feat: add peer reputation penalization for invalid ChainLocks

dash-spv/src/client/chainlock.rs

@@ -37,10 +37,16 @@ impl<
         let chain_state = self.state.read().await;
         {
             let mut storage = self.storage.lock().await;
-            self.chainlock_manager
+            if let Err(e) = self
+                .chainlock_manager
                 .process_chain_lock(chainlock.clone(), &chain_state, &mut *storage)
                 .await
-                .map_err(SpvError::Validation)?;
+            {
+                // Penalize the peer that relayed the invalid ChainLock
+                let reason = format!("Invalid ChainLock: {}", e);
+                let _ = self.network.penalize_last_message_peer_invalid_chainlock(&reason).await;
+                return Err(SpvError::Validation(e));
+            }
         }
         drop(chain_state);
 

dash-spv/src/network/mod.rs

@@ -154,6 +154,28 @@ pub trait NetworkManager: Send + Sync {
 
         Ok(())
     }
+
+    /// Penalize the last peer that sent us a message by adjusting reputation.
+    /// Default implementation is a no-op for managers without reputation.
+    async fn penalize_last_message_peer(
+        &self,
+        _score_change: i32,
+        _reason: &str,
+    ) -> NetworkResult<()> {
+        Ok(())
+    }
+
+    /// Convenience: penalize last peer for an invalid ChainLock.
+    async fn penalize_last_message_peer_invalid_chainlock(
+        &self,
+        reason: &str,
+    ) -> NetworkResult<()> {
+        self.penalize_last_message_peer(
+            crate::network::reputation::misbehavior_scores::INVALID_CHAINLOCK,
+            reason,
+        )
+        .await
+    }
 }
 
 /// TCP-based network manager implementation.

dash-spv/src/network/multi_peer.rs

@@ -1050,7 +1050,37 @@ impl NetworkManager for MultiPeerNetworkManager {
 
                 Ok(())
             }
+        } // end match
+    } // end send_message
+
+    async fn penalize_last_message_peer(
+        &self,
+        score_change: i32,
+        reason: &str,
+    ) -> NetworkResult<()> {
+        // Get the last peer that sent us a message
+        if let Some(addr) = self.get_last_message_peer().await {
+            self.reputation_manager.update_reputation(addr, score_change, reason).await;
         }
+        Ok(())
+    }
+
+    async fn penalize_last_message_peer_invalid_chainlock(
+        &self,
+        reason: &str,
+    ) -> NetworkResult<()> {
+        if let Some(addr) = self.get_last_message_peer().await {
+            // Apply misbehavior score and a short temporary ban
+            self.reputation_manager
+                .update_reputation(addr, misbehavior_scores::INVALID_CHAINLOCK, reason)
+                .await;
+
+            // Short ban: 10 minutes for relaying invalid ChainLock
+            self.reputation_manager
+                .temporary_ban_peer(addr, Duration::from_secs(10 * 60), reason)
+                .await;
+        }
+        Ok(())
     }
 
     async fn receive_message(&mut self) -> NetworkResult<Option<NetworkMessage>> {

dash-spv/src/network/reputation.rs

@@ -313,6 +313,24 @@ impl PeerReputationManager {
         }
     }
 
+    /// Temporarily ban a peer for a specified duration, regardless of score.
+    /// This can be used for critical protocol violations (e.g., invalid ChainLocks).
+    pub async fn temporary_ban_peer(&self, peer: SocketAddr, duration: Duration, reason: &str) {
+        let mut reputations = self.reputations.write().await;
+        let reputation = reputations.entry(peer).or_default();
+
+        reputation.banned_until = Some(Instant::now() + duration);
+        reputation.ban_count += 1;
+
+        log::warn!(
+            "Peer {} temporarily banned for {:?} (ban #{}, reason: {})",
+            peer,
+            duration,
+            reputation.ban_count,
+            reason
+        );
+    }
+
     /// Record a connection attempt
     pub async fn record_connection_attempt(&self, peer: SocketAddr) {
         let mut reputations = self.reputations.write().await;