GRANDPA Does Not Check Multiplicity of Equivocatory Votes (GSR-07)

[danforbes]

An equivocatory vote occurs when a validator has two or more votes at the same stage during a single round.

The specifications state that a valid justification must not contain more than two equivocatory votes from each voter.

The Gossamer function getEquivocatoryVoters() does not put a restriction on the number of equivocatory votes from each voter.

The impact is that commits that may be rejected in Substrate but will be accepted in Gossamer. Furthermore, it is an inefficient use of space and bandwidth to include more than two equivocatory votes.

The issue can be mitigated by rejecting commits with more than two equivocations per user.

This can be implemented by having getEquivocatoryVoters() return error if any authority has more than two equivocations as seen below.

func getEquivocatoryVoters(votes []AuthData) (map[ed25519.PublicKeyBytes]struct{}, error) {
	eqvVoters := make(map[ed25519.PublicKeyBytes]struct{})
	voters := make(map[ed25519.PublicKeyBytes]int, len(votes))
	for _, v := range votes {
		voters[v.AuthorityID]++
		if voters[v.AuthorityID] > 2 {
			return nil, errors.New("Invalid Multiplicity for Voter")
		}
		if voters[v.AuthorityID] == 2 {
			eqvVoters[v.AuthorityID] = struct{}{}
		}
	}
	return eqvVoters, nil
}