Locations
Summary
unguaranteedDepositToBeaconChain submits new-validator deposits without verifying their BLS proof-of-possession signature. The execution-layer deposit succeeds even when the consensus layer will discard the deposit.
Root cause
- Dashboard forwards the supplied pubkey, signature, amount, and self-consistent deposit-data root directly to the deposit contract.
- The deposit contract verifies lengths and the data root, but not the BLS signature.
- The normal PDG predeposit path exposes and invokes
verifyDepositMessage; the Dashboard bypass neither invokes it nor accepts the auxiliary BLS coordinates required to do so.
- Electra
apply_deposit returns without registering an unknown pubkey when its deposit signature is invalid, so no validator witness can later be supplied to proveUnknownValidatorsToPDG.
Impact
A compromised or erroneous unguaranteed-deposit role holder can irreversibly send vault ETH into a deposit event that never creates a validator. The transaction succeeds on the execution layer and the fee exemption is recorded, but the ETH cannot be recovered through PDG or validator withdrawals. Because this produces direct permanent fund loss, severity is high despite requiring a privileged role.
Scenario
- The admin enables
ALLOW_DEPOSIT_AND_PROVE.
- The role holder constructs a deposit with a correctly calculated deposit-data root but a BLS signature that is invalid for the pubkey/message.
- The canonical deposit contract accepts the call because the supplied root matches the supplied fields.
- Consensus processing rejects registration of the new validator because its proof-of-possession signature is invalid.
- No validator exists to prove to PDG, while the deposited ETH and Dashboard fee exemption remain unrecoverable.
Locations
core/contracts/0.8.25/vaults/dashboard/Dashboard.sol:501-509core/contracts/0.6.11/deposit_contract.sol:107-140core/contracts/0.8.25/vaults/predeposit_guarantee/PredepositGuarantee.sol:270-282Summary
unguaranteedDepositToBeaconChainsubmits new-validator deposits without verifying their BLS proof-of-possession signature. The execution-layer deposit succeeds even when the consensus layer will discard the deposit.Root cause
verifyDepositMessage; the Dashboard bypass neither invokes it nor accepts the auxiliary BLS coordinates required to do so.apply_depositreturns without registering an unknown pubkey when its deposit signature is invalid, so no validator witness can later be supplied toproveUnknownValidatorsToPDG.Impact
A compromised or erroneous unguaranteed-deposit role holder can irreversibly send vault ETH into a deposit event that never creates a validator. The transaction succeeds on the execution layer and the fee exemption is recorded, but the ETH cannot be recovered through PDG or validator withdrawals. Because this produces direct permanent fund loss, severity is high despite requiring a privileged role.
Scenario
ALLOW_DEPOSIT_AND_PROVE.