@obolnetwork/obol-sdk 2.11.12 → 2.12.0

package/dist/browser/src/index.js

@@ -21,6 +21,12 @@ var __spreadValues = (a, b) => {
   return a;
 };
 var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __export = (target, all) => {
   for (var name2 in all)
     __defProp(target, name2, { get: all[name2], enumerable: true });
@@ -92,7 +98,7 @@ import { v4 as uuidv4 } from "uuid";
 // package.json
 var package_default = {
   name: "@obolnetwork/obol-sdk",
-  version: "2.11.12",
+  version: "2.12.0",
   description: "A package for creating Distributed Validators using the Obol API.",
   bugs: {
     url: "https://github.com/obolnetwork/obol-sdk/issues"
@@ -578,7 +584,7 @@ var UnsupportedChainError = class _UnsupportedChainError extends Error {
 };
 
 // src/verification/common.ts
-import { fromHexString as fromHexString5 } from "@chainsafe/ssz";
+import { fromHexString as fromHexString6 } from "@chainsafe/ssz";
 import elliptic from "elliptic";
 import * as semver from "semver";
 
@@ -705,7 +711,7 @@ import {
   ByteVectorType as ByteVectorType2,
   ContainerType as ContainerType2,
   ListCompositeType,
-  fromHexString
+  fromHexString as fromHexString2
 } from "@chainsafe/ssz";
 
 // node_modules/@noble/curves/node_modules/@noble/hashes/utils.js
@@ -5159,6 +5165,226 @@ function blsVerifyMultiple(pubkeys, messages, signature) {
 function blsAggregateSignatures(signatures) {
   return ls.Signature.toBytes(ls.aggregateSignatures(signatures));
 }
+function lagrangeCoeffAtZero(shareIndex, indices) {
+  const { Fr } = bls12_381.fields;
+  let num = BigInt(1);
+  let den = BigInt(1);
+  for (const j of indices) {
+    if (j === shareIndex) continue;
+    num = Fr.mul(num, Fr.neg(j));
+    den = Fr.mul(den, Fr.sub(shareIndex, j));
+  }
+  return Fr.mul(num, Fr.inv(den));
+}
+function blsRecoverWithIndices(shares, indices) {
+  try {
+    let recovered = bls12_381.G1.Point.ZERO;
+    for (let i = 0; i < shares.length; i++) {
+      const point = bls12_381.G1.Point.fromBytes(shares[i]);
+      const coeff = lagrangeCoeffAtZero(indices[i], indices);
+      recovered = recovered.add(point.multiply(coeff));
+    }
+    return recovered.toBytes();
+  } catch (e) {
+    return null;
+  }
+}
+function blsRecoverDistributedPubkeyFromShares(pubshares, threshold) {
+  if (threshold <= 0 || pubshares.length < threshold) return null;
+  const selected = pubshares.slice(0, threshold);
+  const indices = selected.map((_, i) => BigInt(i + 1));
+  return blsRecoverWithIndices(selected, indices);
+}
+function blsVerifyExtraShares(pubshares, threshold, distributedPubkey) {
+  if (threshold <= 0 || pubshares.length < threshold) return false;
+  try {
+    const baseShares = pubshares.slice(0, threshold - 1);
+    const baseIndices = baseShares.map((_, i) => BigInt(i + 1));
+    for (let i = threshold; i < pubshares.length; i++) {
+      const shares = [...baseShares, pubshares[i]];
+      const indices = [...baseIndices, BigInt(i + 1)];
+      const recovered = blsRecoverWithIndices(shares, indices);
+      if (!recovered || recovered.length !== distributedPubkey.length || !recovered.every((b, j) => b === distributedPubkey[j])) {
+        return false;
+      }
+    }
+    return true;
+  } catch (e) {
+    return false;
+  }
+}
+
+// src/verification/parallelPool.ts
+import { fromHexString } from "@chainsafe/ssz";
+var MIN_PARALLEL_VALIDATORS = 50;
+var MIN_PARALLEL_BATCH_PAIRS = 100;
+var MAX_WORKERS = 8;
+var MIN_VALIDATORS_PER_WORKER = 25;
+var MIN_PAIRS_PER_WORKER = 50;
+var WORKER_TIMEOUT_MS = 6e4;
+var workerThreadsCache;
+var osCache;
+var workerPathCache;
+function loadWorkerThreads() {
+  if (workerThreadsCache !== void 0) return workerThreadsCache;
+  try {
+    workerThreadsCache = __require("worker_threads");
+  } catch (e) {
+    workerThreadsCache = null;
+  }
+  return workerThreadsCache;
+}
+function loadOs() {
+  if (osCache !== void 0) return osCache;
+  try {
+    osCache = __require("os");
+  } catch (e) {
+    osCache = null;
+  }
+  return osCache;
+}
+function getWorkerPath() {
+  if (workerPathCache !== void 0) return workerPathCache;
+  if (typeof __dirname === "undefined") return workerPathCache = null;
+  const path = __require("path");
+  const candidate = path.join(__dirname, "lockWorker.js");
+  try {
+    const fs = __require("fs");
+    if (!fs.existsSync(candidate)) return workerPathCache = null;
+  } catch (e) {
+    return workerPathCache = null;
+  }
+  return workerPathCache = candidate;
+}
+function chunkArrays(arr, n) {
+  const size = Math.ceil(arr.length / n);
+  const out = [];
+  for (let i = 0; i < arr.length; i += size) {
+    out.push(arr.slice(i, i + size));
+  }
+  return out;
+}
+function verifySharesSync(shares, distributedKeys, threshold) {
+  for (let i = 0; i < shares.length; i++) {
+    const sharesBytes = shares[i].map((s) => fromHexString(s));
+    const dkBytes = fromHexString(distributedKeys[i]);
+    const recovered = blsRecoverDistributedPubkeyFromShares(
+      sharesBytes,
+      threshold
+    );
+    if (!recovered) return false;
+    if (recovered.length !== dkBytes.length) return false;
+    for (let j = 0; j < recovered.length; j++) {
+      if (recovered[j] !== dkBytes[j]) return false;
+    }
+    if (!blsVerifyExtraShares(sharesBytes, threshold, dkBytes)) {
+      return false;
+    }
+  }
+  return true;
+}
+function runWorker(wt, workerFile, data) {
+  return __async(this, null, function* () {
+    return yield new Promise((resolve) => {
+      let settled = false;
+      const worker = new wt.Worker(workerFile, { workerData: data });
+      const finish = (result) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        worker.terminate();
+        resolve(result);
+      };
+      const timer = setTimeout(() => {
+        finish(false);
+      }, WORKER_TIMEOUT_MS);
+      worker.once("message", (msg) => {
+        finish(msg === true);
+      });
+      worker.once("error", () => {
+        finish(false);
+      });
+      worker.once("exit", (code2) => {
+        if (code2 !== 0) finish(false);
+      });
+    });
+  });
+}
+function poolSize(itemCount, minPerWorker) {
+  const wt = loadWorkerThreads();
+  const os = loadOs();
+  const workerFile = getWorkerPath();
+  const numCpus = os ? os.cpus().length : 1;
+  const numWorkers = Math.min(
+    MAX_WORKERS,
+    Math.max(1, Math.floor(itemCount / minPerWorker)),
+    numCpus
+  );
+  return { numWorkers, wt, workerFile };
+}
+function verifySharesBinding(shares, distributedKeys, threshold) {
+  return __async(this, null, function* () {
+    if (shares.length !== distributedKeys.length) return false;
+    if (shares.length === 0) return true;
+    const { numWorkers, wt, workerFile } = poolSize(
+      shares.length,
+      MIN_VALIDATORS_PER_WORKER
+    );
+    if (wt === null || workerFile === null || shares.length < MIN_PARALLEL_VALIDATORS || numWorkers < 2) {
+      return verifySharesSync(shares, distributedKeys, threshold);
+    }
+    const shareChunks = chunkArrays(shares, numWorkers);
+    const keyChunks = chunkArrays(distributedKeys, numWorkers);
+    const results = yield Promise.all(
+      shareChunks.map(
+        (chunk, i) => __async(null, null, function* () {
+          return yield runWorker(wt, workerFile, {
+            mode: "shareBinding",
+            shares: chunk,
+            distributedKeys: keyChunks[i],
+            threshold
+          });
+        })
+      )
+    );
+    return results.every(Boolean);
+  });
+}
+function verifyBatchParallel(pubkeys, messages, signatures) {
+  return __async(this, null, function* () {
+    if (pubkeys.length !== messages.length || pubkeys.length !== signatures.length) {
+      return false;
+    }
+    if (pubkeys.length === 0) return true;
+    const { numWorkers, wt, workerFile } = poolSize(
+      pubkeys.length,
+      MIN_PAIRS_PER_WORKER
+    );
+    if (wt === null || workerFile === null || pubkeys.length < MIN_PARALLEL_BATCH_PAIRS || numWorkers < 2) {
+      return blsVerifyMultiple(
+        pubkeys,
+        messages,
+        blsAggregateSignatures(signatures)
+      );
+    }
+    const pkChunks = chunkArrays(pubkeys, numWorkers);
+    const msgChunks = chunkArrays(messages, numWorkers);
+    const sigChunks = chunkArrays(signatures, numWorkers);
+    const results = yield Promise.all(
+      pkChunks.map(
+        (pks, i) => __async(null, null, function* () {
+          return yield runWorker(wt, workerFile, {
+            mode: "verifyBatch",
+            pubkeys: pks,
+            messages: msgChunks[i],
+            aggregateSignature: blsAggregateSignatures(sigChunks[i])
+          });
+        })
+      )
+    );
+    return results.every(Boolean);
+  });
+}
 
 // src/verification/v1.6.0.ts
 var clusterDefinitionContainerTypeV1X6 = (configOnly) => {
@@ -5192,29 +5418,29 @@ var hashClusterDefinitionV1X6 = (cluster, configOnly) => {
   val.num_validators = cluster.num_validators;
   val.threshold = cluster.threshold;
   val.dkg_algorithm = strToUint8Array(cluster.dkg_algorithm);
-  val.fork_version = fromHexString(cluster.fork_version);
+  val.fork_version = fromHexString2(cluster.fork_version);
   val.operators = cluster.operators.map((operator) => {
-    return configOnly ? { address: fromHexString(operator.address) } : {
-      address: fromHexString(operator.address),
+    return configOnly ? { address: fromHexString2(operator.address) } : {
+      address: fromHexString2(operator.address),
       enr: strToUint8Array(operator.enr),
-      config_signature: fromHexString(operator.config_signature),
-      enr_signature: fromHexString(operator.enr_signature)
+      config_signature: fromHexString2(operator.config_signature),
+      enr_signature: fromHexString2(operator.enr_signature)
     };
   });
-  val.creator = configOnly ? { address: fromHexString(cluster.creator.address) } : {
-    address: fromHexString(cluster.creator.address),
-    config_signature: fromHexString(
+  val.creator = configOnly ? { address: fromHexString2(cluster.creator.address) } : {
+    address: fromHexString2(cluster.creator.address),
+    config_signature: fromHexString2(
       cluster.creator.config_signature
     )
   };
   val.validators = cluster.validators.map((validator) => {
     return {
-      fee_recipient_address: fromHexString(validator.fee_recipient_address),
-      withdrawal_address: fromHexString(validator.withdrawal_address)
+      fee_recipient_address: fromHexString2(validator.fee_recipient_address),
+      withdrawal_address: fromHexString2(validator.withdrawal_address)
     };
   });
   if (!configOnly) {
-    val.config_hash = fromHexString(cluster.config_hash);
+    val.config_hash = fromHexString2(cluster.config_hash);
   }
   return val;
 };
@@ -5243,18 +5469,18 @@ var hashClusterLockV1X6 = (cluster) => {
     (dValidator) => {
       var _a6, _b2, _c, _d;
       return {
-        distributed_public_key: fromHexString(
+        distributed_public_key: fromHexString2(
