@lodestar/beacon-node 1.46.0-dev.e6f04acd82 → 1.46.0-dev.eabf12abae

package/package.json

@@ -11,7 +11,7 @@
   "bugs": {
     "url": "https://github.com/ChainSafe/lodestar/issues"
   },
-  "version": "1.46.0-dev.e6f04acd82",
+  "version": "1.46.0-dev.eabf12abae",
   "type": "module",
   "exports": {
     ".": {
@@ -105,7 +105,7 @@
     "@chainsafe/discv5": "^12.0.1",
     "@chainsafe/enr": "^6.0.1",
     "@chainsafe/libp2p-noise": "^17.0.0",
-    "@chainsafe/libp2p-quic": "^2.1.1",
+    "@chainsafe/libp2p-quic": "^2.1.2",
     "@chainsafe/persistent-merkle-tree": "^1.3.0",
     "@chainsafe/prometheus-gc-stats": "^1.0.0",
     "@chainsafe/snappy-wasm": "^0.5.0",
@@ -126,17 +126,17 @@
     "@libp2p/peer-id": "^6.0.4",
     "@libp2p/prometheus-metrics": "^5.0.14",
     "@libp2p/tcp": "^11.0.13",
-    "@lodestar/api": "^1.46.0-dev.e6f04acd82",
-    "@lodestar/config": "^1.46.0-dev.e6f04acd82",
-    "@lodestar/db": "^1.46.0-dev.e6f04acd82",
-    "@lodestar/fork-choice": "^1.46.0-dev.e6f04acd82",
-    "@lodestar/logger": "^1.46.0-dev.e6f04acd82",
-    "@lodestar/params": "^1.46.0-dev.e6f04acd82",
-    "@lodestar/reqresp": "^1.46.0-dev.e6f04acd82",
-    "@lodestar/state-transition": "^1.46.0-dev.e6f04acd82",
-    "@lodestar/types": "^1.46.0-dev.e6f04acd82",
-    "@lodestar/utils": "^1.46.0-dev.e6f04acd82",
-    "@lodestar/validator": "^1.46.0-dev.e6f04acd82",
+    "@lodestar/api": "^1.46.0-dev.eabf12abae",
+    "@lodestar/config": "^1.46.0-dev.eabf12abae",
+    "@lodestar/db": "^1.46.0-dev.eabf12abae",
+    "@lodestar/fork-choice": "^1.46.0-dev.eabf12abae",
+    "@lodestar/logger": "^1.46.0-dev.eabf12abae",
+    "@lodestar/params": "^1.46.0-dev.eabf12abae",
+    "@lodestar/reqresp": "^1.46.0-dev.eabf12abae",
+    "@lodestar/state-transition": "^1.46.0-dev.eabf12abae",
+    "@lodestar/types": "^1.46.0-dev.eabf12abae",
+    "@lodestar/utils": "^1.46.0-dev.eabf12abae",
+    "@lodestar/validator": "^1.46.0-dev.eabf12abae",
     "@multiformats/multiaddr": "^13.0.1",
     "datastore-core": "^11.0.2",
     "datastore-level": "^12.0.2",
@@ -158,7 +158,7 @@
     "@libp2p/interface-internal": "^3.0.13",
     "@libp2p/logger": "^6.2.2",
     "@libp2p/utils": "^7.0.13",
-    "@lodestar/spec-test-util": "^1.46.0-dev.e6f04acd82",
+    "@lodestar/spec-test-util": "^1.46.0-dev.eabf12abae",
     "@types/js-yaml": "^4.0.5",
     "@types/qs": "^6.9.7",
     "@types/tmp": "^0.2.3",
@@ -175,5 +175,5 @@
     "beacon",
     "blockchain"
   ],
-  "gitHead": "402a1913262b99cdeb71922eb306786e1a590e5e"
+  "gitHead": "9f3566a942890d0e4fc69ebf21d56614ffd925a5"
 }

package/src/api/impl/beacon/blocks/index.ts

@@ -58,7 +58,7 @@ import {
   ProduceFullGloas,
 } from "../../../../chain/produceBlock/index.js";
 import {RegenCaller} from "../../../../chain/regen/index.js";
-import {validateGossipBlock} from "../../../../chain/validation/block.js";
+import {validateGossipBlock, verifyBlockProposerSignature} from "../../../../chain/validation/block.js";
 import {validateApiExecutionPayloadBid} from "../../../../chain/validation/executionPayloadBid.js";
 import {validateApiExecutionPayloadEnvelope} from "../../../../chain/validation/executionPayloadEnvelope.js";
 import {OpSource} from "../../../../chain/validatorMonitor.js";
@@ -268,7 +268,6 @@ export function getBeaconBlockApi({
             await verifyBlocksInEpoch.call(chain as BeaconChain, parentBlock, [blockForImport], null, {
               ...opts,
               verifyOnly: true,
-              skipVerifyBlockSignatures: true,
               skipVerifyExecutionPayload: true,
               seenTimestampSec,
             });
@@ -285,12 +284,31 @@ export function getBeaconBlockApi({
 
         chain.logger.debug("Consensus validated while publishing block", valLogMeta);
 
-        if (broadcastValidation === routes.beacon.BroadcastValidation.consensusAndEquivocation) {
-          const message = `Equivocation checks not yet implemented for broadcastValidation=${broadcastValidation}`;
-          if (chain.opts.broadcastValidationStrictness === "error") {
-            throw Error(message);
+        // Non-local blocks had their proposer and block-body signatures checked by verifyBlocksInEpoch above
+        // Locally produced blocks already passed block production validation, so only their proposer signature is unchecked
+        // Verify that signature and observe the block root here
+        if (blockLocallyProduced) {
+          try {
+            await verifyBlockProposerSignature(chain, signedBlock, blockRoot);
+            chain.seenBlockProposers.observeBlockRoot(
+              slot,
+              signedBlock.message.proposerIndex,
+              blockRoot,
+              signedBlockToSignedHeader(config, signedBlock)
+            );
+          } catch (e) {
+            chain.logger.error(
+              "Proposer signature validation failed while publishing the block",
+              valLogMeta,
+              e as Error
+            );
+            chain.persistInvalidSszValue(
+              chain.config.getForkTypes(slot).SignedBeaconBlock,
+              signedBlock,
+              "api_reject_consensus_failure"
+            );
+            throw e;
           }
-          chain.logger.warn(message, valLogMeta);
         }
         break;
       }
@@ -318,6 +336,25 @@ export function getBeaconBlockApi({
       await sleep(msToBlockSlot);
     }
 
+    if (broadcastValidation === routes.beacon.BroadcastValidation.consensusAndEquivocation) {
+      const conflictingRoots = chain.seenBlockProposers.getConflictingBlockRoots(
+        slot,
+        signedBlock.message.proposerIndex,
+        blockRoot
+      );
+      if (conflictingRoots.length > 0) {
+        chain.logger.warn("Not publishing block due to proposer equivocation", {
+          ...valLogMeta,
+          conflictingRoots: conflictingRoots.join(", "),
+        });
+        throw new ApiError(
+          400,
+          `Block is a proposer equivocation, conflicting block roots: ${conflictingRoots.join(", ")}`
+        );
+      }
+      chain.logger.debug("Equivocation validated while publishing the block", valLogMeta);
+    }
+
     // TODO: Validate block
     const delaySec = seenTimestampSec - computeTimeAtSlot(config, slot, chain.genesisTime);
     metrics?.gossipBlock.elapsedTimeTillReceived.observe({source: OpSource.api}, delaySec);
@@ -775,15 +812,6 @@ export function getBeaconBlockApi({
               throw new ApiError(400, (error as Error).message);
             }
             chain.logger.debug("Consensus validated while publishing execution payload envelope", valLogMeta);
-
-            // TODO GLOAS: check the block is not a proposer equivocation before publishing the envelope
-            if (broadcastValidation === routes.beacon.BroadcastValidation.consensusAndEquivocation) {
-              const message = `Equivocation checks not yet implemented for broadcastValidation=${broadcastValidation}`;
-              if (chain.opts.broadcastValidationStrictness === "error") {
-                throw Error(message);
-              }
-              chain.logger.warn(message, valLogMeta);
-            }
             break;
           }
 
@@ -886,6 +914,27 @@ export function getBeaconBlockApi({
         await sleep(msToBlockSlot);
       }
 
+      // Keep this as the final async validation before publishing. A conflicting block may be observed while the
+      // envelope, blob data, or slot timing is being validated above.
+      if (broadcastValidation === routes.beacon.BroadcastValidation.consensusAndEquivocation) {
+        const conflictingRoots = chain.seenBlockProposers.getConflictingBlockRoots(
+          slot,
+          payloadInput.proposerIndex,
+          blockRootHex
+        );
+        if (conflictingRoots.length > 0) {
+          chain.logger.warn("Not publishing execution payload envelope due to proposer equivocation", {
+            ...valLogMeta,
+            conflictingRoots: conflictingRoots.join(", "),
+          });
+          throw new ApiError(
+            400,
+            `Block of execution payload envelope is a proposer equivocation, conflicting block roots: ${conflictingRoots.join(", ")}`
+          );
+        }
+        chain.logger.debug("Equivocation validated while publishing execution payload envelope", valLogMeta);
+      }
+
       if (payloadInput.hasPayloadEnvelope()) {
         // The envelope may have been added while this request was being validated, e.g. via gossip
         chain.logger.debug("Execution payload envelope already added during publishing", valLogMeta);

package/src/api/impl/validator/index.ts

@@ -339,12 +339,13 @@ export function getValidatorApi(
    * Following activities should be skipped on an Optimistic head (with Syncing status):
    * 1. Attestation if targetRoot is optimistic
    * 2. SyncCommitteeContribution if if the root for which to produce contribution is Optimistic.
-   * 3. ProduceBlock if the parentRoot (chain's current head is optimistic). However this doesn't
-   *    need to be checked/aborted here as assembleBody would call EL's api for the latest
-   *    executionStatus of the parentRoot. If still not validated, produceBlock will throw error.
-   *
-   * TODO/PENDING: SyncCommitteeSignatures should also be aborted, the best way to address this
-   *   is still in flux and will be updated as and when other CL's figure this out.
+   * 3. ProduceBlock if the parentRoot (chain's current head) is optimistic. Must be checked
+   *    explicitly as only local payload production consults the EL, blinded blocks from an
+   *    external builder or bid based blocks (gloas) can be produced without a synced EL.
+   * 4. SyncCommitteeSignature (base sync committee message) is aborted in the validator client
+   *    (see SyncCommitteeService) when the head root it would sign is optimistic, since it is
+   *    produced from the head root without a beacon-node produce endpoint to gate here. Spec:
+   *    https://github.com/ethereum/consensus-specs/blob/v1.6.1/sync/optimistic.md#participating-in-sync-committees
    */
 
   function notOnOptimisticBlockRoot(beaconBlockRoot: Root): void {
@@ -545,6 +546,12 @@ export function getValidatorApi(
     const parentBlock = chain.getProposerHead(slot);
     const {blockRoot: parentBlockRootHex, slot: parentSlot} = parentBlock;
     const parentBlockRoot = fromHex(parentBlockRootHex);
+    // An optimistic validator MUST NOT produce a block
+    if (isOptimisticBlock(parentBlock)) {
+      throw new NodeIsSyncing(
+        `Parent block's execution payload not yet validated, executionPayloadBlockHash=${parentBlock.executionPayloadBlockHash}`
+      );
+    }
     notOnOutOfRangeData(parentBlockRoot);
     metrics?.blockProductionSlotDelta.set(slot - parentSlot);
 
@@ -870,6 +877,12 @@ export function getValidatorApi(
       const parentBlock = chain.getProposerHead(slot);
       const {blockRoot: parentBlockRootHex, slot: parentSlot} = parentBlock;
       const parentBlockRoot = fromHex(parentBlockRootHex);
+      // An optimistic validator MUST NOT produce a block
+      if (isOptimisticBlock(parentBlock)) {
+        throw new NodeIsSyncing(
+          `Parent block's execution payload not yet validated, executionPayloadBlockHash=${parentBlock.executionPayloadBlockHash}`
+        );
+      }
       notOnOutOfRangeData(parentBlockRoot);
       metrics?.blockProductionSlotDelta.set(slot - parentSlot);
 

package/src/chain/blocks/importBlock.ts

@@ -6,6 +6,7 @@ import {
   ForkChoiceError,
   ForkChoiceErrorCode,
   NotReorgedReason,
+  getFinalizedExecutionBlockHash,
   getSafeExecutionBlockHash,
 } from "@lodestar/fork-choice";
 import {
@@ -443,8 +444,8 @@ export async function importBlock(
      * the current finalized block does not contain any execution payload at all (pre MERGE_EPOCH) or if it contains a
      * zero block hash (pre TTD)
      */
-    const safeBlockHash = getSafeExecutionBlockHash(this.forkChoice);
-    const finalizedBlockHash = this.forkChoice.getFinalizedBlock().executionPayloadBlockHash ?? ZERO_HASH_HEX;
+    const safeBlockHash = getSafeExecutionBlockHash(this.forkChoice, this.logger);
+    const finalizedBlockHash = getFinalizedExecutionBlockHash(this.forkChoice, this.logger);
     if (headBlockHash !== ZERO_HASH_HEX) {
       this.executionEngine
         .notifyForkchoiceUpdate(

package/src/chain/blocks/importExecutionPayload.ts

@@ -1,8 +1,12 @@
 import {routes} from "@lodestar/api";
-import {ExecutionStatus, PayloadExecutionStatus, getSafeExecutionBlockHash} from "@lodestar/fork-choice";
+import {
+  ExecutionStatus,
+  PayloadExecutionStatus,
+  getFinalizedExecutionBlockHash,
+  getSafeExecutionBlockHash,
+} from "@lodestar/fork-choice";
 import {DataAvailabilityStatus, isStatePostGloas} from "@lodestar/state-transition";
 import {isErrorAborted} from "@lodestar/utils";
-import {ZERO_HASH_HEX} from "../../constants/index.js";
 import {ExecutionPayloadStatus} from "../../execution/index.js";
 import {isQueueErrorAborted} from "../../util/queue/index.js";
 import {BeaconChain} from "../chain.js";
@@ -245,8 +249,8 @@ export async function importExecutionPayload(
   // 7. Queue notifyForkchoiceUpdate to engine api
   const head = this.forkChoice.getHead();
   if (!this.opts.disableImportExecutionFcU && blockRootHex === head.blockRoot) {
-    const safeBlockHash = getSafeExecutionBlockHash(this.forkChoice);
-    const finalizedBlockHash = this.forkChoice.getFinalizedBlock().executionPayloadBlockHash ?? ZERO_HASH_HEX;
+    const safeBlockHash = getSafeExecutionBlockHash(this.forkChoice, this.logger);
+    const finalizedBlockHash = getFinalizedExecutionBlockHash(this.forkChoice, this.logger);
     this.executionEngine.notifyForkchoiceUpdate(fork, blockHashHex, safeBlockHash, finalizedBlockHash).catch((e) => {
       if (!isErrorAborted(e) && !isQueueErrorAborted(e)) {
         this.logger.error("Error pushing notifyForkchoiceUpdate()", {blockHashHex, finalizedBlockHash}, e);

package/src/chain/blocks/index.ts

@@ -108,6 +108,13 @@ export async function processBlocks(
       throw segmentExecStatus.execAborted.execError;
     }
 
+    if (opts.skipVerifyBlockSignatures !== true) {
+      for (const blockInput of relevantBlocks) {
+        const block = blockInput.getBlock().message;
+        this.seenBlockProposers.add(block.slot, block.proposerIndex);
+      }
+    }
+
     const {executionStatuses} = segmentExecStatus;
     const verifiedBlocksBySlot = new Map<Slot, FullyVerifiedBlock>();
     for (let i = 0; i < relevantBlocks.length; i++) {

package/src/chain/blocks/utils/chainSegment.ts

@@ -31,23 +31,40 @@ export function assertLinearChainSegment(
   payloadEnvelopes: Map<Slot, PayloadEnvelopeInput> | null,
   parentBlock: ProtoBlock | null
 ): ChainSegmentResult {
+  if (blocks.length === 0) {
+    return {warnings: null};
+  }
+
   const warnings: OrphanedPayloadEnvelope[] = [];
 
-  // Track the expected execution payload block hash through the segment.
-  // Starts from the known forkchoice parent's execution hash.
-  // - FULL variant (envelope present for slot): advances to envelope.payload.blockHash
-  // - EMPTY variant (no envelope for slot): execution hash is unchanged
-  let currentExecHash: string | null = parentBlock?.executionPayloadBlockHash ?? null;
-  // Checkpoint sync first batch: parent is the anchor PENDING whose executionPayloadBlockHash
-  // is the inherited parentBlockHash semantic (= grandparent's payload), not its own payload.
-  // If parent's own payload envelope arrives in this batch, advance currentExecHash to that
-  // payload's blockHash so the segment validation sees the true EL chain head.
+  let parentExecHash: string | null = parentBlock?.executionPayloadBlockHash ?? null;
   if (parentBlock !== null) {
     const parentPayloadInput = payloadEnvelopes?.get(parentBlock.slot);
     if (parentPayloadInput?.hasPayloadEnvelope()) {
-      currentExecHash = parentPayloadInput.getBlockHashHex();
+      // Checkpoint-sync first batch: the anchor is stored PENDING with the inherited (grandparent)
+      // hash, not its own payload. Its payload envelope is in this batch, so use that blockHash as
+      // the real parent EL head.
+      parentExecHash = parentPayloadInput.getBlockHashHex();
     }
   }
+
+  // Track the expected execution payload block hash through the segment, seeded from the FIRST
+  // block's own bid
+  const firstBlockMessage = blocks[0].getBlock().message;
+  let currentExecHash: string | null = isGloasBeaconBlock(firstBlockMessage)
+    ? toRootHex(firstBlockMessage.body.signedExecutionPayloadBid.message.parentBlockHash)
+    : null;
+
+  // First block must build on the parent's EL head. PARENT_PAYLOAD_UNKNOWN (vs the in-segment
+  // NON_LINEAR_PAYLOAD_ROOTS below) tells range sync this is a parent-link problem, not an in-batch one.
+  if (parentExecHash !== null && currentExecHash !== null && currentExecHash !== parentExecHash) {
+    throw new BlockError(blocks[0].getBlock(), {
+      code: BlockErrorCode.PARENT_PAYLOAD_UNKNOWN,
+      parentRoot: toRootHex(firstBlockMessage.parentRoot),
+      parentBlockHash: currentExecHash,
+    });
+  }
+
   // Track the execution hash before the last FULL advancement so we can recover
   // if the next block reveals that envelope was orphaned.
   let prevExecHash: string | null = currentExecHash;
@@ -76,8 +93,7 @@ export function assertLinearChainSegment(
     }
 
     if (isGloasBeaconBlock(block.message)) {
-      // Bid check fires only when we have a seeded execution hash. With parentBlock=null the
-      // chain is seeded mid-segment by the first FULL envelope.
+      // currentExecHash and prevExecHash are only null for a pre-gloas first block (fork-transition segment); always set post-gloas.
       if (currentExecHash !== null) {
         // Verify the bid's parentBlockHash matches the tracked execution hash.
         // This ensures the block was built on the correct FULL or EMPTY variant of its parent.
@@ -86,22 +102,13 @@ export function assertLinearChainSegment(
           // Maybe the previous slot's FULL envelope was orphaned — try falling back.
           // If even prevExecHash doesn't match, the segment is non-linear.
           if (bidParentHash !== prevExecHash) {
-            // i === 0 compares against the seeded fork-choice parent (segment boundary); i > 0
-            // compares against the in-segment predecessor's payload (broken link inside the segment).
-            throw new BlockError(
-              block,
-              i === 0
-                ? {
-                    code: BlockErrorCode.PARENT_PAYLOAD_UNKNOWN,
-                    parentRoot: toRootHex(block.message.parentRoot),
-                    parentBlockHash: bidParentHash,
-                  }
-                : {
-                    code: BlockErrorCode.NON_LINEAR_PAYLOAD_ROOTS,
-                    parentBlockHash: bidParentHash,
-                    expectedBlockHash: currentExecHash,
-                  }
-            );
+            // Broken link inside the segment: throw NON_LINEAR_PAYLOAD_ROOTS instead of PARENT_PAYLOAD_UNKNOWN
+            // this is important for range sync to handle accordingly
+            throw new BlockError(block, {
+              code: BlockErrorCode.NON_LINEAR_PAYLOAD_ROOTS,
+              parentBlockHash: bidParentHash,
+              expectedBlockHash: currentExecHash,
+            });
           }
           if (lastFullSlot !== null && payloadEnvelopes !== null) {
             const orphanedInput = payloadEnvelopes.get(lastFullSlot);

package/src/chain/blocks/utils/polarBearBanner.ts

@@ -0,0 +1,50 @@
+export const GLOAS_POLAR_BEAR_BANNER = String.raw`
+
+                               __           .    .- '%%%░░░░░
+                              /  '-.       ,    '    '%%%░░░░
+                      _.--""""--.._;          . * .-' '%%%%░░
+      \ /          _.""    .'       '-._         '  .   '%%%%
+       L         .";      ;           ; '-.     .   / ' * '""
+      Ø         / /     .'      '    ;     '.     '     ;  |
+     D         / ;     e     ' ) ( ' ;       \     .  .'   ,:
+      E       ; :      P      ( ' )  :     '-.\          '  '
+       S      ; ;      B       ).(    '.      ';      '   '
+        T     : :      S      (/:\)     \      :
+       A      : \      ':     / : \      \   '.;
+      R       \ \      ';     \\ //       ;    ;
+     / \       \ : .'   \      \|/        |   /
+                '>'      :      '       '.;   |
+                 / ,'    /             '.  ;/ _\
+                ;,'     ;    '.        '.;    '-.
+               ;' .'   :    '. '.       / \, \ \ \
+ \             :,'     :      '. '. \  ; ::\_/_/_/::
+ ~|         .-=:.-"   -,-   "-.,=-.\ ;.; :::; ; ;::
+ ~|\        |('.'      :       .')| \: '.  :::::::
+ ~|:\        \\/       :       \//   ;   \              _____
+ ~~\:\     ■  :       .:.       :  _/     ;             \hjw:
+ ~~~\/     |  ;                 ;  ;      |              \"""
+ ~~.'      ■   :    _     _    ;  /       ;              /|~~
+ ~/        |    '. \';   ;'/ .' .'       /              /:|~~
+ |         ■      !  :   :  !_.'        /           .--::/~~~
+ |\___     |       '.:   :.'/\         ;      ____.':|:|/~~~~
+ \:::|\    ■         \'_'/  | :       :   ___/|:::|:'"""~~~~~
+ ~'""|:\   |         ;"^"   | !       :__/|::|/""""~~~~~~~~~~
+ ~~~~\::\_____     .-'      | ;       |::|/""~~~~~~~~~~~~~~~~
+ ~~~~~\:|::::|\   / / /    / /       /"""~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~\|::::|:'--\_\_\__.'-|       ;~~~~~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~~~""""~\::::::::::::/      .'~~~~~~~~~~~~~<><~~~~~~~~~
+ ~~~~~~~~~~~~~~""""'"""".-'      /~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~~__,------.__.--/ , ,  , |/--._~~~~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~/   |     .    :\|  |  |v'     \__~~~~~~~~~~~~~~~~~~~~
+ ~~~~~|\   ■    /:\   :::v-;v-'::        \_~~~~~~~~~~~~~~~~~~
+ ~~~~~\:\      / : \   :::::::::           \~~~~~~~~~~~~~~~~~
+ ~~~~~~\|'-.  /  :  \                      /|~~~~~~~~~~~~~~~~
+ ~~~~~~~~': \ \'. ,'/  ___            ____/:/~~~~~~~~~<><~~~~
+ ~~~~~~~~~~\|: \ ' /  /|:|\          /|:::|/~~~~~~~~~~~~~~~~~
+ ~~~~~~~~~~~|:  \:/  //"""\\        /:/"""~~~~~~~~~~~~~~~~~~~
+ ~~~><>~~~~~|\   '  //~~~~~\\______/:/~~~~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~~~~~~'|\____//~~~~~~~\|GLOAS|/~~~~~~~~<><~~~~~~~~~~~~~
+ ~~~~~~~~~~~~\|:::|/~~~~~~~~~'"""""'~~~~~~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~~~~~~~~'"""'~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~eth
+`;

package/src/chain/blocks/verifyBlock.ts

@@ -1,7 +1,13 @@
 import {ExecutionStatus, ProtoBlock} from "@lodestar/fork-choice";
 import {ForkName, ForkSeq, isForkPostFulu} from "@lodestar/params";
-import {DataAvailabilityStatus, IBeaconStateView, computeEpochAtSlot} from "@lodestar/state-transition";
-import {IndexedAttestation, Slot, deneb} from "@lodestar/types";
+import {
+  DataAvailabilityStatus,
+  IBeaconStateView,
+  computeEpochAtSlot,
+  signedBlockToSignedHeader,
+} from "@lodestar/state-transition";
+import {IndexedAttestation, Slot, deneb, ssz} from "@lodestar/types";
+import {toRootHex} from "@lodestar/utils";
 import {getBlobKzgCommitments} from "../../util/dataColumns.js";
 import type {BeaconChain} from "../chain.js";
 import {BlockError, BlockErrorCode} from "../errors/index.js";
@@ -13,6 +19,7 @@ import {ImportBlockOpts} from "./types.js";
 import {DENEB_BLOWFISH_BANNER} from "./utils/blowfishBanner.js";
 import {ELECTRA_GIRAFFE_BANNER} from "./utils/giraffeBanner.js";
 import {CAPELLA_OWL_BANNER} from "./utils/ownBanner.js";
+import {GLOAS_POLAR_BEAR_BANNER} from "./utils/polarBearBanner.js";
 import {FULU_ZEBRA_BANNER} from "./utils/zebraBanner.js";
 import {verifyBlocksDataAvailability} from "./verifyBlocksDataAvailability.js";
 import {SegmentExecStatus, verifyBlocksExecutionPayload} from "./verifyBlocksExecutionPayloads.js";
@@ -203,6 +210,20 @@ export async function verifyBlocksInEpoch(
       // maybe chain with the above verifyBlocksSignatures()
     ]);
 
+    if (opts.skipVerifyBlockSignatures !== true) {
+      for (const block of blocks) {
+        const {slot, proposerIndex} = block.message;
+        const signedBlockHeader = signedBlockToSignedHeader(this.config, block);
+        const blockRoot = toRootHex(ssz.phase0.BeaconBlockHeader.hashTreeRoot(signedBlockHeader.message));
+        this.seenBlockProposers.observeBlockRoot(slot, proposerIndex, blockRoot, signedBlockHeader);
+        // Only produce a slashing while importing the block. A block that is verified before it is published
+        // must not be treated as equivocation evidence since it may never be seen by the network
+        if (opts.verifyOnly !== true && this.seenBlockProposers.isEquivocating(slot, proposerIndex)) {
+          this.processProposerEquivocation(slot, proposerIndex);
+        }
+      }
+    }
+
     if (opts.verifyOnly !== true) {
       const fromForkBoundary = this.config.getForkBoundaryAtEpoch(computeEpochAtSlot(parentBlock.slot));
       const toForkBoundary = this.config.getForkBoundaryAtEpoch(computeEpochAtSlot(lastBlock.message.slot));
@@ -230,6 +251,11 @@ export async function verifyBlocksInEpoch(
             this.logger.info("Activating peerDAS", {epoch: this.config.FULU_FORK_EPOCH});
             break;
 
+          case ForkName.gloas:
+            this.logger.info(GLOAS_POLAR_BEAR_BANNER);
+            this.logger.info("Activating ePBS", {epoch: this.config.GLOAS_FORK_EPOCH});
+            break;
+
           default:
         }
       }

package/src/chain/chain.ts

@@ -130,6 +130,7 @@ import {CPStateDatastore} from "./stateCache/datastore/types.js";
 import {FIFOBlockStateCache} from "./stateCache/fifoBlockStateCache.js";
 import {PersistentCheckpointStateCache} from "./stateCache/persistentCheckpointsCache.js";
 import {CheckpointStateCache} from "./stateCache/types.js";
+import {validateApiProposerSlashing} from "./validation/proposerSlashing.js";
 import {ValidatorMonitor} from "./validatorMonitor.js";
 
 /**
@@ -200,6 +201,8 @@ export class BeaconChain implements IBeaconChain {
   readonly seenAggregatedAttestations: SeenAggregatedAttestations;
   readonly seenExecutionPayloadBids = new SeenExecutionPayloadBids();
   readonly seenBlockProposers = new SeenBlockProposers();
+  /** Proposer indexes with an in-flight proposer slashing production */
+  private readonly producingProposerSlashing = new Set<ValidatorIndex>();
   readonly seenSyncCommitteeMessages = new SeenSyncCommitteeMessages();
   readonly seenContributionAndProof: SeenContributionAndProof;
   readonly seenAttestationDatas: SeenAttestationDatas;
@@ -1163,6 +1166,63 @@ export class BeaconChain implements IBeaconChain {
     return this.payloadEnvelopeProcessor.processPayloadEnvelopeJob(payloadInput, opts);
   }
 
