@lodestar/beacon-node 1.39.1 → 1.40.0-dev.193b2e2047

package/src/chain/validation/executionPayloadEnvelope.ts

@@ -0,0 +1,122 @@
+import {PublicKey} from "@chainsafe/blst";
+import {
+  CachedBeaconStateGloas,
+  computeStartSlotAtEpoch,
+  createSingleSignatureSetFromComponents,
+  getExecutionPayloadEnvelopeSigningRoot,
+} from "@lodestar/state-transition";
+import {gloas} from "@lodestar/types";
+import {toRootHex} from "@lodestar/utils";
+import {ExecutionPayloadEnvelopeError, ExecutionPayloadEnvelopeErrorCode, GossipAction} from "../errors/index.js";
+import {IBeaconChain} from "../index.js";
+
+export async function validateApiExecutionPayloadEnvelope(
+  chain: IBeaconChain,
+  executionPayloadEnvelope: gloas.SignedExecutionPayloadEnvelope
+): Promise<void> {
+  return validateExecutionPayloadEnvelope(chain, executionPayloadEnvelope);
+}
+
+export async function validateGossipExecutionPayloadEnvelope(
+  chain: IBeaconChain,
+  executionPayloadEnvelope: gloas.SignedExecutionPayloadEnvelope
+): Promise<void> {
+  return validateExecutionPayloadEnvelope(chain, executionPayloadEnvelope);
+}
+
+async function validateExecutionPayloadEnvelope(
+  chain: IBeaconChain,
+  executionPayloadEnvelope: gloas.SignedExecutionPayloadEnvelope
+): Promise<void> {
+  const envelope = executionPayloadEnvelope.message;
+  const {payload} = envelope;
+  const blockRootHex = toRootHex(envelope.beaconBlockRoot);
+
+  // [IGNORE] The envelope's block root `envelope.block_root` has been seen (via
+  // gossip or non-gossip sources) (a client MAY queue payload for processing once
+  // the block is retrieved).
+  // TODO GLOAS: Need to review this
+  const block = chain.forkChoice.getBlock(envelope.beaconBlockRoot);
+  if (block === null) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.IGNORE, {
+      code: ExecutionPayloadEnvelopeErrorCode.BLOCK_ROOT_UNKNOWN,
+      blockRoot: blockRootHex,
+    });
+  }
+
+  // [IGNORE] The node has not seen another valid
+  // `SignedExecutionPayloadEnvelope` for this block root from this builder.
+  if (chain.seenExecutionPayloadEnvelopes.isKnown(blockRootHex)) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.IGNORE, {
+      code: ExecutionPayloadEnvelopeErrorCode.ENVELOPE_ALREADY_KNOWN,
+      blockRoot: blockRootHex,
+      slot: envelope.slot,
+    });
+  }
+
+  // [IGNORE] The envelope is from a slot greater than or equal to the latest finalized slot -- i.e. validate that `envelope.slot >= compute_start_slot_at_epoch(store.finalized_checkpoint.epoch)`
+  const finalizedCheckpoint = chain.forkChoice.getFinalizedCheckpoint();
+  const finalizedSlot = computeStartSlotAtEpoch(finalizedCheckpoint.epoch);
+  if (envelope.slot < finalizedSlot) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.IGNORE, {
+      code: ExecutionPayloadEnvelopeErrorCode.BELONG_TO_FINALIZED_BLOCK,
+      envelopeSlot: envelope.slot,
+      finalizedSlot,
+    });
+  }
+
+  // [REJECT] `block` passes validation.
+  // TODO GLOAS: implement this. Technically if we cannot get proto block from fork choice,
+  // it is possible that the block didn't pass the validation
+
+  // [REJECT] `block.slot` equals `envelope.slot`.
+  if (block.slot !== envelope.slot) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.REJECT, {
+      code: ExecutionPayloadEnvelopeErrorCode.SLOT_MISMATCH,
+      envelopeSlot: envelope.slot,
+      blockSlot: block.slot,
+    });
+  }
+
+  if (block.builderIndex === undefined || block.blockHashHex === undefined) {
+    // This indicates this block is a pre-gloas block which is wrong
+    throw new ExecutionPayloadEnvelopeError(GossipAction.IGNORE, {
+      code: ExecutionPayloadEnvelopeErrorCode.CACHE_FAIL,
+      blockRoot: blockRootHex,
+    });
+  }
+
+  // [REJECT] `envelope.builder_index == bid.builder_index`
+  if (envelope.builderIndex !== block.builderIndex) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.REJECT, {
+      code: ExecutionPayloadEnvelopeErrorCode.BUILDER_INDEX_MISMATCH,
+      envelopeBuilderIndex: envelope.builderIndex,
+      bidBuilderIndex: block.builderIndex,
+    });
+  }
+
+  // [REJECT] `payload.block_hash == bid.block_hash`
+  if (toRootHex(payload.blockHash) !== block.blockHashHex) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.REJECT, {
+      code: ExecutionPayloadEnvelopeErrorCode.BLOCK_HASH_MISMATCH,
+      envelopeBlockHash: toRootHex(payload.blockHash),
+      bidBlockHash: block.blockHashHex,
+    });
+  }
+
+  // [REJECT] `signed_execution_payload_envelope.signature` is valid with respect to the builder's public key.
+  const state = chain.getHeadState() as CachedBeaconStateGloas;
+  const signatureSet = createSingleSignatureSetFromComponents(
+    PublicKey.fromBytes(state.builders.getReadonly(envelope.builderIndex).pubkey),
+    getExecutionPayloadEnvelopeSigningRoot(chain.config, envelope),
+    executionPayloadEnvelope.signature
+  );
+
+  if (!(await chain.bls.verifySignatureSets([signatureSet]))) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.REJECT, {
+      code: ExecutionPayloadEnvelopeErrorCode.INVALID_SIGNATURE,
+    });
+  }
+
+  chain.seenExecutionPayloadEnvelopes.add(blockRootHex, envelope.slot);
+}

package/src/chain/validation/payloadAttestationMessage.ts

@@ -0,0 +1,109 @@
+import {
+  CachedBeaconStateGloas,
+  computeEpochAtSlot,
+  createSingleSignatureSetFromComponents,
+  getPayloadAttestationDataSigningRoot,
+} from "@lodestar/state-transition";
+import {RootHex, gloas, ssz} from "@lodestar/types";
+import {toRootHex} from "@lodestar/utils";
+import {GossipAction, PayloadAttestationError, PayloadAttestationErrorCode} from "../errors/index.js";
+import {IBeaconChain} from "../index.js";
+
+export type PayloadAttestationValidationResult = {
+  attDataRootHex: RootHex;
+  validatorCommitteeIndex: number;
+};
+
+export async function validateApiPayloadAttestationMessage(
+  chain: IBeaconChain,
+  payloadAttestationMessage: gloas.PayloadAttestationMessage
+): Promise<PayloadAttestationValidationResult> {
+  return validatePayloadAttestationMessage(chain, payloadAttestationMessage);
+}
+
+export async function validateGossipPayloadAttestationMessage(
+  chain: IBeaconChain,
+  payloadAttestationMessage: gloas.PayloadAttestationMessage
+): Promise<PayloadAttestationValidationResult> {
+  return validatePayloadAttestationMessage(chain, payloadAttestationMessage);
+}
+
+async function validatePayloadAttestationMessage(
+  chain: IBeaconChain,
+  payloadAttestationMessage: gloas.PayloadAttestationMessage
+): Promise<PayloadAttestationValidationResult> {
+  const {data, validatorIndex} = payloadAttestationMessage;
+  const epoch = computeEpochAtSlot(data.slot);
+
+  // [IGNORE] The message's slot is for the current slot (with a `MAXIMUM_GOSSIP_CLOCK_DISPARITY` allowance), i.e. `data.slot == current_slot`.
+  if (!chain.clock.isCurrentSlotGivenGossipDisparity(data.slot)) {
+    throw new PayloadAttestationError(GossipAction.IGNORE, {
+      code: PayloadAttestationErrorCode.NOT_CURRENT_SLOT,
+      currentSlot: chain.clock.currentSlot,
+      slot: data.slot,
+    });
+  }
+
+  // [IGNORE] The `payload_attestation_message` is the first valid message received
+  // from the validator with index `payload_attestation_message.validator_index`.
+  // A single validator can participate PTC at most once per epoch
+  if (chain.seenPayloadAttesters.isKnown(epoch, validatorIndex)) {
+    throw new PayloadAttestationError(GossipAction.IGNORE, {
+      code: PayloadAttestationErrorCode.PAYLOAD_ATTESTATION_ALREADY_KNOWN,
+      validatorIndex,
+      slot: data.slot,
+      blockRoot: toRootHex(data.beaconBlockRoot),
+    });
+  }
+
+  // [IGNORE] The message's block `data.beacon_block_root` has been seen (via
+  // gossip or non-gossip sources) (a client MAY queue attestation for processing
+  // once the block is retrieved. Note a client might want to request payload after).
