@lodestar/beacon-node 1.40.0-dev.c7b6a784da → 1.40.0-dev.cfd894719f

package/src/chain/validation/aggregateAndProof.ts

@@ -71,11 +71,34 @@ async function validateAggregateAndProof(
   const attData = aggregate.data;
   const attSlot = attData.slot;
 
-  let attIndex: number | null;
-  if (ForkSeq[fork] >= ForkSeq.electra) {
-    attIndex = (aggregate as electra.Attestation).committeeBits.getSingleTrueBit();
+  let committeeIndex: number | null;
+  if (ForkSeq[fork] >= ForkSeq.gloas) {
+    // [REJECT] `aggregate.data.index < 2`.
+    if (attData.index >= 2) {
+      throw new AttestationError(GossipAction.REJECT, {
+        code: AttestationErrorCode.INVALID_PAYLOAD_STATUS_VALUE,
+        attDataIndex: attData.index,
+      });
+    }
+    // [REJECT] `aggregate.data.index == 0` if `block.slot == aggregate.data.slot`.
+    const block = chain.forkChoice.getBlock(attData.beaconBlockRoot);
+
+    // If block is unknown, we don't handle it here. It will throw error later on at `verifyHeadBlockAndTargetRoot()`
+    if (block !== null && block.slot === attData.slot && attData.index !== 0) {
+      throw new AttestationError(GossipAction.REJECT, {
+        code: AttestationErrorCode.PREMATURELY_INDICATED_PAYLOAD_PRESENT,
+      });
+    }
+
+    // [REJECT] len(committee_indices) == 1, where committee_indices = get_committee_indices(aggregate)
+    committeeIndex = (aggregate as electra.Attestation).committeeBits.getSingleTrueBit();
+    if (committeeIndex === null) {
+      throw new AttestationError(GossipAction.REJECT, {code: AttestationErrorCode.NOT_EXACTLY_ONE_COMMITTEE_BIT_SET});
+    }
+  } else if (ForkSeq[fork] >= ForkSeq.electra) {
+    committeeIndex = (aggregate as electra.Attestation).committeeBits.getSingleTrueBit();
     // [REJECT] len(committee_indices) == 1, where committee_indices = get_committee_indices(aggregate)
-    if (attIndex === null) {
+    if (committeeIndex === null) {
       throw new AttestationError(GossipAction.REJECT, {code: AttestationErrorCode.NOT_EXACTLY_ONE_COMMITTEE_BIT_SET});
     }
     // [REJECT] aggregate.data.index == 0
@@ -83,11 +106,11 @@ async function validateAggregateAndProof(
       throw new AttestationError(GossipAction.REJECT, {code: AttestationErrorCode.NON_ZERO_ATTESTATION_DATA_INDEX});
     }
   } else {
-    attIndex = attData.index;
+    committeeIndex = attData.index;
   }
 
   const seenAttDataKey = serializedData ? getSeenAttDataKeyFromSignedAggregateAndProof(fork, serializedData) : null;
-  const cachedAttData = seenAttDataKey ? chain.seenAttestationDatas.get(attSlot, attIndex, seenAttDataKey) : null;
+  const cachedAttData = seenAttDataKey ? chain.seenAttestationDatas.get(attSlot, committeeIndex, seenAttDataKey) : null;
 
   const attEpoch = computeEpochAtSlot(attSlot);
   const attTarget = attData.target;
@@ -136,7 +159,7 @@ async function validateAggregateAndProof(
     : toRootHex(ssz.phase0.AttestationData.hashTreeRoot(attData));
   if (
     !skipValidationKnownAttesters &&
-    chain.seenAggregatedAttestations.isKnown(targetEpoch, attIndex, attDataRootHex, aggregationBits)
+    chain.seenAggregatedAttestations.isKnown(targetEpoch, committeeIndex, attDataRootHex, aggregationBits)
   ) {
     throw new AttestationError(GossipAction.IGNORE, {
       code: AttestationErrorCode.ATTESTERS_ALREADY_KNOWN,
@@ -177,7 +200,7 @@ async function validateAggregateAndProof(
   // -- i.e. data.index < get_committee_count_per_slot(state, data.target.epoch)
   const committeeValidatorIndices = cachedAttData
     ? cachedAttData.committeeValidatorIndices
-    : getCommitteeValidatorIndices(shuffling, attSlot, attIndex);
+    : getCommitteeValidatorIndices(shuffling, attSlot, committeeIndex);
 
   // [REJECT] The number of aggregation bits matches the committee size
   // -- i.e. `len(aggregation_bits) == len(get_beacon_committee(state, aggregate.data.slot, index))`.
@@ -216,16 +239,15 @@ async function validateAggregateAndProof(
   // by the validator with index aggregate_and_proof.aggregator_index.
   // [REJECT] The aggregator signature, signed_aggregate_and_proof.signature, is valid.
   // [REJECT] The signature of aggregate is valid.
-  const aggregator = chain.index2pubkey[aggregateAndProof.aggregatorIndex];
   const signingRoot = cachedAttData ? cachedAttData.signingRoot : getAttestationDataSigningRoot(chain.config, attData);
   const indexedAttestationSignatureSet = createAggregateSignatureSetFromComponents(
-    indexedAttestation.attestingIndices.map((i) => chain.index2pubkey[i]),
+    indexedAttestation.attestingIndices,
     signingRoot,
     indexedAttestation.signature
   );
   const signatureSets = [
-    getSelectionProofSignatureSet(chain.config, attSlot, aggregator, signedAggregateAndProof),
-    getAggregateAndProofSignatureSet(chain.config, attEpoch, aggregator, signedAggregateAndProof),
+    getSelectionProofSignatureSet(chain.config, attSlot, aggregatorIndex, signedAggregateAndProof),
+    getAggregateAndProofSignatureSet(chain.config, attEpoch, aggregatorIndex, signedAggregateAndProof),
     indexedAttestationSignatureSet,
   ];
   // no need to write to SeenAttestationDatas
@@ -248,7 +270,7 @@ async function validateAggregateAndProof(
   // Same race-condition check as above for seen aggregators
   if (
     !skipValidationKnownAttesters &&
-    chain.seenAggregatedAttestations.isKnown(targetEpoch, attIndex, attDataRootHex, aggregationBits)
+    chain.seenAggregatedAttestations.isKnown(targetEpoch, committeeIndex, attDataRootHex, aggregationBits)
   ) {
     throw new AttestationError(GossipAction.IGNORE, {
       code: AttestationErrorCode.ATTESTERS_ALREADY_KNOWN,
@@ -260,7 +282,7 @@ async function validateAggregateAndProof(
   chain.seenAggregators.add(targetEpoch, aggregatorIndex);
   chain.seenAggregatedAttestations.add(
     targetEpoch,
-    attIndex,
+    committeeIndex,
     attDataRootHex,
     {aggregationBits, trueBitCount: attestingIndices.length},
     false

package/src/chain/validation/attestation.ts

@@ -10,16 +10,17 @@ import {
   ForkSeq,
   SLOTS_PER_EPOCH,
   isForkPostElectra,
+  isForkPostGloas,
 } from "@lodestar/params";
 import {
   EpochShuffling,
+  IndexedSignatureSet,
   ShufflingError,
   ShufflingErrorCode,
-  SingleSignatureSet,
   computeEpochAtSlot,
   computeSigningRoot,
   computeStartSlotAtEpoch,
-  createSingleSignatureSetFromComponents,
+  createIndexedSignatureSetFromComponents,
 } from "@lodestar/state-transition";
 import {
   CommitteeIndex,
@@ -89,7 +90,7 @@ export type GossipAttestation = {
 };
 
 export type Step0Result = AttestationValidationResult & {
-  signatureSet: SingleSignatureSet;
+  signatureSet: IndexedSignatureSet;
   validatorIndex: number;
 };
 
@@ -124,7 +125,7 @@ export async function validateGossipAttestationsSameAttData(
   // step1: verify signatures of all valid attestations
   // map new index to index in resultOrErrors
   const newIndexToOldIndex = new Map<number, number>();
-  const signatureSets: SingleSignatureSet[] = [];
+  const signatureSets: IndexedSignatureSet[] = [];
   let newIndex = 0;
   const step0Results: Step0Result[] = [];
   for (const [i, resultOrError] of step0ResultOrErrors.entries()) {
@@ -142,7 +143,7 @@ export async function validateGossipAttestationsSameAttData(
   if (batchableBls) {
     // all signature sets should have same signing root since we filtered in network processor
     signatureValids = await chain.bls.verifySignatureSetsSameMessage(
-      signatureSets.map((set) => ({publicKey: set.pubkey, signature: set.signature})),
+      signatureSets.map((set) => ({publicKey: chain.index2pubkey[set.index], signature: set.signature})),
       signatureSets[0].signingRoot
     );
   } else {
@@ -293,9 +294,29 @@ async function validateAttestationNoSignatureCheck(
       // api or first time validation of a gossip attestation
       committeeIndex = attestationOrCache.attestation.committeeIndex;
 
-      // [REJECT] attestation.data.index == 0
-      if (attData.index !== 0) {
-        throw new AttestationError(GossipAction.REJECT, {code: AttestationErrorCode.NON_ZERO_ATTESTATION_DATA_INDEX});
+      if (isForkPostGloas(fork)) {
+        // [REJECT] `attestation.data.index < 2`.
+        if (attData.index >= 2) {
+          throw new AttestationError(GossipAction.REJECT, {
+            code: AttestationErrorCode.INVALID_PAYLOAD_STATUS_VALUE,
+            attDataIndex: attData.index,
+          });
+        }
+
+        // [REJECT] `attestation.data.index == 0` if `block.slot == attestation.data.slot`.
+        const block = chain.forkChoice.getBlock(attData.beaconBlockRoot);
+
+        // block being null will be handled by `verifyHeadBlockAndTargetRoot`
+        if (block !== null && block.slot === attSlot && attData.index !== 0) {
+          throw new AttestationError(GossipAction.REJECT, {
+            code: AttestationErrorCode.PREMATURELY_INDICATED_PAYLOAD_PRESENT,
+          });
+        }
+      } else {
+        // [REJECT] attestation.data.index == 0
+        if (attData.index !== 0) {
+          throw new AttestationError(GossipAction.REJECT, {code: AttestationErrorCode.NON_ZERO_ATTESTATION_DATA_INDEX});
+        }
       }
     } else {
       // phase0 attestation
@@ -477,7 +498,7 @@ async function validateAttestationNoSignatureCheck(
 
   // [REJECT] The signature of attestation is valid.
   const attestingIndices = [validatorIndex];
-  let signatureSet: SingleSignatureSet;
+  let signatureSet: IndexedSignatureSet;
   let attDataRootHex: RootHex;
   const signature = attestationOrCache.attestation
     ? attestationOrCache.attestation.signature
@@ -492,18 +513,14 @@ async function validateAttestationNoSignatureCheck(
 
   if (attestationOrCache.cache) {
     // there could be up to 6% of cpu time to compute signing root if we don't clone the signature set
-    signatureSet = createSingleSignatureSetFromComponents(
-      chain.index2pubkey[validatorIndex],
+    signatureSet = createIndexedSignatureSetFromComponents(
+      validatorIndex,
       attestationOrCache.cache.signingRoot,
       signature
     );
     attDataRootHex = attestationOrCache.cache.attDataRootHex;
   } else {
-    signatureSet = createSingleSignatureSetFromComponents(
-      chain.index2pubkey[validatorIndex],
-      getSigningRoot(),
-      signature
-    );
+    signatureSet = createIndexedSignatureSetFromComponents(validatorIndex, getSigningRoot(), signature);
 
     // add cached attestation data before verifying signature
     attDataRootHex = toRootHex(ssz.phase0.AttestationData.hashTreeRoot(attData));

package/src/chain/validation/attesterSlashing.ts

@@ -58,12 +58,7 @@ export async function validateAttesterSlashing(
     });
   }
 
-  const signatureSets = getAttesterSlashingSignatureSets(
-    chain.config,
-    chain.index2pubkey,
-    state.slot,
-    attesterSlashing
-  );
+  const signatureSets = getAttesterSlashingSignatureSets(chain.config, state.slot, attesterSlashing);
   if (!(await chain.bls.verifySignatureSets(signatureSets, {batchable: true, priority: prioritizeBls}))) {
     throw new AttesterSlashingError(GossipAction.REJECT, {
       code: AttesterSlashingErrorCode.INVALID,

package/src/chain/validation/blobSidecar.ts

@@ -139,7 +139,6 @@ export async function validateGossipBlobSidecar(
   if (!chain.seenBlockInputCache.isVerifiedProposerSignature(blobSlot, blockHex, signature)) {
     const signatureSet = getBlockHeaderProposerSignatureSetByParentStateSlot(
       chain.config,
-      chain.index2pubkey,
       blockState.slot,
       blobSidecar.signedBlockHeader
     );
@@ -244,11 +243,7 @@ export async function validateBlockBlobSidecars(
     const blockRootHex = toRootHex(blockRoot);
     const signature = firstSidecarSignedBlockHeader.signature;
     if (!chain.seenBlockInputCache.isVerifiedProposerSignature(blockSlot, blockRootHex, signature)) {
-      const signatureSet = getBlockHeaderProposerSignatureSetByHeaderSlot(
-        chain.config,
-        chain.index2pubkey,
-        firstSidecarSignedBlockHeader
-      );
+      const signatureSet = getBlockHeaderProposerSignatureSetByHeaderSlot(chain.config, firstSidecarSignedBlockHeader);
 
       if (
         !(await chain.bls.verifySignatureSets([signatureSet], {

package/src/chain/validation/block.ts

@@ -1,5 +1,5 @@
 import {ChainForkConfig} from "@lodestar/config";
-import {ForkName, isForkPostDeneb} from "@lodestar/params";
+import {ForkName, isForkPostBellatrix, isForkPostDeneb, isForkPostGloas} from "@lodestar/params";
 import {
   computeEpochAtSlot,
   computeStartSlotAtEpoch,
@@ -111,7 +111,7 @@ export async function validateGossipBlock(
   }
 
   // [REJECT] The length of KZG commitments is less than or equal to the limitation defined in Consensus Layer -- i.e. validate that len(body.signed_beacon_block.message.blob_kzg_commitments) <= MAX_BLOBS_PER_BLOCK
-  if (isForkPostDeneb(fork)) {
+  if (isForkPostDeneb(fork) && !isForkPostGloas(fork)) {
     const blobKzgCommitmentsLen = (block as deneb.BeaconBlock).body.blobKzgCommitments.length;
     const maxBlobsPerBlock = config.getMaxBlobsPerBlock(computeEpochAtSlot(blockSlot));
     if (blobKzgCommitmentsLen > maxBlobsPerBlock) {
@@ -128,6 +128,7 @@ export async function validateGossipBlock(
   // this is something we should change this in the future to make the code airtight to the spec.
   // [IGNORE] The block's parent (defined by block.parent_root) has been seen (via both gossip and non-gossip sources) (a client MAY queue blocks for processing once the parent block is retrieved).
   // [REJECT] The block's parent (defined by block.parent_root) passes validation.
+  // TODO GLOAS: post-gloas, we check the validity of bid's parent payload, not the entire beacon block
   const blockState = await chain.regen
     .getPreState(block, {dontTransferCache: true}, RegenCaller.validateGossipBlock)
     .catch(() => {
@@ -140,7 +141,7 @@ export async function validateGossipBlock(
   // Extra conditions for merge fork blocks
   // [REJECT] The block's execution payload timestamp is correct with respect to the slot
   // -- i.e. execution_payload.timestamp == compute_timestamp_at_slot(state, block.slot).
-  if (fork === ForkName.bellatrix) {
+  if (isForkPostBellatrix(fork) && !isForkPostGloas(fork)) {
     if (!isExecutionBlockBodyType(block.body)) throw Error("Not merge block type");
     const executionPayload = block.body.executionPayload;
     if (isExecutionStateType(blockState) && isExecutionEnabled(blockState, block)) {
@@ -157,7 +158,7 @@ export async function validateGossipBlock(
 
   // [REJECT] The proposer signature, signed_beacon_block.signature, is valid with respect to the proposer_index pubkey.
   if (!chain.seenBlockInputCache.isVerifiedProposerSignature(blockSlot, blockRoot, signedBlock.signature)) {
-    const signatureSet = getBlockProposerSignatureSet(chain.config, chain.index2pubkey, signedBlock);
+    const signatureSet = getBlockProposerSignatureSet(chain.config, signedBlock);
     // Don't batch so verification is not delayed
     if (!(await chain.bls.verifySignatureSets([signatureSet], {verifyOnMainThread: true}))) {
       throw new BlockGossipError(GossipAction.REJECT, {

package/src/chain/validation/dataColumnSidecar.ts

@@ -136,7 +136,6 @@ export async function validateGossipDataColumnSidecar(
   if (!chain.seenBlockInputCache.isVerifiedProposerSignature(blockHeader.slot, blockRootHex, signature)) {
     const signatureSet = getBlockHeaderProposerSignatureSetByParentStateSlot(
       chain.config,
-      chain.index2pubkey,
       blockState.slot,
       dataColumnSidecar.signedBlockHeader
     );
@@ -337,11 +336,7 @@ export async function validateBlockDataColumnSidecars(
     const slot = firstSidecarSignedBlockHeader.message.slot;
     const signature = firstSidecarSignedBlockHeader.signature;
     if (!chain.seenBlockInputCache.isVerifiedProposerSignature(slot, rootHex, signature)) {
-      const signatureSet = getBlockHeaderProposerSignatureSetByHeaderSlot(
-        chain.config,
-        chain.index2pubkey,
-        firstSidecarSignedBlockHeader
-      );
+      const signatureSet = getBlockHeaderProposerSignatureSetByHeaderSlot(chain.config, firstSidecarSignedBlockHeader);
 
       if (
         !(await chain.bls.verifySignatureSets([signatureSet], {

package/src/chain/validation/executionPayloadBid.ts

@@ -0,0 +1,140 @@
+import {PublicKey} from "@chainsafe/blst";
+import {
+  CachedBeaconStateGloas,
+  canBuilderCoverBid,
+  createSingleSignatureSetFromComponents,
+  getExecutionPayloadBidSigningRoot,
+  isActiveBuilder,
+} from "@lodestar/state-transition";
+import {gloas} from "@lodestar/types";
+import {toRootHex} from "@lodestar/utils";
+import {ExecutionPayloadBidError, ExecutionPayloadBidErrorCode, GossipAction} from "../errors/index.js";
+import {IBeaconChain} from "../index.js";
+import {RegenCaller} from "../regen/index.js";
+
+export async function validateApiExecutionPayloadBid(
+  chain: IBeaconChain,
+  signedExecutionPayloadBid: gloas.SignedExecutionPayloadBid
+): Promise<void> {
+  return validateExecutionPayloadBid(chain, signedExecutionPayloadBid);
+}
+
+export async function validateGossipExecutionPayloadBid(
+  chain: IBeaconChain,
+  signedExecutionPayloadBid: gloas.SignedExecutionPayloadBid
+): Promise<void> {
+  return validateExecutionPayloadBid(chain, signedExecutionPayloadBid);
+}
+
+async function validateExecutionPayloadBid(
+  chain: IBeaconChain,
+  signedExecutionPayloadBid: gloas.SignedExecutionPayloadBid
+): Promise<void> {
+  const bid = signedExecutionPayloadBid.message;
+  const parentBlockRootHex = toRootHex(bid.parentBlockRoot);
+  const parentBlockHashHex = toRootHex(bid.parentBlockHash);
+  const state = (await chain.getHeadStateAtCurrentEpoch(
+    RegenCaller.validateGossipExecutionPayloadBid
+  )) as CachedBeaconStateGloas;
+
+  // [IGNORE] `bid.slot` is the current slot or the next slot.
+  const currentSlot = chain.clock.currentSlot;
+  if (bid.slot !== currentSlot && bid.slot !== currentSlot + 1) {
+    throw new ExecutionPayloadBidError(GossipAction.IGNORE, {
+      code: ExecutionPayloadBidErrorCode.INVALID_SLOT,
+      builderIndex: bid.builderIndex,
+      slot: bid.slot,
+    });
+  }
+
+  // [IGNORE] the `SignedProposerPreferences` where `preferences.proposal_slot`
+  // is equal to `bid.slot` has been seen.
+  // TODO GLOAS: Implement this along with proposer preference
+
+  // [REJECT] `bid.builder_index` is a valid/active builder index -- i.e.
+  // `is_active_builder(state, bid.builder_index)` returns `True`.
+  if (!isActiveBuilder(state, bid.builderIndex)) {
+    throw new ExecutionPayloadBidError(GossipAction.REJECT, {
+      code: ExecutionPayloadBidErrorCode.BUILDER_NOT_ELIGIBLE,
+      builderIndex: bid.builderIndex,
+    });
+  }
+
+  // [REJECT] `bid.execution_payment` is zero.
+  if (bid.executionPayment !== 0) {
+    throw new ExecutionPayloadBidError(GossipAction.REJECT, {
+      code: ExecutionPayloadBidErrorCode.NON_ZERO_EXECUTION_PAYMENT,
+      builderIndex: bid.builderIndex,
+      executionPayment: bid.executionPayment,
+    });
+  }
+
+  // [REJECT] `bid.fee_recipient` matches the `fee_recipient` from the proposer's
