@lodestar/beacon-node 1.45.0-dev.c6b2b7f1ba → 1.45.0-dev.d16fa2b13a

package/src/chain/validation/block.ts

@@ -1,6 +1,22 @@
 import {ChainForkConfig} from "@lodestar/config";
 import {ExecutionStatus} from "@lodestar/fork-choice";
-import {ForkName, isForkPostBellatrix, isForkPostDeneb, isForkPostGloas} from "@lodestar/params";
+import {
+  ForkName,
+  MAX_ATTESTATIONS_ELECTRA,
+  MAX_ATTESTER_SLASHINGS_ELECTRA,
+  MAX_BLS_TO_EXECUTION_CHANGES,
+  MAX_BUILDER_DEPOSIT_REQUESTS_PER_PAYLOAD,
+  MAX_BUILDER_EXIT_REQUESTS_PER_PAYLOAD,
+  MAX_CONSOLIDATION_REQUESTS_PER_PAYLOAD,
+  MAX_DEPOSIT_REQUESTS_PER_PAYLOAD,
+  MAX_PAYLOAD_ATTESTATIONS,
+  MAX_PROPOSER_SLASHINGS,
+  MAX_VOLUNTARY_EXITS,
+  MAX_WITHDRAWAL_REQUESTS_PER_PAYLOAD,
+  isForkPostBellatrix,
+  isForkPostDeneb,
+  isForkPostGloas,
+} from "@lodestar/params";
 import {
   computeEpochAtSlot,
   computeStartSlotAtEpoch,
@@ -88,8 +104,8 @@ export async function validateGossipBlock(
     // 2. The parent is unknown to us, we probably want to download it since it might actually
     //    descend from the finalized root.
     // (Non-Lighthouse): Since we prune all blocks non-descendant from finalized checking the `db.block` database won't be useful to guard
-    // against known bad fork blocks, so we throw PARENT_UNKNOWN for cases (1) and (2)
-    throw new BlockGossipError(GossipAction.IGNORE, {code: BlockErrorCode.PARENT_UNKNOWN, parentRoot});
+    // against known bad fork blocks, so we throw PARENT_BLOCK_UNKNOWN for cases (1) and (2)
+    throw new BlockGossipError(GossipAction.IGNORE, {code: BlockErrorCode.PARENT_BLOCK_UNKNOWN, parentRoot});
   }
 
   // [IGNORE] The block's parent (defined by `block.parent_root`) passes all validation
@@ -164,6 +180,58 @@ export async function validateGossipBlock(
       });
     }
 
+    // [REJECT] The counts of `block.body.parent_execution_requests` are within
+    //   their respective limits -- i.e. validate that
+    //   `len(block.body.parent_execution_requests.deposits) <= MAX_DEPOSIT_REQUESTS_PER_PAYLOAD`,
+    //   `len(block.body.parent_execution_requests.withdrawals) <= MAX_WITHDRAWAL_REQUESTS_PER_PAYLOAD`,
+    //   `len(block.body.parent_execution_requests.consolidations) <= MAX_CONSOLIDATION_REQUESTS_PER_PAYLOAD`,
+    //   `len(block.body.parent_execution_requests.builder_deposits) <= MAX_BUILDER_DEPOSIT_REQUESTS_PER_PAYLOAD`,
+    //   and
+    //   `len(block.body.parent_execution_requests.builder_exits) <= MAX_BUILDER_EXIT_REQUESTS_PER_PAYLOAD`.
+    // [REJECT] The counts of the block body operations are within their respective
+    //   limits -- i.e. validate that
+    //   `len(block.body.proposer_slashings) <= MAX_PROPOSER_SLASHINGS`,
+    //   `len(block.body.attester_slashings) <= MAX_ATTESTER_SLASHINGS_ELECTRA`,
+    //   `len(block.body.attestations) <= MAX_ATTESTATIONS_ELECTRA`,
+    //   `len(block.body.deposits) == 0`,
+    //   `len(block.body.voluntary_exits) <= MAX_VOLUNTARY_EXITS`,
+    //   `len(block.body.bls_to_execution_changes) <= MAX_BLS_TO_EXECUTION_CHANGES`,
+    //   and `len(block.body.payload_attestations) <= MAX_PAYLOAD_ATTESTATIONS`.
+    const body = (block as gloas.BeaconBlock).body;
+    const requests = body.parentExecutionRequests;
+    const countLimits: [string, number, number][] = [
+      ["parentExecutionRequests.deposits", requests.deposits.length, MAX_DEPOSIT_REQUESTS_PER_PAYLOAD],
+      ["parentExecutionRequests.withdrawals", requests.withdrawals.length, MAX_WITHDRAWAL_REQUESTS_PER_PAYLOAD],
+      [
+        "parentExecutionRequests.consolidations",
+        requests.consolidations.length,
+        MAX_CONSOLIDATION_REQUESTS_PER_PAYLOAD,
+      ],
+      [
+        "parentExecutionRequests.builderDeposits",
+        requests.builderDeposits.length,
+        MAX_BUILDER_DEPOSIT_REQUESTS_PER_PAYLOAD,
+      ],
+      ["parentExecutionRequests.builderExits", requests.builderExits.length, MAX_BUILDER_EXIT_REQUESTS_PER_PAYLOAD],
+      ["proposerSlashings", body.proposerSlashings.length, MAX_PROPOSER_SLASHINGS],
+      ["attesterSlashings", body.attesterSlashings.length, MAX_ATTESTER_SLASHINGS_ELECTRA],
+      ["attestations", body.attestations.length, MAX_ATTESTATIONS_ELECTRA],
+      ["deposits", body.deposits.length, 0],
+      ["voluntaryExits", body.voluntaryExits.length, MAX_VOLUNTARY_EXITS],
+      ["blsToExecutionChanges", body.blsToExecutionChanges.length, MAX_BLS_TO_EXECUTION_CHANGES],
+      ["payloadAttestations", body.payloadAttestations.length, MAX_PAYLOAD_ATTESTATIONS],
+    ];
+    for (const [name, count, limit] of countLimits) {
+      if (count > limit) {
+        throw new BlockGossipError(GossipAction.REJECT, {
+          code: BlockErrorCode.TOO_MANY_BLOCK_OPERATIONS,
+          name,
+          count,
+          limit,
+        });
+      }
+    }
+
     // TODO GLOAS: [REJECT] The block's execution payload parent (defined by bid.parent_block_hash) passes all validation
     // This requires execution engine integration to verify the parent block hash
   }
@@ -176,7 +244,7 @@ export async function validateGossipBlock(
   const blockState = await chain.regen
     .getPreState(block, {dontTransferCache: true}, RegenCaller.validateGossipBlock)
     .catch(() => {
-      throw new BlockGossipError(GossipAction.IGNORE, {code: BlockErrorCode.PARENT_UNKNOWN, parentRoot});
+      throw new BlockGossipError(GossipAction.IGNORE, {code: BlockErrorCode.PARENT_BLOCK_UNKNOWN, parentRoot});
     });
 
   // in forky condition, make sure to populate ShufflingCache with regened state

package/src/chain/validation/executionPayloadBid.ts

@@ -37,9 +37,11 @@ async function validateExecutionPayloadBid(
   const parentBlockRootHex = toRootHex(bid.parentBlockRoot);
   const parentBlockHashHex = toRootHex(bid.parentBlockHash);
 
-  // [IGNORE] `bid.slot` is the current slot or the next slot.
-  const currentSlot = chain.clock.currentSlot;
-  if (bid.slot !== currentSlot && bid.slot !== currentSlot + 1) {
+  // [IGNORE] `bid.slot` is the current slot, or the next slot (`bid.slot - 1` is current), allowing for `MAXIMUM_GOSSIP_CLOCK_DISPARITY`.
+  if (
+    !chain.clock.isCurrentSlotGivenGossipDisparity(bid.slot) &&
+    !chain.clock.isCurrentSlotGivenGossipDisparity(bid.slot - 1)
+  ) {
     throw new ExecutionPayloadBidError(GossipAction.IGNORE, {
       code: ExecutionPayloadBidErrorCode.INVALID_SLOT,
       builderIndex: bid.builderIndex,
@@ -122,17 +124,20 @@ async function validateExecutionPayloadBid(
     throw new Error(`Expected gloas+ state for execution payload bid validation, got fork=${state.forkName}`);
   }
 
-  // [REJECT] `bid.builder_index` is a valid/active builder index -- i.e.
-  // `is_active_builder(state, bid.builder_index)` returns `True`.
-  let builder: gloas.Builder;
-  try {
-    builder = state.getBuilder(bid.builderIndex);
-  } catch {
+  // [REJECT] `bid.builder_index` is within bounds -- i.e. `bid.builder_index < len(state.builders)`.
+  // `state.getBuilder` returns a lazy SSZ `getReadonly` view that is not bounds-checked eagerly; an
+  // out-of-range index only throws (`LeafNode has no right node`) on deferred field access (e.g. inside
+  // `isActiveBuilder`), escaping a try/catch around `getBuilder`. Check the length explicitly instead.
+  if (bid.builderIndex >= state.getBuildersLength()) {
     throw new ExecutionPayloadBidError(GossipAction.REJECT, {
       code: ExecutionPayloadBidErrorCode.BUILDER_NOT_ELIGIBLE,
       builderIndex: bid.builderIndex,
     });
   }
+
+  // [REJECT] `bid.builder_index` is a valid/active builder index -- i.e.
+  // `is_active_builder(state, bid.builder_index)` returns `True`.
+  const builder = state.getBuilder(bid.builderIndex);
   if (!isActiveBuilder(builder, state.finalizedCheckpoint.epoch)) {
     throw new ExecutionPayloadBidError(GossipAction.REJECT, {
       code: ExecutionPayloadBidErrorCode.BUILDER_NOT_ELIGIBLE,

package/src/chain/validation/executionPayloadEnvelope.ts

@@ -1,4 +1,12 @@
 import {PayloadStatus} from "@lodestar/fork-choice";
+import {
+  MAX_BUILDER_DEPOSIT_REQUESTS_PER_PAYLOAD,
+  MAX_BUILDER_EXIT_REQUESTS_PER_PAYLOAD,
+  MAX_CONSOLIDATION_REQUESTS_PER_PAYLOAD,
+  MAX_DEPOSIT_REQUESTS_PER_PAYLOAD,
+  MAX_WITHDRAWALS_PER_PAYLOAD,
+  MAX_WITHDRAWAL_REQUESTS_PER_PAYLOAD,
+} from "@lodestar/params";
 import {
   computeStartSlotAtEpoch,
   getExecutionPayloadEnvelopeSignatureSet,
@@ -115,6 +123,37 @@ async function validateExecutionPayloadEnvelope(
     });
   }
 
+  // [REJECT] The counts of `execution_requests` are within their respective limits.
+  // New in Gloas:EIP7688 — progressive lists are unbounded at the type level, so bounds
+  // are enforced here in gossip validation.
+  const {executionRequests} = envelope;
+  const requestCountLimits: [string, number, number][] = [
+    ["deposits", executionRequests.deposits.length, MAX_DEPOSIT_REQUESTS_PER_PAYLOAD],
+    ["withdrawals", executionRequests.withdrawals.length, MAX_WITHDRAWAL_REQUESTS_PER_PAYLOAD],
+    ["consolidations", executionRequests.consolidations.length, MAX_CONSOLIDATION_REQUESTS_PER_PAYLOAD],
+    ["builderDeposits", executionRequests.builderDeposits.length, MAX_BUILDER_DEPOSIT_REQUESTS_PER_PAYLOAD],
+    ["builderExits", executionRequests.builderExits.length, MAX_BUILDER_EXIT_REQUESTS_PER_PAYLOAD],
+  ];
+  for (const [name, count, limit] of requestCountLimits) {
+    if (count > limit) {
+      throw new ExecutionPayloadEnvelopeError(GossipAction.REJECT, {
+        code: ExecutionPayloadEnvelopeErrorCode.EXECUTION_REQUESTS_COUNT_EXCEEDED,
+        name,
+        count,
+        limit,
+      });
+    }
+  }
+
+  // [REJECT] The number of withdrawals is within the limit.
+  if (payload.withdrawals.length > MAX_WITHDRAWALS_PER_PAYLOAD) {
+    throw new ExecutionPayloadEnvelopeError(GossipAction.REJECT, {
+      code: ExecutionPayloadEnvelopeErrorCode.WITHDRAWALS_COUNT_EXCEEDED,
+      count: payload.withdrawals.length,
+      limit: MAX_WITHDRAWALS_PER_PAYLOAD,
+    });
+  }
+
   // Get the block state to verify the builder's signature.
   const blockState = await chain.regen
     .getState(block.stateRoot, RegenCaller.validateGossipPayloadEnvelope)

package/src/chain/validation/proposerPreferences.ts

@@ -32,8 +32,9 @@ export async function validateGossipProposerPreferences(
     });
   }
 
-  // [IGNORE] `preferences.proposal_slot` has not already passed.
-  const currentSlot = chain.clock.currentSlot;
+  // [IGNORE] `preferences.proposal_slot` has not already passed, i.e. `proposal_slot > current_slot`,
+  // allowing for `MAXIMUM_GOSSIP_CLOCK_DISPARITY`.
+  const currentSlot = chain.clock.currentSlotWithGossipDisparity;
   if (proposalSlot <= currentSlot) {
     throw new ProposerPreferencesError(GossipAction.IGNORE, {
       code: ProposerPreferencesErrorCode.PROPOSAL_SLOT_PASSED,
@@ -81,7 +82,7 @@ export async function validateGossipProposerPreferences(
   }
 
   // [IGNORE] First valid message for (dependent_root, proposal_slot, validator_index).
-  if (chain.seenProposerPreferences.isKnown(dependentRootHex, proposalSlot, validatorIndex)) {
+  if (chain.proposerPreferencesPool.isKnown(proposalSlot, dependentRootHex, validatorIndex)) {
     throw new ProposerPreferencesError(GossipAction.IGNORE, {
       code: ProposerPreferencesErrorCode.ALREADY_KNOWN,
       proposalSlot,
@@ -105,6 +106,15 @@ export async function validateGossipProposerPreferences(
     });
   }
 
-  // Valid
-  chain.seenProposerPreferences.add(dependentRootHex, proposalSlot, validatorIndex);
+  // Repeated check - deals with race-condition between preferences submissions
+  if (chain.proposerPreferencesPool.isKnown(proposalSlot, dependentRootHex, validatorIndex)) {
+    throw new ProposerPreferencesError(GossipAction.IGNORE, {
+      code: ProposerPreferencesErrorCode.ALREADY_KNOWN,
+      proposalSlot,
+      validatorIndex,
+      dependentRoot: dependentRootHex,
+    });
+  }
+
+  chain.proposerPreferencesPool.add(signedProposerPreferences);
 }

package/src/chain/validation/signatureSets/aggregateAndProof.ts

@@ -1,7 +1,7 @@
 import {BeaconConfig} from "@lodestar/config";
-import {DOMAIN_AGGREGATE_AND_PROOF, ForkSeq} from "@lodestar/params";
+import {DOMAIN_AGGREGATE_AND_PROOF} from "@lodestar/params";
 import {ISignatureSet, SignatureSetType, computeSigningRoot, computeStartSlotAtEpoch} from "@lodestar/state-transition";
-import {Epoch, SignedAggregateAndProof, ValidatorIndex, ssz} from "@lodestar/types";
+import {Epoch, SignedAggregateAndProof, ValidatorIndex} from "@lodestar/types";
 
 export function getAggregateAndProofSigningRoot(
   config: BeaconConfig,
@@ -14,7 +14,7 @@ export function getAggregateAndProofSigningRoot(
   const slot = computeStartSlotAtEpoch(epoch);
   const fork = config.getForkName(slot);
   const aggregatorDomain = config.getDomainAtFork(fork, DOMAIN_AGGREGATE_AND_PROOF);
-  const sszType = ForkSeq[fork] >= ForkSeq.electra ? ssz.electra.AggregateAndProof : ssz.phase0.AggregateAndProof;
+  const sszType = config.getForkTypes(slot).AggregateAndProof;
   return computeSigningRoot(sszType, aggregateAndProof.message, aggregatorDomain);
 }
 

package/src/db/repositories/lightclientSyncCommitteeWitness.ts

@@ -1,14 +1,16 @@
 import {ContainerType, VectorCompositeType} from "@chainsafe/ssz";
 import {ChainForkConfig} from "@lodestar/config";
 import {DatabaseController, Repository} from "@lodestar/db";
+import {CURRENT_SYNC_COMMITTEE_DEPTH_GLOAS, NEXT_SYNC_COMMITTEE_DEPTH_GLOAS} from "@lodestar/params";
 import {ssz} from "@lodestar/types";
 import {SyncCommitteeWitness} from "../../chain/lightClient/types.js";
 import {Bucket, getBucketNameByValue} from "../buckets.js";
 
-// We add a 1-byte prefix where 0 means pre-electra and 1 means post-electra
+// We add a 1-byte prefix where 0 means pre-Electra, 1 means post-Electra, and 2 means post-Gloas.
 enum PrefixByte {
   PRE_ELECTRA = 0,
   POST_ELECTRA = 1,
+  POST_GLOAS = 2,
 }
 
 export const NUM_WITNESS = 4;
@@ -35,6 +37,35 @@ export class SyncCommitteeWitnessRepository extends Repository<Uint8Array, SyncC
   // Overrides for multi-fork
   encodeValue(value: SyncCommitteeWitness): Uint8Array {
     const numWitness = value.witness.length;
+    const hasGloasBranches =
+      value.currentSyncCommitteeBranch !== undefined || value.nextSyncCommitteeBranch !== undefined;
+
+    if (hasGloasBranches) {
+      if (
+        value.currentSyncCommitteeBranch?.length !== CURRENT_SYNC_COMMITTEE_DEPTH_GLOAS ||
+        value.nextSyncCommitteeBranch?.length !== NEXT_SYNC_COMMITTEE_DEPTH_GLOAS
+      ) {
+        throw Error(
+          `Invalid post-Gloas sync committee branch lengths current=${value.currentSyncCommitteeBranch?.length} next=${value.nextSyncCommitteeBranch?.length}`
+        );
+      }
+
+      const type = new ContainerType({
+        currentSyncCommitteeBranch: new VectorCompositeType(ssz.Root, CURRENT_SYNC_COMMITTEE_DEPTH_GLOAS),
+        nextSyncCommitteeBranch: new VectorCompositeType(ssz.Root, NEXT_SYNC_COMMITTEE_DEPTH_GLOAS),
+        currentSyncCommitteeRoot: ssz.Root,
+        nextSyncCommitteeRoot: ssz.Root,
+      });
+
+      const valueBytes = type.serialize({
+        currentSyncCommitteeBranch: value.currentSyncCommitteeBranch,
+        nextSyncCommitteeBranch: value.nextSyncCommitteeBranch,
+        currentSyncCommitteeRoot: value.currentSyncCommitteeRoot,
+        nextSyncCommitteeRoot: value.nextSyncCommitteeRoot,
+      });
+
+      return prefixData(PrefixByte.POST_GLOAS, valueBytes);
+    }
 
