Gloas: verifiers - #1940
Open
madlabman wants to merge 31 commits into
Open
Gloas: verifiers#1940madlabman wants to merge 31 commits into
madlabman wants to merge 31 commits into
Conversation
|
Hardhat Unit Tests Coverage SummaryDetailsDiff against masterResults for commit: 2f4a21d Minimum allowed coverage is ♻️ This comment has been updated with latest results |
madlabman
force-pushed
the
gloas-verifier
branch
from
August 10, 2026 10:54
557c21f to
723b4ac
Compare
This was referenced Aug 11, 2026
hweawer
added a commit
to lidofinance/late-prover-bot
that referenced
this pull request
Aug 11, 2026
lidofinance/core#1940 stops anchoring the proven block through EIP-4788: verifyValidatorExitDelay( ProvableBeaconBlockHeader recentBlock, // root read from EIP-4788 BlockRootsHeaderWitness targetBlock, // proven against recentBlock.stateRoot ValidatorWitness[] witnesses, // proven against targetBlock.stateRoot ExitRequestData exitRequests) That removes the withheld-payload problem for the deadline block outright. Its root now comes out of the recent state's block_roots ring, so it no longer matters whether an execution block ever carried its successor's timestamp, and the deadline block is simply the first proposed block at or after the deadline - no forward walk, no advance. Only the recent block still needs an entry in the beacon roots buffer, which is what resolveProvableAnchor already guarantees for the finalized anchor; its doc now says so. The bot builds the new witness from the state it already downloads each cycle, so the extra proof costs nothing beyond the proof itself. Two bounds come with the shape and are now enforced where they belong: a deadline that is not yet behind the finalized anchor waits for the next cycle instead of being proven against a state that cannot contain it, and the current-slot path is bounded by recentSlot - targetSlot <= SLOTS_PER_HISTORICAL_ROOT - the size of the ring, which is exactly where the historical-summaries path takes over. That bound replaces the head-relative isSlotOld check, so the bot and the contract now switch paths on the same condition. Verified against the deployed contract on a fork of a Gloas devnet: a proof built by this code is accepted end to end and the module records a 552 h delay for a real Lido key. scripts/devnet-proof-fixture.ts builds that fixture from a live devnet; it fails loudly if the anchor's root is not in the EIP-4788 buffer.
hweawer
added a commit
to lidofinance/late-prover-bot
that referenced
this pull request
Aug 11, 2026
lidofinance/core#1940 stops anchoring the proven block through EIP-4788: verifyValidatorExitDelay( ProvableBeaconBlockHeader recentBlock, // root read from EIP-4788 BlockRootsHeaderWitness targetBlock, // proven against recentBlock.stateRoot ValidatorWitness[] witnesses, // proven against targetBlock.stateRoot ExitRequestData exitRequests) That removes the withheld-payload problem for the deadline block outright. Its root now comes out of the recent state's block_roots ring, so it no longer matters whether an execution block ever carried its successor's timestamp, and the deadline block is simply the first proposed block at or after the deadline - no forward walk, no advance. Only the recent block still needs an entry in the beacon roots buffer, which is what resolveProvableAnchor already guarantees for the finalized anchor; its doc now says so. The bot builds the new witness from the state it already downloads each cycle, so the extra proof costs nothing beyond the proof itself. Two bounds come with the shape and are now enforced where they belong: a deadline that is not yet behind the finalized anchor waits for the next cycle instead of being proven against a state that cannot contain it, and the current-slot path is bounded by recentSlot - targetSlot <= SLOTS_PER_HISTORICAL_ROOT - the size of the ring, which is exactly where the historical-summaries path takes over. That bound replaces the head-relative isSlotOld check, so the bot and the contract now switch paths on the same condition. Verified against the deployed contract on a fork of a Gloas devnet: a proof built by this code is accepted end to end and the module records a 552 h delay for a real Lido key. scripts/devnet-proof-fixture.ts builds that fixture from a live devnet; it fails loudly if the anchor's root is not in the EIP-4788 buffer.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds Gloas-compatible generalized-index handling across validator proof verifiers and deployment tooling.
Changes:
- Adds ProgressiveList GIndex calculation and fork-aware validator proofs.
- Extends exit-delay verification with
block_rootsproofs. - Updates configuration, deployment helpers, and tests for new constructor parameters.
Reviewed changes
Copilot reviewed 44 out of 44 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
test/integration/vaults/scenario/pdg-specific-validator.integration.ts |
Uses fork-aware validator GIndex. |
test/integration/vaults/scenario/pdg-paused-happy-path.integration.ts |
Updates PDG proof setup. |
test/integration/vaults/scenario/node-operator.happy-path.integration.ts |
Updates validator tree setup. |
test/integration/vaults/scenario/happy-path.integration.ts |
Uses fork-aware PDG proofs. |
test/integration/vaults/obligations.integration.ts |
Accounts for existing owner shares. |
test/integration/vaults/dashboard.integration.ts |
Updates PDG proof setup. |
test/integration/report-validator-exit-delay.ts |
Supplies block-roots witnesses. |
test/integration/core/happy-path.integration.ts |
Checks balance increases by delta. |
test/integration/core/burn-shares.integration.ts |
Preserves pre-existing shares in assertions. |
test/common/lib/GIndex.t.sol |
Tests ProgressiveList GIndices. |
test/common/contracts/GIndex__Harness.sol |
Exposes ProgressiveList helper. |
test/0.8.9/lib/GIndex.test.ts |
Adds TypeScript GIndex tests. |
test/0.8.25/vaults/predepositGuarantee/predepositGuarantee.test.ts |
Updates PDG constructor fixtures. |
test/0.8.25/vaults/predepositGuarantee/contracts/CLProofVerifier__harness.sol |
Updates verifier constructor. |
test/0.8.25/vaults/predepositGuarantee/clProofVerifyer.test.ts |
Tests Gloas validator proofs. |
test/0.8.25/vaults/contracts/PredepositGuarantee__HarnessForFactory.sol |
Forwards new PDG parameters. |
test/0.8.25/validatorExitDelayVerifierHelpers.ts |
Builds synthetic block-roots proofs. |
test/0.8.25/validatorExitDelayVerifier.test.ts |
Covers updated exit verifier. |
test/0.8.25/srv3/contracts/CLValidatorVerifier__Harness.sol |
Updates validator harness. |
test/0.8.25/srv3/clValidatorProofVerifier.test.ts |
Tests fork-aware validator GIndices. |
test/0.8.25/contracts/ValidatorExitDelayVerifier__Harness.sol |
Exposes new GIndex helpers. |
test/0.8.25/contracts/TopUpGateway__Harness.sol |
Updates gateway constructor. |
test/0.8.25/consolidationGateway/consolidationGateway.rateLimit.test.ts |
Updates consolidation fixture. |
test/0.8.25/consolidationGateway/consolidationGateway.pausable.test.ts |
Updates consolidation fixture. |
test/0.8.25/consolidationGateway/consolidationGateway.addConsolidationRequests.test.ts |
Updates consolidation fixture. |
test/0.8.25/consolidation-helpers.ts |
Adds null GIndex fixture. |
scripts/upgrade/upgrade-params-mainnet.toml |
Adds mainnet Gloas parameters. |
scripts/upgrade/upgrade-params-hoodi.toml |
Adds Hoodi Gloas parameters. |
scripts/upgrade/steps/0100-deploy-base-contracts.ts |
Passes new gateway parameters. |
scripts/scratch/steps/0085-deploy-vaults.ts |
Passes new PDG parameters. |
scripts/scratch/steps/0083-deploy-core.ts |
Passes new verifier parameters. |
scripts/scratch/deploy-params-testnet.toml |
Adds testnet Gloas configuration. |
scripts/defaults/local-devnet-defaults.json |
Updates local PDG defaults. |
lib/protocol/helpers/vaults.ts |
Selects proof GIndex by slot. |
lib/protocol/helpers/topup.ts |
Builds pre-Gloas top-up fixtures. |
lib/protocol/helpers/consolidation.ts |
Builds pre-Gloas consolidation fixtures. |
lib/config-schemas.ts |
Validates new configuration fields. |
contracts/common/lib/GIndex.sol |
Implements ProgressiveList GIndices. |
contracts/0.8.25/vaults/predeposit_guarantee/PredepositGuarantee.sol |
Accepts Gloas verifier parameters. |
contracts/0.8.25/vaults/predeposit_guarantee/CLProofVerifier.sol |
Supports ProgressiveList validators. |
contracts/0.8.25/ValidatorExitDelayVerifier.sol |
Adds Gloas and block-roots verification. |
contracts/0.8.25/TopUpGateway.sol |
Forwards Gloas validator parameters. |
contracts/0.8.25/consolidation/ConsolidationGateway.sol |
Forwards Gloas validator parameters. |
contracts/0.8.25/CLValidatorVerifier.sol |
Supports ProgressiveList validators. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
3 tasks
hweawer
added a commit
to lidofinance/late-prover-bot
that referenced
this pull request
Aug 17, 2026
lidofinance/core#1940 stops anchoring the proven block through EIP-4788: verifyValidatorExitDelay( ProvableBeaconBlockHeader recentBlock, // root read from EIP-4788 BlockRootsHeaderWitness targetBlock, // proven against recentBlock.stateRoot ValidatorWitness[] witnesses, // proven against targetBlock.stateRoot ExitRequestData exitRequests) That removes the withheld-payload problem for the deadline block outright. Its root now comes out of the recent state's block_roots ring, so it no longer matters whether an execution block ever carried its successor's timestamp, and the deadline block is simply the first proposed block at or after the deadline - no forward walk, no advance. Only the recent block still needs an entry in the beacon roots buffer, which is what resolveProvableAnchor already guarantees for the finalized anchor; its doc now says so. The bot builds the new witness from the state it already downloads each cycle, so the extra proof costs nothing beyond the proof itself. Two bounds come with the shape and are now enforced where they belong: a deadline that is not yet behind the finalized anchor waits for the next cycle instead of being proven against a state that cannot contain it, and the current-slot path is bounded by recentSlot - targetSlot <= SLOTS_PER_HISTORICAL_ROOT - the size of the ring, which is exactly where the historical-summaries path takes over. That bound replaces the head-relative isSlotOld check, so the bot and the contract now switch paths on the same condition. Verified against the deployed contract on a fork of a Gloas devnet: a proof built by this code is accepted end to end and the module records a 552 h delay for a real Lido key. scripts/devnet-proof-fixture.ts builds that fixture from a live devnet; it fails loudly if the anchor's root is not in the EIP-4788 buffer.
hweawer
added a commit
to lidofinance/late-prover-bot
that referenced
this pull request
Aug 17, 2026
lidofinance/core#1940 stops anchoring the proven block through EIP-4788: verifyValidatorExitDelay( ProvableBeaconBlockHeader recentBlock, // root read from EIP-4788 BlockRootsHeaderWitness targetBlock, // proven against recentBlock.stateRoot ValidatorWitness[] witnesses, // proven against targetBlock.stateRoot ExitRequestData exitRequests) That removes the withheld-payload problem for the deadline block outright. Its root now comes out of the recent state's block_roots ring, so it no longer matters whether an execution block ever carried its successor's timestamp, and the deadline block is simply the first proposed block at or after the deadline - no forward walk, no advance. Only the recent block still needs an entry in the beacon roots buffer, which is what resolveProvableAnchor already guarantees for the finalized anchor; its doc now says so. The bot builds the new witness from the state it already downloads each cycle, so the extra proof costs nothing beyond the proof itself. Two bounds come with the shape and are now enforced where they belong: a deadline that is not yet behind the finalized anchor waits for the next cycle instead of being proven against a state that cannot contain it, and the current-slot path is bounded by recentSlot - targetSlot <= SLOTS_PER_HISTORICAL_ROOT - the size of the ring, which is exactly where the historical-summaries path takes over. That bound replaces the head-relative isSlotOld check, so the bot and the contract now switch paths on the same condition. Verified against the deployed contract on a fork of a Gloas devnet: a proof built by this code is accepted end to end and the module records a 552 h delay for a real Lido key. scripts/devnet-proof-fixture.ts builds that fixture from a live devnet; it fails loudly if the anchor's root is not in the EIP-4788 buffer.
