@lodestar/state-transition 1.47.0-dev.bd3a76e069 → 1.47.0-dev.bd761ec9ea

package/src/signatureSets/randao.ts

@@ -1,7 +1,6 @@
 import {BeaconConfig} from "@lodestar/config";
 import {DOMAIN_RANDAO} from "@lodestar/params";
 import {BeaconBlock, ssz} from "@lodestar/types";
-import {PubkeyCache} from "../cache/pubkeyCache.js";
 import {
   ISignatureSet,
   SignatureSetType,
@@ -10,8 +9,8 @@ import {
   verifySignatureSet,
 } from "../util/index.js";
 
-export function verifyRandaoSignature(config: BeaconConfig, pubkeyCache: PubkeyCache, block: BeaconBlock): boolean {
-  return verifySignatureSet(getRandaoRevealSignatureSet(config, block), pubkeyCache);
+export function verifyRandaoSignature(config: BeaconConfig, block: BeaconBlock): boolean {
+  return verifySignatureSet(getRandaoRevealSignatureSet(config, block));
 }
 
 /**

package/src/signatureSets/voluntaryExits.ts

@@ -1,8 +1,6 @@
-import {PublicKey} from "@chainsafe/blst";
 import {BeaconConfig} from "@lodestar/config";
 import {ForkSeq} from "@lodestar/params";
 import {SignedBeaconBlock, Slot, phase0, ssz} from "@lodestar/types";
-import {PubkeyCache} from "../cache/pubkeyCache.js";
 import {IBeaconStateView, IBeaconStateViewGloas, isStatePostGloas} from "../stateView/interface.js";
 import {
   ISignatureSet,
@@ -16,11 +14,10 @@ import {
 
 export function verifyVoluntaryExitSignature(
   config: BeaconConfig,
-  pubkeyCache: PubkeyCache,
   state: IBeaconStateView,
   signedVoluntaryExit: phase0.SignedVoluntaryExit
 ): boolean {
-  return verifySignatureSet(getVoluntaryExitSignatureSet(config, state, signedVoluntaryExit), pubkeyCache);
+  return verifySignatureSet(getVoluntaryExitSignatureSet(config, state, signedVoluntaryExit));
 }
 
 /**
@@ -81,7 +78,7 @@ export function getBuilderVoluntaryExitSignatureSet(
 
   return {
     type: SignatureSetType.single,
-    pubkey: PublicKey.fromBytes(builder.pubkey),
+    pubkey: builder.pubkey,
     signingRoot: computeSigningRoot(ssz.phase0.VoluntaryExit, signedVoluntaryExit.message, domain),
     signature: signedVoluntaryExit.signature,
   };

package/src/slot/upgradeStateToGloas.ts

@@ -10,8 +10,8 @@ import {
   ProgressiveListCompositeType,
   ValueOf,
 } from "@chainsafe/ssz";
-import {PAYLOAD_BUILDER_VERSION, SLOTS_PER_HISTORICAL_ROOT} from "@lodestar/params";
-import {ssz} from "@lodestar/types";
+import {BUILDER_INDEX_SELF_BUILD, PAYLOAD_BUILDER_VERSION, SLOTS_PER_HISTORICAL_ROOT} from "@lodestar/params";
+import {BuilderIndex, ssz} from "@lodestar/types";
 import {toPubkeyHex} from "@lodestar/utils";
 import {isValidDepositSignature} from "../block/processDeposit.js";
 import {getCachedBeaconState} from "../cache/stateCache.js";
@@ -73,11 +73,21 @@ export function upgradeStateToGloas(
   );
   stateGloasView.currentSyncCommittee = stateGloasCloned.currentSyncCommittee;
   stateGloasView.nextSyncCommittee = stateGloasCloned.nextSyncCommittee;
-  stateGloasView.latestExecutionPayloadBid.blockHash = stateFulu.latestExecutionPayloadHeader.blockHash;
-  stateGloasView.latestExecutionPayloadBid.gasLimit = BigInt(stateFulu.latestExecutionPayloadHeader.gasLimit);
-  stateGloasView.latestExecutionPayloadBid.executionRequestsRoot = ssz.gloas.ExecutionRequests.hashTreeRoot(
-    ssz.gloas.ExecutionRequests.defaultValue()
-  );
+  const latestExecutionPayloadBid = ssz.gloas.ExecutionPayloadBid.toViewDU({
+    parentBlockHash: stateFulu.latestExecutionPayloadHeader.parentHash,
+    parentBlockRoot: stateFulu.latestBlockHeader.parentRoot,
+    blockHash: stateFulu.latestExecutionPayloadHeader.blockHash,
+    prevRandao: stateFulu.latestExecutionPayloadHeader.prevRandao,
+    feeRecipient: ssz.ExecutionAddress.defaultValue(),
+    gasLimit: BigInt(stateFulu.latestExecutionPayloadHeader.gasLimit),
+    builderIndex: BUILDER_INDEX_SELF_BUILD,
+    slot: stateFulu.latestBlockHeader.slot,
+    value: 0,
+    executionPayment: 0n,
+    blobKzgCommitments: ssz.gloas.BlobKzgCommitments.defaultValue(),
+    executionRequestsRoot: ssz.gloas.ExecutionRequests.hashTreeRoot(ssz.gloas.ExecutionRequests.defaultValue()),
+  });
+  stateGloasView.latestExecutionPayloadBid = latestExecutionPayloadBid;
   stateGloasView.nextWithdrawalIndex = stateGloasCloned.nextWithdrawalIndex;
   stateGloasView.nextWithdrawalValidatorIndex = stateGloasCloned.nextWithdrawalValidatorIndex;
   stateGloasView.historicalSummaries = stateGloasCloned.historicalSummaries;
@@ -187,9 +197,10 @@ function onboardBuildersFromPendingDeposits(
   let sigFromCache = 0;
   let sigVerified = 0;
 
-  // Track pubkeys of new builders added when applying deposits. `state.builders` starts empty
-  // at the fork, so every builder pubkey here is one added in an earlier iteration.
-  const builderPubkeys = new Set<string>();
+  // Track pubkeys of new builders added when applying deposits, mapped to their registry
+  // index. `state.builders` starts empty at the fork and this loop only ever appends, so the
+  // index is stable and a top-up can go straight to it instead of scanning.
+  const builderIndexByPubkey = new Map<string, BuilderIndex>();
 
   const pendingDeposits = ssz.gloas.PendingDeposits.defaultViewDU();
   const pendingDepositsLookup = PendingDepositsLookup.buildEmpty();
@@ -208,15 +219,10 @@ function onboardBuildersFromPendingDeposits(
       continue;
     }
 
-    if (builderPubkeys.has(pubkeyHex)) {
+    const builderIndex = builderIndexByPubkey.get(pubkeyHex);
+    if (builderIndex !== undefined) {
       // Top up an already-onboarded builder
-      // TODO GLOAS: linear search; consider builder pubkey cache when we drop the upgrade-time set
-      for (let j = 0; j < state.builders.length; j++) {
-        if (toPubkeyHex(state.builders.getReadonly(j).pubkey) === pubkeyHex) {
-          state.builders.get(j).balance += deposit.amount;
-          break;
-        }
-      }
+      state.builders.get(builderIndex).balance += deposit.amount;
       topups++;
       continue;
     }
@@ -272,7 +278,8 @@ function onboardBuildersFromPendingDeposits(
       deposit.amount,
       deposit.slot
     );
-    builderPubkeys.add(pubkeyHex);
+    // appendBuilderToRegistry() pushes, so the new builder is the last entry
+    builderIndexByPubkey.set(pubkeyHex, state.builders.length - 1);
     onboarded++;
   }
 

package/src/stateTransition.ts

@@ -113,7 +113,7 @@ export function stateTransition(
   postState = processSlotsWithTransientCache(postState, blockSlot, options, {metrics, validatorMonitor});
 
   // Verify proposer signature only
-  if (verifyProposer && !verifyProposerSignature(postState.config, postState.epochCtx.pubkeyCache, signedBlock)) {
+  if (verifyProposer && !verifyProposerSignature(postState.config, signedBlock)) {
     throw new Error("Invalid block signature");
   }
 

package/src/stateView/stateViewFactory.ts

@@ -1,5 +1,5 @@
+import {type PubkeyCache, pubkeyCache} from "@chainsafe/lodestar-z/pubkeys";
 import {BeaconConfig} from "@lodestar/config";
-import {PubkeyCache, createPubkeyCache} from "../cache/pubkeyCache.js";
 import {createCachedBeaconState} from "../cache/stateCache.js";
 import {BeaconStateAllForks} from "../cache/types.js";
 import {getStateTypeFromBytes} from "../util/sszBytes.js";
@@ -40,17 +40,6 @@ export function createBeaconStateView(opts: NodeJSOpts | NativeOpts): IBeaconSta
 
 // ---- createBeaconStateViewForHistoricalRegen (regen path) ----
 
-// Reused across all historical state regen calls in the worker thread
-const pubkeyCacheRegen = createPubkeyCache();
-
-function syncPubkeyCache(state: BeaconStateAllForks, pubkeyCache: PubkeyCache): void {
-  const newCount = state.validators.length;
-  for (let i = pubkeyCache.size; i < newCount; i++) {
-    const pubkey = state.validators.getReadonly(i).pubkey;
-    pubkeyCache.set(i, pubkey);
-  }
-}
-
 type RegenNodeJSOpts = {
   useNative: false;
   config: BeaconConfig;
@@ -74,7 +63,6 @@ export function createBeaconStateViewForHistoricalRegen(opts: RegenNodeJSOpts |
   }
   const {config, stateBytes} = opts;
   const state = getStateTypeFromBytes(config, stateBytes).deserializeToViewDU(stateBytes);
-  syncPubkeyCache(state, pubkeyCacheRegen);
-  const cachedState = createCachedBeaconState(state, {config, pubkeyCache: pubkeyCacheRegen}, {skipSyncPubkeys: true});
+  const cachedState = createCachedBeaconState(state, {config, pubkeyCache}, {skipSyncPubkeys: true});
   return new BeaconStateView(cachedState);
 }

package/src/testUtils/index.ts

@@ -1,5 +1,6 @@
 export * from "./cache.js";
 export * from "./interop.js";
+export * from "./interopPubkeyCache.js";
 export * from "./params.js";
 export * from "./testFileCache.js";
 export * from "./util.js";

package/src/testUtils/interopPubkeyCache.ts

@@ -0,0 +1,100 @@
+import fs from "node:fs";
+import path from "node:path";
+import {pubkeyCache} from "@chainsafe/lodestar-z/pubkeys";
+import {interopSecretKey} from "../util/interop.js";
+import {testCachePath} from "./cache.js";
+
+/**
+ * This util persists generated keys as a PKIX snapshot in the local test-cache dir, so
+ * they are generated once per machine and reloaded for tests.
+ *
+ * The snapshot grows to satisfy larger requests. Smaller requests may load more entries
+ * than they need since cache contents do not define validator-registry membership.
+ */
+
+/** Below this count, generating keys is faster than snapshot bookkeeping (~80ms) */
+const MIN_PERSIST_SIZE = 1000;
+const MAX_SNAPSHOT_CAPACITY = 0xffffffff;
+const defaultSnapshotPath = path.join(testCachePath, "interop-pubkeys.pkix");
+
+/** Sentinel pubkeys used to verify cache contents, memoized as they are re-checked often */
+const interopPubkeyByIndex = new Map<number, Uint8Array>();
+
+function interopPubkey(index: number): Uint8Array {
+  let pubkey = interopPubkeyByIndex.get(index);
+  if (!pubkey) {
+    pubkey = interopSecretKey(index).toPublicKey().toBytes();
+    interopPubkeyByIndex.set(index, pubkey);
+  }
+  return pubkey;
+}
+
+function isInteropKeyAt(index: number): boolean {
+  const pubkey = pubkeyCache.get(index);
+  return pubkey !== undefined && Buffer.compare(pubkey.toBytes(), interopPubkey(index)) === 0;
+}
+
+/**
+ * True if cache entries [0, count) are the index-matching interop pubkeys. Checking the
+ * two endpoints suffices: the native cache is append-only and never remaps an index, so
+ * replacing any entry in between would have required a reset() clearing index 0 too.
+ */
+function hasInteropPrefix(count: number): boolean {
+  return pubkeyCache.size >= count && isInteropKeyAt(0) && isInteropKeyAt(count - 1);
+}
+
+function loadSnapshot(snapshotPath: string): void {
+  if (!fs.existsSync(snapshotPath)) return;
+
+  try {
+    pubkeyCache.load(snapshotPath, MAX_SNAPSHOT_CAPACITY);
+  } catch {
+    // Stale ABI, corrupt or torn file: drop it so future runs regenerate it
+    fs.rmSync(snapshotPath, {force: true});
+  }
+}
+
+function saveSnapshot(snapshotPath: string): void {
+  fs.mkdirSync(path.dirname(snapshotPath), {recursive: true});
+  // Write-then-rename so concurrent test processes never observe a partial file
+  const tmpPath = `${snapshotPath}.tmp-${process.pid}`;
+  try {
+    pubkeyCache.save(tmpPath);
+    fs.renameSync(tmpPath, snapshotPath);
+  } catch {
+    fs.rmSync(tmpPath, {force: true});
+  }
+}
+
+/**
+ * Ensure the process-wide pubkey cache holds the interop pubkeys for indices [0, vc),
+ * loading persisted snapshots and generating as few keys as possible. No-op if the cache
+ * already holds them.
+ */
+export function ensureInteropPubkeyCache(vc: number, snapshotPath = defaultSnapshotPath): void {
+  if (vc <= 0 || hasInteropPrefix(vc)) return;
+
+  // The cache is append-only, so extend a shorter interop prefix in place. Otherwise,
+  // replace unrelated contents with the persisted interop cache when available.
+  const size = pubkeyCache.size;
+  const sizeToExtend = size > 0 && size < vc && hasInteropPrefix(size) ? size : 0;
+  if (sizeToExtend === 0) {
+    pubkeyCache.reset();
+    loadSnapshot(snapshotPath);
+  }
+
+  let loadedSize = pubkeyCache.size;
+  if (loadedSize > 0 && !hasInteropPrefix(loadedSize)) {
+    pubkeyCache.reset();
+    loadedSize = 0;
+  }
+  if (loadedSize >= vc) return;
+
+  for (let i = loadedSize; i < vc; i++) {
+    pubkeyCache.append(i, interopSecretKey(i).toPublicKey().toBytes());
+  }
+
+  if (vc >= MIN_PERSIST_SIZE) {
+    saveSnapshot(snapshotPath);
+  }
+}

package/src/testUtils/state.ts

@@ -1,3 +1,4 @@
+import {pubkeyCache} from "@chainsafe/lodestar-z/pubkeys";
 import {ChainForkConfig, createBeaconConfig} from "@lodestar/config";
 import {config, config as minimalConfig} from "@lodestar/config/default";
 import {
@@ -11,13 +12,7 @@ import {phase0, ssz} from "@lodestar/types";
 import {EpochCacheOpts} from "../cache/epochCache.js";
 import {BeaconStateCache} from "../cache/stateCache.js";
 import {ZERO_HASH} from "../constants/index.js";
-import {
-  BeaconStateAllForks,
-  BeaconStatePhase0,
-  CachedBeaconStateAllForks,
-  createCachedBeaconState,
-  createPubkeyCache,
-} from "../index.js";
+import {BeaconStateAllForks, BeaconStatePhase0, CachedBeaconStateAllForks, createCachedBeaconState} from "../index.js";
 import {newZeroedArray} from "../util/index.js";
 
 /**
@@ -86,10 +81,10 @@ export function generateCachedState(
   opts: TestBeaconState = {}
 ): CachedBeaconStateAllForks {
   const state = generateState(opts);
+  pubkeyCache.reset();
   return createCachedBeaconState(state, {
     config: createBeaconConfig(config, state.genesisValidatorsRoot),
-    // This is a test state, there's no need to have a global shared cache of keys
-    pubkeyCache: createPubkeyCache(),
+    pubkeyCache,
   });
 }
 
@@ -102,8 +97,7 @@ export function createCachedBeaconStateTest<T extends BeaconStateAllForks>(
     state,
     {
       config: createBeaconConfig(configCustom, state.genesisValidatorsRoot),
-      // This is a test state, there's no need to have a global shared cache of keys
-      pubkeyCache: createPubkeyCache(),
+      pubkeyCache,
     },
     opts
   );

package/src/testUtils/testFileCache.ts

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import {pubkeyCache} from "@chainsafe/lodestar-z/pubkeys";
 import {getClient} from "@lodestar/api";
 import {ChainForkConfig, createChainForkConfig} from "@lodestar/config";
 import {NetworkName, networksChainConfig} from "@lodestar/config/networks";
@@ -40,6 +41,7 @@ export async function getNetworkCachedState(
 
   if (fs.existsSync(filepath)) {
     const stateSsz = fs.readFileSync(filepath);
+    pubkeyCache.reset();
     return createCachedBeaconStateTest(config.getForkTypes(slot).BeaconState.deserializeToViewDU(stateSsz), config);
   }
 
@@ -57,6 +59,7 @@ export async function getNetworkCachedState(
   ]);
 
   fs.writeFileSync(filepath, stateSsz);
+  pubkeyCache.reset();
   return createCachedBeaconStateTest(config.getForkTypes(slot).BeaconState.deserializeToViewDU(stateSsz), config);
 }
 

package/src/testUtils/util.ts

@@ -1,4 +1,5 @@
-import {PublicKey, SecretKey} from "@chainsafe/blst";
+import {PublicKey, SecretKey} from "@chainsafe/lodestar-z/blst";
+import {pubkeyCache} from "@chainsafe/lodestar-z/pubkeys";
 import {BitArray, fromHexString} from "@chainsafe/ssz";
 import {BeaconConfig, createBeaconConfig, createChainForkConfig} from "@lodestar/config";
 import {config} from "@lodestar/config/default";
@@ -22,7 +23,6 @@ import {
   computeCommitteeCount,
   computeEpochAtSlot,
   createCachedBeaconState,
-  createPubkeyCache,
   newFilledArray,
   processSlots,
 } from "../index.js";
@@ -40,7 +40,7 @@ import {interopSecretKey} from "../util/interop.js";
 import {computeSigningRoot} from "../util/signingRoot.js";
 import {getNextSyncCommittee} from "../util/syncCommittee.js";
 import {getActiveValidatorIndices} from "../util/validator.js";
-import {interopPubkeysCached} from "./interop.js";
+import {ensureInteropPubkeyCache} from "./interopPubkeyCache.js";
 
 let phase0State: BeaconStatePhase0 | null = null;
 let phase0CachedState23637: CachedBeaconStatePhase0 | null = null;
@@ -69,47 +69,45 @@ export const perfStateId = `${numValidators} vs - 7PWei`;
 
 /** Cache interop secret keys */
 const secretKeyByModIndex = new Map<number, SecretKey>();
+const pubkeysByCount = new Map<number, Uint8Array[]>();
 const epoch = 23638;
 export const perfStateEpoch = epoch;
 
 export function getPubkeys(vc = numValidators) {
-  const pubkeysMod = interopPubkeysCached(keypairsMod);
-  const pubkeysModObj = pubkeysMod.map((pk) => PublicKey.fromBytes(pk));
-  const pubkeys = Array.from({length: vc}, (_, i) => pubkeysMod[i % keypairsMod]);
+  ensureInteropPubkeyCache(vc);
+  let pubkeys = pubkeysByCount.get(vc);
+  if (!pubkeys) {
+    for (const [count, cached] of pubkeysByCount) {
+      if (count >= vc) {
+        pubkeys = cached.slice(0, vc);
+        break;
+      }
+    }
+    pubkeys ??= Array.from({length: vc}, (_, i) => pubkeyCache.getPubkeyBytesOrThrow(i));
+    pubkeysByCount.set(vc, pubkeys);
+  }
+  const pubkeysMod = pubkeys;
+  const pubkeysModObj = pubkeys.slice(0, keypairsMod).map((pk) => PublicKey.fromBytes(pk));
   return {pubkeysMod, pubkeysModObj, pubkeys};
 }
 
 /** Get secret key of a validatorIndex, if the pubkeys are generated with `getPubkeys()` */
 export function getSecretKeyFromIndex(validatorIndex: number): SecretKey {
-  return interopSecretKey(validatorIndex % keypairsMod);
+  return interopSecretKey(validatorIndex);
 }
 
 /** Get secret key of a validatorIndex, if the pubkeys are generated with `getPubkeys()` */
 export function getSecretKeyFromIndexCached(validatorIndex: number): SecretKey {
-  const keyIndex = validatorIndex % keypairsMod;
-  let sk = secretKeyByModIndex.get(keyIndex);
+  let sk = secretKeyByModIndex.get(validatorIndex);
   if (!sk) {
-    sk = interopSecretKey(keyIndex);
-    secretKeyByModIndex.set(keyIndex, sk);
+    sk = interopSecretKey(validatorIndex);
+    secretKeyByModIndex.set(validatorIndex, sk);
   }
   return sk;
 }
 
-function getPubkeyCaches({pubkeysMod}: ReturnType<typeof getPubkeys>, vc = numValidators) {
-  // Manually sync pubkeys to prevent doing BLS opts 110_000 times
-  const pubkeyCache = createPubkeyCache();
-  for (let i = 0; i < vc; i++) {
-    const pubkey = pubkeysMod[i % keypairsMod];
-    pubkeyCache.set(i, pubkey);
-  }
-
-  return {pubkeyCache};
-}
-
 export function generatePerfTestCachedStatePhase0(opts?: {goBackOneSlot: boolean}): CachedBeaconStatePhase0 {
-  // Generate only some publicKeys
-  const {pubkeys, pubkeysMod, pubkeysModObj} = getPubkeys();
-  const {pubkeyCache} = getPubkeyCaches({pubkeys, pubkeysMod, pubkeysModObj});
+  const {pubkeys} = getPubkeys();
 
   if (!phase0State) {
     const state = buildPerformanceStatePhase0();
@@ -218,8 +216,7 @@ export function generatePerfTestCachedStateAltair(opts?: {
   vc?: number;
 }): CachedBeaconStateAltair {
   const vc = opts?.vc ?? numValidators;
-  const {pubkeys, pubkeysMod, pubkeysModObj} = getPubkeys(vc);
-  const {pubkeyCache} = getPubkeyCaches({pubkeys, pubkeysMod, pubkeysModObj}, vc);
+  const {pubkeys} = getPubkeys(vc);
 
   const altairConfig = createChainForkConfig({ALTAIR_FORK_EPOCH: 0});
 
@@ -259,8 +256,7 @@ export function generatePerfTestCachedStateElectra(opts?: {
   vc?: number;
 }): CachedBeaconStateElectra {
   const vc = opts?.vc ?? numValidators;
-  const {pubkeys, pubkeysMod, pubkeysModObj} = getPubkeys(vc);
-  const {pubkeyCache} = getPubkeyCaches({pubkeys, pubkeysMod, pubkeysModObj}, vc);
+  const {pubkeys} = getPubkeys(vc);
 
   const electraConfig = createChainForkConfig({
     ALTAIR_FORK_EPOCH: 0,
@@ -495,15 +491,7 @@ export function generateTestCachedBeaconStateOnlyValidators({
   vc: number;
   slot: Slot;
 }): CachedBeaconStateAllForks {
-  // Generate only some publicKeys
-  const {pubkeys, pubkeysMod} = getPubkeys(vc);
-
-  // Manually sync pubkeys to prevent doing BLS opts 110_000 times
-  const pubkeyCache = createPubkeyCache();
-  for (let i = 0; i < vc; i++) {
-    const pubkey = pubkeysMod[i % keypairsMod];
-    pubkeyCache.set(i, pubkey);
-  }
+  const {pubkeys} = getPubkeys(vc);
 
   const state = ssz.phase0.BeaconState.defaultViewDU();
   state.slot = slot;

package/src/util/gloas.ts

@@ -1,4 +1,3 @@
-import {PublicKey, Signature, verify} from "@chainsafe/blst";
 import {BeaconConfig} from "@lodestar/config";
 import {
   BUILDER_INDEX_FLAG,
@@ -23,6 +22,7 @@ import {computeEpochAtSlot} from "./epoch.js";
 import {computeEpochShuffling} from "./epochShuffling.js";
 import {RootCache} from "./rootCache.js";
 import {computePayloadTimelinessCommitteesForEpoch} from "./seed.js";
+import {createSingleSignatureSetFromComponents, verifySignatureSet} from "./signatureSets.js";
 import {computeSigningRoot} from "./signingRoot.js";
 import {getActiveValidatorIndices} from "./validator.js";
 
@@ -339,9 +339,7 @@ export function isValidBuilderDepositSignature(
   const domain = computeDomain(DOMAIN_BUILDER_DEPOSIT, config.GENESIS_FORK_VERSION, ZERO_HASH);
   const signingRoot = computeSigningRoot(ssz.phase0.DepositMessage, depositMessage, domain);
   try {
-    const publicKey = PublicKey.fromBytes(pubkey, true);
-    const sig = Signature.fromBytes(signature, true);
-    return verify(signingRoot, publicKey, sig);
+    return verifySignatureSet(createSingleSignatureSetFromComponents(pubkey, signingRoot, signature));
   } catch (_e) {
     return false;
   }

package/src/util/interop.ts

@@ -1,6 +1,6 @@
 import {toBufferBE} from "@vekexasia/bigint-buffer2";
 import {digest} from "@chainsafe/as-sha256";
-import {SecretKey} from "@chainsafe/blst";
+import {SecretKey} from "@chainsafe/lodestar-z/blst";
 import {bytesToBigInt, intToBytes} from "@lodestar/utils";
 
 let curveOrder: bigint;

package/src/util/signatureSets.ts

@@ -1,6 +1,5 @@
-import {PublicKey, Signature, aggregatePublicKeys, fastAggregateVerify, verify} from "@chainsafe/blst";
+import {BLS_VERIFIER_SET_TYPE, type BlsSignatureSet, verifySignatureSets} from "@chainsafe/lodestar-z/bls-verifier";
 import {Root} from "@lodestar/types";
-import {PubkeyCache} from "../cache/pubkeyCache.js";
 
 export enum SignatureSetType {
   single = "single",
@@ -18,7 +17,7 @@ export enum SignatureSetType {
  */
 export type SingleSignatureSet = {
   type: SignatureSetType.single;
-  pubkey: PublicKey;
+  pubkey: Uint8Array;
   signingRoot: Root;
   signature: Uint8Array;
 };
@@ -47,59 +46,39 @@ export type AggregatedSignatureSet = {
 
 export type ISignatureSet = SingleSignatureSet | IndexedSignatureSet | AggregatedSignatureSet;
 
-/**
- * Get the pubkey for a signature set, performing aggregation if necessary.
- * Requires pubkeyCache for indexed and aggregate sets.
- */
-export function getSignatureSetPubkey(signatureSet: ISignatureSet, pubkeyCache: PubkeyCache): PublicKey {
+export function toBlsSignatureSet(signatureSet: ISignatureSet): BlsSignatureSet {
   switch (signatureSet.type) {
     case SignatureSetType.single:
-      return signatureSet.pubkey;
-
-    case SignatureSetType.indexed: {
-      return pubkeyCache.getOrThrow(signatureSet.index);
-    }
+      return {
+        type: BLS_VERIFIER_SET_TYPE.single,
+        pubkey: signatureSet.pubkey,
+        message: signatureSet.signingRoot,
+        signature: signatureSet.signature,
+      };
+
+    case SignatureSetType.indexed:
+      return {
+        type: BLS_VERIFIER_SET_TYPE.indexed,
+        index: signatureSet.index,
+        message: signatureSet.signingRoot,
+        signature: signatureSet.signature,
+      };
 
