@lodestar/beacon-node 1.51.0-dev.fd649df985 → 1.51.0-rc.0

package/src/chain/validation/executionPayloadBid.ts

@@ -1,5 +1,5 @@
 import {ProtoBlock} from "@lodestar/fork-choice";
-import {PAYLOAD_BUILDER_VERSION} from "@lodestar/params";
+import {PAYLOAD_BUILDER_VERSION, isForkPostHeze} from "@lodestar/params";
 import {
   computeEpochAtSlot,
   createSingleSignatureSetFromComponents,
@@ -9,7 +9,7 @@ import {
   isStartSlotOfEpoch,
   isStatePostGloas,
 } from "@lodestar/state-transition";
-import {RootHex, Slot, ValidatorIndex, gloas} from "@lodestar/types";
+import {RootHex, Slot, ValidatorIndex, gloas, heze} from "@lodestar/types";
 import {byteArrayEquals, toHex, toRootHex} from "@lodestar/utils";
 import {getShufflingDependentRoot} from "../../util/dependentRoot.js";
 import {ExecutionPayloadBidError, ExecutionPayloadBidErrorCode, GossipAction} from "../errors/index.js";
@@ -83,174 +83,6 @@ function isBidCompatibleWithHead(
   return buildsOnParentPayload;
 }
 
-/**
- * Validation for bids submitted via the API by the operator's own builder.
- *
- * Only non-transient checks are applied: slot later than parent, zero execution payment, blob
- * commitment count, builder eligibility, version and balance coverage, prev_randao, and signature.
- * Transient gossip rules (head compatibility, first bid per tuple, value increment, proposer
- * preferences) are not applied, since those only limit forwarding of peers' messages and the
- * builder may legitimately bid on a branch this node does not consider head.
- * The parent-payload builder-exit rule is omitted because this endpoint only accepts bids from
- * the operator's own builder.
- *
- * Throws on any failed check. Also throws if the bid's parent block is unknown or its state is
- * unavailable, since the checks cannot be evaluated against the parent branch.
- */
-export async function validateApiExecutionPayloadBid(
-  chain: IBeaconChain,
-  signedExecutionPayloadBid: gloas.SignedExecutionPayloadBid
-): Promise<void> {
-  const bid = signedExecutionPayloadBid.message;
-  const bidParentBlockRoot = toRootHex(bid.parentBlockRoot);
-
-  // [REJECT] `bid.execution_payment` is zero.
-  if (bid.executionPayment !== 0n) {
-    throw new ExecutionPayloadBidError(GossipAction.REJECT, {
-      code: ExecutionPayloadBidErrorCode.NON_ZERO_EXECUTION_PAYMENT,
-      builderIndex: bid.builderIndex,
-      executionPayment: bid.executionPayment,
-    });
-  }
-
-  // [REJECT] The bid's block hash is not equal to its parent block hash -- i.e.
-  // `bid.block_hash != bid.parent_block_hash`.
-  if (byteArrayEquals(bid.blockHash, bid.parentBlockHash)) {
-    throw new ExecutionPayloadBidError(GossipAction.REJECT, {
-      code: ExecutionPayloadBidErrorCode.BLOCK_HASH_EQUALS_PARENT_BLOCK_HASH,
-      blockHash: toRootHex(bid.blockHash),
-    });
-  }
-
-  // [REJECT] The length of KZG commitments is less than or equal to the limitation defined in the
-  // consensus layer -- i.e. validate that
-  // `len(bid.blob_kzg_commitments) <= get_blob_parameters(compute_epoch_at_slot(bid.slot)).max_blobs_per_block`.
-  const blobKzgCommitmentsLen = bid.blobKzgCommitments.length;
-  const maxBlobsPerBlock = chain.config.getMaxBlobsPerBlock(computeEpochAtSlot(bid.slot));
-  if (blobKzgCommitmentsLen > maxBlobsPerBlock) {
-    throw new ExecutionPayloadBidError(GossipAction.REJECT, {
-      code: ExecutionPayloadBidErrorCode.TOO_MANY_KZG_COMMITMENTS,
-      blobKzgCommitmentsLen,
-      commitmentLimit: maxBlobsPerBlock,
-    });
-  }
-
-  // [IGNORE] `bid.slot` is the current slot, or the next slot (`bid.slot - 1` is current), allowing for `MAXIMUM_GOSSIP_CLOCK_DISPARITY`.
-  if (
-    !chain.clock.isCurrentSlotGivenGossipDisparity(bid.slot) &&
-    !chain.clock.isCurrentSlotGivenGossipDisparity(bid.slot - 1)
-  ) {
-    throw new ExecutionPayloadBidError(GossipAction.IGNORE, {
-      code: ExecutionPayloadBidErrorCode.INVALID_SLOT,
-      builderIndex: bid.builderIndex,
-      slot: bid.slot,
-    });
-  }
-
-  // [IGNORE] `bid.parent_block_root` is the hash tree root of a known beacon block in fork choice.
-  // Moved earlier than the spec ordering so we can derive the proposer dependent root for the
-  // proposer-preferences lookup below from a known fork-choice block.
-  const parentBlock = chain.forkChoice.getBlockHexDefaultStatus(bidParentBlockRoot);
-  if (parentBlock === null) {
-    throw new ExecutionPayloadBidError(GossipAction.IGNORE, {
-      code: ExecutionPayloadBidErrorCode.UNKNOWN_BLOCK_ROOT,
-      parentBlockRoot: bidParentBlockRoot,
-    });
-  }
-
-  // [REJECT] The bid is for a higher slot than its parent block -- i.e.
-  // validate that `bid.slot` is greater than the slot of the block with root
-  // `bid.parent_block_root`.
-  if (bid.slot <= parentBlock.slot) {
-    throw new ExecutionPayloadBidError(GossipAction.REJECT, {
-      code: ExecutionPayloadBidErrorCode.NOT_LATER_THAN_PARENT,
-      parentSlot: parentBlock.slot,
-      slot: bid.slot,
-    });
-  }
-
-  const state = await chain.regen
-    .getBlockSlotState(parentBlock, bid.slot, {dontTransferCache: true}, RegenCaller.validateApiExecutionPayloadBid)
-    .catch(() => {
-      throw new ExecutionPayloadBidError(GossipAction.IGNORE, {
-        code: ExecutionPayloadBidErrorCode.UNKNOWN_BLOCK_ROOT,
-        parentBlockRoot: bidParentBlockRoot,
-      });
-    });
-
-  if (!isStatePostGloas(state)) {
-    throw new Error(`Expected gloas+ state for execution payload bid validation, got fork=${state.forkName}`);
-  }
-
-  // [REJECT] `bid.builder_index` is within bounds -- i.e. `bid.builder_index < len(state.builders)`.
-  // `state.getBuilder` returns a lazy SSZ `getReadonly` view that is not bounds-checked eagerly; an
-  // out-of-range index only throws (`LeafNode has no right node`) on deferred field access (e.g. inside
-  // `isActiveBuilder`), escaping a try/catch around `getBuilder`. Check the length explicitly instead.
-  if (bid.builderIndex >= state.getBuildersLength()) {
-    throw new ExecutionPayloadBidError(GossipAction.REJECT, {
-      code: ExecutionPayloadBidErrorCode.BUILDER_NOT_ELIGIBLE,
-      builderIndex: bid.builderIndex,
-    });
-  }
-
-  // [REJECT] `bid.builder_index` is a valid/active builder index -- i.e.
-  // `is_active_builder(state, bid.builder_index)` returns `True`.
-  const builder = state.getBuilder(bid.builderIndex);
-  if (!isActiveBuilder(builder, state.finalizedCheckpoint.epoch)) {
-    throw new ExecutionPayloadBidError(GossipAction.REJECT, {
-      code: ExecutionPayloadBidErrorCode.BUILDER_NOT_ELIGIBLE,
-      builderIndex: bid.builderIndex,
-    });
-  }
-
-  // [REJECT] The builder version is `PAYLOAD_BUILDER_VERSION` -- i.e.
-  // `state.builders[bid.builder_index].version == PAYLOAD_BUILDER_VERSION`.
-  if (builder.version !== PAYLOAD_BUILDER_VERSION) {
-    throw new ExecutionPayloadBidError(GossipAction.REJECT, {
-      code: ExecutionPayloadBidErrorCode.INVALID_BUILDER_VERSION,
-      builderIndex: bid.builderIndex,
-      version: builder.version,
-      expectedVersion: PAYLOAD_BUILDER_VERSION,
-    });
-  }
-
-  // [IGNORE] `bid.value` is less or equal than the builder's excess balance --
-  // i.e. `can_builder_cover_bid(state, builder_index, amount)` returns `True`.
-  if (!state.canBuilderCoverBid(bid.builderIndex, bid.value)) {
-    throw new ExecutionPayloadBidError(GossipAction.IGNORE, {
-      code: ExecutionPayloadBidErrorCode.BID_TOO_HIGH,
-      bidValue: bid.value,
-      builderBalance: builder.balance,
-    });
-  }
-
-  // [REJECT] `bid.prev_randao` is the correct RANDAO mix -- i.e. validate that
-  // `bid.prev_randao == get_randao_mix(parent_state, get_current_epoch(parent_state))`.
-  const randaoMix = state.getRandaoMix(computeEpochAtSlot(state.slot));
-  if (!byteArrayEquals(bid.prevRandao, randaoMix)) {
-    throw new ExecutionPayloadBidError(GossipAction.REJECT, {
-      code: ExecutionPayloadBidErrorCode.INVALID_PREV_RANDAO,
-      builderIndex: bid.builderIndex,
-      bidPrevRandao: toHex(bid.prevRandao),
-      expectedPrevRandao: toHex(randaoMix),
-    });
-  }
-
-  // [REJECT] `signed_execution_payload_bid.signature` is valid with respect to the `bid.builder_index`.
-  const signatureSet = createSingleSignatureSetFromComponents(
-    builder.pubkey,
-    getExecutionPayloadBidSigningRoot(chain.config, bid),
-    signedExecutionPayloadBid.signature
-  );
-  if (!(await chain.bls.verifySignatureSets([signatureSet]))) {
-    throw new ExecutionPayloadBidError(GossipAction.REJECT, {
-      code: ExecutionPayloadBidErrorCode.INVALID_SIGNATURE,
-      builderIndex: bid.builderIndex,
-      slot: bid.slot,
-    });
-  }
-}
-
 export async function validateGossipExecutionPayloadBid(
   chain: IBeaconChain,
   signedExecutionPayloadBid: gloas.SignedExecutionPayloadBid
@@ -309,6 +141,18 @@ async function validateExecutionPayloadBid(
     });
   }
 
+  // [IGNORE] The bid is received after the inclusion list deadline of `bid.slot - 1`
+  if (
+    isForkPostHeze(chain.config.getForkName(bid.slot)) &&
+    chain.clock.msFromSlot(bid.slot - 1) < chain.config.getInclusionListDueMs(chain.config.getForkName(bid.slot - 1))
+  ) {
+    throw new ExecutionPayloadBidError(GossipAction.IGNORE, {
+      code: ExecutionPayloadBidErrorCode.BEFORE_INCLUSION_LIST_DEADLINE,
+      builderIndex: bid.builderIndex,
+      slot: bid.slot,
+    });
+  }
+
   // [IGNORE] The bid is compatible with the current head branch.
   const head = chain.forkChoice.getHead();
   if (!isBidCompatibleWithHead(chain, head, bid.slot, bidParentBlockRoot, bidParentBlockHash)) {
@@ -357,6 +201,32 @@ async function validateExecutionPayloadBid(
     });
   }
 
+  // [IGNORE] bid.inclusionListBits is inclusive of our timely inclusion lists for
+  // (bid.slot - 1, get_shuffling_dependent_root(store, bid.parent_block_root, epoch)).
+  if (isForkPostHeze(chain.config.getForkName(bid.slot))) {
+    const {inclusionListBits} = bid as heze.ExecutionPayloadBid;
+    const inclusionListSlot = bid.slot - 1;
+    const inclusionListDependentRoot = getShufflingDependentRoot(
+      chain.forkChoice,
+      computeEpochAtSlot(inclusionListSlot),
+      computeEpochAtSlot(parentBlock.slot),
+      parentBlock
+    );
+    if (
+      !chain.inclusionListStore.isInclusionListBitsInclusive(
+        inclusionListSlot,
+        inclusionListDependentRoot,
+        inclusionListBits
+      )
+    ) {
+      throw new ExecutionPayloadBidError(GossipAction.IGNORE, {
+        code: ExecutionPayloadBidErrorCode.INCLUSION_LIST_BITS_NOT_INCLUSIVE,
+        builderIndex: bid.builderIndex,
+        slot: bid.slot,
+      });
+    }
+  }
+
   // [IGNORE] A `SignedProposerPreferences` matching `bid.slot` and the bid's branch has been
   // seen — i.e. `proposal_slot == bid.slot` AND `dependent_root ==
   // get_proposer_dependent_root(parent_state, compute_epoch_at_slot(bid.slot))`.

package/src/chain/validation/inclusionList.ts

@@ -0,0 +1,192 @@
+import {ProtoBlock} from "@lodestar/fork-choice";
+import {GENESIS_SLOT, MIN_SEED_LOOKAHEAD, isForkPostHeze} from "@lodestar/params";
+import {
+  EpochShuffling,
+  computeEpochAtSlot,
+  computeStartSlotAtEpoch,
+  getInclusionListCommittee,
+  getInclusionListSignatureSet,
+} from "@lodestar/state-transition";
+import {Epoch, RootHex, heze} from "@lodestar/types";
+import {toRootHex} from "@lodestar/utils";
+import {InclusionListError, InclusionListErrorCode} from "../errors/inclusionList.js";
+import {GossipAction} from "../errors/index.js";
+import {IBeaconChain} from "../interface.js";
+import {RegenCaller} from "../regen/index.js";
+import {isValidDependentRoot} from "./proposerPreferences.js";
+
+export type InclusionListValidationResult = {
+  /** Positions of `validator_index` in `get_inclusion_list_committee(state, slot)`, several when the committee cycles */
+  committeeIndices: number[];
+  /** Sum of the byte lengths of `message.transactions` */
+  totalBytes: number;
+};
+
+/**
+ * Gossip validation for the `inclusion_list` topic, in spec rule order. Also applied to inclusion lists
+ * submitted over the API before they are published.
+ */
+export async function validateGossipInclusionList(
+  chain: IBeaconChain,
+  signedInclusionList: heze.SignedInclusionList
+): Promise<InclusionListValidationResult> {
+  const {slot, validatorIndex, transactions, dependentRoot} = signedInclusionList.message;
+  let totalBytes = 0;
+  for (let i = 0; i < transactions.length; i++) {
+    totalBytes += transactions.getSize(i);
+  }
+
+  // A pre-heze slot has no inclusion list committee to validate against
+  if (!isForkPostHeze(chain.config.getForkName(slot))) {
+    throw new InclusionListError(GossipAction.IGNORE, {
+      code: InclusionListErrorCode.PRE_HEZE_SLOT,
+      inclusionListSlot: slot,
+    });
+  }
+
+  // [IGNORE] The message is either the first or second valid message received from validatorIndex
+  // for (message.slot, message.dependent_root)
+  const dependentRootHex = toRootHex(dependentRoot);
+  if (chain.inclusionListStore.seenTwice(slot, dependentRootHex, validatorIndex)) {
+    throw new InclusionListError(GossipAction.IGNORE, {
+      code: InclusionListErrorCode.MORE_THAN_TWO,
+      validatorIndex,
+    });
+  }
+
+  // [IGNORE] message.slot is equal to the current slot, with a MAXIMUM_GOSSIP_CLOCK_DISPARITY allowance
+  if (!chain.clock.isCurrentSlotGivenGossipDisparity(slot)) {
+    throw new InclusionListError(GossipAction.IGNORE, {
+      code: InclusionListErrorCode.INVALID_SLOT,
+      inclusionListSlot: slot,
+      currentSlot: chain.clock.currentSlot,
+    });
+  }
+
+  // [IGNORE] The size of message.transactions is greater than 0
+  if (totalBytes === 0) {
+    throw new InclusionListError(GossipAction.IGNORE, {code: InclusionListErrorCode.EMPTY_TRANSACTIONS});
+  }
+
+  // [REJECT] The size of message.transactions is within upperbound MAX_TRANSACTIONS_BYTES_PER_INCLUSION_LIST
+  if (totalBytes > chain.config.MAX_TRANSACTIONS_BYTES_PER_INCLUSION_LIST) {
+    throw new InclusionListError(GossipAction.REJECT, {
+      code: InclusionListErrorCode.MAXIMUM_SIZE_EXCEEDED,
+      totalBytes,
+      maxBytes: chain.config.MAX_TRANSACTIONS_BYTES_PER_INCLUSION_LIST,
+    });
+  }
+
+  // [REJECT] Every transaction in message.transactions is non-empty
+  let emptyTransactionIndex = -1;
+  for (let i = 0; i < transactions.length; i++) {
+    if (transactions.getSize(i) === 0) {
+      emptyTransactionIndex = i;
+      break;
+    }
+  }
+  if (emptyTransactionIndex !== -1) {
+    throw new InclusionListError(GossipAction.REJECT, {
+      code: InclusionListErrorCode.EMPTY_TRANSACTION,
+      transactionIndex: emptyTransactionIndex,
+    });
+  }
+
+  // [IGNORE] The block with root message.dependent_root has been seen
+  const dependentBlock = chain.forkChoice.getBlockHexDefaultStatus(dependentRootHex);
+  if (dependentBlock === null) {
+    throw new InclusionListError(GossipAction.IGNORE, {
+      code: InclusionListErrorCode.UNKNOWN_DEPENDENT_ROOT,
+      dependentRoot: dependentRootHex,
+    });
+  }
+
+  // [REJECT] The slot of the block with root message.dependent_root is strictly less than
+  // compute_start_slot_at_epoch(compute_epoch_at_slot(message.slot) - MIN_SEED_LOOKAHEAD),
+  // clamped to genesis like compute_shuffling_dependent_slot
+  const epoch = computeEpochAtSlot(slot);
+  const dependentEpoch = epoch - MIN_SEED_LOOKAHEAD;
+  const maxDependentSlot = Math.max(GENESIS_SLOT, computeStartSlotAtEpoch(dependentEpoch) - 1);
+  if (dependentBlock.slot > maxDependentSlot) {
+    throw new InclusionListError(GossipAction.REJECT, {
+      code: InclusionListErrorCode.INVALID_DEPENDENT_ROOT_SLOT,
+      dependentRoot: dependentRootHex,
+      dependentSlot: dependentBlock.slot,
+      maxSlot: maxDependentSlot,
+    });
+  }
+
+  // [IGNORE] is_valid_dependent_root(store, message.dependent_root, epoch - MIN_SEED_LOOKAHEAD)
+  if (!isValidDependentRoot(chain.forkChoice, dependentBlock, dependentEpoch)) {
+    throw new InclusionListError(GossipAction.IGNORE, {
+      code: InclusionListErrorCode.INVALID_DEPENDENT_ROOT,
+      dependentRoot: dependentRootHex,
+      epoch: dependentEpoch,
+    });
+  }
+
+  // [REJECT] validatorIndex is in get_inclusion_list_committee(state, message.slot), where state is the
+  // state of the block with root message.dependent_root, i.e. the shuffling of `epoch` keyed by `dependent_root`
+  const shuffling = await getShuffling(chain, epoch, dependentRootHex, dependentBlock);
+  if (shuffling === null) {
+    throw new InclusionListError(GossipAction.IGNORE, {
+      code: InclusionListErrorCode.MISSING_SHUFFLING,
+      dependentRoot: dependentRootHex,
+      epoch,
+    });
+  }
+  const committeeIndices = getInclusionListCommittee(shuffling, slot).getCommitteeIndices(validatorIndex);
+  if (committeeIndices.length === 0) {
+    throw new InclusionListError(GossipAction.REJECT, {
+      code: InclusionListErrorCode.VALIDATOR_NOT_IN_COMMITTEE,
+      validatorIndex,
+    });
+  }
+
+  // [REJECT] The signature is valid with respect to the validator's public key
+  // Domain from the list's own slot, so a list for the first Heze slot verifies while the clock is still in Gloas
+  const signatureSet = getInclusionListSignatureSet(chain.config, slot, signedInclusionList);
+  // With only 16 inclusion list committee members per slot, batching can delay gossip by 100ms.
+  // Verify without batching so inclusion lists can be forwarded sooner.
+  if (!(await chain.bls.verifySignatureSets([signatureSet], {batchable: false}))) {
+    throw new InclusionListError(GossipAction.REJECT, {code: InclusionListErrorCode.INVALID_SIGNATURE});
+  }
+
+  // Check again after the async validation so concurrent lists of the same validator cannot all pass
+  if (chain.inclusionListStore.seenTwice(slot, dependentRootHex, validatorIndex)) {
+    throw new InclusionListError(GossipAction.IGNORE, {
+      code: InclusionListErrorCode.MORE_THAN_TWO,
+      validatorIndex,
+    });
+  }
+  chain.inclusionListStore.markSeen(slot, dependentRootHex, validatorIndex);
+
+  return {committeeIndices, totalBytes};
+}
+
+/**
+ * The shuffling of `epoch` on the branch of `dependentBlock`. Usually cached from the head state; when the
+ * dependent block is the head across empty epochs that state has not reached the lookahead start slot, so
+ * the spec's `process_slots` step is a state regen
+ */
+async function getShuffling(
+  chain: IBeaconChain,
+  epoch: Epoch,
+  dependentRootHex: RootHex,
+  dependentBlock: ProtoBlock
+): Promise<EpochShuffling | null> {
+  const cached = await chain.shufflingCache.get(epoch, dependentRootHex);
+  if (cached !== null) {
+    return cached;
+  }
+  try {
+    return await chain.regenStateForAttestationVerification(
+      epoch,
+      dependentRootHex,
+      dependentBlock,
+      RegenCaller.validateGossipInclusionList
+    );
+  } catch {
+    return null;
+  }
+}

package/src/chain/validation/index.ts

@@ -3,6 +3,7 @@ export * from "./attestation.js";
 export * from "./attesterSlashing.js";
 export * from "./block.js";
 export * from "./blsToExecutionChange.js";
+export * from "./inclusionList.js";
 export * from "./proposerSlashing.js";
 export * from "./syncCommittee.js";
 export * from "./syncCommitteeContributionAndProof.js";

package/src/db/beacon.ts

@@ -30,6 +30,9 @@ import {
   VoluntaryExitRepository,
 } from "./repositories/index.js";
 
+/** Below this size, seeks over leftover legacy column data stay cheap */
+const LEGACY_DATA_COLUMNS_COMPACTION_MIN_BYTES = 1024 ** 3;
+
 export type BeaconDbOpts = {
   dataColumnDir: string;
   logger: Logger;
@@ -67,6 +70,7 @@ export class BeaconDb implements IBeaconDb {
   readonly dataColumns: IDataColumnStore;
   lastLegacyArchiveSlot: Slot | null = null;
   private readonly flatFileStore: FlatFileStore;
+  private readonly logger: Logger;
 
   constructor(
     config: ChainForkConfig,
@@ -100,6 +104,7 @@ export class BeaconDb implements IBeaconDb {
     this.syncCommittee = new SyncCommitteeRepository(config, db);
     this.syncCommitteeWitness = new SyncCommitteeWitnessRepository(config, db);
 
+    this.logger = opts.logger;
     this.flatFileStore = new FlatFileStore(opts.dataColumnDir, config, opts.logger, opts.metrics);
     this.dataColumns = new LegacyDataColumnStore(
       this.flatFileStore,
@@ -125,11 +130,50 @@ export class BeaconDb implements IBeaconDb {
     this.flatFileStore.setMetrics(flatFileStoreMetrics);
   }
 
+  /**
+   * Deletes made while an iterator held a snapshot can stay in the bottom LevelDB level, which `compactRange` never
+   * rewrites, so every seek into the legacy column buckets walks them. Writing a key at each end of the pruned range
+   * makes the compaction overlap those files and rewrite them.
+   */
+  async compactLegacyDataColumns(
+    prunedBeforeSlot: Slot,
+    minSizeBytes = LEGACY_DATA_COLUMNS_COMPACTION_MIN_BYTES
+  ): Promise<void> {
+    const archiveBucket = Bucket.allForks_dataColumnSidecarsArchive;
+    const start = encodeKey(Bucket.allForks_dataColumnSidecars, Buffer.alloc(0));
+    const end = encodeKey(archiveBucket, this.dataColumnSidecarArchive.getMinKeyRaw(prunedBeforeSlot));
+    const sizeBytes = await this.db.approximateSize(start, end);
+    if (sizeBytes < minSizeBytes) return;
+
+    // Column indices stay below 0xffff and hot column keys are shorter, so no sentinel matches a real key
+    const upperSentinel =
+      prunedBeforeSlot > 0
+        ? encodeKey(archiveBucket, this.dataColumnSidecarArchive.encodeKeyRaw(prunedBeforeSlot - 1, 0xffff))
+        : encodeKey(Bucket.allForks_dataColumnSidecars, Buffer.alloc(35, 0xff));
+    const sentinels = [start, upperSentinel];
+
+    this.logger.info("Compacting legacy data columns, this may take a while", {sizeBytes});
+    const startTime = Date.now();
+    await this.db.batchPut(sentinels.map((key) => ({key, value: new Uint8Array()})));
+    await this.db.compactRange(start, end);
+    await this.db.batchDelete(sentinels);
+    await this.db.compactRange(start, end);
+    this.logger.verbose("Compacted legacy data columns", {
+      durationMs: Date.now() - startTime,
+      sizeBytes: await this.db.approximateSize(start, end),
+    });
+  }
+
   async pruneHotDb(): Promise<void> {
     // Prune all hot blobs
     await this.blobSidecars.batchDelete(await this.blobSidecars.keys());
     // New columns are persisted in flat files, so this bucket only contains legacy hot data.
     await this.deleteBucketData(Bucket.allForks_dataColumnSidecars);
+    // Compact even if empty to reclaim tombstones left by previous startups.
+    await this.db.compactRange(
+      encodeKey(Bucket.allForks_dataColumnSidecars, Buffer.alloc(0)),
+      encodeKey(Bucket.allForks_dataColumnSidecars + 1, Buffer.alloc(0))
+    );
     // Prune all hot blocks
     // TODO: Enable once it's deemed safe
     // await this.block.batchDelete(await this.block.keys());