+  const block = chain.forkChoice.getBlock(data.beaconBlockRoot);
+  if (block === null) {
+    throw new PayloadAttestationError(GossipAction.IGNORE, {
+      code: PayloadAttestationErrorCode.UNKNOWN_BLOCK_ROOT,
+      blockRoot: toRootHex(data.beaconBlockRoot),
+    });
+  }
+
+  const state = chain.getHeadState() as CachedBeaconStateGloas;
+
+  // [REJECT] The message's block `data.beacon_block_root` passes validation.
+  // TODO GLOAS: implement this. Technically if we cannot get proto block from fork choice,
+  // it is possible that the block didn't pass the validation
+
+  // [REJECT] The message's validator index is within the payload committee in
+  // `get_ptc(state, data.slot)`. The `state` is the head state corresponding to
+  // processing the block up to the current slot as determined by the fork choice.
+  const ptc = state.epochCtx.getPayloadTimelinessCommittee(data.slot);
+  const validatorCommitteeIndex = ptc.indexOf(validatorIndex);
+
+  if (validatorCommitteeIndex === -1) {
+    throw new PayloadAttestationError(GossipAction.REJECT, {
+      code: PayloadAttestationErrorCode.INVALID_ATTESTER,
+      attesterIndex: validatorIndex,
+    });
+  }
+
+  // [REJECT] `payload_attestation_message.signature` is valid with respect to the validator's public key.
+  const signatureSet = createSingleSignatureSetFromComponents(
+    chain.index2pubkey[validatorIndex],
+    getPayloadAttestationDataSigningRoot(chain.config, state.slot, data),
+    payloadAttestationMessage.signature
+  );
+
+  if (!(await chain.bls.verifySignatureSets([signatureSet]))) {
+    throw new PayloadAttestationError(GossipAction.REJECT, {
+      code: PayloadAttestationErrorCode.INVALID_SIGNATURE,
+    });
+  }
+
+  // Valid
+  chain.seenPayloadAttesters.add(epoch, validatorIndex);
+
+  return {
+    attDataRootHex: toRootHex(ssz.gloas.PayloadAttestationData.hashTreeRoot(data)),
+    validatorCommitteeIndex,
+  };
+}

package/src/chain/validation/proposerSlashing.ts

@@ -35,8 +35,9 @@ async function validateProposerSlashing(
 
   // [REJECT] All of the conditions within process_proposer_slashing pass validation.
   try {
+    const proposer = state.validators.getReadonly(proposerSlashing.signedHeader1.message.proposerIndex);
     // verifySignature = false, verified in batch below
-    assertValidProposerSlashing(state, proposerSlashing, false);
+    assertValidProposerSlashing(chain.config, chain.index2pubkey, state.slot, proposerSlashing, proposer, false);
   } catch (e) {
     throw new ProposerSlashingError(GossipAction.REJECT, {
       code: ProposerSlashingErrorCode.INVALID,
@@ -44,12 +45,7 @@ async function validateProposerSlashing(
     });
   }
 
