@lodestar/beacon-node 1.46.0-dev.2063820a22 → 1.46.0-dev.3d8f7cf440

package/src/chain/seenCache/seenBlockProposers.ts

@@ -1,21 +1,57 @@
 import {computeStartSlotAtEpoch} from "@lodestar/state-transition";
-import {Epoch, Slot, ValidatorIndex} from "@lodestar/types";
+import {Epoch, RootHex, Slot, ValidatorIndex} from "@lodestar/types";
 import {MapDef} from "@lodestar/utils";
 
+/** Two distinct block roots signed by the same proposer for the same slot are sufficient to establish an equivocation */
+const MAX_BLOCK_ROOTS_PER_PROPOSAL = 2;
+
 /**
  * Keeps a cache to filter block proposals from the same validator in the same slot.
  *
- * This cache is not bounded and for extremely long periods of non-finality it can grow a lot. However it's practically
- * limited by the possible shufflings in those epochs, and the stored data is very cheap
+ * Block roots with a signature verified against the block's proposer index are tracked separately from proposals
+ * accepted by gossip validation or block import. A root from a block signed by its declared proposer is potential
+ * equivocation evidence, but the block may still fail other validation. Such a block must not mark the proposal as
+ * known, since that would cause a later valid block for the same slot and proposer to be ignored as a repeat proposal.
+ *
+ * The cache is pruned on finalization and bounds the number of roots stored per proposer and slot
  */
 export class SeenBlockProposers {
   private readonly proposerIndexesBySlot = new MapDef<Slot, Set<ValidatorIndex>>(() => new Set<ValidatorIndex>());
-  private finalizedSlot: Epoch = 0;
+  private readonly blockRootsBySlot = new MapDef<Slot, MapDef<ValidatorIndex, Set<RootHex>>>(
+    () => new MapDef<ValidatorIndex, Set<RootHex>>(() => new Set<RootHex>())
+  );
+  private finalizedSlot: Slot = 0;
 
   isKnown(blockSlot: Slot, proposerIndex: ValidatorIndex): boolean {
     return this.proposerIndexesBySlot.get(blockSlot)?.has(proposerIndex) === true;
   }
 
+  hasBlockRoot(blockSlot: Slot, proposerIndex: ValidatorIndex, blockRoot: RootHex): boolean {
+    return this.blockRootsBySlot.get(blockSlot)?.get(proposerIndex)?.has(blockRoot) === true;
+  }
+
+  isEquivocating(blockSlot: Slot, proposerIndex: ValidatorIndex): boolean {
+    return (this.blockRootsBySlot.get(blockSlot)?.get(proposerIndex)?.size ?? 0) >= MAX_BLOCK_ROOTS_PER_PROPOSAL;
+  }
+
+  getConflictingBlockRoots(blockSlot: Slot, proposerIndex: ValidatorIndex, blockRoot: RootHex): RootHex[] {
+    const roots = this.blockRootsBySlot.get(blockSlot)?.get(proposerIndex);
+    return roots === undefined ? [] : Array.from(roots).filter((root) => root !== blockRoot);
+  }
+
+  /** Record a block only after its proposer signature has been verified */
+  observeBlockRoot(blockSlot: Slot, proposerIndex: ValidatorIndex, blockRoot: RootHex): void {
+    if (blockSlot < this.finalizedSlot) {
+      throw Error(`blockSlot ${blockSlot} < finalizedSlot ${this.finalizedSlot}`);
+    }
+
+    const blockRoots = this.blockRootsBySlot.getOrDefault(blockSlot).getOrDefault(proposerIndex);
+    if (blockRoots.size < MAX_BLOCK_ROOTS_PER_PROPOSAL) {
+      blockRoots.add(blockRoot);
+    }
+  }
+
+  /** Mark a block as known from gossip or another block import path */
   add(blockSlot: Slot, proposerIndex: ValidatorIndex): void {
     if (blockSlot < this.finalizedSlot) {
       throw Error(`blockSlot ${blockSlot} < finalizedSlot ${this.finalizedSlot}`);
@@ -31,9 +67,14 @@ export class SeenBlockProposers {
         this.proposerIndexesBySlot.delete(slot);
       }
     }
+    for (const slot of this.blockRootsBySlot.keys()) {
+      if (slot < finalizedSlot) {
+        this.blockRootsBySlot.delete(slot);
+      }
+    }
   }
 
-  seenAtEpoch(epoch: Slot, index: ValidatorIndex): boolean {
+  seenAtEpoch(epoch: Epoch, index: ValidatorIndex): boolean {
     const fromSlot = computeStartSlotAtEpoch(epoch);
     const toSlot = computeStartSlotAtEpoch(epoch + 1);
 

package/src/chain/validation/block.ts

@@ -24,7 +24,7 @@ import {
   isExecutionBlockBodyType,
   isStatePostBellatrix,
 } from "@lodestar/state-transition";
-import {SignedBeaconBlock, deneb, gloas, isGloasBeaconBlock} from "@lodestar/types";
+import {RootHex, SignedBeaconBlock, deneb, gloas, isGloasBeaconBlock} from "@lodestar/types";
 import {byteArrayEquals, sleep, toRootHex} from "@lodestar/utils";
 import {BlockErrorCode, BlockGossipError, GossipAction} from "../errors/index.js";
 import {IBeaconChain} from "../interface.js";
@@ -85,7 +85,12 @@ export async function validateGossipBlock(
 
   // [IGNORE] The block is the first block with valid signature received for the proposer for the slot, signed_beacon_block.message.slot.
   const proposerIndex = block.proposerIndex;
+  const hasBlockRoot = chain.seenBlockProposers.hasBlockRoot(blockSlot, proposerIndex, blockRoot);
   if (chain.seenBlockProposers.isKnown(blockSlot, proposerIndex)) {
+    if (!hasBlockRoot && !chain.seenBlockProposers.isEquivocating(blockSlot, proposerIndex)) {
+      await verifyBlockProposerSignature(chain, signedBlock, blockRoot, {verifyOnMainThread: false});
+      chain.seenBlockProposers.observeBlockRoot(blockSlot, proposerIndex, blockRoot);
+    }
     throw new BlockGossipError(GossipAction.IGNORE, {code: BlockErrorCode.REPEAT_PROPOSAL, proposerIndex});
   }
 
@@ -270,18 +275,8 @@ export async function validateGossipBlock(
   }
 
   // [REJECT] The proposer signature, signed_beacon_block.signature, is valid with respect to the proposer_index pubkey.
-  if (!chain.seenBlockInputCache.isVerifiedProposerSignature(blockSlot, blockRoot, signedBlock.signature)) {
-    const signatureSet = getBlockProposerSignatureSet(chain.config, signedBlock);
-    // Don't batch so verification is not delayed
-    if (!(await chain.bls.verifySignatureSets([signatureSet], {verifyOnMainThread: true}))) {
-      throw new BlockGossipError(GossipAction.REJECT, {
-        code: BlockErrorCode.PROPOSAL_SIGNATURE_INVALID,
-        blockSlot,
-      });
-    }
-
-    chain.seenBlockInputCache.markVerifiedProposerSignature(blockSlot, blockRoot, signedBlock.signature);
-  }
+  await verifyBlockProposerSignature(chain, signedBlock, blockRoot);
+  chain.seenBlockProposers.observeBlockRoot(blockSlot, proposerIndex, blockRoot);
 
   // [REJECT] The block is proposed by the expected proposer_index for the block's slot in the context of the current
   // shuffling (defined by parent_root/slot). If the proposer_index cannot immediately be verified against the expected
@@ -291,11 +286,6 @@ export async function validateGossipBlock(
     throw new BlockGossipError(GossipAction.REJECT, {code: BlockErrorCode.INCORRECT_PROPOSER, proposerIndex});
   }
 
-  // Check again in case there two blocks are processed concurrently
-  if (chain.seenBlockProposers.isKnown(blockSlot, proposerIndex)) {
-    throw new BlockGossipError(GossipAction.IGNORE, {code: BlockErrorCode.REPEAT_PROPOSAL, proposerIndex});
-  }
-
   // Simple implementation of a pending block queue. Keeping the block here recycles the queue logic, and keeps the
   // gossip validation promise without any extra infrastructure.
   // Do the sleep at the end, since regen and signature validation can already take longer than `msToBlockSlot`.
@@ -305,7 +295,35 @@ export async function validateGossipBlock(
     await sleep(msToBlockSlot);
   }
 
+  // Check again after all async validation and the early-block delay so concurrent proposals cannot both pass
+  if (chain.seenBlockProposers.isKnown(blockSlot, proposerIndex)) {
+    throw new BlockGossipError(GossipAction.IGNORE, {code: BlockErrorCode.REPEAT_PROPOSAL, proposerIndex});
+  }
+
   chain.seenBlockProposers.add(blockSlot, proposerIndex);
 
   return {skippedSlots};
 }
+
+export async function verifyBlockProposerSignature(
+  chain: IBeaconChain,
+  signedBlock: SignedBeaconBlock,
+  blockRoot: RootHex,
+  opts: {verifyOnMainThread?: boolean} = {}
+): Promise<void> {
+  const blockSlot = signedBlock.message.slot;
+  if (chain.seenBlockInputCache.isVerifiedProposerSignature(blockSlot, blockRoot, signedBlock.signature)) {
+    return;
+  }
+
+  const signatureSet = getBlockProposerSignatureSet(chain.config, signedBlock);
+  // Don't batch so verification is not delayed
+  if (!(await chain.bls.verifySignatureSets([signatureSet], {verifyOnMainThread: opts.verifyOnMainThread ?? true}))) {
+    throw new BlockGossipError(GossipAction.REJECT, {
+      code: BlockErrorCode.PROPOSAL_SIGNATURE_INVALID,
+      blockSlot,
+    });
+  }
+
+  chain.seenBlockInputCache.markVerifiedProposerSignature(blockSlot, blockRoot, signedBlock.signature);
+}

package/src/chain/validation/dataColumnSidecar.ts

@@ -2,15 +2,16 @@ import {ChainConfig, ChainForkConfig} from "@lodestar/config";
 import {
   KZG_COMMITMENTS_INCLUSION_PROOF_DEPTH,
   KZG_COMMITMENTS_SUBTREE_INDEX,
+  MIN_SEED_LOOKAHEAD,
   NUMBER_OF_COLUMNS,
+  isForkPostFulu,
 } from "@lodestar/params";
 import {
   computeEpochAtSlot,
   computeStartSlotAtEpoch,
   getBlockHeaderProposerSignatureSetByHeaderSlot,
-  getBlockHeaderProposerSignatureSetByParentStateSlot,
 } from "@lodestar/state-transition";
-import {DataColumnSidecar, Root, Slot, SubnetID, fulu, gloas, ssz} from "@lodestar/types";
+import {DataColumnSidecar, Root, Slot, SubnetID, ValidatorIndex, fulu, gloas, ssz} from "@lodestar/types";
 import {byteArrayEquals, toRootHex, verifyMerkleBranch} from "@lodestar/utils";
 import {BeaconMetrics} from "../../metrics/metrics/beacon.js";
 import {Metrics} from "../../metrics/metrics.js";
@@ -104,19 +105,23 @@ export async function validateGossipFuluDataColumnSidecar(
     });
   }
 
-  // getBlockSlotState also checks for whether the current finalized checkpoint is an ancestor of the block.
-  // As a result, we throw an IGNORE (whereas the spec says we should REJECT for this scenario).
-  // this is something we should change this in the future to make the code airtight to the spec.
   // 7) [REJECT] The sidecar's block's parent passes validation.
-  const blockState = await chain.regen
-    .getBlockSlotState(parentBlock, blockHeader.slot, {dontTransferCache: true}, RegenCaller.validateGossipDataColumn)
-    .catch(() => {
-      throw new DataColumnSidecarGossipError(GossipAction.IGNORE, {
-        code: DataColumnSidecarErrorCode.PARENT_UNKNOWN,
-        parentRoot,
-        slot: blockHeader.slot,
-      });
-    });
+  // Post-fulu, we can use parent state to get expected proposer index thanks to proposer lookahead
+  const parentEpoch = computeEpochAtSlot(parentBlock.slot);
+  const blockEpoch = computeEpochAtSlot(blockHeader.slot);
+  const getProposerIndex = async (): Promise<ValidatorIndex> => {
+    if (isForkPostFulu(chain.config.getForkName(parentBlock.slot)) && blockEpoch - parentEpoch <= MIN_SEED_LOOKAHEAD) {
+      const parentState = await chain.regen.getState(parentBlock.stateRoot, RegenCaller.validateGossipDataColumn);
+      return parentState.getBeaconProposer(blockHeader.slot);
+    }
+    const blockState = await chain.regen.getBlockSlotState(
+      parentBlock,
+      blockHeader.slot,
+      {dontTransferCache: true},
+      RegenCaller.validateGossipDataColumn
+    );
+    return blockState.getBeaconProposer(blockHeader.slot);
+  };
 
   // 13) [REJECT] The sidecar is proposed by the expected proposer_index for the block's slot in the context of the current
   //              shuffling (defined by block_header.parent_root/block_header.slot). If the proposer_index cannot
@@ -124,7 +129,13 @@ export async function validateGossipFuluDataColumnSidecar(
   //              while proposers for the block's branch are calculated -- in such a case do not REJECT, instead IGNORE
   //              this message.
   const proposerIndex = blockHeader.proposerIndex;
-  const expectedProposerIndex = blockState.getBeaconProposer(blockHeader.slot);
+  const expectedProposerIndex = await getProposerIndex().catch(() => {
+    throw new DataColumnSidecarGossipError(GossipAction.IGNORE, {
+      code: DataColumnSidecarErrorCode.PARENT_UNKNOWN,
+      parentRoot,
+      slot: blockHeader.slot,
+    });
+  });
 
   if (proposerIndex !== expectedProposerIndex) {
     throw new DataColumnSidecarGossipError(GossipAction.REJECT, {
@@ -137,9 +148,8 @@ export async function validateGossipFuluDataColumnSidecar(
   // 5) [REJECT] The proposer signature of sidecar.signed_block_header, is valid with respect to the block_header.proposer_index pubkey.
   const signature = dataColumnSidecar.signedBlockHeader.signature;
   if (!chain.seenBlockInputCache.isVerifiedProposerSignature(blockHeader.slot, blockRootHex, signature)) {
-    const signatureSet = getBlockHeaderProposerSignatureSetByParentStateSlot(
+    const signatureSet = getBlockHeaderProposerSignatureSetByHeaderSlot(
       chain.config,
-      blockState.slot,
       dataColumnSidecar.signedBlockHeader
     );
 

package/src/chain/validation/executionPayloadBid.ts

@@ -7,6 +7,7 @@ import {
   getExecutionPayloadBidSigningRoot,
   isActiveBuilder,
   isGasLimitTargetCompatible,
+  isStartSlotOfEpoch,
   isStatePostGloas,
 } from "@lodestar/state-transition";
 import {RootHex, Slot, ValidatorIndex, gloas} from "@lodestar/types";
@@ -46,8 +47,8 @@ function getMinBidValue(currentHighestBid: number): number {
 /**
  * Check whether a bid builds on one of the paths compatible with the local head branch.
  *
- * The direct parent path is always allowed for proposer-boost reorgs. Otherwise the bid
- * must build on the local head's full or empty payload variant, as selected for its slot.
+ * Building directly on the parent is allowed for proposer-boost reorgs outside epoch boundaries.
+ * Otherwise the bid must build on the local head's full or empty payload variant, as selected for its slot.
  */
 function isBidCompatibleWithHead(
   forkChoice: IForkChoice,
@@ -60,7 +61,9 @@ function isBidCompatibleWithHead(
   const buildsOnParentPayload = bidParentBlockHash === head.parentBlockHash;
 
   if (buildsOnParentBlock && buildsOnParentPayload) {
-    return true;
+    // The spec allows this at epoch boundaries, but Lodestar does not propagate these bids because validating
+    // them requires an epoch transition for a parent state that cannot be used for proposer-boost reorgs.
+    return !isStartSlotOfEpoch(bidSlot);
   }
 
   if (bidParentBlockRoot !== head.blockRoot) {
@@ -343,7 +346,7 @@ async function validateExecutionPayloadBid(
   // [REJECT] `signed_execution_payload_bid.signature` is valid with respect to the `bid.builder_index`.
   const signatureSet = createSingleSignatureSetFromComponents(
     PublicKey.fromBytes(builder.pubkey),
-    getExecutionPayloadBidSigningRoot(chain.config, state.slot, bid),
+    getExecutionPayloadBidSigningRoot(chain.config, bid),
     signedExecutionPayloadBid.signature
   );
 

package/src/metrics/metrics/lodestar.ts

@@ -424,7 +424,7 @@ export function createLodestarMetrics(
       jobWaitTime: register.histogram({
         name: "lodestar_bls_thread_pool_queue_job_wait_time_seconds",
         help: "Time from job added to the queue to starting the job in seconds",
-        buckets: [0.01, 0.02, 0.5, 0.1, 0.3, 1],
+        buckets: [0.01, 0.02, 0.1, 0.3, 0.5, 1],
       }),
       queueLength: register.gauge({
         name: "lodestar_bls_thread_pool_queue_length",
@@ -1708,6 +1708,41 @@ export function createLodestarMetrics(
       }),
     },
 
+    // Pre-verify builder-deposit signatures in the epochs before the Gloas fork (prepareNextSlot).
+    builderDepositPreVerify: {
+      duration: register.histogram({
+        name: "lodestar_builder_deposit_preverify_duration_seconds",
+        help: "Duration of one preVerifyBuilderDepositsPreGloas call (BLS batch verify + scan)",
+        buckets: [1, 2, 3, 4],
+      }),
+      pendingDeposits: register.gauge({
+        name: "lodestar_builder_deposit_preverify_pending_deposits",
+        help: "Current state.pendingDeposits length (backlog to drain before the fork)",
+      }),
+      cachedDeposits: register.gauge({
+        name: "lodestar_builder_deposit_preverify_cached_deposits",
+        help: "Deposit signatures verified & cached so far this pre-fork window (valid + invalid)",
+      }),
+      scannedDeposits: register.gauge({
+        name: "lodestar_builder_deposit_preverify_scanned_deposits",
+        help: "Pending deposits examined by the last pre-verify call (< pending_deposits ⇒ cap hit)",
+      }),
+      builderPubkeys: register.gauge({
+        name: "lodestar_builder_deposit_preverify_builder_pubkeys",
+        help: "Distinct builder pubkeys tracked this window (validator deposits for these are pre-verified)",
+      }),
+      validSignatures: register.counter<{type: "builder" | "validator"}>({
+        name: "lodestar_builder_deposit_preverify_valid_signatures_total",
+        help: "Cumulative deposit signatures whose BLS verification passed (VALID), by credential type",
+        labelNames: ["type"],
+      }),
+      invalidSignatures: register.counter<{type: "builder" | "validator"}>({
+        name: "lodestar_builder_deposit_preverify_invalid_signatures_total",
+        help: "Cumulative deposit signatures whose BLS verification failed (INVALID), by credential type",
+        labelNames: ["type"],
+      }),
+    },
+
     // reprocess attestations
     reprocessApiAttestations: {
       total: register.gauge({

package/src/network/gossip/topic.ts

@@ -8,11 +8,13 @@ import {
   MAX_DATA_COLUMN_SIDECAR_SIZE,
   MAX_SIGNED_AGGREGATE_AND_PROOF_SIZE,
   MAX_SIGNED_EXECUTION_PAYLOAD_BID_SIZE,
+  MAX_SIGNED_EXECUTION_PAYLOAD_BID_SIZE_HEZE,
   SYNC_COMMITTEE_SUBNET_COUNT,
   isForkPostAltair,
   isForkPostElectra,
   isForkPostFulu,
   isForkPostGloas,
+  isForkPostHeze,
 } from "@lodestar/params";
 import {Attestation, SingleAttestation, ssz, sszTypesFor} from "@lodestar/types";
 import {GossipAction, GossipActionError, GossipErrorCode} from "../../chain/errors/gossipValidation.js";
@@ -130,7 +132,7 @@ export function getGossipSSZType(topic: GossipTopic) {
     case GossipType.payload_attestation_message:
       return ssz.gloas.PayloadAttestationMessage;
     case GossipType.execution_payload_bid:
-      return ssz.gloas.SignedExecutionPayloadBid;
+      return isForkPostGloas(fork) ? sszTypesFor(fork).SignedExecutionPayloadBid : ssz.gloas.SignedExecutionPayloadBid;
     case GossipType.proposer_preferences:
       return ssz.gloas.SignedProposerPreferences;
   }
@@ -154,7 +156,7 @@ export function getGossipSSZMaxSize(topic: GossipTopic, maxPayloadSize: number,
     case GossipType.execution_payload:
       return maxPayloadSize;
     case GossipType.execution_payload_bid:
-      return MAX_SIGNED_EXECUTION_PAYLOAD_BID_SIZE;
+      return isForkPostHeze(fork) ? MAX_SIGNED_EXECUTION_PAYLOAD_BID_SIZE_HEZE : MAX_SIGNED_EXECUTION_PAYLOAD_BID_SIZE;
     default:
       return (sszType ?? getGossipSSZType(topic)).maxSize;
   }

package/src/network/reqresp/handlers/lightClientFinalityUpdate.ts

@@ -12,7 +12,7 @@ export async function* onLightClientFinalityUpdate(chain: IBeaconChain): AsyncIt
     throw new ResponseError(RespStatus.RESOURCE_UNAVAILABLE, "No latest finality update available");
   }
 
-  const boundary = chain.config.getForkBoundaryAtEpoch(computeEpochAtSlot(update.signatureSlot));
+  const boundary = chain.config.getForkBoundaryAtEpoch(computeEpochAtSlot(update.attestedHeader.beacon.slot));
   const type = responseSszTypeByMethod[ReqRespMethod.LightClientFinalityUpdate](boundary.fork, 0);
   yield {
     data: type.serialize(update),

package/src/network/reqresp/handlers/lightClientOptimisticUpdate.ts

@@ -12,7 +12,7 @@ export async function* onLightClientOptimisticUpdate(chain: IBeaconChain): Async
     throw new ResponseError(RespStatus.RESOURCE_UNAVAILABLE, "No latest optimistic update available");
   }
 
-  const boundary = chain.config.getForkBoundaryAtEpoch(computeEpochAtSlot(update.signatureSlot));
+  const boundary = chain.config.getForkBoundaryAtEpoch(computeEpochAtSlot(update.attestedHeader.beacon.slot));
   const type = responseSszTypeByMethod[ReqRespMethod.LightClientOptimisticUpdate](boundary.fork, 0);
   yield {
     data: type.serialize(update),

package/src/network/reqresp/handlers/lightClientUpdatesByRange.ts

@@ -27,7 +27,7 @@ export async function* onLightClientUpdatesByRange(
     const period = requestBody.startPeriod + i;
     try {
       const update = await chain.lightClientServer.getUpdate(period);
-      const boundary = chain.config.getForkBoundaryAtEpoch(computeEpochAtSlot(update.signatureSlot));
+      const boundary = chain.config.getForkBoundaryAtEpoch(computeEpochAtSlot(update.attestedHeader.beacon.slot));
       const type = responseSszTypeByMethod[ReqRespMethod.LightClientUpdatesByRange](boundary.fork, 0);
 
       yield {

package/src/network/reqresp/protocols.ts

@@ -1,6 +1,6 @@
 import {BeaconConfig} from "@lodestar/config";
-import {ForkName} from "@lodestar/params";
-import {ContextBytesFactory, ContextBytesType, Encoding} from "@lodestar/reqresp";
+import {ForkName, MAX_DATA_COLUMN_SIDECAR_SIZE, isForkPostGloas} from "@lodestar/params";
+import {ContextBytesFactory, ContextBytesType, Encoding, TypeSizes} from "@lodestar/reqresp";
 import {rateLimitQuotas} from "./rateLimit.js";
 import {ProtocolNoHandler, ReqRespMethod, Version, requestSszTypeByMethod, responseSszTypeByMethod} from "./types.js";
 
@@ -143,15 +143,43 @@ type ProtocolSummary = {
 };
 
 function toProtocol(protocol: ProtocolSummary) {
-  return (fork: ForkName, config: BeaconConfig): ProtocolNoHandler => ({
-    method: protocol.method,
-    version: protocol.version,
-    encoding: Encoding.SSZ_SNAPPY,
-    contextBytes: toContextBytes(protocol.contextBytesType, config),
-    inboundRateLimits: rateLimitQuotas(fork, config)[protocol.method],
-    requestSizes: requestSszTypeByMethod(fork, config)[protocol.method],
-    responseSizes: (fork) => responseSszTypeByMethod[protocol.method](fork, protocol.version),
-  });
+  return (fork: ForkName, config: BeaconConfig): ProtocolNoHandler => {
+    const requestType = requestSszTypeByMethod(fork, config)[protocol.method];
+    return {
+      method: protocol.method,
+      version: protocol.version,
+      encoding: Encoding.SSZ_SNAPPY,
+      contextBytes: toContextBytes(protocol.contextBytesType, config),
+      inboundRateLimits: rateLimitQuotas(fork, config)[protocol.method],
+      requestSizes: requestType === null ? null : clampTypeSizes(requestType, protocol.method, fork, config),
+      responseSizes: (fork) =>
+        clampTypeSizes(responseSszTypeByMethod[protocol.method](fork, protocol.version), protocol.method, fork, config),
+    };
+  };
+}
+
+/**
+ * Bound the sizes accepted from the ssz-snappy length-prefix. Gloas progressive containers have broad
+ * theoretical SSZ max sizes so the preset p2p bounds must be used instead.
+ *
+ * The length-prefix must be within the size bounds derived from the payload SSZ type or `MAX_PAYLOAD_SIZE`,
+ * whichever is smaller, see
+ * https://github.com/ethereum/consensus-specs/blob/v1.7.0-alpha.12/specs/phase0/p2p-interface.md#encoding-strategies.
+ * Type-specific SSZ bounds supersede the bounds derived from the SSZ type, see
+ * https://github.com/ethereum/consensus-specs/blob/v1.7.0-alpha.12/specs/gloas/p2p-interface.md#type-specific-ssz-bounds.
+ */
+function clampTypeSizes(type: TypeSizes, method: ReqRespMethod, fork: ForkName, config: BeaconConfig): TypeSizes {
+  let typeSpecificBound = config.MAX_PAYLOAD_SIZE;
+  if (isForkPostGloas(fork)) {
+    switch (method) {
+      case ReqRespMethod.DataColumnSidecarsByRange:
+      case ReqRespMethod.DataColumnSidecarsByRoot:
+        typeSpecificBound = MAX_DATA_COLUMN_SIDECAR_SIZE;
+        break;
+    }
+  }
+
+  return {minSize: type.minSize, maxSize: Math.min(type.maxSize, typeSpecificBound)};
 }
 
 function toContextBytes(type: ContextBytesType, config: BeaconConfig): ContextBytesFactory {

package/src/network/reqresp/rateLimit.ts

@@ -87,7 +87,7 @@ export const rateLimitQuotas: (fork: ForkName, config: BeaconConfig) => Record<R
     ),
   },
   [ReqRespMethod.ExecutionPayloadEnvelopesByRange]: {
-    byPeer: {quota: config.MAX_REQUEST_BLOCKS_DENEB, quotaTimeMs: 10_000},
+    byPeer: {quota: config.MAX_REQUEST_PAYLOADS, quotaTimeMs: 10_000},
     getRequestCount: getRequestCountFn(
       fork,
       config,

package/src/network/reqresp/score.ts

@@ -33,9 +33,28 @@ export function onOutgoingReqRespError(e: RequestError, method: ReqRespMethod):
 
     case RequestErrorCode.DIAL_TIMEOUT:
     case RequestErrorCode.DIAL_ERROR:
-      return e.message.includes(multiStreamSelectErrorCodes.protocolSelectionFailed) && method === ReqRespMethod.Ping
-        ? PeerAction.Fatal
-        : PeerAction.LowToleranceError;
+      // `RequestError` renders `e.message` as just the error code (see `renderErrorMessage`), so the
+      // multistream "protocol selection failed" text is only on the wrapped inner error, which is
+      // available on `DIAL_ERROR` via `e.type.error` (`DIAL_TIMEOUT` carries no inner error).
+      if (
+        e.type.code === RequestErrorCode.DIAL_ERROR &&
+        e.type.error.message.includes(multiStreamSelectErrorCodes.protocolSelectionFailed)
+      ) {
+        // Peer does not support the protocol, a real incompatibility rather than a transient
+        // failure, so keep the stronger penalty (Fatal for Ping, as before).
+        return method === ReqRespMethod.Ping ? PeerAction.Fatal : PeerAction.LowToleranceError;
+      }
+      switch (method) {
+        // Ping and Status are liveness probes; their dial timeouts are dominated by transient
+        // network congestion rather than peer misbehavior, so penalize leniently to avoid
+        // self-inflicted peer starvation (https://github.com/ChainSafe/lodestar/issues/9562),
+        // while still applying some penalty so genuinely dead peers eventually free the slot.
+        case ReqRespMethod.Ping:
+        case ReqRespMethod.Status:
+          return PeerAction.HighToleranceError;
+        default:
+          return PeerAction.LowToleranceError;
+      }
     // TODO: Detect SSZDecodeError and return PeerAction.Fatal
 