+  // `SignedProposerPreferences` associated with `bid.slot`.
+  // [REJECT] `bid.gas_limit` matches the `gas_limit` from the proposer's
+  // `SignedProposerPreferences` associated with `bid.slot`.
+  // TODO GLOAS: Implement this along with proposer preference
+
+  // [IGNORE] this is the first signed bid seen with a valid signature from the given builder for this slot.
+  if (chain.seenExecutionPayloadBids.isKnown(bid.slot, bid.builderIndex)) {
+    throw new ExecutionPayloadBidError(GossipAction.IGNORE, {
+      code: ExecutionPayloadBidErrorCode.BID_ALREADY_KNOWN,
+      builderIndex: bid.builderIndex,
+      slot: bid.slot,
+      parentBlockRoot: parentBlockRootHex,
+      parentBlockHash: parentBlockHashHex,
+    });
+  }
+
+  // [IGNORE] this bid is the highest value bid seen for the corresponding slot
+  // and the given parent block hash.
+  const bestBid = chain.executionPayloadBidPool.getBestBid(parentBlockRootHex, parentBlockHashHex, bid.slot);
+  if (bestBid !== null && bestBid.value >= bid.value) {
+    throw new ExecutionPayloadBidError(GossipAction.IGNORE, {
+      code: ExecutionPayloadBidErrorCode.BID_TOO_LOW,
+      bidValue: bid.value,
+      currentHighestBid: bestBid.value,
+    });
+  }
+  // [IGNORE] `bid.value` is less or equal than the builder's excess balance --
+  // i.e. `can_builder_cover_bid(state, builder_index, amount)` returns `True`.
+  if (!canBuilderCoverBid(state, bid.builderIndex, bid.value)) {
+    throw new ExecutionPayloadBidError(GossipAction.IGNORE, {
+      code: ExecutionPayloadBidErrorCode.BID_TOO_HIGH,
+      bidValue: bid.value,
+      builderBalance: state.builders.getReadonly(bid.builderIndex).balance,
+    });
+  }
+
+  // [IGNORE] `bid.parent_block_hash` is the block hash of a known execution
+  // payload in fork choice.
+  // TODO GLOAS: implement this
+
+  // [IGNORE] `bid.parent_block_root` is the hash tree root of a known beacon
+  // block in fork choice.
+  const block = chain.forkChoice.getBlock(bid.parentBlockRoot);
+  if (block === null) {
+    throw new ExecutionPayloadBidError(GossipAction.IGNORE, {
+      code: ExecutionPayloadBidErrorCode.UNKNOWN_BLOCK_ROOT,
+      parentBlockRoot: parentBlockRootHex,
+    });
+  }
+
+  // [REJECT] `signed_execution_payload_bid.signature` is valid with respect to the `bid.builder_index`.
+  const signatureSet = createSingleSignatureSetFromComponents(
+    PublicKey.fromBytes(state.builders.getReadonly(bid.builderIndex).pubkey),
+    getExecutionPayloadBidSigningRoot(chain.config, state as CachedBeaconStateGloas, bid),
+    signedExecutionPayloadBid.signature
+  );
+
+  if (!(await chain.bls.verifySignatureSets([signatureSet]))) {
+    throw new ExecutionPayloadBidError(GossipAction.REJECT, {
+      code: ExecutionPayloadBidErrorCode.INVALID_SIGNATURE,
+      builderIndex: bid.builderIndex,
+      slot: bid.slot,
+    });
+  }
+
+  // Valid
+  chain.seenExecutionPayloadBids.add(bid.slot, bid.builderIndex);
+}