     if (numWitness !== NUM_WITNESS && numWitness !== NUM_WITNESS_ELECTRA) {
       throw Error(`Number of witness can only be 4 pre-electra or 5 post-electra numWitness=${numWitness}`);
@@ -51,19 +82,25 @@ export class SyncCommitteeWitnessRepository extends Repository<Uint8Array, SyncC
     // We need to differentiate between post-electra and pre-electra witness
     // such that we can deserialize correctly
     const isPostElectra = numWitness === NUM_WITNESS_ELECTRA;
-    const prefixByte = new Uint8Array(1);
-    prefixByte[0] = isPostElectra ? PrefixByte.POST_ELECTRA : PrefixByte.PRE_ELECTRA;
-
-    const prefixedData = new Uint8Array(1 + valueBytes.length);
-    prefixedData.set(prefixByte, 0);
-    prefixedData.set(valueBytes, 1);
-
-    return prefixedData;
+    return prefixData(isPostElectra ? PrefixByte.POST_ELECTRA : PrefixByte.PRE_ELECTRA, valueBytes);
   }
 
   decodeValue(data: Uint8Array): SyncCommitteeWitness {
     // First byte is written
     const prefix = data.subarray(0, 1);
+    const isPostGloas = prefix[0] === PrefixByte.POST_GLOAS;
+
+    if (isPostGloas) {
+      const type = new ContainerType({
+        currentSyncCommitteeBranch: new VectorCompositeType(ssz.Root, CURRENT_SYNC_COMMITTEE_DEPTH_GLOAS),
+        nextSyncCommitteeBranch: new VectorCompositeType(ssz.Root, NEXT_SYNC_COMMITTEE_DEPTH_GLOAS),
+        currentSyncCommitteeRoot: ssz.Root,
+        nextSyncCommitteeRoot: ssz.Root,
+      });
+
+      return {witness: [], ...type.deserialize(data.subarray(1))};
+    }
+
     const isPostElectra = prefix[0] === PrefixByte.POST_ELECTRA;
 
     const type = new ContainerType({
@@ -75,3 +112,14 @@ export class SyncCommitteeWitnessRepository extends Repository<Uint8Array, SyncC
     return type.deserialize(data.subarray(1));
   }
 }
+
+function prefixData(prefix: PrefixByte, valueBytes: Uint8Array): Uint8Array {
+  const prefixByte = new Uint8Array(1);
+  prefixByte[0] = prefix;
+
+  const prefixedData = new Uint8Array(1 + valueBytes.length);
+  prefixedData.set(prefixByte, 0);
+  prefixedData.set(valueBytes, 1);
+
+  return prefixedData;
+}

package/src/execution/builder/http.ts

@@ -70,6 +70,33 @@ export class NoBidReceived extends Error {
   }
 }
 
+/**
+ * Beacon clients select randomized values from the following ranges when initializing
+ * the circuit breaker (so at boot time and once for each unique boot).
+ *
+ * ALLOWED_FAULTS: between 1 and SLOTS_PER_EPOCH // 4
+ * FAULT_INSPECTION_WINDOW: between SLOTS_PER_EPOCH and 2 * SLOTS_PER_EPOCH
+ *
+ * The values are randomized per node so builders cannot predict when a given proposer will
+ * fall back to local blocks. With fixed thresholds a builder could withhold payloads right up
+ * to the limit without ever tripping the breaker.
+ */
+export function getFaultInspectionParams(opts: {faultInspectionWindow?: number; allowedFaults?: number}): {
+  faultInspectionWindow: number;
+  allowedFaults: number;
+} {
+  const faultInspectionWindow = Math.max(
+    opts.faultInspectionWindow ?? SLOTS_PER_EPOCH + Math.floor(Math.random() * SLOTS_PER_EPOCH),
+    SLOTS_PER_EPOCH
+  );
+  // allowedFaults should be < faultInspectionWindow, limiting them to faultInspectionWindow/4
+  const allowedFaults = Math.min(
+    opts.allowedFaults ?? Math.floor(faultInspectionWindow / 4),
+    Math.floor(faultInspectionWindow / 4)
+  );
+  return {faultInspectionWindow, allowedFaults};
+}
+
 /**
  * Additional duration to account for potential event loop lag which causes
  * builder blocks to be rejected even though the response was sent in time.
@@ -122,23 +149,9 @@ export class ExecutionBuilderHttp implements IExecutionBuilder {
     this.registrations = new ValidatorRegistrationCache();
     this.issueLocalFcUWithFeeRecipient = opts.issueLocalFcUWithFeeRecipient;
 
