Least Authority audit follow-up: S03A - harden FROST stream lifecycle and DKG delivery

ZlyDevMayarequested to merge
zly/s03a-frost-stream-lifecycle-retries into develop

Context

This MR is part of the S series tracked in the XMR v3.21.0 launch plan. This MR is S03A part of the S series tracked in the [XMR v3.21.0 launch plan](https://gitlab.com/thorchain/thornode/-/snippets/6058894 and follows up on feedback from Least Authority’s XMR audit review.

Least Authority recommended enabling delivery retries for FROST keygen round 1–3 payloads and the final result. This MR implements that recommendation and completes the related stream-lifecycle behavior needed to make retries and ceremony cleanup predictable.

Earlier MRs in the series address out-of-order message retention, verification batching, and bounded transport queues. This follow-up focuses on reliable delivery, ownership, participant scope, and cleanup.

Changes

  • Retry FROST DKG round 1, round 2, round 3, and result delivery.
  • Use a fresh stream for each retry and allow at most three delivery attempts.
  • Keep verification echoes on their existing quorum-based delivery path.
  • Reserve each expected FROST message before waiting for its delivery.
  • Give each reservation a single terminal owner responsible for completion or cancellation.
  • Close local stream state without waiting for remote EOF, then drain the stream in the background.
  • Restrict keysign subscriptions monotonically as unavailable participants are removed.
  • Fail keysign closed if the remaining participants cannot satisfy the signing threshold.
  • Keep FROST keygen scoped to the complete deterministic participant set required by DKG.

Series integration

This MR builds on the preceding XMR FROST branches rather than introducing a standalone production change. The complete series is expected to be reviewed, merged, and deployed together after the combined design has been accepted.

No mixed-version negotiation or ceremony-resume compatibility is included. XMR FROST keygen will remain disabled until every intended participant runs the same reviewed build.

https://gitlab.com/thorchain/thornode-private/-/merge_requests/28 / S03B contains the private companion fix for atomic release in the shared TSS stream manager.

Edited by ZlyDevMaya

Merge request reports