           dValidator.distributed_public_key
         ),
         public_shares: dValidator.public_shares.map(
-          (publicShare) => fromHexString(publicShare)
+          (publicShare) => fromHexString2(publicShare)
         ),
-        pubkey: fromHexString((_a6 = dValidator.deposit_data) == null ? void 0 : _a6.pubkey),
-        withdrawal_credentials: fromHexString(
+        pubkey: fromHexString2((_a6 = dValidator.deposit_data) == null ? void 0 : _a6.pubkey),
+        withdrawal_credentials: fromHexString2(
           (_b2 = dValidator.deposit_data) == null ? void 0 : _b2.withdrawal_credentials
         ),
         amount: parseInt((_c = dValidator.deposit_data) == null ? void 0 : _c.amount),
-        signature: fromHexString((_d = dValidator.deposit_data) == null ? void 0 : _d.signature)
+        signature: fromHexString2((_d = dValidator.deposit_data) == null ? void 0 : _d.signature)
       };
     }
   );
@@ -5263,6 +5489,22 @@ var hashClusterLockV1X6 = (cluster) => {
 var verifyDVV1X6 = (clusterLock) => __async(null, null, function* () {
   var _a6;
   const validators = clusterLock.distributed_validators;
+  const operatorCount = clusterLock.cluster_definition.operators.length;
+  const threshold = clusterLock.cluster_definition.threshold;
+  for (const validator of validators) {
+    if (validator.public_shares.length !== operatorCount) {
+      return false;
+    }
+    const uniqueShareCount = new Set(validator.public_shares).size;
+    if (uniqueShareCount !== validator.public_shares.length) {
+      return false;
+    }
+  }
+  const allShares = validators.map((v) => v.public_shares);
+  const allDKs = validators.map((v) => v.distributed_public_key);
+  if (!(yield verifySharesBinding(allShares, allDKs, threshold))) {
+    return false;
+  }
   const pubShares = [];
   const pubKeys = [];
   const builderRegistrationAndDepositDataMessages = [];
@@ -5271,8 +5513,18 @@ var verifyDVV1X6 = (clusterLock) => __async(null, null, function* () {
     const validator = validators[i];
     const validatorPublicShares = validator.public_shares;
     const distributedPublicKey = validator.distributed_public_key;
-    for (const element of validatorPublicShares) {
-      pubShares.push(fromHexString(element));
+    if (validatorPublicShares.length !== operatorCount) {
+      return false;
+    }
+    const normalizedShares = validatorPublicShares.map((s) => s.toLowerCase());
+    if (new Set(normalizedShares).size !== normalizedShares.length) {
+      return false;
+    }
+    const validatorPublicSharesBytes = validatorPublicShares.map(
+      (share) => fromHexString2(share)
+    );
+    for (const share of validatorPublicSharesBytes) {
+      pubShares.push(share);
     }
     const { isValidDepositData, depositDataMsg } = verifyDepositData(
       distributedPublicKey,
@@ -5283,24 +5535,23 @@ var verifyDVV1X6 = (clusterLock) => __async(null, null, function* () {
     if (!isValidDepositData) {
       return false;
     }
-    pubKeys.push(fromHexString(validator.distributed_public_key));
+    pubKeys.push(fromHexString2(validator.distributed_public_key));
     builderRegistrationAndDepositDataMessages.push(depositDataMsg);
     blsSignatures.push(
-      fromHexString((_a6 = validator.deposit_data) == null ? void 0 : _a6.signature)
+      fromHexString2((_a6 = validator.deposit_data) == null ? void 0 : _a6.signature)
     );
   }
-  const aggregateBLSSignature = blsAggregateSignatures(blsSignatures);
-  if (!blsVerifyMultiple(
+  if (!(yield verifyBatchParallel(
     pubKeys,
     builderRegistrationAndDepositDataMessages,
-    aggregateBLSSignature
-  )) {
+    blsSignatures
+  ))) {
     return false;
   }
   if (!blsVerifyAggregate(
     pubShares,
-    fromHexString(clusterLock.lock_hash),
-    fromHexString(clusterLock.signature_aggregate)
+    fromHexString2(clusterLock.lock_hash),
+    fromHexString2(clusterLock.signature_aggregate)
   )) {
     return false;
   }
@@ -5316,7 +5567,7 @@ import {
   ByteVectorType as ByteVectorType3,
   ContainerType as ContainerType3,
   ListCompositeType as ListCompositeType2,
-  fromHexString as fromHexString2
+  fromHexString as fromHexString3
 } from "@chainsafe/ssz";
 var clusterDefinitionContainerTypeV1X7 = (configOnly) => {
   let returnedContainerType = {
@@ -5349,29 +5600,29 @@ var hashClusterDefinitionV1X7 = (cluster, configOnly) => {
   val.num_validators = cluster.num_validators;
   val.threshold = cluster.threshold;
   val.dkg_algorithm = strToUint8Array(cluster.dkg_algorithm);
-  val.fork_version = fromHexString2(cluster.fork_version);
+  val.fork_version = fromHexString3(cluster.fork_version);
   val.operators = cluster.operators.map((operator) => {
-    return configOnly ? { address: fromHexString2(operator.address) } : {
-      address: fromHexString2(operator.address),
+    return configOnly ? { address: fromHexString3(operator.address) } : {
+      address: fromHexString3(operator.address),
       enr: strToUint8Array(operator.enr),
-      config_signature: fromHexString2(operator.config_signature),
-      enr_signature: fromHexString2(operator.enr_signature)
+      config_signature: fromHexString3(operator.config_signature),
+      enr_signature: fromHexString3(operator.enr_signature)
     };
   });
-  val.creator = configOnly ? { address: fromHexString2(cluster.creator.address) } : {
-    address: fromHexString2(cluster.creator.address),
-    config_signature: fromHexString2(
+  val.creator = configOnly ? { address: fromHexString3(cluster.creator.address) } : {
+    address: fromHexString3(cluster.creator.address),
+    config_signature: fromHexString3(
       cluster.creator.config_signature
     )
   };
   val.validators = cluster.validators.map((validator) => {
     return {
-      fee_recipient_address: fromHexString2(validator.fee_recipient_address),
-      withdrawal_address: fromHexString2(validator.withdrawal_address)
+      fee_recipient_address: fromHexString3(validator.fee_recipient_address),
+      withdrawal_address: fromHexString3(validator.withdrawal_address)
     };
   });
   if (!configOnly) {
-    val.config_hash = fromHexString2(cluster.config_hash);
+    val.config_hash = fromHexString3(cluster.config_hash);
   }
   return val;
 };
@@ -5398,34 +5649,34 @@ var hashClusterLockV1X7 = (cluster) => {
     (dValidator) => {
       var _a6, _b2, _c, _d, _e, _f, _g, _h, _i;
       return {
-        distributed_public_key: fromHexString2(
+        distributed_public_key: fromHexString3(
           dValidator.distributed_public_key
         ),
         public_shares: dValidator.public_shares.map(
-          (publicShare) => fromHexString2(publicShare)
+          (publicShare) => fromHexString3(publicShare)
         ),
         deposit_data: {
-          pubkey: fromHexString2((_a6 = dValidator.deposit_data) == null ? void 0 : _a6.pubkey),
-          withdrawal_credentials: fromHexString2(
+          pubkey: fromHexString3((_a6 = dValidator.deposit_data) == null ? void 0 : _a6.pubkey),
+          withdrawal_credentials: fromHexString3(
             (_b2 = dValidator.deposit_data) == null ? void 0 : _b2.withdrawal_credentials
           ),
           amount: parseInt((_c = dValidator.deposit_data) == null ? void 0 : _c.amount),
-          signature: fromHexString2(
+          signature: fromHexString3(
             (_d = dValidator.deposit_data) == null ? void 0 : _d.signature
           )
         },
         builder_registration: {
           message: {
-            fee_recipient: fromHexString2(
+            fee_recipient: fromHexString3(
               (_e = dValidator.builder_registration) == null ? void 0 : _e.message.fee_recipient
             ),
             gas_limit: (_f = dValidator.builder_registration) == null ? void 0 : _f.message.gas_limit,
             timestamp: (_g = dValidator.builder_registration) == null ? void 0 : _g.message.timestamp,
-            pubkey: fromHexString2(
+            pubkey: fromHexString3(
               (_h = dValidator.builder_registration) == null ? void 0 : _h.message.pubkey
             )
           },
-          signature: fromHexString2(
+          signature: fromHexString3(
             (_i = dValidator.builder_registration) == null ? void 0 : _i.signature
           )
         }
@@ -5437,6 +5688,22 @@ var hashClusterLockV1X7 = (cluster) => {
 var verifyDVV1X7 = (clusterLock) => __async(null, null, function* () {
   var _a6, _b2;
   const validators = clusterLock.distributed_validators;
+  const operatorCount = clusterLock.cluster_definition.operators.length;
+  const threshold = clusterLock.cluster_definition.threshold;
+  for (const validator of validators) {
+    if (validator.public_shares.length !== operatorCount) {
+      return false;
+    }
+    const uniqueShareCount = new Set(validator.public_shares).size;
+    if (uniqueShareCount !== validator.public_shares.length) {
+      return false;
+    }
+  }
+  const allShares = validators.map((v) => v.public_shares);
+  const allDKs = validators.map((v) => v.distributed_public_key);
+  if (!(yield verifySharesBinding(allShares, allDKs, threshold))) {
+    return false;
+  }
   const pubShares = [];
   const pubKeys = [];
   const builderRegistrationAndDepositDataMessages = [];
@@ -5445,8 +5712,18 @@ var verifyDVV1X7 = (clusterLock) => __async(null, null, function* () {
     const validator = validators[i];
     const validatorPublicShares = validator.public_shares;
     const distributedPublicKey = validator.distributed_public_key;
-    for (const element of validatorPublicShares) {
-      pubShares.push(fromHexString2(element));
+    if (validatorPublicShares.length !== operatorCount) {
+      return false;
+    }
+    const normalizedShares = validatorPublicShares.map((s) => s.toLowerCase());
+    if (new Set(normalizedShares).size !== normalizedShares.length) {
+      return false;
+    }
+    const validatorPublicSharesBytes = validatorPublicShares.map(
+      (share) => fromHexString3(share)
+    );
+    for (const share of validatorPublicSharesBytes) {
+      pubShares.push(share);
     }
     const { isValidDepositData, depositDataMsg } = verifyDepositData(
       distributedPublicKey,
@@ -5457,10 +5734,10 @@ var verifyDVV1X7 = (clusterLock) => __async(null, null, function* () {
     if (!isValidDepositData) {
       return false;
     }
-    pubKeys.push(fromHexString2(distributedPublicKey));
+    pubKeys.push(fromHexString3(distributedPublicKey));
     builderRegistrationAndDepositDataMessages.push(depositDataMsg);
     blsSignatures.push(
-      fromHexString2((_a6 = validator.deposit_data) == null ? void 0 : _a6.signature)
+      fromHexString3((_a6 = validator.deposit_data) == null ? void 0 : _a6.signature)
     );
     const { isValidBuilderRegistration, builderRegistrationMsg } = verifyBuilderRegistration(
       validator,
@@ -5470,18 +5747,17 @@ var verifyDVV1X7 = (clusterLock) => __async(null, null, function* () {
     if (!isValidBuilderRegistration) {
       return false;
     }
-    pubKeys.push(fromHexString2(distributedPublicKey));
+    pubKeys.push(fromHexString3(distributedPublicKey));
     builderRegistrationAndDepositDataMessages.push(builderRegistrationMsg);
     blsSignatures.push(
-      fromHexString2((_b2 = validator.builder_registration) == null ? void 0 : _b2.signature)
+      fromHexString3((_b2 = validator.builder_registration) == null ? void 0 : _b2.signature)
     );
   }
-  const aggregateBLSSignature = blsAggregateSignatures(blsSignatures);
-  if (!blsVerifyMultiple(
+  if (!(yield verifyBatchParallel(
     pubKeys,
     builderRegistrationAndDepositDataMessages,
-    aggregateBLSSignature
-  )) {
+    blsSignatures
+  ))) {
     return false;
   }
   if (!verifyNodeSignatures(clusterLock)) {
@@ -5489,8 +5765,8 @@ var verifyDVV1X7 = (clusterLock) => __async(null, null, function* () {
   }
   if (!blsVerifyAggregate(
     pubShares,
-    fromHexString2(clusterLock.lock_hash),
-    fromHexString2(clusterLock.signature_aggregate)
+    fromHexString3(clusterLock.lock_hash),
+    fromHexString3(clusterLock.signature_aggregate)
   )) {
     return false;
   }
@@ -14959,7 +15235,7 @@ import {
   ContainerType as ContainerType4,
   ListBasicType,
   ListCompositeType as ListCompositeType3,
-  fromHexString as fromHexString3
+  fromHexString as fromHexString4
 } from "@chainsafe/ssz";
 var clusterDefinitionContainerTypeV1X8 = (configOnly) => {
   let returnedContainerType = {
@@ -14996,25 +15272,25 @@ var hashClusterDefinitionV1X8 = (cluster, configOnly) => {
   val.num_validators = cluster.num_validators;
   val.threshold = cluster.threshold;
   val.dkg_algorithm = strToUint8Array(cluster.dkg_algorithm);
-  val.fork_version = fromHexString3(cluster.fork_version);
+  val.fork_version = fromHexString4(cluster.fork_version);
   val.operators = cluster.operators.map((operator) => {
-    return configOnly ? { address: fromHexString3(operator.address) } : {
-      address: fromHexString3(operator.address),
+    return configOnly ? { address: fromHexString4(operator.address) } : {
+      address: fromHexString4(operator.address),
       enr: strToUint8Array(operator.enr),
-      config_signature: fromHexString3(operator.config_signature),
-      enr_signature: fromHexString3(operator.enr_signature)
+      config_signature: fromHexString4(operator.config_signature),
+      enr_signature: fromHexString4(operator.enr_signature)
     };
   });
-  val.creator = configOnly ? { address: fromHexString3(cluster.creator.address) } : {
-    address: fromHexString3(cluster.creator.address),
-    config_signature: fromHexString3(
+  val.creator = configOnly ? { address: fromHexString4(cluster.creator.address) } : {
+    address: fromHexString4(cluster.creator.address),
+    config_signature: fromHexString4(
       cluster.creator.config_signature
     )
   };
   val.validators = cluster.validators.map((validator) => {
     return {
-      fee_recipient_address: fromHexString3(validator.fee_recipient_address),
-      withdrawal_address: fromHexString3(validator.withdrawal_address)
+      fee_recipient_address: fromHexString4(validator.fee_recipient_address),
+      withdrawal_address: fromHexString4(validator.withdrawal_address)
     };
   });
   if (cluster.deposit_amounts) {
@@ -15023,7 +15299,7 @@ var hashClusterDefinitionV1X8 = (cluster, configOnly) => {
     });
   }
   if (!configOnly) {
-    val.config_hash = fromHexString3(cluster.config_hash);
+    val.config_hash = fromHexString4(cluster.config_hash);
   }
   return val;
 };
@@ -15050,35 +15326,35 @@ var hashClusterLockV1X8 = (cluster) => {
     (dValidator) => {
       var _a6, _b2, _c, _d, _e;
       return {
-        distributed_public_key: fromHexString3(
+        distributed_public_key: fromHexString4(
           dValidator.distributed_public_key
         ),
         public_shares: dValidator.public_shares.map(
-          (publicShare) => fromHexString3(publicShare)
+          (publicShare) => fromHexString4(publicShare)
         ),
         // should be fixed
         partial_deposit_data: dValidator.partial_deposit_data.map((depositData) => {
           return {
-            pubkey: fromHexString3(depositData.pubkey),
-            withdrawal_credentials: fromHexString3(
+            pubkey: fromHexString4(depositData.pubkey),
+            withdrawal_credentials: fromHexString4(
               depositData.withdrawal_credentials
             ),
             amount: parseInt(depositData.amount),
-            signature: fromHexString3(depositData.signature)
+            signature: fromHexString4(depositData.signature)
           };
         }),
         builder_registration: {
           message: {
-            fee_recipient: fromHexString3(
+            fee_recipient: fromHexString4(
               (_a6 = dValidator.builder_registration) == null ? void 0 : _a6.message.fee_recipient
             ),
             gas_limit: (_b2 = dValidator.builder_registration) == null ? void 0 : _b2.message.gas_limit,
             timestamp: (_c = dValidator.builder_registration) == null ? void 0 : _c.message.timestamp,
-            pubkey: fromHexString3(
+            pubkey: fromHexString4(
               (_d = dValidator.builder_registration) == null ? void 0 : _d.message.pubkey
             )
           },
-          signature: fromHexString3(
+          signature: fromHexString4(
             (_e = dValidator.builder_registration) == null ? void 0 : _e.signature
           )
         }