package/src/db/dataColumnStore.ts

@@ -13,7 +13,7 @@ export type IndexedDataColumnBytes = {index: ColumnIndex; data: Uint8Array};
 type LegacyHotDataColumnStore = Pick<DataColumnSidecarRepository, "values" | "getManyBinary" | "deleteMany">;
 type LegacyArchiveDataColumnStore = Pick<
   DataColumnSidecarArchiveRepository,
-  "values" | "getManyBinary" | "keys" | "deleteMany"
+  "values" | "getManyBinary" | "pruneBefore"
 >;
 type BlockRootIndex = Pick<BlockArchiveRepository, "getSlotByRoot">;
 
@@ -86,9 +86,7 @@ export class LegacyDataColumnStore implements IDataColumnStore {
 
   async pruneBefore(slot: Slot): Promise<Slot[]> {
     const flatFileSlots = await this.flatFiles.pruneBefore(slot);
-    const prefixedKeys = await this.legacyArchive.keys({lt: {prefix: slot, id: 0}});
-    const slots = [...new Set(prefixedKeys.map(({prefix}) => prefix))];
-    if (slots.length > 0) await this.legacyArchive.deleteMany(slots);
+    const slots = await this.legacyArchive.pruneBefore(slot);
     return [...new Set([...flatFileSlots, ...slots])].sort((a, b) => a - b);
   }
 }

package/src/db/interface.ts

@@ -68,6 +68,8 @@ export interface IBeaconDb {
   readonly lastLegacyArchiveSlot: Slot | null;
   init(): Promise<void>;
 
+  compactLegacyDataColumns(prunedBeforeSlot: Slot, minSizeBytes?: number): Promise<void>;
+
   pruneHotDb(): Promise<void>;
 
   deleteDeprecatedEth1Data(): Promise<void>;

package/src/db/repositories/dataColumnSidecarArchive.ts

@@ -15,6 +15,8 @@ const SLOT_BYTE_SIZE = 8;
  * Indexed data by `slot` + `columnIndex`
  */
 export class DataColumnSidecarArchiveRepository extends PrefixedRepository<Slot, ColumnIndex, DataColumnSidecar> {
+  private prunedBeforeSlot: Slot | null = null;
+
   constructor(config: ChainForkConfig, db: Db) {
     const bucket = Bucket.allForks_dataColumnSidecarsArchive;
     // Type won't be used since we select it dynamically based on fork
@@ -70,4 +72,22 @@ export class DataColumnSidecarArchiveRepository extends PrefixedRepository<Slot,
       encodeNumberForDbKey(0, COLUMN_INDEX_BYTE_SIZE),
     ]);
   }
+
+  /**
+   * Deletes all entries before `slot`. Prunes only delete from the start of the bucket, so the first prune
+   * compacts the range to drop tombstones of earlier runs and later prunes resume where the previous one ended.
+   */
+  async pruneBefore(slot: Slot): Promise<Slot[]> {
+    if (this.prunedBeforeSlot === null) {
+      await this.db.compactRange(this.wrapKey(this.getMinKeyRaw(0)), this.wrapKey(this.getMinKeyRaw(slot)));
+    } else if (slot <= this.prunedBeforeSlot) {
+      return [];
+    }
+
+    const keys = await this.keys({gte: {prefix: this.prunedBeforeSlot ?? 0, id: 0}, lt: {prefix: slot, id: 0}});
+    const slots = [...new Set(keys.map(({prefix}) => prefix))];
+    if (slots.length > 0) await this.deleteMany(slots);
+    this.prunedBeforeSlot = slot;
+    return slots;
+  }
 }

package/src/execution/builder/validateBid.ts

@@ -1,6 +1,6 @@
 import {routes} from "@lodestar/api";
 import {ProtoBlock} from "@lodestar/fork-choice";
-import {MAX_EXECUTION_PAYMENT, PAYLOAD_BUILDER_VERSION} from "@lodestar/params";
+import {MAX_EXECUTION_PAYMENT, PAYLOAD_BUILDER_VERSION, isForkPostHeze} from "@lodestar/params";
 import {
   computeEpochAtSlot,
   createSingleSignatureSetFromComponents,
@@ -9,7 +9,7 @@ import {
   isGasLimitTargetCompatible,
   isStatePostGloas,
 } from "@lodestar/state-transition";
-import {RootHex, Slot, gloas} from "@lodestar/types";
+import {RootHex, Slot, gloas, heze} from "@lodestar/types";
 import {bigIntMin, byteArrayEquals, prettyGweiToEth, toHex, toRootHex} from "@lodestar/utils";
 import {IBeaconChain} from "../../chain/index.js";
 import {RegenCaller} from "../../chain/regen/index.js";
@@ -41,6 +41,7 @@ export async function validateBuilderApiExecutionPayloadBid(
   }
 ): Promise<void> {
   const bid = signedExecutionPayloadBid.message;
+  const fork = chain.config.getForkName(bid.slot);
   const {slot, parentBlock, parentBlockHash, parentBlockRoot, entry, getParentExecutionRequests} = request;
 
   if (bid.slot !== slot) {
@@ -76,6 +77,26 @@ export async function validateBuilderApiExecutionPayloadBid(
     );
   }
 
+  // Same check as bid gossip (only_timely=True), not the proposer's full view from validator.md: a list released
+  // after the deadline would void every bid, and a high bid that went stale after gossip could crowd out the rest unpaid
+  if (isForkPostHeze(fork)) {
+    const {inclusionListBits} = bid as heze.ExecutionPayloadBid;
+    const inclusionListSlot = bid.slot - 1;
+    const dependentRoot = getShufflingDependentRoot(
+      chain.forkChoice,
+      computeEpochAtSlot(inclusionListSlot),
+      computeEpochAtSlot(parentBlock.slot),
+      parentBlock
+    );
+    if (!chain.inclusionListStore.isInclusionListBitsInclusive(inclusionListSlot, dependentRoot, inclusionListBits)) {
+      const expectedBits = chain.inclusionListStore.getInclusionListBits(inclusionListSlot, dependentRoot);
+      throw Error(
+        `Bid inclusionListBits=${toHex(inclusionListBits.uint8Array)} is not inclusive of ` +
+          `timely inclusion lists expected=${toHex(expectedBits.uint8Array)}`
+      );
+    }
+  }
+
   const state = await chain.regen
     .getBlockSlotState(parentBlock, slot, {dontTransferCache: true}, RegenCaller.validateGossipExecutionPayloadBid)
     .catch((e: Error) => {

package/src/execution/engine/blobVersionedHashes.ts

@@ -7,7 +7,7 @@ import {VersionedHashes} from "./interface.js";
  * Skip unrelated fields without decoding or copying them, including untrusted nested access lists.
  * The EL remains responsible for the other transaction validity checks.
  */
-export function isValidBlobVersionedHashes(transactions: Uint8Array[], expected: VersionedHashes): boolean {
+export function isValidBlobVersionedHashes(transactions: Iterable<Uint8Array>, expected: VersionedHashes): boolean {
   let index = 0;
   for (const transaction of transactions) {
     if (transaction.length === 0) return false;

package/src/execution/engine/disabled.ts

@@ -28,4 +28,8 @@ export class ExecutionEngineDisabled implements IExecutionEngine {
   getBlobs(): Promise<never> {
     throw Error("Execution engine disabled");
   }
+
+  getInclusionList(): Promise<never> {
+    throw Error("Execution engine disabled");
+  }
 }