Sidecar inclusion proof (#4900)

* Refactor BlobSidecar to new type

* Fix some compile errors

* Gossip verification compiles

* Fix http api types take 1

* Fix another round of compile errors

* Beacon node crate compiles

* EF tests compile

* Remove all blob signing from VC

* fmt

* Tests compile

* Fix some tests

* Fix more http tests

* get compiling

* Fix gossip conditions and tests

* Add basic proof generation and verification

* remove unnecessary ssz decode

* add back build_sidecar

* remove default at fork for blobs

* fix beacon chain tests

* get relase tests compiling

* fix lints

* fix existing spec tests

* add new ef tests

* fix gossip duplicate rule

* lints

* add back sidecar signature check in gossip

* add finalized descendant check to blob sidecar gossip

* fix error conversion

* fix release tests

* sidecar inclusion self review cleanup

* Add proof verification and computation metrics

* Remove accidentally committed file

* Unify some block and blob errors; add slashing conditions for sidecars

* Address review comment

* Clean up re-org tests (#4957)

* Address more review comments

* Add Comments & Eliminate Unnecessary Clones

* update names

* Update beacon_node/beacon_chain/src/metrics.rs

Co-authored-by: Jimmy Chen <jchen.tc@gmail.com>

* Update beacon_node/network/src/network_beacon_processor/tests.rs

Co-authored-by: Jimmy Chen <jchen.tc@gmail.com>

* pr feedback

* fix test compile

* Sidecar Inclusion proof small refactor and updates (#4967)

* Update some comments, variables and small cosmetic fixes.

* Couple blobs and proofs into a tuple in `PayloadAndBlobs` for simplicity and safety.

* Update function comment.

* Update testing/ef_tests/src/cases/merkle_proof_validity.rs

Co-authored-by: Jimmy Chen <jchen.tc@gmail.com>

* Rename the block and blob wrapper types used in the beacon API interfaces.

* make sure gossip invalid blobs are passed to the slasher (#4970)

* Add blob headers to slasher before adding to DA checker

* Replace Vec with HashSet in BlockQueue

* fmt

* Rename gindex -> index

* Simplify gossip condition

---------

Co-authored-by: realbigsean <seananderson33@gmail.com>
Co-authored-by: realbigsean <sean@sigmaprime.io>
Co-authored-by: Michael Sproul <michael@sigmaprime.io>
Co-authored-by: Mark Mackey <mark@sigmaprime.io>
Co-authored-by: Jimmy Chen <jchen.tc@gmail.com>

validator_client/src/block_service.rs

@@ -11,7 +11,7 @@ use crate::{
 };
 use bls::SignatureBytes;
 use environment::RuntimeContext;
-use eth2::types::{BlockContents, SignedBlockContents};
+use eth2::types::{FullBlockContents, PublishBlockRequest};
 use eth2::{BeaconNodeHttpClient, StatusCode};
 use slog::{crit, debug, error, info, trace, warn, Logger};
 use slot_clock::SlotClock;
@@ -22,7 +22,7 @@ use std::sync::Arc;
 use std::time::Duration;
 use tokio::sync::mpsc;
 use types::{
-    AbstractExecPayload, BlindedPayload, BlockType, EthSpec, FullPayload, Graffiti, PublicKeyBytes,
+    BlindedBeaconBlock, BlockType, EthSpec, Graffiti, PublicKeyBytes, SignedBlindedBeaconBlock,
     Slot,
 };
 
@@ -329,10 +329,7 @@ impl<T: SlotClock + 'static, E: EthSpec> BlockService<T, E> {
             self.inner.context.executor.spawn(
                 async move {
                     if builder_proposals {
-                        let result = service
-                            .clone()
-                            .publish_block::<BlindedPayload<E>>(slot, validator_pubkey)
-                            .await;
+                        let result = service.publish_block(slot, validator_pubkey, true).await;
                         match result {
                             Err(BlockError::Recoverable(e)) => {
                                 error!(
@@ -342,9 +339,8 @@ impl<T: SlotClock + 'static, E: EthSpec> BlockService<T, E> {
                                     "block_slot" => ?slot,
                                     "info" => "blinded proposal failed, attempting full block"
                                 );
-                                if let Err(e) = service
-                                    .publish_block::<FullPayload<E>>(slot, validator_pubkey)
-                                    .await
+                                if let Err(e) =
+                                    service.publish_block(slot, validator_pubkey, false).await
                                 {
                                     // Log a `crit` since a full block
                                     // (non-builder) proposal failed.
@@ -371,9 +367,8 @@ impl<T: SlotClock + 'static, E: EthSpec> BlockService<T, E> {
                             }
                             Ok(_) => {}
                         };
-                    } else if let Err(e) = service
-                        .publish_block::<FullPayload<E>>(slot, validator_pubkey)
-                        .await
+                    } else if let Err(e) =
+                        service.publish_block(slot, validator_pubkey, false).await
                     {
                         // Log a `crit` since a full block (non-builder)
                         // proposal failed.
@@ -394,10 +389,11 @@ impl<T: SlotClock + 'static, E: EthSpec> BlockService<T, E> {
     }
 
     /// Produce a block at the given slot for validator_pubkey
-    async fn publish_block<Payload: AbstractExecPayload<E>>(
-        self,
+    async fn publish_block(
+        &self,
         slot: Slot,
         validator_pubkey: PublicKeyBytes,
+        builder_proposal: bool,
     ) -> Result<(), BlockError> {
         let log = self.context.log();
         let _timer =
@@ -460,7 +456,7 @@ impl<T: SlotClock + 'static, E: EthSpec> BlockService<T, E> {
         //
         // Try the proposer nodes last, since it's likely that they don't have a
         // great view of attestations on the network.
-        let block_contents = proposer_fallback
+        let unsigned_block = proposer_fallback
             .request_proposers_last(
                 RequireSynced::No,
                 OfflineOnFailure::Yes,
@@ -471,20 +467,32 @@ impl<T: SlotClock + 'static, E: EthSpec> BlockService<T, E> {
                         randao_reveal_ref,
                         graffiti,
                         proposer_index,
+                        builder_proposal,
                         log,
                     )
                 },
             )
             .await?;
 
-        let (block, maybe_blob_sidecars) = block_contents.deconstruct();
         let signing_timer = metrics::start_timer(&metrics::BLOCK_SIGNING_TIMES);
 
-        let signed_block = match self_ref
-            .validator_store
-            .sign_block::<Payload>(*validator_pubkey_ref, block, current_slot)
-            .await
-        {
+        let res = match unsigned_block {
+            UnsignedBlock::Full(block_contents) => {
+                let (block, maybe_blobs) = block_contents.deconstruct();
+                self_ref
+                    .validator_store
+                    .sign_block(*validator_pubkey_ref, block, current_slot)
+                    .await
+                    .map(|b| SignedBlock::Full(PublishBlockRequest::new(b, maybe_blobs)))
+            }
+            UnsignedBlock::Blinded(block) => self_ref
+                .validator_store
+                .sign_block(*validator_pubkey_ref, block, current_slot)
+                .await
+                .map(SignedBlock::Blinded),
+        };
+
+        let signed_block = match res {
             Ok(block) => block,
             Err(ValidatorStoreError::UnknownPubkey(pubkey)) => {
                 // A pubkey can be missing when a validator was recently removed
@@ -506,36 +514,6 @@ impl<T: SlotClock + 'static, E: EthSpec> BlockService<T, E> {
             }
         };
 
