[Context] Issues caused by improper output signatures of provable store readers #607
Labels
A: critical
Admin: critical or Important
O: logic
Objective: aims for better implementation logic
O: security
Objective: aims to enhance security and improve safety
S: errors
Scope: related to error handlings
Problem Statement
There is a discrepancy between the output signature/type of methods (under
ValidationContext
) that retrieve datagrams from a provable store, e.g.:next_consensus_state
andprev_consensus_state
interfaces we haveResult<Option<Output>, ContextError>
Result<Output, ContextError>
typeMeaning sometimes we denote unavailability with
None
and other times as anError
Why does this matter and should a consistent approach be taken? and clearly differentiate cases where an output represents (1) existence/absence of a state in storage and any other errors that show (2) failure scenarios (like broken storage, etc) when performing a query?
Looking into the acceptable absences
There are places we operate based on a lack of datagrams and treat them as an expected/acceptable execution route, like:
get_packet_commitment
get_packet_acknowledgment
get_packet_receipt
call, we should act afterward.ClientStatePath
is empty during client creation #605, where theClientStateNotFound
is a valid case, shouldn't be treated as an error. In contrast,ClientStateAlreadyExists
correctly represents the existence error.Needing self-contained approach
The correctness of our operations relies on implementors. Hoping they select the right error variant and do not use any other errors under the
ContextError
enum, too. E.g. hereMoving towards errors with concerns separated
This is consistent with the view presented here splitting errors into categories of protocol-specific and host-related errors, where:
Option<Output>
concerned only with the IBC implementationResult<Option<Output>, Error>
type that occurred in hosts' boundaryAvoiding side effects
And, with the current signature, our error system becomes useless and fails to propagate the correct failure reason in a bunch of places, as we eventually map them to our assumed/desired errors like here & here
Proposal
Result<Option<Output>, Error>
signature for the reader methods (It might not apply to all, but seems like it should)Result<Result<Output, ProtocolError> HostError>
instead?ProtocolError
everywhere, which must be exactly the same as the one we defined to represent that non-existence case. (means they have no other options). This shouldn't be their concern and better to be handled internally.Remark
Error
enums less specific #270 due to critical issues associated with this and needs to be fixed before that. We are unsure how different hosts have handled errors, and some of their error scenarios may bypass the cases mentioned above, particularly during packet processings.The text was updated successfully, but these errors were encountered: