Refine EIP-8025 `ProofData` type and gossip validation logic by frisitano · Pull Request #5593 · ethereum/consensus-specs

frisitano · 2026-09-02T13:46:32Z

Description

This PR refines the EIP-8025 spec with the following changes:

Changes the ProofData type to be ByteList with a size limit
Remove the max size checks on gossiped execution proofs as they are implied and enforced by the size limit of ProofData and the container types
Remove the block root consistency check between the beacon block and the execution payload as this is already enforced by the execution payload handler outside the scope of eip-8025
Remove the explicit check on the block state associated with the block root. If a payload exists for the block root then the beacon block must be valid
Update tests to reflect these changes

frisitano · 2026-09-03T09:52:26Z

Some additional changes to the spec cc: @dapplion

jtraglia · 2026-09-03T20:46:21Z

        verify_execution_proof_envelope(
            state,
            signed_proof_envelope,
-            payload_envelope,
        )


We should be able to make this a single line now, without wrapping.

jtraglia · 2026-09-09T16:40:20Z

Hey @frisitano I've been sort of waiting for @dapplion to review this before giving it a proper review myself. Is that a requirement or would this be ready to review/merge without him?

frisitano · 2026-09-09T17:17:54Z

Hey @frisitano I've been sort of waiting for @dapplion to review this before giving it a proper review myself. Is that a requirement or would this be ready to review/merge without him?

I don't think it's a requirement, just a nice-to-have. I trust that @dapplion and @nalepae will provide review and feedback as and when they have capacity.

jtraglia · 2026-09-09T17:51:27Z

+*Note*: `MAX_SIGNED_EXECUTION_PROOF_ENVELOPE_SIZE` is derived from
+`MAX_PROOF_SIZE` plus 145 bytes of fixed SSZ overhead: two 4-byte offsets, a
+1-byte `ProofType`, a 32-byte `Root`, an 8-byte `ValidatorIndex`, and a 96-byte
+`BLSSignature`.
+
+| Name                                       | Value                                              |
+| ------------------------------------------ | -------------------------------------------------- |
+| `MAX_SIGNED_EXECUTION_PROOF_ENVELOPE_SIZE` | `Uint64(MAX_PROOF_SIZE + 145)` (= 4,194,449 bytes) |


Clients don't really need to know how this is computed. Let's delete the note, revert this change, then add a test like the following which ensures the constant matches the computed value.

consensus-specs/tests/core/pyspec/eth_consensus_specs/test/gloas/unittests/test_p2p_size_bounds.py

Lines 34 to 40 in 4546169

@with_gloas_and_later

@spec_test

@single_phase

def test_max_signed_execution_payload_bid_size(spec):

encoded = build_max_size_signed_execution_payload_bid(spec).encode_bytes()

assert len(encoded) == get_max_signed_execution_payload_bid_size(spec)

assert len(encoded) <= spec.config.MAX_PAYLOAD_SIZE

jtraglia · 2026-09-09T17:52:55Z

+        raise GossipReject("execution proof envelope is invalid")
+
+    # [REJECT] The proof type is supported
+    if proof_envelope.proof_type not in get_supported_proof_types():
+        raise GossipReject("execution proof envelope is invalid")


These error messages must be different, otherwise we would be unable to test them properly (indistinguishable). Let's do something like "execution proof is empty" and "unexpected proof type".

jtraglia · 2026-09-09T17:54:53Z

    payload_envelope = store.payloads[beacon_block_root]

-    # [IGNORE] No valid proof is known for this beacon block and proof type
-    if proof_envelope.proof_type in store.execution_proofs.get(beacon_block_root, {}):
-        raise GossipIgnore("verified proof already known for this beacon block and proof type")
-
    # [REJECT] The execution proof envelope passes validation
+    state = store.block_states[beacon_block_root]
    try:


Let's put the state definition above this check.

state = ... payload_envelope = ... # [REJECT] The execution proof envelope passes validation try:

jtraglia · 2026-09-09T18:07:49Z

Hmm I just realized that these execution proof gossip tests are unit tests, not proper reference tests. This whole file needs to be re-written eventually; to be something more like this. But don't worry about this right now. We're planning to remove all tests for non-CFI'd EIPs. Updating the testing infrastructure for every proposed EIP is not sustainable; testing updates are way more invasive than a self-contained feature spec directory.