-  const signatureSets = getProposerSlashingSignatureSets(
-    chain.config,
-    chain.index2pubkey,
-    state.slot,
-    proposerSlashing
-  );
+  const signatureSets = getProposerSlashingSignatureSets(chain.config, state.slot, proposerSlashing);
   if (!(await chain.bls.verifySignatureSets(signatureSets, {batchable: true, priority: prioritizeBls}))) {
     throw new ProposerSlashingError(GossipAction.REJECT, {
       code: ProposerSlashingErrorCode.INVALID,

package/src/chain/validation/signatureSets/aggregateAndProof.ts

@@ -1,13 +1,7 @@
-import {PublicKey} from "@chainsafe/blst";
 import {BeaconConfig} from "@lodestar/config";
 import {DOMAIN_AGGREGATE_AND_PROOF, ForkSeq} from "@lodestar/params";
-import {
-  ISignatureSet,
-  computeSigningRoot,
-  computeStartSlotAtEpoch,
-  createSingleSignatureSetFromComponents,
-} from "@lodestar/state-transition";
-import {Epoch, SignedAggregateAndProof, ssz} from "@lodestar/types";
+import {ISignatureSet, SignatureSetType, computeSigningRoot, computeStartSlotAtEpoch} from "@lodestar/state-transition";
+import {Epoch, SignedAggregateAndProof, ValidatorIndex, ssz} from "@lodestar/types";
 
 export function getAggregateAndProofSigningRoot(
   config: BeaconConfig,
@@ -27,12 +21,13 @@ export function getAggregateAndProofSigningRoot(
 export function getAggregateAndProofSignatureSet(
   config: BeaconConfig,
   epoch: Epoch,
-  aggregator: PublicKey,
+  aggregatorIndex: ValidatorIndex,
   aggregateAndProof: SignedAggregateAndProof
 ): ISignatureSet {
-  return createSingleSignatureSetFromComponents(
-    aggregator,
-    getAggregateAndProofSigningRoot(config, epoch, aggregateAndProof),
-    aggregateAndProof.signature
-  );
+  return {
+    type: SignatureSetType.indexed,
+    index: aggregatorIndex,
+    signingRoot: getAggregateAndProofSigningRoot(config, epoch, aggregateAndProof),
+    signature: aggregateAndProof.signature,
+  };
 }

package/src/chain/validation/signatureSets/contributionAndProof.ts

@@ -3,7 +3,6 @@ import {DOMAIN_CONTRIBUTION_AND_PROOF} from "@lodestar/params";
 import {
   CachedBeaconStateAllForks,
   ISignatureSet,
-  Index2PubkeyCache,
   SignatureSetType,
   computeSigningRoot,
 } from "@lodestar/state-transition";
@@ -11,7 +10,6 @@ import {altair, ssz} from "@lodestar/types";
 
 export function getContributionAndProofSignatureSet(
   config: BeaconConfig,
-  index2pubkey: Index2PubkeyCache,
   state: CachedBeaconStateAllForks,
   signedContributionAndProof: altair.SignedContributionAndProof
 ): ISignatureSet {
@@ -22,8 +20,8 @@ export function getContributionAndProofSignatureSet(
   );
   const signingData = signedContributionAndProof.message;
   return {
-    type: SignatureSetType.single,
-    pubkey: index2pubkey[signedContributionAndProof.message.aggregatorIndex],
+    type: SignatureSetType.indexed,
+    index: signedContributionAndProof.message.aggregatorIndex,
     signingRoot: computeSigningRoot(ssz.altair.ContributionAndProof, signingData, domain),
     signature: signedContributionAndProof.signature,
   };

package/src/chain/validation/signatureSets/selectionProof.ts

@@ -1,8 +1,7 @@
-import {PublicKey} from "@chainsafe/blst";
 import {BeaconConfig} from "@lodestar/config";
 import {DOMAIN_SELECTION_PROOF} from "@lodestar/params";
-import {ISignatureSet, computeSigningRoot, createSingleSignatureSetFromComponents} from "@lodestar/state-transition";
-import {Slot, phase0, ssz} from "@lodestar/types";
+import {ISignatureSet, SignatureSetType, computeSigningRoot} from "@lodestar/state-transition";
+import {Slot, ValidatorIndex, phase0, ssz} from "@lodestar/types";
 
