@lodestar/beacon-node 1.46.0-dev.281a8ee194 → 1.46.0-dev.3d8f7cf440

package/src/api/impl/beacon/blocks/index.ts

@@ -58,7 +58,7 @@ import {
   ProduceFullGloas,
 } from "../../../../chain/produceBlock/index.js";
 import {RegenCaller} from "../../../../chain/regen/index.js";
-import {validateGossipBlock} from "../../../../chain/validation/block.js";
+import {validateGossipBlock, verifyBlockProposerSignature} from "../../../../chain/validation/block.js";
 import {validateApiExecutionPayloadBid} from "../../../../chain/validation/executionPayloadBid.js";
 import {validateApiExecutionPayloadEnvelope} from "../../../../chain/validation/executionPayloadEnvelope.js";
 import {OpSource} from "../../../../chain/validatorMonitor.js";
@@ -268,7 +268,6 @@ export function getBeaconBlockApi({
             await verifyBlocksInEpoch.call(chain as BeaconChain, parentBlock, [blockForImport], null, {
               ...opts,
               verifyOnly: true,
-              skipVerifyBlockSignatures: true,
               skipVerifyExecutionPayload: true,
               seenTimestampSec,
             });
@@ -285,12 +284,26 @@ export function getBeaconBlockApi({
 
         chain.logger.debug("Consensus validated while publishing block", valLogMeta);
 
-        if (broadcastValidation === routes.beacon.BroadcastValidation.consensusAndEquivocation) {
-          const message = `Equivocation checks not yet implemented for broadcastValidation=${broadcastValidation}`;
-          if (chain.opts.broadcastValidationStrictness === "error") {
-            throw Error(message);
+        // Non-local blocks had their proposer and block-body signatures checked by verifyBlocksInEpoch above
+        // Locally produced blocks already passed block production validation, so only their proposer signature is unchecked
+        // Verify that signature and observe the block root here
+        if (blockLocallyProduced) {
+          try {
+            await verifyBlockProposerSignature(chain, signedBlock, blockRoot);
+            chain.seenBlockProposers.observeBlockRoot(slot, signedBlock.message.proposerIndex, blockRoot);
+          } catch (e) {
+            chain.logger.error(
+              "Proposer signature validation failed while publishing the block",
+              valLogMeta,
+              e as Error
+            );
+            chain.persistInvalidSszValue(
+              chain.config.getForkTypes(slot).SignedBeaconBlock,
+              signedBlock,
+              "api_reject_consensus_failure"
+            );
+            throw e;
           }
-          chain.logger.warn(message, valLogMeta);
         }
         break;
       }
@@ -318,6 +331,25 @@ export function getBeaconBlockApi({
       await sleep(msToBlockSlot);
     }
 
+    if (broadcastValidation === routes.beacon.BroadcastValidation.consensusAndEquivocation) {
+      const conflictingRoots = chain.seenBlockProposers.getConflictingBlockRoots(
+        slot,
+        signedBlock.message.proposerIndex,
+        blockRoot
+      );
+      if (conflictingRoots.length > 0) {
+        chain.logger.warn("Not publishing block due to proposer equivocation", {
+          ...valLogMeta,
+          conflictingRoots: conflictingRoots.join(", "),
+        });
+        throw new ApiError(
+          400,
+          `Block is a proposer equivocation, conflicting block roots: ${conflictingRoots.join(", ")}`
+        );
+      }
+      chain.logger.debug("Equivocation validated while publishing the block", valLogMeta);
+    }
+
     // TODO: Validate block
     const delaySec = seenTimestampSec - computeTimeAtSlot(config, slot, chain.genesisTime);
     metrics?.gossipBlock.elapsedTimeTillReceived.observe({source: OpSource.api}, delaySec);
@@ -775,15 +807,6 @@ export function getBeaconBlockApi({
               throw new ApiError(400, (error as Error).message);
             }
             chain.logger.debug("Consensus validated while publishing execution payload envelope", valLogMeta);
-
-            // TODO GLOAS: check the block is not a proposer equivocation before publishing the envelope
-            if (broadcastValidation === routes.beacon.BroadcastValidation.consensusAndEquivocation) {
-              const message = `Equivocation checks not yet implemented for broadcastValidation=${broadcastValidation}`;
-              if (chain.opts.broadcastValidationStrictness === "error") {
-                throw Error(message);
-              }
-              chain.logger.warn(message, valLogMeta);
-            }
             break;
           }
 
@@ -886,6 +909,27 @@ export function getBeaconBlockApi({
         await sleep(msToBlockSlot);
       }
 
+      // Keep this as the final async validation before publishing. A conflicting block may be observed while the
+      // envelope, blob data, or slot timing is being validated above.
+      if (broadcastValidation === routes.beacon.BroadcastValidation.consensusAndEquivocation) {
+        const conflictingRoots = chain.seenBlockProposers.getConflictingBlockRoots(
+          slot,
+          payloadInput.proposerIndex,
+          blockRootHex
+        );
+        if (conflictingRoots.length > 0) {
+          chain.logger.warn("Not publishing execution payload envelope due to proposer equivocation", {
+            ...valLogMeta,
+            conflictingRoots: conflictingRoots.join(", "),
+          });
+          throw new ApiError(
+            400,
+            `Block of execution payload envelope is a proposer equivocation, conflicting block roots: ${conflictingRoots.join(", ")}`
+          );
+        }
+        chain.logger.debug("Equivocation validated while publishing execution payload envelope", valLogMeta);
+      }
+
       if (payloadInput.hasPayloadEnvelope()) {
         // The envelope may have been added while this request was being validated, e.g. via gossip
         chain.logger.debug("Execution payload envelope already added during publishing", valLogMeta);

package/src/api/impl/validator/index.ts

@@ -339,12 +339,13 @@ export function getValidatorApi(
    * Following activities should be skipped on an Optimistic head (with Syncing status):
    * 1. Attestation if targetRoot is optimistic
    * 2. SyncCommitteeContribution if if the root for which to produce contribution is Optimistic.
-   * 3. ProduceBlock if the parentRoot (chain's current head is optimistic). However this doesn't
-   *    need to be checked/aborted here as assembleBody would call EL's api for the latest
-   *    executionStatus of the parentRoot. If still not validated, produceBlock will throw error.
-   *
-   * TODO/PENDING: SyncCommitteeSignatures should also be aborted, the best way to address this
-   *   is still in flux and will be updated as and when other CL's figure this out.
+   * 3. ProduceBlock if the parentRoot (chain's current head) is optimistic. Must be checked
+   *    explicitly as only local payload production consults the EL, blinded blocks from an
+   *    external builder or bid based blocks (gloas) can be produced without a synced EL.
+   * 4. SyncCommitteeSignature (base sync committee message) is aborted in the validator client
+   *    (see SyncCommitteeService) when the head root it would sign is optimistic, since it is
+   *    produced from the head root without a beacon-node produce endpoint to gate here. Spec:
+   *    https://github.com/ethereum/consensus-specs/blob/v1.6.1/sync/optimistic.md#participating-in-sync-committees
    */
 
   function notOnOptimisticBlockRoot(beaconBlockRoot: Root): void {
@@ -545,6 +546,12 @@ export function getValidatorApi(
     const parentBlock = chain.getProposerHead(slot);
     const {blockRoot: parentBlockRootHex, slot: parentSlot} = parentBlock;
     const parentBlockRoot = fromHex(parentBlockRootHex);
+    // An optimistic validator MUST NOT produce a block
+    if (isOptimisticBlock(parentBlock)) {
+      throw new NodeIsSyncing(
+        `Parent block's execution payload not yet validated, executionPayloadBlockHash=${parentBlock.executionPayloadBlockHash}`
+      );
+    }
     notOnOutOfRangeData(parentBlockRoot);
     metrics?.blockProductionSlotDelta.set(slot - parentSlot);
 
@@ -870,6 +877,12 @@ export function getValidatorApi(
       const parentBlock = chain.getProposerHead(slot);
       const {blockRoot: parentBlockRootHex, slot: parentSlot} = parentBlock;
       const parentBlockRoot = fromHex(parentBlockRootHex);
+      // An optimistic validator MUST NOT produce a block
+      if (isOptimisticBlock(parentBlock)) {
+        throw new NodeIsSyncing(
+          `Parent block's execution payload not yet validated, executionPayloadBlockHash=${parentBlock.executionPayloadBlockHash}`
+        );
+      }
       notOnOutOfRangeData(parentBlockRoot);
       metrics?.blockProductionSlotDelta.set(slot - parentSlot);
 

package/src/chain/blocks/importBlock.ts

@@ -6,6 +6,7 @@ import {
   ForkChoiceError,
   ForkChoiceErrorCode,
   NotReorgedReason,
+  getFinalizedExecutionBlockHash,
   getSafeExecutionBlockHash,
 } from "@lodestar/fork-choice";
 import {
@@ -443,8 +444,8 @@ export async function importBlock(
      * the current finalized block does not contain any execution payload at all (pre MERGE_EPOCH) or if it contains a
      * zero block hash (pre TTD)
      */
-    const safeBlockHash = getSafeExecutionBlockHash(this.forkChoice);
-    const finalizedBlockHash = this.forkChoice.getFinalizedBlock().executionPayloadBlockHash ?? ZERO_HASH_HEX;
+    const safeBlockHash = getSafeExecutionBlockHash(this.forkChoice, this.logger);
+    const finalizedBlockHash = getFinalizedExecutionBlockHash(this.forkChoice, this.logger);
     if (headBlockHash !== ZERO_HASH_HEX) {
       this.executionEngine
         .notifyForkchoiceUpdate(

package/src/chain/blocks/importExecutionPayload.ts

@@ -1,8 +1,12 @@
 import {routes} from "@lodestar/api";
-import {ExecutionStatus, PayloadExecutionStatus, getSafeExecutionBlockHash} from "@lodestar/fork-choice";
+import {
+  ExecutionStatus,
+  PayloadExecutionStatus,
+  getFinalizedExecutionBlockHash,
+  getSafeExecutionBlockHash,
+} from "@lodestar/fork-choice";
 import {DataAvailabilityStatus, isStatePostGloas} from "@lodestar/state-transition";
 import {isErrorAborted} from "@lodestar/utils";
-import {ZERO_HASH_HEX} from "../../constants/index.js";
 import {ExecutionPayloadStatus} from "../../execution/index.js";
 import {isQueueErrorAborted} from "../../util/queue/index.js";
 import {BeaconChain} from "../chain.js";
@@ -245,8 +249,8 @@ export async function importExecutionPayload(
   // 7. Queue notifyForkchoiceUpdate to engine api
   const head = this.forkChoice.getHead();
   if (!this.opts.disableImportExecutionFcU && blockRootHex === head.blockRoot) {
-    const safeBlockHash = getSafeExecutionBlockHash(this.forkChoice);
-    const finalizedBlockHash = this.forkChoice.getFinalizedBlock().executionPayloadBlockHash ?? ZERO_HASH_HEX;
+    const safeBlockHash = getSafeExecutionBlockHash(this.forkChoice, this.logger);
+    const finalizedBlockHash = getFinalizedExecutionBlockHash(this.forkChoice, this.logger);
     this.executionEngine.notifyForkchoiceUpdate(fork, blockHashHex, safeBlockHash, finalizedBlockHash).catch((e) => {
       if (!isErrorAborted(e) && !isQueueErrorAborted(e)) {
         this.logger.error("Error pushing notifyForkchoiceUpdate()", {blockHashHex, finalizedBlockHash}, e);

package/src/chain/blocks/index.ts

@@ -108,6 +108,13 @@ export async function processBlocks(
       throw segmentExecStatus.execAborted.execError;
     }
 
+    if (opts.skipVerifyBlockSignatures !== true) {
+      for (const blockInput of relevantBlocks) {
+        const block = blockInput.getBlock().message;
+        this.seenBlockProposers.add(block.slot, block.proposerIndex);
+      }
+    }
+
     const {executionStatuses} = segmentExecStatus;
     const verifiedBlocksBySlot = new Map<Slot, FullyVerifiedBlock>();
     for (let i = 0; i < relevantBlocks.length; i++) {

package/src/chain/blocks/utils/chainSegment.ts

@@ -31,23 +31,40 @@ export function assertLinearChainSegment(
   payloadEnvelopes: Map<Slot, PayloadEnvelopeInput> | null,
   parentBlock: ProtoBlock | null
 ): ChainSegmentResult {
+  if (blocks.length === 0) {
+    return {warnings: null};
+  }
+
   const warnings: OrphanedPayloadEnvelope[] = [];
 
-  // Track the expected execution payload block hash through the segment.
-  // Starts from the known forkchoice parent's execution hash.
-  // - FULL variant (envelope present for slot): advances to envelope.payload.blockHash
-  // - EMPTY variant (no envelope for slot): execution hash is unchanged
-  let currentExecHash: string | null = parentBlock?.executionPayloadBlockHash ?? null;
-  // Checkpoint sync first batch: parent is the anchor PENDING whose executionPayloadBlockHash
-  // is the inherited parentBlockHash semantic (= grandparent's payload), not its own payload.
-  // If parent's own payload envelope arrives in this batch, advance currentExecHash to that
-  // payload's blockHash so the segment validation sees the true EL chain head.
+  let parentExecHash: string | null = parentBlock?.executionPayloadBlockHash ?? null;
   if (parentBlock !== null) {
     const parentPayloadInput = payloadEnvelopes?.get(parentBlock.slot);
     if (parentPayloadInput?.hasPayloadEnvelope()) {
-      currentExecHash = parentPayloadInput.getBlockHashHex();
+      // Checkpoint-sync first batch: the anchor is stored PENDING with the inherited (grandparent)
+      // hash, not its own payload. Its payload envelope is in this batch, so use that blockHash as
+      // the real parent EL head.
+      parentExecHash = parentPayloadInput.getBlockHashHex();
     }
   }
+
+  // Track the expected execution payload block hash through the segment, seeded from the FIRST
+  // block's own bid
+  const firstBlockMessage = blocks[0].getBlock().message;
+  let currentExecHash: string | null = isGloasBeaconBlock(firstBlockMessage)
+    ? toRootHex(firstBlockMessage.body.signedExecutionPayloadBid.message.parentBlockHash)
+    : null;
+
+  // First block must build on the parent's EL head. PARENT_PAYLOAD_UNKNOWN (vs the in-segment
+  // NON_LINEAR_PAYLOAD_ROOTS below) tells range sync this is a parent-link problem, not an in-batch one.
+  if (parentExecHash !== null && currentExecHash !== null && currentExecHash !== parentExecHash) {
+    throw new BlockError(blocks[0].getBlock(), {
+      code: BlockErrorCode.PARENT_PAYLOAD_UNKNOWN,
+      parentRoot: toRootHex(firstBlockMessage.parentRoot),
+      parentBlockHash: currentExecHash,
+    });
+  }
+
   // Track the execution hash before the last FULL advancement so we can recover
   // if the next block reveals that envelope was orphaned.
   let prevExecHash: string | null = currentExecHash;
@@ -76,8 +93,7 @@ export function assertLinearChainSegment(
     }
 
     if (isGloasBeaconBlock(block.message)) {
-      // Bid check fires only when we have a seeded execution hash. With parentBlock=null the
-      // chain is seeded mid-segment by the first FULL envelope.
+      // currentExecHash and prevExecHash are only null for a pre-gloas first block (fork-transition segment); always set post-gloas.
       if (currentExecHash !== null) {
         // Verify the bid's parentBlockHash matches the tracked execution hash.
         // This ensures the block was built on the correct FULL or EMPTY variant of its parent.
@@ -86,22 +102,13 @@ export function assertLinearChainSegment(
           // Maybe the previous slot's FULL envelope was orphaned — try falling back.
           // If even prevExecHash doesn't match, the segment is non-linear.
           if (bidParentHash !== prevExecHash) {
-            // i === 0 compares against the seeded fork-choice parent (segment boundary); i > 0
-            // compares against the in-segment predecessor's payload (broken link inside the segment).
-            throw new BlockError(
-              block,
-              i === 0
-                ? {
-                    code: BlockErrorCode.PARENT_PAYLOAD_UNKNOWN,
-                    parentRoot: toRootHex(block.message.parentRoot),
-                    parentBlockHash: bidParentHash,
-                  }
-                : {
-                    code: BlockErrorCode.NON_LINEAR_PAYLOAD_ROOTS,
-                    parentBlockHash: bidParentHash,
-                    expectedBlockHash: currentExecHash,
-                  }
-            );
+            // Broken link inside the segment: throw NON_LINEAR_PAYLOAD_ROOTS instead of PARENT_PAYLOAD_UNKNOWN
+            // this is important for range sync to handle accordingly
+            throw new BlockError(block, {
+              code: BlockErrorCode.NON_LINEAR_PAYLOAD_ROOTS,
+              parentBlockHash: bidParentHash,
+              expectedBlockHash: currentExecHash,
+            });
           }
           if (lastFullSlot !== null && payloadEnvelopes !== null) {
             const orphanedInput = payloadEnvelopes.get(lastFullSlot);

package/src/chain/blocks/utils/polarBearBanner.ts

@@ -0,0 +1,50 @@
+export const GLOAS_POLAR_BEAR_BANNER = String.raw`
+
+                               __           .    .- '%%%░░░░░
+                              /  '-.       ,    '    '%%%░░░░
+                      _.--""""--.._;          . * .-' '%%%%░░
+      \ /          _.""    .'       '-._         '  .   '%%%%
+       L         .";      ;           ; '-.     .   / ' * '""
+      Ø         / /     .'      '    ;     '.     '     ;  |
+     D         / ;     e     ' ) ( ' ;       \     .  .'   ,:
+      E       ; :      P      ( ' )  :     '-.\          '  '
+       S      ; ;      B       ).(    '.      ';      '   '
+        T     : :      S      (/:\)     \      :
+       A      : \      ':     / : \      \   '.;
+      R       \ \      ';     \\ //       ;    ;
+     / \       \ : .'   \      \|/        |   /
+                '>'      :      '       '.;   |
+                 / ,'    /             '.  ;/ _\
+                ;,'     ;    '.        '.;    '-.
+               ;' .'   :    '. '.       / \, \ \ \
+ \             :,'     :      '. '. \  ; ::\_/_/_/::
+ ~|         .-=:.-"   -,-   "-.,=-.\ ;.; :::; ; ;::
+ ~|\        |('.'      :       .')| \: '.  :::::::
+ ~|:\        \\/       :       \//   ;   \              _____
+ ~~\:\     ■  :       .:.       :  _/     ;             \hjw:
+ ~~~\/     |  ;                 ;  ;      |              \"""
+ ~~.'      ■   :    _     _    ;  /       ;              /|~~
+ ~/        |    '. \';   ;'/ .' .'       /              /:|~~
+ |         ■      !  :   :  !_.'        /           .--::/~~~
+ |\___     |       '.:   :.'/\         ;      ____.':|:|/~~~~
+ \:::|\    ■         \'_'/  | :       :   ___/|:::|:'"""~~~~~
+ ~'""|:\   |         ;"^"   | !       :__/|::|/""""~~~~~~~~~~
+ ~~~~\::\_____     .-'      | ;       |::|/""~~~~~~~~~~~~~~~~
+ ~~~~~\:|::::|\   / / /    / /       /"""~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~\|::::|:'--\_\_\__.'-|       ;~~~~~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~~~""""~\::::::::::::/      .'~~~~~~~~~~~~~<><~~~~~~~~~
+ ~~~~~~~~~~~~~~""""'"""".-'      /~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~~__,------.__.--/ , ,  , |/--._~~~~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~/   |     .    :\|  |  |v'     \__~~~~~~~~~~~~~~~~~~~~
+ ~~~~~|\   ■    /:\   :::v-;v-'::        \_~~~~~~~~~~~~~~~~~~
+ ~~~~~\:\      / : \   :::::::::           \~~~~~~~~~~~~~~~~~
+ ~~~~~~\|'-.  /  :  \                      /|~~~~~~~~~~~~~~~~
+ ~~~~~~~~': \ \'. ,'/  ___            ____/:/~~~~~~~~~<><~~~~
+ ~~~~~~~~~~\|: \ ' /  /|:|\          /|:::|/~~~~~~~~~~~~~~~~~
+ ~~~~~~~~~~~|:  \:/  //"""\\        /:/"""~~~~~~~~~~~~~~~~~~~
+ ~~~><>~~~~~|\   '  //~~~~~\\______/:/~~~~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~~~~~~'|\____//~~~~~~~\|GLOAS|/~~~~~~~~<><~~~~~~~~~~~~~
+ ~~~~~~~~~~~~\|:::|/~~~~~~~~~'"""""'~~~~~~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~~~~~~~~'"""'~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~eth
+`;

