fix: validate proof of work on block acceptance

[Jiyacodex]

Addressed Issues:

Received blocks were checked for linkage and hash consistency, but their hashes were not verified against the required Proof-of-Work difficulty.

This PR adds PoW validation to validate_block_link_and_hash(). Since both add_block() and resolve_conflicts() use this shared validator, invalid-PoW blocks are now rejected during both normal block acceptance and chain reorganization.

Screenshots/Recordings:

Not applicable.

Additional Notes:

Added regression tests covering both affected paths:

• add_block() rejects a block whose hash does not satisfy its claimed difficulty.
• resolve_conflicts() rejects a candidate chain containing a block with invalid PoW.

The regression tests fail without the PoW validation check and pass with the fix.

Testing:

• python -m pytest tests/test_pow_validation.py -v: 2 passed
• python -m pytest: 75 passed, 1 pre-existing failure in TestSmartContract.test_out_of_gas
  • Expected: Out of gas!
  • Actual: Execution timed out
  • The same failure was reproduced on untouched origin/main

AI Usage Disclosure:

• This PR does not contain AI-generated code at all.
• This PR contains AI-generated code. I have read the AI Usage Policy and this PR complies with this policy. I have tested the code locally and I am responsible for it.

I have used the following AI models and tools: ChatGPT and Claude for reviewing the changes and refining the tests.

Checklist

• My PR addresses a single issue, fixes a single bug or makes a single improvement.
• My code follows the project's code style and conventions
• If applicable, I have made corresponding changes or additions to the documentation
• If applicable, I have made corresponding changes or additions to tests
• My changes generate no new warnings or errors
• I have joined the Discord server and I will share a link to this PR with the project maintainers there
• I have read the Contribution Guidelines
• Once I submit my PR, CodeRabbit AI will automatically review it and I will address CodeRabbit's comments.
• I have filled this PR template completely and carefully, and I understand that my PR may be closed without review otherwise.

Summary by CodeRabbit

• Bug Fixes
  • Improved block validation to reject blocks that do not meet the required proof-of-work difficulty.
  • Added safeguards so invalid chains are not accepted during block addition or conflict resolution.

[coderabbitai]

Warning

Review limit reached

@Jiyacodex, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 9 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 31e9e090-a915-455f-a570-176d884be3d4

📥 Commits

Reviewing files that changed from the base of the PR and between 2b20b43 and 7a7f3c1.

📒 Files selected for processing (1)

• minichain/chain.py

Walkthrough

Adds a Proof-of-Work difficulty enforcement check to block validation, rejecting blocks whose hash does not start with the required number of leading zeros. Adds a new test module covering rejection of invalid-PoW blocks in both add_block and resolve_conflicts flows.

Changes

PoW Validation

Layer / File(s)	Summary
PoW difficulty check minichain/chain.py	validate_block_link_and_hash now raises ValueError when block.hash does not start with "0" * block.difficulty.
Invalid PoW rejection tests tests/test_pow_validation.py	Adds a helper to build a block with an intentionally invalid hash, and tests confirming add_block returns ValidationStatus.INVALID and resolve_conflicts rejects the chain, leaving chain length unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested labels: Python Lang

Poem

A hash must wear its zeros right,
Or else it fails the PoW light. 🐰
I nudged the nonce, I broke the chain,
To prove the guard rejects in vain—
No shortcuts hop past difficulty's gate!

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: enforcing proof-of-work validation when accepting blocks.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@minichain/chain.py`:
- Around line 28-31: The PoW validation in block handling is currently tied to
fragile string matching in add_block, where ValueError classification depends on
whether the message contains “hash.” Update the proof-of-work check in the block
validation path to raise a distinct error type or carry an explicit reason/code
from the PoW check, and update add_block to classify based on that symbol
instead of substring inspection. Use the existing block validation logic and
add_block flow to keep INVALID vs FAILED handling stable even if the error
wording changes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3f2bc44e-a4f5-4c11-a81e-8a5cdfd08fec

📥 Commits

Reviewing files that changed from the base of the PR and between 4334478 and 2b20b43.

📒 Files selected for processing (2)

• minichain/chain.py
• tests/test_pow_validation.py