should_extend_payload and gossip bid verification changes

beacon_node/beacon_chain/src/payload_bid_verification/gossip_verified_bid.rs

@@ -158,6 +158,14 @@ impl<T: BeaconChainTypes> GossipVerifiedPayloadBid<T> {
             });
         }
 
+        // [REJECT] `bid.prev_randao` is the correct RANDAO mix -- i.e. validate that
+        // `bid.prev_randao == get_randao_mix(parent_state, get_current_epoch(parent_state))`
+        if signed_bid.message.prev_randao
+            != *head_state.get_randao_mix(current_slot.epoch(T::EthSpec::slots_per_epoch()))?
+        {
+            return Err(PayloadBidError::InvalidPrevRandao { slot: bid_slot });
+        }
+
         // TODO(gloas) reprocess bids whose parent_block_root becomes canonical after a reorg.
         let head_root = cached_head.head_block_root();
         if !fork_choice.is_descendant(bid_parent_block_root, head_root) {

beacon_node/beacon_chain/src/payload_bid_verification/mod.rs

@@ -59,6 +59,8 @@ pub enum PayloadBidError {
         max_blobs_per_block: usize,
         blob_kzg_commitments_len: usize,
     },
+    /// The bids prev randao value is invalid
+    InvalidPrevRandao { slot: Slot },
     /// Some Beacon State error
     BeaconStateError(BeaconStateError),
     /// Internal error

beacon_node/network/src/network_beacon_processor/gossip_methods.rs

@@ -4025,6 +4025,7 @@ impl<T: BeaconChainTypes> NetworkBeaconProcessor<T> {
                 | PayloadBidError::ExecutionPaymentNonZero { .. }
                 | PayloadBidError::InvalidBlobKzgCommitments { .. }
                 | PayloadBidError::BidNotDescendantOfParent { .. },
+                | PayloadBidError::InvalidPrevRandao { .. },
             ) => {
                 self.propagate_validation_result(message_id, peer_id, MessageAcceptance::Reject);
                 self.gossip_penalize_peer(