hweawer
added a commit
to lidofinance/late-prover-bot
that referenced
this pull request
Aug 17, 2026
lidofinance/core#1940 stops anchoring the proven block through EIP-4788: verifyValidatorExitDelay( ProvableBeaconBlockHeader recentBlock, // root read from EIP-4788 BlockRootsHeaderWitness targetBlock, // proven against recentBlock.stateRoot ValidatorWitness[] witnesses, // proven against targetBlock.stateRoot ExitRequestData exitRequests) That removes the withheld-payload problem for the deadline block outright. Its root now comes out of the recent state's block_roots ring, so it no longer matters whether an execution block ever carried its successor's timestamp, and the deadline block is simply the first proposed block at or after the deadline - no forward walk, no advance. Only the recent block still needs an entry in the beacon roots buffer, which is what resolveProvableAnchor already guarantees for the finalized anchor; its doc now says so. The bot builds the new witness from the state it already downloads each cycle, so the extra proof costs nothing beyond the proof itself. Two bounds come with the shape and are now enforced where they belong: a deadline that is not yet behind the finalized anchor waits for the next cycle instead of being proven against a state that cannot contain it, and the current-slot path is bounded by recentSlot - targetSlot <= SLOTS_PER_HISTORICAL_ROOT - the size of the ring, which is exactly where the historical-summaries path takes over. That bound replaces the head-relative isSlotOld check, so the bot and the contract now switch paths on the same condition. Verified against the deployed contract on a fork of a Gloas devnet: a proof built by this code is accepted end to end and the module records a 552 h delay for a real Lido key. scripts/devnet-proof-fixture.ts builds that fixture from a live devnet; it fails loudly if the anchor's root is not in the EIP-4788 buffer.
dry914
reviewed
Aug 19, 2026
dry914
left a comment
dry914
left a comment
Contributor
There was a problem hiding this comment.
Contract changes look right, but upgrade flow doesn't ship new ValidatorExitDelayVerifier and PDG implementation.
tamtamchik
requested changes
Sep 5, 2026
tamtamchik
left a comment
tamtamchik
left a comment
Member
There was a problem hiding this comment.
Agree with @dry914 comments, need to extend tests a bit
The Gloas pivot in deploy-params-testnet.toml is 898 x 32 = 28736, the fork epoch of the kurtosis devnet deployed on 2026-09-04. The public glamsterdam-devnet-11 (genesis 2026-09-09 10:00 UTC) forks at epoch 1125, so the verifier pivot and change slots become 1125 x 32 = 36000.
hweawer
added a commit
to lidofinance/late-prover-bot
that referenced
this pull request
Sep 11, 2026
lidofinance/core#1940 stops anchoring the proven block through EIP-4788: verifyValidatorExitDelay( ProvableBeaconBlockHeader recentBlock, // root read from EIP-4788 BlockRootsHeaderWitness targetBlock, // proven against recentBlock.stateRoot ValidatorWitness[] witnesses, // proven against targetBlock.stateRoot ExitRequestData exitRequests) That removes the withheld-payload problem for the deadline block outright. Its root now comes out of the recent state's block_roots ring, so it no longer matters whether an execution block ever carried its successor's timestamp, and the deadline block is simply the first proposed block at or after the deadline - no forward walk, no advance. Only the recent block still needs an entry in the beacon roots buffer, which is what resolveProvableAnchor already guarantees for the finalized anchor; its doc now says so. The bot builds the new witness from the state it already downloads each cycle, so the extra proof costs nothing beyond the proof itself. Two bounds come with the shape and are now enforced where they belong: a deadline that is not yet behind the finalized anchor waits for the next cycle instead of being proven against a state that cannot contain it, and the current-slot path is bounded by recentSlot - targetSlot <= SLOTS_PER_HISTORICAL_ROOT - the size of the ring, which is exactly where the historical-summaries path takes over. That bound replaces the head-relative isSlotOld check, so the bot and the contract now switch paths on the same condition. Verified against the deployed contract on a fork of a Gloas devnet: a proof built by this code is accepted end to end and the module records a 552 h delay for a real Lido key. scripts/devnet-proof-fixture.ts builds that fixture from a live devnet; it fails loudly if the anchor's root is not in the EIP-4788 buffer.
dry914
added
solidity
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add Gloas support: