@lodestar/beacon-node 1.35.0-dev.b42a298a7c → 1.35.0-dev.ba92bd8a88

package/src/chain/validation/dataColumnSidecar.ts

@@ -0,0 +1,381 @@
+import {ChainConfig} from "@lodestar/config";
+import {
+  KZG_COMMITMENTS_INCLUSION_PROOF_DEPTH,
+  KZG_COMMITMENTS_SUBTREE_INDEX,
+  NUMBER_OF_COLUMNS,
+} from "@lodestar/params";
+import {computeStartSlotAtEpoch, getBlockHeaderProposerSignatureSet} from "@lodestar/state-transition";
+import {Root, Slot, SubnetID, fulu, ssz} from "@lodestar/types";
+import {toRootHex, verifyMerkleBranch} from "@lodestar/utils";
+import {Metrics} from "../../metrics/metrics.js";
+import {kzg} from "../../util/kzg.js";
+import {
+  DataColumnSidecarErrorCode,
+  DataColumnSidecarGossipError,
+  DataColumnSidecarValidationError,
+} from "../errors/dataColumnSidecarError.js";
+import {GossipAction} from "../errors/gossipValidation.js";
+import {IBeaconChain} from "../interface.js";
+import {RegenCaller} from "../regen/interface.js";
+
+// SPEC FUNCTION
+// https://github.com/ethereum/consensus-specs/blob/v1.6.0-alpha.4/specs/fulu/p2p-interface.md#data_column_sidecar_subnet_id
+export async function validateGossipDataColumnSidecar(
+  chain: IBeaconChain,
+  dataColumnSidecar: fulu.DataColumnSidecar,
+  gossipSubnet: SubnetID,
+  metrics: Metrics | null
+): Promise<void> {
+  const blockHeader = dataColumnSidecar.signedBlockHeader.message;
+
+  // 1) [REJECT] The sidecar is valid as verified by verify_data_column_sidecar
+  verifyDataColumnSidecar(dataColumnSidecar);
+
+  // 2) [REJECT] The sidecar is for the correct subnet -- i.e. compute_subnet_for_data_column_sidecar(sidecar.index) == subnet_id
+  if (computeSubnetForDataColumnSidecar(chain.config, dataColumnSidecar) !== gossipSubnet) {
+    throw new DataColumnSidecarGossipError(GossipAction.REJECT, {
+      code: DataColumnSidecarErrorCode.INVALID_SUBNET,
+      columnIdx: dataColumnSidecar.index,
+      gossipSubnet: gossipSubnet,
+    });
+  }
+
+  // 3) [IGNORE] The sidecar is not from a future slot (with a MAXIMUM_GOSSIP_CLOCK_DISPARITY allowance)
+  //             -- i.e. validate that sidecar.slot <= current_slot (a client MAY queue future blocks
+  //             for processing at the appropriate slot).
+  const currentSlotWithGossipDisparity = chain.clock.currentSlotWithGossipDisparity;
+  if (currentSlotWithGossipDisparity < blockHeader.slot) {
+    throw new DataColumnSidecarGossipError(GossipAction.IGNORE, {
+      code: DataColumnSidecarErrorCode.FUTURE_SLOT,
+      currentSlot: currentSlotWithGossipDisparity,
+      blockSlot: blockHeader.slot,
+    });
+  }
+
+  // 4) [IGNORE] The sidecar is from a slot greater than the latest finalized slot -- i.e. validate that
+  //             sidecar.slot > compute_start_slot_at_epoch(state.finalized_checkpoint.epoch)
+  const finalizedCheckpoint = chain.forkChoice.getFinalizedCheckpoint();
+  const finalizedSlot = computeStartSlotAtEpoch(finalizedCheckpoint.epoch);
+  if (blockHeader.slot <= finalizedSlot) {
+    throw new DataColumnSidecarGossipError(GossipAction.IGNORE, {
+      code: DataColumnSidecarErrorCode.WOULD_REVERT_FINALIZED_SLOT,
+      blockSlot: blockHeader.slot,
+      finalizedSlot,
+    });
+  }
+
+  // 6) [IGNORE] The sidecar's block's parent (defined by block_header.parent_root) has been seen (via gossip
+  //             or non-gossip sources)
+  const parentRoot = toRootHex(blockHeader.parentRoot);
+  const parentBlock = chain.forkChoice.getBlockHex(parentRoot);
+  if (parentBlock === null) {
+    // If fork choice does *not* consider the parent to be a descendant of the finalized block,
+    // then there are two more cases:
+    //
+    // 1. We have the parent stored in our database. Because fork-choice has confirmed the
+    //    parent is *not* in our post-finalization DAG, all other blocks must be either
+    //    pre-finalization or conflicting with finalization.
+    // 2. The parent is unknown to us, we probably want to download it since it might actually
+    //    descend from the finalized root.
+    // (Non-Lighthouse): Since we prune all blocks non-descendant from finalized checking the `db.block` database won't be useful to guard
+    // against known bad fork blocks, so we throw PARENT_UNKNOWN for cases (1) and (2)
+    throw new DataColumnSidecarGossipError(GossipAction.IGNORE, {
+      code: DataColumnSidecarErrorCode.PARENT_UNKNOWN,
+      parentRoot,
+    });
+  }
+
+  // 8) [REJECT] The sidecar is from a higher slot than the sidecar's block's parent
+  if (parentBlock.slot >= blockHeader.slot) {
+    throw new DataColumnSidecarGossipError(GossipAction.REJECT, {
+      code: DataColumnSidecarErrorCode.NOT_LATER_THAN_PARENT,
+      parentSlot: parentBlock.slot,
+      slot: blockHeader.slot,
+    });
+  }
+
+  // getBlockSlotState also checks for whether the current finalized checkpoint is an ancestor of the block.
+  // As a result, we throw an IGNORE (whereas the spec says we should REJECT for this scenario).
+  // this is something we should change this in the future to make the code airtight to the spec.
+  // 7) [REJECT] The sidecar's block's parent passes validation.
+  const blockState = await chain.regen
+    .getBlockSlotState(parentRoot, blockHeader.slot, {dontTransferCache: true}, RegenCaller.validateGossipBlock)
+    .catch(() => {
+      throw new DataColumnSidecarGossipError(GossipAction.IGNORE, {
+        code: DataColumnSidecarErrorCode.PARENT_UNKNOWN,
+        parentRoot,
+      });
+    });
+
+  // 13) [REJECT] The sidecar is proposed by the expected proposer_index for the block's slot in the context of the current
+  //              shuffling (defined by block_header.parent_root/block_header.slot). If the proposer_index cannot
+  //              immediately be verified against the expected shuffling, the sidecar MAY be queued for later processing
+  //              while proposers for the block's branch are calculated -- in such a case do not REJECT, instead IGNORE
+  //              this message.
+  const proposerIndex = blockHeader.proposerIndex;
+  const expectedProposerIndex = blockState.epochCtx.getBeaconProposer(blockHeader.slot);
+
+  if (proposerIndex !== expectedProposerIndex) {
+    throw new DataColumnSidecarGossipError(GossipAction.REJECT, {
+      code: DataColumnSidecarErrorCode.INCORRECT_PROPOSER,
+      actualProposerIndex: proposerIndex,
+      expectedProposerIndex,
+    });
+  }
+
+  // 5) [REJECT] The proposer signature of sidecar.signed_block_header, is valid with respect to the block_header.proposer_index pubkey.
+  const signatureSet = getBlockHeaderProposerSignatureSet(blockState, dataColumnSidecar.signedBlockHeader);
+  // Don't batch so verification is not delayed
+  if (
+    !(await chain.bls.verifySignatureSets([signatureSet], {
+      verifyOnMainThread: blockHeader.slot > chain.forkChoice.getHead().slot,
+    }))
+  ) {
+    throw new DataColumnSidecarGossipError(GossipAction.REJECT, {
+      code: DataColumnSidecarErrorCode.PROPOSAL_SIGNATURE_INVALID,
+    });
+  }
+
+  // 9) [REJECT] The current finalized_checkpoint is an ancestor of the sidecar's block
+  //             -- i.e. get_checkpoint_block(store, block_header.parent_root, store.finalized_checkpoint.epoch)
+  //                     == store.finalized_checkpoint.root
+  // Handled by 7)
+
+  // 10) [REJECT] The sidecar's kzg_commitments field inclusion proof is valid as verified by
+  //              verify_data_column_sidecar_inclusion_proof
+  //              TODO: Can cache result on (commitments, proof, header) in the future
+  const timer = metrics?.peerDas.dataColumnSidecarInclusionProofVerificationTime.startTimer();
+  const valid = verifyDataColumnSidecarInclusionProof(dataColumnSidecar);
+  timer?.();
+
+  if (!valid) {
+    throw new DataColumnSidecarGossipError(GossipAction.REJECT, {
+      code: DataColumnSidecarErrorCode.INCLUSION_PROOF_INVALID,
+      slot: dataColumnSidecar.signedBlockHeader.message.slot,
+      columnIdx: dataColumnSidecar.index,
+    });
+  }
+
+  const kzgProofTimer = metrics?.peerDas.dataColumnSidecarKzgProofsVerificationTime.startTimer();
+  // 11) [REJECT] The sidecar's column data is valid as verified by verify_data_column_sidecar_kzg_proofs
+  try {
+    await verifyDataColumnSidecarKzgProofs(
+      dataColumnSidecar.kzgCommitments,
+      Array.from({length: dataColumnSidecar.column.length}, () => dataColumnSidecar.index),
+      dataColumnSidecar.column,
+      dataColumnSidecar.kzgProofs
+    );
+  } catch {
+    throw new DataColumnSidecarGossipError(GossipAction.REJECT, {
+      code: DataColumnSidecarErrorCode.INVALID_KZG_PROOF,
+      slot: blockHeader.slot,
+      columnIdx: dataColumnSidecar.index,
+    });
+  } finally {
+    kzgProofTimer?.();
+  }
+
+  // 12) [IGNORE] The sidecar is the first sidecar for the tuple (block_header.slot, block_header.proposer_index,
+  //              sidecar.index) with valid header signature, sidecar inclusion proof, and kzg proof
+  //              -- Handled in seenGossipBlockInput
+}
+
+/**
+ * SPEC FUNCTION
+ * https://github.com/ethereum/consensus-specs/blob/v1.6.0-alpha.4/specs/fulu/p2p-interface.md#verify_data_column_sidecar
+ */
+function verifyDataColumnSidecar(dataColumnSidecar: fulu.DataColumnSidecar): void {
+  if (dataColumnSidecar.index >= NUMBER_OF_COLUMNS) {
+    throw new DataColumnSidecarGossipError(GossipAction.REJECT, {
+      code: DataColumnSidecarErrorCode.INVALID_INDEX,
+      slot: dataColumnSidecar.signedBlockHeader.message.slot,
+      columnIdx: dataColumnSidecar.index,
+    });
+  }
+
+  if (dataColumnSidecar.kzgCommitments.length === 0) {
+    throw new DataColumnSidecarGossipError(GossipAction.REJECT, {
+      code: DataColumnSidecarErrorCode.NO_COMMITMENTS,
+      slot: dataColumnSidecar.signedBlockHeader.message.slot,
+      columnIdx: dataColumnSidecar.index,
+    });
+  }
+
+  if (
+    dataColumnSidecar.column.length !== dataColumnSidecar.kzgCommitments.length ||
+    dataColumnSidecar.column.length !== dataColumnSidecar.kzgProofs.length
+  ) {
+    throw new DataColumnSidecarGossipError(GossipAction.REJECT, {
+      code: DataColumnSidecarErrorCode.MISMATCHED_LENGTHS,
+      columnLength: dataColumnSidecar.column.length,
+      commitmentsLength: dataColumnSidecar.kzgCommitments.length,
+      proofsLength: dataColumnSidecar.kzgProofs.length,
+    });
+  }
+}
+
+/**
+ * SPEC FUNCTION
+ * https://github.com/ethereum/consensus-specs/blob/v1.6.0-alpha.4/specs/fulu/p2p-interface.md#verify_data_column_sidecar_kzg_proofs
+ */
+export async function verifyDataColumnSidecarKzgProofs(
+  commitments: Uint8Array[],
+  cellIndices: number[],
+  cells: Uint8Array[],
+  proofs: Uint8Array[]
+): Promise<void> {
+  let valid: boolean;
+  try {
+    valid = await kzg.asyncVerifyCellKzgProofBatch(commitments, cellIndices, cells, proofs);
+  } catch (e) {
+    (e as Error).message = `Error on asyncVerifyCellKzgProofBatch: ${(e as Error).message}`;
+    throw e;
+  }
+  if (!valid) {
+    throw Error("Invalid verifyCellKzgProofBatch");
+  }
+}
+
+/**
+ * SPEC FUNCTION
+ * https://github.com/ethereum/consensus-specs/blob/v1.6.0-alpha.4/specs/fulu/p2p-interface.md#verify_data_column_sidecar_inclusion_proof
+ */
+export function verifyDataColumnSidecarInclusionProof(dataColumnSidecar: fulu.DataColumnSidecar): boolean {
+  return verifyMerkleBranch(
+    ssz.deneb.BlobKzgCommitments.hashTreeRoot(dataColumnSidecar.kzgCommitments),
+    dataColumnSidecar.kzgCommitmentsInclusionProof,
+    KZG_COMMITMENTS_INCLUSION_PROOF_DEPTH,
+    KZG_COMMITMENTS_SUBTREE_INDEX,
+    dataColumnSidecar.signedBlockHeader.message.bodyRoot
+  );
+}
+
+/**
+ * Validate a subset of data column sidecars in a block
+ *
+ * Requires the block to be known to the node
+ */
+export async function validateBlockDataColumnSidecars(
+  blockSlot: Slot,
+  blockRoot: Root,
+  blockBlobCount: number,
+  dataColumnSidecars: fulu.DataColumnSidecars
+): Promise<void> {
+  if (dataColumnSidecars.length === 0) {
+    return;
+  }
+
+  if (blockBlobCount === 0) {
+    throw new DataColumnSidecarValidationError(
+      {
+        code: DataColumnSidecarErrorCode.INCORRECT_SIDECAR_COUNT,
+        slot: blockSlot,
+        expected: 0,
+        actual: dataColumnSidecars.length,
+      },
+      "Block has no blob commitments but data column sidecars were provided"
+    );
+  }
+
+  // Hash the first sidecar block header and compare the rest via (cheaper) equality
+  const firstSidecarBlockHeader = dataColumnSidecars[0].signedBlockHeader.message;
+  const firstBlockRoot = ssz.phase0.BeaconBlockHeader.hashTreeRoot(firstSidecarBlockHeader);
+  if (Buffer.compare(blockRoot, firstBlockRoot) !== 0) {
+    throw new DataColumnSidecarValidationError(
+      {
+        code: DataColumnSidecarErrorCode.INCORRECT_BLOCK,
+        slot: blockSlot,
+        columnIdx: 0,
+        expected: toRootHex(blockRoot),
+        actual: toRootHex(firstBlockRoot),
+      },
+      "DataColumnSidecar doesn't match corresponding block"
+    );
+  }
+
+  const commitments: Uint8Array[] = [];
+  const cellIndices: number[] = [];
+  const cells: Uint8Array[] = [];
+  const proofs: Uint8Array[] = [];
+  for (let i = 0; i < dataColumnSidecars.length; i++) {
+    const columnSidecar = dataColumnSidecars[i];
+
+    if (columnSidecar.index >= NUMBER_OF_COLUMNS) {
+      throw new DataColumnSidecarValidationError(
+        {
+          code: DataColumnSidecarErrorCode.INVALID_INDEX,
+          slot: blockSlot,
+          columnIdx: columnSidecar.index,
+        },
+        "DataColumnSidecar has invalid index"
+      );
+    }
+
+    if (columnSidecar.kzgCommitments.length !== blockBlobCount) {
+      throw new DataColumnSidecarValidationError({
+        code: DataColumnSidecarErrorCode.INCORRECT_KZG_COMMITMENTS_COUNT,
+        slot: blockSlot,
+        columnIdx: columnSidecar.index,
+        expected: blockBlobCount,
+        actual: columnSidecar.kzgCommitments.length,
+      });
+    }
+
+    if (columnSidecar.kzgProofs.length !== columnSidecar.kzgCommitments.length) {
+      throw new DataColumnSidecarValidationError({
+        code: DataColumnSidecarErrorCode.INCORRECT_KZG_PROOF_COUNT,
+        slot: blockSlot,
+        columnIdx: columnSidecar.index,
+        expected: columnSidecar.kzgCommitments.length,
+        actual: columnSidecar.kzgProofs.length,
+      });
+    }
+
+    if (!verifyDataColumnSidecarInclusionProof(columnSidecar)) {
+      throw new DataColumnSidecarValidationError(
+        {
+          code: DataColumnSidecarErrorCode.INCLUSION_PROOF_INVALID,
+          slot: blockSlot,
+          columnIdx: columnSidecar.index,
+        },
+        "DataColumnSidecar has invalid inclusion proof"
+      );
+    }
+
+    commitments.push(...columnSidecar.kzgCommitments);
+    cellIndices.push(...Array.from({length: columnSidecar.column.length}, () => columnSidecar.index));
+    cells.push(...columnSidecar.column);
+    proofs.push(...columnSidecar.kzgProofs);
+  }
+
+  let reason: string | undefined;
+  try {
+    const valid = await kzg.asyncVerifyCellKzgProofBatch(commitments, cellIndices, cells, proofs);
+    if (!valid) {
+      reason = "Invalid KZG proof batch";
+    }
+  } catch (e) {
+    reason = (e as Error).message;
+  }
+  if (reason !== undefined) {
+    throw new DataColumnSidecarValidationError(
+      {
+        code: DataColumnSidecarErrorCode.INVALID_KZG_PROOF_BATCH,
+        slot: blockSlot,
+        reason,
+      },
+      "DataColumnSidecar has invalid KZG proof batch"
+    );
+  }
+}
+
+/**
+ * SPEC FUNCTION
+ * https://github.com/ethereum/consensus-specs/blob/v1.6.0-alpha.4/specs/fulu/p2p-interface.md#compute_subnet_for_data_column_sidecar
+ */
+export function computeSubnetForDataColumnSidecar(
+  config: ChainConfig,
+  columnSidecar: fulu.DataColumnSidecar
+): SubnetID {
+  return columnSidecar.index % config.DATA_COLUMN_SIDECAR_SUBNET_COUNT;
+}

