Fix sandwich attack on honest reorgs (#12418)

* Fix sandwich attack on honest reorgs

* fix test

---------

Co-authored-by: prylabs-bulldozer[bot] <58059840+prylabs-bulldozer[bot]@users.noreply.github.com>

beacon-chain/forkchoice/doubly-linked-tree/reorg_late_blocks.go

@@ -82,6 +82,11 @@ func (f *ForkChoice) ShouldOverrideFCU() (override bool) {
 	if head.weight*100 > f.store.committeeWeight*params.BeaconConfig().ReorgWeightThreshold {
 		return
 	}
+
+	// Only orphan a block if the parent LMD vote is strong
+	if parent.weight*100 < f.store.committeeWeight*params.BeaconConfig().ReorgParentWeightThreshold {
+		panic(f.store.committeeWeight)
+	}
 	return true
 }
 
@@ -137,6 +142,11 @@ func (f *ForkChoice) GetProposerHead() [32]byte {
 		return head.root
 	}
 
+	// Only orphan a block if the parent LMD vote is strong
+	if parent.weight*100 < f.store.committeeWeight*params.BeaconConfig().ReorgParentWeightThreshold {
+		return head.root
+	}
+
 	// Only reorg if we are proposing early
 	secs, err := slots.SecondsSinceSlotStart(head.slot+1, f.store.genesisTime, uint64(time.Now().Unix()))
 	if err != nil {

beacon-chain/forkchoice/doubly-linked-tree/reorg_late_blocks_test.go

@@ -22,7 +22,11 @@ func TestForkChoice_ShouldOverrideFCU(t *testing.T) {
 	st, root, err := prepareForkchoiceState(ctx, 1, [32]byte{'a'}, [32]byte{}, [32]byte{'A'}, 0, 0)
 	require.NoError(t, err)
 	require.NoError(t, f.InsertNode(ctx, st, root))
-	f.ProcessAttestation(ctx, []uint64{0, 1, 2}, root, 0)
+	attesters := make([]uint64, f.numActiveValidators-64)
+	for i := range attesters {
+		attesters[i] = uint64(i + 64)
+	}
+	f.ProcessAttestation(ctx, attesters, root, 0)
 
 	driftGenesisTime(f, 2, orphanLateBlockFirstThreshold+1)
 	st, root, err = prepareForkchoiceState(ctx, 2, [32]byte{'b'}, [32]byte{'a'}, [32]byte{'B'}, 0, 0)
@@ -101,7 +105,11 @@ func TestForkChoice_GetProposerHead(t *testing.T) {
 	st, root, err := prepareForkchoiceState(ctx, 1, parentRoot, [32]byte{}, [32]byte{'A'}, 0, 0)
 	require.NoError(t, err)
 	require.NoError(t, f.InsertNode(ctx, st, root))
-	f.ProcessAttestation(ctx, []uint64{0, 1, 2}, root, 0)
+	attesters := make([]uint64, f.numActiveValidators-64)
+	for i := range attesters {
+		attesters[i] = uint64(i + 64)
+	}
+	f.ProcessAttestation(ctx, attesters, root, 0)
 
 	driftGenesisTime(f, 3, 1)
 	childRoot := [32]byte{'b'}

config/params/config.go

@@ -69,6 +69,7 @@ type BeaconChainConfig struct {
 	// Fork choice algorithm constants.
 	ProposerScoreBoost              uint64           `yaml:"PROPOSER_SCORE_BOOST" spec:"true"`                // ProposerScoreBoost defines a value that is a % of the committee weight for fork-choice boosting.
 	ReorgWeightThreshold            uint64           `yaml:"REORG_WEIGHT_THRESHOLD" spec:"true"`              // ReorgWeightThreshold defines a value that is a % of the committee weight to consider a block weak and subject to being orphaned.
+	ReorgParentWeightThreshold      uint64           `yaml:"REORG_PARENT_WEIGHT_THRESHOLD" spec:"true"`       // ReorgParentWeightThreshold defines a value that is a % of the committee weight to consider a parent block strong and subject its child to being orphaned.
 	ReorgMaxEpochsSinceFinalization primitives.Epoch `yaml:"REORG_MAX_EPOCHS_SINCE_FINALIZATION" spec:"true"` // This defines a limit to consider safe to orphan a block if the network is finalizing
 	IntervalsPerSlot                uint64           `yaml:"INTERVALS_PER_SLOT" spec:"true"`                  // IntervalsPerSlot defines the number of fork choice intervals in a slot defined in the fork choice spec.
 

config/params/mainnet_config.go

@@ -117,6 +117,7 @@ var mainnetBeaconConfig = &BeaconChainConfig{
 	// Fork choice algorithm constants.
 	ProposerScoreBoost:              40,
 	ReorgWeightThreshold:            20,
+	ReorgParentWeightThreshold:      160,
 	ReorgMaxEpochsSinceFinalization: 2,
 	IntervalsPerSlot:                3,