validate using the submitted block's fork, not the relay's fork

Author: JasonVranek

crates/common/src/pbs/error.rs

@@ -119,6 +119,9 @@ pub enum ValidationError {
 
     #[error("unsupported fork")]
     UnsupportedFork,
+
+    #[error("fork mismatch: request is {expected} but relay response is {got}")]
+    ForkMismatch { expected: ForkName, got: ForkName },
 }
 
 #[derive(Debug, Error, PartialEq, Eq)]

crates/pbs/src/mev_boost/submit_block.rs

@@ -221,8 +221,19 @@ async fn send_submit_block(
     // Extract the info needed for validation
     let got_block_hash = response.data.execution_payload.block_hash().0;
 
-    // request has different type so cant be deserialized in the wrong version,
-    // response has a "version" field
+    // Reject if response's fork mismatches BlindedBeaconBlock's fork
+    let expected_fork = match &proposal_info.signed_blinded_block.message() {
+        BlindedBeaconBlock::Electra(_) => ForkName::Electra,
+        BlindedBeaconBlock::Fulu(_) => ForkName::Fulu,
+        _ => return Err(PbsError::Validation(ValidationError::UnsupportedFork)),
+    };
+    if response.version != expected_fork {
+        return Err(PbsError::Validation(ValidationError::ForkMismatch {
+            expected: expected_fork,
+            got: response.version,
+        }));
+    }
+
     match &proposal_info.signed_blinded_block.message() {
         BlindedBeaconBlock::Electra(blinded_block) => {
             let expected_block_hash =
@@ -234,7 +245,7 @@ async fn send_submit_block(
                 got_block_hash,
                 expected_commitments,
                 &response.data.blobs_bundle,
-                response.version,
+                expected_fork,
             )
         }
 
@@ -248,7 +259,7 @@ async fn send_submit_block(
                 got_block_hash,
                 expected_commitments,
                 &response.data.blobs_bundle,
-                response.version,
+                expected_fork,
             )
         }
 
@@ -525,12 +536,6 @@ fn validate_unblinded_block(
     fork_name: ForkName,
 ) -> Result<(), PbsError> {
     match fork_name {
-        ForkName::Base |
-        ForkName::Altair |
-        ForkName::Bellatrix |
-        ForkName::Capella |
-        ForkName::Deneb |
-        ForkName::Gloas => Err(PbsError::Validation(ValidationError::UnsupportedFork)),
         ForkName::Electra => validate_unblinded_block_electra(
             expected_block_hash,
             got_block_hash,
@@ -543,6 +548,7 @@ fn validate_unblinded_block(
             expected_commitments,
             blobs_bundle,
         ),
+        _ => Err(PbsError::Validation(ValidationError::UnsupportedFork)),
     }
 }
 

tests/src/mock_relay.rs

@@ -8,7 +8,10 @@ use std::{
     time::Duration,
 };
 
-use alloy::{primitives::U256, rpc::types::beacon::relay::ValidatorRegistration};
+use alloy::{
+    eips::eip7594::CELLS_PER_EXT_BLOB, primitives::U256,
+    rpc::types::beacon::relay::ValidatorRegistration,
+};
 use axum::{
     Json, Router,
     extract::{Path, State},
@@ -76,6 +79,10 @@ pub struct MockRelayState {
     /// negotiated via `Accept`. Used to exercise PBS tolerance of
     /// MIME-parameter suffixes like `application/octet-stream; charset=binary`.
     response_content_type_override: Option<String>,
+    /// If set, `handle_submit_block_v1` labels its JSON response with this fork
+    /// in the `version` field instead of the request's fork. Used to drive the
+    /// fork-mismatch rejection test
+    submit_block_version_override: Option<ForkName>,
     received_get_header: Arc<AtomicU64>,
     received_get_status: Arc<AtomicU64>,
     received_register_validator: Arc<AtomicU64>,
@@ -112,6 +119,9 @@ impl MockRelayState {
     pub fn response_content_type_override(&self) -> Option<&str> {
         self.response_content_type_override.as_deref()
     }
+    pub fn submit_block_version_override(&self) -> Option<ForkName> {
+        self.submit_block_version_override
+    }
     pub fn set_response_override(&self, status: StatusCode) {
         *self.response_override.write().unwrap() = Some(status);
     }
@@ -127,6 +137,7 @@ impl MockRelayState {
             use_not_found_for_submit_block: false,
             submit_block_ssz_status_override: None,
             response_content_type_override: None,
+            submit_block_version_override: None,
             received_get_header: Default::default(),
             received_get_status: Default::default(),
             received_register_validator: Default::default(),
@@ -174,6 +185,13 @@ impl MockRelayState {
     pub fn with_response_content_type(self, raw_content_type: impl Into<String>) -> Self {
         Self { response_content_type_override: Some(raw_content_type.into()), ..self }
     }
+
+    /// Make `handle_submit_block_v1` label its JSON response with `fork` in the
+    /// `version` field, regardless of the request's fork. Used to exercise the
+    /// PBS fork-mismatch rejection.
+    pub fn with_submit_block_version(self, fork: ForkName) -> Self {
+        Self { submit_block_version_override: Some(fork), ..self }
+    }
 }
 
 pub fn mock_relay_app_router(state: Arc<MockRelayState>) -> Router {
@@ -366,7 +384,17 @@ async fn handle_submit_block_v1(
         blobs_bundle.blobs.push(Default::default()).unwrap();
         blobs_bundle.commitments =
             submit_block.as_electra().unwrap().message.body.blob_kzg_commitments.clone();
-        blobs_bundle.proofs.push(KzgProof([0; 48])).unwrap();
+        // Emit a proof layout matching the fork we label the response with, so a
+        // mismatch-labelled response still passes that fork's blob validation and
+        // the only thing left to reject it is the fork check itself. Electra uses
+        // one proof per blob; Fulu uses CELLS_PER_EXT_BLOB per blob.
+        let proofs_per_blob = match state.submit_block_version_override() {
+            Some(ForkName::Fulu) => CELLS_PER_EXT_BLOB,
+            _ => 1,
+        };
+        for _ in 0..(blobs_bundle.blobs.len() * proofs_per_blob) {
+            blobs_bundle.proofs.push(KzgProof([0; 48])).unwrap();
+        }
 
         let response =
             PayloadAndBlobs { execution_payload: execution_payload.into(), blobs_bundle };
@@ -376,7 +404,7 @@ async fn handle_submit_block_v1(
         } else {
             // Return JSON for everything else; this is fine for the mock
             let response = SubmitBlindedBlockResponse {
-                version: ForkName::Electra,
+                version: state.submit_block_version_override().unwrap_or(ForkName::Electra),
                 metadata: Default::default(),
                 data: response,
             };

tests/tests/pbs_post_blinded_blocks.rs

@@ -281,6 +281,55 @@ async fn test_submit_block_too_large() -> Result<()> {
     Ok(())
 }
 
+// A relay must not be able to have its response validated, or its version
+// header forwarded to the beacon node, under a fork other than the one the
+// request was for. Here the relay answers an Electra request but labels the
+// JSON response Fulu; PBS must reject it rather than trust the relay-controlled
+// version.
+#[tokio::test]
+async fn test_submit_block_rejects_fork_mismatch() -> Result<()> {
+    setup_test_env();
+    let signer = random_secret();
+    let pubkey = signer.public_key();
+    let chain = Chain::Holesky;
+    let pbs_listener = get_free_listener().await;
+    let relay_listener = get_free_listener().await;
+    let pbs_port = pbs_listener.local_addr().unwrap().port();
+    let relay_port = relay_listener.local_addr().unwrap().port();
+
+    let mock_relay = generate_mock_relay(relay_port, pubkey)?;
+    let mut mock_relay_state =
+        MockRelayState::new(chain, signer).with_submit_block_version(ForkName::Fulu);
+    // JSON-only so the response parses cleanly and the rejection is on the fork
+    // mismatch, not an SSZ decode error.
+    mock_relay_state.supported_content_types = Arc::new(HashSet::from([EncodingType::Json]));
+    let mock_state = Arc::new(mock_relay_state);
+    tokio::spawn(start_mock_relay_service_with_listener(mock_state.clone(), relay_listener));
+
+    let config = to_pbs_config(chain, get_pbs_config(pbs_port), vec![mock_relay]);
+    let state = PbsState::new(config, PathBuf::new());
+    drop(pbs_listener);
+    tokio::spawn(PbsService::run::<(), DefaultBuilderApi>(state));
+    tokio::time::sleep(Duration::from_millis(100)).await;
+
+    let mock_validator = MockValidator::new(pbs_port)?;
+    let res = mock_validator
+        .do_submit_block_v1(
+            Some(load_test_signed_blinded_block()),
+            vec![EncodingType::Json],
+            EncodingType::Json,
+            ForkName::Electra,
+        )
+        .await?;
+
+    // The relay was reached (SSZ attempt 415s on this JSON-only relay, then a
+    // JSON retry carries the mismatched version), but the fork-mismatched
+    // response is rejected rather than trusted.
+    assert_eq!(mock_state.received_submit_block(), 2);
+    assert_eq!(res.status(), StatusCode::BAD_GATEWAY);
+    Ok(())
+}
+
 #[allow(clippy::too_many_arguments)]
 async fn submit_block_impl(
     api_version: BuilderApiVersion,