package/src/chain/validation/index.ts

@@ -0,0 +1,9 @@
+export * from "./aggregateAndProof.js";
+export * from "./attestation.js";
+export * from "./attesterSlashing.js";
+export * from "./block.js";
+export * from "./blsToExecutionChange.js";
+export * from "./proposerSlashing.js";
+export * from "./syncCommittee.js";
+export * from "./syncCommitteeContributionAndProof.js";
+export * from "./voluntaryExit.js";

package/src/chain/validation/lightClientFinalityUpdate.ts

@@ -0,0 +1,45 @@
+import {ChainForkConfig} from "@lodestar/config";
+import {LightClientFinalityUpdate} from "@lodestar/types";
+import {assertLightClientServer} from "../../node/utils/lightclient.js";
+import {GossipAction} from "../errors/index.js";
+import {LightClientError, LightClientErrorCode} from "../errors/lightClientError.js";
+import {IBeaconChain} from "../interface.js";
+import {updateReceivedTooEarly} from "./lightClientOptimisticUpdate.js";
+
+// https://github.com/ethereum/consensus-specs/blob/dev/specs/altair/light-client/p2p-interface.md#light_client_finality_update
+export function validateLightClientFinalityUpdate(
+  config: ChainForkConfig,
+  chain: IBeaconChain,
+  gossipedFinalityUpdate: LightClientFinalityUpdate
+): void {
+  assertLightClientServer(chain.lightClientServer);
+
+  // [IGNORE] No other finality_update with a lower or equal finalized_header.slot was already forwarded on the network
+  const gossipedFinalitySlot = gossipedFinalityUpdate.finalizedHeader.beacon.slot;
+  const localFinalityUpdate = chain.lightClientServer.getFinalityUpdate();
+
+  if (localFinalityUpdate && gossipedFinalitySlot <= localFinalityUpdate.finalizedHeader.beacon.slot) {
+    throw new LightClientError(GossipAction.IGNORE, {
+      code: LightClientErrorCode.FINALITY_UPDATE_ALREADY_FORWARDED,
+    });
+  }
+
+  // [IGNORE] The finality_update is received after the block at signature_slot was given enough time to propagate
+  // through the network -- i.e. validate that one-third of finality_update.signature_slot has transpired
+  // (SECONDS_PER_SLOT / INTERVALS_PER_SLOT seconds after the start of the slot, with a MAXIMUM_GOSSIP_CLOCK_DISPARITY allowance)
+  if (updateReceivedTooEarly(config, chain.genesisTime, gossipedFinalityUpdate)) {
+    throw new LightClientError(GossipAction.IGNORE, {
+      code: LightClientErrorCode.FINALITY_UPDATE_RECEIVED_TOO_EARLY,
+    });
+  }
+
+  // [IGNORE] The received finality_update matches the locally computed one exactly
+  const sszType = config.getPostAltairForkTypes(
+    gossipedFinalityUpdate.attestedHeader.beacon.slot
+  ).LightClientFinalityUpdate;
+  if (localFinalityUpdate === null || !sszType.equals(gossipedFinalityUpdate, localFinalityUpdate)) {
+    throw new LightClientError(GossipAction.IGNORE, {
+      code: LightClientErrorCode.FINALITY_UPDATE_NOT_MATCHING_LOCAL,
+    });
+  }
+}