-        let maybe_signed_blobs = match maybe_blob_sidecars {
-            Some(blob_sidecars) => {
-                match self_ref
-                    .validator_store
-                    .sign_blobs::<Payload>(*validator_pubkey_ref, blob_sidecars)
-                    .await
-                {
-                    Ok(signed_blobs) => Some(signed_blobs),
-                    Err(ValidatorStoreError::UnknownPubkey(pubkey)) => {
-                        // A pubkey can be missing when a validator was recently removed
-                        // via the API.
-                        warn!(
-                            log,
-                            "Missing pubkey for blobs";
-                            "info" => "a validator may have recently been removed from this VC",
-                            "pubkey" => ?pubkey,
-                            "slot" => ?slot
-                        );
-                        return Ok(());
-                    }
-                    Err(e) => {
-                        return Err(BlockError::Recoverable(format!(
-                            "Unable to sign blobs: {:?}",
-                            e
-                        )))
-                    }
-                }
-            }
-            None => None,
-        };
         let signing_time_ms =
             Duration::from_secs_f64(signing_timer.map_or(0.0, |t| t.stop_and_record())).as_millis();
 
@@ -546,8 +524,6 @@ impl<T: SlotClock + 'static, E: EthSpec> BlockService<T, E> {
             "signing_time_ms" => signing_time_ms,
         );
 
-        let signed_block_contents = SignedBlockContents::from((signed_block, maybe_signed_blobs));
-
         // Publish block with first available beacon node.
         //
         // Try the proposer nodes first, since we've likely gone to efforts to
@@ -558,11 +534,8 @@ impl<T: SlotClock + 'static, E: EthSpec> BlockService<T, E> {
                 RequireSynced::No,
                 OfflineOnFailure::Yes,
                 |beacon_node| async {
-                    self.publish_signed_block_contents::<Payload>(
-                        &signed_block_contents,
-                        beacon_node,
-                    )
-                    .await
+                    self.publish_signed_block_contents(&signed_block, beacon_node)
+                        .await
                 },
             )
             .await?;
@@ -570,41 +543,41 @@ impl<T: SlotClock + 'static, E: EthSpec> BlockService<T, E> {
         info!(
             log,
             "Successfully published block";
-            "block_type" => ?Payload::block_type(),
-            "deposits" => signed_block_contents.signed_block().message().body().deposits().len(),
-            "attestations" => signed_block_contents.signed_block().message().body().attestations().len(),
+            "block_type" => ?signed_block.block_type(),
+            "deposits" => signed_block.num_deposits(),
+            "attestations" => signed_block.num_attestations(),
             "graffiti" => ?graffiti.map(|g| g.as_utf8_lossy()),
-            "slot" => signed_block_contents.signed_block().slot().as_u64(),
+            "slot" => signed_block.slot().as_u64(),
         );
 
         Ok(())
     }
 
-    async fn publish_signed_block_contents<Payload: AbstractExecPayload<E>>(
+    async fn publish_signed_block_contents(
         &self,
-        signed_block_contents: &SignedBlockContents<E, Payload>,
+        signed_block: &SignedBlock<E>,
         beacon_node: &BeaconNodeHttpClient,
     ) -> Result<(), BlockError> {
         let log = self.context.log();
-        let slot = signed_block_contents.signed_block().slot();
-        match Payload::block_type() {
-            BlockType::Full => {
+        let slot = signed_block.slot();
+        match signed_block {
+            SignedBlock::Full(signed_block) => {
                 let _post_timer = metrics::start_timer_vec(
                     &metrics::BLOCK_SERVICE_TIMES,
                     &[metrics::BEACON_BLOCK_HTTP_POST],
                 );
                 beacon_node
-                    .post_beacon_blocks(signed_block_contents)
+                    .post_beacon_blocks(signed_block)
                     .await
                     .or_else(|e| handle_block_post_error(e, slot, log))?
             }
-            BlockType::Blinded => {
+            SignedBlock::Blinded(signed_block) => {
                 let _post_timer = metrics::start_timer_vec(
                     &metrics::BLOCK_SERVICE_TIMES,
                     &[metrics::BLINDED_BEACON_BLOCK_HTTP_POST],
                 );
                 beacon_node
-                    .post_beacon_blinded_blocks(signed_block_contents)
+                    .post_beacon_blinded_blocks(signed_block)
                     .await
                     .or_else(|e| handle_block_post_error(e, slot, log))?
             }
@@ -612,22 +585,23 @@ impl<T: SlotClock + 'static, E: EthSpec> BlockService<T, E> {
         Ok::<_, BlockError>(())
     }
 