+  processProposerEquivocation(blockSlot: Slot, proposerIndex: ValidatorIndex): void {
+    this.produceProposerSlashing(blockSlot, proposerIndex).catch((e) => {
+      this.logger.debug("Error producing proposer slashing", {slot: blockSlot, proposerIndex}, e as Error);
+    });
+  }
+
+  /** Produce a proposer slashing from two conflicting signed block headers observed for the same slot and proposer */
+  private async produceProposerSlashing(blockSlot: Slot, proposerIndex: ValidatorIndex): Promise<void> {
+    if (this.opts.disableProposerSlashings === true || this.producingProposerSlashing.has(proposerIndex)) {
+      return;
+    }
+
+    if (this.opPool.hasSeenProposerSlashing(proposerIndex)) {
+      this.logger.debug("Not producing proposer slashing, already in the op pool", {
+        slot: blockSlot,
+        proposerIndex,
+      });
+      return;
+    }
+
+    const headers = this.seenBlockProposers.getEquivocationHeaders(blockSlot, proposerIndex);
+    if (headers === null) {
+      return;
+    }
+
+    this.producingProposerSlashing.add(proposerIndex);
+    try {
+      const [header1, header2] = headers;
+      // ProposerSlashing uses the bigint variant of the signed block header, see types package for details
+      const proposerSlashing: phase0.ProposerSlashing = {
+        signedHeader1: {
+          message: {...header1.message, slot: BigInt(header1.message.slot)},
+          signature: header1.signature,
+        },
+        signedHeader2: {
+          message: {...header2.message, slot: BigInt(header2.message.slot)},
+          signature: header2.signature,
+        },
+      };
+
+      try {
+        await validateApiProposerSlashing(this, proposerSlashing);
+      } catch (e) {
+        this.logger.debug("Produced proposer slashing is not valid", {slot: blockSlot, proposerIndex}, e as Error);
+        return;
+      }
+
+      this.opPool.insertProposerSlashing(proposerSlashing);
+      this.emitter.emit(routes.events.EventType.proposerSlashing, proposerSlashing);
+      this.emitter.emit(ChainEvent.publishProposerSlashing, proposerSlashing);
+      this.metrics?.opPool.proposerSlashingsProduced.inc();
+      this.logger.info("Produced proposer slashing from observed equivocation", {slot: blockSlot, proposerIndex});
+    } finally {
+      this.producingProposerSlashing.delete(proposerIndex);
+    }
+  }
+
   getStatus(): Status {
     const head = this.forkChoice.getHead();
     const finalizedCheckpoint = this.forkChoice.getFinalizedCheckpoint();

package/src/chain/emitter.ts

@@ -50,6 +50,11 @@ export enum ChainEvent {
    * and are ready to be published.
    */
   publishBlobSidecars = "publishBlobSidecars",
+  /**
+   * This event signals that a proposer slashing has been produced from an observed equivocation
+   * and is ready to be published.
+   */
+  publishProposerSlashing = "publishProposerSlashing",
   /**
    * Trigger an update of status so reqresp by peers have current earliestAvailableSlot
    */
@@ -110,6 +115,8 @@ export type IChainEvents = ApiEvents & {
 
   [ChainEvent.publishBlobSidecars]: (sidecars: deneb.BlobSidecar[]) => void;
 
+  [ChainEvent.publishProposerSlashing]: (proposerSlashing: phase0.ProposerSlashing) => void;
+
   [ChainEvent.updateStatus]: () => void;
 
   // Sync events that are chain->chain. Initiated from network requests but do not cross the network

package/src/chain/interface.ts

@@ -262,6 +262,9 @@ export interface IBeaconChain {
   /** Process execution payload envelope: verify, import to fork choice, and persist to DB */
   processExecutionPayload(payloadInput: PayloadEnvelopeInput, opts?: ImportPayloadOpts): Promise<void>;
 
+  /** Produce and publish a proposer slashing from an observed equivocation. Does not throw, only logs errors */
+  processProposerEquivocation(blockSlot: Slot, proposerIndex: ValidatorIndex): void;
+
   getStatus(): Status;
 
   recomputeForkChoiceHead(caller: ForkchoiceCaller): ProtoBlock;

package/src/chain/options.ts

@@ -37,6 +37,8 @@ export type IChainOptions = BlockProcessOpts &
     suggestedFeeRecipient: string;
     graffitiAppend?: boolean;
     maxSkipSlots?: number;
+    /** Do not produce proposer slashings from observed equivocations and do not include proposer slashings in produced blocks */
+    disableProposerSlashings?: boolean;
     /** Ensure blobs returned by the execution engine are valid */
     sanityCheckExecutionEngineBlobs?: boolean;
     /** Max number of produced blobs by local validators to cache */
@@ -122,6 +124,7 @@ export const defaultChainOptions: IChainOptions = {
   // for gossip block validation, it's unlikely we see a reorg with 32 slots
   // for attestation validation, having this value ensures we don't have to regen states most of the time
   maxSkipSlots: 32,
+  disableProposerSlashings: false,
   broadcastValidationStrictness: "warn",
   // should be less than or equal to MIN_SIGNATURE_SETS_TO_BATCH_VERIFY
   // batching too much may block the I/O thread so if useWorker=false, suggest this value to be 32