From 413728c3675111cdf3981a59d20689479cf1c210 Mon Sep 17 00:00:00 2001
From: Callum Waters <cmwaters19@gmail.com>
Date: Mon, 12 Sep 2022 13:30:34 +0200
Subject: [PATCH] light: update default trust level to 2/3

---
 light/detector_test.go |  8 +++++++-
 light/verifier.go      | 18 +++++++++++++-----
 light/verifier_test.go |  8 ++++----
 3 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/light/detector_test.go b/light/detector_test.go
index caec5e8e2..8999fdd2d 100644
--- a/light/detector_test.go
+++ b/light/detector_test.go
@@ -57,6 +57,7 @@ func TestLightClientAttackEvidence_Lunatic(t *testing.T) {
 		dbs.New(dbm.NewMemDB(), chainID),
 		light.Logger(log.TestingLogger()),
 		light.MaxRetryAttempts(1),
+		light.SkippingVerification(minimumTrustLevel),
 	)
 	require.NoError(t, err)
 
@@ -92,7 +93,7 @@ func TestLightClientAttackEvidence_Lunatic(t *testing.T) {
 func TestLightClientAttackEvidence_Equivocation(t *testing.T) {
 	verificationOptions := map[string]light.Option{
 		"sequential": light.SequentialVerification(),
-		"skipping":   light.SkippingVerification(light.DefaultTrustLevel),
+		"skipping":   light.SkippingVerification(minimumTrustLevel),
 	}
 
 	for s, verificationOption := range verificationOptions {
@@ -230,6 +231,7 @@ func TestLightClientAttackEvidence_ForwardLunatic(t *testing.T) {
 		light.Logger(log.TestingLogger()),
 		light.MaxClockDrift(1*time.Second),
 		light.MaxBlockLag(1*time.Second),
+		light.SkippingVerification(minimumTrustLevel),
 	)
 	require.NoError(t, err)
 
@@ -297,6 +299,7 @@ func TestLightClientAttackEvidence_ForwardLunatic(t *testing.T) {
 		light.Logger(log.TestingLogger()),
 		light.MaxClockDrift(1*time.Second),
 		light.MaxBlockLag(1*time.Second),
+		light.SkippingVerification(minimumTrustLevel),
 	)
 	require.NoError(t, err)
 
@@ -327,6 +330,7 @@ func TestClientDivergentTraces1(t *testing.T) {
 		dbs.New(dbm.NewMemDB(), chainID),
 		light.Logger(log.TestingLogger()),
 		light.MaxRetryAttempts(1),
+		light.SkippingVerification(minimumTrustLevel),
 	)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "does not match primary")
@@ -351,6 +355,7 @@ func TestClientDivergentTraces2(t *testing.T) {
 		dbs.New(dbm.NewMemDB(), chainID),
 		light.Logger(log.TestingLogger()),
 		light.MaxRetryAttempts(1),
+		light.SkippingVerification(minimumTrustLevel),
 	)
 	require.NoError(t, err)
 
@@ -422,6 +427,7 @@ func TestClientDivergentTraces4(t *testing.T) {
 		[]provider.Provider{witness},
 		dbs.New(dbm.NewMemDB(), chainID),
 		light.Logger(log.TestingLogger()),
+		light.SkippingVerification(minimumTrustLevel),
 	)
 	require.NoError(t, err)
 
diff --git a/light/verifier.go b/light/verifier.go
index 2ec02e877..1424e15e8 100644
--- a/light/verifier.go
+++ b/light/verifier.go
@@ -10,11 +10,19 @@ import (
 	"github.com/tendermint/tendermint/types"
 )
 
-var (
-	// DefaultTrustLevel - new header can be trusted if at least one correct
-	// validator signed it.
-	DefaultTrustLevel = tmmath.Fraction{Numerator: 1, Denominator: 3}
-)
+// DefaultTrustLevel - We default to assuming that 2/3 in voting power of the validator set must be in common
+// between the trusted and untrusted validator set. Guarantees at least 1/3 honest validators signed.
+//
+// Trust level must at minimum be greater than 1/3 and less than or equal to 1. Assuming that
+// 1/3 or less of the validator set are byzantine (Tendermint's standard security gaurantee), this equates
+// to at least 1 honest node that we can trust in the untrusted signer set.
+//
+// Practically speaking, a trust level greater than 2/3 does not provide signifcantly greater
+// security as a plethora of other attack vectors become apparent at that level of byzantine.
+// The lower the trust level the less amount of intermediary verification steps need to be taken
+// between a trusted header and untrusted header. This is also depedent on how much a validator
+// set changes. In chains with low turnover, 2/3 should be a good balance of speed and security.
+var DefaultTrustLevel = tmmath.Fraction{Numerator: 2, Denominator: 3}
 
 // VerifyNonAdjacent verifies non-adjacent untrustedHeader against
 // trustedHeader. It ensures that:
diff --git a/light/verifier_test.go b/light/verifier_test.go
index 9e10810b2..bf45e1eea 100644
--- a/light/verifier_test.go
+++ b/light/verifier_test.go
@@ -12,9 +12,9 @@ import (
 	"github.com/tendermint/tendermint/types"
 )
 
-const (
-	maxClockDrift = 10 * time.Second
-)
+const maxClockDrift = 10 * time.Second
+
+var minimumTrustLevel = tmmath.Fraction{Numerator: 1, Denominator: 3}
 
 func TestVerifyAdjacentHeaders(t *testing.T) {
 	const (
@@ -271,7 +271,7 @@ func TestVerifyNonAdjacentHeaders(t *testing.T) {
 		t.Run(fmt.Sprintf("#%d", i), func(t *testing.T) {
 			err := light.VerifyNonAdjacent(header, vals, tc.newHeader, tc.newVals, tc.trustingPeriod,
 				tc.now, maxClockDrift,
-				light.DefaultTrustLevel)
+				minimumTrustLevel)
 
 			switch {
 			case tc.expErr != nil && assert.Error(t, err):