Wallet-based, encrypted key management (#1138)

* Update hashmap hashset to stable futures * Adds panic test to hashset delay * Port remote_beacon_node to stable futures * Fix lcli merge conflicts * Non rpc stuff compiles * Remove padding * Add error enum, zeroize more things * Fix comment * protocol.rs compiles * Port websockets, timer and notifier to stable futures (#1035) * Fix lcli * Port timer to stable futures * Fix timer * Port websocket_server to stable futures * Port notifier to stable futures * Add TODOS * Port remote_beacon_node to stable futures * Partial eth2-libp2p stable future upgrade * Finished first round of fighting RPC types * Further progress towards porting eth2-libp2p adds caching to discovery * Update behaviour * Add keystore builder * Remove keystore stuff from val client * Add more tests, comments * RPC handler to stable futures * Update RPC to master libp2p * Add more comments, test vectors * Network service additions * Progress on improving JSON validation * More JSON verification * Start moving JSON into own mod * Remove old code * Add more tests, reader/writers * Tidy * Move keystore into own file * Move more logic into keystore file * Tidy * Tidy * Fix the fallback transport construction (#1102) * Allow for odd-character hex * Correct warning * Remove hashmap delay * Compiling version of eth2-libp2p * Update all crates versions * Fix conversion function and add tests (#1113) * Add more json missing field checks * Use scrypt by default * Tidy, address comments * Test path and uuid in vectors * Fix comment * Add checks for kdf params * Enforce empty kdf message * Port validator_client to stable futures (#1114) * Add PH & MS slot clock changes * Account for genesis time * Add progress on duties refactor * Add simple is_aggregator bool to val subscription * Start work on attestation_verification.rs * Add progress on ObservedAttestations * Progress with ObservedAttestations * Fix tests * Add observed attestations to the beacon chain * Add attestation observation to processing code * Add progress on attestation verification * Add first draft of ObservedAttesters * Add more tests * Add observed attesters to beacon chain * Add observers to attestation processing * Add more attestation verification * Create ObservedAggregators map * Remove commented-out code * Add observed aggregators into chain * Add progress * Finish adding features to attestation verification * Ensure beacon chain compiles * Link attn verification into chain * Integrate new attn verification in chain * Remove old attestation processing code * Start trying to fix beacon_chain tests * Split adding into pools into two functions * Add aggregation to harness * Get test harness working again * Adjust the number of aggregators for test harness * Fix edge-case in harness * Integrate new attn processing in network * Fix compile bug in validator_client * Update validator API endpoints * Fix aggreagation in test harness * Fix enum thing * Fix attestation observation bug: * Patch failing API tests * Start adding comments to attestation verification * Remove unused attestation field * Unify "is block known" logic * Update comments * Supress fork choice errors for network processing * Add todos * Tidy * Add gossip attn tests * Disallow test harness to produce old attns * Comment out in-progress tests * Partially address pruning tests * Fix failing store test * Add aggregate tests * Add comments about which spec conditions we check * Dont re-aggregate * Split apart test harness attn production * Fix compile error in network * Make progress on commented-out test * Fix skipping attestation test * Add fork choice verification tests * Tidy attn tests, remove dead code * Remove some accidentally added code * Fix clippy lint * Rename test file * Add block tests, add cheap block proposer check * Rename block testing file * Add observed_block_producers * Tidy * Switch around block signature verification * Finish block testing * Remove gossip from signature tests * First pass of self review * Fix deviation in spec * Update test spec tags * Start moving over to hashset * Finish moving observed attesters to hashmap * Move aggregation pool over to hashmap * Make fc attn borrow again * Fix rest_api compile error * Fix missing comments * Fix monster test * Uncomment increasing slots test * Address remaining comments * Remove unsafe, use cfg test * Remove cfg test flag * Fix dodgy comment * Revert "Update hashmap hashset to stable futures" This reverts commit d432378a3c. * Revert "Adds panic test to hashset delay" This reverts commit 281502396f. * Ported attestation_service * Ported duties_service * Ported fork_service * More ports * Port block_service * Minor fixes * VC compiles * Update TODOS * Borrow self where possible * Ignore aggregates that are already known. * Unify aggregator modulo logic * Fix typo in logs * Refactor validator subscription logic * Avoid reproducing selection proof * Skip HTTP call if no subscriptions * Rename DutyAndState -> DutyAndProof * Tidy logs * Print root as dbg * Fix compile errors in tests * Fix compile error in test * Re-Fix attestation and duties service * Minor fixes Co-authored-by: Paul Hauner <paul@paulhauner.com> * Expose json_keystore mod * First commits on path derivation * Progress with implementation * More progress * Passing intermediate test vectors * Tidy, add comments * Add DerivedKey structs * Move key derivation into own crate * Add zeroize structs * Return error for empty seed * Add tests * Tidy * First commits on path derivation * Progress with implementation * Move key derivation into own crate * Start defining JSON wallet * Add progress * Split out encrypt/decrypt * First commits on path derivation * Progress with implementation * More progress * Passing intermediate test vectors * Tidy, add comments * Add DerivedKey structs * Move key derivation into own crate * Add zeroize structs * Return error for empty seed * Add tests * Tidy * Add progress * Replace some password usage with slice * First commits on path derivation * Progress with implementation * More progress * Passing intermediate test vectors * Tidy, add comments * Add DerivedKey structs * Move key derivation into own crate * Add zeroize structs * Return error for empty seed * Add tests * Tidy * Add progress * Expose PlainText struct * First commits on path derivation * Progress with implementation * More progress * Passing intermediate test vectors * Tidy, add comments * Add DerivedKey structs * Move key derivation into own crate * Add zeroize structs * Return error for empty seed * Add tests * Tidy * Add builder * Expose consts, remove Password * Minor progress * Expose SALT_SIZE * First compiling version * Add test vectors * Network crate update to stable futures * Move dbg assert statement * Port account_manager to stable futures (#1121) * Port account_manager to stable futures * Run async fns in tokio environment * Port rest_api crate to stable futures (#1118) * Port rest_api lib to stable futures * Reduce tokio features * Update notifier to stable futures * Builder update * Further updates * Add mnemonic, tidy * Convert self referential async functions * Tidy * Add testing * Add first attempt at validator_dir * Present pubkey field * stable futures fixes (#1124) * Fix eth1 update functions * Fix genesis and client * Fix beacon node lib * Return appropriate runtimes from environment * Fix test rig * Refactor eth1 service update * Upgrade simulator to stable futures * Lighthouse compiles on stable futures * Add first pass of wallet manager * Progress with CLI * Remove println debugging statement * Tidy output * Tidy 600 perms * Update libp2p service, start rpc test upgrade * Add validator creation flow * Update network crate for new libp2p * Start tidying, adding comments * Update tokio::codec to futures_codec (#1128) * Further work towards RPC corrections * Correct http timeout and network service select * Add wallet mgr testing * Shift LockedWallet into own file * Add comments to fs * Start integration into VC * Use tokio runtime for libp2p * Revert "Update tokio::codec to futures_codec (#1128)" This reverts commit e57aea924a. * Upgrade RPC libp2p tests * Upgrade secio fallback test * Add lcli keypair upgrade command * Upgrade gossipsub examples * Clean up RPC protocol * Test fixes (#1133) * Correct websocket timeout and run on os thread * Fix network test * Add --secrets-dir to VC * Remove --legacy-keys from VC * Clean up PR * Correct tokio tcp move attestation service tests * Upgrade attestation service tests * Fix sim * Correct network test * Correct genesis test * Start docs * Add progress for validator generation * Tidy error messages * Test corrections * Log info when block is received * Modify logs and update attester service events * Stable futures: fixes to vc, eth1 and account manager (#1142) * Add local testnet scripts * Remove whiteblock script * Rename local testnet script * Move spawns onto handle * Fix VC panic * Initial fix to block production issue * Tidy block producer fix * Tidy further * Add local testnet clean script * Run cargo fmt * Tidy duties service * Tidy fork service * Tidy ForkService * Tidy AttestationService * Tidy notifier * Ensure await is not suppressed in eth1 * Ensure await is not suppressed in account_manager * Use .ok() instead of .unwrap_or(()) * RPC decoding test for proto * Update discv5 and eth2-libp2p deps * Run cargo fmt * Pre-build keystores for sim * Fix lcli double runtime issue (#1144) * Handle stream termination and dialing peer errors * Correct peer_info variant types * Add progress on new deposit flow * Remove unnecessary warnings * Handle subnet unsubscription removal and improve logigng * Add logs around ping * Upgrade discv5 and improve logging * Handle peer connection status for multiple connections * Improve network service logging * Add more incomplete progress * Improve logging around peer manager * Upgrade swarm poll centralise peer management * Identify clients on error * Fix `remove_peer` in sync (#1150) * remove_peer removes from all chains * Remove logs * Fix early return from loop * Improved logging, fix panic * Partially correct tests * Add deposit command * Remove old validator directory * Start adding AM tests * Stable futures: Vc sync (#1149) * Improve syncing heuristic * Add comments * Use safer method for tolerance * Fix tests * Binary testing progress * Progress with CLI tests * Use constants for flags * More account manager testing * Improve CLI tests * Move upgrade-legacy-keypairs into account man * Use rayon for VC key generation * Add comments to `validator_dir` * Add testing to validator_dir * Add fix to eth1-sim * Check errors in eth1-sim * Fix mutability issue * Ensure password file ends in .pass * Add more tests to wallet manager * Tidy deposit * Tidy account manager * Tidy account manager * Remove panic * Generate keypairs earlier in sim * Tidy eth1-sime * Try to fix eth1 sim * Address review comments * Fix typo in CLI command * Update docs * Disable eth1 sim * Remove eth1 sim completely Co-authored-by: Age Manning <Age@AgeManning.com> Co-authored-by: pawanjay176 <pawandhananjay@gmail.com>
2026-03-23 23:04:53 +00:00 · 2020-05-18 19:01:45 +10:00
parent a4b07a833c
commit c571afb8d8
55 changed files with 3761 additions and 1163 deletions
--- a/account_manager/src/validator/create.rs
+++ b/account_manager/src/validator/create.rs
@@ -0,0 +1,203 @@
+use crate::{
+    common::{ensure_dir_exists, random_password},
+    SECRETS_DIR_FLAG, VALIDATOR_DIR_FLAG,
+};
+use clap::{App, Arg, ArgMatches};
+use environment::Environment;
+use eth2_wallet::PlainText;
+use eth2_wallet_manager::WalletManager;
+use std::fs;
+use std::path::{Path, PathBuf};
+use types::EthSpec;
+use validator_dir::Builder as ValidatorDirBuilder;
+
+pub const CMD: &str = "create";
+pub const BASE_DIR_FLAG: &str = "base-dir";
+pub const WALLET_NAME_FLAG: &str = "wallet-name";
+pub const WALLET_PASSPHRASE_FLAG: &str = "wallet-passphrase";
+pub const DEPOSIT_GWEI_FLAG: &str = "deposit-gwei";
+pub const STORE_WITHDRAW_FLAG: &str = "store-withdrawal-keystore";
+pub const COUNT_FLAG: &str = "count";
+pub const AT_MOST_FLAG: &str = "at-most";
+
+pub fn cli_app<'a, 'b>() -> App<'a, 'b> {
+    App::new(CMD)
+        .about(
+            "Creates new validators from an existing EIP-2386 wallet using the EIP-2333 HD key \
+            derivation scheme.",
+        )
+        .arg(
+            Arg::with_name(WALLET_NAME_FLAG)
+                .long(WALLET_NAME_FLAG)
+                .value_name("WALLET_NAME")
+                .help("Use the wallet identified by this name")
+                .takes_value(true)
+                .required(true),
+        )
+        .arg(
+            Arg::with_name(WALLET_PASSPHRASE_FLAG)
+                .long(WALLET_PASSPHRASE_FLAG)
+                .value_name("WALLET_PASSWORD_PATH")
+                .help("A path to a file containing the password which will unlock the wallet.")
+                .takes_value(true)
+                .required(true),
+        )
+        .arg(
+            Arg::with_name(VALIDATOR_DIR_FLAG)
+                .long(VALIDATOR_DIR_FLAG)
+                .value_name("VALIDATOR_DIRECTORY")
+                .help(
+                    "The path where the validator directories will be created. \
+                    Defaults to ~/.lighthouse/validators",
+                )
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(SECRETS_DIR_FLAG)
+                .long(SECRETS_DIR_FLAG)
+                .value_name("SECRETS_DIR")
+                .help(
+                    "The path where the validator keystore passwords will be stored. \
+                    Defaults to ~/.lighthouse/secrets",
+                )
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(DEPOSIT_GWEI_FLAG)
+                .long(DEPOSIT_GWEI_FLAG)
+                .value_name("DEPOSIT_GWEI")
+                .help(
+                    "The GWEI value of the deposit amount. Defaults to the minimum amount \
+                    required for an active validator (MAX_EFFECTIVE_BALANCE)",
+                )
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(STORE_WITHDRAW_FLAG)
+                .long(STORE_WITHDRAW_FLAG)
+                .help(
+                    "If present, the withdrawal keystore will be stored alongside the voting \
+                    keypair. It is generally recommended to *not* store the withdrawal key and \
+                    instead generate them from the wallet seed when required.",
+                ),
+        )
+        .arg(
+            Arg::with_name(COUNT_FLAG)
+                .long(COUNT_FLAG)
+                .value_name("VALIDATOR_COUNT")
+                .help("The number of validators to create, regardless of how many already exist")
+                .conflicts_with("at-most")
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(AT_MOST_FLAG)
+                .long(AT_MOST_FLAG)
+                .value_name("AT_MOST_VALIDATORS")
+                .help(
+                    "Observe the number of validators in --validator-dir, only creating enough to \
+                    reach the given count. Never deletes an existing validator.",
+                )
+                .conflicts_with("count")
+                .takes_value(true),
+        )
+}
+
+pub fn cli_run<T: EthSpec>(
+    matches: &ArgMatches,
+    mut env: Environment<T>,
+    wallet_base_dir: PathBuf,
+) -> Result<(), String> {
+    let spec = env.core_context().eth2_config.spec;
+
+    let name: String = clap_utils::parse_required(matches, WALLET_NAME_FLAG)?;
+    let wallet_password_path: PathBuf =
+        clap_utils::parse_required(matches, WALLET_PASSPHRASE_FLAG)?;
+    let validator_dir = clap_utils::parse_path_with_default_in_home_dir(
+        matches,
+        VALIDATOR_DIR_FLAG,
+        PathBuf::new().join(".lighthouse").join("validators"),
+    )?;
+    let secrets_dir = clap_utils::parse_path_with_default_in_home_dir(
+        matches,
+        SECRETS_DIR_FLAG,
+        PathBuf::new().join(".lighthouse").join("secrets"),
+    )?;
+    let deposit_gwei = clap_utils::parse_optional(matches, DEPOSIT_GWEI_FLAG)?
+        .unwrap_or_else(|| spec.max_effective_balance);
+    let count: Option<usize> = clap_utils::parse_optional(matches, COUNT_FLAG)?;
+    let at_most: Option<usize> = clap_utils::parse_optional(matches, AT_MOST_FLAG)?;
+
+    ensure_dir_exists(&validator_dir)?;
+    ensure_dir_exists(&secrets_dir)?;
+
+    let starting_validator_count = existing_validator_count(&validator_dir)?;
+
+    let n = match (count, at_most) {
+        (Some(_), Some(_)) => Err(format!(
+            "Cannot supply --{} and --{}",
+            COUNT_FLAG, AT_MOST_FLAG
+        )),
+        (None, None) => Err(format!(
+            "Must supply either --{} or --{}",
+            COUNT_FLAG, AT_MOST_FLAG
+        )),
+        (Some(count), None) => Ok(count),
+        (None, Some(at_most)) => Ok(at_most.saturating_sub(starting_validator_count)),
+    }?;
+
+    if n == 0 {
+        eprintln!(
+            "No validators to create. {}={:?}, {}={:?}",
+            COUNT_FLAG, count, AT_MOST_FLAG, at_most
+        );
+        return Ok(());
+    }
+
+    let wallet_password = fs::read(&wallet_password_path)
+        .map_err(|e| format!("Unable to read {:?}: {:?}", wallet_password_path, e))
+        .map(|bytes| PlainText::from(bytes))?;
+
+    let mgr = WalletManager::open(&wallet_base_dir)
+        .map_err(|e| format!("Unable to open --{}: {:?}", BASE_DIR_FLAG, e))?;
+
+    let mut wallet = mgr
+        .wallet_by_name(&name)
+        .map_err(|e| format!("Unable to open wallet: {:?}", e))?;
+
+    for i in 0..n {
+        let voting_password = random_password();
+        let withdrawal_password = random_password();
+
+        let keystores = wallet
+            .next_validator(
+                wallet_password.as_bytes(),
+                voting_password.as_bytes(),
+                withdrawal_password.as_bytes(),
+            )
+            .map_err(|e| format!("Unable to create validator keys: {:?}", e))?;
+
+        let voting_pubkey = keystores.voting.pubkey().to_string();
+
+        ValidatorDirBuilder::new(validator_dir.clone(), secrets_dir.clone())
+            .voting_keystore(keystores.voting, voting_password.as_bytes())
+            .withdrawal_keystore(keystores.withdrawal, withdrawal_password.as_bytes())
+            .create_eth1_tx_data(deposit_gwei, &spec)
+            .store_withdrawal_keystore(matches.is_present(STORE_WITHDRAW_FLAG))
+            .build()
+            .map_err(|e| format!("Unable to build validator directory: {:?}", e))?;
+
+        println!("{}/{}\t0x{}", i + 1, n, voting_pubkey);
+    }
+
+    Ok(())
+}
+
+/// Returns the number of validators that exist in the given `validator_dir`.
+///
+/// This function just assumes any file is a validator directory, making it likely to return a
+/// higher number than accurate but never a lower one.
+fn existing_validator_count<P: AsRef<Path>>(validator_dir: P) -> Result<usize, String> {
+    fs::read_dir(validator_dir.as_ref())
+        .map(|iter| iter.count())
+        .map_err(|e| format!("Unable to read {:?}: {}", validator_dir.as_ref(), e))
+}
--- a/account_manager/src/validator/deposit.rs
+++ b/account_manager/src/validator/deposit.rs
@@ -0,0 +1,271 @@
+use crate::VALIDATOR_DIR_FLAG;
+use clap::{App, Arg, ArgMatches};
+use clap_utils;
+use deposit_contract::DEPOSIT_GAS;
+use environment::Environment;
+use futures::compat::Future01CompatExt;
+use slog::{info, Logger};
+use std::path::PathBuf;
+use tokio::time::{delay_until, Duration, Instant};
+use types::EthSpec;
+use validator_dir::Manager as ValidatorManager;
+use web3::{
+    transports::Ipc,
+    types::{Address, SyncInfo, SyncState, TransactionRequest, U256},
+    Transport, Web3,
+};
+
+pub const CMD: &str = "deposit";
+pub const VALIDATOR_FLAG: &str = "validator";
+pub const ETH1_IPC_FLAG: &str = "eth1-ipc";
+pub const FROM_ADDRESS_FLAG: &str = "from-address";
+
+const GWEI: u64 = 1_000_000_000;
+
+const SYNCING_STATE_RETRY_DELAY: Duration = Duration::from_secs(2);
+
+pub fn cli_app<'a, 'b>() -> App<'a, 'b> {
+    App::new("deposit")
+        .about(
+            "Submits a deposit to an Eth1 validator registration contract via an IPC endpoint \
+            of an Eth1 client (e.g., Geth, OpenEthereum, etc.). The validators must already \
+            have been created and exist on the file-system. The process will exit immediately \
+            with an error if any error occurs. After each deposit is submitted to the Eth1 \
+            node, a file will be saved in the validator directory with the transaction hash. \
+            The application does not wait for confirmations so there is not guarantee that \
+            the transaction is included in the Eth1 chain; use a block explorer and the \
+            transaction hash to check for confirmations. The deposit contract address will \
+            be determined by the --testnet-dir flag on the primary Lighthouse binary.",
+        )
+        .arg(
+            Arg::with_name(VALIDATOR_DIR_FLAG)
+                .long(VALIDATOR_DIR_FLAG)
+                .value_name("VALIDATOR_DIRECTORY")
+                .help(
+                    "The path the validator client data directory. \
+                    Defaults to ~/.lighthouse/validators",
+                )
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(VALIDATOR_FLAG)
+                .long(VALIDATOR_FLAG)
+                .value_name("VALIDATOR_NAME")
+                .help(
+                    "The name of the directory in --data-dir for which to deposit. \
+                    Set to 'all' to deposit all validators in the --data-dir.",
+                )
+                .takes_value(true)
+                .required(true),
+        )
+        .arg(
+            Arg::with_name(ETH1_IPC_FLAG)
+                .long(ETH1_IPC_FLAG)
+                .value_name("ETH1_IPC_PATH")
+                .help("Path to an Eth1 JSON-RPC IPC endpoint")
+                .takes_value(true)
+                .required(true),
+        )
+        .arg(
+            Arg::with_name(FROM_ADDRESS_FLAG)
+                .long(FROM_ADDRESS_FLAG)
+                .value_name("FROM_ETH1_ADDRESS")
+                .help(
+                    "The address that will submit the eth1 deposit. \
+                    Must be unlocked on the node at --eth1-ipc.",
+                )
+                .takes_value(true)
+                .required(true),
+        )
+}
+
+pub fn cli_run<T: EthSpec>(
+    matches: &ArgMatches<'_>,
+    mut env: Environment<T>,
+) -> Result<(), String> {
+    let log = env.core_context().log;
+
+    let data_dir = clap_utils::parse_path_with_default_in_home_dir(
+        matches,
+        VALIDATOR_DIR_FLAG,
+        PathBuf::new().join(".lighthouse").join("validators"),
+    )?;
+    let validator: String = clap_utils::parse_required(matches, VALIDATOR_FLAG)?;
+    let eth1_ipc_path: PathBuf = clap_utils::parse_required(matches, ETH1_IPC_FLAG)?;
+    let from_address: Address = clap_utils::parse_required(matches, FROM_ADDRESS_FLAG)?;
+
+    let manager = ValidatorManager::open(&data_dir)
+        .map_err(|e| format!("Unable to read --{}: {:?}", VALIDATOR_DIR_FLAG, e))?;
+
+    let validators = match validator.as_ref() {
+        "all" => manager
+            .open_all_validators()
+            .map_err(|e| format!("Unable to read all validators: {:?}", e)),
+        name => {
+            let path = manager
+                .directory_names()
+                .map_err(|e| {
+                    format!(
+                        "Unable to read --{} directory names: {:?}",
+                        VALIDATOR_DIR_FLAG, e
+                    )
+                })?
+                .get(name)
+                .ok_or_else(|| format!("Unknown validator:  {}", name))?
+                .clone();
+
+            manager
+                .open_validator(&path)
+                .map_err(|e| format!("Unable to open {}: {:?}", name, e))
+                .map(|v| vec![v])
+        }
+    }?;
+
+    let eth1_deposit_datas = validators
+        .into_iter()
+        .filter(|v| !v.eth1_deposit_tx_hash_exists())
+        .map(|v| match v.eth1_deposit_data() {
+            Ok(Some(data)) => Ok((v, data)),
+            Ok(None) => Err(format!(
+                "Validator is missing deposit data file: {:?}",
+                v.dir()
+            )),
+            Err(e) => Err(format!(
+                "Unable to read deposit data for {:?}: {:?}",
+                v.dir(),
+                e
+            )),
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+
+    let total_gwei: u64 = eth1_deposit_datas
+        .iter()
+        .map(|(_, d)| d.deposit_data.amount)
+        .sum();
+
+    if eth1_deposit_datas.is_empty() {
+        info!(log, "No validators to deposit");
+
+        return Ok(());
+    }
+
+    info!(
+        log,
+        "Starting deposits";
+        "deposit_count" => eth1_deposit_datas.len(),
+        "total_eth" => total_gwei / GWEI,
+    );
+
+    let deposit_contract = env
+        .testnet
+        .as_ref()
+        .ok_or_else(|| "Unable to run account manager without a testnet dir".to_string())?
