Add hashed address filter by MishkaRogachev · Pull Request #4235 · OffchainLabs/nitro

MishkaRogachev · 2026-01-13T13:21:33Z

Changes:

Implement AddressChecker interface with NewHashedAddressChecker, using HashStore from feat(compliance-chains): s3 polling + hash-store #NIT-4269 #4234
Enable NewHashedAddressChecker if service and assign it to execution

codecov · 2026-01-13T13:37:26Z

Codecov Report

❌ Patch coverage is 4.05405% with 71 lines in your changes missing coverage. Please review.
✅ Project coverage is 32.40%. Comparing base (35440a4) to head (145cd1c).
⚠️ Report is 1 commits behind head on master.

❗ There is a different number of reports uploaded between BASE (35440a4) and HEAD (145cd1c). Click for more details.

HEAD has 1 upload less than BASE

Flag BASE (35440a4) HEAD (145cd1c)

5 4

Additional details and impacted files

@@             Coverage Diff             @@
##           master    #4235       +/-   ##
===========================================
- Coverage   57.24%   32.40%   -24.84%     
===========================================
  Files         483      483               
  Lines       57539    57575       +36     
===========================================
- Hits        32939    18658    -14281     
- Misses      19694    35584    +15890     
+ Partials     4906     3333     -1573

github-actions · 2026-01-13T13:48:17Z

❌ 6 Tests Failed:

Tests completed	Failed	Passed	Skipped
4133	6	4127	0

View the top 3 failed tests by shortest run time

TestEndToEnd_ManyEvilValidators

Stack Traces | -0.000s run time

... [CONTENT TRUNCATED: Keeping last 20 lines]
github.com/offchainlabs/nitro/bold/challenge/tracker.(*Tracker).Spawn(0xc008c5e640, {0x1fdd420, 0xc004ef5900})
	/home/runner/work/nitro/nitro/bold/challenge/tracker/tracker.go:204 +0x235
created by github.com/offchainlabs/nitro/bold/challenge/tracker.(*Tracker).Act in goroutine 273035
	/home/runner/work/nitro/nitro/bold/challenge/tracker/tracker.go:356 +0x10bf

goroutine 305764 [select]:
github.com/offchainlabs/nitro/bold/containers/events.(*Subscription[...]).Next(0x1fdd420, {0x1fdd420?, 0xc004ef5a40?})
	/home/runner/work/nitro/nitro/bold/containers/events/producer.go:130 +0xd0
github.com/offchainlabs/nitro/bold/challenge/tracker.(*Tracker).Spawn(0xc0006108c0, {0x1fdd420, 0xc004ef5a40})
	/home/runner/work/nitro/nitro/bold/challenge/tracker/tracker.go:204 +0x235
created by github.com/offchainlabs/nitro/bold/challenge/tracker.(*Tracker).Act in goroutine 280393
	/home/runner/work/nitro/nitro/bold/challenge/tracker/tracker.go:357 +0x1125

goroutine 305567 [select]:
github.com/offchainlabs/nitro/bold/containers/events.(*Subscription[...]).Next(0x1fdd420, {0x1fdd420?, 0xc004ef59a0?})
	/home/runner/work/nitro/nitro/bold/containers/events/producer.go:130 +0xd0
github.com/offchainlabs/nitro/bold/challenge/tracker.(*Tracker).Spawn(0xc000222b40, {0x1fdd420, 0xc004ef59a0})
	/home/runner/work/nitro/nitro/bold/challenge/tracker/tracker.go:204 +0x235
created by github.com/offchainlabs/nitro/bold/challenge/tracker.(*Tracker).Act in goroutine 280097
	/home/runner/work/nitro/nitro/bold/challenge/tracker/tracker.go:357 +0x1125

TestEndToEnd_ManyEvilValidators/honest_essential_edges_confirmed_by_challenge_win

Stack Traces | -0.000s run time

... [CONTENT TRUNCATED: Keeping last 20 lines]
github.com/offchainlabs/nitro/bold/challenge/tracker.(*Tracker).Spawn(0xc008c5e640, {0x1fdd420, 0xc004ef5900})
	/home/runner/work/nitro/nitro/bold/challenge/tracker/tracker.go:204 +0x235
created by github.com/offchainlabs/nitro/bold/challenge/tracker.(*Tracker).Act in goroutine 273035
	/home/runner/work/nitro/nitro/bold/challenge/tracker/tracker.go:356 +0x10bf

goroutine 305764 [select]:
github.com/offchainlabs/nitro/bold/containers/events.(*Subscription[...]).Next(0x1fdd420, {0x1fdd420?, 0xc004ef5a40?})
	/home/runner/work/nitro/nitro/bold/containers/events/producer.go:130 +0xd0
github.com/offchainlabs/nitro/bold/challenge/tracker.(*Tracker).Spawn(0xc0006108c0, {0x1fdd420, 0xc004ef5a40})
	/home/runner/work/nitro/nitro/bold/challenge/tracker/tracker.go:204 +0x235
created by github.com/offchainlabs/nitro/bold/challenge/tracker.(*Tracker).Act in goroutine 280393
	/home/runner/work/nitro/nitro/bold/challenge/tracker/tracker.go:357 +0x1125

goroutine 305567 [select]:
github.com/offchainlabs/nitro/bold/containers/events.(*Subscription[...]).Next(0x1fdd420, {0x1fdd420?, 0xc004ef59a0?})
	/home/runner/work/nitro/nitro/bold/containers/events/producer.go:130 +0xd0
github.com/offchainlabs/nitro/bold/challenge/tracker.(*Tracker).Spawn(0xc000222b40, {0x1fdd420, 0xc004ef59a0})
	/home/runner/work/nitro/nitro/bold/challenge/tracker/tracker.go:204 +0x235
created by github.com/offchainlabs/nitro/bold/challenge/tracker.(*Tracker).Act in goroutine 280097
	/home/runner/work/nitro/nitro/bold/challenge/tracker/tracker.go:357 +0x1125

TestNitroNodeVersionAlerter

Stack Traces | 0.450s run time

... [CONTENT TRUNCATED: Keeping last 20 lines]
INFO [02-05|17:12:35.706] Submitted transaction                    hash=0x6398c8a5f79879715085e58011c83435f92cb39d67ae3ea2554ec0f904f92c8e from=0xb386a74Dcab67b66F8AC07B4f08365d37495Dd23 nonce=11  recipient=0x4b57470B25264b4b1C151df8FDCD339eF2a90e54 value=0
INFO [02-05|17:12:35.707] DataPoster sent transaction              nonce=11  hash=6398c8..f92c8e feeCap=5,636,815,520  tipCap=50,000,000    blobFeeCap=&lt;nil&gt; gas=180,303
INFO [02-05|17:12:35.707] BatchPoster: batch sent                  sequenceNumber=12  from=15  to=16  prevDelayed=1   currentDelayed=1   totalSegments=3  numBlobs=0
INFO [02-05|17:12:35.707] Submitted transaction                    hash=0x53317ff98c47e8bf1f73df7851dc3501cd8ab46b710d9e9205c8a696ddbaea94 from=0xb386a74Dcab67b66F8AC07B4f08365d37495Dd23 nonce=130 recipient=0x4b57470B25264b4b1C151df8FDCD339eF2a90e54 value=0
INFO [02-05|17:12:35.707] DataPoster sent transaction              nonce=130 hash=53317f..baea94 feeCap=500,000,900    tipCap=50,000,000    blobFeeCap=&lt;nil&gt; gas=157,247
INFO [02-05|17:12:35.707] BatchPoster: batch sent                  sequenceNumber=131 from=288 to=290 prevDelayed=109 currentDelayed=110 totalSegments=4  numBlobs=0
INFO [02-05|17:12:35.708] Starting work on payload                 id=0x03679ffe46e9e70b
INFO [02-05|17:12:35.708] Starting work on payload                 id=0x0332f10e446fdc38
INFO [02-05|17:12:35.709] Updated payload                          id=0x03679ffe46e9e70b number=45  hash=3b7c62..8b15f0 txs=1   withdrawals=0 gas=167,804    fees=8.3902e-06     root=f38447..bd2f4e elapsed=1.170ms
INFO [02-05|17:12:35.709] Stopping work on payload                 id=0x03679ffe46e9e70b reason=delivery
INFO [02-05|17:12:35.711] Updated payload                          id=0x0332f10e446fdc38 number=164 hash=d1ae13..19bd8a txs=1   withdrawals=0 gas=144,930    fees=7.2465e-06     root=540478..450b8c elapsed=2.231ms
INFO [02-05|17:12:35.711] Imported new potential chain segment     number=45  hash=3b7c62..8b15f0 blocks=1  txs=1   mgas=0.168  elapsed=1.507ms     mgasps=111.323  triediffs=237.11KiB  triedirty=0.00B
INFO [02-05|17:12:35.711] Chain head was updated                   number=45  hash=3b7c62..8b15f0 root=f38447..bd2f4e elapsed="107.47µs"
INFO [02-05|17:12:35.711] ExecutionEngine: Added DelayedMessages   msgIdx=290 delayedMsgIdx=110 block-header="&amp;{ParentHash:0xc1e5d8b2458370981535684e021b4809cc141600d0234fd412949d6ac5c4ee46 UncleHash:0x1dcc4de8dec75d7aab85b567b6ccd41ad312451b948a7413f0a142fd40d49347 Coinbase:0xb386a74Dcab67b66F8AC07B4f08365d37495Dd23 Root:0xd0f55022e7e142f72564de7c521d57dbca5ce27bfea8839cebbeb9a7714ede05 TxHash:0x8066f6aa06b515a9236d87beb0a7f6b3a5a0d50eca7f845a71c124eab4c08d19 ReceiptHash:0xf08cf5553e1dae52e3df19b356b8320e17c39fb055f635739c31052db5c3e45e Bloom:[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] Difficulty:+1 Number:+290 GasLimit:1125899906842624 GasUsed:0 Time:1770311651 Extra:[0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] MixDigest:0x000000000000000000000000000000a200000000000000330000000000000000 Nonce:[0 0 0 0 0 0 0 111] BaseFee:+100000000 WithdrawalsHash:&lt;nil&gt; BlobGasUsed:&lt;nil&gt; ExcessBlobGas:&lt;nil&gt; ParentBeaconRoot:&lt;nil&gt; RequestsHash:&lt;nil&gt;}"
INFO [02-05|17:12:35.712] DelayedSequencer: Sequenced              msgnum=1 startpos=110
INFO [02-05|17:12:35.713] Stopping work on payload                 id=0x0332f10e446fdc38 reason=delivery
INFO [02-05|17:12:35.718] Imported new potential chain segment     number=164 hash=d1ae13..19bd8a blocks=1  txs=1   mgas=0.145  elapsed=7.276ms     mgasps=19.918   triediffs=1.06MiB    triedirty=55.22KiB
INFO [02-05|17:12:35.719] Chain head was updated                   number=164 hash=d1ae13..19bd8a root=540478..450b8c elapsed="94.246µs"
INFO [02-05|17:12:35.736] Submitted transaction                    hash=0x0c53dc13468f1d5865249bf48e791317e34e10ec18e7ed6ab91255c0b2792a32 from=0x26E554a8acF9003b83495c7f45F06edCB803d4e3 nonce=180 recipient=0x0C709F340F0BB2e361229e345B7e26999d0969Ab value=340,282,366,920,938,463,463,374,607,431,768,211,456
--- FAIL: TestNitroNodeVersionAlerter (0.45s)

📣 Thoughts on this report? Let Codecov know! | Powered by Codecov

# Conflicts: # arbnode/node.go

changelog/mnasr-compliance-chains-restricted-addr-NIT-4269.md

util/s3syncer/syncer.go

Tristan-Wilson · 2026-02-02T13:18:38Z

execution/gethexec/addressfilter/address_checker.go

+	for i := 0; i < c.workerCount; i++ {
+		c.LaunchThread(func(ctx context.Context) {
+			c.worker(ctx)
+		})
+	}
+}


I spent some time thinking about this approach vs spawning workers on demand with a limit of 4 concurrent Goroutines, and I think this is the better approach despite being slightly less idiomatic Go, because the larger queue absorbs bursty traffic much better.

Tristan-Wilson · 2026-02-02T13:26:04Z

execution/gethexec/addressfilter/address_checker.go

+	default:
+		// queue full: process synchronously to avoid dropping
+		s.checker.processAddress(addr, s)
+	}


I am not convinced about falling back to synchronous, since the most likely bottleneck causing the backlog would be CPUs doing SHA instructions, and there are a limited number of CPUs, which means that new requests would "jump the queue" and starve older ones stuck in the queue.

I think it is reasonable instead to not have a default case and block on posting to the queue and ctx.Done().

Agree. I leaved sync path only fallback when checker is stopped or not started

…-filter-hashed-address-filter

…filter

tsahee

generally seems good. small comments.
Also - I haven't yet reviewd the "big picture" of what happens when we get an update from S3

tsahee · 2026-02-05T03:19:16Z

execution/gethexec/addressfilter/address_checker.go

+// Copyright 2026, Offchain Labs, Inc.
+// For license information, see https://github.com/OffchainLabs/nitro/blob/master/LICENSE.md
+
+package addressfilter


move entire package into gethexec

tsahee · 2026-02-05T03:27:44Z

addressfilter/address_checker.go

+const (
+	defaultRestrictedAddrWorkerCount = 4
+	defaultRestrictedAddrQueueSize   = 8192
+)


use a standard config struct and have config values for these. Also, remove NewDefaultHashedAddressChecker.
We will want to be able to play with these without having to compile a new binary.

tsahee · 2026-02-05T03:32:48Z

execution/gethexec/addressfilter/address_checker.go

+	select {
+	case s.checker.workChan <- workItem{addr: addr, state: s}:
+		// ok
+	case <-s.checker.GetContext().Done():


both for checker.stopped and checker context done can be handled together.
In both cases I think best action is - don't do anything, just mark filtered=true. Sequencer should not be sequencing any new blocks at this point, and filtering to be on the safe side means we won't be doing damage.

changed to more conservative with s.report(true)

MishkaRogachev · 2026-02-05T13:11:01Z

@Tristan-Wilson @mahdy-nasr fyi: I moved addressfilter into execution/gethexec

…-filter-hashed-address-filter

MishkaRogachev force-pushed the transaction-address-filter-hashed-address-filter branch from ae96608 to 9f01974 Compare January 13, 2026 13:47

MishkaRogachev force-pushed the transaction-address-filter-hashed-address-filter branch from 9f01974 to 041fbdf Compare January 14, 2026 14:25

MishkaRogachev changed the base branch from master to s3-scensorship-resistant January 14, 2026 14:26

MishkaRogachev force-pushed the transaction-address-filter-hashed-address-filter branch from 041fbdf to e5eb39c Compare January 15, 2026 13:32

mahdy-nasr force-pushed the s3-scensorship-resistant branch from 635f047 to f0ee6c2 Compare January 16, 2026 16:54

mahdy-nasr added 7 commits January 20, 2026 22:34

feat(compliance-chains): s3 polling + hash-store

bf57e61

# Conflicts: # arbnode/node.go

remove address-checker+add lru-cache

74b4d97

fix lint and add changelog

aec4930

move restrictedaddr service to execution node

5ff641e

move restrictedaddr service to execution node 2

359c41b

apply suggestions and enhnace s3 download to use memory buffer

ddaf146

Fix address-filter configci

064f48a

mahdy-nasr force-pushed the s3-scensorship-resistant branch from 6235f36 to 064f48a Compare January 20, 2026 19:43

Remove un-needed md file

0670977

MishkaRogachev force-pushed the transaction-address-filter-hashed-address-filter branch 2 times, most recently from e0c620d to d996b94 Compare January 21, 2026 15:50

MishkaRogachev requested review from Tristan-Wilson and mahdy-nasr January 21, 2026 15:51

MishkaRogachev marked this pull request as ready for review January 21, 2026 15:51

MishkaRogachev assigned Tristan-Wilson Jan 21, 2026

mahdy-nasr and others added 7 commits January 21, 2026 19:10

rename addressfilter and change copyright

8633730

update changelog

a6e26b1

enhance PR, fix issues

cbb44bd

Add hashed address filter

80fefb0

Use restrictedaddr.HashStore in HashedAddressChecker

054b70e

Minor improvments and test

d0453f3

Move HashedAddressChecker to addressfilter

2370090

MishkaRogachev force-pushed the transaction-address-filter-hashed-address-filter branch from d996b94 to 2370090 Compare January 22, 2026 11:26

MishkaRogachev requested a review from Tristan-Wilson January 29, 2026 13:58

Tristan-Wilson assigned Tristan-Wilson and unassigned MishkaRogachev Jan 30, 2026

Tristan-Wilson requested changes Feb 2, 2026

View reviewed changes

Tristan-Wilson assigned MishkaRogachev and unassigned Tristan-Wilson Feb 2, 2026

Don't fallback to synchronous TouchAddress call, block instead

c90fa95

MishkaRogachev assigned Tristan-Wilson and unassigned MishkaRogachev Feb 2, 2026

Tristan-Wilson previously approved these changes Feb 3, 2026

View reviewed changes

Tristan-Wilson assigned tsahee and unassigned Tristan-Wilson Feb 3, 2026

Tristan-Wilson requested a review from tsahee February 3, 2026 12:49

Merge remote-tracking branch 'origin/master' into transaction-address…

858d0db

…-filter-hashed-address-filter

MishkaRogachev dismissed Tristan-Wilson’s stale review via 858d0db February 3, 2026 14:50

Merge branch 'master' into transaction-address-filter-hashed-address-…

e2a68b8

…filter

tsahee requested changes Feb 5, 2026

View reviewed changes

tsahee assigned MishkaRogachev and unassigned tsahee Feb 5, 2026

Move address filter to gethexec & other review fixes

6dd7358

MishkaRogachev requested review from Tristan-Wilson and tsahee February 5, 2026 13:11

MishkaRogachev assigned tsahee and unassigned MishkaRogachev Feb 5, 2026

Merge remote-tracking branch 'origin/master' into transaction-address…

82e6790

…-filter-hashed-address-filter

Tristan-Wilson previously approved these changes Feb 5, 2026

View reviewed changes

Post-merge fix

1fb96f3

MishkaRogachev dismissed Tristan-Wilson’s stale review via 1fb96f3 February 5, 2026 14:43

Fixup TestConfig_Validate

145cd1c

Conversation

MishkaRogachev commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ 6 Tests Failed:

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tsahee left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MishkaRogachev commented Feb 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

MishkaRogachev commented Jan 13, 2026 •

edited

Loading

codecov bot commented Jan 13, 2026 •

edited

Loading

github-actions bot commented Jan 13, 2026 •

edited

Loading