 export function getSelectionProofSigningRoot(config: BeaconConfig, slot: Slot): Uint8Array {
   // previously, we call `const selectionProofDomain = config.getDomain(state.slot, DOMAIN_SELECTION_PROOF, slot)`
@@ -16,12 +15,13 @@ export function getSelectionProofSigningRoot(config: BeaconConfig, slot: Slot):
 export function getSelectionProofSignatureSet(
   config: BeaconConfig,
   slot: Slot,
-  aggregator: PublicKey,
+  aggregatorIndex: ValidatorIndex,
   aggregateAndProof: phase0.SignedAggregateAndProof
 ): ISignatureSet {
-  return createSingleSignatureSetFromComponents(
-    aggregator,
-    getSelectionProofSigningRoot(config, slot),
-    aggregateAndProof.message.selectionProof
-  );
+  return {
+    type: SignatureSetType.indexed,
+    index: aggregatorIndex,
+    signingRoot: getSelectionProofSigningRoot(config, slot),
+    signature: aggregateAndProof.message.selectionProof,
+  };
 }

package/src/chain/validation/signatureSets/syncCommittee.ts

@@ -3,7 +3,6 @@ import {DOMAIN_SYNC_COMMITTEE} from "@lodestar/params";
 import {
   CachedBeaconStateAllForks,
   ISignatureSet,
-  Index2PubkeyCache,
   SignatureSetType,
   computeSigningRoot,
 } from "@lodestar/state-transition";
@@ -11,15 +10,14 @@ import {altair, ssz} from "@lodestar/types";
 
 export function getSyncCommitteeSignatureSet(
   config: BeaconConfig,
-  index2pubkey: Index2PubkeyCache,
   state: CachedBeaconStateAllForks,
   syncCommittee: altair.SyncCommitteeMessage
 ): ISignatureSet {
   const domain = config.getDomain(state.slot, DOMAIN_SYNC_COMMITTEE, syncCommittee.slot);
 
   return {
-    type: SignatureSetType.single,
-    pubkey: index2pubkey[syncCommittee.validatorIndex],
+    type: SignatureSetType.indexed,
+    index: syncCommittee.validatorIndex,
     signingRoot: computeSigningRoot(ssz.Root, syncCommittee.beaconBlockRoot, domain),
     signature: syncCommittee.signature,
   };

package/src/chain/validation/signatureSets/syncCommitteeContribution.ts

@@ -1,4 +1,3 @@
-import {PublicKey} from "@chainsafe/blst";
 import {BeaconConfig} from "@lodestar/config";
 import {DOMAIN_SYNC_COMMITTEE} from "@lodestar/params";
 import {CachedBeaconStateAltair, ISignatureSet, SignatureSetType, computeSigningRoot} from "@lodestar/state-transition";
@@ -8,12 +7,12 @@ export function getSyncCommitteeContributionSignatureSet(
   config: BeaconConfig,
   state: CachedBeaconStateAltair,
   contribution: altair.SyncCommitteeContribution,
-  pubkeys: PublicKey[]
+  participantIndices: number[]
 ): ISignatureSet {
   const domain = config.getDomain(state.slot, DOMAIN_SYNC_COMMITTEE, contribution.slot);
   return {
     type: SignatureSetType.aggregate,
-    pubkeys,
+    indices: participantIndices,
     signingRoot: computeSigningRoot(ssz.Root, contribution.beaconBlockRoot, domain),
     signature: contribution.signature,
   };

package/src/chain/validation/signatureSets/syncCommitteeSelectionProof.ts

@@ -3,7 +3,6 @@ import {DOMAIN_SYNC_COMMITTEE_SELECTION_PROOF} from "@lodestar/params";
 import {
   CachedBeaconStateAllForks,
   ISignatureSet,
-  Index2PubkeyCache,
   SignatureSetType,
   computeSigningRoot,
 } from "@lodestar/state-transition";
@@ -11,7 +10,6 @@ import {altair, ssz} from "@lodestar/types";
 