package/src/chain/blocks/verifyBlock.ts

@@ -2,6 +2,7 @@ import {ExecutionStatus, ProtoBlock} from "@lodestar/fork-choice";
 import {ForkName, ForkSeq, isForkPostFulu} from "@lodestar/params";
 import {DataAvailabilityStatus, IBeaconStateView, computeEpochAtSlot} from "@lodestar/state-transition";
 import {IndexedAttestation, Slot, deneb} from "@lodestar/types";
+import {toRootHex} from "@lodestar/utils";
 import {getBlobKzgCommitments} from "../../util/dataColumns.js";
 import type {BeaconChain} from "../chain.js";
 import {BlockError, BlockErrorCode} from "../errors/index.js";
@@ -13,6 +14,7 @@ import {ImportBlockOpts} from "./types.js";
 import {DENEB_BLOWFISH_BANNER} from "./utils/blowfishBanner.js";
 import {ELECTRA_GIRAFFE_BANNER} from "./utils/giraffeBanner.js";
 import {CAPELLA_OWL_BANNER} from "./utils/ownBanner.js";
+import {GLOAS_POLAR_BEAR_BANNER} from "./utils/polarBearBanner.js";
 import {FULU_ZEBRA_BANNER} from "./utils/zebraBanner.js";
 import {verifyBlocksDataAvailability} from "./verifyBlocksDataAvailability.js";
 import {SegmentExecStatus, verifyBlocksExecutionPayload} from "./verifyBlocksExecutionPayloads.js";
@@ -203,6 +205,15 @@ export async function verifyBlocksInEpoch(
       // maybe chain with the above verifyBlocksSignatures()
     ]);
 
+    if (opts.skipVerifyBlockSignatures !== true) {
+      for (const block of blocks) {
+        const blockRoot = toRootHex(
+          this.config.getForkTypes(block.message.slot).BeaconBlock.hashTreeRoot(block.message)
+        );
+        this.seenBlockProposers.observeBlockRoot(block.message.slot, block.message.proposerIndex, blockRoot);
+      }
+    }
+
     if (opts.verifyOnly !== true) {
       const fromForkBoundary = this.config.getForkBoundaryAtEpoch(computeEpochAtSlot(parentBlock.slot));
       const toForkBoundary = this.config.getForkBoundaryAtEpoch(computeEpochAtSlot(lastBlock.message.slot));
@@ -230,6 +241,11 @@ export async function verifyBlocksInEpoch(
             this.logger.info("Activating peerDAS", {epoch: this.config.FULU_FORK_EPOCH});
             break;
 
+          case ForkName.gloas:
+            this.logger.info(GLOAS_POLAR_BEAR_BANNER);
+            this.logger.info("Activating ePBS", {epoch: this.config.GLOAS_FORK_EPOCH});
+            break;
+
           default:
         }
       }

package/src/chain/prepareNextSlot.ts

@@ -1,6 +1,6 @@
 import {routes} from "@lodestar/api";
 import {ChainForkConfig} from "@lodestar/config";
-import {getSafeExecutionBlockHash} from "@lodestar/fork-choice";
+import {getFinalizedExecutionBlockHash, getSafeExecutionBlockHash} from "@lodestar/fork-choice";
 import {
   ForkPostBellatrix,
   ForkSeq,
@@ -10,17 +10,20 @@ import {
   isForkPostGloas,
 } from "@lodestar/params";
 import {
+  GLOAS_PREVERIFY_WINDOW_EPOCHS,
   IBeaconStateView,
   IBeaconStateViewBellatrix,
+  MAX_BUILDER_DEPOSITS_PER_SLOT,
   StateHashTreeRootSource,
   computeEpochAtSlot,
   computeTimeAtSlot,
   isStatePostBellatrix,
+  isStatePostFulu,
   isStatePostGloas,
 } from "@lodestar/state-transition";
 import {Bytes32, Slot, ValidatorIndex} from "@lodestar/types";
 import {Logger, fromHex, isErrorAborted, sleep} from "@lodestar/utils";
-import {GENESIS_SLOT, ZERO_HASH_HEX} from "../constants/constants.js";
+import {GENESIS_SLOT} from "../constants/constants.js";
 import {BuilderStatus} from "../execution/builder/http.js";
 import {Metrics} from "../metrics/index.js";
 import {ClockEvent} from "../util/clock.js";
@@ -37,6 +40,11 @@ export const PREPARE_NEXT_SLOT_BPS = 6667;
 /* We don't want to do more epoch transition than this */
 const PREPARE_EPOCH_LIMIT = 1;
 
