fix(llmq): drop and score unrequested quorum commitments

QFCOMMITMENT is only ever sent in reply to a GETDATA (commitments are announced via AddMineableCommitment -> PeerRelayInv), so one we have no in-flight request for was never asked for. Most of the checks in ProcessMessage reject without scoring the peer -- deliberately, since we may just be lagging behind or on another chain -- so an unsolicited sender could repeat the block lookups and mineable-commitment probes indefinitely at no cost.

Authorize on PeerConsumeGetDataResponse before any of that work, replacing the m_to_erase round-trip that resolved to the weaker ReceivedResponse. CQuorumBlockProcessor holds no PeerManagerInternal reference (net_processing already includes this header, so taking one would make the dependency circular), so the check is passed in as a predicate from the call site.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: PastaPastaPasta

src/llmq/blockprocessor.cpp

@@ -63,7 +63,8 @@ CQuorumBlockProcessor::~CQuorumBlockProcessor()
 }
 
 MessageProcessingResult CQuorumBlockProcessor::ProcessMessage(const CNode& peer, std::string_view msg_type,
-                                                              CDataStream& vRecv)
+                                                              CDataStream& vRecv,
+                                                              const ConsumeRequestFn& consume_request)
 {
     if (msg_type != NetMsgType::QFCOMMITMENT) {
         return {};
@@ -72,8 +73,20 @@ MessageProcessingResult CQuorumBlockProcessor::ProcessMessage(const CNode& peer,
     CFinalCommitment qc;
     vRecv >> qc;
 
+    // A QFCOMMITMENT is only ever sent in reply to a GETDATA (see ProcessGetData), so one we have no
+    // in-flight request for was never asked for. Drop it up front: most of the checks below reject
+    // without scoring the peer -- deliberately, since we may just be lagging behind -- so an
+    // unsolicited peer could otherwise repeat the block lookups and map probes indefinitely. A bare
+    // announcement deliberately does not qualify: it would let the peer authorise its own payload by
+    // sending INV first.
+    if (!consume_request(CInv{MSG_QUORUM_FINAL_COMMITMENT, ::SerializeHash(qc)})) {
+        LogPrint(BCLog::LLMQ, "CQuorumBlockProcessor::%s -- unrequested commitment from peer=%d\n", __func__,
+                 peer.GetId());
+        return MisbehavingError{UNREQUESTED_OBJECT_MISBEHAVIOR_SCORE, "unrequested quorum commitment"};
+    }
+
+    // Note: no m_to_erase, the request was already consumed by the solicitation check above.
     MessageProcessingResult ret;
-    ret.m_to_erase = CInv{MSG_QUORUM_FINAL_COMMITMENT, ::SerializeHash(qc)};
 
     if (qc.IsNull()) {
         LogPrint(BCLog::LLMQ, "CQuorumBlockProcessor::%s -- null commitment from peer=%d\n", __func__, peer.GetId());

src/llmq/blockprocessor.h

@@ -18,6 +18,7 @@
 
 #include <gsl/pointers.h>
 
+#include <functional>
 #include <optional>
 
 class BlockValidationState;
@@ -62,7 +63,18 @@ class CQuorumBlockProcessor
                                    CQuorumSnapshotManager& qsnapman, int8_t bls_threads);
     ~CQuorumBlockProcessor();
 
-    [[nodiscard]] MessageProcessingResult ProcessMessage(const CNode& peer, std::string_view msg_type, CDataStream& vRecv)
+    //! Predicate answering "did we ask this peer for the inv?", consuming the pending request as a
+    //! side effect. Passed in rather than reached through PeerManagerInternal because net_processing
+    //! already depends on this header; see ProcessMessage for how it is used.
+    //!
+    //! Must be invoked without ::cs_main held -- the implementation takes it. Thread-safety
+    //! analysis cannot check this through the type-erased std::function, so keep any call site
+    //! outside ProcessMessage's own LOCK(::cs_main) block.
+    using ConsumeRequestFn = std::function<bool(const CInv&)>;
+
+    [[nodiscard]] MessageProcessingResult ProcessMessage(const CNode& peer, std::string_view msg_type,
+                                                         CDataStream& vRecv,
+                                                         const ConsumeRequestFn& consume_request)
         EXCLUSIVE_LOCKS_REQUIRED(!minableCommitmentsCs);
 
     bool ProcessBlock(const CBlock& block, gsl::not_null<const CBlockIndex*> pindex, BlockValidationState& state,

src/net_processing.cpp

@@ -5542,7 +5542,13 @@ void PeerManagerImpl::ProcessMessage(
             PostProcessMessage(m_cj_walletman->processMessage(pfrom, m_chainman.ActiveChainstate(), m_connman, m_mempool, msg_type, vRecv), pfrom.GetId());
         }
         PostProcessMessage(CMNAuth::ProcessMessage(pfrom, peer->m_their_services, m_connman, m_mn_metaman, m_nodeman, m_mn_sync, m_dmnman->GetListAtChainTip(), msg_type, vRecv), pfrom.GetId());
-        PostProcessMessage(m_llmq_ctx->quorum_block_processor->ProcessMessage(pfrom, msg_type, vRecv), pfrom.GetId());
+        PostProcessMessage(m_llmq_ctx->quorum_block_processor->ProcessMessage(
+                               pfrom, msg_type, vRecv,
+                               [this, &pfrom](const CInv& inv) EXCLUSIVE_LOCKS_REQUIRED(!::cs_main) {
+                                   return WITH_LOCK(::cs_main,
+                                                    return PeerConsumeGetDataResponse(pfrom.GetId(), inv));
+                               }),
+                           pfrom.GetId());
         PostProcessMessage(ProcessPlatformBanMessage(pfrom.GetId(), msg_type, vRecv), pfrom.GetId());
 
         if (msg_type == NetMsgType::CLSIG) {