nalepae · 2026-09-10T09:38:12Z


 ```python
-class ProofData(ProgressiveList[Byte]):
+class ProofData(ByteList):


What is the rationale behind this change?

Is it to ensure that a message is not too big (thanks to checking if proof size is not higher than (MAX_PROOF_SIZE)?

(If so, the message size is already bounded at the network layer by MAX_SIGNED_EXECUTION_PROOF_ENVELOPE_SIZE)

Yes, it bounds the size of the gossiped message. The idea of this change is to provide the bound such that the limit is encoded into the type directly instead of needing an extra check elsewhere.

MAX_SIGNED_EXECUTION_PROOF_ENVELOPE_SIZE is not actually enforced anywhere in code. It is this change that encodes the bound into the message.

nalepae · 2026-09-10T10:26:19Z

-        raise GossipIgnore("verified proof already known for this beacon block and proof type")
-
    # [REJECT] The execution proof envelope passes validation
+    state = store.block_states[beacon_block_root]


The new version of the spec has no

if beacon_block_root not in store.block_states:

check any more.

So, if beacon_block_root is not in store.block_states, it will generate a KeyError. Before the change it was a clear GossipReject. It would probably be better to explicitly reject in that case.

The idea is that the payload envelope will reach the store only if the associated beacon block is valid, so checking for the payload envelope is implicit check that the beacon block is valid and as such it exists in block_states without having to explicitly do the check.

Co-authored-by: Justin Traglia <95511699+jtraglia@users.noreply.github.com>

jtraglia · 2026-09-10T14:25:44Z

    if beacon_block_root not in store.payloads:
        raise GossipIgnore("execution proof's payload is unavailable")

    payload_envelope = store.payloads[beacon_block_root]


So I disagree here. If those variables were only used within that gossip check, I would agree, but that's not the case. Please see https://github.com/ethereum/consensus-specs/pull/5593/changes#r3971468388 where I suggest something different.

jihoonsong · 2026-09-11T16:37:22Z

+        raise GossipIgnore("execution proof's beacon block has not been seen")
+
+    # [IGNORE] No valid proof is known for this beacon block and proof type
+    if proof_envelope.proof_type in store.execution_proofs.get(beacon_block_root, {}):


execution_proofs could be DefaultDict.

Refine EIP-8025 proof bounds and gossip validation

4373370

github-actions Bot added testing CI, actions, tests, testing infra eip8025 Optional Execution Proofs labels Sep 2, 2026

Merge branch 'master' into eip8025-clean-up

7839b29

frisitano changed the title ~~Refine EIP-8025 ProofData typing and size limits and simply gossip validation logic~~ Refine EIP-8025 ProofData typing and simply gossip validation logic Sep 2, 2026

frisitano changed the title ~~Refine EIP-8025 ProofData typing and simply gossip validation logic~~ Refine EIP-8025 ProofData type and simply gossip validation logic Sep 2, 2026

frisitano changed the title ~~Refine EIP-8025 ProofData type and simply gossip validation logic~~ Refine EIP-8025 ProofData type and gossip validation logic Sep 2, 2026

frisitano added 2 commits September 2, 2026 23:26

Fix EIP-8025 SSZ limit exception assertions

818c948

Remove redundant ProofData limit test

bbc7d16

frisitano marked this pull request as ready for review September 2, 2026 15:48

Merge branch 'master' into eip8025-clean-up

bf2e898

frisitano added 3 commits September 3, 2026 18:35

Reorder execution proof gossip checks

307cf7c

Check known execution proofs before hashing

e027c42

Cache gossip proofs after engine verification

0d28490

jtraglia reviewed Sep 3, 2026

View reviewed changes

frisitano and others added 6 commits September 7, 2026 16:14

Format execution proof envelope validation call

5f174d9

Merge branch 'master' into eip8025-clean-up

b3f7d09

Record gossip proofs before verification

0f2fe83

Simplify gossip proof cache tests

fc6c68d

Test proof validity using proof data

4bcfb04

Clarify execution proof gossip comment

bb9e72a

Merge branch 'master' into eip8025-clean-up

49d4107

jtraglia reviewed Sep 9, 2026

View reviewed changes

nalepae reviewed Sep 10, 2026

View reviewed changes

Update specs/_features/eip8025/beacon-chain.md

8a45683

Co-authored-by: Justin Traglia <95511699+jtraglia@users.noreply.github.com>

jtraglia reviewed Sep 10, 2026

View reviewed changes

jihoonsong reviewed Sep 11, 2026

View reviewed changes

	@with_gloas_and_later
	@spec_test
	@single_phase
	def test_max_signed_execution_payload_bid_size(spec):
	encoded = build_max_size_signed_execution_payload_bid(spec).encode_bytes()
	assert len(encoded) == get_max_signed_execution_payload_bid_size(spec)
	assert len(encoded) <= spec.config.MAX_PAYLOAD_SIZE

Uh oh!

Conversation

frisitano commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Uh oh!

frisitano commented Sep 3, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jtraglia commented Sep 9, 2026

Uh oh!

frisitano commented Sep 9, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

frisitano commented Sep 2, 2026 •

edited

Loading