     case RequestErrorCode.RESP_TIMEOUT:

package/src/sync/range/batch.ts

@@ -5,6 +5,7 @@ import {LodestarError, byteArrayEquals, prettyPrintIndices, toRootHex} from "@lo
 import {isBlockInputColumns} from "../../chain/blocks/blockInput/blockInput.js";
 import {IBlockInput} from "../../chain/blocks/blockInput/types.js";
 import {isDaOutOfRange} from "../../chain/blocks/blockInput/utils.js";
+import {PayloadError, PayloadErrorCode} from "../../chain/blocks/importExecutionPayload.js";
 import {PayloadEnvelopeInput} from "../../chain/blocks/payloadEnvelopeInput/payloadEnvelopeInput.js";
 import {BlockError, BlockErrorCode} from "../../chain/errors/index.js";
 import {ZERO_HASH} from "../../constants/constants.js";
@@ -702,7 +703,7 @@ export class Batch {
       throw new BatchError(this.wrongStatusErrorType(BatchStatus.Processing));
     }
 
-    if (err instanceof BlockError && err.type.code === BlockErrorCode.EXECUTION_ENGINE_ERROR) {
+    if (isExecutionEngineError(err)) {
       this.onExecutionEngineError(this.state.attempt);
     } else {
       this.onProcessingError(this.state.attempt);
@@ -717,7 +718,7 @@ export class Batch {
       throw new BatchError(this.wrongStatusErrorType(BatchStatus.AwaitingValidation));
     }
 
-    if (err instanceof BlockError && err.type.code === BlockErrorCode.EXECUTION_ENGINE_ERROR) {
+    if (isExecutionEngineError(err)) {
       this.onExecutionEngineError(this.state.attempt);
     } else {
       this.onProcessingError(this.state.attempt);
@@ -787,3 +788,19 @@ type BatchErrorMetadata = {
 };
 
 export class BatchError extends LodestarError<BatchErrorType & BatchErrorMetadata> {}
+
+function isExecutionEngineError(err: Error): boolean {
+  if (!(err instanceof BlockError)) {
+    return false;
+  }
+
+  if (err.type.code === BlockErrorCode.EXECUTION_ENGINE_ERROR) {
+    return true;
+  }
+
+  return (
+    err.type.code === BlockErrorCode.BEACON_CHAIN_ERROR &&
+    err.type.error instanceof PayloadError &&
+    err.type.error.type.code === PayloadErrorCode.EXECUTION_ENGINE_ERROR
+  );
+}

package/src/util/clock.ts

@@ -94,10 +94,7 @@ export class Clock extends EventEmitter implements IClock {
   }
   /**
    * If it's too close to next slot given MAXIMUM_GOSSIP_CLOCK_DISPARITY, return currentSlot + 1.
-   * Otherwise return currentSlot
-   *
-   * Spec: phase0/p2p-interface.md - gossip validation uses `current_time + MAXIMUM_GOSSIP_CLOCK_DISPARITY < message_time`
-   * to reject future messages (strict `<`), so the boundary (exactly equal) is accepted, hence `<=` here.
+   * Spec: phase0/p2p-interface.md rejects future messages with strict `<`, hence `<=` here.
    */
   get currentSlotWithGossipDisparity(): Slot {
     const currentSlot = this.currentSlot;
@@ -123,9 +120,7 @@ export class Clock extends EventEmitter implements IClock {
 
   /**
    * Check if a slot is current slot given MAXIMUM_GOSSIP_CLOCK_DISPARITY.
-   *
-   * Uses `<=` for disparity checks because the spec rejects with strict `<`
-   * (phase0/p2p-interface.md), meaning the boundary (exactly equal) is accepted.
+   * Spec: phase0/p2p-interface.md rejects future messages with strict `<`, hence `<=`.
    */
   isCurrentSlotGivenGossipDisparity(slot: Slot): boolean {
     const currentSlot = this.currentSlot;