#233: input validation error reported as fatal

[m2ux]

Summary

Stop pallet-cnight-observation from emitting a "Fatal" log line for Dust registrations whose DustPublicKey byte payload is the wrong scalar value; validate at the inherent boundary (consensus-gated by a CNightObservationApi v2 → v3 bump) and narrow the legacy log severity in the pallet so misleading "Fatal" lines disappear on both new and old runtimes.

🐛 Issue 📐 Engineering

Jira: PM-22301

---

Motivation

A Dust registration submitted on Cardano with a DustPublicKey whose 33-byte payload is the right length but whose decoded value lies outside the cryptographic field Fr is stored in Mappings::<T> unchanged: the data source's only structural check is a length bound, and the pallet's handle_registration writer never invokes the ledger bridge. The field-range failure surfaces much later, when a subsequent AssetCreate event triggers LedgerApi::construct_cnight_generates_dust_event(...). The ledger bridge logs Error deserializing: "midnight_ledger::dust::DustPublicKey": ... out of range for Fr at error severity, and the pallet then logs Fatal: Unable to construct CNightGeneratesDustEvent: ....

Operationally the chain is unaffected — handle_create returns None, the per-UTXO loop in process_tokens discards None results, block production continues. But the log severity is wrong: the word "Fatal" trains on-call engineers to escalate, and severity-keyed monitoring pipelines do the same. The fix moves field-range validation to the inherent-data-provider boundary so invalid registrations never enter chain state, and narrows the pallet's log line so the legacy path (old runtime on a new binary during the upgrade window) also stops mis-labelling the recoverable case.

---

Changes

Implementation (landed):

• Validator — added pub fn dust_public_key_is_valid(bytes: &[u8]) -> bool to ledger/src/versions/common/api/mod.rs. Calls <DustPublicKey as Deserializable>::deserialize directly so no log::error! side effect fires on failure. (commit 39da76b3)
• Runtime API — bumped CNightObservationApi from #[api_version(2)] to #[api_version(3)] at primitives/cnight-observation/src/lib.rs:397. Doc comment expanded alongside the v1/v2 history to record the IDP-filter rationale. (commit c7cfdf5c)
• Inherent data provider — MidnightCNightObservationInherentDataProvider::new now calls a free function filter_invalid_dust_public_key_registrations against the data-source UTXOs. At api_version >= 3 invalid ObservedUtxoData::Registration entries are dropped with a log::debug! recording the Cardano reward address and hex-encoded bytes; at api_version <= 2 legacy pass-through is preserved. The filter is factored out so unit tests run without a ProvideRuntimeApi<Block> mock. midnight-primitives-mainchain-follower picks up midnight-node-ledger and hex as direct std-feature dependencies. (commit 62d66054)
• Pallet log overlay — narrowed handle_create (:528-537) and handle_spend (:569-575) Err(e) arms. LedgerApiError::Deserialization(DeserializationError::DustPublicKey) logs at debug with a Skipping AssetCreate/AssetSpend ... prefix; every other variant logs at warn (no error). The Fatal: substring is dropped throughout. (commit fcbf6da6)
• Change file — changes/runtime/changed/dust-public-key-fatal-validation.md recording the API version bump, the IDP filter gate, the log-downgrade overlay, and the explicit decision not to migrate existing storage entries. (commit 41611b6c)
• Tests — validator unit tests at ledger/src/versions/common/api/mod.rs (round-trip valid key + three reject paths, commit cb45ebc9); IDP filter unit tests at primitives/mainchain-follower/src/idp/cnight_observation.rs for v2 pass-through, v3 drop, variant scoping, ordering preservation (commit 0f04c992); pallet integration tests at pallets/cnight-observation/tests/tests.rs covering handle_spend invalid-key path and batch tolerance through process_tokens (commit 18527afc).
• Local validation — cargo fmt --check, cargo build, and cargo clippy --no-deps --tests -- -D warnings all clean on midnight-node-ledger, midnight-primitives-cnight-observation, midnight-primitives-mainchain-follower, pallet-cnight-observation. Test execution is operator-only per local convention (cargo test OOMs the agent host). (commit 2b284007)

Out of scope: storage purge of any pre-existing invalid registrations on testnet; extension of IDP-level validation to other DeserializationError variants; throttle pallet rate-limiting for spam.

---

📌 Submission Checklist

• Changes are backward-compatible (or flagged if breaking)
• Pull request description explains why the change is needed
• Self-reviewed the diff
• I have included a change file, or skipped for this reason: [reason]
• If the changes introduce a new feature, I have bumped the node minor version
• Update documentation (if relevant)
• No new todos introduced

---

🔱 Fork Strategy

• Node Runtime Update
• Node Client Update
• Other
• N/A

---

🗹 TODO before merging

• Ready for review