verify batch item identifiers on-chain at batch submit

backend/src/event-handlers/rollup.js

@@ -72,7 +72,7 @@ const submitRollup = async () => {
   const content = `Batch of ${batchItems.length} items`;
   const embeddedData = {
     batchItems,
-    nonce: uuidv4().replace(/-/i, ''),
+    nonce: uuidv4().replaceAll('-', ''),
   };
   const sender = await wallet.getAddress();
   const contentToVerify = `${content}\n\n${JSON.stringify(embeddedData, null, 2)}`;
@@ -88,7 +88,7 @@ const submitRollup = async () => {
   // Call Rollup.submitBatch
   console.log('Submitting batch', { batchPostId, batchItems, authors });
   const poolDuration = 60;
-  await callWithRetry(() => rollup.submitBatch(batchPostId, batchItems.length, poolDuration));
+  await callWithRetry(() => rollup.submitBatch(batchPostId, batchItems, poolDuration));
   // Send matrix event
   await sendMatrixEvent('io.dgov.rollup.submit', { batchPostId, batchItems, authors });
   // Clear the batch in preparation for next batch

ethereum/contracts/Rollup.sol

@@ -44,19 +44,27 @@ contract Rollup is Availability {
     /// but it will only succeed if it is able to assign a new worker.
     function submitBatch(
         string calldata batchPostId,
-        uint batchSize,
+        string[] calldata batchItems,
         uint poolDuration
     ) public returns (uint poolIndex) {
-        require(batchSize <= itemCount, "Batch size too large");
         if (batchWorker != address(0)) {
             require(
                 msg.sender == batchWorker,
                 "Batch result must be submitted by current batch worker"
             );
         }
+        require(batchItems.length <= itemCount, "Batch size too large");
+        // Make sure all batch items match
+        for (uint i = 0; i < batchItems.length; i++) {
+            require(
+                keccak256(bytes(batchItems[i])) ==
+                    keccak256(bytes(items[i].postId)),
+                "Batch item mismatch"
+            );
+        }
         // initiate a validation pool for this batch
         uint fee;
-        for (uint i = 0; i < batchSize; i++) {
+        for (uint i = 0; i < batchItems.length; i++) {
             fee += items[i].fee;
         }
         poolIndex = dao.initiateValidationPool{value: fee}(
@@ -70,7 +78,7 @@ contract Rollup is Availability {
             ""
         );
         // Include all the availability stakes from the batched work
-        for (uint i = 0; i < batchSize; i++) {
+        for (uint i = 0; i < batchItems.length; i++) {
             dao.delegatedStakeOnValidationPool(
                 poolIndex,
                 items[i].worker,
@@ -87,13 +95,13 @@ contract Rollup is Availability {
                 true
             );
         }
-        if (batchSize < itemCount) {
+        if (batchItems.length < itemCount) {
             // Some items were added after this batch was computed.
             // Keep them in the queue to be included in the next batch.
-            for (uint i = 0; i < itemCount - batchSize; i++) {
-                items[i] = items[batchSize + i];
+            for (uint i = 0; i < itemCount - batchItems.length; i++) {
+                items[i] = items[batchItems.length + i];
             }
-            itemCount = itemCount - batchSize;
+            itemCount = itemCount - batchItems.length;
         } else {
             // Reset item count so we can start the next batch
             itemCount = 0;