+        .deposit_contract_address()
+        .map_err(|e| format!("Unable to parse deposit contract address: {}", e))?;
+
+    if deposit_contract == Address::zero() {
+        return Err("Refusing to deposit to the zero address. Check testnet configuration.".into());
+    }
+
+    let (_event_loop_handle, transport) =
+        Ipc::new(eth1_ipc_path).map_err(|e| format!("Unable to connect to eth1 IPC: {:?}", e))?;
+    let web3 = Web3::new(transport);
+
+    let deposits_fut = async {
+        poll_until_synced(web3.clone(), log.clone()).await?;
+
+        for (mut validator_dir, eth1_deposit_data) in eth1_deposit_datas {
+            let tx_hash = web3
+                .eth()
+                .send_transaction(TransactionRequest {
+                    from: from_address,
+                    to: Some(deposit_contract),
+                    gas: Some(DEPOSIT_GAS.into()),
+                    gas_price: None,
+                    value: Some(from_gwei(eth1_deposit_data.deposit_data.amount)),
+                    data: Some(eth1_deposit_data.rlp.into()),
+                    nonce: None,
+                    condition: None,
+                })
+                .compat()
+                .await
+                .map_err(|e| format!("Failed to send transaction: {:?}", e))?;
+
+            validator_dir
+                .save_eth1_deposit_tx_hash(&format!("{:?}", tx_hash))
+                .map_err(|e| format!("Failed to save tx hash {:?} to disk: {:?}", tx_hash, e))?;
+        }
+
+        Ok::<(), String>(())
+    };
+
+    env.runtime().block_on(deposits_fut)?;
+
+    Ok(())
+}
+
+/// Converts gwei to wei.
+fn from_gwei(gwei: u64) -> U256 {
+    U256::from(gwei) * U256::exp10(9)
+}
+
+/// Run a poll on the `eth_syncing` endpoint, blocking until the node is synced.
+async fn poll_until_synced<T>(web3: Web3<T>, log: Logger) -> Result<(), String>
+where
+    T: Transport + Send + 'static,
+    <T as Transport>::Out: Send,
+{
+    loop {
+        let sync_state = web3
+            .clone()
+            .eth()
+            .syncing()
+            .compat()
+            .await
+            .map_err(|e| format!("Unable to read syncing state from eth1 node: {:?}", e))?;
+
+        match sync_state {
+            SyncState::Syncing(SyncInfo {
+                current_block,
+                highest_block,
+                ..
+            }) => {
+                info!(
+                    log,
+                    "Waiting for eth1 node to sync";
+                    "est_highest_block" => format!("{}", highest_block),
+                    "current_block" => format!("{}", current_block),
+                );
+
+                delay_until(Instant::now() + SYNCING_STATE_RETRY_DELAY).await;
+            }
+            SyncState::NotSyncing => {
+                let block_number = web3
+                    .clone()
+                    .eth()
+                    .block_number()
+                    .compat()
+                    .await
+                    .map_err(|e| format!("Unable to read block number from eth1 node: {:?}", e))?;
+
+                if block_number > 0.into() {
+                    info!(
+                        log,
+                        "Eth1 node is synced";
+                        "head_block" => format!("{}", block_number),
+                    );
+                    break;
+                } else {
+                    delay_until(Instant::now() + SYNCING_STATE_RETRY_DELAY).await;
+                    info!(
+                        log,
+                        "Waiting for eth1 node to sync";
+                        "current_block" => 0,
+                    );
+                }
+            }
+        }
+    }
+
+    Ok(())
+}
--- a/account_manager/src/validator/mod.rs
+++ b/account_manager/src/validator/mod.rs
@@ -0,0 +1,38 @@
+pub mod create;
+pub mod deposit;
+
+use crate::common::base_wallet_dir;
+use clap::{App, Arg, ArgMatches};
+use environment::Environment;
+use types::EthSpec;
+
+pub const CMD: &str = "validator";
+
+pub fn cli_app<'a, 'b>() -> App<'a, 'b> {
+    App::new(CMD)
+        .about("Provides commands for managing Eth2 validators.")
+        .arg(
+            Arg::with_name("base-dir")
+                .long("base-dir")
+                .value_name("BASE_DIRECTORY")
+                .help("A path containing Eth2 EIP-2386 wallets. Defaults to ~/.lighthouse/wallets")
+                .takes_value(true),
+        )
+        .subcommand(create::cli_app())
+        .subcommand(deposit::cli_app())
+}
+
+pub fn cli_run<T: EthSpec>(matches: &ArgMatches, env: Environment<T>) -> Result<(), String> {
+    let base_wallet_dir = base_wallet_dir(matches, "base-dir")?;
+
+    match matches.subcommand() {
+        (create::CMD, Some(matches)) => create::cli_run::<T>(matches, env, base_wallet_dir),
+        (deposit::CMD, Some(matches)) => deposit::cli_run::<T>(matches, env),
+        (unknown, _) => {
+            return Err(format!(
+                "{} does not have a {} command. See --help",
+                CMD, unknown
+            ));
+        }
+    }
+}