feat: skip processing old state witnesses

chain/client/src/stateless_validation/chunk_validator/mod.rs

@@ -632,6 +632,25 @@ impl Client {
         // wait for validation to finish.
         self.send_state_witness_ack(&witness);
 
+        // Avoid processing state witness for old chunks.
+        // In particular it is impossible for a chunk created at a height
+        // that doesn't exceed the height of the current final block to be
+        // included in the chain. This addresses both network-delayed messages
+        // as well as malicious behavior of a chunk producer.
+        if let Ok(final_head) = self.chain.final_head() {
+            if witness.chunk_header.height_created() <= final_head.height {
+                tracing::debug!(
+                    target: "stateless_validation",
+                    chunk_hash=?witness.chunk_header.chunk_hash(),
+                    shard_id=witness.chunk_header.shard_id(),
+                    witness_height=witness.chunk_header.height_created(),
+                    final_height=final_head.height,
+                    "Skipping state witness below the last final block",
+                );
+                return Ok(());
+            }
+        }
+
         match self.chain.get_block(witness.chunk_header.prev_block_hash()) {
             Ok(block) => self.process_chunk_state_witness_with_prev_block(
                 witness,