Skip to content

feat(sequencer): catchup from base#3057

Draft
julienrbrt wants to merge 8 commits intomainfrom
julien/catchup-base
Draft

feat(sequencer): catchup from base#3057
julienrbrt wants to merge 8 commits intomainfrom
julien/catchup-base

Conversation

@julienrbrt
Copy link
Member

Closes: #3016

Opus did a pretty good job. I'll be improving it.

@github-actions
Copy link
Contributor

github-actions bot commented Feb 9, 2026

The latest Buf updates on your PR. Results from workflow CI / buf-check (pull_request).

BuildFormatLintBreakingUpdated (UTC)
✅ passed⏩ skipped✅ passed✅ passedFeb 11, 2026, 12:28 PM

@claude
Copy link
Contributor

claude bot commented Feb 9, 2026

Claude finished @julienrbrt's task in 2m 29s —— View job


Code Review Complete

Completed comprehensive code review of the sequencer catch-up mechanism implementation.

Tasks

  • Read and understand the catch-up implementation in syncer.go
  • Review sequencer.go catch-up state management
  • Analyze test coverage and edge cases
  • Verify critical issues (timestamp monotonicity, data races)
  • Review code quality, error handling, and Go idioms
  • Assess security and performance implications
  • Provide actionable feedback

Review Summary

This PR implements a well-thought-out catch-up mechanism for the sequencer, with comprehensive test coverage. The syncer implementation for incremental DA height advancement is solid. However, there is a critical data race issue in the single sequencer implementation that must be addressed before merging.

Critical Issues 🔴

1. Data Race on currentDAEndTime (sequencer.go:70, 370, 485)

Severity: High - Potential for undefined behavior and corrupted timestamps

The currentDAEndTime field is accessed concurrently without synchronization:

  • Write access: Line 485 in fetchNextDAEpoch() (called from block production loop)
  • Read access: Line 370 in GetNextBatch() (called from block production loop)
  • Concurrent read: IsCatchingUp() method (line 433) can be called by RPC handlers, metrics, or monitoring

While the production loop may be single-threaded, IsCatchingUp() is a public method that can be called concurrently. Additionally, time.Time is a struct (not atomic), so concurrent read/write access violates Go's memory model and constitutes undefined behavior.

Impact: Race detector will flag this. Corrupted timestamp reads could lead to invalid block timestamps, causing execution layer rejection.

Fix Required:

// Option 1: Use atomic.Pointer[time.Time]
currentDAEndTime atomic.Pointer[time.Time]

// Write: c.currentDAEndTime.Store(&timestamp)
// Read: if t := c.currentDAEndTime.Load(); t != nil { ... }

// Option 2: Use mutex protection
mu sync.RWMutex
currentDAEndTime time.Time // protected by mu

Fix data race →


Major Issues 🟡

2. Timestamp Monotonicity Analysis (sequencer.go:366-378)

Status: Implementation is CORRECT

After detailed analysis, the timestamp jitter calculation is correct and maintains monotonicity:

The formula timestamp = daEndTime.Add(-time.Duration(remainingForcedTxs) * time.Millisecond) uses remainingForcedTxs calculated AFTER checkpoint update (line 335). This ensures:

  • Block N: remaining = total - consumed_so_far → decreases each block
  • Timestamps become less negative (increase) with each block
  • Final block has remaining = 0 → exact daEndTime

Example with 3 txs:

  • Block 0: consume 1 → remaining=2 → T-2ms
  • Block 1: consume 1 → remaining=1 → T-1ms
  • Block 2: consume 1 → remaining=0 → T

The test TestSequencer_CatchUp_MonotonicTimestamps validates this thoroughly. No issue here.

However, there's a minor edge case concern: If an empty epoch is encountered, currentDAEndTime is NOT updated (line 484-486 only updates when timestamp is non-zero). This could theoretically cause the next epoch to reuse an older timestamp if the DA layer returns an empty epoch with a zero timestamp. The test TestSequencer_CatchUp_MonotonicTimestamps_EmptyEpoch should verify this scenario.

3. Magic Constants (sequencer.go:376, 569)

Severity: Medium - Readability & Maintainability

  • Line 376: time.Millisecond jitter multiplier
  • Line 569: missedEpochs <= 1 threshold for catch-up detection

These values should be named constants with documentation explaining their significance:

const (
    // catchUpTimestampJitterInterval is the time interval subtracted per remaining
    // forced inclusion transaction to ensure monotonic timestamps during catch-up.
    // Must match based sequencer jitter interval.
    catchUpTimestampJitterInterval = time.Millisecond
    
    // catchUpEpochThreshold is the maximum number of epochs the sequencer can be
    // behind before entering catch-up mode. Being within one epoch is considered
    // normal operation.
    catchUpEpochThreshold = 1
)

Fix magic constants →


Code Quality Issues 🟢

4. Test Logger Inconsistency (sequencer_test.go:1309, 1457, 1676)

Severity: Low - Developer Experience

Several catch-up tests use zerolog.New(zerolog.NewConsoleWriter()) which produces verbose console output during test runs. Other tests in the same file correctly use zerolog.New(zerolog.NewTestWriter(t)) which only shows logs for failed tests.

