Skip to content

topology: replace gossip pre-verification swarm with verify-on-first-dial #226

Description

@mfw78

Summary

Vertex currently verifies every gossiped peer record by dialling the peer on a separate ephemeral-identity swarm and running a full handshake before the peer is admitted to the known table. This design was flagged by all three reviews of the depth-deadlock fix (#225) as the largest remaining structural smell in the discovery path. It should be replaced by collapsing verification into the first real dial.

Problems with the current design

  1. Double handshake. Every peer that we eventually connect to pays two complete handshakes: one on the verification swarm and one on the real swarm. This doubles ECDSA work for both sides and doubles our connection visibility on the network.
  2. Cold-start delay. The known table only fills as fast as the verification swarm can churn through the gossip backlog, which adds minutes of warm-up before candidate selection has real supply. The depth climb measured on mainnet only starts once verification throughput catches up with gossip intake.
  3. Re-verification churn against bee 2.8.0. Bee 2.8.0 re-signs gossip records on every broadcast (fixed upstream in fix(handshake): reuse session-stable signed BzzAddress ethersphere/bee#5493), so the same peer arrives with a fresh signature repeatedly and is re-verified each time. Without a cooldown this wastes verification capacity on peers we already know.
  4. Ephemeral identity is a fingerprint. A node that handshakes with a throwaway identity and immediately disconnects is trivially identifiable as a vertex prober and contributes nothing to the network.

Proposed direction

Admit gossiped records into the known table as an unverified tier. Candidate selection may dial unverified peers; a successful real handshake both verifies and connects in one round trip. A failed dial demotes or expires the record exactly as it does today. Records that update an existing verified peer only need signature validation, not a dial. Add a per-peer cooldown so re-signed records from bee 2.8.0 peers do not trigger re-processing more than once per interval.

This removes the verification swarm entirely, removes the warm-up delay, halves handshake cost on the happy path, and makes our connection behaviour indistinguishable from a normal node.

Scope

  • crates/swarm/topology (gossip intake, candidate selection eligibility).
  • crates/swarm/peers/peer-manager (known-table tiers, record update path).
  • Docs: docs/swarm/hive-gossip.md, docs/networking/peer-management.md.

References

Review follow-up from #225. Related upstream behaviour: ethersphere/bee#5493 (gossip re-signing churn).

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions