Skip to content

fix(sequencer): skip proposing when node has no connected peers - #25180

Closed
spalladino wants to merge 1 commit into
spl/slasher-no-peers-gatefrom
spl/sequencer-no-peers-gate
Closed

fix(sequencer): skip proposing when node has no connected peers#25180
spalladino wants to merge 1 commit into
spl/slasher-no-peers-gatefrom
spl/sequencer-no-peers-gate

Conversation

@spalladino

@spalladino spalladino commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

A validator running with a dead p2p stack (zero connected peers) still took its
turn as proposer. Two failure modes follow: the checkpoint proposal is broadcast
into the void, so committee attestations can never be collected and the slot is
burned; and an HA node holding enough committee seats to reach quorum with its
own attestations publishes a checkpoint whose tx data was never gossiped to
anyone, which is indistinguishable from data withholding and gets it slashed.

The proposer now checks p2p connectivity before entering the build path and
skips building when peerless, while still performing its L1 duties: governance
and slashing votes, prune, and invalidation all run via the existing
vote-and-prune fallback. The skipped slot is marked as attempted so the gate is
not re-evaluated on every work-loop tick, and the skip is recorded on the
checkpoint precheck metric with a no_peers reason.

The threshold is the new minPeersToPropose sequencer option
(SEQ_MIN_PEERS_TO_PROPOSE), defaulting to 1; setting it to 0 disables the gate.
Setups that disable p2p by config (sandbox, single node, automine) report
enabled: false and are unaffected, so they keep proposing with no peers.

Part of A-1701.


Part of a stacked-PR chain (bottom → top) hardening the node against running with a dead p2p stack; each PR targets the branch below it and the bottom targets merge-train/spartan-v5:

  1. fix(p2p): fail node startup when p2p service fails to start #25177 — fail node startup when the p2p service fails to start
  2. feat(p2p): expose p2p connectivity (enabled + connected peer count) #25178 — expose p2p connectivity (enabled + connected peer count)
  3. fix(slasher): do not file data-withholding offenses while peerless #25179 — do not file data-withholding offenses while peerless
  4. fix(sequencer): skip proposing when node has no connected peers #25180 — skip proposing when the node has no connected peers
  5. feat(node): report per-component health with p2p peer count on GET /status #25181 — report per-component health with p2p peer count on GET /status
  6. fix(node): reject sendTx when node has no peers to propagate the tx #25182 — reject sendTx when the node has no peers to propagate the tx
  7. feat(p2p): warn periodically while node has zero connected peers #25183 — warn periodically while the node has zero connected peers

A validator running with a dead p2p stack (zero connected peers) still took its
turn as proposer. Two failure modes follow: the checkpoint proposal is broadcast
into the void, so committee attestations can never be collected and the slot is
burned; and an HA node holding enough committee seats to reach quorum with its
own attestations publishes a checkpoint whose tx data was never gossiped to
anyone, which is indistinguishable from data withholding and gets it slashed.

The proposer now checks p2p connectivity before entering the build path and
skips building when peerless, while still performing its L1 duties: governance
and slashing votes, prune, and invalidation all run via the existing
vote-and-prune fallback. The skipped slot is marked as attempted so the gate is
not re-evaluated on every work-loop tick, and the skip is recorded on the
checkpoint precheck metric with a `no_peers` reason.

The threshold is the new `minPeersToPropose` sequencer option
(`SEQ_MIN_PEERS_TO_PROPOSE`), defaulting to 1; setting it to 0 disables the gate.
Setups that disable p2p by config (sandbox, single node, automine) report
`enabled: false` and are unaffected, so they keep proposing with no peers.

Part of A-1701.
@spalladino

Copy link
Copy Markdown
Contributor Author

Superseded by #25185, which groups this stack's dependent layers (connectivity signal + slasher/proposer/health/sendTx gates) into one PR with a commit per concern, targeting merge-train/spartan-v5 directly. The independent fixes remain as #25177 and #25183.

@spalladino spalladino closed this Aug 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant