Repository navigation
Validate the slot of Gloas RPC data columns against the bid - #10327
Merged
Merged
Conversation
Gloas data column sidecars carry no signed block header, so their slot is not authenticated. Two places relied on it anyway: - is_block_data_imported chose between the pre-Gloas and Gloas import conditions using a slot supplied by the caller, usually taken from a sidecar. A column claiming a pre-Gloas slot made a Gloas block whose payload had not been received look fully imported, so the column was dropped as a duplicate. A Gloas slot on an imported pre-Gloas block had the opposite effect. - process_rpc_custody_columns used the column slot to choose between the Fulu and Gloas import paths. Nothing on the Gloas path checks it (KZG verification does not cover the slot), so a column with a wrong slot could be cached and stored as is. is_block_data_imported now looks the block up in fork choice and uses the block's own slot, and the slot parameter is gone. It also reads payload_received from that lookup instead of querying fork choice twice. process_rpc_custody_columns groups the batch by block root only and, after duplicate detection, checks each Gloas column's slot against the bid. A mismatch returns the new BlockError::DataColumnSlotMismatch carrying the column index, so sync penalizes only the custody peer that served it. Previously, grouping by (slot, block root) made a batch with one wrong-slot column fail with an unpenalized InternalError. The bid loaded for the check is passed on to the import instead of being loaded again.
Merge Queue Status
This pull request spent 29 minutes 50 seconds in the queue, including 28 minutes 7 seconds running CI. Required conditions to merge
|
This was referenced Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue Addressed
Gloas data column sidecars carry no signed block header, so their slot is not authenticated. Two places relied on it anyway:
is_block_data_importedchose between the pre-Gloas and Gloas import conditions using a slot supplied by the caller, usually taken from a sidecar. A column claiming a pre-Gloas slot made a Gloas block whose payload had not been received look fully imported, so the column was dropped as a duplicate.process_rpc_custody_columnsused the column slot to choose between the Fulu and Gloas import paths. Nothing on the Gloas path checks it, so a column with a wrong slot could be cached and stored as is.Proposed Changes
is_block_data_importednow looks the block up in fork choice and uses the block's own slot, and the slot parameter is gone. It also reads payload_received from that lookup instead of querying fork choice twice.process_rpc_custody_columnsgroups the batch by block root only and, after duplicate detection, checks each Gloas column's slot against the bid. A mismatch returns the newBlockError::DataColumnSlotMismatchcarrying the column index, so sync penalizes only the custody peer that served it. Previously, grouping by (slot, block root) made a batch with one wrong-slot column fail with an unpenalizedInternalError. The bid loaded for the check is passed on to the import instead of being loaded again.Additional Info
Claude