@lodestar/state-transition 1.45.0 → 1.46.0-dev.4191d8e353

package/src/lightClient/spec/utils.ts

@@ -1,16 +1,25 @@
 import {PublicKey} from "@chainsafe/blst";
+import {Tree} from "@chainsafe/persistent-merkle-tree";
 import {BitArray} from "@chainsafe/ssz";
 import {ChainForkConfig} from "@lodestar/config";
 import {
-  BLOCK_BODY_EXECUTION_PAYLOAD_DEPTH as EXECUTION_PAYLOAD_DEPTH,
-  BLOCK_BODY_EXECUTION_PAYLOAD_INDEX as EXECUTION_PAYLOAD_INDEX,
-  FINALIZED_ROOT_DEPTH,
-  FINALIZED_ROOT_DEPTH_ELECTRA,
+  BLOCK_BODY_EXECUTION_PAYLOAD_GINDEX,
+  CURRENT_SYNC_COMMITTEE_GINDEX,
+  CURRENT_SYNC_COMMITTEE_GINDEX_ELECTRA,
+  CURRENT_SYNC_COMMITTEE_GINDEX_GLOAS,
+  EXECUTION_BLOCK_HASH_GINDEX,
+  EXECUTION_BLOCK_HASH_GINDEX_DENEB,
+  EXECUTION_BLOCK_HASH_GINDEX_GLOAS,
+  FINALIZED_ROOT_GINDEX,
+  FINALIZED_ROOT_GINDEX_ELECTRA,
+  FINALIZED_ROOT_GINDEX_GLOAS,
   ForkName,
   ForkSeq,
-  NEXT_SYNC_COMMITTEE_DEPTH,
-  NEXT_SYNC_COMMITTEE_DEPTH_ELECTRA,
+  NEXT_SYNC_COMMITTEE_GINDEX,
+  NEXT_SYNC_COMMITTEE_GINDEX_ELECTRA,
+  NEXT_SYNC_COMMITTEE_GINDEX_GLOAS,
   isForkPostElectra,
+  isForkPostGloas,
 } from "@lodestar/params";
 import {
   BeaconBlockHeader,
@@ -29,7 +38,6 @@ import type {LightClientStore, SyncCommitteeFast} from "./store.js";
 
 export const GENESIS_SLOT = 0;
 export const ZERO_HASH = new Uint8Array(32);
-export const ZERO_PUBKEY = new Uint8Array(48);
 export const ZERO_SYNC_COMMITTEE = ssz.altair.SyncCommittee.defaultValue();
 export const ZERO_HEADER = ssz.phase0.BeaconBlockHeader.defaultValue();
 /** From https://notes.ethereum.org/@vbuterin/extended_light_client_protocol#Optimistic-head-determining-function */
@@ -74,17 +82,11 @@ export function getSafetyThreshold(maxActiveParticipants: number): number {
 }
 
 export function getZeroSyncCommitteeBranch(fork: ForkName): Uint8Array[] {
-  const nextSyncCommitteeDepth = isForkPostElectra(fork)
-    ? NEXT_SYNC_COMMITTEE_DEPTH_ELECTRA
-    : NEXT_SYNC_COMMITTEE_DEPTH;
-
-  return Array.from({length: nextSyncCommitteeDepth}, () => ZERO_HASH);
+  return Array.from({length: getGindexDepth(nextSyncCommitteeGindexAtFork(fork))}, () => ZERO_HASH);
 }
 
 export function getZeroFinalityBranch(fork: ForkName): Uint8Array[] {
-  const finalizedRootDepth = isForkPostElectra(fork) ? FINALIZED_ROOT_DEPTH_ELECTRA : FINALIZED_ROOT_DEPTH;
-
-  return Array.from({length: finalizedRootDepth}, () => ZERO_HASH);
+  return Array.from({length: getGindexDepth(finalizedRootGindexAtFork(fork))}, () => ZERO_HASH);
 }
 
 export function isSyncCommitteeUpdate(update: LightClientUpdate): boolean {
@@ -106,13 +108,16 @@ export function isFinalityUpdate(update: LightClientUpdate): boolean {
 }
 
 export function isZeroedHeader(header: BeaconBlockHeader): boolean {
-  // Fast return for when constructing full LightClientUpdate from partial updates
-  return header === ZERO_HEADER || byteArrayEquals(header.bodyRoot, ZERO_HASH);
+  // Spec requires the whole header to equal LightClientHeader() in the non-finality case
+  // (see altair/light-client/sync-protocol.md `process_light_client_update`). Checking only
+  // bodyRoot would let an attacker smuggle arbitrary slot/proposerIndex/parentRoot/stateRoot
+  // through the non-finality branch and overwrite store.finalizedHeader.
+  return header === ZERO_HEADER || ssz.phase0.BeaconBlockHeader.equals(header, ZERO_HEADER);
 }
 
 export function isZeroedSyncCommittee(syncCommittee: SyncCommittee): boolean {
-  // Fast return for when constructing full LightClientUpdate from partial updates
-  return syncCommittee === ZERO_SYNC_COMMITTEE || byteArrayEquals(syncCommittee.pubkeys[0], ZERO_PUBKEY);
+  // Spec requires the whole SyncCommittee to equal SyncCommittee() in the non-sync-committee-update case.
+  return syncCommittee === ZERO_SYNC_COMMITTEE || ssz.altair.SyncCommittee.equals(syncCommittee, ZERO_SYNC_COMMITTEE);
 }
 
 export function isValidMerkleBranch(
@@ -129,12 +134,73 @@ export function isValidMerkleBranch(
   return verifyMerkleBranch(leaf, branch, depth, index, root);
 }
 
-export function normalizeMerkleBranch(branch: Uint8Array[], depth: number): Uint8Array[] {
+export function isValidNormalizedMerkleBranch(
+  leaf: Uint8Array,
+  branch: Uint8Array[],
+  gindex: number,
+  root: Uint8Array
+): boolean {
+  const depth = getGindexDepth(gindex);
+  const index = getGindexIndex(gindex);
+  const numExtraDepth = branch.length - depth;
+  if (numExtraDepth < 0) {
+    return false;
+  }
+
+  for (let i = 0; i < numExtraDepth; i++) {
+    if (!byteArrayEquals(branch[i], ZERO_HASH)) {
+      return false;
+    }
+  }
+
+  return isValidMerkleBranch(leaf, branch.slice(numExtraDepth), depth, index, root);
+}
+
+export function normalizeMerkleBranch(branch: Uint8Array[], gindex: number): Uint8Array[] {
+  const depth = getGindexDepth(gindex);
   const numExtraDepth = depth - branch.length;
 
   return [...Array.from({length: numExtraDepth}, () => ZERO_HASH), ...branch];
 }
 
+export function currentSyncCommitteeGindexAtFork(fork: ForkName): number {
+  if (isForkPostGloas(fork)) {
+    return CURRENT_SYNC_COMMITTEE_GINDEX_GLOAS;
+  }
+  if (isForkPostElectra(fork)) {
+    return CURRENT_SYNC_COMMITTEE_GINDEX_ELECTRA;
+  }
+  return CURRENT_SYNC_COMMITTEE_GINDEX;
+}
+
+export function finalizedRootGindexAtFork(fork: ForkName): number {
+  if (isForkPostGloas(fork)) {
+    return FINALIZED_ROOT_GINDEX_GLOAS;
+  }
+  if (isForkPostElectra(fork)) {
+    return FINALIZED_ROOT_GINDEX_ELECTRA;
+  }
+  return FINALIZED_ROOT_GINDEX;
+}
+
+export function nextSyncCommitteeGindexAtFork(fork: ForkName): number {
+  if (isForkPostGloas(fork)) {
+    return NEXT_SYNC_COMMITTEE_GINDEX_GLOAS;
+  }
+  if (isForkPostElectra(fork)) {
+    return NEXT_SYNC_COMMITTEE_GINDEX_ELECTRA;
+  }
+  return NEXT_SYNC_COMMITTEE_GINDEX;
+}
+
+export function getGindexDepth(gindex: number): number {
+  return Math.floor(Math.log2(gindex));
+}
+
+export function getGindexIndex(gindex: number): number {
+  return gindex - 2 ** getGindexDepth(gindex);
+}
+
 export function upgradeLightClientHeader(
   config: ChainForkConfig,
   targetFork: ForkName,
@@ -147,7 +213,7 @@ export function upgradeLightClientHeader(
 
   // We are modifying the same header object, may be we could create a copy, but its
   // not required as of now
-  const upgradedHeader = header;
+  let upgradedHeader = header;
   const startUpgradeFromFork = Object.values(ForkName)[ForkSeq[headerFork] + 1];
 
   switch (startUpgradeFromFork) {
@@ -198,7 +264,11 @@ export function upgradeLightClientHeader(
       if (ForkSeq[targetFork] <= ForkSeq.fulu) break;
 
     case ForkName.gloas:
-      // No changes to LightClientHeader in Gloas
+      if (isGloasLightClientHeader(upgradedHeader)) {
+        break;
+      }
+
+      upgradedHeader = upgradeLightClientHeaderToGloas(config, upgradedHeader as LightClientHeader<ForkName.electra>);
 
       // Break if no further upgrades is required else fall through
       if (ForkSeq[targetFork] <= ForkSeq.gloas) break;
@@ -209,6 +279,40 @@ export function upgradeLightClientHeader(
 export function isValidLightClientHeader(config: ChainForkConfig, header: LightClientHeader): boolean {
   const epoch = computeEpochAtSlot(header.beacon.slot);
 
+  if (isGloasLightClientHeader(header)) {
+    if (epoch >= config.GLOAS_FORK_EPOCH) {
+      return isValidNormalizedMerkleBranch(
+        header.executionBlockHash,
+        header.executionBranch,
+        EXECUTION_BLOCK_HASH_GINDEX_GLOAS,
+        header.beacon.bodyRoot
+      );
+    }
+
+    if (epoch >= config.DENEB_FORK_EPOCH) {
+      return isValidNormalizedMerkleBranch(
+        header.executionBlockHash,
+        header.executionBranch,
+        EXECUTION_BLOCK_HASH_GINDEX_DENEB,
+        header.beacon.bodyRoot
+      );
+    }
+
+    if (epoch >= config.CAPELLA_FORK_EPOCH) {
+      return isValidNormalizedMerkleBranch(
+        header.executionBlockHash,
+        header.executionBranch,
+        EXECUTION_BLOCK_HASH_GINDEX,
+        header.beacon.bodyRoot
+      );
+    }
+
+    return (
+      byteArrayEquals(header.executionBlockHash, ZERO_HASH) &&
+      header.executionBranch.every((node) => byteArrayEquals(node, ZERO_HASH))
+    );
+  }
+
   if (epoch < config.CAPELLA_FORK_EPOCH) {
     return (
       ((header as LightClientHeader<ForkName.capella>).execution === undefined ||
@@ -239,8 +343,8 @@ export function isValidLightClientHeader(config: ChainForkConfig, header: LightC
       .getPostBellatrixForkTypes(header.beacon.slot)
       .ExecutionPayloadHeader.hashTreeRoot((header as LightClientHeader<ForkName.capella>).execution),
     (header as LightClientHeader<ForkName.capella>).executionBranch,
-    EXECUTION_PAYLOAD_DEPTH,
-    EXECUTION_PAYLOAD_INDEX,
+    getGindexDepth(BLOCK_BODY_EXECUTION_PAYLOAD_GINDEX),
+    getGindexIndex(BLOCK_BODY_EXECUTION_PAYLOAD_GINDEX),
     header.beacon.bodyRoot
   );
 }
@@ -254,12 +358,9 @@ export function upgradeLightClientUpdate(
   update.finalizedHeader = upgradeLightClientHeader(config, targetFork, update.finalizedHeader);
   update.nextSyncCommitteeBranch = normalizeMerkleBranch(
     update.nextSyncCommitteeBranch,
-    isForkPostElectra(targetFork) ? NEXT_SYNC_COMMITTEE_DEPTH_ELECTRA : NEXT_SYNC_COMMITTEE_DEPTH
-  );
-  update.finalityBranch = normalizeMerkleBranch(
-    update.finalityBranch,
-    isForkPostElectra(targetFork) ? FINALIZED_ROOT_DEPTH_ELECTRA : FINALIZED_ROOT_DEPTH
+    nextSyncCommitteeGindexAtFork(targetFork)
   );
+  update.finalityBranch = normalizeMerkleBranch(update.finalityBranch, finalizedRootGindexAtFork(targetFork));
 
   return update;
 }
@@ -273,7 +374,7 @@ export function upgradeLightClientFinalityUpdate(
   finalityUpdate.finalizedHeader = upgradeLightClientHeader(config, targetFork, finalityUpdate.finalizedHeader);
   finalityUpdate.finalityBranch = normalizeMerkleBranch(
     finalityUpdate.finalityBranch,
-    isForkPostElectra(targetFork) ? FINALIZED_ROOT_DEPTH_ELECTRA : FINALIZED_ROOT_DEPTH
+    finalizedRootGindexAtFork(targetFork)
   );
 
   return finalityUpdate;
@@ -315,3 +416,72 @@ export function upgradeLightClientStore(
 
   return store;
 }
+
+function isGloasLightClientHeader(header: LightClientHeader): header is LightClientHeader<ForkName.gloas> {
+  return (header as LightClientHeader<ForkName.gloas>).executionBlockHash !== undefined;
+}
+
+function upgradeLightClientHeaderToGloas(
+  config: ChainForkConfig,
+  pre: LightClientHeader<ForkName.electra>
+): LightClientHeader<ForkName.gloas> {
+  if (ssz.electra.LightClientHeader.equals(pre, ssz.electra.LightClientHeader.defaultValue())) {
+    return ssz.gloas.LightClientHeader.defaultValue();
+  }
+
+  const epoch = computeEpochAtSlot(pre.beacon.slot);
+
+  if (epoch >= config.DENEB_FORK_EPOCH) {
+    const blockHashGindex = ssz.deneb.ExecutionPayloadHeader.getPathInfo(["blockHash"]).gindex;
+    const executionBranch = new Tree(ssz.deneb.ExecutionPayloadHeader.toView(pre.execution).node).getSingleProof(
+      blockHashGindex
+    );
+
+    return {
+      beacon: pre.beacon,
+      executionBlockHash: pre.execution.blockHash,
+      executionBranch: normalizeMerkleBranch(
+        [...executionBranch, ...pre.executionBranch],
+        EXECUTION_BLOCK_HASH_GINDEX_GLOAS
+      ),
+    };
+  }
+
+  if (epoch >= config.CAPELLA_FORK_EPOCH) {
+    const executionHeader = {
+      parentHash: pre.execution.parentHash,
+      feeRecipient: pre.execution.feeRecipient,
+      stateRoot: pre.execution.stateRoot,
+      receiptsRoot: pre.execution.receiptsRoot,
+      logsBloom: pre.execution.logsBloom,
+      prevRandao: pre.execution.prevRandao,
+      blockNumber: pre.execution.blockNumber,
+      gasLimit: pre.execution.gasLimit,
+      gasUsed: pre.execution.gasUsed,
+      timestamp: pre.execution.timestamp,
+      extraData: pre.execution.extraData,
+      baseFeePerGas: pre.execution.baseFeePerGas,
+      blockHash: pre.execution.blockHash,
+      transactionsRoot: pre.execution.transactionsRoot,
+      withdrawalsRoot: pre.execution.withdrawalsRoot,
+    };
+    const blockHashGindex = ssz.capella.ExecutionPayloadHeader.getPathInfo(["blockHash"]).gindex;
+    const executionBranch = new Tree(ssz.capella.ExecutionPayloadHeader.toView(executionHeader).node).getSingleProof(
+      blockHashGindex
+    );
+
+    return {
+      beacon: pre.beacon,
+      executionBlockHash: executionHeader.blockHash,
+      executionBranch: normalizeMerkleBranch(
+        [...executionBranch, ...pre.executionBranch],
+        EXECUTION_BLOCK_HASH_GINDEX_GLOAS
+      ),
+    };
+  }
+
+  return {
+    ...ssz.gloas.LightClientHeader.defaultValue(),
+    beacon: pre.beacon,
+  };
+}

package/src/lightClient/spec/validateLightClientBootstrap.ts

@@ -1,13 +1,7 @@
 import {ChainForkConfig} from "@lodestar/config";
-import {isForkPostElectra} from "@lodestar/params";
 import {LightClientBootstrap, Root, ssz} from "@lodestar/types";
 import {byteArrayEquals, toHex} from "@lodestar/utils";
-import {isValidLightClientHeader, isValidMerkleBranch} from "./utils.js";
-
-const CURRENT_SYNC_COMMITTEE_INDEX = 22;
-const CURRENT_SYNC_COMMITTEE_DEPTH = 5;
-const CURRENT_SYNC_COMMITTEE_INDEX_ELECTRA = 22;
-const CURRENT_SYNC_COMMITTEE_DEPTH_ELECTRA = 6;
+import {currentSyncCommitteeGindexAtFork, isValidLightClientHeader, isValidNormalizedMerkleBranch} from "./utils.js";
 
 export function validateLightClientBootstrap(
   config: ChainForkConfig,
@@ -26,11 +20,10 @@ export function validateLightClientBootstrap(
   }
 
   if (
-    !isValidMerkleBranch(
+    !isValidNormalizedMerkleBranch(
       ssz.altair.SyncCommittee.hashTreeRoot(bootstrap.currentSyncCommittee),
       bootstrap.currentSyncCommitteeBranch,
-      isForkPostElectra(fork) ? CURRENT_SYNC_COMMITTEE_DEPTH_ELECTRA : CURRENT_SYNC_COMMITTEE_DEPTH,
-      isForkPostElectra(fork) ? CURRENT_SYNC_COMMITTEE_INDEX_ELECTRA : CURRENT_SYNC_COMMITTEE_INDEX,
+      currentSyncCommitteeGindexAtFork(fork),
       bootstrap.header.beacon.stateRoot
     )
   ) {

package/src/lightClient/spec/validateLightClientUpdate.ts

@@ -1,29 +1,19 @@
 import {PublicKey, Signature, fastAggregateVerify} from "@chainsafe/blst";
 import {ChainForkConfig} from "@lodestar/config";
-import {
-  DOMAIN_SYNC_COMMITTEE,
-  FINALIZED_ROOT_DEPTH,
-  FINALIZED_ROOT_DEPTH_ELECTRA,
-  FINALIZED_ROOT_INDEX,
-  FINALIZED_ROOT_INDEX_ELECTRA,
-  GENESIS_SLOT,
-  MIN_SYNC_COMMITTEE_PARTICIPANTS,
-  NEXT_SYNC_COMMITTEE_DEPTH,
-  NEXT_SYNC_COMMITTEE_DEPTH_ELECTRA,
-  NEXT_SYNC_COMMITTEE_INDEX,
-  NEXT_SYNC_COMMITTEE_INDEX_ELECTRA,
-} from "@lodestar/params";
-import {LightClientUpdate, Root, isElectraLightClientUpdate, ssz} from "@lodestar/types";
+import {DOMAIN_SYNC_COMMITTEE, GENESIS_SLOT, MIN_SYNC_COMMITTEE_PARTICIPANTS} from "@lodestar/params";
+import {LightClientUpdate, Root, ssz} from "@lodestar/types";
 import type {ILightClientStore, SyncCommitteeFast} from "./store.js";
 import {
   ZERO_HASH,
+  finalizedRootGindexAtFork,
   getParticipantPubkeys,
   isFinalityUpdate,
   isSyncCommitteeUpdate,
   isValidLightClientHeader,
-  isValidMerkleBranch,
+  isValidNormalizedMerkleBranch,
   isZeroedHeader,
   isZeroedSyncCommittee,
+  nextSyncCommitteeGindexAtFork,
   sumBits,
 } from "./utils.js";
 
@@ -33,6 +23,8 @@ export function validateLightClientUpdate(
   update: LightClientUpdate,
   syncCommittee: SyncCommitteeFast
 ): void {
+  const attestedFork = config.getForkName(update.attestedHeader.beacon.slot);
+
   // Verify sync committee has sufficient participants
   if (sumBits(update.syncAggregate.syncCommitteeBits) < MIN_SYNC_COMMITTEE_PARTICIPANTS) {
     throw Error("Sync committee has not sufficient participants");
@@ -78,11 +70,10 @@ export function validateLightClientUpdate(
     }
 
     if (
-      !isValidMerkleBranch(
+      !isValidNormalizedMerkleBranch(
         finalizedRoot,
         update.finalityBranch,
-        isElectraLightClientUpdate(update) ? FINALIZED_ROOT_DEPTH_ELECTRA : FINALIZED_ROOT_DEPTH,
-        isElectraLightClientUpdate(update) ? FINALIZED_ROOT_INDEX_ELECTRA : FINALIZED_ROOT_INDEX,
+        finalizedRootGindexAtFork(attestedFork),
         update.attestedHeader.beacon.stateRoot
       )
     ) {
@@ -98,11 +89,10 @@ export function validateLightClientUpdate(
     }
   } else {
     if (
-      !isValidMerkleBranch(
+      !isValidNormalizedMerkleBranch(
         ssz.altair.SyncCommittee.hashTreeRoot(update.nextSyncCommittee),
         update.nextSyncCommitteeBranch,
-        isElectraLightClientUpdate(update) ? NEXT_SYNC_COMMITTEE_DEPTH_ELECTRA : NEXT_SYNC_COMMITTEE_DEPTH,
-        isElectraLightClientUpdate(update) ? NEXT_SYNC_COMMITTEE_INDEX_ELECTRA : NEXT_SYNC_COMMITTEE_INDEX,
+        nextSyncCommitteeGindexAtFork(attestedFork),
         update.attestedHeader.beacon.stateRoot
       )
     ) {

