Reject compromised blocks and harden rollback recovery

[Frozen]

Summary

• reject the compromised shard 0 block 92730036 and shard 1 block 94978279 by exact hash
• pin the retained pre-incident block hash and state root at shard 0 block 92730035 and shard 1 block 94978278
• reject locally available abandoned ancestry while tolerating pruned deep history
• enforce the guards in consensus, header/body verification, full/receipt imports, epoch-chain imports, head updates, and TiKV fast-forward
• re-run incoming CX receipt proof validation even when an import path skips header verification
• prevent staged sync from treating stale block bodies as canonical progress
• apply the incident constants only on mainnet

MaxBlocksPerSyncCycle wiring was split into #12.

[Test]

• go test -mod=readonly ./consensus/engine ./internal/chain ./consensus ./core ./api/service/synchronize/stagedstreamsync
• go vet -mod=readonly ./consensus/engine ./internal/chain ./consensus ./core ./api/service/synchronize/stagedstreamsync
• git diff --check origin/main...HEAD

[greptile-apps]

Greptile Summary

The PR adds an exact shard, height, and hash denylist for two compromised mainnet blocks and enforces it across consensus verification and blockchain ingress paths.

• Adds a shared rejected-block validator and focused unit tests.
• Rejects compromised headers, signatures, cross-links, block bodies, and chain writes.
• Adds validation directly to the TiKV fast-forward path before it mutates any in-memory heads.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
consensus/engine/rejected_block.go	Defines exact denylist entries and the shared validation error used by consensus and storage paths.
internal/chain/engine.go	Applies denylist validation to header, signature, and cross-link verification.
core/blockchain_impl.go	Enforces rejection across block ingress paths and fixes the previously reported TiKV fast-forward bypass before head mutation.
core/epochchain.go	Prevents denylisted blocks from entering or becoming heads of the epoch chain.
core/block_validator.go	Rejects denylisted blocks during body validation.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Incoming block or header] --> B{Exact shard, height, and hash denylisted?}
    B -- Yes --> C[Return ErrRejectedBlock]
    B -- No --> D[Continue consensus or ingress validation]
    C --> E[Do not update canonical or in-memory heads]
    D --> F[Normal verification and persistence]

Loading

_{Reviews (3): Last reviewed commit: "Reject compromised mainnet block hashes" | Re-trigger Greptile}