 export function getSyncCommitteeSelectionProofSignatureSet(
   config: BeaconConfig,
-  index2pubkey: Index2PubkeyCache,
   state: CachedBeaconStateAllForks,
   contributionAndProof: altair.ContributionAndProof
 ): ISignatureSet {
@@ -22,8 +20,8 @@ export function getSyncCommitteeSelectionProofSignatureSet(
     subcommitteeIndex: contributionAndProof.contribution.subcommitteeIndex,
   };
   return {
-    type: SignatureSetType.single,
-    pubkey: index2pubkey[contributionAndProof.aggregatorIndex],
+    type: SignatureSetType.indexed,
+    index: contributionAndProof.aggregatorIndex,
     signingRoot: computeSigningRoot(ssz.altair.SyncAggregatorSelectionData, signingData, domain),
     signature: contributionAndProof.selectionProof,
   };

package/src/chain/validation/syncCommittee.ts

@@ -89,7 +89,7 @@ async function validateSyncCommitteeSigOnly(
   syncCommittee: altair.SyncCommitteeMessage,
   prioritizeBls = false
 ): Promise<void> {
-  const signatureSet = getSyncCommitteeSignatureSet(chain.config, chain.index2pubkey, headState, syncCommittee);
+  const signatureSet = getSyncCommitteeSignatureSet(chain.config, headState, syncCommittee);
   if (!(await chain.bls.verifySignatureSets([signatureSet], {batchable: true, priority: prioritizeBls}))) {
     throw new SyncCommitteeError(GossipAction.REJECT, {
       code: SyncCommitteeErrorCode.INVALID_SIGNATURE,

package/src/chain/validation/syncCommitteeContributionAndProof.ts

@@ -21,7 +21,6 @@ export async function validateSyncCommitteeGossipContributionAndProof(
   const contributionAndProof = signedContributionAndProof.message;
   const {contribution, aggregatorIndex} = contributionAndProof;
   const {subcommitteeIndex, slot} = contribution;
-  const {index2pubkey} = chain;
 
   const headState = chain.getHeadState();
   validateGossipSyncCommitteeExceptSig(chain, headState, subcommitteeIndex, {
@@ -74,14 +73,13 @@ export async function validateSyncCommitteeGossipContributionAndProof(
   // i.e. state.validators[contribution_and_proof.aggregator_index].pubkey in get_sync_subcommittee_pubkeys(state, contribution.subcommittee_index).
   // > Checked in validateGossipSyncCommitteeExceptSig()
 
-  const participantPubkeys = syncCommitteeParticipantIndices.map((validatorIndex) => index2pubkey[validatorIndex]);
   const signatureSets = [
     // [REJECT] The contribution_and_proof.selection_proof is a valid signature of the SyncAggregatorSelectionData
     // derived from the contribution by the validator with index contribution_and_proof.aggregator_index.
-    getSyncCommitteeSelectionProofSignatureSet(chain.config, index2pubkey, headState, contributionAndProof),
+    getSyncCommitteeSelectionProofSignatureSet(chain.config, headState, contributionAndProof),
 
     // [REJECT] The aggregator signature, signed_contribution_and_proof.signature, is valid.
-    getContributionAndProofSignatureSet(chain.config, index2pubkey, headState, signedContributionAndProof),
+    getContributionAndProofSignatureSet(chain.config, headState, signedContributionAndProof),
 
     // [REJECT] The aggregate signature is valid for the message beacon_block_root and aggregate pubkey derived from
     // the participation info in aggregation_bits for the subcommittee specified by the contribution.subcommittee_index.
@@ -89,7 +87,7 @@ export async function validateSyncCommitteeGossipContributionAndProof(
       chain.config,
       headState as CachedBeaconStateAltair,
       contribution,
-      participantPubkeys
+      syncCommitteeParticipantIndices
     ),
   ];
 

package/src/chain/validation/voluntaryExit.ts

@@ -59,7 +59,7 @@ async function validateVoluntaryExit(
     });
   }
 
-  const signatureSet = getVoluntaryExitSignatureSet(chain.config, chain.index2pubkey, state.slot, voluntaryExit);
+  const signatureSet = getVoluntaryExitSignatureSet(chain.config, state.slot, voluntaryExit);
   if (!(await chain.bls.verifySignatureSets([signatureSet], {batchable: true, priority: prioritizeBls}))) {
     throw new VoluntaryExitError(GossipAction.REJECT, {
       code: VoluntaryExitErrorCode.INVALID_SIGNATURE,

