erigontech / erigontech/erigon
cl/phase1/network/services: gossip block KZG-commitment bound is skipped, not rejected, when the schema disagrees with the slot
- Dominant language
- Go
- Stars
- 3.6k
- Forks
- 1.5k
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 455
Description
## Problem
`blockService.ProcessMessage` (`cl/phase1/network/services/block_service.go`) derives the fork from the block's slot:
```go
epoch := msg.Block.Slot / b.beaconCfg.SlotsPerEpoch
blockVersion := b.beaconCfg.GetCurrentStateVersion(epoch)
```
and then branches on it while reading fields belonging to the schema the block was actually decoded with. The two branches disagree about what an absent field means:
- the Gloas branch **rejects** — `bid == nil || bid.Message == nil` returns `missing signed_execution_payload_bid in GLOAS block`;
- the pre-Gloas branch **skips** — `else if msg.Block.Body.BlobKzgCommitments != nil && ...Len() > int(maxBlobsPerBlock)`, so a nil list means `ErrInvalidCommitmentsCount` is never evaluated and the block goes straight on to `processAndStoreBlock`.
A Gloas-schema block whose slot maps to a pre-Gloas fork therefore bypasses the commitment-count bound rather than being rejected by it. The nil check is doing its job as a nil check; it is the validation semantics that are wrong, because absent and within-bounds are being treated as the same answer.
## Scope
Narrower than the req/resp sinks in #22807. Gossip decodes with the local clock — `GetCurrentStateVersion(ethClock.GetCurrentEpoch())` in `cl/phase1/network/gossip/gossip_manager.go` — rather than a peer-supplied fork digest, so a peer cannot select the schema at will. The disagreement is confined to the window where the block's slot and the local clock sit on opposite sides of the Gloas boundary. Nothing crashes.
## Suggested fix
Have the pre-Gloas branch reject a nil `BlobKzgCommitments` the way the Gloas branch rejects a nil bid, so an absent field can never stand in for a satisfied bound. If the schema/slot predicate from #22797 lands, asserting agreement before the branch would make both arms unreachable with the wrong schema and is the cleaner shape.
Contributor guide
Assessment
This issue has not been assessed yet.