-    async fn get_validator_block<Payload: AbstractExecPayload<E>>(
+    async fn get_validator_block(
         beacon_node: &BeaconNodeHttpClient,
         slot: Slot,
         randao_reveal_ref: &SignatureBytes,
         graffiti: Option<Graffiti>,
         proposer_index: Option<u64>,
+        builder_proposal: bool,
         log: &Logger,
-    ) -> Result<BlockContents<E, Payload>, BlockError> {
-        let block_contents: BlockContents<E, Payload> = match Payload::block_type() {
-            BlockType::Full => {
-                let _get_timer = metrics::start_timer_vec(
-                    &metrics::BLOCK_SERVICE_TIMES,
-                    &[metrics::BEACON_BLOCK_HTTP_GET],
-                );
+    ) -> Result<UnsignedBlock<E>, BlockError> {
+        let unsigned_block = if !builder_proposal {
+            let _get_timer = metrics::start_timer_vec(
+                &metrics::BLOCK_SERVICE_TIMES,
+                &[metrics::BEACON_BLOCK_HTTP_GET],
+            );
+            UnsignedBlock::Full(
                 beacon_node
-                    .get_validator_blocks::<E, Payload>(slot, randao_reveal_ref, graffiti.as_ref())
+                    .get_validator_blocks::<E>(slot, randao_reveal_ref, graffiti.as_ref())
                     .await
                     .map_err(|e| {
                         BlockError::Recoverable(format!(
@@ -635,19 +609,16 @@ impl<T: SlotClock + 'static, E: EthSpec> BlockService<T, E> {
                             e
                         ))
                     })?
-                    .data
-            }
-            BlockType::Blinded => {
-                let _get_timer = metrics::start_timer_vec(
-                    &metrics::BLOCK_SERVICE_TIMES,
-                    &[metrics::BLINDED_BEACON_BLOCK_HTTP_GET],
-                );
+                    .data,
+            )
+        } else {
+            let _get_timer = metrics::start_timer_vec(
+                &metrics::BLOCK_SERVICE_TIMES,
+                &[metrics::BLINDED_BEACON_BLOCK_HTTP_GET],
+            );
+            UnsignedBlock::Blinded(
                 beacon_node
-                    .get_validator_blinded_blocks::<E, Payload>(
-                        slot,
-                        randao_reveal_ref,
-                        graffiti.as_ref(),
-                    )
+                    .get_validator_blinded_blocks::<E>(slot, randao_reveal_ref, graffiti.as_ref())
                     .await
                     .map_err(|e| {
                         BlockError::Recoverable(format!(
@@ -655,8 +626,8 @@ impl<T: SlotClock + 'static, E: EthSpec> BlockService<T, E> {
                             e
                         ))
                     })?
-                    .data
-            }
+                    .data,
+            )
         };
 
         info!(
@@ -664,13 +635,59 @@ impl<T: SlotClock + 'static, E: EthSpec> BlockService<T, E> {
             "Received unsigned block";
             "slot" => slot.as_u64(),
         );
-        if proposer_index != Some(block_contents.block().proposer_index()) {
+        if proposer_index != Some(unsigned_block.proposer_index()) {
             return Err(BlockError::Recoverable(
                 "Proposer index does not match block proposer. Beacon chain re-orged".to_string(),
             ));
         }
 