package/src/chain/validation/executionPayloadEnvelope.ts

@@ -0,0 +1,122 @@
+import {PublicKey} from "@chainsafe/blst";
+import {
+  CachedBeaconStateGloas,
+  computeStartSlotAtEpoch,
+  createSingleSignatureSetFromComponents,
+  getExecutionPayloadEnvelopeSigningRoot,
+} from "@lodestar/state-transition";
+import {gloas} from "@lodestar/types";
+import {toRootHex} from "@lodestar/utils";
+import {ExecutionPayloadEnvelopeError, ExecutionPayloadEnvelopeErrorCode, GossipAction} from "../errors/index.js";
+import {IBeaconChain} from "../index.js";
+
+export async function validateApiExecutionPayloadEnvelope(
+  chain: IBeaconChain,
+  executionPayloadEnvelope: gloas.SignedExecutionPayloadEnvelope
+): Promise<void> {
+  return validateExecutionPayloadEnvelope(chain, executionPayloadEnvelope);
+}
+
+export async function validateGossipExecutionPayloadEnvelope(
+  chain: IBeaconChain,
+  executionPayloadEnvelope: gloas.SignedExecutionPayloadEnvelope
+): Promise<void> {
+  return validateExecutionPayloadEnvelope(chain, executionPayloadEnvelope);
+}
+
+async function validateExecutionPayloadEnvelope(
+  chain: IBeaconChain,
+  executionPayloadEnvelope: gloas.SignedExecutionPayloadEnvelope
+): Promise<void> {
+  const envelope = executionPayloadEnvelope.message;
+  const {payload} = envelope;
+  const blockRootHex = toRootHex(envelope.beaconBlockRoot);
+
+  // [IGNORE] The envelope's block root `envelope.block_root` has been seen (via
+  // gossip or non-gossip sources) (a client MAY queue payload for processing once
+  // the block is retrieved).
+  // TODO GLOAS: Need to review this
+  const block = chain.forkChoice.getBlock(envelope.beaconBlockRoot);
+  if (block === null) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.IGNORE, {
+      code: ExecutionPayloadEnvelopeErrorCode.BLOCK_ROOT_UNKNOWN,
+      blockRoot: blockRootHex,
+    });
+  }
+
+  // [IGNORE] The node has not seen another valid
+  // `SignedExecutionPayloadEnvelope` for this block root from this builder.
+  if (chain.seenExecutionPayloadEnvelopes.isKnown(blockRootHex)) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.IGNORE, {
+      code: ExecutionPayloadEnvelopeErrorCode.ENVELOPE_ALREADY_KNOWN,
+      blockRoot: blockRootHex,
+      slot: envelope.slot,
+    });
+  }
+
+  // [IGNORE] The envelope is from a slot greater than or equal to the latest finalized slot -- i.e. validate that `envelope.slot >= compute_start_slot_at_epoch(store.finalized_checkpoint.epoch)`
+  const finalizedCheckpoint = chain.forkChoice.getFinalizedCheckpoint();
+  const finalizedSlot = computeStartSlotAtEpoch(finalizedCheckpoint.epoch);
+  if (envelope.slot < finalizedSlot) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.IGNORE, {
+      code: ExecutionPayloadEnvelopeErrorCode.BELONG_TO_FINALIZED_BLOCK,
+      envelopeSlot: envelope.slot,
+      finalizedSlot,
+    });
+  }
+
+  // [REJECT] `block` passes validation.
+  // TODO GLOAS: implement this. Technically if we cannot get proto block from fork choice,
+  // it is possible that the block didn't pass the validation
+
+  // [REJECT] `block.slot` equals `envelope.slot`.
+  if (block.slot !== envelope.slot) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.REJECT, {
+      code: ExecutionPayloadEnvelopeErrorCode.SLOT_MISMATCH,
+      envelopeSlot: envelope.slot,
+      blockSlot: block.slot,
+    });
+  }
+
+  if (block.builderIndex === undefined || block.blockHashHex === undefined) {
+    // This indicates this block is a pre-gloas block which is wrong
+    throw new ExecutionPayloadEnvelopeError(GossipAction.IGNORE, {
+      code: ExecutionPayloadEnvelopeErrorCode.CACHE_FAIL,
+      blockRoot: blockRootHex,
+    });
+  }
+
+  // [REJECT] `envelope.builder_index == bid.builder_index`
+  if (envelope.builderIndex !== block.builderIndex) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.REJECT, {
+      code: ExecutionPayloadEnvelopeErrorCode.BUILDER_INDEX_MISMATCH,
+      envelopeBuilderIndex: envelope.builderIndex,
+      bidBuilderIndex: block.builderIndex,
+    });
+  }
+
+  // [REJECT] `payload.block_hash == bid.block_hash`
+  if (toRootHex(payload.blockHash) !== block.blockHashHex) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.REJECT, {
+      code: ExecutionPayloadEnvelopeErrorCode.BLOCK_HASH_MISMATCH,
+      envelopeBlockHash: toRootHex(payload.blockHash),
+      bidBlockHash: block.blockHashHex,
+    });
+  }
+
+  // [REJECT] `signed_execution_payload_envelope.signature` is valid with respect to the builder's public key.
+  const state = chain.getHeadState() as CachedBeaconStateGloas;
+  const signatureSet = createSingleSignatureSetFromComponents(
+    PublicKey.fromBytes(state.builders.getReadonly(envelope.builderIndex).pubkey),
+    getExecutionPayloadEnvelopeSigningRoot(chain.config, envelope),
+    executionPayloadEnvelope.signature
+  );
+
+  if (!(await chain.bls.verifySignatureSets([signatureSet]))) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.REJECT, {
+      code: ExecutionPayloadEnvelopeErrorCode.INVALID_SIGNATURE,
+    });
+  }
+
+  chain.seenExecutionPayloadEnvelopes.add(blockRootHex, envelope.slot);
+}