Recommendation: Use zerolog.NewTestWriter(t) consistently across all new tests for better developer experience.

// Before:
logger := zerolog.New(zerolog.NewConsoleWriter())

// After:
logger := zerolog.New(zerolog.NewTestWriter(t))

5. Documentation Quality

Status: Good

The catch-up mechanism is well-documented:

  • Clear inline comments explaining the logic (lines 57-70, 436-442, 517-532)
  • Comprehensive test coverage with descriptive names
  • CHANGELOG.md updated with implementation details

Architecture & Design Review

Strengths ✅

  1. Modular Design: Catch-up logic cleanly separated between syncer (verification) and sequencer (production)

  2. Defensive Programming: Proper error handling, context cancellation support

  3. Idempotency: Checkpoint-based recovery ensures crash safety

  4. Test Coverage: Excellent coverage of edge cases including:

    • Multi-epoch replay
    • Empty epochs
    • Gas and size limit interactions
    • Checkpoint advancement during catch-up
    • Exit conditions (HeightFromFuture, recent epoch)
  5. DA Height Synchronization Logic (syncer.go:760-806): The incremental epoch advancement during catch-up is well-designed and properly documented. This prevents forced inclusion verification from checking the wrong epoch.

  6. Timestamp Alignment: The jitter mechanism (T - remaining*1ms) correctly mimics based sequencer behavior, ensuring nodes produce identical blocks during replay.

Areas for Improvement

  1. GetLatestDAHeight Call Frequency (sequencer.go:548): Currently called once per sequencer lifecycle in updateCatchUpState(). Consider caching or rate-limiting if this becomes a performance concern with high-latency DA layers.

  2. Error Handling for Timestamp Fetch (client.go:186-196, 224-229, 262-267): Multiple TODOs indicate timestamp fetch failures fall back to time.Now(). This could break determinism for based sequencers. Consider:

    • Retry logic with exponential backoff
    • Failing the retrieve operation entirely if timestamp is critical
    • Documenting when time.Now() fallback is acceptable
  3. Forced Inclusion Namespace Validation (sequencer.go:539-543): Early return if DAEpochForcedInclusion == 0 prevents unnecessary DA queries. Good optimization.


Security Analysis

Potential Issues

  1. DoS via Malformed Forced Inclusion Transactions:

    • Syncer filters invalid forced txs using FilterTxs (syncer.go:1034-1045) ✅
    • Sequencer validates tx size (sequencer.go:492-501) ✅
    • Protection against oversized blobs is adequate
  2. Timestamp Manipulation:

    • Timestamps come from DA layer headers (deterministic) ✅
    • Fallback to time.Now() could be exploited if DA layer is compromised, but this is documented and acceptable for the threat model
  3. Checkpoint Corruption:

    • Checkpoint is persisted after each update (sequencer.go:349) ✅
    • Recovery logic handles missing checkpoints (sequencer.go:110-118) ✅

No critical security vulnerabilities identified.


Performance Considerations

  1. GetLatestDAHeight Call: Lightweight operation called once per lifecycle. No concern.

  2. Epoch Replay Cost: During catch-up, the sequencer fetches and processes historical DA epochs sequentially. For long downtimes, this could be slow. Consider:

    • Progress logging (already present at line 504-510) ✅
    • Parallel DA fetches if DA client supports it (future optimization)
  3. Memory Usage: cachedForcedInclusionTxs holds entire epoch's transactions in memory. For large epochs, this could be significant. However:

    • Transactions are cleared after epoch completion (line 342) ✅
    • Individual tx size is validated (line 492) ✅
    • Risk is acceptable given blob size limits

No performance bottlenecks identified for typical use cases.


Recommendations

Must Fix Before Merge 🔴

  1. Fix data race on currentDAEndTime using atomic.Pointer[time.Time] or mutex protection

Should Fix Before Merge 🟡

  1. Extract magic constants for jitter interval and epoch threshold with documentation
  2. Verify empty epoch handling doesn't cause timestamp reuse (add test case or verify existing coverage)

Nice to Have 🟢

  1. Standardize test loggers to use NewTestWriter(t) for consistency
  2. Consider retry logic for DA timestamp fetch failures (address TODOs in client.go)

Conclusion

This is a well-designed and thoroughly tested implementation of a critical feature. The catch-up mechanism is architecturally sound, with excellent test coverage and documentation. The syncer-side logic is production-ready.

However, the data race on currentDAEndTime is a blocking issue that must be fixed before merge. Without proper synchronization, this will fail race detection in CI and could cause undefined behavior in production.

After fixing the data race, this PR will be ready for merge with high confidence.


Additional Context

  • Gemini Code Assist Review: Gemini identified the same timestamp monotonicity concern I initially investigated. However, after detailed code analysis and test review, I've verified the implementation is correct. Gemini's concern about "multiple blocks per epoch having same timestamp" is not accurate — the jitter mechanism ensures strictly increasing timestamps.

  • Gemini's data race concern is valid and aligns with my findings.

  • Codecov: 63.89% patch coverage is reasonable. The uncovered lines are mostly in tracing.go (observability) and error paths in client.go.

@gemini-code-assist
Copy link
Contributor

Summary of Changes

Hello @julienrbrt, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request implements a critical "catch-up" feature for the sequencer, designed to enhance its resilience and consistency following periods of inactivity or downtime. By intelligently replaying missed Data Availability (DA) epochs, the sequencer can resynchronize its state, ensuring that all forced inclusion transactions are processed in the correct order and with accurate timestamps, thereby maintaining a consistent view of the blockchain's history, even when operating in a decentralized environment. This mechanism allows the sequencer to seamlessly transition back to normal operation without compromising data integrity.

Highlights

  • Sequencer Catch-up Mechanism: Introduced a new mechanism allowing the sequencer to "catch up" on missed Data Availability (DA) epochs after extended downtime.
  • Forced Inclusion Priority: During catch-up, the sequencer temporarily processes only forced inclusion transactions, ensuring consistency with base sequencing nodes and temporarily skipping mempool transactions.
  • DA Height Synchronization: Modified syncer.go to incrementally advance the DAHeight by one epoch during catch-up, preventing issues with forced inclusion transaction verification.
  • Timestamp Alignment: Block timestamps generated during catch-up are now aligned with the DA epoch's end timestamp for historical accuracy.
  • Comprehensive Testing: Added extensive unit tests covering various catch-up scenarios, including detection, mempool skipping, timestamp usage, exit conditions, and multi-epoch replay.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog
  • block/internal/syncing/syncer.go
    • Updated the logic for DAHeight updates to handle large discrepancies between event.DaHeight and newState.DAHeight. When a significant gap (more than one epoch) is detected, newState.DAHeight is now advanced by exactly one epoch per block, rather than jumping directly to event.DaHeight. This ensures correct verification of forced inclusion transactions during sequencer catch-up.
    • Added detailed comments explaining the new DAHeight update strategy and its importance for catch-up blocks and forced inclusion verification.
  • pkg/sequencers/single/sequencer.go
    • Added catchingUp (boolean) and currentDAEndTime (time.Time) to the Sequencer struct to manage the catch-up state and store the DA epoch's end timestamp.
    • Modified GetNextBatch to conditionally skip fetching transactions from the mempool when the sequencer is in catchingUp mode. This ensures that only forced inclusion transactions are included in batches during catch-up.
    • Updated GetNextBatch to use sequencer.currentDAEndTime as the block timestamp when catchingUp is true, aligning block timestamps with the historical DA epoch.
    • Introduced a public IsCatchingUp() method to query the sequencer's current catch-up status.
    • Modified fetchNextDAEpoch to store the forcedTxsEvent.Timestamp in currentDAEndTime and to call a new updateCatchUpState method to manage the catchingUp flag. It also now exits catch-up mode if StatusHeightFromFuture is returned by the DA client.
    • Implemented a new private method updateCatchUpState that determines whether the sequencer should be in catch-up mode based on the timestamp of the fetched DA epoch. It enters catch-up if the epoch timestamp is significantly in the past (more than one epoch's wall-clock duration) and exits if it's recent.
  • pkg/sequencers/single/sequencer_test.go
    • Added a comprehensive suite of tests (TestSequencer_CatchUp_...) to validate the new catch-up functionality. These tests cover:
    • Detection of old epochs and entering catch-up mode.
    • Skipping mempool transactions during catch-up.
    • Using DA epoch timestamps for blocks during catch-up.
    • Exiting catch-up mode when the DA head is reached (either a recent epoch or HeightFromFuture).
    • Scenarios where catch-up is not triggered (recent epoch, no forced inclusion configured).
    • Multi-epoch replay scenarios.
    • Correct advancement of the internal checkpoint (DAHeight) during catch-up.
Activity
  • The pull request addresses and closes issue https://github.com/evstack/ev-node/issues/3016.
  • The author indicates that this work builds upon a previous attempt by "Opus", aiming for improvement.
Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment @gemini-code-assist Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution.

@codecov
Copy link

codecov bot commented Feb 9, 2026

Codecov Report

❌ Patch coverage is 64.54545% with 39 lines in your changes missing coverage. Please review.
✅ Project coverage is 61.97%. Comparing base (b92e97e) to head (a30ea68).

Files with missing lines Patch % Lines
block/internal/syncing/syncer.go 22.22% 13 Missing and 1 partial ⚠️
block/internal/da/tracing.go 0.00% 10 Missing ⚠️
block/internal/da/client.go 0.00% 9 Missing ⚠️
pkg/sequencers/single/sequencer.go 91.78% 4 Missing and 2 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #3057      +/-   ##
==========================================
+ Coverage   61.92%   61.97%   +0.04%     
==========================================
  Files         111      111              
  Lines       11113    11218     +105     
==========================================
+ Hits         6882     6952      +70     
- Misses       3492     3527      +35     
  Partials      739      739              
Flag Coverage Δ
combined 61.97% <64.54%> (+0.04%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a robust catch-up mechanism for the sequencer, designed to handle restarts after extended downtime. While the overall approach for consuming and verifying catch-up blocks in the syncer, including the incremental advancement of DAHeight, is well-implemented and tested, the implementation of catch-up mode in the single sequencer has significant flaws. Specifically, it produces non-monotonic block timestamps when multiple blocks are generated for a single DA epoch or when empty epochs are encountered, which will likely cause the execution layer to reject blocks and halt the chain. Additionally, there is a data race on the new catch-up state fields due to a lack of synchronization primitives. Minor suggestions for code clarity and testing experience were also noted.

Comment on lines 362 to 365
timestamp := time.Now()
if c.catchingUp && !c.currentDAEndTime.IsZero() {
timestamp = c.currentDAEndTime
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

During catch-up mode, the sequencer uses the timestamp from the last fetched DA epoch as the block timestamp. However, multiple blocks can be produced for a single DA epoch (e.g., if the epoch contains many transactions that don't fit in one block). In this case, all blocks produced for that epoch will have the exact same timestamp (c.currentDAEndTime). Furthermore, if an empty DA epoch is encountered, c.currentDAEndTime is not updated, causing the next block to reuse the timestamp from the previous non-empty epoch.

Most blockchain execution layers (like EVM) require that each new block has a timestamp strictly greater than its parent. If the sequencer produces multiple blocks with the same timestamp, the execution layer will reject them, halting the block production process and causing a Denial of Service.

Comment on lines 60 to 63
catchingUp bool
// currentDAEndTime is the DA epoch end timestamp from the last fetched epoch.
// Used as the block timestamp during catch-up to match based sequencing behavior.
currentDAEndTime time.Time
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

The fields catchingUp and currentDAEndTime are accessed concurrently without proper synchronization. GetNextBatch and fetchNextDAEpoch (which update these fields) can be called by the block production loop, while IsCatchingUp() can be called concurrently by other components (e.g., RPC, monitoring, or metrics).

In Go, concurrent read/write access to non-atomic fields is a data race, which leads to undefined behavior. Specifically, a race on time.Time (which is a struct) can result in a corrupted timestamp being read, potentially leading to invalid blocks and a Denial of Service.

Comment on lines 533 to 535
if catchUpThreshold < 30*time.Second {
catchUpThreshold = 30 * time.Second
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The value 30*time.Second is used as a minimum threshold for the catch-up logic. To improve readability and maintainability, consider defining this as a named constant at the package level, for example: const minCatchUpThreshold = 30 * time.Second, and using that constant here. This makes the intent of the value clearer and centralizes its definition.

// This test uses maxBytes to limit how many txs are fetched, triggering the unprocessed txs scenario.
func TestSequencer_CatchUp_DetectsOldEpoch(t *testing.T) {
ctx := context.Background()
logger := zerolog.New(zerolog.NewConsoleWriter())
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Using zerolog.New(zerolog.NewConsoleWriter()) in tests can lead to verbose output in the console during test runs. It's generally better to use a logger that integrates with the testing framework, such as zerolog.New(zerolog.NewTestWriter(t)), which only shows logs for failed tests, or zerolog.Nop() if logs are not needed. This practice is followed in other new tests in this file (e.g., TestSequencer_CatchUp_UsesDATimestamp). Applying this consistently would improve the developer experience. This comment also applies to lines 1309, 1457, and 1676.

Suggested change
logger := zerolog.New(zerolog.NewConsoleWriter())
logger := zerolog.New(zerolog.NewTestWriter(t))

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[FEATURE] Sequencer catchup on restart from base

1 participant