-    /**
-     * Beacon clients select randomized values from the following ranges when initializing
-     * the circuit breaker (so at boot time and once for each unique boot).
-     *
-     * ALLOWED_FAULTS: between 1 and SLOTS_PER_EPOCH // 4
-     * FAULT_INSPECTION_WINDOW: between SLOTS_PER_EPOCH and 2 * SLOTS_PER_EPOCH
-     *
-     */
-    this.faultInspectionWindow = Math.max(
-      opts.faultInspectionWindow ?? SLOTS_PER_EPOCH + Math.floor(Math.random() * SLOTS_PER_EPOCH),
-      SLOTS_PER_EPOCH
-    );
-    // allowedFaults should be < faultInspectionWindow, limiting them to faultInspectionWindow/4
-    this.allowedFaults = Math.min(
-      opts.allowedFaults ?? Math.floor(this.faultInspectionWindow / 4),
-      Math.floor(this.faultInspectionWindow / 4)
-    );
+    const {faultInspectionWindow, allowedFaults} = getFaultInspectionParams(opts);
+    this.faultInspectionWindow = faultInspectionWindow;
+    this.allowedFaults = allowedFaults;
   }
 
   updateStatus(status: BuilderStatus): void {

package/src/metrics/metrics/beacon.ts

@@ -138,6 +138,25 @@ export function createBeaconMetrics(register: RegistryMetricCreator) {
       help: "Count of cached produced results",
     }),
 
+    builderCircuitBreaker: {
+      active: register.gauge({
+        name: "beacon_builder_circuit_breaker_active",
+        help: "Whether the builder circuit breaker is active (1) causing builder bids to be ignored",
+      }),
+      faults: register.gauge({
+        name: "beacon_builder_circuit_breaker_faults",
+        help: "Count of blocks with unrevealed payloads in the fault inspection window",
+      }),
+      blocksPresent: register.gauge({
+        name: "beacon_builder_circuit_breaker_blocks_present",
+        help: "Count of blocks present in the fault inspection window",
+      }),
+      payloadsRevealed: register.gauge({
+        name: "beacon_builder_circuit_breaker_payloads_revealed",
+        help: "Count of blocks with revealed payloads in the fault inspection window",
+      }),
+    },
+
     blockPayload: {
       payloadAdvancePrepTime: register.histogram({
         name: "beacon_block_payload_prepare_time",