     case SignatureSetType.aggregate: {
-      const pubkeys = signatureSet.indices.map((i) => {
-        return pubkeyCache.getOrThrow(i);
-      });
-      return aggregatePublicKeys(pubkeys);
-    }
-
-    default:
-      throw Error("Unknown signature set type");
-  }
-}
-
-export function verifySignatureSet(signatureSet: SingleSignatureSet, pubkeyCache?: PubkeyCache): boolean;
-export function verifySignatureSet(signatureSet: IndexedSignatureSet, pubkeyCache: PubkeyCache): boolean;
-export function verifySignatureSet(signatureSet: AggregatedSignatureSet, pubkeyCache: PubkeyCache): boolean;
-export function verifySignatureSet(signatureSet: ISignatureSet, pubkeyCache: PubkeyCache): boolean;
-export function verifySignatureSet(signatureSet: ISignatureSet, pubkeyCache?: PubkeyCache): boolean {
-  // All signatures are not trusted and must be group checked (p2.subgroup_check)
-  const signature = Signature.fromBytes(signatureSet.signature, true);
-
-  switch (signatureSet.type) {
-    case SignatureSetType.single:
-      return verify(signatureSet.signingRoot, signatureSet.pubkey, signature);
-
-    case SignatureSetType.indexed: {
-      if (!pubkeyCache) {
-        throw Error("pubkeyCache required for indexed signature set");
+      const indices = new Uint32Array(signatureSet.indices.length);
+      for (const [i, index] of signatureSet.indices.entries()) {
+        if (!Number.isInteger(index) || index < 0 || index > 0xffffffff) {
+          throw new RangeError(`Invalid validator index ${index}`);
+        }
+        indices[i] = index;
       }
-      const pubkey = pubkeyCache.getOrThrow(signatureSet.index);
-      return verify(signatureSet.signingRoot, pubkey, signature);
-    }
 
-    case SignatureSetType.aggregate: {
-      if (!pubkeyCache) {
-        throw Error("pubkeyCache required for aggregate signature set");
-      }
-      const pubkeys = signatureSet.indices.map((i) => {
-        return pubkeyCache.getOrThrow(i);
-      });
-      return fastAggregateVerify(signatureSet.signingRoot, pubkeys, signature);
+      return {
+        type: BLS_VERIFIER_SET_TYPE.aggregate,
+        indices,
+        message: signatureSet.signingRoot,
+        signature: signatureSet.signature,
+      };
     }
 
     default:
@@ -107,8 +86,12 @@ export function verifySignatureSet(signatureSet: ISignatureSet, pubkeyCache?: Pu
   }
 }
 
+export function verifySignatureSet(signatureSet: ISignatureSet): boolean {
+  return verifySignatureSets([toBlsSignatureSet(signatureSet)]);
+}
+
 export function createSingleSignatureSetFromComponents(
-  pubkey: PublicKey,
+  pubkey: Uint8Array,
   signingRoot: Root,
   signature: Uint8Array
 ): SingleSignatureSet {

package/src/util/syncCommittee.ts

@@ -1,4 +1,4 @@
-import {aggregateSerializedPublicKeys} from "@chainsafe/blst";
+import {aggregateSerializedPublicKeys} from "@chainsafe/lodestar-z/blst";
 import {
   BASE_REWARD_FACTOR,
   EFFECTIVE_BALANCE_INCREMENT,

package/lib/cache/pubkeyCache.d.ts

@@ -1,28 +0,0 @@
-import { PublicKey } from "@chainsafe/blst";
-import { ValidatorIndex, phase0 } from "@lodestar/types";
-/**
- * Unified pubkey cache coupling index→pubkey and pubkey→index lookups.
- * Both directions are kept in sync atomically via `set()`.
- */
-export interface PubkeyCache {
-    /** Get deserialized PublicKey by validator index */
-    get(index: ValidatorIndex): PublicKey | undefined;
-    /** Get deserialized PublicKey by validator index or throw if not found */
-    getOrThrow(index: ValidatorIndex): PublicKey;
-    /** Get validator index by pubkey bytes */
-    getIndex(pubkey: Uint8Array): ValidatorIndex | null;
-    /** Set both directions atomically. Takes raw pubkey bytes — deserialization is handled internally. */
-    set(index: ValidatorIndex, pubkey: Uint8Array): void;
-    /** Number of entries */
-    readonly size: number;
-}
-export declare function createPubkeyCache(): PubkeyCache;
-/**
- * Checks the pubkey indices against a state and adds missing pubkeys
- *
- * Mutates `pubkeyCache`
- *
- * If pubkey cache is empty: SLOW CODE - 🐢
- */
-export declare function syncPubkeys(pubkeyCache: PubkeyCache, validators: phase0.Validator[]): void;
-//# sourceMappingURL=pubkeyCache.d.ts.map