package/src/lightClient/types.ts

@@ -26,8 +26,10 @@
  * ```
  */
 export type SyncCommitteeWitness = {
-  /** Vector[Bytes32, 4] or Vector[Bytes32, 5] depending on the fork */
+  /** Shared witness for pre-Gloas forks where current and next sync committees are siblings. */
   witness: Uint8Array[];
   currentSyncCommitteeRoot: Uint8Array;
   nextSyncCommitteeRoot: Uint8Array;
+  currentSyncCommitteeBranch?: Uint8Array[];
+  nextSyncCommitteeBranch?: Uint8Array[];
 };

package/src/metrics.ts

@@ -159,11 +159,9 @@ export function onPostStateMetrics(postState: CachedBeaconStateAllForks, metrics
 // This cache is populated during epoch transition, and should be preserved for performance.
 // If the cache is missing too often, means that our clone strategy is not working well.
 function isValidatorsNodesPopulated(state: CachedBeaconStateAllForks): boolean {
-  // biome-ignore lint/complexity/useLiteralKeys: It is a private attribute
-  return state.validators["nodesPopulated"] === true;
+  return (state.validators as unknown as {nodesPopulated?: boolean}).nodesPopulated === true;
 }
 
 function isBalancesNodesPopulated(state: CachedBeaconStateAllForks): boolean {
-  // biome-ignore lint/complexity/useLiteralKeys: It is a private attribute
-  return state.balances["nodesPopulated"] === true;
+  return (state.balances as unknown as {nodesPopulated?: boolean}).nodesPopulated === true;
 }

package/src/slot/upgradeStateToAltair.ts

@@ -131,7 +131,7 @@ function translateParticipation(
 
   for (const attestation of pendingAttesations.getAllReadonly()) {
     const data = attestation.data;
-    const attestationFlags = getAttestationParticipationStatus(
+    const {flags: attestationFlags} = getAttestationParticipationStatus(
       ForkSeq.altair,
       data,
       attestation.inclusionDelay,

package/src/slot/upgradeStateToGloas.ts

@@ -1,3 +1,15 @@
+import {getNodesAtDepth} from "@chainsafe/persistent-merkle-tree";
+import {
+  BasicType,
+  CompositeType,
+  CompositeView,
+  CompositeViewDU,
+  ListBasicTreeViewDU,
+  ListCompositeTreeViewDU,
+  ProgressiveListBasicType,
+  ProgressiveListCompositeType,
+  ValueOf,
+} from "@chainsafe/ssz";
 import {PAYLOAD_BUILDER_VERSION, SLOTS_PER_HISTORICAL_ROOT} from "@lodestar/params";
 import {ssz} from "@lodestar/types";
 import {toPubkeyHex} from "@lodestar/utils";
@@ -7,6 +19,7 @@ import {CachedBeaconStateFulu, CachedBeaconStateGloas} from "../types.js";
 import {addBuilderToRegistry, initializePtcWindow, isBuilderWithdrawalCredential} from "../util/gloas.js";
 import {isValidatorKnown} from "../util/index.js";
 import {PendingDepositsLookup} from "../util/pendingDepositsLookup.js";
+import {progressiveListRootNode} from "../util/ssz.js";
 
 /**
  * Upgrade a state from Fulu to Gloas.
@@ -34,17 +47,26 @@ export function upgradeStateToGloas(stateFulu: CachedBeaconStateFulu): CachedBea
   stateGloasView.eth1Data = stateGloasCloned.eth1Data;
   stateGloasView.eth1DataVotes = stateGloasCloned.eth1DataVotes;
   stateGloasView.eth1DepositIndex = stateGloasCloned.eth1DepositIndex;
-  stateGloasView.validators = stateGloasCloned.validators;
-  stateGloasView.balances = stateGloasCloned.balances;
+  stateGloasView.validators = migrateCompositeListToGloas(stateGloasCloned.validators, ssz.gloas.Validators);
+  stateGloasView.balances = migrateBasicListToGloas(stateGloasCloned.balances, ssz.gloas.Balances);
   stateGloasView.randaoMixes = stateGloasCloned.randaoMixes;
   stateGloasView.slashings = stateGloasCloned.slashings;
-  stateGloasView.previousEpochParticipation = stateGloasCloned.previousEpochParticipation;
-  stateGloasView.currentEpochParticipation = stateGloasCloned.currentEpochParticipation;
+  stateGloasView.previousEpochParticipation = migrateBasicListToGloas(
+    stateGloasCloned.previousEpochParticipation,
+    ssz.gloas.EpochParticipation
+  );
+  stateGloasView.currentEpochParticipation = migrateBasicListToGloas(
+    stateGloasCloned.currentEpochParticipation,
+    ssz.gloas.EpochParticipation
+  );
   stateGloasView.justificationBits = stateGloasCloned.justificationBits;
   stateGloasView.previousJustifiedCheckpoint = stateGloasCloned.previousJustifiedCheckpoint;
   stateGloasView.currentJustifiedCheckpoint = stateGloasCloned.currentJustifiedCheckpoint;
   stateGloasView.finalizedCheckpoint = stateGloasCloned.finalizedCheckpoint;
-  stateGloasView.inactivityScores = stateGloasCloned.inactivityScores;
+  stateGloasView.inactivityScores = migrateBasicListToGloas(
+    stateGloasCloned.inactivityScores,
+    ssz.gloas.InactivityScores
+  );
   stateGloasView.currentSyncCommittee = stateGloasCloned.currentSyncCommittee;
   stateGloasView.nextSyncCommittee = stateGloasCloned.nextSyncCommittee;
   stateGloasView.latestExecutionPayloadBid.blockHash = stateFulu.latestExecutionPayloadHeader.blockHash;
@@ -61,9 +83,18 @@ export function upgradeStateToGloas(stateFulu: CachedBeaconStateFulu): CachedBea
   stateGloasView.earliestExitEpoch = stateGloasCloned.earliestExitEpoch;
   stateGloasView.consolidationBalanceToConsume = stateGloasCloned.consolidationBalanceToConsume;
   stateGloasView.earliestConsolidationEpoch = stateGloasCloned.earliestConsolidationEpoch;
-  stateGloasView.pendingDeposits = stateGloasCloned.pendingDeposits;
-  stateGloasView.pendingPartialWithdrawals = stateGloasCloned.pendingPartialWithdrawals;
-  stateGloasView.pendingConsolidations = stateGloasCloned.pendingConsolidations;
+  stateGloasView.pendingDeposits = migrateCompositeListToGloas(
+    stateGloasCloned.pendingDeposits,
+    ssz.gloas.PendingDeposits
+  );
+  stateGloasView.pendingPartialWithdrawals = migrateCompositeListToGloas(
+    stateGloasCloned.pendingPartialWithdrawals,
+    ssz.gloas.PendingPartialWithdrawals
+  );
+  stateGloasView.pendingConsolidations = migrateCompositeListToGloas(
+    stateGloasCloned.pendingConsolidations,
+    ssz.gloas.PendingConsolidations
+  );
   stateGloasView.proposerLookahead = stateGloasCloned.proposerLookahead;
   stateGloasView.ptcWindow = ssz.gloas.PtcWindow.toViewDU(initializePtcWindow(stateFulu));
 
@@ -85,6 +116,50 @@ export function upgradeStateToGloas(stateFulu: CachedBeaconStateFulu): CachedBea
   return stateGloas;
 }
 
+/**
+ * Migrate a composite list from fulu to its gloas progressive-list equivalent by reusing the fulu
+ * list's element nodes.
+ *
+ * Works whenever the element type is identical across the fork (e.g. validators use ValidatorNodeStruct,
+ * the pending* queues use the same electra element types). Each element's cached subtree root is then
+ * valid under gloas, so only the progressive list superstructure is rebuilt and a subsequent
+ * hashTreeRoot() skips re-hashing every element — the dominant cost for large lists like validators.
+ * Much cheaper than `gloasType.toViewDU(fuluList.getAllReadonlyValues())`, which decodes every element
+ * to a value and forces a full re-hash.
+ *
+ * The chunk nodes of a composite list ARE the element root nodes, so they are extracted directly
+ * with getNodesAtDepth instead of allocating a temporary ViewDU wrapper per element (getAllReadonly).
+ * Requires the fulu view to be committed (done at the top of upgradeStateToGloas).
+ */
+function migrateCompositeListToGloas<
+  ElementType extends CompositeType<ValueOf<ElementType>, CompositeView<ElementType>, CompositeViewDU<ElementType>>,
+>(fuluList: ListCompositeTreeViewDU<ElementType>, gloasType: ProgressiveListCompositeType<ElementType>) {
+  const {length, type} = fuluList;
+  const elementNodes = getNodesAtDepth(fuluList.node.left, type.chunkDepth, 0, length);
+  return gloasType.getViewDU(progressiveListRootNode(elementNodes, length));
+}
+
+/**
+ * Migrate a basic list from fulu to its gloas progressive-list equivalent by reusing the fulu
+ * list's packed chunk leaf nodes.
+ *
+ * Packed leaf chunks are bit-identical between List[T, N] and ProgressiveList[T] (same 32-byte
+ * LE packing, zero-padded final chunk); only the superstructure above the leaves differs. Reusing
+ * the leaves avoids materializing the value array (getAll), re-serializing it, and allocating
+ * fresh LeafNodes — the gloas tree shares the leaf nodes with the fulu tree.
+ * Requires the fulu view to be committed (done at the top of upgradeStateToGloas).
+ */
+function migrateBasicListToGloas<ElementType extends BasicType<unknown>>(
+  fuluList: ListBasicTreeViewDU<ElementType>,
+  gloasType: ProgressiveListBasicType<ElementType>
+) {
+  const {length, type} = fuluList;
+  const chunkCount = Math.ceil(length / type.itemsPerChunk);
+  // List root = BranchNode(chunksNode, lengthNode) → chunks tree is the left child
+  const chunkLeafNodes = getNodesAtDepth(fuluList.node.left, type.chunkDepth, 0, chunkCount);
+  return gloasType.getViewDU(progressiveListRootNode(chunkLeafNodes, length));
+}
+
 /**
  * Applies any pending deposits for builders to onboard builders during the fork transition
  * Spec: https://github.com/ethereum/consensus-specs/blob/v1.7.0-alpha.8/specs/gloas/fork.md#new-onboard_builders_from_pending_deposits
@@ -94,7 +169,7 @@ function onboardBuildersFromPendingDeposits(state: CachedBeaconStateGloas): void
   // at the fork, so every builder pubkey here is one added in an earlier iteration.
   const builderPubkeys = new Set<string>();
 
-  const pendingDeposits = ssz.electra.PendingDeposits.defaultViewDU();
+  const pendingDeposits = ssz.gloas.PendingDeposits.defaultViewDU();
   const pendingDepositsLookup = PendingDepositsLookup.buildEmpty();
 
   for (let i = 0; i < state.pendingDeposits.length; i++) {

package/src/util/execution.ts

@@ -9,6 +9,7 @@ import {
   bellatrix,
   capella,
   deneb,
+  gloas,
   isBlindedBeaconBlockBody,
   isExecutionPayload,
   ssz,
@@ -127,7 +128,10 @@ export function isCapellaPayloadHeader(
 }
 
 export function executionPayloadToPayloadHeader(fork: ForkSeq, payload: ExecutionPayload): ExecutionPayloadHeader {
-  const transactionsRoot = ssz.bellatrix.Transactions.hashTreeRoot(payload.transactions);
+  const transactionsRoot =
+    fork >= ForkSeq.gloas
+      ? ssz.gloas.Transactions.hashTreeRoot((payload as gloas.ExecutionPayload).transactions)
+      : ssz.bellatrix.Transactions.hashTreeRoot(payload.transactions);
 
   const bellatrixPayloadFields: ExecutionPayloadHeader = {
     parentHash: payload.parentHash,
@@ -147,9 +151,10 @@ export function executionPayloadToPayloadHeader(fork: ForkSeq, payload: Executio
   };
 
   if (fork >= ForkSeq.capella) {
-    (bellatrixPayloadFields as capella.ExecutionPayloadHeader).withdrawalsRoot = ssz.capella.Withdrawals.hashTreeRoot(
-      (payload as capella.ExecutionPayload).withdrawals
-    );
+    (bellatrixPayloadFields as capella.ExecutionPayloadHeader).withdrawalsRoot =
+      fork >= ForkSeq.gloas
+        ? ssz.gloas.Withdrawals.hashTreeRoot((payload as gloas.ExecutionPayload).withdrawals)
+        : ssz.capella.Withdrawals.hashTreeRoot((payload as capella.ExecutionPayload).withdrawals);
   }
 
   if (fork >= ForkSeq.deneb) {