governance_inv_tests.cpp

// Copyright (c) 2026 The Dash Core developers
// Distributed under the MIT software license, see the accompanying
// file COPYING or http://www.opensource.org/licenses/mit-license.php.

#include <arith_uint256.h>
#include <common/bloom.h>
#include <governance/collateral.h>
#include <governance/governance.h>
#include <governance/net_governance.h>
#include <governance/object.h>
#include <masternode/meta.h>
#include <masternode/sync.h>
#include <net.h>
#include <net_processing.h>
#include <netfulfilledman.h>
#include <node/connection_types.h>
#include <protocol.h>
#include <streams.h>
#include <uint256.h>
#include <util/strencodings.h>
#include <util/time.h>
#include <version.h>

#include <test/util/net.h>
#include <test/util/setup_common.h>
#include <test/util/validation.h>

#include <boost/test/unit_test.hpp>

#include <algorithm>
#include <atomic>
#include <chrono>
#include <memory>
#include <set>
#include <vector>

using namespace std::chrono_literals;

namespace {
//! Knows no collateral, like a synced index on a chain without fee burns
struct EmptyCollateralSource final : public governance::CollateralSource {
    std::atomic<bool> synced{true};

    bool IsCollateralSynced() const override { return synced; }
    std::optional<governance::CollateralInfo> FindCollateral(const uint256&) const override { return std::nullopt; }
};

struct GovernanceInvSetup : public TestingSetup {
    EmptyCollateralSource m_collateral;

    GovernanceInvSetup() : TestingSetup{CBaseChainParams::MAIN}
    {
        // ConfirmInventoryRequest and the NetGovernance object/vote handlers
        // short-circuit on !IsBlockchainSynced().
        BOOST_REQUIRE(m_node.mn_sync);
        m_node.mn_sync->SwitchToNextAsset();
        BOOST_REQUIRE(m_node.mn_sync->IsBlockchainSynced());

        BOOST_REQUIRE(m_node.mn_metaman);
        // Note: mn_metaman is left unloaded. Reaching CGovernanceObject::ProcessVote asserts
        // metaman.IsValid(), so a test that delivers a vote whose parent object exists must
        // load it first (see invalid_vote_is_scored_alike_with_and_without_a_parent_object).
        m_node.govman = std::make_unique<CGovernanceManager>(*m_node.mn_metaman, *m_node.chainman, *m_node.sbman,
                                                             *m_node.dmnman, *m_node.mn_sync, &m_collateral);
        // Match runtime preconditions: NetGovernance::AlreadyHave claims we
        // already have the inv when governance isn't loaded (e.g.
        // -disablegovernance), so ConfirmInventoryRequest would never run.
        BOOST_REQUIRE(m_node.govman->LoadCache(/*load_cache=*/false));

        BOOST_REQUIRE(m_node.netfulfilledman);
        // Loaded here for the later test that advances GOVERNANCE -> FINISHED;
        // the sync notifier asserts netfulfilledman.IsValid().
        BOOST_REQUIRE(m_node.netfulfilledman->LoadCache(/*load_cache=*/false));
        BOOST_REQUIRE(m_node.connman);
        BOOST_REQUIRE(m_node.peerman);

        // Intentional unit-test boundary: TestingSetup does not run the
        // init.cpp/AppInit startup path that registers the Dash-specific
        // handlers, so the INV branch in PeerManagerImpl::AlreadyHave would not
        // route MSG_GOVERNANCE_OBJECT[_VOTE] anywhere. Install the same
        // NetGovernance handler init.cpp registers so a real INV reaches
        // CGovernanceManager::ConfirmInventoryRequest; the startup registration
        // itself stays outside this unit test.
        m_node.peerman->AddExtraHandler(std::make_unique<NetGovernance>(
            m_node.peerman.get(), *m_node.govman, *m_node.mn_sync,
            *m_node.netfulfilledman, *m_node.connman));

        // Anchor the clock so the object and vote timestamps the tests build
        // from GetTime() are deterministic. Nothing advances it.
        SetMockTime(1'700'000'000s);
    }
    ~GovernanceInvSetup() {
        m_node.peerman->RemoveHandlers();
        m_node.govman.reset();
    }

};

size_t CountQueuedMessages(const CNode& peer, const std::string& msg_type)
{
    LOCK(peer.cs_vSend);
    size_t count{0};
    for (const auto& msg : peer.vSendMsg) {
        if (msg.m_type == msg_type) {
            ++count;
        }
    }
    return count;
}

size_t CountQueuedInventory(const CNode& peer, const CInv& expected_inv, const std::string& msg_type = NetMsgType::INV)
{
    LOCK(peer.cs_vSend);
    size_t count{0};
    for (const auto& msg : peer.vSendMsg) {
        if (msg.m_type != msg_type) {
            continue;
        }
        CDataStream stream{msg.data, SER_NETWORK, PROTOCOL_VERSION};
        std::vector<CInv> invs;
        stream >> invs;
        for (const auto& inv : invs) {
            if (inv.type == expected_inv.type && inv.hash == expected_inv.hash) {
                ++count;
            }
        }
    }
    return count;
}

std::unique_ptr<CNode> MakeGovernanceInvPeer(NodeId id)
{
    in_addr peer_in_addr{};
    peer_in_addr.s_addr = htonl(0x01020305 + id);
    auto peer{std::make_unique<CNode>(id,
                                      /*sock=*/nullptr,
                                      /*addrIn=*/CAddress{CService{peer_in_addr, 8333}, NODE_NETWORK},
                                      /*nKeyedNetGroupIn=*/0,
                                      /*nLocalHostNonceIn=*/0,
                                      /*addrBindIn=*/CAddress{},
                                      /*addrNameIn=*/std::string{},
                                      /*conn_type_in=*/ConnectionType::INBOUND,
                                      /*inbound_onion=*/false)};
    peer->nVersion = PROTOCOL_VERSION;
    peer->SetCommonVersion(PROTOCOL_VERSION);
    peer->fSuccessfullyConnected = true;
    return peer;
}

void ProcessInvs(PeerManager& peerman, CNode& peer, const std::vector<CInv>& invs)
    EXCLUSIVE_LOCKS_REQUIRED(NetEventsInterface::g_msgproc_mutex)
{
    CDataStream inv_stream{SER_NETWORK, PROTOCOL_VERSION};
    inv_stream << invs;
    std::atomic<bool> interrupt_dummy{false};
    peerman.ProcessMessage(peer, NetMsgType::INV, inv_stream, GetTime<std::chrono::microseconds>(), interrupt_dummy);
}

void ProcessInv(PeerManager& peerman, CNode& peer, const CInv& inv)
    EXCLUSIVE_LOCKS_REQUIRED(NetEventsInterface::g_msgproc_mutex)
{
    ProcessInvs(peerman, peer, {inv});
}

CGovernanceObject MakeGovernanceObject(int64_t creation_time, const uint256& collateral_hash)
{
    const std::string data{
        R"({"type":1,"name":"proposal","start_epoch":1700000000,"end_epoch":1700100000,"payment_amount":1.0,"payment_address":"XwnLY9Tf7Zsef8gMGL2fhWA9ZmMjt4KPwV","url":"https://dash.org"})"};
    return CGovernanceObject{uint256{}, /*revision=*/1, creation_time, collateral_hash, HexStr(data)};
}

void ProcessGovernanceObject(NetGovernance& net_gov, CNode& peer, const CGovernanceObject& govobj)
{
    CDataStream object_stream{SER_NETWORK, PROTOCOL_VERSION};
    object_stream << govobj;
    net_gov.ProcessMessage(peer, NetMsgType::MNGOVERNANCEOBJECT, object_stream);
}

CGovernanceVote MakeGovernanceVote(const uint256& parent_hash)
{
    CGovernanceVote vote{COutPoint{uint256S("11"), 1}, parent_hash, VOTE_SIGNAL_FUNDING, VOTE_OUTCOME_YES};
    vote.SetTime(GetTime<std::chrono::seconds>().count());
    vote.SetSignature(std::vector<unsigned char>(CGovernanceVote::COMPACT_SIG_SIZE));
    return vote;
}

void ProcessGovernanceVote(NetGovernance& net_gov, CNode& peer, const CGovernanceVote& vote)
{
    CDataStream vote_stream{SER_NETWORK, PROTOCOL_VERSION};
    vote_stream << vote;
    net_gov.ProcessMessage(peer, NetMsgType::MNGOVERNANCEOBJECTVOTE, vote_stream);
}
} // namespace

BOOST_FIXTURE_TEST_SUITE(governance_inv_tests, GovernanceInvSetup)

BOOST_AUTO_TEST_CASE(per_object_vote_sync_is_fulfilled_request_limited)
{
    LOCK(NetEventsInterface::g_msgproc_mutex);

    // NetGovernance::ProcessMessage ignores MNGOVERNANCESYNC until sync is
    // fully finished; advance from GOVERNANCE to FINISHED.
    m_node.mn_sync->SwitchToNextAsset();
    BOOST_REQUIRE(m_node.mn_sync->IsSynced());

    auto peer{MakeGovernanceInvPeer(/*id=*/1)};
    m_node.peerman->InitializeNode(*peer, NODE_NETWORK);

    auto make_request_stream = [](const uint256& object_hash, const CBloomFilter& filter) {
        CDataStream stream{SER_NETWORK, PROTOCOL_VERSION};
        stream << object_hash << filter;
        return stream;
    };

    NetGovernance net_gov(m_node.peerman.get(), *m_node.govman, *m_node.mn_sync,
                          *m_node.netfulfilledman, *m_node.connman);
    auto& connman = static_cast<ConnmanTestMsg&>(*m_node.connman);
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 0);

    const CBloomFilter vote_filter{1, 0.001, 0, BLOOM_UPDATE_NONE};
    CGovernanceObject postponed_object{uint256(), /*revision=*/1, GetTime(), uint256::ONE, /*data=*/{}};
    m_node.govman->AddPostponedObject(postponed_object);

    const uint256 postponed_object_hash{postponed_object.GetHash()};
    const std::string postponed_vote_sync_request{strprintf("%s-votes-%s", NetMsgType::MNGOVERNANCESYNC,
                                                            postponed_object_hash.ToString())};
    auto postponed_stream = make_request_stream(postponed_object_hash, vote_filter);
    net_gov.ProcessMessage(*peer, NetMsgType::MNGOVERNANCESYNC, postponed_stream);

    BOOST_CHECK(!m_node.netfulfilledman->HasFulfilledRequest(peer->addr, postponed_vote_sync_request));
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 0);

    auto duplicate_postponed_stream = make_request_stream(postponed_object_hash, vote_filter);
    net_gov.ProcessMessage(*peer, NetMsgType::MNGOVERNANCESYNC, duplicate_postponed_stream);

    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 0);

    CGovernanceObject syncable_object{uint256(), /*revision=*/1, GetTime() + 1, uint256S("02"), /*data=*/{}};
    m_node.govman->AddGovernanceObjectForTesting(syncable_object);

    const uint256 syncable_object_hash{syncable_object.GetHash()};
    const std::string syncable_vote_sync_request{strprintf("%s-votes-%s", NetMsgType::MNGOVERNANCESYNC,
                                                           syncable_object_hash.ToString())};
    BOOST_CHECK(!m_node.netfulfilledman->HasFulfilledRequest(peer->addr, syncable_vote_sync_request));

    connman.FlushSendBuffer(*peer);
    auto syncable_object_fetch_stream = make_request_stream(syncable_object_hash, CBloomFilter{});
    net_gov.ProcessMessage(*peer, NetMsgType::MNGOVERNANCESYNC, syncable_object_fetch_stream);

    BOOST_CHECK_EQUAL(CountQueuedInventory(*peer, CInv{MSG_GOVERNANCE_OBJECT, syncable_object_hash}), 1U);
    BOOST_CHECK(!m_node.netfulfilledman->HasFulfilledRequest(peer->addr, syncable_vote_sync_request));
    BOOST_CHECK_EQUAL(CountQueuedMessages(*peer, NetMsgType::SYNCSTATUSCOUNT), 0U);
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 0);

    connman.FlushSendBuffer(*peer);
    auto duplicate_syncable_object_fetch_stream = make_request_stream(syncable_object_hash, CBloomFilter{});
    net_gov.ProcessMessage(*peer, NetMsgType::MNGOVERNANCESYNC, duplicate_syncable_object_fetch_stream);

    BOOST_CHECK_EQUAL(CountQueuedInventory(*peer, CInv{MSG_GOVERNANCE_OBJECT, syncable_object_hash}), 1U);
    BOOST_CHECK(!m_node.netfulfilledman->HasFulfilledRequest(peer->addr, syncable_vote_sync_request));
    BOOST_CHECK_EQUAL(CountQueuedMessages(*peer, NetMsgType::SYNCSTATUSCOUNT), 0U);
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 0);

    connman.FlushSendBuffer(*peer);
    auto syncable_stream = make_request_stream(syncable_object_hash, vote_filter);
    net_gov.ProcessMessage(*peer, NetMsgType::MNGOVERNANCESYNC, syncable_stream);

    BOOST_CHECK(m_node.netfulfilledman->HasFulfilledRequest(peer->addr, syncable_vote_sync_request));
    BOOST_CHECK_EQUAL(CountQueuedMessages(*peer, NetMsgType::SYNCSTATUSCOUNT), 1U);
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 0);

    auto duplicate_syncable_stream = make_request_stream(syncable_object_hash, vote_filter);
    net_gov.ProcessMessage(*peer, NetMsgType::MNGOVERNANCESYNC, duplicate_syncable_stream);

    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 20);

    connman.FlushSendBuffer(*peer);
    CGovernanceObject empty_filter_object{uint256(), /*revision=*/1, GetTime() + 2, uint256S("03"), /*data=*/{}};
    m_node.govman->AddPostponedObject(empty_filter_object);
    const uint256 empty_filter_object_hash{empty_filter_object.GetHash()};
    const std::string empty_filter_vote_request{strprintf("%s-votes-%s", NetMsgType::MNGOVERNANCESYNC,
                                                          empty_filter_object_hash.ToString())};
    auto empty_filter_stream = make_request_stream(empty_filter_object_hash, CBloomFilter{});
    net_gov.ProcessMessage(*peer, NetMsgType::MNGOVERNANCESYNC, empty_filter_stream);

    BOOST_CHECK_EQUAL(CountQueuedInventory(*peer, CInv{MSG_GOVERNANCE_OBJECT, empty_filter_object_hash}), 1U);
    BOOST_CHECK(!m_node.netfulfilledman->HasFulfilledRequest(peer->addr, empty_filter_vote_request));
    BOOST_CHECK_EQUAL(CountQueuedMessages(*peer, NetMsgType::SYNCSTATUSCOUNT), 0U);
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 20);

    connman.FlushSendBuffer(*peer);
    auto duplicate_empty_filter_stream = make_request_stream(empty_filter_object_hash, CBloomFilter{});
    net_gov.ProcessMessage(*peer, NetMsgType::MNGOVERNANCESYNC, duplicate_empty_filter_stream);

    BOOST_CHECK_EQUAL(CountQueuedInventory(*peer, CInv{MSG_GOVERNANCE_OBJECT, empty_filter_object_hash}), 1U);
    BOOST_CHECK(!m_node.netfulfilledman->HasFulfilledRequest(peer->addr, empty_filter_vote_request));
    BOOST_CHECK_EQUAL(CountQueuedMessages(*peer, NetMsgType::SYNCSTATUSCOUNT), 0U);
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 20);

    const uint256 unknown_vote_hash{uint256S("09")};
    const std::string unknown_vote_request{strprintf("%s-votes-%s", NetMsgType::MNGOVERNANCESYNC,
                                                     unknown_vote_hash.ToString())};
    auto unknown_vote_stream = make_request_stream(unknown_vote_hash, vote_filter);
    net_gov.ProcessMessage(*peer, NetMsgType::MNGOVERNANCESYNC, unknown_vote_stream);

    BOOST_CHECK(!m_node.netfulfilledman->HasFulfilledRequest(peer->addr, unknown_vote_request));
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 20);

    auto duplicate_unknown_vote_stream = make_request_stream(unknown_vote_hash, vote_filter);
    net_gov.ProcessMessage(*peer, NetMsgType::MNGOVERNANCESYNC, duplicate_unknown_vote_stream);

    BOOST_CHECK(!m_node.netfulfilledman->HasFulfilledRequest(peer->addr, unknown_vote_request));
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 20);

    const uint256 object_fetch_hash{uint256S("0a")};
    const std::string object_fetch_request{strprintf("%s-votes-%s", NetMsgType::MNGOVERNANCESYNC,
                                                     object_fetch_hash.ToString())};
    auto object_fetch_stream = make_request_stream(object_fetch_hash, CBloomFilter{});
    net_gov.ProcessMessage(*peer, NetMsgType::MNGOVERNANCESYNC, object_fetch_stream);

    BOOST_CHECK(!m_node.netfulfilledman->HasFulfilledRequest(peer->addr, object_fetch_request));
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 20);

    auto duplicate_object_fetch_stream = make_request_stream(object_fetch_hash, CBloomFilter{});
    net_gov.ProcessMessage(*peer, NetMsgType::MNGOVERNANCESYNC, duplicate_object_fetch_stream);

    BOOST_CHECK(!m_node.netfulfilledman->HasFulfilledRequest(peer->addr, object_fetch_request));
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 20);

    m_node.peerman->FinalizeNode(*peer);
}

BOOST_AUTO_TEST_CASE(governance_objects_require_peer_announcement_or_request)
{
    LOCK(NetEventsInterface::g_msgproc_mutex);

    TestChainState& chainstate =
        *static_cast<TestChainState*>(&m_node.chainman->ActiveChainstate());
    chainstate.JumpOutOfIbd();

    NetGovernance net_gov(m_node.peerman.get(), *m_node.govman, *m_node.mn_sync,
                          *m_node.netfulfilledman, *m_node.connman);

    auto announcing_peer{MakeGovernanceInvPeer(/*id=*/11)};
    auto second_announcing_peer{MakeGovernanceInvPeer(/*id=*/12)};
    auto unsolicited_peer{MakeGovernanceInvPeer(/*id=*/13)};
    m_node.peerman->InitializeNode(*announcing_peer, NODE_NETWORK);
    m_node.peerman->InitializeNode(*second_announcing_peer, NODE_NETWORK);
    m_node.peerman->InitializeNode(*unsolicited_peer, NODE_NETWORK);