-        Ok::<_, BlockError>(block_contents)
+        Ok::<_, BlockError>(unsigned_block)
+    }
+}
+
+pub enum UnsignedBlock<E: EthSpec> {
+    Full(FullBlockContents<E>),
+    Blinded(BlindedBeaconBlock<E>),
+}
+
+impl<E: EthSpec> UnsignedBlock<E> {
+    pub fn proposer_index(&self) -> u64 {
+        match self {
+            UnsignedBlock::Full(block) => block.block().proposer_index(),
+            UnsignedBlock::Blinded(block) => block.proposer_index(),
+        }
+    }
+}
+
+pub enum SignedBlock<E: EthSpec> {
+    Full(PublishBlockRequest<E>),
+    Blinded(SignedBlindedBeaconBlock<E>),
+}
+
+impl<E: EthSpec> SignedBlock<E> {
+    pub fn block_type(&self) -> BlockType {
+        match self {
+            SignedBlock::Full(_) => BlockType::Full,
+            SignedBlock::Blinded(_) => BlockType::Blinded,
+        }
+    }
+    pub fn slot(&self) -> Slot {
+        match self {
+            SignedBlock::Full(block) => block.signed_block().message().slot(),
+            SignedBlock::Blinded(block) => block.message().slot(),
+        }
+    }
+    pub fn num_deposits(&self) -> usize {
+        match self {
+            SignedBlock::Full(block) => block.signed_block().message().body().deposits().len(),
+            SignedBlock::Blinded(block) => block.message().body().deposits().len(),
+        }
+    }
+    pub fn num_attestations(&self) -> usize {
+        match self {
+            SignedBlock::Full(block) => block.signed_block().message().body().attestations().len(),
+            SignedBlock::Blinded(block) => block.message().body().attestations().len(),
+        }
     }
 }
 

validator_client/src/http_metrics/metrics.rs

@@ -59,11 +59,6 @@ lazy_static::lazy_static! {
         "Total count of attempted block signings",
         &["status"]
     );
-    pub static ref SIGNED_BLOBS_TOTAL: Result<IntCounterVec> = try_create_int_counter_vec(
-        "vc_signed_beacon_blobs_total",
-        "Total count of attempted blob signings",
-        &["status"]
-    );
     pub static ref SIGNED_ATTESTATIONS_TOTAL: Result<IntCounterVec> = try_create_int_counter_vec(
         "vc_signed_attestations_total",
         "Total count of attempted Attestation signings",

validator_client/src/signing_method.rs

@@ -37,7 +37,6 @@ pub enum Error {
 pub enum SignableMessage<'a, T: EthSpec, Payload: AbstractExecPayload<T> = FullPayload<T>> {
     RandaoReveal(Epoch),
     BeaconBlock(&'a BeaconBlock<T, Payload>),
-    BlobSidecar(&'a Payload::Sidecar),
     AttestationData(&'a AttestationData),
     SignedAggregateAndProof(&'a AggregateAndProof<T>),
     SelectionProof(Slot),
@@ -60,7 +59,6 @@ impl<'a, T: EthSpec, Payload: AbstractExecPayload<T>> SignableMessage<'a, T, Pay
         match self {
             SignableMessage::RandaoReveal(epoch) => epoch.signing_root(domain),
             SignableMessage::BeaconBlock(b) => b.signing_root(domain),
-            SignableMessage::BlobSidecar(b) => b.signing_root(domain),
             SignableMessage::AttestationData(a) => a.signing_root(domain),
             SignableMessage::SignedAggregateAndProof(a) => a.signing_root(domain),
             SignableMessage::SelectionProof(slot) => slot.signing_root(domain),
@@ -184,10 +182,6 @@ impl SigningMethod {
                         Web3SignerObject::RandaoReveal { epoch }
                     }
                     SignableMessage::BeaconBlock(block) => Web3SignerObject::beacon_block(block)?,
-                    SignableMessage::BlobSidecar(_) => {
-                        // https://github.com/ConsenSys/web3signer/issues/726
-                        unimplemented!("Web3Signer blob signing not implemented.")
-                    }
                     SignableMessage::AttestationData(a) => Web3SignerObject::Attestation(a),
                     SignableMessage::SignedAggregateAndProof(a) => {
                         Web3SignerObject::AggregateAndProof(a)

