Merge pull request #6 from opentensor/polkadot-stable2506-2-otf-mev-block-builder

Shielded transactions support in block proposer

Author: sam0x17

Cargo.lock

@@ -594,6 +594,7 @@ unexpected_cfgs = { level = "warn", check-cfg = [
 	'cfg(ignore_flaky_test)',
 	'cfg(substrate_runtime)',
 ] }
+mismatched_lifetime_syntaxes = "allow"
 
 [workspace.lints.clippy]
 all = { level = "allow", priority = 0 }
@@ -1468,6 +1469,11 @@ zombienet-orchestrator = { version = "0.3.0" }
 zombienet-sdk = { version = "0.3.0" }
 zstd = { version = "0.12.4", default-features = false }
 
+stp-shield = { path = "substrate/primitives/shield", default-features = false }
+stc-shield = { path = "substrate/client/shield", default-features = false }
+ml-kem = { version = "0.2.2", default-features = false }
+chacha20poly1305 = { version = "0.10", default-features = false }
+
 [profile.release]
 # Polkadot runtime requires unwinding.
 opt-level = 3

Cargo.toml

@@ -41,9 +41,11 @@ sp-inherents.default-features = true
 sp-inherents.workspace = true
 sp-runtime.default-features = true
 sp-runtime.workspace = true
+stp-shield = { workspace = true, default-features = true}
 
 [dev-dependencies]
 parking_lot = { workspace = true, default-features = true }
 sc-client-api = { default-features = true, workspace = true }
 sc-transaction-pool = { default-features = true, workspace = true }
 substrate-test-runtime-client = { workspace = true }
+stc-shield = { workspace = true, default-features = true }

substrate/client/basic-authorship/Cargo.toml

@@ -1,5 +1,17 @@
 Basic implementation of block-authoring logic.
 
+## MEV Shield integration
+
+When a `ShieldKeystorePtr` is provided to `ProposerFactory`, the proposer will handle shielded transactions during block authoring:
+
+1. Each pending transaction is inspected via the `ShieldApi` runtime API to detect whether it is a shielded wrapper.
+2. Shielded transactions are decrypted on the spot using the keystore registered as a runtime extension. Block size accounting is adjusted to reflect the inner plaintext size rather than the ciphertext size.
+3. If the wrapper extrinsic applies successfully, the decrypted inner transaction is immediately pushed into the block as a second extrinsic.
+
+Decryption happens only at block authoring time, never earlier. Setting the environment variable `SUBSTRATE_SKIP_SHIELDED_TXS=1` causes the proposer to skip all shielded transactions (leaving them in the pool for other authors).
+
+See [`stp-shield`](../../primitives/shield) and [`stc-shield`](../shield) for the underlying types and keystore implementation.
+
 # Example
 
 ```rust