package/src/chain/validatorMonitor.ts

@@ -24,7 +24,7 @@ import {
   altair,
   deneb,
 } from "@lodestar/types";
-import {LogData, LogHandler, LogLevel, Logger, MapDef, MapDefMax, toRootHex} from "@lodestar/utils";
+import {LogData, LogHandler, LogLevel, Logger, MapDef, MapDefMax, prettyPrintIndices, toRootHex} from "@lodestar/utils";
 import {GENESIS_SLOT} from "../constants/constants.js";
 import {RegistryMetricCreator} from "../metrics/index.js";
 
@@ -39,7 +39,8 @@ const MAX_CACHED_DISTINCT_TARGETS = 4;
 const LATE_ATTESTATION_SUBMISSION_BPS = 5000;
 const LATE_BLOCK_SUBMISSION_BPS = 2500;
 
-const RETAIN_REGISTERED_VALIDATORS_MS = 1 * 3600 * 1000; // 1 hour
+/** Number of epochs to retain registered validators after their last registration */
+const RETAIN_REGISTERED_VALIDATORS_EPOCHS = 2;
 
 type Seconds = number;
 export enum OpSource {
@@ -97,6 +98,8 @@ export type ValidatorMonitor = {
   ): void;
   onceEveryEndOfEpoch(state: CachedBeaconStateAllForks): void;
   scrapeMetrics(slotClock: Slot): void;
+  /** Returns the list of validator indices currently being monitored */
+  getMonitoredValidatorIndices(): ValidatorIndex[];
 };
 
 export type ValidatorMonitorOpts = {
@@ -284,6 +287,9 @@ export function createValidatorMonitor(
     logger[logLevel](message, context);
   };
 
+  // Calculate retain time dynamically based on slot duration (2 epochs)
+  const retainRegisteredValidatorsMs = SLOTS_PER_EPOCH * config.SLOT_DURATION_MS * RETAIN_REGISTERED_VALIDATORS_EPOCHS;
+
   /** The validators that require additional monitoring. */
   const validators = new MapDef<ValidatorIndex, MonitoredValidator>(() => ({
     summaries: new Map<Epoch, EpochSummary>(),
@@ -306,11 +312,19 @@ export function createValidatorMonitor(
 
   let lastRegisteredStatusEpoch = -1;
 
+  // Track validator additions/removals per epoch for logging
+  const addedValidatorsInEpoch: Set<ValidatorIndex> = new Set();
+  const removedValidatorsInEpoch: Set<ValidatorIndex> = new Set();
+
   const validatorMonitorMetrics = metricsRegister ? createValidatorMonitorMetrics(metricsRegister) : null;
 
   const validatorMonitor: ValidatorMonitor = {
     registerLocalValidator(index) {
+      const isNewValidator = !validators.has(index);
       validators.getOrDefault(index).lastRegisteredTimeMs = Date.now();
+      if (isNewValidator) {
+        addedValidatorsInEpoch.add(index);
+      }
     },
 
     registerLocalValidatorInSyncCommittee(index, untilEpoch) {
@@ -673,11 +687,29 @@ export function createValidatorMonitor(
 
       // Prune validators not seen in a while
       for (const [index, validator] of validators.entries()) {
-        if (Date.now() - validator.lastRegisteredTimeMs > RETAIN_REGISTERED_VALIDATORS_MS) {
+        if (Date.now() - validator.lastRegisteredTimeMs > retainRegisteredValidatorsMs) {
           validators.delete(index);
+          removedValidatorsInEpoch.add(index);
         }
       }
 