@@ -15090,6 +15366,22 @@ var hashClusterLockV1X8 = (cluster) => {
 var verifyDVV1X8 = (clusterLock) => __async(null, null, function* () {
   var _a6;
   const validators = clusterLock.distributed_validators;
+  const operatorCount = clusterLock.cluster_definition.operators.length;
+  const threshold = clusterLock.cluster_definition.threshold;
+  for (const validator of validators) {
+    if (validator.public_shares.length !== operatorCount) {
+      return false;
+    }
+    const uniqueShareCount = new Set(validator.public_shares).size;
+    if (uniqueShareCount !== validator.public_shares.length) {
+      return false;
+    }
+  }
+  const allShares = validators.map((v) => v.public_shares);
+  const allDKs = validators.map((v) => v.distributed_public_key);
+  if (!(yield verifySharesBinding(allShares, allDKs, threshold))) {
+    return false;
+  }
   const pubShares = [];
   const pubKeys = [];
   const builderRegistrationAndDepositDataMessages = [];
@@ -15098,8 +15390,18 @@ var verifyDVV1X8 = (clusterLock) => __async(null, null, function* () {
     const validator = validators[i];
     const validatorPublicShares = validator.public_shares;
     const distributedPublicKey = validator.distributed_public_key;
-    for (const element of validatorPublicShares) {
-      pubShares.push(fromHexString3(element));
+    if (validatorPublicShares.length !== operatorCount) {
+      return false;
+    }
+    const normalizedShares = validatorPublicShares.map((s) => s.toLowerCase());
+    if (new Set(normalizedShares).size !== normalizedShares.length) {
+      return false;
+    }
+    const validatorPublicSharesBytes = validatorPublicShares.map(
+      (share) => fromHexString4(share)
+    );
+    for (const share of validatorPublicSharesBytes) {
+      pubShares.push(share);
     }
     const depositAmounts = clusterLock.cluster_definition.deposit_amounts;
     if (!!depositAmounts && depositAmounts !== null) {
@@ -15122,9 +15424,9 @@ var verifyDVV1X8 = (clusterLock) => __async(null, null, function* () {
       if (!isValidDepositData) {
         return false;
       }
-      pubKeys.push(fromHexString3(distributedPublicKey));
+      pubKeys.push(fromHexString4(distributedPublicKey));
       builderRegistrationAndDepositDataMessages.push(depositDataMsg);
-      blsSignatures.push(fromHexString3(depositData == null ? void 0 : depositData.signature));
+      blsSignatures.push(fromHexString4(depositData == null ? void 0 : depositData.signature));
     }
     const { isValidBuilderRegistration, builderRegistrationMsg } = verifyBuilderRegistration(
       validator,
@@ -15134,18 +15436,17 @@ var verifyDVV1X8 = (clusterLock) => __async(null, null, function* () {
     if (!isValidBuilderRegistration) {
       return false;
     }
-    pubKeys.push(fromHexString3(distributedPublicKey));
+    pubKeys.push(fromHexString4(distributedPublicKey));
     builderRegistrationAndDepositDataMessages.push(builderRegistrationMsg);
     blsSignatures.push(
-      fromHexString3((_a6 = validator.builder_registration) == null ? void 0 : _a6.signature)
+      fromHexString4((_a6 = validator.builder_registration) == null ? void 0 : _a6.signature)
     );
   }
-  const aggregateBLSSignature = blsAggregateSignatures(blsSignatures);
-  if (!blsVerifyMultiple(
+  if (!(yield verifyBatchParallel(
     pubKeys,
     builderRegistrationAndDepositDataMessages,
-    aggregateBLSSignature
-  )) {
+    blsSignatures
+  ))) {
     return false;
   }
   if (!verifyNodeSignatures(clusterLock)) {
@@ -15153,8 +15454,8 @@ var verifyDVV1X8 = (clusterLock) => __async(null, null, function* () {
   }
   if (!blsVerifyAggregate(
     pubShares,
-    fromHexString3(clusterLock.lock_hash),
-    fromHexString3(clusterLock.signature_aggregate)
+    fromHexString4(clusterLock.lock_hash),
+    fromHexString4(clusterLock.signature_aggregate)
   )) {
     return false;
   }
@@ -15246,7 +15547,7 @@ import {
   ContainerType as ContainerType5,
   ListBasicType as ListBasicType2,
   ListCompositeType as ListCompositeType4,
-  fromHexString as fromHexString4,
+  fromHexString as fromHexString5,
   BooleanType
 } from "@chainsafe/ssz";
 var clusterDefinitionContainerTypeV1X10 = (configOnly) => {
@@ -15287,25 +15588,25 @@ var hashClusterDefinitionV1X10 = (cluster, configOnly) => {
   val.num_validators = cluster.num_validators;
   val.threshold = cluster.threshold;
   val.dkg_algorithm = strToUint8Array(cluster.dkg_algorithm);
-  val.fork_version = fromHexString4(cluster.fork_version);
+  val.fork_version = fromHexString5(cluster.fork_version);
   val.operators = cluster.operators.map((operator) => {
-    return configOnly ? { address: fromHexString4(operator.address) } : {
-      address: fromHexString4(operator.address),
+    return configOnly ? { address: fromHexString5(operator.address) } : {
+      address: fromHexString5(operator.address),
       enr: strToUint8Array(operator.enr),
-      config_signature: fromHexString4(operator.config_signature),
-      enr_signature: fromHexString4(operator.enr_signature)
+      config_signature: fromHexString5(operator.config_signature),
+      enr_signature: fromHexString5(operator.enr_signature)
     };
   });
-  val.creator = configOnly ? { address: fromHexString4(cluster.creator.address) } : {
-    address: fromHexString4(cluster.creator.address),
-    config_signature: fromHexString4(
+  val.creator = configOnly ? { address: fromHexString5(cluster.creator.address) } : {
+    address: fromHexString5(cluster.creator.address),
