erigontech / erigontech/erigon

cl/phase1/network/services: gossip block KZG-commitment bound is skipped, not rejected, when the schema disagrees with the slot

Open
#22,819 1 comment 0 reactions 1 assignee Claimed by @domiwei View on GitHub
Caplin tech debt reduction
Dominant language
Go
Stars
3.6k
Forks
1.5k
Avg merge
1d 16h
Merged PRs (30d)
455

Description

## Problem

`blockService.ProcessMessage` (`cl/phase1/network/services/block_service.go`) derives the fork from the block's slot:

```go
epoch := msg.Block.Slot / b.beaconCfg.SlotsPerEpoch
blockVersion := b.beaconCfg.GetCurrentStateVersion(epoch)
```

and then branches on it while reading fields belonging to the schema the block was actually decoded with. The two branches disagree about what an absent field means:

- the Gloas branch **rejects** — `bid == nil || bid.Message == nil` returns `missing signed_execution_payload_bid in GLOAS block`;
- the pre-Gloas branch **skips** — `else if msg.Block.Body.BlobKzgCommitments != nil && ...Len() > int(maxBlobsPerBlock)`, so a nil list means `ErrInvalidCommitmentsCount` is never evaluated and the block goes straight on to `processAndStoreBlock`.

A Gloas-schema block whose slot maps to a pre-Gloas fork therefore bypasses the commitment-count bound rather than being rejected by it. The nil check is doing its job as a nil check; it is the validation semantics that are wrong, because absent and within-bounds are being treated as the same answer.

## Scope

Narrower than the req/resp sinks in #22807. Gossip decodes with the local clock — `GetCurrentStateVersion(ethClock.GetCurrentEpoch())` in `cl/phase1/network/gossip/gossip_manager.go` — rather than a peer-supplied fork digest, so a peer cannot select the schema at will. The disagreement is confined to the window where the block's slot and the local clock sit on opposite sides of the Gloas boundary. Nothing crashes.

## Suggested fix

Have the pre-Gloas branch reject a nil `BlobKzgCommitments` the way the Gloas branch rejects a nil bid, so an absent field can never stand in for a satisfied bound. If the schema/slot predicate from #22797 lands, asserting agreement before the branch would make both arms unreachable with the wrong schema and is the cleaner shape.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.