Skip to content

fix: add proposer index bounds check before signature verification #9194

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nflaig merged 2 commits into from
Apr 5, 2026
Merged

fix: add proposer index bounds check before signature verification #9194

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
17c15b9
fix: add proposer index bounds check before signature verification
lodekeeper Apr 5, 2026
82914e3
fix: align proposer index check comment with spec PR 5047
lodekeeper Apr 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/beacon-node/src/chain/validation/block.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,11 @@ export async function validateGossipBlock(
}
}

// [REJECT] The proposer_index is valid -- i.e. block.proposer_index < len(state.validators)

@nflaig nflaig Apr 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that condition doesn't exist in the spec??

@lodekeeper lodekeeper Apr 5, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's in the executable spec from PR #5047 (bellatrix gossip validation):

# [REJECT] The proposer index is a valid validator index
if block.proposer_index >= len(state.validators):
    raise GossipReject("proposer index out of range")

The prose spec doesn't have it explicitly — it's implied by the signature check (no valid pubkey for an out-of-range index). But without this guard, the pubkey cache throws a raw Error before the signature verification runs, which bypasses the GossipActionError path entirely.

The test vectors also expect REJECT for reject_invalid_proposer_index. If you'd prefer a different approach (e.g., wrapping the signature path to catch the pubkey lookup error), happy to change it.

@nflaig nflaig Apr 5, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok please align the comment with whats' in 5047

@lodekeeper lodekeeper Apr 5, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the comment to match the spec wording from #5047.

if (proposerIndex >= blockState.validatorCount) {
throw new BlockGossipError(GossipAction.REJECT, {code: BlockErrorCode.UNKNOWN_PROPOSER, proposerIndex});
}

// [REJECT] The proposer signature, signed_beacon_block.signature, is valid with respect to the proposer_index pubkey.
if (!chain.seenBlockInputCache.isVerifiedProposerSignature(blockSlot, blockRoot, signedBlock.signature)) {
const signatureSet = getBlockProposerSignatureSet(chain.config, signedBlock);
Expand Down