+      // Log validator monitor status every epoch
+      const allIndices = Array.from(validators.keys()).sort((a, b) => a - b);
+      const addedIndices = Array.from(addedValidatorsInEpoch).sort((a, b) => a - b);
+      const removedIndices = Array.from(removedValidatorsInEpoch).sort((a, b) => a - b);
+
+      log("Validator monitor status", {
+        epoch: computeEpochAtSlot(headState.slot),
+        added: addedIndices.length > 0 ? prettyPrintIndices(addedIndices) : "none",
+        removed: removedIndices.length > 0 ? prettyPrintIndices(removedIndices) : "none",
+        total: validators.size,
+        indices: prettyPrintIndices(allIndices),
+      });
+
+      // Clear tracking sets for next epoch
+      addedValidatorsInEpoch.clear();
+      removedValidatorsInEpoch.clear();
+
       // Compute summaries of previous epoch attestation performance
       const prevEpoch = computeEpochAtSlot(headState.slot) - 1;
 
@@ -736,6 +768,13 @@ export function createValidatorMonitor(
     scrapeMetrics(slotClock) {
       validatorMonitorMetrics?.validatorsConnected.set(validators.size);
 
+      // Update static metric with connected validator indices
+      if (validatorMonitorMetrics?.validatorsConnectedIndices) {
+        validatorMonitorMetrics.validatorsConnectedIndices.reset();
+        const allIndices = Array.from(validators.keys()).sort((a, b) => a - b);
+        validatorMonitorMetrics.validatorsConnectedIndices.set({indices: prettyPrintIndices(allIndices)}, 1);
+      }
+
       const epoch = computeEpochAtSlot(slotClock);
       const slotInEpoch = slotClock % SLOTS_PER_EPOCH;
 
@@ -815,6 +854,10 @@ export function createValidatorMonitor(
       validatorMonitorMetrics?.prevEpochSyncCommitteeHits.set(prevEpochSyncCommitteeHits);
       validatorMonitorMetrics?.prevEpochSyncCommitteeMisses.set(prevEpochSyncCommitteeMisses);
     },
+
+    getMonitoredValidatorIndices() {
+      return Array.from(validators.keys()).sort((a, b) => a - b);
+    },
   };
 
   // Register a single collect() function to run all validatorMonitor metrics
@@ -1098,6 +1141,12 @@ function createValidatorMonitorMetrics(register: RegistryMetricCreator) {
       help: "Count of validators that are specifically monitored by this beacon node",
     }),
 
+    validatorsConnectedIndices: register.gauge<{indices: string}>({
+      name: "validator_monitor_indices",
+      help: "Static metric with connected validator indices as label, value is always 1",
+      labelNames: ["indices"],
+    }),
+
     validatorsInSyncCommittee: register.gauge({
       name: "validator_monitor_validators_in_sync_committee",
       help: "Count of validators monitored by this beacon node that are part of sync committee",

package/src/db/repositories/checkpointState.ts

@@ -1,31 +1,15 @@
 import {ChainForkConfig} from "@lodestar/config";
-import {Db, Repository} from "@lodestar/db";
-import {BeaconStateAllForks} from "@lodestar/state-transition";
-import {ssz} from "@lodestar/types";
+import {BinaryRepository, Db} from "@lodestar/db";
 import {Bucket, getBucketNameByValue} from "../buckets.js";
 
 /**
  * Store temporary checkpoint states.
  * We should only put/get binary data from this repository, consumer will load it into an existing state ViewDU object.
  */
-export class CheckpointStateRepository extends Repository<Uint8Array, BeaconStateAllForks> {
+export class CheckpointStateRepository extends BinaryRepository<Uint8Array> {
   constructor(config: ChainForkConfig, db: Db) {
-    // Pick some type but won't be used. Casted to any because no type can match `BeaconStateAllForks`
-    const type = ssz.phase0.BeaconState;
     const bucket = Bucket.allForks_checkpointState;
-    // biome-ignore lint/suspicious/noExplicitAny: The type is complex to specify a proper override
-    super(config, db, bucket, type as any, getBucketNameByValue(bucket));
-  }
-
-  getId(): Uint8Array {
-    throw Error("CheckpointStateRepository does not work with value");
-  }
-
-  encodeValue(): Uint8Array {
-    throw Error("CheckpointStateRepository does not work with value");
-  }
 
-  decodeValue(): BeaconStateAllForks {
-    throw Error("CheckpointStateRepository does not work with value");
+    super(config, db, bucket, getBucketNameByValue(bucket));
   }
 }