +136,7 @@ def nodeNames = project.getProperties().get('nodeNames', "")
 def validators = project.getProperties().get('validators', '0')
 def publicKeys = project.getProperties().get('publicKeys', '')
 def network = project.getProperties().get('network', '')
+def stakingAccountPublicKey = project.findProperty('stakingAccountPublicKey')
 
 task getClassPathForRadixShell {
     doLast {
@@ -187,6 +188,9 @@ task generateDevGenesis(type: Exec) {
             "com.radixdlt.cli.GenerateGenesis",
             "--validator-count=${validators}",
             "--network=${network}"
+    if (stakingAccountPublicKey != null) {
+        args "--staking-account-public-key=${stakingAccountPublicKey}"
+    }
 }
 
 task generateGenesisFile(type: Exec) {
@@ -205,6 +209,9 @@ task generateGenesisFile(type: Exec) {
             "com.radixdlt.cli.GenerateGenesis",
             "--public-keys=${publicKeys}",
             "--network=${network}"
+    if (stakingAccountPublicKey != null) {
+        args "--staking-account-public-key=${stakingAccountPublicKey}"
+    }
 }
 
 task createGenerateGenesisScripts(type: CreateStartScripts) {

cli-tools/src/main/java/com/radixdlt/cli/GenerateGenesis.java

@@ -143,6 +143,11 @@ public static void main(String[] args) throws Exception {
     options.addOption("p", "public-keys", true, "Specify validator keys");
     options.addOption("v", "validator-count", true, "Specify number of validators to generate");
     options.addOption("n", "network", true, "Specify the network name or ID");
+    options.addOption(
+        "s",
+        "staking-account-public-key",
+        true,
+        "Override the powerful staking account public key (hex)");
 
     CommandLineParser parser = new DefaultParser();
     CommandLine cmd = parser.parse(options, args);
@@ -188,8 +193,15 @@ public static void main(String[] args) throws Exception {
             });
 
     final var network = parseNetwork(cmd.getOptionValue("n"));
+    if (cmd.hasOption("s") && !NETWORKS_TO_USE_POWERFUL_STAKING_ACCOUNT.contains(network)) {
+      throw new IllegalArgumentException("This network does not use a powerful staking account");
+    }
+    final var stakingAccountPublicKey =
+        cmd.hasOption("s")
+            ? ECDSASecp256k1PublicKey.fromHex(cmd.getOptionValue("s"))
+            : GENESIS_POWERFUL_STAKING_ACCOUNT_PUBLIC_KEY;
     final var validators = validatorsBuilder.build();
-    final var genesisData = createGenesisData(network, validators);
+    final var genesisData = createGenesisData(network, validators, stakingAccountPublicKey);
     final var encodedGenesisData =
         NodeSborCodecs.encode(genesisData, NodeSborCodecs.resolveCodec(new TypeToken<>() {}));
     final var compressedGenesisData = Compress.compress(encodedGenesisData);
@@ -240,7 +252,9 @@ Could not resolve (lower case) logical network name, or network id.
   }
 
   private static GenesisData createGenesisData(
-      Network network, ImmutableList<ECDSASecp256k1PublicKey> validators) {
+      Network network,
+      ImmutableList<ECDSASecp256k1PublicKey> validators,
+      ECDSASecp256k1PublicKey stakingAccountPublicKey) {
     final var usePowerfulStakingAccount =
         NETWORKS_TO_USE_POWERFUL_STAKING_ACCOUNT.contains(network);
 
@@ -251,16 +265,14 @@ private static GenesisData createGenesisData(
 
     final var stakingAccount =
         usePowerfulStakingAccount
-            ? Address.virtualAccountAddress(GENESIS_POWERFUL_STAKING_ACCOUNT_PUBLIC_KEY)
+            ? Address.virtualAccountAddress(stakingAccountPublicKey)
             : Address.virtualAccountAddress(PrivateKeys.ofNumeric(1).getPublicKey());
 
     final var stakingAccountOwnsAllValidators = usePowerfulStakingAccount;
 
