fix: validate cached validator indices against state - #9748
Merged
Conversation
Contributor
Performance Report✔️ no performance regression detected Full benchmark results
|
lodekeeper
approved these changes
Aug 2, 2026
lodekeeper
left a comment
Contributor
There was a problem hiding this comment.
Approving — this resolves the issue.
I independently reproduced the crash end-to-end first (Kurtosis, latest ethereum-package images — Lodestar v1.41.0 + Lighthouse v8.1.2). It fails with exactly the stack this fixes: TypeError: Cannot read properties of undefined (reading 'withdrawalCredentials') at processWithdrawalRequest.ts:86 ← :40 ← processOperations.ts:82, with the victim pinned one slot behind a finalized block until restart. The call site is unchanged since #7284, so this reproduces on v1.44/v1.45/unstable identically.
Fix review:
processWithdrawalRequest.ts—!isValidatorKnown(state, validatorIndex)is the correct guard. It matches the existing pattern inprocessPendingDepositsand restores the spec-mandated silent no-op instead of throwing.isValidatorKnowntakesValidatorIndex | nulland narrows, so thenullcase is still covered by the same check.validator/index.ts(builder-registration filter) — good catch, this is the same shared-pubkeyCachehazard feedingheadState.getValidator(...).validatorIndex >= headState.validatorCountis the right bound and returningfalse(skip the registration) is the correct behavior for a pubkey the head state doesn't hold.- Swept the other shared-cache consumers to be sure nothing else is exposed:
beacon/state/utils.tsalready bounds-checks (>= state.validatorCount);processConsolidationRequest/processDeposit/processPendingDeposits/upgradeStateToGloasall already guard viaisPubkeyKnown/isValidatorKnown/ an inline bound. No remaining unguarded site. - Regression test faithfully reproduces the poisoning: adds the pubkey to the shared cache through a clone at index
validators.length, assertsgetValidatorIndexresolves it out-of-range for the base state, then thatprocessWithdrawalRequestno-ops without throwing.
CI green across the board. LGTM.
🤖 Generated with AI assistance
nazarhussain
approved these changes
Aug 3, 2026
Member
|
🎉 This PR is included in v1.46.0 🎉 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.