Bug Report

Setup

CometBFT version (use cometbft version or git rev-parse --verify HEAD if installed from source):
635d0b5

Have you tried the latest version: yes

ABCI app (name for built-in, URL for self-written if it's publicly available):
https://github.com/bnb-chain/greenfield

node command runtime flags:

./gnfd rollback --home ./ --hard

What happened?

Rollback at a specific height causes the node to fail to start. This is caused by the error code:

According to the definition of the State struct as below

LastHeightValidatorsChanged satisfy the following condition under any circumstances
1 <= state.LastHeightValidatorsChanged <= state.LastBlockHeight + 1 + 1

this condition can also be confirmed by looking at the code in func (store dbStore) save(state State, key []byte) error

state.LastHeightValidatorsChanged is with nextHeight + 1(state.LastBlockHeight + 1 + 1) corresponds.

When we rollback from block height state.LastHeightValidatorsChanged - 1 to height state.LastHeightValidatorsChanged - 2, newState.LastHeightValidatorsChanged would be wrong to modified into the state.LastHeightValidatorsChanged - 1

What did you expect to happen?

Node start properly while rollbacked from state.LastHeightValidatorsChanged-1 height to state.LastHeightValidatorsChanged-2 height

How to reproduce it

Let me give an example to describe the issue:

example

... => [block 242 (5validators)] ==state1(5validators)==> [block 243 (5validators)] ==state2(4validators)==> [block 244 (4validators)] => ...

1. Assume that the current height of the block is 243, current state is state2 and state2.LastHeightValidatorsChanged == 244, validatorSet changed to 4 validators in the block 244 and state2

2. Rollback to block 242 and state1, the target rollbackHeight == 242

3. Since the error code,

   cometbft/internal/state/rollback.go

   Line 71 in 635d0b5

   valChangeHeight = rollbackHeight + 1

   
   state1.LastHeightValidatorsChanged was changed to 243 incorrectly and it should be 244

4. After rollbacked to block 242, node could not start properly

Anything else we need to know

I've already made a pr fix for this issue:
#2136