package/src/chain/validation/lightClientOptimisticUpdate.ts

@@ -0,0 +1,67 @@
+import {ChainForkConfig} from "@lodestar/config";
+import {computeTimeAtSlot} from "@lodestar/state-transition";
+import {LightClientOptimisticUpdate} from "@lodestar/types";
+import {MAXIMUM_GOSSIP_CLOCK_DISPARITY} from "../../constants/index.js";
+import {assertLightClientServer} from "../../node/utils/lightclient.js";
+import {GossipAction} from "../errors/index.js";
+import {LightClientError, LightClientErrorCode} from "../errors/lightClientError.js";
+import {IBeaconChain} from "../interface.js";
+
+// https://github.com/ethereum/consensus-specs/blob/dev/specs/altair/light-client/p2p-interface.md#light_client_optimistic_update
+export function validateLightClientOptimisticUpdate(
+  config: ChainForkConfig,
+  chain: IBeaconChain,
+  gossipedOptimisticUpdate: LightClientOptimisticUpdate
+): void {
+  assertLightClientServer(chain.lightClientServer);
+
+  // [IGNORE] No other optimistic_update with a lower or equal attested_header.slot was already forwarded on the network
+  const gossipedAttestedSlot = gossipedOptimisticUpdate.attestedHeader.beacon.slot;
+  const localOptimisticUpdate = chain.lightClientServer.getOptimisticUpdate();
+
+  if (localOptimisticUpdate && gossipedAttestedSlot <= localOptimisticUpdate.attestedHeader.beacon.slot) {
+    throw new LightClientError(GossipAction.IGNORE, {
+      code: LightClientErrorCode.OPTIMISTIC_UPDATE_ALREADY_FORWARDED,
+    });
+  }
+
+  // [IGNORE] The optimistic_update is received after the block at signature_slot was given enough time to propagate
+  // through the network -- i.e. validate that one-third of optimistic_update.signature_slot has transpired
+  // (SECONDS_PER_SLOT / INTERVALS_PER_SLOT seconds after the start of the slot, with a MAXIMUM_GOSSIP_CLOCK_DISPARITY allowance)
+  if (updateReceivedTooEarly(config, chain.genesisTime, gossipedOptimisticUpdate)) {
+    throw new LightClientError(GossipAction.IGNORE, {
+      code: LightClientErrorCode.OPTIMISTIC_UPDATE_RECEIVED_TOO_EARLY,
+    });
+  }
+
+  // [IGNORE] The received optimistic_update matches the locally computed one exactly
+  const sszType = config.getPostAltairForkTypes(
+    gossipedOptimisticUpdate.attestedHeader.beacon.slot
+  ).LightClientOptimisticUpdate;
+  if (localOptimisticUpdate === null || !sszType.equals(gossipedOptimisticUpdate, localOptimisticUpdate)) {
+    throw new LightClientError(GossipAction.IGNORE, {
+      code: LightClientErrorCode.OPTIMISTIC_UPDATE_NOT_MATCHING_LOCAL,
+    });
+  }
+}
+
+/**
+ * Returns true, if the spec condition below triggers an IGNORE.
+ *
+ *      Sig +1/3 time
+ * -----|-----
+ * xxx|-------  (x is not okay)
+ *
+ * [IGNORE] The *update is received after the block at signature_slot was given enough time to propagate
+ * through the network -- i.e. validate that one-third of *update.signature_slot has transpired
+ * (SECONDS_PER_SLOT / INTERVALS_PER_SLOT seconds after the start of the slot, with a MAXIMUM_GOSSIP_CLOCK_DISPARITY allowance)
+ */
+export function updateReceivedTooEarly(
+  config: ChainForkConfig,
+  genesisTime: number,
+  update: Pick<LightClientOptimisticUpdate, "signatureSlot">
+): boolean {
+  const signatureSlot13TimestampMs = computeTimeAtSlot(config, update.signatureSlot + 1 / 3, genesisTime) * 1000;
+  const earliestAllowedTimestampMs = signatureSlot13TimestampMs - MAXIMUM_GOSSIP_CLOCK_DISPARITY;
+  return Date.now() < earliestAllowedTimestampMs;
+}

package/src/chain/validation/proposerSlashing.ts

@@ -0,0 +1,54 @@
+import {assertValidProposerSlashing, getProposerSlashingSignatureSets} from "@lodestar/state-transition";
+import {phase0} from "@lodestar/types";
+import {GossipAction, ProposerSlashingError, ProposerSlashingErrorCode} from "../errors/index.js";
+import {IBeaconChain} from "../index.js";
+
+export async function validateApiProposerSlashing(
+  chain: IBeaconChain,
+  proposerSlashing: phase0.ProposerSlashing
+): Promise<void> {
+  const prioritizeBls = true;
+  return validateProposerSlashing(chain, proposerSlashing, prioritizeBls);
+}
+
+export async function validateGossipProposerSlashing(
+  chain: IBeaconChain,
+  proposerSlashing: phase0.ProposerSlashing
+): Promise<void> {
+  return validateProposerSlashing(chain, proposerSlashing);
+}
+
+async function validateProposerSlashing(
+  chain: IBeaconChain,
+  proposerSlashing: phase0.ProposerSlashing,
+  prioritizeBls = false
+): Promise<void> {
+  // [IGNORE] The proposer slashing is the first valid proposer slashing received for the proposer with index
+  // proposer_slashing.signed_header_1.message.proposer_index.
+  if (chain.opPool.hasSeenProposerSlashing(proposerSlashing.signedHeader1.message.proposerIndex)) {
+    throw new ProposerSlashingError(GossipAction.IGNORE, {
+      code: ProposerSlashingErrorCode.ALREADY_EXISTS,
+    });
+  }
+
+  const state = chain.getHeadState();
+
+  // [REJECT] All of the conditions within process_proposer_slashing pass validation.
+  try {
+    // verifySignature = false, verified in batch below
+    assertValidProposerSlashing(state, proposerSlashing, false);
+  } catch (e) {
+    throw new ProposerSlashingError(GossipAction.REJECT, {
+      code: ProposerSlashingErrorCode.INVALID,
+      error: e as Error,
+    });
+  }
+
+  const signatureSets = getProposerSlashingSignatureSets(state, proposerSlashing);
+  if (!(await chain.bls.verifySignatureSets(signatureSets, {batchable: true, priority: prioritizeBls}))) {
+    throw new ProposerSlashingError(GossipAction.REJECT, {
+      code: ProposerSlashingErrorCode.INVALID,
+      error: Error("Invalid signature"),
+    });
+  }
+}

package/src/chain/validation/signatureSets/aggregateAndProof.ts

@@ -0,0 +1,38 @@
+import {PublicKey} from "@chainsafe/blst";
+import {BeaconConfig} from "@lodestar/config";
+import {DOMAIN_AGGREGATE_AND_PROOF, ForkSeq} from "@lodestar/params";
+import {
+  ISignatureSet,
+  computeSigningRoot,
+  computeStartSlotAtEpoch,
+  createSingleSignatureSetFromComponents,
+} from "@lodestar/state-transition";
+import {Epoch, SignedAggregateAndProof, ssz} from "@lodestar/types";
+
+export function getAggregateAndProofSigningRoot(
+  config: BeaconConfig,
+  epoch: Epoch,
+  aggregateAndProof: SignedAggregateAndProof
+): Uint8Array {
+  // previously, we call `const aggregatorDomain = state.config.getDomain(state.slot, DOMAIN_AGGREGATE_AND_PROOF, slot);`
+  // at fork boundary, it's required to dial to target epoch https://github.com/ChainSafe/lodestar/blob/v1.11.3/packages/beacon-node/src/chain/validation/attestation.ts#L573
+  // instead of that, just use the fork of slot in the attestation data
+  const slot = computeStartSlotAtEpoch(epoch);
+  const fork = config.getForkName(slot);
+  const aggregatorDomain = config.getDomainAtFork(fork, DOMAIN_AGGREGATE_AND_PROOF);
+  const sszType = ForkSeq[fork] >= ForkSeq.electra ? ssz.electra.AggregateAndProof : ssz.phase0.AggregateAndProof;
+  return computeSigningRoot(sszType, aggregateAndProof.message, aggregatorDomain);
+}
+
+export function getAggregateAndProofSignatureSet(
+  config: BeaconConfig,
+  epoch: Epoch,
+  aggregator: PublicKey,
+  aggregateAndProof: SignedAggregateAndProof
+): ISignatureSet {
+  return createSingleSignatureSetFromComponents(
+    aggregator,
+    getAggregateAndProofSigningRoot(config, epoch, aggregateAndProof),
+    aggregateAndProof.signature
+  );
+}

