should_extend_payload and gossip bid verification changes

consensus/fork_choice/src/fork_choice.rs

@@ -1631,9 +1631,10 @@ where
 
     /// Returns whether the proposer should extend the execution payload chain of the given block.
     pub fn should_extend_payload(&self, block_root: &Hash256) -> Result<bool, Error<T::Error>> {
+        let current_slot = self.fc_store.get_current_slot();
         let proposer_boost_root = self.fc_store.proposer_boost_root();
         self.proto_array
-            .should_extend_payload::<E>(block_root, proposer_boost_root)
+            .should_extend_payload::<E>(block_root, current_slot, proposer_boost_root)
             .map_err(Error::ProtoArrayStringError)
     }
 

consensus/proto_array/src/error.rs

@@ -1,6 +1,6 @@
 use crate::PayloadStatus;
 use safe_arith::ArithError;
-use types::{Epoch, ExecutionBlockHash, Hash256};
+use types::{Epoch, ExecutionBlockHash, Hash256, Slot};
 
 #[derive(Clone, PartialEq, Debug)]
 pub enum Error {
@@ -63,6 +63,14 @@ pub enum Error {
         block_root: Hash256,
         payload_status: PayloadStatus,
     },
+    /// `should_extend_payload` was called for a block whose slot is not the previous slot.
+    ///
+    /// Spec equivalent: `assert store.blocks[root].slot + 1 == get_current_slot(store)`.
+    ShouldExtendPayloadInvalidSlot {
+        block_root: Hash256,
+        block_slot: Slot,
+        current_slot: Slot,
+    },
 }
 
 impl From<ArithError> for Error {

consensus/proto_array/src/proto_array.rs

@@ -1564,7 +1564,12 @@ impl ProtoArray {
             Ok(fc_node.payload_status as u8)
         } else if fc_node.payload_status == PayloadStatus::Empty {
             Ok(1)
-        } else if self.should_extend_payload::<E>(fc_node, proto_node, proposer_boost_root)? {
+        } else if self.should_extend_payload::<E>(
+            fc_node,
+            proto_node,
+            current_slot,
+            proposer_boost_root,
+        )? {
             Ok(2)
         } else {
             Ok(0)
@@ -1614,8 +1619,17 @@ impl ProtoArray {
         &self,
         fc_node: &IndexedForkChoiceNode,
         proto_node: &ProtoNode,
+        current_slot: Slot,
         proposer_boost_root: Hash256,
     ) -> Result<bool, Error> {
+        if proto_node.slot().saturating_add(1u64) != current_slot {
+            return Err(Error::ShouldExtendPayloadInvalidSlot {
+                block_root: fc_node.root,
+                block_slot: proto_node.slot(),
+                current_slot,
+            });
+        }
+
         let Ok(node) = proto_node.as_v29() else {
             return Err(Error::InvalidNodeVariant {
                 block_root: fc_node.root,

consensus/proto_array/src/proto_array_fork_choice.rs

@@ -999,6 +999,7 @@ impl ProtoArrayForkChoice {
     pub fn should_extend_payload<E: EthSpec>(
         &self,
         block_root: &Hash256,
+        current_slot: Slot,
         proposer_boost_root: Hash256,
     ) -> Result<bool, String> {
         let block_index = self
@@ -1017,7 +1018,7 @@ impl ProtoArrayForkChoice {
             payload_status: proto_node.get_parent_payload_status(),
         };
         self.proto_array
-            .should_extend_payload::<E>(&fc_node, proto_node, proposer_boost_root)
+            .should_extend_payload::<E>(&fc_node, proto_node, current_slot, proposer_boost_root)
             .map_err(|e| format!("{e:?}"))
     }
 

consensus/state_processing/src/per_block_processing/process_operations.rs

@@ -397,7 +397,9 @@ pub fn process_proposer_slashings<E: EthSpec>(
 
             // [New in Gloas:EIP7732]
             // Remove the BuilderPendingPayment corresponding to this proposal
-            // if it is still in the 2-epoch window.
+            // if it is still in the 2-epoch window. Only clear it when the slashed validator is
+            // the proposer associated with the payment; otherwise an unrelated same-slot
+            // equivocation could grief an honest proposer's payment.
             if state.fork_name_unchecked().gloas_enabled() {
                 let slot = proposer_slashing.signed_header_1.message.slot;
                 let proposal_epoch = slot.epoch(E::slots_per_epoch());