validator_client/src/validator_store.rs

@@ -6,7 +6,6 @@ use crate::{
     Config,
 };
 use account_utils::validator_definitions::{PasswordStorage, ValidatorDefinition};
-use eth2::types::VariableList;
 use parking_lot::{Mutex, RwLock};
 use slashing_protection::{
     interchange::Interchange, InterchangeError, NotSafe, Safe, SlashingDatabase,
@@ -18,16 +17,14 @@ use std::marker::PhantomData;
 use std::path::Path;
 use std::sync::Arc;
 use task_executor::TaskExecutor;
-use types::sidecar::Sidecar;
 use types::{
     attestation::Error as AttestationError, graffiti::GraffitiString, AbstractExecPayload, Address,
     AggregateAndProof, Attestation, BeaconBlock, BlindedPayload, ChainSpec, ContributionAndProof,
     Domain, Epoch, EthSpec, Fork, ForkName, Graffiti, Hash256, Keypair, PublicKeyBytes,
-    SelectionProof, SidecarList, Signature, SignedAggregateAndProof, SignedBeaconBlock,
-    SignedContributionAndProof, SignedRoot, SignedSidecar, SignedSidecarList,
-    SignedValidatorRegistrationData, SignedVoluntaryExit, Slot, SyncAggregatorSelectionData,
-    SyncCommitteeContribution, SyncCommitteeMessage, SyncSelectionProof, SyncSubnetId,
-    ValidatorRegistrationData, VoluntaryExit,
+    SelectionProof, Signature, SignedAggregateAndProof, SignedBeaconBlock,
+    SignedContributionAndProof, SignedRoot, SignedValidatorRegistrationData, SignedVoluntaryExit,
+    Slot, SyncAggregatorSelectionData, SyncCommitteeContribution, SyncCommitteeMessage,
+    SyncSelectionProof, SyncSubnetId, ValidatorRegistrationData, VoluntaryExit,
 };
 use validator_dir::ValidatorDir;
 
@@ -567,39 +564,6 @@ impl<T: SlotClock + 'static, E: EthSpec> ValidatorStore<T, E> {
         }
     }
 
-    pub async fn sign_blobs<Payload: AbstractExecPayload<E>>(
-        &self,
-        validator_pubkey: PublicKeyBytes,
-        blob_sidecars: SidecarList<E, Payload::Sidecar>,
-    ) -> Result<SignedSidecarList<E, Payload::Sidecar>, Error> {
-        let mut signed_blob_sidecars = Vec::new();
-        for blob_sidecar in blob_sidecars.into_iter() {
-            let slot = blob_sidecar.slot();
-            let signing_epoch = slot.epoch(E::slots_per_epoch());
-            let signing_context = self.signing_context(Domain::BlobSidecar, signing_epoch);
-            let signing_method = self.doppelganger_checked_signing_method(validator_pubkey)?;
-
-            let signature = signing_method
-                .get_signature::<E, Payload>(
-                    SignableMessage::BlobSidecar(blob_sidecar.as_ref()),
-                    signing_context,
-                    &self.spec,
-                    &self.task_executor,
-                )
-                .await?;
-
-            metrics::inc_counter_vec(&metrics::SIGNED_BLOBS_TOTAL, &[metrics::SUCCESS]);
-
-            signed_blob_sidecars.push(SignedSidecar {
-                message: blob_sidecar,
-                signature,
-                _phantom: PhantomData,
-            });
-        }
-
-        Ok(VariableList::from(signed_blob_sidecars))
-    }
-
     pub async fn sign_attestation(
         &self,
         validator_pubkey: PublicKeyBytes,