+/* Fraction of a slot (out of 10_000) the pre-Gloas builder-deposit pre-verify may spend per tick.
+ * 2000 = 20% of slot (2.4s on mainnet), within the spare window left after PREPARE_NEXT_SLOT_BPS.
+ * Expressed in bps so it scales with slot duration (mainnet vs minimal/devnet). */
+const BUILDER_PREVERIFY_LIMIT_BPS = 2000;
+
 /**
  * At Bellatrix, if we are responsible for proposing in next slot, we want to prepare payload
  * 4s before the start of next slot at PREPARE_NEXT_SLOT_BPS of the current slot.
@@ -117,6 +125,7 @@ export class PrepareNextSlotScheduler {
         ? this.metrics?.precomputeNextEpochTransition.duration.startTimer()
         : null;
       const start = Date.now();
+      let feeRecipient: string | undefined;
       // No need to wait for this or the clock drift
       if (isForkPostBellatrix(fork)) {
         let preparedState: IBeaconStateView | undefined;
@@ -140,7 +149,7 @@ export class PrepareNextSlotScheduler {
         };
 
         const proposerIndex = await getProposerIndex();
-        const feeRecipient = this.chain.beaconProposerCache.get(proposerIndex);
+        feeRecipient = this.chain.beaconProposerCache.get(proposerIndex);
 
         if (feeRecipient) {
           // If we are proposing next slot, we need to predict if we can proposer-boost-reorg or not
@@ -214,9 +223,8 @@ export class PrepareNextSlotScheduler {
             computeTimeAtSlot(this.config, prepareSlot, this.chain.genesisTime) - Date.now() / 1000;
           this.metrics?.blockPayload.payloadAdvancePrepTime.observe(preparationTime);
 
-          const safeBlockHash = getSafeExecutionBlockHash(this.chain.forkChoice);
-          const finalizedBlockHash =
-            this.chain.forkChoice.getFinalizedBlock().executionPayloadBlockHash ?? ZERO_HASH_HEX;
+          const safeBlockHash = getSafeExecutionBlockHash(this.chain.forkChoice, this.logger);
+          const finalizedBlockHash = getFinalizedExecutionBlockHash(this.chain.forkChoice, this.logger);
 
           // awaiting here instead of throwing an async call because there is no other task
           // left for scheduler and this gives nice semantics to catch and log errors in the
@@ -287,6 +295,74 @@ export class PrepareNextSlotScheduler {
         });
 
         precomputeEpochTransitionTimer?.();
+
+        // Nothing more to do on an epoch-transition slot: that precompute already ran a full (>1s)
+        // epoch transition, so we don't pile the builder-deposit pre-verify (below) on top of it.
+        return;
+      }
+
+      // Pre-verify builder-deposit signatures in the GLOAS_PREVERIFY_WINDOW_EPOCHS epochs leading
+      // up to the Gloas fork, off the block-import hot path, so onboardBuildersFromPendingDeposits
+      // at the transition is mostly cache hits. Reached only on non-epoch-transition slots (the
+      // epoch-transition branch returned above). Runs on the head state — its pendingDeposits are
+      // what the fork transition derives from, and its epochCtx holds the shared, app-wide
+      // builderDepositSignatureCache.
+      const headState = this.chain.getHeadState();
+      if (isStatePostFulu(headState)) {
+        const gloasEpoch = this.config.GLOAS_FORK_EPOCH;
+        const finalizedEpoch = this.chain.forkChoice.getFinalizedCheckpoint().epoch;
+        if (finalizedEpoch >= gloasEpoch) {
+          // Gloas is finalized — the pre-verify cache has served its purpose; release its memory.
+          headState.clearPreGloasBuilderDepositCache();
+        } else {
+          const clockEpoch = computeEpochAtSlot(clockSlot);
+          if (
+            ForkSeq[fork] < ForkSeq.gloas && // only before the fork
+            clockEpoch >= gloasEpoch - GLOAS_PREVERIFY_WINDOW_EPOCHS && // Infinity when Gloas unscheduled → skip
+            clockEpoch < gloasEpoch &&
+            // skip when we're the next-slot proposer — don't compete with block-production prep.
+            feeRecipient === undefined
+          ) {
+            const maxDurationMs = this.config.getSlotComponentDurationMs(BUILDER_PREVERIFY_LIMIT_BPS);
+            const preVerifyTimer = this.metrics?.builderDepositPreVerify.duration.startTimer();
+            const result = headState.preVerifyBuilderDepositsPreGloas(MAX_BUILDER_DEPOSITS_PER_SLOT, maxDurationMs);
+            preVerifyTimer?.();
+
+            const preVerifyMetrics = this.metrics?.builderDepositPreVerify;
+            if (preVerifyMetrics) {
+              preVerifyMetrics.pendingDeposits.set(result.pendingDepositsCount);
+              preVerifyMetrics.cachedDeposits.set(result.totalCachedDeposits);
+              preVerifyMetrics.scannedDeposits.set(result.scannedPendingDeposits);
+              preVerifyMetrics.builderPubkeys.set(result.totalBuilderPubkeys);
+              if (result.validBuilderSignaturesCount > 0) {
+                preVerifyMetrics.validSignatures.inc({type: "builder"}, result.validBuilderSignaturesCount);
+              }
+              if (result.validValidatorSignaturesCount > 0) {
+                preVerifyMetrics.validSignatures.inc({type: "validator"}, result.validValidatorSignaturesCount);
+              }
+              if (result.invalidBuilderSignaturesCount > 0) {
+                preVerifyMetrics.invalidSignatures.inc({type: "builder"}, result.invalidBuilderSignaturesCount);
+              }
+              if (result.invalidValidatorSignaturesCount > 0) {
+                preVerifyMetrics.invalidSignatures.inc({type: "validator"}, result.invalidValidatorSignaturesCount);
+              }
+            }
+
+            // Always log (once per slot, only within the pre-fork window) so devnets show the
+            // pre-verify draining even on all-cache-hit ticks.
+            this.logger.verbose("PrepareNextSlotScheduler pre-verified deposit signatures", {
+              clockSlot,
+              validBuilderSignaturesCount: result.validBuilderSignaturesCount,
+              invalidBuilderSignaturesCount: result.invalidBuilderSignaturesCount,
+              validValidatorSignaturesCount: result.validValidatorSignaturesCount,
+              invalidValidatorSignaturesCount: result.invalidValidatorSignaturesCount,
+              scannedPendingDeposits: result.scannedPendingDeposits,
+              totalCachedDeposits: result.totalCachedDeposits,
+              totalBuilderPubkeys: result.totalBuilderPubkeys,
+              pendingDepositsCount: result.pendingDepositsCount,
+            });
+          }
+        }
       }
     } catch (e) {
       if (!isErrorAborted(e) && !isQueueErrorAborted(e)) {

