ICS28: system aborted due to update aggregation logic

[danwt]

Context

In the consumer EndBlock the received updates are aggregated and then processed

ibc/spec/app/ics-028-cross-chain-validation/technical_specification.md

Lines 1734 to 1743 in a6bc8d1

	// aggregate the pending changes
	changes = pendingChanges.Aggregate()
	// Note: in the implementation, the aggregation is done directly
	// when receiving a VSCPacket via the AccumulateChanges method.
	// remove all pending changes
	pendingChanges.RemoveAll()
	// update validatorSet
	UpdateValidatorSet(changes)

the aggregation is defined

ibc/spec/app/ics-028-cross-chain-validation/technical_specification.md

Lines 348 to 351 in a6bc8d1

	// return an aggregated list of updates, i.e.,
	// keep only the latest update per validator;
	// the original list is not modified
	Aggregate(): [ValidatorUpdate]

and the aggregated updates are processed:

ibc/spec/app/ics-028-cross-chain-validation/technical_specification.md

Lines 1775 to 1781 in a6bc8d1

	// CCF: Consumer Chain Function
	function UpdateValidatorSet(changes: [ValidatorUpdate]) {
	foreach update IN changes {
	addr := hash(update.pubKey)
	if addr NOT IN validatorSet.Keys() {
	// new validator bonded
	abortSystemUnless(update.power > 0)

Scenario

If a validator v0 receives a power=0 update on the consumer in block A then the validator will be deleted

ibc/spec/app/ics-028-cross-chain-validation/technical_specification.md

Lines 1791 to 1793 in a6bc8d1

	else if update.power == 0 {
	// existing validator begins unbonding
	validatorSet.Remove(addr)

but if subsequently the the pendingUpdates struct fills up with, e.g.

[(v0, 42), (v0, 0)]

then the aggregation will reduce this to

[ (v0, 0)]

which will trigger this branch

ibc/spec/app/ics-028-cross-chain-validation/technical_specification.md

Lines 1779 to 1781 in a6bc8d1

	if addr NOT IN validatorSet.Keys() {
	// new validator bonded
	abortSystemUnless(update.power > 0)

causing a panic

[mpoke]

@danwt That's true. Nice catch. Could you please open an issue on the implementation side also?