light: update default trust level to 2/3

light/detector_test.go

@@ -57,6 +57,7 @@ func TestLightClientAttackEvidence_Lunatic(t *testing.T) {
 		dbs.New(dbm.NewMemDB(), chainID),
 		light.Logger(log.TestingLogger()),
 		light.MaxRetryAttempts(1),
+		light.SkippingVerification(minimumTrustLevel),
 	)
 	require.NoError(t, err)
 
@@ -92,7 +93,7 @@ func TestLightClientAttackEvidence_Lunatic(t *testing.T) {
 func TestLightClientAttackEvidence_Equivocation(t *testing.T) {
 	verificationOptions := map[string]light.Option{
 		"sequential": light.SequentialVerification(),
-		"skipping":   light.SkippingVerification(light.DefaultTrustLevel),
+		"skipping":   light.SkippingVerification(minimumTrustLevel),
 	}
 
 	for s, verificationOption := range verificationOptions {
@@ -230,6 +231,7 @@ func TestLightClientAttackEvidence_ForwardLunatic(t *testing.T) {
 		light.Logger(log.TestingLogger()),
 		light.MaxClockDrift(1*time.Second),
 		light.MaxBlockLag(1*time.Second),
+		light.SkippingVerification(minimumTrustLevel),
 	)
 	require.NoError(t, err)
 
@@ -297,6 +299,7 @@ func TestLightClientAttackEvidence_ForwardLunatic(t *testing.T) {
 		light.Logger(log.TestingLogger()),
 		light.MaxClockDrift(1*time.Second),
 		light.MaxBlockLag(1*time.Second),
+		light.SkippingVerification(minimumTrustLevel),
 	)
 	require.NoError(t, err)
 
@@ -327,6 +330,7 @@ func TestClientDivergentTraces1(t *testing.T) {
 		dbs.New(dbm.NewMemDB(), chainID),
 		light.Logger(log.TestingLogger()),
 		light.MaxRetryAttempts(1),
+		light.SkippingVerification(minimumTrustLevel),
 	)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "does not match primary")
@@ -351,6 +355,7 @@ func TestClientDivergentTraces2(t *testing.T) {
 		dbs.New(dbm.NewMemDB(), chainID),
 		light.Logger(log.TestingLogger()),
 		light.MaxRetryAttempts(1),
+		light.SkippingVerification(minimumTrustLevel),
 	)
 	require.NoError(t, err)
 
@@ -422,6 +427,7 @@ func TestClientDivergentTraces4(t *testing.T) {
 		[]provider.Provider{witness},
 		dbs.New(dbm.NewMemDB(), chainID),
 		light.Logger(log.TestingLogger()),
+		light.SkippingVerification(minimumTrustLevel),
 	)
 	require.NoError(t, err)
 

light/verifier.go

@@ -10,11 +10,19 @@ import (
 	"github.com/tendermint/tendermint/types"
 )
 
-var (
-	// DefaultTrustLevel - new header can be trusted if at least one correct
-	// validator signed it.
-	DefaultTrustLevel = tmmath.Fraction{Numerator: 1, Denominator: 3}
-)
+// DefaultTrustLevel - We default to assuming that 2/3 in voting power of the validator set must be in common
+// between the trusted and untrusted validator set. Guarantees at least 1/3 honest validators signed.
+//
+// Trust level must at minimum be greater than 1/3 and less than or equal to 1. Assuming that
+// 1/3 or less of the validator set are byzantine (Tendermint's standard security gaurantee), this equates
+// to at least 1 honest node that we can trust in the untrusted signer set.
+//
+// Practically speaking, a trust level greater than 2/3 does not provide signifcantly greater
+// security as a plethora of other attack vectors become apparent at that level of byzantine.
+// The lower the trust level the less amount of intermediary verification steps need to be taken
+// between a trusted header and untrusted header. This is also depedent on how much a validator
+// set changes. In chains with low turnover, 2/3 should be a good balance of speed and security.
+var DefaultTrustLevel = tmmath.Fraction{Numerator: 2, Denominator: 3}
 
 // VerifyNonAdjacent verifies non-adjacent untrustedHeader against
 // trustedHeader. It ensures that:

light/verifier_test.go

@@ -12,9 +12,9 @@ import (
 	"github.com/tendermint/tendermint/types"
 )
 
-const (
-	maxClockDrift = 10 * time.Second
-)
+const maxClockDrift = 10 * time.Second
+
+var minimumTrustLevel = tmmath.Fraction{Numerator: 1, Denominator: 3}
 
 func TestVerifyAdjacentHeaders(t *testing.T) {
 	const (
@@ -271,7 +271,7 @@ func TestVerifyNonAdjacentHeaders(t *testing.T) {
 		t.Run(fmt.Sprintf("#%d", i), func(t *testing.T) {
 			err := light.VerifyNonAdjacent(header, vals, tc.newHeader, tc.newVals, tc.trustingPeriod,
 				tc.now, maxClockDrift,
-				light.DefaultTrustLevel)
+				minimumTrustLevel)
 
 			switch {
 			case tc.expErr != nil && assert.Error(t, err):