     final Map<ECDSASecp256k1PublicKey, Decimal> xrdBalances =
         usePowerfulStakingAccount
-            ? Map.of(
-                GENESIS_POWERFUL_STAKING_ACCOUNT_PUBLIC_KEY,
-                GENESIS_POWERFUL_STAKING_ACCOUNT_INITIAL_XRD_BALANCE)
+            ? Map.of(stakingAccountPublicKey, GENESIS_POWERFUL_STAKING_ACCOUNT_INITIAL_XRD_BALANCE)
             : Map.of();
 
     var consensusConfig =

common/src/main/java/com/radixdlt/networks/Network.java

@@ -94,9 +94,9 @@ public enum Network {
       "tdx_2_",
       FixedNetworkGenesis.constant(
           HashCode.fromBytes(
-              Hex.decode("2825a4f1697dd457a27b6f641999d5f64d46ad512a49ee54653e4b866eab86e3")),
+              Hex.decode("2536c14ce79bb6cf7113aeed00a76666c4693622ee2187fefdf5225a2fd5cd51")),
           WrappedByteArray.fromBase64String(
-              "/wYAAHNOYVBwWQCPAgDGlw0JsgsUXCEGCgEACQEABREJICEKCWQAAAAK9A0RCAq4CwkiDArgkwQFChU0JKDsgpDrUQ6PtZoFGBkBIKAAAGSns7bgDRkTCQEVOxUJJKAAABBjLV7HawUJIhUB4CAiAwQBICEBAoDR8n5qke/XQptnD/OrX5rCMZLhJi7+LunGT4EIuc2gAAAAYIqmHv7EbdLVCAAAABUCsAEgIQQGIAchAw5SIf/qpLqorABPAywoLS8tR8jo2w15AUAIpnGOzWFIAQEBAWKzAPBJICECAgwEbmFtZSIAAQwTRGVmYXVsdCB2YWxpZGF0b3IgMQIMCGluZm9fdXJsIg0BDBhodHRwczovL3d3dy5yYWRpeGRsdC5jb216yQAFq3wW0qUtuYiPbyBCBqyKDUokPNOghqTrU7tt5IPo1+DROvarAAQ0Av6rAB2rfJN1Tm8Rj44uiQJFqfg94pPmNJ85dkD9s51S79+5QpbO9qsAADb+qwAuqwB4hKj6wGhwun4klfc+61w0uqJsaYm1e9FHmiKFsm6bV/pWAQA5/qsADasQAQIggAF27QIMICEEAo7SAhAgIQECCWEJMKAAAADoPIDQnzwuOwMBEREBBUd+bgKaRwB+CgKaRwB+pgGGRwAB7iRA6u10RtCcLJ8MEevwPAAAACAMCgx0cmFuc2Zlcl94cmQIcmFkaXN3YXAIbWV0YWRhdGERZnVuZ2libGVfcmVzb3VyY2UVbm9uX2Y+FgC4HWFjY291bnRfYXV0aG9yaXplZF9kZXBvc2l0b3JzDmdsb2JhbF9uX293bmVkJm5OQwBgX3dpdGhfcmVtb3RlX3R5cGUZa3Zfc3RvckYaADwPbWF4X3RyYW5zYWN0aW9u"))),
+              "/wYAAHNOYVBwWQCPAgASzkEPsgsUXCEGCgEACQEABQkHKAAAIQoJZAAAAAr0DRoICrgLCRsMCuCTBAUKFTQkoOyCkOtRDo+1mgUYGQEgoAAAZKeztuANGRMJARU7FQkgoAAAEGMtXsdrFYENAeAgIgMEASAhAQKA0Z5qm6ckGZ1ekdMsR2Xv3/D9wODYzg5xCVT+dKIzoAAAAGCKph7+xG3S1QgAAAAVArABICEEBiAHIQKVH3QVvG5TGRc1TV/S8YIf1330OtVfC9K4KIz2+Xvv0wEBAQFiswDwSSAhAgIMBG5hbWUiAAEME0RlZmF1bHQgdmFsaWRhdG9yIDECDAhpbmZvX3VybCINAQwYaHR0cHM6Ly93d3cucmFkaXhkbHQuY29teskABat8b8DgUXfyb9oovnwwKanJ+kJ84hDaMSD98J8HYttxhdb2qwAEMgL+qwAdq3x6ZAJPmCNKHV7mLi4dMBIVVa7Ld618ure+IAQ18W+/3varAAAz/qsALqsAfIFIPS1onORL8Ac2G+MyjWEedqx+xuJf5L91gJ+dD5N89qsAADT+qwANqxABAiCAAXbtAgwgIQQCjtICYTgACWEJMKAAAADoPIDQnzwuOwMBEREBBUd+bgKaRwB+CgKaRwB+pgGGRwAB7iRA6u10RtCcLJ8MEevwPAAAACAMCgx0cmFuc2Zlcl94cmQIcmFkaXN3YXAIbWV0YWRhdGERZnVuZ2libGVfcmVzb3VyY2UVbm9uX2Y+FgC4HWFjY291bnRfYXV0aG9yaXplZF9kZXBvc2l0b3JzDmdsb2JhbF9uX293bmVkJm5OQwBgX3dpdGhfcmVtb3RlX3R5cGUZa3Zfc3RvckYaADwPbWF4X3RyYW5zYWN0aW9u"))),
 
