fix(l1sequencer): fail-fast on verifier startup when L1 unreachable

[chengwenxi]

Problem

NewSequencerVerifier treated an initial syncHistory() failure as a soft error (Logger.Error only). When the L1 RPC is unreachable at boot, history stays empty, upgrade.SetUpgradeBlockHeight is never called, and the global upgrade.UpgradeBlockHeight is left at its -1 sentinel — yet the node continues booting.

Booting with UpgradeBlockHeight=-1 is unsafe and is the shared root cause of three audit findings:

• F-01 — IsUpgraded() returns false for every height, so the PBFT state machine can run past the true upgrade height (split-brain at the boundary).
• F-03 — on a block-synced fullnode restart, two crash points both keyed on IsUpgraded:
  • the handshake's sequencer-mode replay exemption (replay.go: IsUpgraded(storeHeight+1)) fails → ErrAppBlockHeightTooHigh (app height N > core upgradeHeight-1);
  • the consensus ctor's reconstructLastCommit guard (state.go:192) runs against a nil commit → panic.
• F-13 — silent halt of an active verifier on the same path.

I reproduced F-03 on the devnet (pre-fix image): stopping a sentry node that had block-synced past the upgrade height (=10) and restarting it with the L1 RPC black-holed produced the verifier soft-error followed by error during handshake: ... app block height (723) is higher than core (9) — confirming the node boots into the -1 state and then crashes in the handshake.

Fix

Make verifier startup fail-fast: NewSequencerVerifier now returns an error when the initial sync fails or returns empty history (UpgradeBlockHeight still < 0), and cmd/node/main.go propagates it so the node exits at boot rather than booting into the unsafe -1 state. The operator's supervisor (Docker restart, systemd, k8s) restarts the node once L1 is reachable.

The error message carries the refusing to start with UpgradeBlockHeight=-1 sentinel that the audit verification scripts (f1-upgrade-init-race.sh, f3-nilcommit-panic.sh) assert on.

Scope

• node/l1sequencer/verifier.go — NewSequencerVerifier returns (*SequencerVerifier, error); fail-fast on sync failure / empty history.
• node/cmd/node/main.go — propagate the error.

Based on the latest feat/sequencer-final (4a7b9119).

Verification

• go build ./cmd/node/ ./l1sequencer/ — clean
• go vet ./l1sequencer/ — clean
• go test ./l1sequencer/ — pass

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 97432287-cd4c-41f2-b8c2-e61b7e64be37

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/f03-verifier-failfast

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}