package/src/chain/validation/signatureSets/contributionAndProof.ts

@@ -0,0 +1,27 @@
+import {DOMAIN_CONTRIBUTION_AND_PROOF} from "@lodestar/params";
+import {
+  CachedBeaconStateAllForks,
+  ISignatureSet,
+  SignatureSetType,
+  computeSigningRoot,
+} from "@lodestar/state-transition";
+import {altair, ssz} from "@lodestar/types";
+
+export function getContributionAndProofSignatureSet(
+  state: CachedBeaconStateAllForks,
+  signedContributionAndProof: altair.SignedContributionAndProof
+): ISignatureSet {
+  const {epochCtx} = state;
+  const domain = state.config.getDomain(
+    state.slot,
+    DOMAIN_CONTRIBUTION_AND_PROOF,
+    signedContributionAndProof.message.contribution.slot
+  );
+  const signingData = signedContributionAndProof.message;
+  return {
+    type: SignatureSetType.single,
+    pubkey: epochCtx.index2pubkey[signedContributionAndProof.message.aggregatorIndex],
+    signingRoot: computeSigningRoot(ssz.altair.ContributionAndProof, signingData, domain),
+    signature: signedContributionAndProof.signature,
+  };
+}

package/src/chain/validation/signatureSets/index.ts

@@ -0,0 +1,6 @@
+export * from "./aggregateAndProof.js";
+export * from "./contributionAndProof.js";
+export * from "./selectionProof.js";
+export * from "./syncCommittee.js";
+export * from "./syncCommitteeContribution.js";
+export * from "./syncCommitteeSelectionProof.js";

package/src/chain/validation/signatureSets/selectionProof.ts

@@ -0,0 +1,27 @@
+import {PublicKey} from "@chainsafe/blst";
+import {BeaconConfig} from "@lodestar/config";
+import {DOMAIN_SELECTION_PROOF} from "@lodestar/params";
+import {ISignatureSet, computeSigningRoot, createSingleSignatureSetFromComponents} from "@lodestar/state-transition";
+import {Slot, phase0, ssz} from "@lodestar/types";
+
+export function getSelectionProofSigningRoot(config: BeaconConfig, slot: Slot): Uint8Array {
+  // previously, we call `const selectionProofDomain = config.getDomain(state.slot, DOMAIN_SELECTION_PROOF, slot)`
+  // at fork boundary, it's required to dial to target epoch https://github.com/ChainSafe/lodestar/blob/v1.11.3/packages/beacon-node/src/chain/validation/attestation.ts#L573
+  // instead of that, just use the fork of slot in the attestation data
+  const fork = config.getForkName(slot);
+  const selectionProofDomain = config.getDomainAtFork(fork, DOMAIN_SELECTION_PROOF);
+  return computeSigningRoot(ssz.Slot, slot, selectionProofDomain);
+}
+
+export function getSelectionProofSignatureSet(
+  config: BeaconConfig,
+  slot: Slot,
+  aggregator: PublicKey,
+  aggregateAndProof: phase0.SignedAggregateAndProof
+): ISignatureSet {
+  return createSingleSignatureSetFromComponents(
+    aggregator,
+    getSelectionProofSigningRoot(config, slot),
+    aggregateAndProof.message.selectionProof
+  );
+}