package/src/network/core/metrics.ts

@@ -127,6 +127,100 @@ export function createNetworkCoreMetrics(register: RegistryMetricCreator) {
         name: "lodestar_peer_manager_starved_bool",
         help: "Whether lodestar is starved of data while syncing",
       }),
+      /**
+       * Core selection/pruning phase of the heartbeat, split out of heartbeatDuration so it
+       * can be attributed on its own. Divide by peersEvaluated for time-per-peer.
+       */
+      prioritizePeersDuration: register.histogram({
+        name: "lodestar_peer_manager_prioritize_peers_seconds",
+        help: "prioritizePeers function duration in seconds, the core peer selection/pruning algorithm",
+        buckets: [0.0005, 0.001, 0.005, 0.01, 0.05, 0.1],
+      }),
+      /**
+       * Score decay + map prune over every tracked peer, split out of heartbeatDuration.
+       * This loop iterates the whole score store, so divide by scoreMapSize (not
+       * peersEvaluated) for time-per-peer.
+       */
+      scoreUpdateDuration: register.histogram({
+        name: "lodestar_peer_score_update_seconds",
+        help: "Peer score store update (decay + prune over all peers) duration in seconds",
+        buckets: [0.0005, 0.001, 0.005, 0.01, 0.05, 0.1],
+      }),
+      /**
+       * Denominator for prioritizePeersDuration: it scales with the number of connected
+       * healthy peers, so time-per-peer (prioritizePeersDuration / this) is the comparable
+       * figure. For scoreUpdateDuration use scoreMapSize instead.
+       */
+      peersEvaluated: register.histogram({
+        name: "lodestar_peer_manager_peers_evaluated_count",
+        help: "Number of connected healthy peers evaluated by prioritizePeers per heartbeat, denominator for prioritize_peers_seconds",
+        buckets: [0, 25, 50, 75, 100, 150, 200],
+      }),
+      /**
+       * Every peer the manager intends to disconnect. Covers both the top-of-heartbeat
+       * bad-score disconnects ("banned"/"score_too_low") and the prioritization reasons;
+       * the older peersRequestedToDisconnect gauge only recorded the latter. Counts intent,
+       * not completion (goodbye is fire-and-forget).
+       */
+      peersPruned: register.counter<{reason: string}>({
+        name: "lodestar_peer_manager_peers_pruned_total",
+        help: "Total peers the peer manager intends to disconnect, labeled by reason (incl. bad-score and prioritization reasons)",
+        labelNames: ["reason"],
+      }),
+      /**
+       * Actual peer count per active subnet, to check the min-peers-per-subnet invariant.
+       * Buckets straddle the target (TARGET_SUBNET_PEERS = 6).
+       */
+      peersPerActiveSubnet: register.histogram<{type: SubnetType}>({
+        name: "lodestar_peer_manager_peers_per_active_subnet",
+        help: "Histogram of connected peer count per active subnet, labeled by subnet type",
+        labelNames: ["type"],
+        buckets: [0, 2, 4, 6, 8, 12],
+      }),
+      /**
+       * Live outbound ratio, to check the OUTBOUND_PEERS_RATIO (10%) invariant (issue #2215).
+       * Denominator is connected healthy peers (banned/disconnected already removed).
+       */
+      outboundPeersRatio: register.gauge({
+        name: "lodestar_peer_manager_outbound_peers_ratio",
+        help: "Ratio of outbound peers to total connected healthy peers, verifies the outbound peers invariant",
+      }),
+      /**
+       * Score state crossings (Healthy/Disconnected/Banned). Sensitive to the decay formula,
+       * thresholds, and gossip-score weighting.
+       */
+      scoreStateTransitions: register.counter<{from: string; to: string}>({
+        name: "lodestar_peer_score_state_transitions_total",
+        help: "Total peer score state transitions, labeled by from and to state (Healthy/Disconnected/Banned)",
+        labelNames: ["from", "to"],
+      }),
+      /**
+       * Entry count of the score store (not bytes). Reflects the prune-to-MAX_ENTRIES /
+       * SCORE_THRESHOLD retention logic. Also the denominator for scoreUpdateDuration
+       * time-per-peer (that loop iterates the whole store, not just connected peers).
+       */
+      scoreMapSize: register.gauge({
+        name: "lodestar_peer_manager_score_map_size",
+        help: "Current number of entries in the peer score store",
+      }),
+      /**
+       * Entry count of the connectedPeers map (not bytes). Should track libp2p_peers; a
+       * persistent gap indicates the connection leak guarded by leakedConnectionsCount.
+       */
+      connectedPeersMapSize: register.gauge({
+        name: "lodestar_peer_manager_connected_peers_map_size",
+        help: "Current number of entries in the peer manager connectedPeers map",
+      }),
+      /**
+       * assertPeerRelevance outcome per Status exchange: "relevant", an irrelevant reason
+       * code, or "error". Fires on every status evaluation (inbound requests and our own
+       * requestStatus responses both route through onStatus).
+       */
+      relevanceCheck: register.counter<{result: string}>({
+        name: "lodestar_peer_relevance_check_total",
+        help: "Total peer relevance checks on Status, labeled by result (relevant or irrelevant reason code)",
+        labelNames: ["result"],
+      }),
     },
     leakedConnectionsCount: register.gauge({
       name: "lodestar_peer_manager_leaked_connections_count",

package/src/network/discv5/utils.ts

@@ -13,9 +13,17 @@ export enum ENRRelevance {
 }
 
 export function enrRelevance(enr: ENR, config: BeaconConfig, clock: IClock): ENRRelevance {
-  // We are not interested in peers that don't advertise at least one transport (tcp or quic)
-  const multiaddrTCP = enr.getLocationMultiaddr(ENRKey.tcp);
-  const multiaddrQUIC = enr.getLocationMultiaddr(ENRKey.quic);
+  // We are not interested in peers that don't advertise at least one transport (tcp or quic).
+  let multiaddrTCP: ReturnType<ENR["getLocationMultiaddr"]>;
+  let multiaddrQUIC: ReturnType<ENR["getLocationMultiaddr"]>;
+  // Malformed ENR endpoint fields can make multiaddr conversion throw.
+  // Treat endpoints that cannot be converted as unusable.
+  try {
+    multiaddrTCP = enr.getLocationMultiaddr(ENRKey.tcp);
+    multiaddrQUIC = enr.getLocationMultiaddr(ENRKey.quic);
+  } catch {
+    return ENRRelevance.no_transport;
+  }
   if (!multiaddrTCP && !multiaddrQUIC) {
     return ENRRelevance.no_transport;
   }