package/src/chain/produceBlock/produceBlockBody.ts

@@ -1,6 +1,11 @@
 import {BitArray} from "@chainsafe/ssz";
 import {ChainForkConfig} from "@lodestar/config";
-import {IForkChoice, ProtoBlock, getSafeExecutionBlockHash} from "@lodestar/fork-choice";
+import {
+  IForkChoice,
+  ProtoBlock,
+  getFinalizedExecutionBlockHash,
+  getSafeExecutionBlockHash,
+} from "@lodestar/fork-choice";
 import {
   BUILDER_INDEX_SELF_BUILD,
   ForkName,
@@ -265,8 +270,8 @@ export async function produceBlockBody<T extends BlockType>(
     // TODO GLOAS: support non self-building here, the block type differentiation between
     // full and blinded no longer makes sense in gloas, it might be a good idea to move
     // this into a completely separate function and have pre/post gloas more separated
-    const safeBlockHash = getSafeExecutionBlockHash(this.forkChoice);
-    const finalizedBlockHash = this.forkChoice.getFinalizedBlock().executionPayloadBlockHash ?? ZERO_HASH_HEX;
+    const safeBlockHash = getSafeExecutionBlockHash(this.forkChoice, this.logger);
+    const finalizedBlockHash = getFinalizedExecutionBlockHash(this.forkChoice, this.logger);
     // TODO GLOAS: post-Gloas, proposer feeRecipient is also carried (signed) in
     // ProposerPreferencesPool. Consider using this unified cache instead
     // see https://github.com/ChainSafe/lodestar/issues/9379
@@ -411,8 +416,8 @@ export async function produceBlockBody<T extends BlockType>(
       throw new Error("Expected Bellatrix state for execution block production");
     }
 
-    const safeBlockHash = getSafeExecutionBlockHash(this.forkChoice);
-    const finalizedBlockHash = this.forkChoice.getFinalizedBlock().executionPayloadBlockHash ?? ZERO_HASH_HEX;
+    const safeBlockHash = getSafeExecutionBlockHash(this.forkChoice, this.logger);
+    const finalizedBlockHash = getFinalizedExecutionBlockHash(this.forkChoice, this.logger);
     const feeRecipient = requestedFeeRecipient ?? this.beaconProposerCache.getOrDefault(proposerIndex);
     const feeRecipientType = requestedFeeRecipient
       ? "requested"