    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *announcing_peer), 0);

    const CGovernanceObject govobj{MakeGovernanceObject(GetTime<std::chrono::seconds>().count(), uint256S("21"))};
    const CInv object_inv{MSG_GOVERNANCE_OBJECT, govobj.GetHash()};

    ProcessInv(*m_node.peerman, *announcing_peer, object_inv);
    ProcessInv(*m_node.peerman, *second_announcing_peer, object_inv);
    // Pre-seed the object so ProcessObject short-circuits on "already seen" and the
    // acceptance gate is exercised in isolation from collateral/chain validation. Both
    // ProcessInv calls ran first, so the object was still absent at INV time and both
    // peers registered a real pending request in the net-layer tracker.
    m_node.govman->AddPostponedObject(govobj);

    // Announcing peer: the gate accepts (it announced the inv) and consumes its per-peer
    // request entry. Checking the entry is gone proves the gate actually consulted the
    // net-layer tracker, independent of the pre-seed above (a rejected object would leave
    // the entry untouched).
    ProcessGovernanceObject(net_gov, *announcing_peer, govobj);
    BOOST_CHECK(
        !WITH_LOCK(::cs_main, return m_node.peerman->PeerConsumeObjectRequest(announcing_peer->GetId(), object_inv)));
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *announcing_peer), 0);

    ProcessGovernanceObject(net_gov, *second_announcing_peer, govobj);
    // Consumption is per-peer: the second announcer's own entry is accepted and consumed,
    // independent of the first peer's already-consumed entry.
    BOOST_CHECK(!WITH_LOCK(::cs_main,
                           return m_node.peerman->PeerConsumeObjectRequest(second_announcing_peer->GetId(), object_inv)));
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *second_announcing_peer), 0);

    const CGovernanceObject unsolicited_govobj{MakeGovernanceObject(GetTime<std::chrono::seconds>().count() + 1, uint256S("22"))};
    ProcessGovernanceObject(net_gov, *unsolicited_peer, unsolicited_govobj);
    BOOST_CHECK(!m_node.govman->HaveObjectForHash(unsolicited_govobj.GetHash()));
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *unsolicited_peer), 0);

    m_node.peerman->FinalizeNode(*announcing_peer);
    m_node.peerman->FinalizeNode(*second_announcing_peer);
    m_node.peerman->FinalizeNode(*unsolicited_peer);
    chainstate.ResetIbd();
}

BOOST_AUTO_TEST_CASE(governance_objects_wait_for_the_collateral_index)
{
    LOCK(NetEventsInterface::g_msgproc_mutex);

    TestChainState& chainstate =
        *static_cast<TestChainState*>(&m_node.chainman->ActiveChainstate());
    chainstate.JumpOutOfIbd();

    NetGovernance net_gov(m_node.peerman.get(), *m_node.govman, *m_node.mn_sync,
                          *m_node.netfulfilledman, *m_node.connman);
    auto peer{MakeGovernanceInvPeer(/*id=*/31)};
    m_node.peerman->InitializeNode(*peer, NODE_NETWORK);
    auto flooding_peer{MakeGovernanceInvPeer(/*id=*/32)};
    m_node.peerman->InitializeNode(*flooding_peer, NODE_NETWORK);

    // Its collateral doesn't exist, so the object is invalid once collateral can be looked up
    const CGovernanceObject govobj{MakeGovernanceObject(GetTime<std::chrono::seconds>().count(), uint256S("31"))};
    const CInv object_inv{MSG_GOVERNANCE_OBJECT, govobj.GetHash()};

    // An index that hasn't synced yet would report every collateral as missing
    m_collateral.synced = false;
    BOOST_REQUIRE(m_node.govman->IsCollateralSourceBehind());

    // The announcement is held instead of requested
    ProcessInv(*m_node.peerman, *peer, object_inv);
    m_node.peerman->SendMessages(peer.get());
    BOOST_CHECK_EQUAL(CountQueuedInventory(*peer, object_inv, NetMsgType::GETDATA), 0U);
    BOOST_CHECK(!WITH_LOCK(::cs_main, return m_node.peerman->PeerConsumeObjectRequest(peer->GetId(), object_inv)));
    ProcessGovernanceObject(net_gov, *peer, govobj);
    BOOST_CHECK(!m_node.govman->HaveObjectForHash(govobj.GetHash()));
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 0);

    // The peer's transaction announcements take up all the announcements it may have pending
    // (MAX_PEER_OBJECT_ANNOUNCEMENTS)
    std::vector<CInv> tx_invs;
    for (uint64_t i = 0; i < 2 * MAX_INV_SZ; ++i) {
        tx_invs.emplace_back(MSG_TX, ArithToUint256(arith_uint256{i}));
    }
    ProcessInvs(*m_node.peerman, *peer, {tx_invs.begin(), tx_invs.begin() + MAX_INV_SZ});
    ProcessInvs(*m_node.peerman, *peer, {tx_invs.begin() + MAX_INV_SZ, tx_invs.end()});

    // As many announcements as a peer may have pending are held, in INVs of MAX_INV_SZ
    std::vector<CInv> vote_invs;
    for (uint64_t i = 0; i < 2 * MAX_INV_SZ; ++i) {
        vote_invs.emplace_back(MSG_GOVERNANCE_OBJECT_VOTE, ArithToUint256(arith_uint256{i}));
        if (vote_invs.size() == MAX_INV_SZ) {
            ProcessInvs(*m_node.peerman, *flooding_peer, vote_invs);
            vote_invs.clear();
        }
    }
    BOOST_CHECK(!flooding_peer->fDisconnect);
    // One more can't be held, and the peer won't announce it again on this connection, so the peer is disconnected
    // right away, before governance sync could ask it for anything that would stop a new connection from being asked
    ProcessInv(*m_node.peerman, *flooding_peer, CInv{MSG_GOVERNANCE_OBJECT_VOTE, ArithToUint256(arith_uint256{2 * MAX_INV_SZ})});
    BOOST_CHECK(flooding_peer->fDisconnect);
    BOOST_CHECK(m_node.govman->IsCollateralSourceBehind());

    // Still held after the index has synced while the blockchain isn't synced, which governance also waits for
    m_collateral.synced = true;
    m_node.mn_sync->Reset(/*fForce=*/true, /*fNotifyReset=*/false);
    m_node.peerman->SendMessages(peer.get());
    BOOST_CHECK_EQUAL(CountQueuedInventory(*peer, object_inv, NetMsgType::GETDATA), 0U);

    // Once both have synced, it still waits while the peer has no room for another pending announcement
    m_node.mn_sync->SwitchToNextAsset();
    BOOST_REQUIRE(m_node.mn_sync->IsBlockchainSynced());
    m_node.peerman->SendMessages(peer.get());
    BOOST_CHECK_EQUAL(CountQueuedInventory(*peer, object_inv, NetMsgType::GETDATA), 0U);
    BOOST_CHECK(!peer->fDisconnect);

    // Then the object is requested from the same peer without it announcing the object again, and is rejected and
    // punished
    for (const CInv& tx_inv : tx_invs) {
        WITH_LOCK(::cs_main, m_node.peerman->PeerForgetObjectRequest(tx_inv));
    }
    m_node.peerman->SendMessages(peer.get());
    BOOST_CHECK_EQUAL(CountQueuedInventory(*peer, object_inv, NetMsgType::GETDATA), 1U);
    ProcessGovernanceObject(net_gov, *peer, govobj);
    BOOST_CHECK(!m_node.govman->HaveObjectForHash(govobj.GetHash()));
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 20);

    BOOST_CHECK(!peer->fDisconnect);

    m_node.peerman->FinalizeNode(*flooding_peer);
    m_node.peerman->FinalizeNode(*peer);
    chainstate.ResetIbd();
}

BOOST_AUTO_TEST_CASE(governance_votes_require_peer_announcement_or_request)
{
    LOCK(NetEventsInterface::g_msgproc_mutex);

    TestChainState& chainstate =
        *static_cast<TestChainState*>(&m_node.chainman->ActiveChainstate());
    chainstate.JumpOutOfIbd();

    NetGovernance net_gov(m_node.peerman.get(), *m_node.govman, *m_node.mn_sync,
                          *m_node.netfulfilledman, *m_node.connman);

    auto announcing_peer{MakeGovernanceInvPeer(/*id=*/21)};
    auto second_announcing_peer{MakeGovernanceInvPeer(/*id=*/22)};
    auto unsolicited_peer{MakeGovernanceInvPeer(/*id=*/23)};
    m_node.peerman->InitializeNode(*announcing_peer, NODE_NETWORK);
    m_node.peerman->InitializeNode(*second_announcing_peer, NODE_NETWORK);
    m_node.peerman->InitializeNode(*unsolicited_peer, NODE_NETWORK);

    // The vote below carries an unknown masternode outpoint, so CGovernanceManager::ProcessVote
    // rejects it with a penalty of 20. Only a peer that passes the announce-then-request gate
    // reaches ProcessVote at all, which makes the score the observable for the gate itself.
    // Penalties are applied only once fully synced.
    m_node.mn_sync->SwitchToNextAsset();
    BOOST_REQUIRE(m_node.mn_sync->IsSynced());

    const CGovernanceVote vote{MakeGovernanceVote(uint256S("31"))};
    const CInv vote_inv{MSG_GOVERNANCE_OBJECT_VOTE, vote.GetHash()};

    ProcessGovernanceVote(net_gov, *unsolicited_peer, vote);
    BOOST_CHECK_EQUAL(CountQueuedMessages(*unsolicited_peer, NetMsgType::MNGOVERNANCESYNC), 0U);
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *unsolicited_peer), 0);

    ProcessInv(*m_node.peerman, *announcing_peer, vote_inv);
    ProcessInv(*m_node.peerman, *second_announcing_peer, vote_inv);

    ProcessGovernanceVote(net_gov, *announcing_peer, vote);
    BOOST_CHECK(
        !WITH_LOCK(::cs_main, return m_node.peerman->PeerConsumeObjectRequest(announcing_peer->GetId(), vote_inv)));
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *announcing_peer), 20);

    ProcessGovernanceVote(net_gov, *second_announcing_peer, vote);
    // Consumption is per-peer: the second announcer's own entry is accepted and consumed,
    // independent of the first peer's already-consumed entry.
    BOOST_CHECK(!WITH_LOCK(::cs_main,
                           return m_node.peerman->PeerConsumeObjectRequest(second_announcing_peer->GetId(), vote_inv)));
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *second_announcing_peer), 20);

    m_node.peerman->FinalizeNode(*announcing_peer);
    m_node.peerman->FinalizeNode(*second_announcing_peer);
    m_node.peerman->FinalizeNode(*unsolicited_peer);
    chainstate.ResetIbd();
}

// A message received while not blockchain-synced is dropped, but the per-peer authorization must
// survive so a retransmit after sync is still accepted (the consume happens after the sync gate).
BOOST_AUTO_TEST_CASE(governance_vote_authorization_survives_unsynced_drop)
{
    LOCK(NetEventsInterface::g_msgproc_mutex);

    TestChainState& chainstate =
        *static_cast<TestChainState*>(&m_node.chainman->ActiveChainstate());
    chainstate.JumpOutOfIbd();

    NetGovernance net_gov(m_node.peerman.get(), *m_node.govman, *m_node.mn_sync,
                          *m_node.netfulfilledman, *m_node.connman);

    auto peer{MakeGovernanceInvPeer(/*id=*/31)};
    m_node.peerman->InitializeNode(*peer, NODE_NETWORK);

    const CGovernanceVote vote{MakeGovernanceVote(uint256S("41"))};
    const CInv vote_inv{MSG_GOVERNANCE_OBJECT_VOTE, vote.GetHash()};

    // Synced: announce the vote so we hold a per-peer request for it.
    BOOST_REQUIRE(m_node.mn_sync->IsBlockchainSynced());
    ProcessInv(*m_node.peerman, *peer, vote_inv);

    // Not synced: delivering the vote is dropped at the sync gate and must NOT consume the request.
    m_node.mn_sync->Reset(/*fForce=*/true, /*fNotifyReset=*/false);
    BOOST_REQUIRE(!m_node.mn_sync->IsBlockchainSynced());
    ProcessGovernanceVote(net_gov, *peer, vote);
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 0);

    // Back in sync, the retransmit is still authorized and reaches ProcessVote, which rejects the
    // unknown masternode outpoint with a penalty of 20. Had the unsynced drop consumed the request,
    // the gate would now reject the vote as unrequested and return before ProcessVote, leaving the
    // score at 0.
    while (!m_node.mn_sync->IsSynced()) {
        m_node.mn_sync->SwitchToNextAsset();
    }
    ProcessGovernanceVote(net_gov, *peer, vote);
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 20);

    m_node.peerman->FinalizeNode(*peer);
    chainstate.ResetIbd();
}

// A vote whose parent object is unknown must prove masternode authorship before it is cached.
BOOST_AUTO_TEST_CASE(orphan_votes_require_a_valid_masternode_signature)
{
    LOCK(NetEventsInterface::g_msgproc_mutex);

    TestChainState& chainstate =
        *static_cast<TestChainState*>(&m_node.chainman->ActiveChainstate());
    chainstate.JumpOutOfIbd();

    // Penalties are applied only once fully synced.
    m_node.mn_sync->SwitchToNextAsset();
    BOOST_REQUIRE(m_node.mn_sync->IsSynced());

    NetGovernance net_gov(m_node.peerman.get(), *m_node.govman, *m_node.mn_sync,
                          *m_node.netfulfilledman, *m_node.connman);

    auto peer{MakeGovernanceInvPeer(/*id=*/41)};
    m_node.peerman->InitializeNode(*peer, NODE_NETWORK);
    auto& connman = static_cast<ConnmanTestMsg&>(*m_node.connman);

    // The tip masternode list is empty in this setup, so no vote can name a known collateral.
    const CGovernanceVote vote{MakeGovernanceVote(uint256S("51"))};
    const CInv vote_inv{MSG_GOVERNANCE_OBJECT_VOTE, vote.GetHash()};

    ProcessInv(*m_node.peerman, *peer, vote_inv);
    connman.FlushSendBuffer(*peer);
    ProcessGovernanceVote(net_gov, *peer, vote);

    BOOST_CHECK(m_node.govman->GetOrphanVoteObjectHashes().empty());
    BOOST_CHECK_EQUAL(CountQueuedMessages(*peer, NetMsgType::MNGOVERNANCESYNC), 0U);
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *peer), 20);

    m_node.peerman->FinalizeNode(*peer);
    chainstate.ResetIbd();
}

// The same unauthenticated vote must cost the sender the same whether or not its parent object
// happens to have arrived first.
BOOST_AUTO_TEST_CASE(invalid_vote_is_scored_alike_with_and_without_a_parent_object)
{
    LOCK(NetEventsInterface::g_msgproc_mutex);

    TestChainState& chainstate =
        *static_cast<TestChainState*>(&m_node.chainman->ActiveChainstate());
    chainstate.JumpOutOfIbd();

    m_node.mn_sync->SwitchToNextAsset();
    BOOST_REQUIRE(m_node.mn_sync->IsSynced());
    // The known-object path runs CGovernanceObject::ProcessVote, which asserts metaman.IsValid().
    BOOST_REQUIRE(m_node.mn_metaman->LoadCache(/*load_cache=*/false));

    NetGovernance net_gov(m_node.peerman.get(), *m_node.govman, *m_node.mn_sync,
                          *m_node.netfulfilledman, *m_node.connman);

    auto orphan_peer{MakeGovernanceInvPeer(/*id=*/51)};
    auto known_parent_peer{MakeGovernanceInvPeer(/*id=*/52)};
    m_node.peerman->InitializeNode(*orphan_peer, NODE_NETWORK);
    m_node.peerman->InitializeNode(*known_parent_peer, NODE_NETWORK);

    const CGovernanceObject govobj{MakeGovernanceObject(GetTime<std::chrono::seconds>().count(), uint256S("61"))};
    const CGovernanceVote orphan_vote{MakeGovernanceVote(uint256S("62"))};
    const CGovernanceVote known_parent_vote{MakeGovernanceVote(govobj.GetHash())};

    ProcessInv(*m_node.peerman, *orphan_peer, CInv{MSG_GOVERNANCE_OBJECT_VOTE, orphan_vote.GetHash()});
    ProcessGovernanceVote(net_gov, *orphan_peer, orphan_vote);
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *orphan_peer), 20);

    m_node.govman->AddGovernanceObjectForTesting(govobj);
    ProcessInv(*m_node.peerman, *known_parent_peer, CInv{MSG_GOVERNANCE_OBJECT_VOTE, known_parent_vote.GetHash()});
    ProcessGovernanceVote(net_gov, *known_parent_peer, known_parent_vote);
    BOOST_CHECK_EQUAL(MisbehaviorScore(*m_node.peerman, *known_parent_peer), 20);

    m_node.peerman->FinalizeNode(*orphan_peer);
    m_node.peerman->FinalizeNode(*known_parent_peer);
    chainstate.ResetIbd();
}

// Every orphan parent hash is re-requested from every peer on each governance tick, and one
// masternode key can sign votes for any number of invented parents, so the hashes requested per tick
// must stay bounded.
BOOST_AUTO_TEST_CASE(orphan_object_requests_are_capped_per_tick)
{
    constexpr size_t cap{CGovernanceManager::MAX_ORPHAN_OBJECT_REQUESTS};
    std::set<uint256> parents;
    const auto add_orphans = [&](size_t count) {
        for (size_t i = 0; i < count; ++i) {
            const uint256 parent{GetRandHash()};
            parents.insert(parent);
            m_node.govman->AddOrphanVoteForTesting(MakeGovernanceVote(parent));
        }
    };

    // Up to the cap, every orphan parent is requested.
    add_orphans(cap);
    auto hashes{m_node.govman->GetOrphanVoteObjectHashes()};
    BOOST_CHECK(std::set<uint256>(hashes.begin(), hashes.end()) == parents);

    // Beyond it, each tick requests exactly cap distinct ones among them.
    add_orphans(cap);
    for (int tick = 0; tick < 2; ++tick) {
        hashes = m_node.govman->GetOrphanVoteObjectHashes();
        BOOST_CHECK_EQUAL(hashes.size(), cap);
        const std::set<uint256> unique(hashes.begin(), hashes.end());
        BOOST_CHECK_EQUAL(unique.size(), cap);
        BOOST_CHECK(std::includes(parents.begin(), parents.end(), unique.begin(), unique.end()));
    }
}


BOOST_AUTO_TEST_SUITE_END()