package/src/network/gossip/encoding.ts

@@ -9,7 +9,7 @@ import {ForkName} from "@lodestar/params";
 import {intToBytes} from "@lodestar/utils";
 import {MESSAGE_DOMAIN_VALID_SNAPPY} from "./constants.js";
 import {Eth2GossipsubMetrics} from "./metrics.js";
-import {GossipTopicCache, getGossipSSZType} from "./topic.js";
+import {GossipTopicCache, getGossipSSZMaxSize, getGossipSSZType} from "./topic.js";
 
 // Load WASM
 const xxhash = await xxhashFactory();
@@ -52,6 +52,13 @@ export function fastMsgIdFn(rpcMsg: RPC.Message): string {
 }
 
 export function msgIdToStrFn(msgId: Uint8Array): string {
+  // Spec mandates a 20-byte gossipsub message-id, but control-message IDs from peers
+  // can be any length. Reject non-20-byte IDs to avoid a Buffer.set() RangeError on
+  // longer IDs and stale shared-buffer bytes on shorter ones.
+  // Ref: https://github.com/ethereum/consensus-specs/blob/v1.7.0-alpha.10/specs/phase0/p2p-interface.md?plain=1#L486
+  if (msgId.length !== 20) {
+    throw Error(`Expect msgId to be 20 bytes, got ${msgId.length}`);
+  }
   // this is the same logic to `toHex(msgId)` with better performance
   sharedMsgIdBuf.set(msgId);
   return `0x${sharedMsgIdBuf.toString("hex")}`;
@@ -91,7 +98,7 @@ export function msgIdFn(gossipTopicCache: GossipTopicCache, msg: Message): Uint8
 export class DataTransformSnappy implements DataTransform {
   constructor(
     private readonly gossipTopicCache: GossipTopicCache,
-    private readonly maxSizePerMessage: number,
+    private readonly maxPayloadSize: number,
     private readonly metrics: Eth2GossipsubMetrics | null
   ) {}
 
@@ -104,17 +111,18 @@ export class DataTransformSnappy implements DataTransform {
   inboundTransform(topicStr: string, data: Uint8Array): Uint8Array {
     // check uncompressed data length before we actually decompress
     const uncompressedDataLength = snappyWasm.decompress_len(data);
-    if (uncompressedDataLength > this.maxSizePerMessage) {
-      throw Error(`ssz_snappy decoded data length ${uncompressedDataLength} > ${this.maxSizePerMessage}`);
-    }
 
     const topic = this.gossipTopicCache.getTopic(topicStr);
     const sszType = getGossipSSZType(topic);
+    const maxSize = getGossipSSZMaxSize(topic, this.maxPayloadSize, sszType);
     this.metrics?.dataTransform.inbound.inc({type: topic.type});
 
     if (uncompressedDataLength < sszType.minSize) {
       throw Error(`ssz_snappy decoded data length ${uncompressedDataLength} < ${sszType.minSize}`);
     }
+    if (uncompressedDataLength > maxSize) {
+      throw Error(`ssz_snappy decoded data length ${uncompressedDataLength} > ${maxSize}`);
+    }
     if (uncompressedDataLength > sszType.maxSize) {
       throw Error(`ssz_snappy decoded data length ${uncompressedDataLength} > ${sszType.maxSize}`);
     }
@@ -132,9 +140,14 @@ export class DataTransformSnappy implements DataTransform {
    */
   outboundTransform(topicStr: string, data: Uint8Array): Uint8Array {
     const topic = this.gossipTopicCache.getTopic(topicStr);
+    const sszType = getGossipSSZType(topic);
+    const maxSize = getGossipSSZMaxSize(topic, this.maxPayloadSize, sszType);
     this.metrics?.dataTransform.outbound.inc({type: topic.type});
-    if (data.length > this.maxSizePerMessage) {
-      throw Error(`ssz_snappy encoded data length ${data.length} > ${this.maxSizePerMessage}`);
+    if (data.length > maxSize) {
+      throw Error(`ssz_snappy encoded data length ${data.length} > ${maxSize}`);
+    }
+    if (data.length > sszType.maxSize) {
+      throw Error(`ssz_snappy encoded data length ${data.length} > ${sszType.maxSize}`);
     }
 
     // Using Buffer.alloc() instead of Buffer.allocUnsafe() to mitigate high GC pressure observed in some environments