   // Temporary networks that match Olympia - for genesis testing mostly
   OLYMPIA_RELEASENET(3, "releasenet", "tdx_3_"),

core-rust-bridge/src/main/java/com/radixdlt/protocol/ProtocolConfig.java

@@ -74,33 +74,59 @@
 import com.radixdlt.sbor.codec.CodecMap;
 import com.radixdlt.sbor.codec.StructCodec;
 import com.radixdlt.sbor.exceptions.SborDecodeException;
+import com.radixdlt.utils.UInt64;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 
 public record ProtocolConfig(
     ImmutableList<ProtocolUpdateTrigger> protocolUpdateTriggers,
-    Map<String, byte[]> rawProtocolUpdateContentOverrides) {
+    Map<String, byte[]> rawProtocolUpdateContentOverrides,
+    ImmutableList<UserTransactionMoratorium> userTransactionMoratoriums) {
 
   public static final String GENESIS_PROTOCOL_VERSION_NAME = "babylon-genesis";
   public static final String ANEMONE_PROTOCOL_VERSION_NAME = "anemone";
   public static final String BOTTLENOSE_PROTOCOL_VERSION_NAME = "bottlenose";
   public static final String CUTTLEFISH_PART1_PROTOCOL_VERSION_NAME = "cuttlefish";
   public static final String CUTTLEFISH_PART2_PROTOCOL_VERSION_NAME = "cuttlefish-part2";
+  public static final String EAGLE_RAY_PROTOCOL_VERSION_NAME = "eagle-ray";
 
   public static ImmutableList<String> VERSION_NAMES =
       ImmutableList.of(
           GENESIS_PROTOCOL_VERSION_NAME,
           ANEMONE_PROTOCOL_VERSION_NAME,
           BOTTLENOSE_PROTOCOL_VERSION_NAME,
           CUTTLEFISH_PART1_PROTOCOL_VERSION_NAME,
-          CUTTLEFISH_PART2_PROTOCOL_VERSION_NAME);
+          CUTTLEFISH_PART2_PROTOCOL_VERSION_NAME,
+          EAGLE_RAY_PROTOCOL_VERSION_NAME);
 
   public static final String LATEST_PROTOCOL_VERSION_NAME =
       VERSION_NAMES.get(VERSION_NAMES.size() - 1);
 
   public ProtocolConfig(ImmutableList<ProtocolUpdateTrigger> protocolUpdateTriggers) {
-    this(protocolUpdateTriggers, Map.of());
+    this(protocolUpdateTriggers, Map.of(), ImmutableList.of());
+  }
+
+  public ProtocolConfig(
+      ImmutableList<ProtocolUpdateTrigger> protocolUpdateTriggers,
+      Map<String, byte[]> rawProtocolUpdateContentOverrides) {
+    this(protocolUpdateTriggers, rawProtocolUpdateContentOverrides, ImmutableList.of());
+  }
+
+  /** Replaces the moratorium schedule with a single range. */
+  public ProtocolConfig withUserTransactionMoratorium(long fromEpoch, long untilEpoch) {
+    return new ProtocolConfig(
+        protocolUpdateTriggers,
+        rawProtocolUpdateContentOverrides,
+        ImmutableList.of(
+            new UserTransactionMoratorium(
+                UInt64.fromNonNegativeLong(fromEpoch), UInt64.fromNonNegativeLong(untilEpoch))));
+  }
+
+  public static ProtocolConfig enactAtEpochWithUserTransactionMoratorium(
+      String version, long fromEpoch, long enactmentEpoch) {
+    return enactAtEpoch(version, enactmentEpoch)
+        .withUserTransactionMoratorium(fromEpoch, enactmentEpoch);
   }
 
   public static void registerCodec(CodecMap codecMap) {

core-rust-bridge/src/main/java/com/radixdlt/protocol/UserTransactionMoratorium.java

@@ -0,0 +1,84 @@
+/* Copyright 2021 Radix Publishing Ltd incorporated in Jersey (Channel Islands).
+ *
+ * Licensed under the Radix License, Version 1.0 (the "License"); you may not use this
+ * file except in compliance with the License. You may obtain a copy of the License at:
+ *
+ * radixfoundation.org/licenses/LICENSE-v1
+ *
+ * The Licensor hereby grants permission for the Canonical version of the Work to be
+ * published, distributed and used under or by reference to the Licensor’s trademark
+ * Radix ® and use of any unregistered trade names, logos or get-up.
+ *
+ * The Licensor provides the Work (and each Contributor provides its Contributions) on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied,
+ * including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT,
+ * MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ * Whilst the Work is capable of being deployed, used and adopted (instantiated) to create
+ * a distributed ledger it is your responsibility to test and validate the code, together
+ * with all logic and performance of that code under all foreseeable scenarios.
+ *
+ * The Licensor does not make or purport to make and hereby excludes liability for all
+ * and any representation, warranty or undertaking in any form whatsoever, whether express
+ * or implied, to any entity or person, including any representation, warranty or
+ * undertaking, as to the functionality security use, value or other characteristics of
+ * any distributed ledger nor in respect the functioning or value of any tokens which may
+ * be created stored or transferred using the Work. The Licensor does not warrant that the
+ * Work or any use of the Work complies with any law or regulation in any territory where
+ * it may be implemented or used or that it will be appropriate for any specific purpose.
+ *
+ * Neither the licensor nor any current or former employees, officers, directors, partners,
+ * trustees, representatives, agents, advisors, contractors, or volunteers of the Licensor
+ * shall be liable for any direct or indirect, special, incidental, consequential or other
+ * losses of any kind, in tort, contract or otherwise (including but not limited to loss
+ * of revenue, income or profits, or loss of use or data, or loss of reputation, or loss
+ * of any economic or other opportunity of whatsoever nature or howsoever arising), arising
+ * out of or in connection with (without limitation of any use, misuse, of any ledger system
+ * or use made or its functionality or any performance or operation of any code or protocol
+ * caused by bugs or programming or logic errors or otherwise);
+ *
+ * A. any offer, purchase, holding, use, sale, exchange or transmission of any
+ * cryptographic keys, tokens or assets created, exchanged, stored or arising from any
+ * interaction with the Work;
+ *
+ * B. any failure in a transmission or loss of any token or assets keys or other digital
+ * artefacts due to errors in transmission;
+ *
+ * C. bugs, hacks, logic errors or faults in the Work or any communication;
+ *
+ * D. system software or apparatus including but not limited to losses caused by errors
+ * in holding or transmitting tokens by any third-party;
+ *
+ * E. breaches or failure of security including hacker attacks, loss or disclosure of
+ * password, loss of private key, unauthorised use or misuse of such passwords or keys;
+ *
+ * F. any losses including loss of anticipated savings or other benefits resulting from
+ * use of the Work or any changes to the Work (however implemented).
+ *
+ * You are solely responsible for; testing, validating and evaluation of all operation
+ * logic, functionality, security and appropriateness of using the Work for any commercial
+ * or non-commercial purpose and for any reproduction or redistribution by You of the
+ * Work. You assume all risks associated with Your use of the Work and the exercise of
+ * permissions under this License.
+ */
+
+package com.radixdlt.protocol;
+
+import com.radixdlt.sbor.codec.CodecMap;
+import com.radixdlt.sbor.codec.StructCodec;
+import com.radixdlt.utils.UInt64;
+
+/**
+ * An epoch range during which user transactions are refused.
+ *
+ * @param fromInclusive the first committed epoch during which transactions are refused
+ * @param toExclusive the first committed epoch from which clients may retry
+ */
+public record UserTransactionMoratorium(UInt64 fromInclusive, UInt64 toExclusive) {
+
+  public static void registerCodec(CodecMap codecMap) {
+    codecMap.register(
+        UserTransactionMoratorium.class,
+        codecs -> StructCodec.fromRecordComponents(UserTransactionMoratorium.class, codecs));
+  }
+}

core-rust-bridge/src/main/java/com/radixdlt/sbor/NodeSborCodecs.java

@@ -135,6 +135,7 @@ public static void registerCodecsWithCodecMap(CodecMap codecMap) {
     ProtocolUpdateEnactmentCondition.registerCodec(codecMap);
     ProtocolUpdateEnactmentCondition.SignalledReadinessThreshold.registerCodec(codecMap);
     ProtocolState.registerCodec(codecMap);
+    UserTransactionMoratorium.registerCodec(codecMap);
     ProtocolUpdateResult.registerCodec(codecMap);
     RawLedgerTransaction.registerCodec(codecMap);
     RawNotarizedTransaction.registerCodec(codecMap);

core-rust-bridge/src/main/java/com/radixdlt/statecomputer/RustStateComputer.java

@@ -68,13 +68,16 @@
 
 import com.google.common.reflect.TypeToken;
 import com.radixdlt.environment.NodeRustEnvironment;
+import com.radixdlt.lang.Option;
 import com.radixdlt.lang.Result;
 import com.radixdlt.lang.Tuple;
 import com.radixdlt.monitoring.LabelledTimer;
 import com.radixdlt.monitoring.Metrics;
 import com.radixdlt.monitoring.Metrics.MethodId;
+import com.radixdlt.protocol.UserTransactionMoratorium;
 import com.radixdlt.sbor.Natives;
 import com.radixdlt.statecomputer.commit.*;
+import com.radixdlt.utils.UInt64;
 import java.util.Objects;
 
 @SuppressWarnings("OptionalUsedAsFieldOrParameterType")
@@ -99,6 +102,11 @@ public RustStateComputer(Metrics metrics, NodeRustEnvironment nodeRustEnvironmen
         Natives.builder(nodeRustEnvironment, RustStateComputer::protocolState)
             .measure(timer.label(new MethodId(RustStateComputer.class, "protocolState")))
             .build(new TypeToken<>() {});
+    this.ensureUserTransactionsAllowedFunc =
+        Natives.builder(nodeRustEnvironment, RustStateComputer::ensureUserTransactionsAllowed)
+            .measure(
+                timer.label(new MethodId(RustStateComputer.class, "ensureUserTransactionsAllowed")))
+            .build(new TypeToken<>() {});
   }
 
   public PrepareResult prepare(PrepareRequest prepareRequest) {
@@ -135,4 +143,20 @@ public ProtocolState protocolState() {
 
   private static native byte[] protocolState(
       NodeRustEnvironment nodeRustEnvironment, byte[] payload);
+
+  /** Returns the active moratorium as an error, using Rust's committed ledger epoch. */
+  public Result<Tuple.Tuple0, UserTransactionMoratorium> ensureUserTransactionsAllowed() {
+    return ensureUserTransactionsAllowedFunc.call(Option.none());
+  }
+
+  /** Checks the consensus event's epoch independently of the committed ledger epoch. */
+  public Result<Tuple.Tuple0, UserTransactionMoratorium> ensureUserTransactionsAllowed(long epoch) {
+    return ensureUserTransactionsAllowedFunc.call(Option.some(UInt64.fromNonNegativeLong(epoch)));
+  }
+
+  private final Natives.Call1<Option<UInt64>, Result<Tuple.Tuple0, UserTransactionMoratorium>>
+      ensureUserTransactionsAllowedFunc;
+
+  private static native byte[] ensureUserTransactionsAllowed(
+      NodeRustEnvironment nodeRustEnvironment, byte[] payload);
 }