Audit the voting power that signed a CometBFT commit
Counting signatures obscures voting power and can include a vote for nil. Interpret the block ID flags and use the validator set for the commit height.
Classify commit signatures
Set RPC to a CometBFT endpoint retaining the target height. Inspect signed_header.commit.signatures and paginate the complete validator set for that same height. Match committed votes to validator addresses.
curl -fsS "$RPC/commit?height=12000"
curl -fsS "$RPC/validators?height=12000&page=1&per_page=100"
For the CometBFT 0.38 flags, 2 denotes a vote for the block, 3 a nil vote and 1 absence. If the voting powers are 45, 30 and 25 and only the first two commit to the block, the committed power is 75 of 100.
Understand what the audit establishes
This calculation describes the node’s reported commit. Authenticating an untrusted response additionally requires checking header and commit signatures against a trusted validator set. When consuming last_commit from a block, check its own height before loading validators. github.com CometBFT RPC