+    config_signature: fromHexString5(
       cluster.creator.config_signature
     )
   };
   val.validators = cluster.validators.map((validator) => {
     return {
-      fee_recipient_address: fromHexString4(validator.fee_recipient_address),
-      withdrawal_address: fromHexString4(validator.withdrawal_address)
+      fee_recipient_address: fromHexString5(validator.fee_recipient_address),
+      withdrawal_address: fromHexString5(validator.withdrawal_address)
     };
   });
   if (cluster.deposit_amounts) {
@@ -15323,7 +15624,7 @@ var hashClusterDefinitionV1X10 = (cluster, configOnly) => {
     val.compounding = cluster.compounding;
   }
   if (!configOnly) {
-    val.config_hash = fromHexString4(cluster.config_hash);
+    val.config_hash = fromHexString5(cluster.config_hash);
   }
   return val;
 };
@@ -15350,35 +15651,35 @@ var hashClusterLockV1X10 = (cluster) => {
     (dValidator) => {
       var _a6, _b2, _c, _d, _e;
       return {
-        distributed_public_key: fromHexString4(
+        distributed_public_key: fromHexString5(
           dValidator.distributed_public_key
         ),
         public_shares: dValidator.public_shares.map(
-          (publicShare) => fromHexString4(publicShare)
+          (publicShare) => fromHexString5(publicShare)
         ),
         // should be fixed
         partial_deposit_data: dValidator.partial_deposit_data.map((depositData) => {
           return {
-            pubkey: fromHexString4(depositData.pubkey),
-            withdrawal_credentials: fromHexString4(
+            pubkey: fromHexString5(depositData.pubkey),
+            withdrawal_credentials: fromHexString5(
               depositData.withdrawal_credentials
             ),
             amount: parseInt(depositData.amount),
-            signature: fromHexString4(depositData.signature)
+            signature: fromHexString5(depositData.signature)
           };
         }),
         builder_registration: {
           message: {
-            fee_recipient: fromHexString4(
+            fee_recipient: fromHexString5(
               (_a6 = dValidator.builder_registration) == null ? void 0 : _a6.message.fee_recipient
             ),
             gas_limit: (_b2 = dValidator.builder_registration) == null ? void 0 : _b2.message.gas_limit,
             timestamp: (_c = dValidator.builder_registration) == null ? void 0 : _c.message.timestamp,
-            pubkey: fromHexString4(
+            pubkey: fromHexString5(
               (_d = dValidator.builder_registration) == null ? void 0 : _d.message.pubkey
             )
           },
-          signature: fromHexString4(
+          signature: fromHexString5(
             (_e = dValidator.builder_registration) == null ? void 0 : _e.signature
           )
         }
@@ -15537,8 +15838,8 @@ var computeSigningRoot = (sszObjectRoot, domain) => {
 };
 var computeDepositMsgRoot = (msg) => {
   const depositMsgVal = depositMessageType.defaultValue();
-  depositMsgVal.pubkey = fromHexString5(msg.pubkey);
-  depositMsgVal.withdrawal_credentials = fromHexString5(
+  depositMsgVal.pubkey = fromHexString6(msg.pubkey);
+  depositMsgVal.withdrawal_credentials = fromHexString6(
     msg.withdrawal_credentials
   );
   depositMsgVal.amount = parseInt(msg.amount);
@@ -15552,16 +15853,16 @@ var computeForkDataRoot = (currentVersion, genesisValidatorsRoot) => {
 };
 var computebuilderRegistrationMsgRoot = (msg) => {
   const builderRegistrationMsgVal = builderRegistrationMessageType.defaultValue();
-  builderRegistrationMsgVal.fee_recipient = fromHexString5(msg.fee_recipient);
+  builderRegistrationMsgVal.fee_recipient = fromHexString6(msg.fee_recipient);
   builderRegistrationMsgVal.gas_limit = msg.gas_limit;
   builderRegistrationMsgVal.timestamp = msg.timestamp;
-  builderRegistrationMsgVal.pubkey = fromHexString5(msg.pubkey);
+  builderRegistrationMsgVal.pubkey = fromHexString6(msg.pubkey);
   return Buffer.from(
     builderRegistrationMessageType.hashTreeRoot(builderRegistrationMsgVal).buffer
   );
 };
-var computeDomain = (domainType, lockForkVersion, genesisValidatorsRoot = fromHexString5(GENESIS_VALIDATOR_ROOT)) => {
-  const forkVersion = fromHexString5(
+var computeDomain = (domainType, lockForkVersion, genesisValidatorsRoot = fromHexString6(GENESIS_VALIDATOR_ROOT)) => {
+  const forkVersion = fromHexString6(
     lockForkVersion.substring(2, lockForkVersion.length)
   );
   const forkDataRoot = computeForkDataRoot(forkVersion, genesisValidatorsRoot);
@@ -15572,7 +15873,7 @@ var computeDomain = (domainType, lockForkVersion, genesisValidatorsRoot = fromHe
 };
 var verifyDepositData = (distributedPublicKey, depositData, withdrawalAddress, forkVersion, compounding) => {
   const depositDomain = computeDomain(
-    fromHexString5(DOMAIN_DEPOSIT),
+    fromHexString6(DOMAIN_DEPOSIT),
     forkVersion
   );
   const withdrawalPrefix = compounding ? "0x02" : "0x01";
@@ -15589,16 +15890,16 @@ var verifyDepositData = (distributedPublicKey, depositData, withdrawalAddress, f
     return { isValidDepositData: false, depositDataMsg: depositDataRoot };
   }
   const isValidDepositData = blsVerify(
-    fromHexString5(depositData.pubkey),
+    fromHexString6(depositData.pubkey),
     depositDataRoot,
-    fromHexString5(depositData.signature)
+    fromHexString6(depositData.signature)
   );
   return { isValidDepositData, depositDataMsg: depositDataRoot };
 };
 var verifyBuilderRegistration = (validator, feeRecipientAddress, forkVersion) => {
   var _a6;
   const builderDomain = computeDomain(
-    fromHexString5(DOMAIN_APPLICATION_BUILDER),
+    fromHexString6(DOMAIN_APPLICATION_BUILDER),
     forkVersion
   );
   if (validator.distributed_public_key !== ((_a6 = validator.builder_registration) == null ? void 0 : _a6.message.pubkey)) {
@@ -15666,6 +15967,12 @@ var verifyLockData = (clusterLock) => __async(null, null, function* () {
   }
   return false;
 });
+var hasUniqueDistributedKeys = (clusterLock) => {
+  const dvKeys = clusterLock.distributed_validators.map(
+    (v) => v.distributed_public_key.toLowerCase()
+  );
+  return new Set(dvKeys).size === dvKeys.length;
+};
 var isValidClusterLock = (clusterLock, safeRpcUrl) => __async(null, null, function* () {
   try {
     const definitionType = definitionFlow(clusterLock.cluster_definition);
@@ -15686,6 +15993,9 @@ var isValidClusterLock = (clusterLock, safeRpcUrl) => __async(null, null, functi
     if (clusterLockHash(clusterLock) !== clusterLock.lock_hash) {
       return false;
     }
+    if (!hasUniqueDistributedKeys(clusterLock)) {
+      return false;
+    }
     const isValidLockData = yield verifyLockData(clusterLock);
     if (!isValidLockData) {
       return false;
@@ -19360,7 +19670,7 @@ import * as elliptic2 from "elliptic";
 import {
   ByteVectorType as ByteVectorType7,
   ContainerType as ContainerType7,
-  fromHexString as fromHexString7,
+  fromHexString as fromHexString8,
   ListCompositeType as ListCompositeType5,
   UintNumberType as UintNumberType6
 } from "@chainsafe/ssz";
@@ -19400,7 +19710,7 @@ function getGenesisValidatorsRoot(beaconNodeApiUrl) {
 }
 
 // src/exits/verificationHelpers.ts
-import { ContainerType as ContainerType6, ByteVectorType as ByteVectorType6, fromHexString as fromHexString6 } from "@chainsafe/ssz";
+import { ContainerType as ContainerType6, ByteVectorType as ByteVectorType6, fromHexString as fromHexString7 } from "@chainsafe/ssz";
 var GENESIS_VALIDATOR_ROOT_HEX_STRING = "0x0000000000000000000000000000000000000000000000000000000000000000";
 var ForkDataType = new ContainerType6({
   currentVersion: new ByteVectorType6(4),
@@ -19417,7 +19727,7 @@ function computeForkDataRoot2(currentVersion, genesisValidatorsRoot) {
   return Buffer.from(ForkDataType.hashTreeRoot(forkDataVal).buffer);
 }
 function computeDomain2(domainType, forkVersionString, genesisValidatorsRootOverride) {
-  const forkVersionBytes = fromHexString6(
+  const forkVersionBytes = fromHexString7(
     forkVersionString.substring(2, forkVersionString.length)
   );
   if (forkVersionBytes.length !== 4) {
@@ -19426,7 +19736,7 @@ function computeDomain2(domainType, forkVersionString, genesisValidatorsRootOver
   if (domainType.length !== 4) {
     throw new Error("Domain type must be 4 bytes");
   }
-  const actualGenesisValidatorsRoot = genesisValidatorsRootOverride != null ? genesisValidatorsRootOverride : fromHexString6(GENESIS_VALIDATOR_ROOT_HEX_STRING.substring(2));
+  const actualGenesisValidatorsRoot = genesisValidatorsRootOverride != null ? genesisValidatorsRootOverride : fromHexString7(GENESIS_VALIDATOR_ROOT_HEX_STRING.substring(2));
   if (actualGenesisValidatorsRoot.length !== 32) {
     throw new Error("genesisValidatorsRoot must be 32 bytes");
   }
@@ -19519,7 +19829,7 @@ var Exit = class _Exit {
   static computeExitPayloadRoot(exits) {
     const sszValue = SSZPartialExitsPayloadType.defaultValue();
     sszValue.partial_exits = exits.partial_exits.map((pe) => ({
-      public_key: fromHexString7(pe.public_key),
+      public_key: fromHexString8(pe.public_key),
       signed_exit_message: {
         message: {
           epoch: _Exit.safeParseInt(pe.signed_exit_message.message.epoch),
@@ -19527,7 +19837,7 @@ var Exit = class _Exit {
             pe.signed_exit_message.message.validator_index
           )
         },
-        signature: fromHexString7(pe.signed_exit_message.signature)
+        signature: fromHexString8(pe.signed_exit_message.signature)
       }
     }));
     sszValue.share_idx = exits.share_idx;
@@ -19577,18 +19887,18 @@ var Exit = class _Exit {
         signedExitMessage.message
       );
       const exitDomain = computeDomain2(
-        fromHexString7(DOMAIN_VOLUNTARY_EXIT),
+        fromHexString8(DOMAIN_VOLUNTARY_EXIT),
         capellaForkVersionString,
-        fromHexString7(genesisValidatorsRootString)
+        fromHexString8(genesisValidatorsRootString)
       );
       const messageSigningRoot = signingRoot2(
         exitDomain,
         partialExitMessageBuffer
       );
       return blsVerify(
-        fromHexString7(publicShareKey),
+        fromHexString8(publicShareKey),
         messageSigningRoot,
-        fromHexString7(signedExitMessage.signature)
+        fromHexString8(signedExitMessage.signature)
       );
     });
   }
@@ -19891,7 +20201,7 @@ var Exit = class _Exit {
           );
         }
         try {
-          const sigBytes = fromHexString7(cleanSigStr);
+          const sigBytes = fromHexString8(cleanSigStr);
           const sigIdx = parseInt(sigIdxStr, 10);
           signaturesByIndex.set(sigIdx + 1, sigBytes);
         } catch (err) {
@@ -21250,6 +21560,7 @@ export {
   Domain,
   EIP712_DOMAIN_NAME,
   EIP712_DOMAIN_VERSION,
+  ENR,
   ENRTypedMessage,
   EOA,
   ETHER_TO_GWEI,
@@ -21276,6 +21587,7 @@ export {
   blsVerify,
   clusterConfigOrDefinitionHash,
   clusterLockHash,
+  hasUniqueDistributedKeys,
   isChainSupportedForSplitters,
   isValidClusterLock,
   signCreatorConfigHashPayload,