fix(consensus): three minimal audit fixes (#67, #41, #43)

[keanji-x]

Summary

Combined PR — three minimal surgical fixes for gravity-audit findings in the vendored aptos-core consensus crate. Supersedes #726 and #727.

Commit 1 — gravity-audit#67 (Critical)

IncrementalProofState::take() panicked via unreachable!() when BLS signature aggregation failed (legitimately reachable after a validator-set rotation), crashing the ProofCoordinator task and halting consensus. Changed return type to Result<ProofOfStore, SignedBatchInfoError>, added SignedBatchInfoError::UnableToAggregate, propagated ? at the one caller in add_signature.

Commit 2 — gravity-audit#41 (Critical) + #43 (High)

• fix: make chain id u64 in aptos #41: PendingOrderVotes had no per-author tracking, so a Byzantine validator could vote for conflicting LedgerInfo digests and have its voting power counted in each bucket. Added author_to_li_digest: HashMap<Author, HashValue> mirroring PendingVotes::insert_vote, equivocation detection with SecurityEvent::ConsensusEquivocatingVote log, GC of the new map alongside existing entries.
• [enhancement]: make consensus crate pub and remove some unused import #43: process_order_vote_msg was the only message handler not calling ensure_round_and_sync_up. Since OrderVoteMsg carries no SyncInfo, added a snapshot of highest_ordered_round before new_qc_from_order_vote_msg runs, and a MAX_ORDER_VOTE_ROUND_JUMP = 3 guard rejecting order votes that jump past that window via the embedded QC.

Why minimal (not full upstream backports)

• [fix]: fix safe hash in forchChoiceUpdate #67 ⟸ upstream aptos-core#14644 refactors the whole signature-aggregator path (~466 lines of conflicts here).
• fix: make chain id u64 in aptos #41 + [enhancement]: make consensus crate pub and remove some unused import #43 ⟸ upstream aptos-core#14637 reshapes li_digest_to_votes into a (QuorumCert, OrderVoteStatus) map and plumbs verified_quorum_cert through the call chain (~164 lines of conflicts).

These PRs port only the security-bearing slices.

Notable deviations the reviewer should check

• MAX_ORDER_VOTE_ROUND_JUMP = 3 — chosen to avoid breaking pipelined ordering; reviewer should confirm the window is safe vs. legitimate sync flows.
• Round-jump log uses SecurityEvent::ConsensusInvalidMessage (the variant epoch_manager.rs already uses); InvalidConsensusVote does not exist in the codebase.
• author_to_li_digest insert is inside the NotEnoughVotes arm after the unknown-author filter — unknown authors are already rejected at UnverifiedEvent::verify upstream, so this keeps the equivocation map clean.
• No DuplicateVote variant added — existing add_signature path is already idempotent and the existing order_vote_aggregation test asserts VoteAdded for the duplicate case.

Test plan

• cargo check --tests passes.
• cargo clippy --all-targets --all-features -- -D warnings passes (1 pre-existing warning in aptos-executor-types, unrelated).
• pending_order_votes::tests::order_vote_aggregation passes — direct coverage of the modified insert_order_vote.
• Reviewer: round_manager_test::* and proof_coordinator_test::test_proof_coordinator_basic cannot run locally — they hit pre-existing todo!() stubs in mock_storage.rs:119 and proof_coordinator_test.rs:65 on origin/main. Out of scope for this PR.
• Reviewer: confirm MAX_ORDER_VOTE_ROUND_JUMP = 3 is safe.

Diff

4 files changed, 112 insertions(+), 12 deletions(-)

🤖 Generated with Claude Code