Merge branch 'develop' into process-exec-payload

This PR implements gossip for execution payload envelope as outlined in
the following spec:

https://github.com/ethereum/consensus-specs/blob/master/specs/gloas/p2p-interface.md#execution_payload

.ethspecify.yml

@@ -1,25 +1,39 @@
-version: v1.7.0-alpha.1
+version: v1.7.0-alpha.2
 style: full
 
 specrefs:
-  search_root: ..
+  search_root: .
+  auto_standardize_names: true
+  auto_add_missing_entries: true
+  require_exceptions_have_fork: true
+
   files:
-    - configs.yml
-    - constants.yml
-    - containers.yml
-    - dataclasses.yml
-    - functions.yml
-    - presets.yml
+    - specrefs/configs.yml
+    - specrefs/constants.yml
+    - specrefs/containers.yml
+    - specrefs/dataclasses.yml
+    - specrefs/functions.yml
+    - specrefs/presets.yml
 
 exceptions:
   presets:
-    # Not implemented: gloas (future fork)
+    # gloas
     - BUILDER_PENDING_WITHDRAWALS_LIMIT#gloas
     - MAX_PAYLOAD_ATTESTATIONS#gloas
     - PTC_SIZE#gloas
 
   constants:
-    # Constants in the KZG library
+    # phase0
+    - BASIS_POINTS#phase0
+    - ENDIANNESS#phase0
+    - MAX_CONCURRENT_REQUESTS#phase0
+    - UINT64_MAX#phase0
+    - UINT64_MAX_SQRT#phase0
+    # altair
+    - PARTICIPATION_FLAG_WEIGHTS#altair
+    # bellatrix
+    - SAFE_SLOTS_TO_IMPORT_OPTIMISTICALLY#bellatrix
+    # deneb
     - BLS_MODULUS#deneb
     - BYTES_PER_COMMITMENT#deneb
     - BYTES_PER_FIELD_ELEMENT#deneb
@@ -33,18 +47,9 @@ exceptions:
     - PRIMITIVE_ROOT_OF_UNITY#deneb
     - RANDOM_CHALLENGE_KZG_BATCH_DOMAIN#deneb
     - RANDOM_CHALLENGE_KZG_CELL_BATCH_DOMAIN#fulu
-
-    # Not implemented
-    - BASIS_POINTS#phase0
-    - ENDIANNESS#phase0
-    - MAX_CONCURRENT_REQUESTS#phase0
-    - PARTICIPATION_FLAG_WEIGHTS#altair
-    - SAFE_SLOTS_TO_IMPORT_OPTIMISTICALLY#bellatrix
+    # fulu
     - UINT256_MAX#fulu
-    - UINT64_MAX#phase0
-    - UINT64_MAX_SQRT#phase0
-
-    # Not implemented: gloas (future fork)
+    # gloas
     - BUILDER_PAYMENT_THRESHOLD_DENOMINATOR#gloas
     - BUILDER_PAYMENT_THRESHOLD_NUMERATOR#gloas
     - BUILDER_WITHDRAWAL_PREFIX#gloas
@@ -61,61 +66,62 @@ exceptions:
     - PTC_TIMELINESS_INDEX#gloas
 
   configs:
-    # Not implemented: gloas (future fork)
+    # gloas
     - AGGREGATE_DUE_BPS_GLOAS#gloas
     - ATTESTATION_DUE_BPS_GLOAS#gloas
     - CONTRIBUTION_DUE_BPS_GLOAS#gloas
     - GLOAS_FORK_EPOCH#gloas
     - GLOAS_FORK_VERSION#gloas
     - MAX_REQUEST_PAYLOADS#gloas
+    - MIN_BUILDER_WITHDRAWABILITY_DELAY#gloas
     - PAYLOAD_ATTESTATION_DUE_BPS#gloas
     - SYNC_MESSAGE_DUE_BPS_GLOAS#gloas
-    - MIN_BUILDER_WITHDRAWABILITY_DELAY#gloas
 
   ssz_objects:
-    # Not implemented
+    # phase0
     - Eth1Block#phase0
-    - MatrixEntry#fulu
-
-    # Not implemented: capella
+    # capella
     - LightClientBootstrap#capella
     - LightClientFinalityUpdate#capella
     - LightClientOptimisticUpdate#capella
     - LightClientUpdate#capella
-
-    # Not implemented: gloas (future fork)
+    # fulu
+    - MatrixEntry#fulu
+    # gloas
     - BeaconBlockBody#gloas
     - BeaconState#gloas
+    - Builder#gloas
     - BuilderPendingPayment#gloas
     - BuilderPendingWithdrawal#gloas
     - DataColumnSidecar#gloas
-    - ExecutionPayloadEnvelope#gloas
     - ExecutionPayloadBid#gloas
+    - ExecutionPayloadEnvelope#gloas
     - ForkChoiceNode#gloas
     - IndexedPayloadAttestation#gloas
     - PayloadAttestation#gloas
     - PayloadAttestationData#gloas
     - PayloadAttestationMessage#gloas
-    - SignedExecutionPayloadEnvelope#gloas
-    - SignedExecutionPayloadBid#gloas
-    - Builder#gloas
     - ProposerPreferences#gloas
+    - SignedExecutionPayloadBid#gloas
+    - SignedExecutionPayloadEnvelope#gloas
     - SignedProposerPreferences#gloas
 
   dataclasses:
-    # Not implemented
-    - BlobParameters#fulu
-    - ExpectedWithdrawals#capella
-    - ExpectedWithdrawals#electra
+    # phase0
     - LatestMessage#phase0
-    - LightClientStore#altair
-    - OptimisticStore#bellatrix
     - Store#phase0
-
-    # Not implemented: capella
+    # altair
+    - LightClientStore#altair
+    # bellatrix
+    - OptimisticStore#bellatrix
+    # capella
+    - ExpectedWithdrawals#capella
     - LightClientStore#capella
-
-    # Not implemented: gloas (future fork)
+    # electra
+    - ExpectedWithdrawals#electra
+    # fulu
+    - BlobParameters#fulu
+    # gloas
     - ExpectedWithdrawals#gloas
     - LatestMessage#gloas
     - Store#gloas
@@ -140,7 +146,6 @@ exceptions:
     - g1_lincomb#deneb
     - hash_to_bls_field#deneb
     - is_power_of_two#deneb
-    - multi_exp#deneb
     - reverse_bits#deneb
     - validate_kzg_g1#deneb
     - verify_blob_kzg_proof#deneb
@@ -175,7 +180,12 @@ exceptions:
     - verify_cell_kzg_proof_batch#fulu
     - verify_cell_kzg_proof_batch_impl#fulu
 
-    # Not implemented: phase0
+    # phase0
+    - update_proposer_boost_root#phase0
+    - is_proposer_equivocation#phase0
+    - record_block_timeliness#phase0
+    - compute_proposer_score#phase0
+    - get_attestation_score#phase0
     - calculate_committee_fraction#phase0
     - compute_fork_version#phase0
     - compute_pulled_up_tip#phase0
@@ -221,8 +231,7 @@ exceptions:
     - validate_on_attestation#phase0
     - validate_target_epoch_against_current_time#phase0
     - xor#phase0
-
-    # Not implemented: altair
+    # altair
     - compute_merkle_proof#altair
     - compute_sync_committee_period_at_slot#altair
     - get_contribution_and_proof#altair
@@ -244,27 +253,29 @@ exceptions:
     - process_sync_committee_contributions#altair
     - set_or_append_list#altair
     - validate_light_client_update#altair
-
-    # Not implemented: bellatrix
+    # bellatrix
     - get_execution_payload#bellatrix
     - is_merge_transition_block#bellatrix
     - is_optimistic_candidate_block#bellatrix
     - latest_verified_ancestor#bellatrix
     - prepare_execution_payload#bellatrix
-
-    # Not implemented: capella
+    # capella
+    - apply_withdrawals#capella
+    - get_balance_after_withdrawals#capella
     - get_lc_execution_root#capella
+    - get_validators_sweep_withdrawals#capella
     - is_valid_light_client_header#capella
     - prepare_execution_payload#capella
     - process_epoch#capella
+    - update_next_withdrawal_index#capella
+    - update_next_withdrawal_validator_index#capella
     - upgrade_lc_bootstrap_to_capella#capella
     - upgrade_lc_finality_update_to_capella#capella
     - upgrade_lc_header_to_capella#capella
     - upgrade_lc_optimistic_update_to_capella#capella
     - upgrade_lc_store_to_capella#capella
     - upgrade_lc_update_to_capella#capella
-
-    # Not implemented: deneb
+    # deneb
     - get_lc_execution_root#deneb
     - is_valid_light_client_header#deneb
     - prepare_execution_payload#deneb
@@ -274,33 +285,34 @@ exceptions:
     - upgrade_lc_optimistic_update_to_deneb#deneb
     - upgrade_lc_store_to_deneb#deneb
     - upgrade_lc_update_to_deneb#deneb
-
-    # Not implemented: electra
+    # electra
     - compute_weak_subjectivity_period#electra
     - current_sync_committee_gindex_at_slot#electra
     - finalized_root_gindex_at_slot#electra
     - get_eth1_vote#electra
     - get_lc_execution_root#electra
+    - get_pending_partial_withdrawals#electra
+    - get_validators_sweep_withdrawals#electra
     - is_compounding_withdrawal_credential#electra
+    - is_eligible_for_partial_withdrawals#electra
     - is_within_weak_subjectivity_period#electra
     - next_sync_committee_gindex_at_slot#electra
     - normalize_merkle_branch#electra
     - prepare_execution_payload#electra
+    - update_pending_partial_withdrawals#electra
     - upgrade_lc_bootstrap_to_electra#electra
     - upgrade_lc_finality_update_to_electra#electra
     - upgrade_lc_header_to_electra#electra
     - upgrade_lc_optimistic_update_to_electra#electra
     - upgrade_lc_store_to_electra#electra
     - upgrade_lc_update_to_electra#electra
-
-    # Not implemented: fulu
+    # fulu
     - compute_matrix#fulu
     - get_blob_parameters#fulu
     - get_data_column_sidecars_from_block#fulu
     - get_data_column_sidecars_from_column_sidecar#fulu
     - recover_matrix#fulu
-
-    # Not implemented: gloas (future fork)
+    # gloas
     - compute_balance_weighted_acceptance#gloas
     - compute_balance_weighted_selection#gloas
     - compute_fork_version#gloas
@@ -368,49 +380,42 @@ exceptions:
     - verify_execution_payload_bid_signature#gloas
     - add_builder_to_registry#gloas
     - apply_deposit_for_builder#gloas
-    - apply_withdrawals#capella
     - apply_withdrawals#gloas
     - can_builder_cover_bid#gloas
-    - compute_proposer_score#phase0
     - convert_builder_index_to_validator_index#gloas
     - convert_validator_index_to_builder_index#gloas
     - get_attestation_score#gloas
     - get_attestation_score#phase0
     - get_balance_after_withdrawals#capella
-    - get_builder_from_deposit#gloas
     - get_builder_withdrawals#gloas
     - get_builders_sweep_withdrawals#gloas
     - get_index_for_new_builder#gloas
     - get_pending_balance_to_withdraw_for_builder#gloas
-    - get_pending_partial_withdrawals#electra
     - get_proposer_preferences_signature#gloas
     - get_upcoming_proposal_slots#gloas
-    - get_validators_sweep_withdrawals#capella
-    - get_validators_sweep_withdrawals#electra
     - initiate_builder_exit#gloas
     - is_active_builder#gloas
     - is_builder_index#gloas
+    - is_data_available#gloas
     - is_eligible_for_partial_withdrawals#electra
     - is_head_late#gloas
     - is_head_weak#gloas
     - is_parent_strong#gloas
-    - is_proposer_equivocation#phase0
     - is_valid_proposal_slot#gloas
+    - onboard_builders_from_pending_deposits#gloas
     - process_deposit_request#gloas
     - process_voluntary_exit#gloas
     - record_block_timeliness#gloas
     - record_block_timeliness#phase0
+    - verify_data_column_sidecar_kzg_proofs#gloas
     - should_apply_proposer_boost#gloas
     - update_builder_pending_withdrawals#gloas
     - update_next_withdrawal_builder_index#gloas
-    - update_next_withdrawal_index#capella
-    - update_next_withdrawal_validator_index#capella
     - update_payload_expected_withdrawals#gloas
-    - update_pending_partial_withdrawals#electra
     - update_proposer_boost_root#gloas
-    - update_proposer_boost_root#phase0
 
   presets:
+    # gloas
     - BUILDER_PENDING_WITHDRAWALS_LIMIT#gloas
     - BUILDER_REGISTRY_LIMIT#gloas
     - MAX_BUILDERS_PER_WITHDRAWALS_SWEEP#gloas

.github/workflows/check-specrefs.yml

@@ -12,11 +12,11 @@ jobs:
     - name: Check version consistency
       run: |
         WORKSPACE_VERSION=$(grep 'consensus_spec_version = ' WORKSPACE | sed 's/.*"\(.*\)"/\1/')
-        ETHSPECIFY_VERSION=$(grep '^version:' specrefs/.ethspecify.yml | sed 's/version: //')
+        ETHSPECIFY_VERSION=$(grep '^version:' .ethspecify.yml | sed 's/version: //')
         if [ "$WORKSPACE_VERSION" != "$ETHSPECIFY_VERSION" ]; then
           echo "Version mismatch between WORKSPACE and ethspecify"
           echo "  WORKSPACE: $WORKSPACE_VERSION"
-          echo "  specrefs/.ethspecify.yml: $ETHSPECIFY_VERSION"
+          echo "  .ethspecify.yml: $ETHSPECIFY_VERSION"
           exit 1
         else
           echo "Versions match: $WORKSPACE_VERSION"
@@ -26,7 +26,7 @@ jobs:
       run: python3 -mpip install ethspecify
 
     - name: Update spec references
-      run: ethspecify process --path=specrefs
+      run: ethspecify
 
     - name: Check for differences
       run: |
@@ -40,4 +40,4 @@ jobs:
         fi
 
     - name: Check spec references
-      run: ethspecify check --path=specrefs
+      run: ethspecify check

WORKSPACE

@@ -273,16 +273,16 @@ filegroup(
     url = "https://github.com/ethereum/EIPs/archive/5480440fe51742ed23342b68cf106cefd427e39d.tar.gz",
 )
 
-consensus_spec_version = "v1.7.0-alpha.1"
+consensus_spec_version = "v1.7.0-alpha.2"
 
 load("@prysm//tools:download_spectests.bzl", "consensus_spec_tests")
 
 consensus_spec_tests(
     name = "consensus_spec_tests",
     flavors = {
-        "general": "sha256-j5R3jA7Oo4OSDMTvpMuD+8RomaCByeFSwtfkq6fL0Zg=",
-        "minimal": "sha256-tdTqByoyswOS4r6OxFmo70y2BP7w1TgEok+gf4cbxB0=",
-        "mainnet": "sha256-5gB4dt6SnSDKzdBc06VedId3NkgvSYyv9n9FRxWKwYI=",
+        "general": "sha256-iGQsGZ1cHah+2CSod9jC3kN8Ku4n6KO0hIwfINrn/po=",
+        "minimal": "sha256-TgcYt8N8sXSttdHTGvOa+exUZ1zn1UzlAMz0V7i37xc=",
+        "mainnet": "sha256-LnXyiLoJtrvEvbqLDSAAqpLMdN/lXv92SAgYG8fNjCs=",
     },
     version = consensus_spec_version,
 )
@@ -298,7 +298,7 @@ filegroup(
     visibility = ["//visibility:public"],
 )
     """,
-    integrity = "sha256-J+43DrK1pF658kTXTwMS6zGf4KDjvas++m8w2a8swpg=",
+    integrity = "sha256-Y/67Dg393PksZj5rTFNLntiJ6hNdB7Rxbu5gZE2gebY=",
     strip_prefix = "consensus-specs-" + consensus_spec_version[1:],
     url = "https://github.com/ethereum/consensus-specs/archive/refs/tags/%s.tar.gz" % consensus_spec_version,
 )

api/fallback/BUILD.bazel

@@ -0,0 +1,19 @@
+load("@prysm//tools/go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "go_default_library",
+    srcs = [
+        "fallback.go",
+        "log.go",
+    ],
+    importpath = "github.com/OffchainLabs/prysm/v7/api/fallback",
+    visibility = ["//visibility:public"],
+    deps = ["@com_github_sirupsen_logrus//:go_default_library"],
+)
+
+go_test(
+    name = "go_default_test",
+    srcs = ["fallback_test.go"],
+    embed = [":go_default_library"],
+    deps = ["//testing/assert:go_default_library"],
+)

api/fallback/fallback.go

@@ -0,0 +1,66 @@
+package fallback
+
+import (
+	"context"
+
+	"github.com/sirupsen/logrus"
+)
+
+// HostProvider is the subset of connection-provider methods that EnsureReady
+// needs. Both grpc.GrpcConnectionProvider and rest.RestConnectionProvider
+// satisfy this interface.
+type HostProvider interface {
+	Hosts() []string
+	CurrentHost() string
+	SwitchHost(index int) error
+}
+
+// ReadyChecker can report whether the current endpoint is ready.
+// iface.NodeClient satisfies this implicitly.
+type ReadyChecker interface {
+	IsReady(ctx context.Context) bool
+}
+
+// EnsureReady iterates through the configured hosts and returns true as soon as
+// one responds as ready. It starts from the provider's current host and wraps
+// around using modular arithmetic, performing failover when a host is not ready.
+func EnsureReady(ctx context.Context, provider HostProvider, checker ReadyChecker) bool {
+	hosts := provider.Hosts()
+	numHosts := len(hosts)
+	startingHost := provider.CurrentHost()
+	var attemptedHosts []string
+
+	// Find current index
+	currentIdx := 0
+	for i, h := range hosts {
+		if h == startingHost {
+			currentIdx = i
+			break
+		}
+	}
+
+	for i := range numHosts {
+		if checker.IsReady(ctx) {
+			if len(attemptedHosts) > 0 {
+				log.WithFields(logrus.Fields{
+					"previous": startingHost,
+					"current":  provider.CurrentHost(),
+					"tried":    attemptedHosts,
+				}).Info("Switched to responsive beacon node")
+			}
+			return true
+		}
+		attemptedHosts = append(attemptedHosts, provider.CurrentHost())
+
+		// Try next host if not the last iteration
+		if i < numHosts-1 {
+			nextIdx := (currentIdx + i + 1) % numHosts
+			if err := provider.SwitchHost(nextIdx); err != nil {
+				log.WithError(err).Error("Failed to switch host")
+			}
+		}
+	}
+
+	log.WithField("tried", attemptedHosts).Warn("No responsive beacon node found")
+	return false
+}

api/fallback/fallback_test.go

@@ -0,0 +1,94 @@
+package fallback
+
+import (
+	"context"
+	"testing"
+
+	"github.com/OffchainLabs/prysm/v7/testing/assert"
+)
+
+// mockHostProvider is a minimal HostProvider for unit tests.
+type mockHostProvider struct {
+	hosts     []string
+	hostIndex int
+}
+
+func (m *mockHostProvider) Hosts() []string { return m.hosts }
+func (m *mockHostProvider) CurrentHost() string {
+	return m.hosts[m.hostIndex%len(m.hosts)]
+}
+func (m *mockHostProvider) SwitchHost(index int) error { m.hostIndex = index; return nil }
+
+// mockReadyChecker records per-call IsReady results in sequence.
+type mockReadyChecker struct {
+	results []bool
+	idx     int
+}
+
+func (m *mockReadyChecker) IsReady(_ context.Context) bool {
+	if m.idx >= len(m.results) {
+		return false
+	}
+	r := m.results[m.idx]
+	m.idx++
+	return r
+}
+
+func TestEnsureReady_SingleHostReady(t *testing.T) {
+	provider := &mockHostProvider{hosts: []string{"http://host1:3500"}, hostIndex: 0}
+	checker := &mockReadyChecker{results: []bool{true}}
+	assert.Equal(t, true, EnsureReady(t.Context(), provider, checker))
+	assert.Equal(t, 0, provider.hostIndex)
+}
+
+func TestEnsureReady_SingleHostNotReady(t *testing.T) {
+	provider := &mockHostProvider{hosts: []string{"http://host1:3500"}, hostIndex: 0}
+	checker := &mockReadyChecker{results: []bool{false}}
+	assert.Equal(t, false, EnsureReady(t.Context(), provider, checker))
+}
+
+func TestEnsureReady_SingleHostError(t *testing.T) {
+	provider := &mockHostProvider{hosts: []string{"http://host1:3500"}, hostIndex: 0}
+	checker := &mockReadyChecker{results: []bool{false}}
+	assert.Equal(t, false, EnsureReady(t.Context(), provider, checker))
+}
+
+func TestEnsureReady_MultipleHostsFirstReady(t *testing.T) {
+	provider := &mockHostProvider{
+		hosts:     []string{"http://host1:3500", "http://host2:3500"},
+		hostIndex: 0,
+	}
+	checker := &mockReadyChecker{results: []bool{true}}
+	assert.Equal(t, true, EnsureReady(t.Context(), provider, checker))
+	assert.Equal(t, 0, provider.hostIndex)
+}
+
+func TestEnsureReady_MultipleHostsFailoverToSecond(t *testing.T) {
+	provider := &mockHostProvider{
+		hosts:     []string{"http://host1:3500", "http://host2:3500"},
+		hostIndex: 0,
+	}
+	checker := &mockReadyChecker{results: []bool{false, true}}
+	assert.Equal(t, true, EnsureReady(t.Context(), provider, checker))
+	assert.Equal(t, 1, provider.hostIndex)
+}
+
+func TestEnsureReady_MultipleHostsNoneReady(t *testing.T) {
+	provider := &mockHostProvider{
+		hosts:     []string{"http://host1:3500", "http://host2:3500", "http://host3:3500"},
+		hostIndex: 0,
+	}
+	checker := &mockReadyChecker{results: []bool{false, false, false}}
+	assert.Equal(t, false, EnsureReady(t.Context(), provider, checker))
+}
+
+func TestEnsureReady_WrapAroundFromNonZeroIndex(t *testing.T) {
+	provider := &mockHostProvider{
+		hosts:     []string{"http://host0:3500", "http://host1:3500", "http://host2:3500"},
+		hostIndex: 1,
+	}
+	// host1 (start) fails, host2 fails, host0 succeeds
+	checker := &mockReadyChecker{results: []bool{false, false, true}}
+	assert.Equal(t, true, EnsureReady(t.Context(), provider, checker))
+	assert.Equal(t, 0, provider.hostIndex)
+}

api/fallback/log.go

@@ -0,0 +1,9 @@
+// Code generated by hack/gen-logs.sh; DO NOT EDIT.
+// This file is created and regenerated automatically. Anything added here might get removed.
+package fallback
+
+import "github.com/sirupsen/logrus"
+
+// The prefix for logs from this package will be the text after the last slash in the package path.
+// If you wish to change this, you should add your desired name in the runtime/logging/logrus-prefixed-formatter/prefix-replacement.go file.
+var log = logrus.WithField("package", "api/fallback")

api/grpc/grpc_connection_provider.go

@@ -25,6 +25,11 @@ type GrpcConnectionProvider interface {
 	// SwitchHost switches to the endpoint at the given index.
 	// The new connection is created lazily on next CurrentConn() call.
 	SwitchHost(index int) error
+	// ConnectionCounter returns a monotonically increasing counter that increments
+	// each time SwitchHost changes the active endpoint. This allows consumers to
+	// detect connection changes even when the host string returns to a previous value
+	// (e.g., host0 → host1 → host0).
+	ConnectionCounter() uint64
 	// Close closes the current connection.
 	Close()
 }
@@ -38,6 +43,7 @@ type grpcConnectionProvider struct {
 	// Current connection state (protected by mutex)
 	currentIndex uint64
 	conn         *grpc.ClientConn
+	connCounter  uint64
 
 	mu     sync.Mutex
 	closed bool
@@ -138,6 +144,7 @@ func (p *grpcConnectionProvider) SwitchHost(index int) error {
 
 	p.conn = nil // Clear immediately - new connection created lazily
 	p.currentIndex = uint64(index)
+	p.connCounter++
 
 	// Close old connection asynchronously to avoid blocking the caller
 	if oldConn != nil {
@@ -155,6 +162,12 @@ func (p *grpcConnectionProvider) SwitchHost(index int) error {
 	return nil
 }
 
+func (p *grpcConnectionProvider) ConnectionCounter() uint64 {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return p.connCounter
+}
+
 func (p *grpcConnectionProvider) Close() {
 	p.mu.Lock()
 	defer p.mu.Unlock()

api/grpc/mock_grpc_provider.go

@@ -4,17 +4,24 @@ import "google.golang.org/grpc"
 
 // MockGrpcProvider implements GrpcConnectionProvider for testing.
 type MockGrpcProvider struct {
-	MockConn  *grpc.ClientConn
-	MockHosts []string
+	MockConn     *grpc.ClientConn
+	MockHosts    []string
+	CurrentIndex int
+	ConnCounter  uint64
 }
 
 func (m *MockGrpcProvider) CurrentConn() *grpc.ClientConn { return m.MockConn }
 func (m *MockGrpcProvider) CurrentHost() string {
 	if len(m.MockHosts) > 0 {
-		return m.MockHosts[0]
+		return m.MockHosts[m.CurrentIndex]
 	}
 	return ""
 }
-func (m *MockGrpcProvider) Hosts() []string      { return m.MockHosts }
-func (m *MockGrpcProvider) SwitchHost(int) error { return nil }
-func (m *MockGrpcProvider) Close()               {}
+func (m *MockGrpcProvider) Hosts() []string { return m.MockHosts }
+func (m *MockGrpcProvider) SwitchHost(idx int) error {
+	m.CurrentIndex = idx
+	m.ConnCounter++
+	return nil
+}
+func (m *MockGrpcProvider) ConnectionCounter() uint64 { return m.ConnCounter }
+func (m *MockGrpcProvider) Close()                    {}

api/rest/mock_rest_provider.go

@@ -9,13 +9,13 @@ import (
 // MockRestProvider implements RestConnectionProvider for testing.
 type MockRestProvider struct {
 	MockClient  *http.Client
-	MockHandler RestHandler
+	MockHandler Handler
 	MockHosts   []string
 	HostIndex   int
 }
 
 func (m *MockRestProvider) HttpClient() *http.Client { return m.MockClient }
-func (m *MockRestProvider) RestHandler() RestHandler { return m.MockHandler }
+func (m *MockRestProvider) Handler() Handler         { return m.MockHandler }
 func (m *MockRestProvider) CurrentHost() string {
 	if len(m.MockHosts) > 0 {
 		return m.MockHosts[m.HostIndex%len(m.MockHosts)]
@@ -25,25 +25,22 @@ func (m *MockRestProvider) CurrentHost() string {
 func (m *MockRestProvider) Hosts() []string            { return m.MockHosts }
 func (m *MockRestProvider) SwitchHost(index int) error { m.HostIndex = index; return nil }
 
-// MockRestHandler implements RestHandler for testing.
-type MockRestHandler struct {
-	MockHost   string
-	MockClient *http.Client
+// MockHandler implements Handler for testing.
+type MockHandler struct {
+	MockHost string
 }
 
-func (m *MockRestHandler) Get(_ context.Context, _ string, _ any) error { return nil }
-func (m *MockRestHandler) GetStatusCode(_ context.Context, _ string) (int, error) {
+func (m *MockHandler) Get(_ context.Context, _ string, _ any) error { return nil }
+func (m *MockHandler) GetStatusCode(_ context.Context, _ string) (int, error) {
 	return http.StatusOK, nil
 }
-func (m *MockRestHandler) GetSSZ(_ context.Context, _ string) ([]byte, http.Header, error) {
+func (m *MockHandler) GetSSZ(_ context.Context, _ string) ([]byte, http.Header, error) {
 	return nil, nil, nil
 }
-func (m *MockRestHandler) Post(_ context.Context, _ string, _ map[string]string, _ *bytes.Buffer, _ any) error {
+func (m *MockHandler) Post(_ context.Context, _ string, _ map[string]string, _ *bytes.Buffer, _ any) error {
 	return nil
 }
-func (m *MockRestHandler) PostSSZ(_ context.Context, _ string, _ map[string]string, _ *bytes.Buffer) ([]byte, http.Header, error) {
+func (m *MockHandler) PostSSZ(_ context.Context, _ string, _ map[string]string, _ *bytes.Buffer) ([]byte, http.Header, error) {
 	return nil, nil, nil
 }
-func (m *MockRestHandler) HttpClient() *http.Client { return m.MockClient }
-func (m *MockRestHandler) Host() string             { return m.MockHost }
-func (m *MockRestHandler) SwitchHost(host string)   { m.MockHost = host }
+func (m *MockHandler) Host() string { return m.MockHost }

api/rest/rest_connection_provider.go

@@ -17,8 +17,8 @@ import (
 type RestConnectionProvider interface {
 	// HttpClient returns the configured HTTP client with headers, timeout, and optional tracing.
 	HttpClient() *http.Client
-	// RestHandler returns the REST handler for making API requests.
-	RestHandler() RestHandler
+	// Handler returns the REST handler for making API requests.
+	Handler() Handler
 	// CurrentHost returns the current REST API endpoint URL.
 	CurrentHost() string
 	// Hosts returns all configured REST API endpoint URLs.
@@ -54,7 +54,7 @@ func WithTracing() RestConnectionProviderOption {
 type restConnectionProvider struct {
 	endpoints     []string
 	httpClient    *http.Client
-	restHandler   RestHandler
+	restHandler   *handler
 	currentIndex  atomic.Uint64
 	timeout       time.Duration
 	headers       map[string][]string
@@ -96,7 +96,7 @@ func NewRestConnectionProvider(endpoint string, opts ...RestConnectionProviderOp
 	}
 
 	// Create the REST handler with the HTTP client and initial host
-	p.restHandler = newRestHandler(*p.httpClient, endpoints[0])
+	p.restHandler = newHandler(*p.httpClient, endpoints[0])
 
 	log.WithFields(logrus.Fields{
 		"endpoints": endpoints,
@@ -124,7 +124,7 @@ func (p *restConnectionProvider) HttpClient() *http.Client {
 	return p.httpClient
 }
 
-func (p *restConnectionProvider) RestHandler() RestHandler {
+func (p *restConnectionProvider) Handler() Handler {
 	return p.restHandler
 }
 

api/rest/rest_handler.go

@@ -21,32 +21,35 @@ import (
 
 type reqOption func(*http.Request)
 
-// RestHandler defines the interface for making REST API requests.
-type RestHandler interface {
+// Handler defines the interface for making REST API requests.
+type Handler interface {
 	Get(ctx context.Context, endpoint string, resp any) error
 	GetStatusCode(ctx context.Context, endpoint string) (int, error)
 	GetSSZ(ctx context.Context, endpoint string) ([]byte, http.Header, error)
 	Post(ctx context.Context, endpoint string, headers map[string]string, data *bytes.Buffer, resp any) error
 	PostSSZ(ctx context.Context, endpoint string, headers map[string]string, data *bytes.Buffer) ([]byte, http.Header, error)
-	HttpClient() *http.Client
 	Host() string
-	SwitchHost(host string)
 }
 
-type restHandler struct {
+type handler struct {
 	client       http.Client
 	host         string
 	reqOverrides []reqOption
 }
 
-// newRestHandler returns a RestHandler (internal use)
-func newRestHandler(client http.Client, host string) RestHandler {
-	return NewRestHandler(client, host)
+// newHandler returns a *handler for internal use within the rest package.
+func newHandler(client http.Client, host string) *handler {
+	rh := &handler{
+		client: client,
+		host:   host,
+	}
+	rh.appendAcceptOverride()
+	return rh
 }
 
-// NewRestHandler returns a RestHandler
-func NewRestHandler(client http.Client, host string) RestHandler {
-	rh := &restHandler{
+// NewHandler returns a Handler
+func NewHandler(client http.Client, host string) Handler {
+	rh := &handler{
 		client: client,
 		host:   host,
 	}
@@ -57,7 +60,7 @@ func NewRestHandler(client http.Client, host string) RestHandler {
 // appendAcceptOverride enables the Accept header to be customized at runtime via an environment variable.
 // This is specified as an env var because it is a niche option that prysm may use for performance testing or debugging
 // bug which users are unlikely to need. Using an env var keeps the set of user-facing flags cleaner.
-func (c *restHandler) appendAcceptOverride() {
+func (c *handler) appendAcceptOverride() {
 	if accept := os.Getenv(params.EnvNameOverrideAccept); accept != "" {
 		c.reqOverrides = append(c.reqOverrides, func(req *http.Request) {
 			req.Header.Set("Accept", accept)
@@ -66,18 +69,18 @@ func (c *restHandler) appendAcceptOverride() {
 }
 
 // HttpClient returns the underlying HTTP client of the handler
-func (c *restHandler) HttpClient() *http.Client {
+func (c *handler) HttpClient() *http.Client {
 	return &c.client
 }
 
 // Host returns the underlying HTTP host
-func (c *restHandler) Host() string {
+func (c *handler) Host() string {
 	return c.host
 }
 
 // Get sends a GET request and decodes the response body as a JSON object into the passed in object.
 // If an HTTP error is returned, the body is decoded as a DefaultJsonError JSON object and returned as the first return value.
-func (c *restHandler) Get(ctx context.Context, endpoint string, resp any) error {
+func (c *handler) Get(ctx context.Context, endpoint string, resp any) error {
 	url := c.host + endpoint
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
@@ -100,7 +103,7 @@ func (c *restHandler) Get(ctx context.Context, endpoint string, resp any) error
 // GetStatusCode sends a GET request and returns only the HTTP status code.
 // This is useful for endpoints like /eth/v1/node/health that communicate status via HTTP codes
 // (200 = ready, 206 = syncing, 503 = unavailable) rather than response bodies.
-func (c *restHandler) GetStatusCode(ctx context.Context, endpoint string) (int, error) {
+func (c *handler) GetStatusCode(ctx context.Context, endpoint string) (int, error) {
 	url := c.host + endpoint
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
@@ -119,7 +122,7 @@ func (c *restHandler) GetStatusCode(ctx context.Context, endpoint string) (int,
 	return httpResp.StatusCode, nil
 }
 
-func (c *restHandler) GetSSZ(ctx context.Context, endpoint string) ([]byte, http.Header, error) {
+func (c *handler) GetSSZ(ctx context.Context, endpoint string) ([]byte, http.Header, error) {
 	url := c.host + endpoint
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
@@ -174,7 +177,7 @@ func (c *restHandler) GetSSZ(ctx context.Context, endpoint string) ([]byte, http
 
 // Post sends a POST request and decodes the response body as a JSON object into the passed in object.
 // If an HTTP error is returned, the body is decoded as a DefaultJsonError JSON object and returned as the first return value.
-func (c *restHandler) Post(
+func (c *handler) Post(
 	ctx context.Context,
 	apiEndpoint string,
 	headers map[string]string,
@@ -210,7 +213,7 @@ func (c *restHandler) Post(
 }
 
 // PostSSZ sends a POST request and prefers an SSZ (application/octet-stream) response body.
-func (c *restHandler) PostSSZ(
+func (c *handler) PostSSZ(
 	ctx context.Context,
 	apiEndpoint string,
 	headers map[string]string,
@@ -311,6 +314,6 @@ func decodeResp(httpResp *http.Response, resp any) error {
 	return nil
 }
 
-func (c *restHandler) SwitchHost(host string) {
+func (c *handler) SwitchHost(host string) {
 	c.host = host
 }

api/server/structs/block.go

@@ -509,17 +509,17 @@ func (s *SignedBlindedBeaconBlockFulu) SigString() string {
 // ----------------------------------------------------------------------------
 
 type ExecutionPayloadBid struct {
-	ParentBlockHash        string `json:"parent_block_hash"`
-	ParentBlockRoot        string `json:"parent_block_root"`
-	BlockHash              string `json:"block_hash"`
-	PrevRandao             string `json:"prev_randao"`
-	FeeRecipient           string `json:"fee_recipient"`
-	GasLimit               string `json:"gas_limit"`
-	BuilderIndex           string `json:"builder_index"`
-	Slot                   string `json:"slot"`
-	Value                  string `json:"value"`
-	ExecutionPayment       string `json:"execution_payment"`
-	BlobKzgCommitmentsRoot string `json:"blob_kzg_commitments_root"`
+	ParentBlockHash    string   `json:"parent_block_hash"`
+	ParentBlockRoot    string   `json:"parent_block_root"`
+	BlockHash          string   `json:"block_hash"`
+	PrevRandao         string   `json:"prev_randao"`
+	FeeRecipient       string   `json:"fee_recipient"`
+	GasLimit           string   `json:"gas_limit"`
+	BuilderIndex       string   `json:"builder_index"`
+	Slot               string   `json:"slot"`
+	Value              string   `json:"value"`
+	ExecutionPayment   string   `json:"execution_payment"`
+	BlobKzgCommitments []string `json:"blob_kzg_commitments"`
 }
 
 type SignedExecutionPayloadBid struct {

api/server/structs/conversions_block.go

@@ -2939,18 +2939,22 @@ func SignedExecutionPayloadBidFromConsensus(b *eth.SignedExecutionPayloadBid) *S
 }
 
 func ExecutionPayloadBidFromConsensus(b *eth.ExecutionPayloadBid) *ExecutionPayloadBid {
+	blobKzgCommitments := make([]string, len(b.BlobKzgCommitments))
+	for i := range b.BlobKzgCommitments {
+		blobKzgCommitments[i] = hexutil.Encode(b.BlobKzgCommitments[i])
+	}
 	return &ExecutionPayloadBid{
-		ParentBlockHash:        hexutil.Encode(b.ParentBlockHash),
-		ParentBlockRoot:        hexutil.Encode(b.ParentBlockRoot),
-		BlockHash:              hexutil.Encode(b.BlockHash),
-		PrevRandao:             hexutil.Encode(b.PrevRandao),
-		FeeRecipient:           hexutil.Encode(b.FeeRecipient),
-		GasLimit:               fmt.Sprintf("%d", b.GasLimit),
-		BuilderIndex:           fmt.Sprintf("%d", b.BuilderIndex),
-		Slot:                   fmt.Sprintf("%d", b.Slot),
-		Value:                  fmt.Sprintf("%d", b.Value),
-		ExecutionPayment:       fmt.Sprintf("%d", b.ExecutionPayment),
-		BlobKzgCommitmentsRoot: hexutil.Encode(b.BlobKzgCommitmentsRoot),
+		ParentBlockHash:    hexutil.Encode(b.ParentBlockHash),
+		ParentBlockRoot:    hexutil.Encode(b.ParentBlockRoot),
+		BlockHash:          hexutil.Encode(b.BlockHash),
+		PrevRandao:         hexutil.Encode(b.PrevRandao),
+		FeeRecipient:       hexutil.Encode(b.FeeRecipient),
+		GasLimit:           fmt.Sprintf("%d", b.GasLimit),
+		BuilderIndex:       fmt.Sprintf("%d", b.BuilderIndex),
+		Slot:               fmt.Sprintf("%d", b.Slot),
+		Value:              fmt.Sprintf("%d", b.Value),
+		ExecutionPayment:   fmt.Sprintf("%d", b.ExecutionPayment),
+		BlobKzgCommitments: blobKzgCommitments,
 	}
 }
 
@@ -3187,22 +3191,30 @@ func (b *ExecutionPayloadBid) ToConsensus() (*eth.ExecutionPayloadBid, error) {
 	if err != nil {
 		return nil, server.NewDecodeError(err, "ExecutionPayment")
 	}
-	blobKzgCommitmentsRoot, err := bytesutil.DecodeHexWithLength(b.BlobKzgCommitmentsRoot, fieldparams.RootLength)
+	err = slice.VerifyMaxLength(b.BlobKzgCommitments, fieldparams.MaxBlobCommitmentsPerBlock)
 	if err != nil {
-		return nil, server.NewDecodeError(err, "BlobKzgCommitmentsRoot")
+		return nil, server.NewDecodeError(err, "BlobKzgCommitments")
+	}
+	blobKzgCommitments := make([][]byte, len(b.BlobKzgCommitments))
+	for i, commitment := range b.BlobKzgCommitments {
+		kzg, err := bytesutil.DecodeHexWithLength(commitment, fieldparams.BLSPubkeyLength)
+		if err != nil {
+			return nil, server.NewDecodeError(err, fmt.Sprintf("BlobKzgCommitments[%d]", i))
+		}
+		blobKzgCommitments[i] = kzg
 	}
 	return &eth.ExecutionPayloadBid{
-		ParentBlockHash:        parentBlockHash,
-		ParentBlockRoot:        parentBlockRoot,
-		BlockHash:              blockHash,
-		PrevRandao:             prevRandao,
-		FeeRecipient:           feeRecipient,
-		GasLimit:               gasLimit,
-		BuilderIndex:           primitives.BuilderIndex(builderIndex),
-		Slot:                   primitives.Slot(slot),
-		Value:                  primitives.Gwei(value),
-		ExecutionPayment:       primitives.Gwei(executionPayment),
-		BlobKzgCommitmentsRoot: blobKzgCommitmentsRoot,
+		ParentBlockHash:    parentBlockHash,
+		ParentBlockRoot:    parentBlockRoot,
+		BlockHash:          blockHash,
+		PrevRandao:         prevRandao,
+		FeeRecipient:       feeRecipient,
+		GasLimit:           gasLimit,
+		BuilderIndex:       primitives.BuilderIndex(builderIndex),
+		Slot:               primitives.Slot(slot),
+		Value:              primitives.Gwei(value),
+		ExecutionPayment:   primitives.Gwei(executionPayment),
+		BlobKzgCommitments: blobKzgCommitments,
 	}, nil
 }
 

beacon-chain/blockchain/BUILD.bazel

@@ -27,6 +27,8 @@ go_library(
         "receive_blob.go",
         "receive_block.go",
         "receive_data_column.go",
+        "receive_execution_payload_envelope.go",
+        "receive_payload_attestation_message.go",
         "service.go",
         "setup_forkchoice.go",
         "tracked_proposer.go",
@@ -85,6 +87,7 @@ go_library(
         "//consensus-types/primitives:go_default_library",
         "//crypto/bls:go_default_library",
         "//encoding/bytesutil:go_default_library",
+        "//io/logs:go_default_library",
         "//math:go_default_library",
         "//monitoring/tracing:go_default_library",
         "//monitoring/tracing/trace:go_default_library",

beacon-chain/blockchain/log_helpers.go

@@ -10,6 +10,7 @@ import (
 	consensus_types "github.com/OffchainLabs/prysm/v7/consensus-types"
 	"github.com/OffchainLabs/prysm/v7/consensus-types/interfaces"
 	"github.com/OffchainLabs/prysm/v7/encoding/bytesutil"
+	"github.com/OffchainLabs/prysm/v7/io/logs"
 	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
 	"github.com/OffchainLabs/prysm/v7/runtime/version"
 	prysmTime "github.com/OffchainLabs/prysm/v7/time"
@@ -87,36 +88,45 @@ func logStateTransitionData(b interfaces.ReadOnlyBeaconBlock) error {
 func logBlockSyncStatus(block interfaces.ReadOnlyBeaconBlock, blockRoot [32]byte, justified, finalized *ethpb.Checkpoint, receivedTime time.Time, genesis time.Time, daWaitedTime time.Duration) error {
 	startTime, err := slots.StartTime(genesis, block.Slot())
 	if err != nil {
-		return err
+		return errors.Wrap(err, "failed to get slot start time")
 	}
-	level := log.Logger.GetLevel()
+	parentRoot := block.ParentRoot()
+	blkRoot := fmt.Sprintf("0x%s...", hex.EncodeToString(blockRoot[:])[:8])
+	finalizedRoot := fmt.Sprintf("0x%s...", hex.EncodeToString(finalized.Root)[:8])
+	sinceSlotStartTime := prysmTime.Now().Sub(startTime)
+
+	lessFields := logrus.Fields{
+		"slot":               block.Slot(),
+		"block":              blkRoot,
+		"finalizedEpoch":     finalized.Epoch,
+		"finalizedRoot":      finalizedRoot,
+		"epoch":              slots.ToEpoch(block.Slot()),
+		"sinceSlotStartTime": sinceSlotStartTime,
+	}
+	moreFields := logrus.Fields{
+		"slot":                       block.Slot(),
+		"slotInEpoch":                block.Slot() % params.BeaconConfig().SlotsPerEpoch,
+		"block":                      blkRoot,
+		"epoch":                      slots.ToEpoch(block.Slot()),
+		"justifiedEpoch":             justified.Epoch,
+		"justifiedRoot":              fmt.Sprintf("0x%s...", hex.EncodeToString(justified.Root)[:8]),
+		"finalizedEpoch":             finalized.Epoch,
+		"finalizedRoot":              finalizedRoot,
+		"parentRoot":                 fmt.Sprintf("0x%s...", hex.EncodeToString(parentRoot[:])[:8]),
+		"version":                    version.String(block.Version()),
+		"sinceSlotStartTime":         sinceSlotStartTime,
+		"chainServiceProcessedTime":  prysmTime.Now().Sub(receivedTime) - daWaitedTime,
+		"dataAvailabilityWaitedTime": daWaitedTime,
+	}
+
+	level := logs.PackageVerbosity("beacon-chain/blockchain")
 	if level >= logrus.DebugLevel {
-		parentRoot := block.ParentRoot()
-		lf := logrus.Fields{
-			"slot":                       block.Slot(),
-			"slotInEpoch":                block.Slot() % params.BeaconConfig().SlotsPerEpoch,
-			"block":                      fmt.Sprintf("0x%s...", hex.EncodeToString(blockRoot[:])[:8]),
-			"epoch":                      slots.ToEpoch(block.Slot()),
-			"justifiedEpoch":             justified.Epoch,
-			"justifiedRoot":              fmt.Sprintf("0x%s...", hex.EncodeToString(justified.Root)[:8]),
-			"finalizedEpoch":             finalized.Epoch,
-			"finalizedRoot":              fmt.Sprintf("0x%s...", hex.EncodeToString(finalized.Root)[:8]),
-			"parentRoot":                 fmt.Sprintf("0x%s...", hex.EncodeToString(parentRoot[:])[:8]),
-			"version":                    version.String(block.Version()),
-			"sinceSlotStartTime":         prysmTime.Now().Sub(startTime),
-			"chainServiceProcessedTime":  prysmTime.Now().Sub(receivedTime) - daWaitedTime,
-			"dataAvailabilityWaitedTime": daWaitedTime,
-		}
-		log.WithFields(lf).Debug("Synced new block")
-	} else {
-		log.WithFields(logrus.Fields{
-			"slot":           block.Slot(),
-			"block":          fmt.Sprintf("0x%s...", hex.EncodeToString(blockRoot[:])[:8]),
-			"finalizedEpoch": finalized.Epoch,
-			"finalizedRoot":  fmt.Sprintf("0x%s...", hex.EncodeToString(finalized.Root)[:8]),
-			"epoch":          slots.ToEpoch(block.Slot()),
-		}).Info("Synced new block")
+		log.WithFields(moreFields).Info("Synced new block")
+		return nil
 	}
+
+	log.WithFields(lessFields).WithField(logs.LogTargetField, logs.LogTargetUser).Info("Synced new block")
+	log.WithFields(moreFields).WithField(logs.LogTargetField, logs.LogTargetEphemeral).Info("Synced new block")
 	return nil
 }
 

beacon-chain/blockchain/receive_execution_payload_envelope.go

@@ -0,0 +1,19 @@
+package blockchain
+
+import (
+	"context"
+
+	"github.com/OffchainLabs/prysm/v7/consensus-types/interfaces"
+)
+
+// ExecutionPayloadEnvelopeReceiver interface defines the methods of chain service for receiving
+// validated execution payload envelopes.
+type ExecutionPayloadEnvelopeReceiver interface {
+	ReceiveExecutionPayloadEnvelope(context.Context, interfaces.ROSignedExecutionPayloadEnvelope) error
+}
+
+// ReceiveExecutionPayloadEnvelope accepts a signed execution payload envelope.
+func (s *Service) ReceiveExecutionPayloadEnvelope(_ context.Context, _ interfaces.ROSignedExecutionPayloadEnvelope) error {
+	// TODO: wire into execution payload envelope processing pipeline.
+	return nil
+}

beacon-chain/blockchain/receive_payload_attestation_message.go

@@ -0,0 +1,19 @@
+package blockchain
+
+import (
+	"context"
+
+	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
+)
+
+// PayloadAttestationReceiver interface defines the methods of chain service for receiving
+// validated payload attestation messages.
+type PayloadAttestationReceiver interface {
+	ReceivePayloadAttestationMessage(context.Context, *ethpb.PayloadAttestationMessage) error
+}
+
+// ReceivePayloadAttestationMessage accepts a payload attestation message.
+func (s *Service) ReceivePayloadAttestationMessage(ctx context.Context, a *ethpb.PayloadAttestationMessage) error {
+	// TODO: Handle payload attestation message processing once Gloas is fully wired.
+	return nil
+}

beacon-chain/blockchain/testing/mock.go

@@ -757,6 +757,16 @@ func (c *ChainService) ReceiveDataColumns(dcs []blocks.VerifiedRODataColumn) err
 	return nil
 }
 
+// ReceivePayloadAttestationMessage implements the same method in the chain service.
+func (c *ChainService) ReceivePayloadAttestationMessage(_ context.Context, _ *ethpb.PayloadAttestationMessage) error {
+	return nil
+}
+
+// ReceiveExecutionPayloadEnvelope implements the same method in the chain service.
+func (c *ChainService) ReceiveExecutionPayloadEnvelope(_ context.Context, _ interfaces.ROSignedExecutionPayloadEnvelope) error {
+	return nil
+}
+
 // DependentRootForEpoch mocks the same method in the chain service
 func (c *ChainService) DependentRootForEpoch(_ [32]byte, _ primitives.Epoch) ([32]byte, error) {
 	return c.TargetRoot, nil

beacon-chain/cache/BUILD.bazel

@@ -17,6 +17,7 @@ go_library(
         "error.go",
         "interfaces.go",
         "log.go",
+        "payload_attestation.go",
         "payload_id.go",
         "proposer_indices.go",
         "proposer_indices_disabled.go",  # keep
@@ -76,6 +77,7 @@ go_test(
         "checkpoint_state_test.go",
         "committee_fuzz_test.go",
         "committee_test.go",
+        "payload_attestation_test.go",
         "payload_id_test.go",
         "private_access_test.go",
         "proposer_indices_test.go",

beacon-chain/cache/payload_attestation.go

@@ -0,0 +1,53 @@
+package cache
+
+import (
+	"sync"
+
+	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+)
+
+// PayloadAttestationCache tracks seen payload attestation messages for a single slot.
+type PayloadAttestationCache struct {
+	slot primitives.Slot
+	seen map[primitives.ValidatorIndex]struct{}
+	mu   sync.RWMutex
+}
+
+// Seen returns true if a vote for the given slot has already been
+// processed for this validator index.
+func (p *PayloadAttestationCache) Seen(slot primitives.Slot, idx primitives.ValidatorIndex) bool {
+	p.mu.RLock()
+	defer p.mu.RUnlock()
+	if p.slot != slot {
+		return false
+	}
+	if p.seen == nil {
+		return false
+	}
+	_, ok := p.seen[idx]
+	return ok
+}
+
+// Add marks the given slot and validator index as seen.
+// This function assumes that the message has already been validated.
+func (p *PayloadAttestationCache) Add(slot primitives.Slot, idx primitives.ValidatorIndex) error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.slot != slot {
+		p.slot = slot
+		p.seen = make(map[primitives.ValidatorIndex]struct{})
+	}
+	if p.seen == nil {
+		p.seen = make(map[primitives.ValidatorIndex]struct{})
+	}
+	p.seen[idx] = struct{}{}
+	return nil
+}
+
+// Clear clears the internal cache.
+func (p *PayloadAttestationCache) Clear() {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.slot = 0
+	p.seen = nil
+}

beacon-chain/cache/payload_attestation_test.go

@@ -0,0 +1,48 @@
+package cache_test
+
+import (
+	"testing"
+
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/cache"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPayloadAttestationCache_SeenAndAdd(t *testing.T) {
+	var c cache.PayloadAttestationCache
+	slot1 := primitives.Slot(1)
+	slot2 := primitives.Slot(2)
+	idx1 := primitives.ValidatorIndex(3)
+	idx2 := primitives.ValidatorIndex(4)
+
+	require.False(t, c.Seen(slot1, idx1))
+
+	require.NoError(t, c.Add(slot1, idx1))
+	require.True(t, c.Seen(slot1, idx1))
+	require.False(t, c.Seen(slot1, idx2))
+	require.False(t, c.Seen(slot2, idx1))
+
+	require.NoError(t, c.Add(slot1, idx2))
+	require.True(t, c.Seen(slot1, idx1))
+	require.True(t, c.Seen(slot1, idx2))
+
+	require.NoError(t, c.Add(slot2, idx1))
+	require.True(t, c.Seen(slot2, idx1))
+	require.False(t, c.Seen(slot1, idx1))
+	require.False(t, c.Seen(slot1, idx2))
+}
+
+func TestPayloadAttestationCache_Clear(t *testing.T) {
+	var c cache.PayloadAttestationCache
+	slot := primitives.Slot(10)
+	idx := primitives.ValidatorIndex(42)
+
+	require.NoError(t, c.Add(slot, idx))
+	require.True(t, c.Seen(slot, idx))
+
+	c.Clear()
+	require.False(t, c.Seen(slot, idx))
+
+	require.NoError(t, c.Add(slot, idx))
+	require.True(t, c.Seen(slot, idx))
+}

beacon-chain/core/altair/BUILD.bazel

@@ -20,6 +20,7 @@ go_library(
         "//beacon-chain/core/blocks:go_default_library",
         "//beacon-chain/core/epoch:go_default_library",
         "//beacon-chain/core/epoch/precompute:go_default_library",
+        "//beacon-chain/core/gloas:go_default_library",
         "//beacon-chain/core/helpers:go_default_library",
         "//beacon-chain/core/signing:go_default_library",
         "//beacon-chain/core/time:go_default_library",

beacon-chain/core/altair/attestation.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 
 	"github.com/OffchainLabs/prysm/v7/beacon-chain/core/blocks"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/core/gloas"
 	"github.com/OffchainLabs/prysm/v7/beacon-chain/core/helpers"
 	"github.com/OffchainLabs/prysm/v7/beacon-chain/core/time"
 	"github.com/OffchainLabs/prysm/v7/beacon-chain/state"
@@ -75,7 +76,11 @@ func ProcessAttestationNoVerifySignature(
 		return nil, err
 	}
 
-	return SetParticipationAndRewardProposer(ctx, beaconState, att.GetData().Target.Epoch, indices, participatedFlags, totalBalance)
+	if err := beaconState.UpdatePendingPaymentWeight(att, indices, participatedFlags); err != nil {
+		return nil, errors.Wrap(err, "failed to update pending payment weight")
+	}
+
+	return SetParticipationAndRewardProposer(ctx, beaconState, att.GetData().Target.Epoch, indices, participatedFlags, totalBalance, att)
 }
 
 // SetParticipationAndRewardProposer retrieves and sets the epoch participation bits in state. Based on the epoch participation, it rewards
@@ -105,7 +110,9 @@ func SetParticipationAndRewardProposer(
 	beaconState state.BeaconState,
 	targetEpoch primitives.Epoch,
 	indices []uint64,
-	participatedFlags map[uint8]bool, totalBalance uint64) (state.BeaconState, error) {
+	participatedFlags map[uint8]bool,
+	totalBalance uint64,
+	att ethpb.Att) (state.BeaconState, error) {
 	var proposerRewardNumerator uint64
 	currentEpoch := time.CurrentEpoch(beaconState)
 	var stateErr error
@@ -299,6 +306,19 @@ func AttestationParticipationFlagIndices(beaconState state.ReadOnlyBeaconState,
 		participatedFlags[targetFlagIndex] = true
 	}
 	matchedSrcTgtHead := matchedHead && matchedSrcTgt
+
+	var beaconBlockRoot [32]byte
+	copy(beaconBlockRoot[:], data.BeaconBlockRoot)
+	matchingPayload, err := gloas.MatchingPayload(
+		beaconState,
+		beaconBlockRoot,
+		data.Slot,
+		uint64(data.CommitteeIndex),
+	)
+	if err != nil {
+		return nil, err
+	}
+	matchedSrcTgtHead = matchedSrcTgtHead && matchingPayload
 	if matchedSrcTgtHead && delay == cfg.MinAttestationInclusionDelay {
 		participatedFlags[headFlagIndex] = true
 	}

beacon-chain/core/altair/attestation_test.go

@@ -1,7 +1,9 @@
 package altair_test
 
 import (
+	"bytes"
 	"fmt"
+	"reflect"
 	"testing"
 
 	"github.com/OffchainLabs/go-bitfield"
@@ -556,7 +558,7 @@ func TestSetParticipationAndRewardProposer(t *testing.T) {
 
 			b, err := helpers.TotalActiveBalance(beaconState)
 			require.NoError(t, err)
-			st, err := altair.SetParticipationAndRewardProposer(t.Context(), beaconState, test.epoch, test.indices, test.participatedFlags, b)
+			st, err := altair.SetParticipationAndRewardProposer(t.Context(), beaconState, test.epoch, test.indices, test.participatedFlags, b, &ethpb.Attestation{})
 			require.NoError(t, err)
 
 			i, err := helpers.BeaconProposerIndex(t.Context(), st)
@@ -775,11 +777,67 @@ func TestAttestationParticipationFlagIndices(t *testing.T) {
 				headFlagIndex:   true,
 			},
 		},
+		{
+			name: "gloas same-slot committee index non-zero errors",
+			inputState: func() state.BeaconState {
+				stateSlot := primitives.Slot(5)
+				slot := primitives.Slot(3)
+				targetRoot := bytes.Repeat([]byte{0xAA}, 32)
+				headRoot := bytes.Repeat([]byte{0xBB}, 32)
+				prevRoot := bytes.Repeat([]byte{0xCC}, 32)
+				return buildGloasStateForFlags(t, stateSlot, slot, targetRoot, headRoot, prevRoot, 0, 0)
+			}(),
+			inputData: &ethpb.AttestationData{
+				Slot:            3,
+				CommitteeIndex:  1, // invalid for same-slot
+				BeaconBlockRoot: bytes.Repeat([]byte{0xBB}, 32),
+				Source:          &ethpb.Checkpoint{Root: bytes.Repeat([]byte{0xDD}, 32)},
+				Target: &ethpb.Checkpoint{
+					Epoch: 0,
+					Root:  bytes.Repeat([]byte{0xAA}, 32),
+				},
+			},
+			inputDelay:           1,
+			participationIndices: nil,
+		},
+		{
+			name: "gloas payload availability matches committee index",
+			inputState: func() state.BeaconState {
+				stateSlot := primitives.Slot(5)
+				slot := primitives.Slot(3)
+				targetRoot := bytes.Repeat([]byte{0xAA}, 32)
+				headRoot := bytes.Repeat([]byte{0xBB}, 32)
+				// Same prev root to make SameSlotAttestation false and use payload availability.
+				return buildGloasStateForFlags(t, stateSlot, slot, targetRoot, headRoot, headRoot, 1, slot)
+			}(),
+			inputData: &ethpb.AttestationData{
+				Slot:            3,
+				CommitteeIndex:  1,
+				BeaconBlockRoot: bytes.Repeat([]byte{0xBB}, 32),
+				Source:          &ethpb.Checkpoint{Root: bytes.Repeat([]byte{0xDD}, 32)},
+				Target: &ethpb.Checkpoint{
+					Epoch: 0,
+					Root:  bytes.Repeat([]byte{0xAA}, 32),
+				},
+			},
+			inputDelay: 1,
+			participationIndices: map[uint8]bool{
+				sourceFlagIndex: true,
+				targetFlagIndex: true,
+				headFlagIndex:   true,
+			},
+		},
 	}
 	for _, test := range tests {
 		flagIndices, err := altair.AttestationParticipationFlagIndices(test.inputState, test.inputData, test.inputDelay)
+		if test.participationIndices == nil {
+			require.ErrorContains(t, "committee index", err)
+			continue
+		}
 		require.NoError(t, err)
-		require.DeepEqual(t, test.participationIndices, flagIndices)
+		if !reflect.DeepEqual(test.participationIndices, flagIndices) {
+			t.Fatalf("unexpected participation indices: got %v want %v", flagIndices, test.participationIndices)
+		}
 	}
 }
 
@@ -858,3 +916,61 @@ func TestMatchingStatus(t *testing.T) {
 		require.Equal(t, test.matchedHead, head)
 	}
 }
+
+func buildGloasStateForFlags(t *testing.T, stateSlot, slot primitives.Slot, targetRoot, headRoot, prevRoot []byte, availabilityBit uint8, availabilitySlot primitives.Slot) state.BeaconState {
+	t.Helper()
+
+	cfg := params.BeaconConfig()
+	blockRoots := make([][]byte, cfg.SlotsPerHistoricalRoot)
+	blockRoots[0] = targetRoot
+	blockRoots[slot%cfg.SlotsPerHistoricalRoot] = headRoot
+	blockRoots[(slot-1)%cfg.SlotsPerHistoricalRoot] = prevRoot
+
+	stateRoots := make([][]byte, cfg.SlotsPerHistoricalRoot)
+	for i := range stateRoots {
+		stateRoots[i] = make([]byte, fieldparams.RootLength)
+	}
+	randaoMixes := make([][]byte, cfg.EpochsPerHistoricalVector)
+	for i := range randaoMixes {
+		randaoMixes[i] = make([]byte, fieldparams.RootLength)
+	}
+
+	execPayloadAvailability := make([]byte, cfg.SlotsPerHistoricalRoot/8)
+	idx := availabilitySlot % cfg.SlotsPerHistoricalRoot
+	byteIndex := idx / 8
+	bitIndex := idx % 8
+	if availabilityBit == 1 {
+		execPayloadAvailability[byteIndex] |= 1 << bitIndex
+	}
+
+	checkpointRoot := bytes.Repeat([]byte{0xDD}, fieldparams.RootLength)
+	justified := &ethpb.Checkpoint{Root: checkpointRoot}
+
+	stProto := &ethpb.BeaconStateGloas{
+		Slot:                         stateSlot,
+		GenesisValidatorsRoot:        bytes.Repeat([]byte{0x11}, fieldparams.RootLength),
+		BlockRoots:                   blockRoots,
+		StateRoots:                   stateRoots,
+		RandaoMixes:                  randaoMixes,
+		ExecutionPayloadAvailability: execPayloadAvailability,
+		CurrentJustifiedCheckpoint:   justified,
+		PreviousJustifiedCheckpoint:  justified,
+		Validators: []*ethpb.Validator{
+			{
+				EffectiveBalance:      cfg.MinActivationBalance,
+				WithdrawalCredentials: append([]byte{cfg.ETH1AddressWithdrawalPrefixByte}, bytes.Repeat([]byte{0x01}, 31)...),
+			},
+		},
+		Balances:               []uint64{cfg.MinActivationBalance},
+		BuilderPendingPayments: make([]*ethpb.BuilderPendingPayment, cfg.SlotsPerEpoch*2),
+		Fork: &ethpb.Fork{
+			CurrentVersion:  bytes.Repeat([]byte{0x01}, 4),
+			PreviousVersion: bytes.Repeat([]byte{0x01}, 4),
+			Epoch:           0,
+		},
+	}
+
+	beaconState, err := state_native.InitializeFromProtoGloas(stProto)
+	require.NoError(t, err)
+	return beaconState
+}

beacon-chain/core/blocks/attestation.go

@@ -111,10 +111,21 @@ func VerifyAttestationNoVerifySignature(
 	var indexedAtt ethpb.IndexedAtt
 
 	if att.Version() >= version.Electra {
-		if att.GetData().CommitteeIndex != 0 {
-			return errors.New("committee index must be 0 post-Electra")
+		ci := att.GetData().CommitteeIndex
+		// Spec v1.7.0-alpha pseudocode:
+		//
+		//	# [Modified in Gloas:EIP7732]
+		//	assert data.index < 2
+		//
+		if beaconState.Version() >= version.Gloas {
+			if ci >= 2 {
+				return fmt.Errorf("incorrect committee index %d", ci)
+			}
+		} else {
+			if ci != 0 {
+				return errors.New("committee index must be 0 between Electra and Gloas forks")
+			}
 		}
-
 		aggBits := att.GetAggregationBits()
 		committeeIndices := att.CommitteeBitsVal().BitIndices()
 		committees := make([][]primitives.ValidatorIndex, len(committeeIndices))

beacon-chain/core/blocks/attestation_test.go

@@ -1,6 +1,7 @@
 package blocks_test
 
 import (
+	"bytes"
 	"context"
 	"testing"
 
@@ -262,7 +263,7 @@ func TestVerifyAttestationNoVerifySignature_Electra(t *testing.T) {
 			CommitteeBits:   bitfield.NewBitvector64(),
 		}
 		err = blocks.VerifyAttestationNoVerifySignature(context.TODO(), beaconState, att)
-		assert.ErrorContains(t, "committee index must be 0 post-Electra", err)
+		assert.ErrorContains(t, "committee index must be 0", err)
 	})
 	t.Run("index of committee too big", func(t *testing.T) {
 		aggBits := bitfield.NewBitlist(3)
@@ -314,6 +315,75 @@ func TestVerifyAttestationNoVerifySignature_Electra(t *testing.T) {
 	})
 }
 
+func TestVerifyAttestationNoVerifySignature_GloasCommitteeIndexLimit(t *testing.T) {
+	cfg := params.BeaconConfig()
+	stateSlot := cfg.MinAttestationInclusionDelay + 1
+
+	blockRoots := make([][]byte, cfg.SlotsPerHistoricalRoot)
+	for i := range blockRoots {
+		blockRoots[i] = make([]byte, fieldparams.RootLength)
+	}
+	stateRoots := make([][]byte, cfg.SlotsPerHistoricalRoot)
+	for i := range stateRoots {
+		stateRoots[i] = make([]byte, fieldparams.RootLength)
+	}
+	randaoMixes := make([][]byte, cfg.EpochsPerHistoricalVector)
+	for i := range randaoMixes {
+		randaoMixes[i] = make([]byte, fieldparams.RootLength)
+	}
+
+	checkpointRoot := bytes.Repeat([]byte{0xAA}, fieldparams.RootLength)
+	justified := &ethpb.Checkpoint{Epoch: 0, Root: checkpointRoot}
+
+	gloasStateProto := &ethpb.BeaconStateGloas{
+		Slot:                         stateSlot,
+		GenesisValidatorsRoot:        bytes.Repeat([]byte{0x11}, fieldparams.RootLength),
+		BlockRoots:                   blockRoots,
+		StateRoots:                   stateRoots,
+		RandaoMixes:                  randaoMixes,
+		ExecutionPayloadAvailability: make([]byte, cfg.SlotsPerHistoricalRoot/8),
+		CurrentJustifiedCheckpoint:   justified,
+		PreviousJustifiedCheckpoint:  justified,
+		Validators: []*ethpb.Validator{
+			{
+				EffectiveBalance:      cfg.MinActivationBalance,
+				WithdrawalCredentials: append([]byte{cfg.ETH1AddressWithdrawalPrefixByte}, bytes.Repeat([]byte{0x01}, 31)...),
+			},
+		},
+		Balances:               []uint64{cfg.MinActivationBalance},
+		BuilderPendingPayments: make([]*ethpb.BuilderPendingPayment, cfg.SlotsPerEpoch*2),
+		Fork: &ethpb.Fork{
+			CurrentVersion:  bytes.Repeat([]byte{0x01}, 4),
+			PreviousVersion: bytes.Repeat([]byte{0x01}, 4),
+			Epoch:           0,
+		},
+	}
+
+	beaconState, err := state_native.InitializeFromProtoGloas(gloasStateProto)
+	require.NoError(t, err)
+
+	committeeBits := bitfield.NewBitvector64()
+	committeeBits.SetBitAt(0, true)
+	aggBits := bitfield.NewBitlist(1)
+	aggBits.SetBitAt(0, true)
+
+	att := &ethpb.AttestationElectra{
+		Data: &ethpb.AttestationData{
+			Slot:            0,
+			CommitteeIndex:  2, // invalid for Gloas (must be <2)
+			BeaconBlockRoot: blockRoots[0],
+			Source:          justified,
+			Target:          justified,
+		},
+		AggregationBits: aggBits,
+		CommitteeBits:   committeeBits,
+		Signature:       bytes.Repeat([]byte{0x00}, fieldparams.BLSSignatureLength),
+	}
+
+	err = blocks.VerifyAttestationNoVerifySignature(context.TODO(), beaconState, att)
+	assert.ErrorContains(t, "incorrect committee index 2", err)
+}
+
 func TestConvertToIndexed_OK(t *testing.T) {
 	helpers.ClearCache()
 	validators := make([]*ethpb.Validator, 2*params.BeaconConfig().SlotsPerEpoch)
@@ -583,6 +653,7 @@ func TestVerifyAttestations_HandlesPlannedFork(t *testing.T) {
 }
 
 func TestRetrieveAttestationSignatureSet_VerifiesMultipleAttestations(t *testing.T) {
+	helpers.ClearCache()
 	ctx := t.Context()
 	numOfValidators := uint64(params.BeaconConfig().SlotsPerEpoch.Mul(4))
 	validators := make([]*ethpb.Validator, numOfValidators)

beacon-chain/core/gloas/BUILD.bazel

@@ -3,7 +3,11 @@ load("@prysm//tools/go:def.bzl", "go_library", "go_test")
 go_library(
     name = "go_default_library",
     srcs = [
+        "attestation.go",
         "bid.go",
+        "deposit_request.go",
+        "log.go",
+        "payload.go",
         "payload_attestation.go",
         "pending_payment.go",
         "proposer_slashing.go",
@@ -12,6 +16,7 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//beacon-chain/core/helpers:go_default_library",
+        "//beacon-chain/core/requests:go_default_library",
         "//beacon-chain/core/signing:go_default_library",
         "//beacon-chain/core/time:go_default_library",
         "//beacon-chain/state:go_default_library",
@@ -25,17 +30,23 @@ go_library(
         "//crypto/bls/common:go_default_library",
         "//crypto/hash:go_default_library",
         "//encoding/bytesutil:go_default_library",
+        "//proto/engine/v1:go_default_library",
         "//proto/prysm/v1alpha1:go_default_library",
+        "//runtime/version:go_default_library",
         "//time/slots:go_default_library",
         "@com_github_pkg_errors//:go_default_library",
+        "@com_github_sirupsen_logrus//:go_default_library",
     ],
 )
 
 go_test(
     name = "go_default_test",
     srcs = [
+        "attestation_test.go",
         "bid_test.go",
+        "deposit_request_test.go",
         "payload_attestation_test.go",
+        "payload_test.go",
         "pending_payment_test.go",
         "proposer_slashing_test.go",
     ],
@@ -45,6 +56,7 @@ go_test(
         "//beacon-chain/core/signing:go_default_library",
         "//beacon-chain/state:go_default_library",
         "//beacon-chain/state/state-native:go_default_library",
+        "//beacon-chain/state/testing:go_default_library",
         "//config/params:go_default_library",
         "//consensus-types/blocks:go_default_library",
         "//consensus-types/interfaces:go_default_library",

beacon-chain/core/gloas/attestation.go

@@ -0,0 +1,52 @@
+package gloas
+
+import (
+	"fmt"
+
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/state"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+	"github.com/OffchainLabs/prysm/v7/runtime/version"
+	"github.com/pkg/errors"
+)
+
+// MatchingPayload returns true if the attestation's committee index matches the expected payload index.
+//
+// For pre-Gloas forks, this always returns true.
+//
+// Spec v1.7.0-alpha (pseudocode):
+//
+//	# [New in Gloas:EIP7732]
+//	if is_attestation_same_slot(state, data):
+//	    assert data.index == 0
+//	    payload_matches = True
+//	else:
+//	    slot_index = data.slot % SLOTS_PER_HISTORICAL_ROOT
+//	    payload_index = state.execution_payload_availability[slot_index]
+//	    payload_matches = data.index == payload_index
+func MatchingPayload(
+	beaconState state.ReadOnlyBeaconState,
+	beaconBlockRoot [32]byte,
+	slot primitives.Slot,
+	committeeIndex uint64,
+) (bool, error) {
+	if beaconState.Version() < version.Gloas {
+		return true, nil
+	}
+
+	sameSlot, err := beaconState.IsAttestationSameSlot(beaconBlockRoot, slot)
+	if err != nil {
+		return false, errors.Wrap(err, "failed to get same slot attestation status")
+	}
+	if sameSlot {
+		if committeeIndex != 0 {
+			return false, fmt.Errorf("committee index %d for same slot attestation must be 0", committeeIndex)
+		}
+		return true, nil
+	}
+
+	executionPayloadAvail, err := beaconState.ExecutionPayloadAvailability(slot)
+	if err != nil {
+		return false, errors.Wrap(err, "failed to get execution payload availability status")
+	}
+	return executionPayloadAvail == committeeIndex, nil
+}

beacon-chain/core/gloas/attestation_test.go

@@ -0,0 +1,110 @@
+package gloas
+
+import (
+	"bytes"
+	"testing"
+
+	state_native "github.com/OffchainLabs/prysm/v7/beacon-chain/state/state-native"
+	"github.com/OffchainLabs/prysm/v7/config/params"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
+	"github.com/OffchainLabs/prysm/v7/runtime/version"
+	"github.com/OffchainLabs/prysm/v7/testing/require"
+)
+
+func buildStateWithBlockRoots(t *testing.T, stateSlot primitives.Slot, roots map[primitives.Slot][]byte) *state_native.BeaconState {
+	t.Helper()
+
+	cfg := params.BeaconConfig()
+	blockRoots := make([][]byte, cfg.SlotsPerHistoricalRoot)
+	for slot, root := range roots {
+		blockRoots[slot%cfg.SlotsPerHistoricalRoot] = root
+	}
+
+	stProto := &ethpb.BeaconStateGloas{
+		Slot:       stateSlot,
+		BlockRoots: blockRoots,
+	}
+
+	state, err := state_native.InitializeFromProtoGloas(stProto)
+	require.NoError(t, err)
+	return state.(*state_native.BeaconState)
+}
+
+func TestMatchingPayload(t *testing.T) {
+	t.Run("pre-gloas always true", func(t *testing.T) {
+		stIface, err := state_native.InitializeFromProtoElectra(&ethpb.BeaconStateElectra{})
+		require.NoError(t, err)
+
+		ok, err := MatchingPayload(stIface, [32]byte{}, 0, 123)
+		require.NoError(t, err)
+		require.Equal(t, true, ok)
+	})
+
+	t.Run("same slot requires committee index 0", func(t *testing.T) {
+		root := bytes.Repeat([]byte{0xAA}, 32)
+		state := buildStateWithBlockRoots(t, 6, map[primitives.Slot][]byte{
+			4: root,
+			3: bytes.Repeat([]byte{0xBB}, 32),
+		})
+
+		var rootArr [32]byte
+		copy(rootArr[:], root)
+
+		ok, err := MatchingPayload(state, rootArr, 4, 1)
+		require.ErrorContains(t, "committee index", err)
+		require.Equal(t, false, ok)
+	})
+
+	t.Run("same slot matches when committee index is 0", func(t *testing.T) {
+		root := bytes.Repeat([]byte{0xAA}, 32)
+		state := buildStateWithBlockRoots(t, 6, map[primitives.Slot][]byte{
+			4: root,
+			3: bytes.Repeat([]byte{0xBB}, 32),
+		})
+
+		var rootArr [32]byte
+		copy(rootArr[:], root)
+
+		ok, err := MatchingPayload(state, rootArr, 4, 0)
+		require.NoError(t, err)
+		require.Equal(t, true, ok)
+	})
+
+	t.Run("non same slot checks payload availability", func(t *testing.T) {
+		cfg := params.BeaconConfig()
+		root := bytes.Repeat([]byte{0xAA}, 32)
+		blockRoots := make([][]byte, cfg.SlotsPerHistoricalRoot)
+		blockRoots[4%cfg.SlotsPerHistoricalRoot] = bytes.Repeat([]byte{0xCC}, 32)
+		blockRoots[3%cfg.SlotsPerHistoricalRoot] = bytes.Repeat([]byte{0xBB}, 32)
+
+		availability := make([]byte, cfg.SlotsPerHistoricalRoot/8)
+		slotIndex := uint64(4)
+		availability[slotIndex/8] = byte(1 << (slotIndex % 8))
+
+		stIface, err := state_native.InitializeFromProtoGloas(&ethpb.BeaconStateGloas{
+			Slot:                         6,
+			BlockRoots:                   blockRoots,
+			ExecutionPayloadAvailability: availability,
+			Fork: &ethpb.Fork{
+				CurrentVersion:  bytes.Repeat([]byte{0x66}, 4),
+				PreviousVersion: bytes.Repeat([]byte{0x66}, 4),
+				Epoch:           0,
+			},
+		})
+		require.NoError(t, err)
+		state := stIface.(*state_native.BeaconState)
+		require.Equal(t, version.Gloas, state.Version())
+
+		var rootArr [32]byte
+		copy(rootArr[:], root)
+
+		ok, err := MatchingPayload(state, rootArr, 4, 1)
+		require.NoError(t, err)
+		require.Equal(t, true, ok)
+
+		ok, err = MatchingPayload(state, rootArr, 4, 0)
+		require.NoError(t, err)
+		require.Equal(t, false, ok)
+	})
+}

beacon-chain/core/gloas/bid.go

@@ -17,27 +17,56 @@ import (
 )
 
 // ProcessExecutionPayloadBid processes a signed execution payload bid in the Gloas fork.
-// Spec v1.7.0-alpha.0 (pseudocode):
-// process_execution_payload_bid(state: BeaconState, block: BeaconBlock):
 //
-//	signed_bid = block.body.signed_execution_payload_bid
-//	bid = signed_bid.message
-//	builder_index = bid.builder_index
-//	amount = bid.value
-//	if builder_index == BUILDER_INDEX_SELF_BUILD:
-//	  assert amount == 0
-//	  assert signed_bid.signature == G2_POINT_AT_INFINITY
-//	else:
-//	  assert is_active_builder(state, builder_index)
-//	  assert can_builder_cover_bid(state, builder_index, amount)
-//	  assert verify_execution_payload_bid_signature(state, signed_bid)
-//	assert bid.slot == block.slot
-//	assert bid.parent_block_hash == state.latest_block_hash
-//	assert bid.parent_block_root == block.parent_root
-//	assert bid.prev_randao == get_randao_mix(state, get_current_epoch(state))
-//	if amount > 0:
-//	  state.builder_pending_payments[...] = BuilderPendingPayment(weight=0, withdrawal=BuilderPendingWithdrawal(fee_recipient=bid.fee_recipient, amount=amount, builder_index=builder_index))
-//	state.latest_execution_payload_bid = bid
+//	<spec fn="process_execution_payload_bid" fork="gloas" hash="823c9f3a">
+//	def process_execution_payload_bid(state: BeaconState, block: BeaconBlock) -> None:
+//	    signed_bid = block.body.signed_execution_payload_bid
+//	    bid = signed_bid.message
+//	    builder_index = bid.builder_index
+//	    amount = bid.value
+//
+//	    # For self-builds, amount must be zero regardless of withdrawal credential prefix
+//	    if builder_index == BUILDER_INDEX_SELF_BUILD:
+//	        assert amount == 0
+//	        assert signed_bid.signature == bls.G2_POINT_AT_INFINITY
+//	    else:
+//	        # Verify that the builder is active
+//	        assert is_active_builder(state, builder_index)
+//	        # Verify that the builder has funds to cover the bid
+//	        assert can_builder_cover_bid(state, builder_index, amount)
+//	        # Verify that the bid signature is valid
+//	        assert verify_execution_payload_bid_signature(state, signed_bid)
+//
+//	    # Verify commitments are under limit
+//	    assert (
+//	        len(bid.blob_kzg_commitments)
+//	        <= get_blob_parameters(get_current_epoch(state)).max_blobs_per_block
+//	    )
+//
+//	    # Verify that the bid is for the current slot
+//	    assert bid.slot == block.slot
+//	    # Verify that the bid is for the right parent block
+//	    assert bid.parent_block_hash == state.latest_block_hash
+//	    assert bid.parent_block_root == block.parent_root
+//	    assert bid.prev_randao == get_randao_mix(state, get_current_epoch(state))
+//
+//	    # Record the pending payment if there is some payment
+//	    if amount > 0:
+//	        pending_payment = BuilderPendingPayment(
+//	            weight=0,
+//	            withdrawal=BuilderPendingWithdrawal(
+//	                fee_recipient=bid.fee_recipient,
+//	                amount=amount,
+//	                builder_index=builder_index,
+//	            ),
+//	        )
+//	        state.builder_pending_payments[SLOTS_PER_EPOCH + bid.slot % SLOTS_PER_EPOCH] = (
+//	            pending_payment
+//	        )
+//
+//	    # Cache the signed execution payload bid
+//	    state.latest_execution_payload_bid = bid
+//	</spec>
 func ProcessExecutionPayloadBid(st state.BeaconState, block interfaces.ReadOnlyBeaconBlock) error {
 	signedBid, err := block.Body().SignedExecutionPayloadBid()
 	if err != nil {
@@ -86,6 +115,12 @@ func ProcessExecutionPayloadBid(st state.BeaconState, block interfaces.ReadOnlyB
 		}
 	}
 
+	maxBlobsPerBlock := params.BeaconConfig().MaxBlobsPerBlockAtEpoch(slots.ToEpoch(block.Slot()))
+	commitmentCount := bid.BlobKzgCommitmentCount()
+	if commitmentCount > uint64(maxBlobsPerBlock) {
+		return fmt.Errorf("bid has %d blob KZG commitments over max %d", commitmentCount, maxBlobsPerBlock)
+	}
+
 	if err := validateBidConsistency(st, bid, block); err != nil {
 		return errors.Wrap(err, "bid consistency validation failed")
 	}

beacon-chain/core/gloas/bid_test.go

@@ -184,6 +184,28 @@ func signBid(t *testing.T, sk common.SecretKey, bid *ethpb.ExecutionPayloadBid,
 	return out
 }
 
+func blobCommitmentsForSlot(slot primitives.Slot, count int) [][]byte {
+	max := int(params.BeaconConfig().MaxBlobsPerBlockAtEpoch(slots.ToEpoch(slot)))
+	if count > max {
+		count = max
+	}
+	commitments := make([][]byte, count)
+	for i := range commitments {
+		commitments[i] = bytes.Repeat([]byte{0xEE}, 48)
+	}
+	return commitments
+}
+
+func tooManyBlobCommitmentsForSlot(slot primitives.Slot) [][]byte {
+	max := int(params.BeaconConfig().MaxBlobsPerBlockAtEpoch(slots.ToEpoch(slot)))
+	count := max + 1
+	commitments := make([][]byte, count)
+	for i := range commitments {
+		commitments[i] = bytes.Repeat([]byte{0xEE}, 48)
+	}
+	return commitments
+}
+
 func TestProcessExecutionPayloadBid_SelfBuildSuccess(t *testing.T) {
 	slot := primitives.Slot(12)
 	proposerIdx := primitives.ValidatorIndex(0)
@@ -194,17 +216,17 @@ func TestProcessExecutionPayloadBid_SelfBuildSuccess(t *testing.T) {
 	state := buildGloasState(t, slot, proposerIdx, builderIdx, params.BeaconConfig().MinActivationBalance+1000, randao, latestHash, pubKey)
 
 	bid := &ethpb.ExecutionPayloadBid{
-		ParentBlockHash:        latestHash[:],
-		ParentBlockRoot:        bytes.Repeat([]byte{0xCC}, 32),
-		BlockHash:              bytes.Repeat([]byte{0xDD}, 32),
-		PrevRandao:             randao[:],
-		GasLimit:               1,
-		BuilderIndex:           builderIdx,
-		Slot:                   slot,
-		Value:                  0,
-		ExecutionPayment:       0,
-		BlobKzgCommitmentsRoot: bytes.Repeat([]byte{0xEE}, 32),
-		FeeRecipient:           bytes.Repeat([]byte{0xFF}, 20),
+		ParentBlockHash:    latestHash[:],
+		ParentBlockRoot:    bytes.Repeat([]byte{0xCC}, 32),
+		BlockHash:          bytes.Repeat([]byte{0xDD}, 32),
+		PrevRandao:         randao[:],
+		GasLimit:           1,
+		BuilderIndex:       builderIdx,
+		Slot:               slot,
+		Value:              0,
+		ExecutionPayment:   0,
+		BlobKzgCommitments: blobCommitmentsForSlot(slot, 1),
+		FeeRecipient:       bytes.Repeat([]byte{0xFF}, 20),
 	}
 	signed := &ethpb.SignedExecutionPayloadBid{
 		Message:   bid,
@@ -236,16 +258,16 @@ func TestProcessExecutionPayloadBid_SelfBuildNonZeroAmountFails(t *testing.T) {
 	state := buildGloasState(t, slot, proposerIdx, builderIdx, params.BeaconConfig().MinActivationBalance+1000, randao, latestHash, [48]byte{})
 
 	bid := &ethpb.ExecutionPayloadBid{
-		ParentBlockHash:        latestHash[:],
-		ParentBlockRoot:        bytes.Repeat([]byte{0xAA}, 32),
-		BlockHash:              bytes.Repeat([]byte{0xBB}, 32),
-		PrevRandao:             randao[:],
-		BuilderIndex:           builderIdx,
-		Slot:                   slot,
-		Value:                  10,
-		ExecutionPayment:       0,
-		BlobKzgCommitmentsRoot: bytes.Repeat([]byte{0xCC}, 32),
-		FeeRecipient:           bytes.Repeat([]byte{0xDD}, 20),
+		ParentBlockHash:    latestHash[:],
+		ParentBlockRoot:    bytes.Repeat([]byte{0xAA}, 32),
+		BlockHash:          bytes.Repeat([]byte{0xBB}, 32),
+		PrevRandao:         randao[:],
+		BuilderIndex:       builderIdx,
+		Slot:               slot,
+		Value:              10,
+		ExecutionPayment:   0,
+		BlobKzgCommitments: blobCommitmentsForSlot(slot, 1),
+		FeeRecipient:       bytes.Repeat([]byte{0xDD}, 20),
 	}
 	signed := &ethpb.SignedExecutionPayloadBid{
 		Message:   bid,
@@ -280,17 +302,17 @@ func TestProcessExecutionPayloadBid_PendingPaymentAndCacheBid(t *testing.T) {
 	state := buildGloasState(t, slot, proposerIdx, builderIdx, balance, randao, latestHash, pubKey)
 
 	bid := &ethpb.ExecutionPayloadBid{
-		ParentBlockHash:        latestHash[:],
-		ParentBlockRoot:        bytes.Repeat([]byte{0xCC}, 32),
-		BlockHash:              bytes.Repeat([]byte{0xDD}, 32),
-		PrevRandao:             randao[:],
-		GasLimit:               1,
-		BuilderIndex:           builderIdx,
-		Slot:                   slot,
-		Value:                  500_000,
-		ExecutionPayment:       1,
-		BlobKzgCommitmentsRoot: bytes.Repeat([]byte{0xEE}, 32),
-		FeeRecipient:           bytes.Repeat([]byte{0xFF}, 20),
+		ParentBlockHash:    latestHash[:],
+		ParentBlockRoot:    bytes.Repeat([]byte{0xCC}, 32),
+		BlockHash:          bytes.Repeat([]byte{0xDD}, 32),
+		PrevRandao:         randao[:],
+		GasLimit:           1,
+		BuilderIndex:       builderIdx,
+		Slot:               slot,
+		Value:              500_000,
+		ExecutionPayment:   1,
+		BlobKzgCommitments: blobCommitmentsForSlot(slot, 1),
+		FeeRecipient:       bytes.Repeat([]byte{0xFF}, 20),
 	}
 
 	genesis := bytesutil.ToBytes32(state.GenesisValidatorsRoot())
@@ -341,17 +363,17 @@ func TestProcessExecutionPayloadBid_BuilderNotActive(t *testing.T) {
 	state = stateIface.(*state_native.BeaconState)
 
 	bid := &ethpb.ExecutionPayloadBid{
-		ParentBlockHash:        latestHash[:],
-		ParentBlockRoot:        bytes.Repeat([]byte{0x03}, 32),
-		BlockHash:              bytes.Repeat([]byte{0x04}, 32),
-		PrevRandao:             randao[:],
-		GasLimit:               1,
-		BuilderIndex:           builderIdx,
-		Slot:                   slot,
-		Value:                  10,
-		ExecutionPayment:       0,
-		BlobKzgCommitmentsRoot: bytes.Repeat([]byte{0x05}, 32),
-		FeeRecipient:           bytes.Repeat([]byte{0x06}, 20),
+		ParentBlockHash:    latestHash[:],
+		ParentBlockRoot:    bytes.Repeat([]byte{0x03}, 32),
+		BlockHash:          bytes.Repeat([]byte{0x04}, 32),
+		PrevRandao:         randao[:],
+		GasLimit:           1,
+		BuilderIndex:       builderIdx,
+		Slot:               slot,
+		Value:              10,
+		ExecutionPayment:   0,
+		BlobKzgCommitments: blobCommitmentsForSlot(slot, 1),
+		FeeRecipient:       bytes.Repeat([]byte{0x06}, 20),
 	}
 	genesis := bytesutil.ToBytes32(state.GenesisValidatorsRoot())
 	sig := signBid(t, sk, bid, state.Fork(), genesis)
@@ -394,17 +416,17 @@ func TestProcessExecutionPayloadBid_CannotCoverBid(t *testing.T) {
 	state = stateIface.(*state_native.BeaconState)
 
 	bid := &ethpb.ExecutionPayloadBid{
-		ParentBlockHash:        latestHash[:],
-		ParentBlockRoot:        bytes.Repeat([]byte{0xCC}, 32),
-		BlockHash:              bytes.Repeat([]byte{0xDD}, 32),
-		PrevRandao:             randao[:],
-		GasLimit:               1,
-		BuilderIndex:           builderIdx,
-		Slot:                   slot,
-		Value:                  25,
-		ExecutionPayment:       0,
-		BlobKzgCommitmentsRoot: bytes.Repeat([]byte{0xEE}, 32),
-		FeeRecipient:           bytes.Repeat([]byte{0xFF}, 20),
+		ParentBlockHash:    latestHash[:],
+		ParentBlockRoot:    bytes.Repeat([]byte{0xCC}, 32),
+		BlockHash:          bytes.Repeat([]byte{0xDD}, 32),
+		PrevRandao:         randao[:],
+		GasLimit:           1,
+		BuilderIndex:       builderIdx,
+		Slot:               slot,
+		Value:              25,
+		ExecutionPayment:   0,
+		BlobKzgCommitments: blobCommitmentsForSlot(slot, 1),
+		FeeRecipient:       bytes.Repeat([]byte{0xFF}, 20),
 	}
 	genesis := bytesutil.ToBytes32(state.GenesisValidatorsRoot())
 	sig := signBid(t, sk, bid, state.Fork(), genesis)
@@ -436,17 +458,17 @@ func TestProcessExecutionPayloadBid_InvalidSignature(t *testing.T) {
 	state := buildGloasState(t, slot, proposerIdx, builderIdx, params.BeaconConfig().MinDepositAmount+1000, randao, latestHash, pubKey)
 
 	bid := &ethpb.ExecutionPayloadBid{
-		ParentBlockHash:        latestHash[:],
-		ParentBlockRoot:        bytes.Repeat([]byte{0xCC}, 32),
-		BlockHash:              bytes.Repeat([]byte{0xDD}, 32),
-		PrevRandao:             randao[:],
-		GasLimit:               1,
-		BuilderIndex:           builderIdx,
-		Slot:                   slot,
-		Value:                  10,
-		ExecutionPayment:       0,
-		BlobKzgCommitmentsRoot: bytes.Repeat([]byte{0xEE}, 32),
-		FeeRecipient:           bytes.Repeat([]byte{0xFF}, 20),
+		ParentBlockHash:    latestHash[:],
+		ParentBlockRoot:    bytes.Repeat([]byte{0xCC}, 32),
+		BlockHash:          bytes.Repeat([]byte{0xDD}, 32),
+		PrevRandao:         randao[:],
+		GasLimit:           1,
+		BuilderIndex:       builderIdx,
+		Slot:               slot,
+		Value:              10,
+		ExecutionPayment:   0,
+		BlobKzgCommitments: blobCommitmentsForSlot(slot, 1),
+		FeeRecipient:       bytes.Repeat([]byte{0xFF}, 20),
 	}
 	// Use an invalid signature.
 	invalidSig := [96]byte{1}
@@ -463,6 +485,42 @@ func TestProcessExecutionPayloadBid_InvalidSignature(t *testing.T) {
 	require.ErrorContains(t, "bid signature validation failed", err)
 }
 
+func TestProcessExecutionPayloadBid_TooManyBlobCommitments(t *testing.T) {
+	slot := primitives.Slot(9)
+	proposerIdx := primitives.ValidatorIndex(0)
+	builderIdx := params.BeaconConfig().BuilderIndexSelfBuild
+	randao := [32]byte(bytes.Repeat([]byte{0xAA}, 32))
+	latestHash := [32]byte(bytes.Repeat([]byte{0xBB}, 32))
+	pubKey := [48]byte{}
+	state := buildGloasState(t, slot, proposerIdx, builderIdx, params.BeaconConfig().MinActivationBalance+1000, randao, latestHash, pubKey)
+
+	bid := &ethpb.ExecutionPayloadBid{
+		ParentBlockHash:    latestHash[:],
+		ParentBlockRoot:    bytes.Repeat([]byte{0xCC}, 32),
+		BlockHash:          bytes.Repeat([]byte{0xDD}, 32),
+		PrevRandao:         randao[:],
+		BuilderIndex:       builderIdx,
+		Slot:               slot,
+		BlobKzgCommitments: tooManyBlobCommitmentsForSlot(slot),
+		FeeRecipient:       bytes.Repeat([]byte{0xFF}, 20),
+	}
+	signed := &ethpb.SignedExecutionPayloadBid{
+		Message:   bid,
+		Signature: common.InfiniteSignature[:],
+	}
+
+	block := stubBlock{
+		slot:       slot,
+		proposer:   proposerIdx,
+		parentRoot: bytesutil.ToBytes32(bid.ParentBlockRoot),
+		body:       stubBlockBody{signedBid: signed},
+		v:          version.Gloas,
+	}
+
+	err := ProcessExecutionPayloadBid(state, block)
+	require.ErrorContains(t, "blob KZG commitments over max", err)
+}
+
 func TestProcessExecutionPayloadBid_SlotMismatch(t *testing.T) {
 	slot := primitives.Slot(10)
 	builderIdx := primitives.BuilderIndex(1)
@@ -478,17 +536,17 @@ func TestProcessExecutionPayloadBid_SlotMismatch(t *testing.T) {
 	state := buildGloasState(t, slot, proposerIdx, builderIdx, params.BeaconConfig().MinDepositAmount+1000, randao, latestHash, pubKey)
 
 	bid := &ethpb.ExecutionPayloadBid{
-		ParentBlockHash:        latestHash[:],
-		ParentBlockRoot:        bytes.Repeat([]byte{0xAA}, 32),
-		BlockHash:              bytes.Repeat([]byte{0xBB}, 32),
-		PrevRandao:             randao[:],
-		GasLimit:               1,
-		BuilderIndex:           builderIdx,
-		Slot:                   slot + 1, // mismatch
-		Value:                  1,
-		ExecutionPayment:       0,
-		BlobKzgCommitmentsRoot: bytes.Repeat([]byte{0xCC}, 32),
-		FeeRecipient:           bytes.Repeat([]byte{0xDD}, 20),
+		ParentBlockHash:    latestHash[:],
+		ParentBlockRoot:    bytes.Repeat([]byte{0xAA}, 32),
+		BlockHash:          bytes.Repeat([]byte{0xBB}, 32),
+		PrevRandao:         randao[:],
+		GasLimit:           1,
+		BuilderIndex:       builderIdx,
+		Slot:               slot + 1, // mismatch
+		Value:              1,
+		ExecutionPayment:   0,
+		BlobKzgCommitments: blobCommitmentsForSlot(slot, 1),
+		FeeRecipient:       bytes.Repeat([]byte{0xDD}, 20),
 	}
 	genesis := bytesutil.ToBytes32(state.GenesisValidatorsRoot())
 	sig := signBid(t, sk, bid, state.Fork(), genesis)
@@ -520,17 +578,17 @@ func TestProcessExecutionPayloadBid_ParentHashMismatch(t *testing.T) {
 	state := buildGloasState(t, slot, proposerIdx, builderIdx, params.BeaconConfig().MinDepositAmount+1000, randao, latestHash, pubKey)
 
 	bid := &ethpb.ExecutionPayloadBid{
-		ParentBlockHash:        bytes.Repeat([]byte{0x11}, 32), // mismatch
-		ParentBlockRoot:        bytes.Repeat([]byte{0x22}, 32),
-		BlockHash:              bytes.Repeat([]byte{0x33}, 32),
-		PrevRandao:             randao[:],
-		GasLimit:               1,
-		BuilderIndex:           builderIdx,
-		Slot:                   slot,
-		Value:                  1,
-		ExecutionPayment:       0,
-		BlobKzgCommitmentsRoot: bytes.Repeat([]byte{0x44}, 32),
-		FeeRecipient:           bytes.Repeat([]byte{0x55}, 20),
+		ParentBlockHash:    bytes.Repeat([]byte{0x11}, 32), // mismatch
+		ParentBlockRoot:    bytes.Repeat([]byte{0x22}, 32),
+		BlockHash:          bytes.Repeat([]byte{0x33}, 32),
+		PrevRandao:         randao[:],
+		GasLimit:           1,
+		BuilderIndex:       builderIdx,
+		Slot:               slot,
+		Value:              1,
+		ExecutionPayment:   0,
+		BlobKzgCommitments: blobCommitmentsForSlot(slot, 1),
+		FeeRecipient:       bytes.Repeat([]byte{0x55}, 20),
 	}
 	genesis := bytesutil.ToBytes32(state.GenesisValidatorsRoot())
 	sig := signBid(t, sk, bid, state.Fork(), genesis)
@@ -563,17 +621,17 @@ func TestProcessExecutionPayloadBid_ParentRootMismatch(t *testing.T) {
 
 	parentRoot := bytes.Repeat([]byte{0x22}, 32)
 	bid := &ethpb.ExecutionPayloadBid{
-		ParentBlockHash:        latestHash[:],
-		ParentBlockRoot:        parentRoot,
-		BlockHash:              bytes.Repeat([]byte{0x33}, 32),
-		PrevRandao:             randao[:],
-		GasLimit:               1,
-		BuilderIndex:           builderIdx,
-		Slot:                   slot,
-		Value:                  1,
-		ExecutionPayment:       0,
-		BlobKzgCommitmentsRoot: bytes.Repeat([]byte{0x44}, 32),
-		FeeRecipient:           bytes.Repeat([]byte{0x55}, 20),
+		ParentBlockHash:    latestHash[:],
+		ParentBlockRoot:    parentRoot,
+		BlockHash:          bytes.Repeat([]byte{0x33}, 32),
+		PrevRandao:         randao[:],
+		GasLimit:           1,
+		BuilderIndex:       builderIdx,
+		Slot:               slot,
+		Value:              1,
+		ExecutionPayment:   0,
+		BlobKzgCommitments: blobCommitmentsForSlot(slot, 1),
+		FeeRecipient:       bytes.Repeat([]byte{0x55}, 20),
 	}
 	genesis := bytesutil.ToBytes32(state.GenesisValidatorsRoot())
 	sig := signBid(t, sk, bid, state.Fork(), genesis)
@@ -605,17 +663,17 @@ func TestProcessExecutionPayloadBid_PrevRandaoMismatch(t *testing.T) {
 	state := buildGloasState(t, slot, proposerIdx, builderIdx, params.BeaconConfig().MinDepositAmount+1000, randao, latestHash, pubKey)
 
 	bid := &ethpb.ExecutionPayloadBid{
-		ParentBlockHash:        latestHash[:],
-		ParentBlockRoot:        bytes.Repeat([]byte{0x22}, 32),
-		BlockHash:              bytes.Repeat([]byte{0x33}, 32),
-		PrevRandao:             bytes.Repeat([]byte{0x01}, 32), // mismatch
-		GasLimit:               1,
-		BuilderIndex:           builderIdx,
-		Slot:                   slot,
-		Value:                  1,
-		ExecutionPayment:       0,
-		BlobKzgCommitmentsRoot: bytes.Repeat([]byte{0x44}, 32),
-		FeeRecipient:           bytes.Repeat([]byte{0x55}, 20),
+		ParentBlockHash:    latestHash[:],
+		ParentBlockRoot:    bytes.Repeat([]byte{0x22}, 32),
+		BlockHash:          bytes.Repeat([]byte{0x33}, 32),
+		PrevRandao:         bytes.Repeat([]byte{0x01}, 32), // mismatch
+		GasLimit:           1,
+		BuilderIndex:       builderIdx,
+		Slot:               slot,
+		Value:              1,
+		ExecutionPayment:   0,
+		BlobKzgCommitments: blobCommitmentsForSlot(slot, 1),
+		FeeRecipient:       bytes.Repeat([]byte{0x55}, 20),
 	}
 	genesis := bytesutil.ToBytes32(state.GenesisValidatorsRoot())
 	sig := signBid(t, sk, bid, state.Fork(), genesis)

beacon-chain/core/gloas/deposit_request.go

@@ -0,0 +1,180 @@
+package gloas
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/core/helpers"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/state"
+	fieldparams "github.com/OffchainLabs/prysm/v7/config/fieldparams"
+	"github.com/OffchainLabs/prysm/v7/config/params"
+	"github.com/OffchainLabs/prysm/v7/encoding/bytesutil"
+	enginev1 "github.com/OffchainLabs/prysm/v7/proto/engine/v1"
+	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
+	"github.com/OffchainLabs/prysm/v7/runtime/version"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+)
+
+func processDepositRequests(ctx context.Context, beaconState state.BeaconState, requests []*enginev1.DepositRequest) error {
+	if len(requests) == 0 {
+		return nil
+	}
+
+	for _, receipt := range requests {
+		if err := processDepositRequest(beaconState, receipt); err != nil {
+			return errors.Wrap(err, "could not apply deposit request")
+		}
+	}
+	return nil
+}
+
+// processDepositRequest processes the specific deposit request
+//
+//	<spec fn="process_deposit_request" fork="gloas" hash="3c6b0310">
+//	def process_deposit_request(state: BeaconState, deposit_request: DepositRequest) -> None:
+//	    # [New in Gloas:EIP7732]
+//	    builder_pubkeys = [b.pubkey for b in state.builders]
+//	    validator_pubkeys = [v.pubkey for v in state.validators]
+//
+//	    # [New in Gloas:EIP7732]
+//	    # Regardless of the withdrawal credentials prefix, if a builder/validator
+//	    # already exists with this pubkey, apply the deposit to their balance
+//	    is_builder = deposit_request.pubkey in builder_pubkeys
+//	    is_validator = deposit_request.pubkey in validator_pubkeys
+//	    is_builder_prefix = is_builder_withdrawal_credential(deposit_request.withdrawal_credentials)
+//	    if is_builder or (is_builder_prefix and not is_validator):
+//	        # Apply builder deposits immediately
+//	        apply_deposit_for_builder(
+//	            state,
+//	            deposit_request.pubkey,
+//	            deposit_request.withdrawal_credentials,
+//	            deposit_request.amount,
+//	            deposit_request.signature,
+//	            state.slot,
+//	        )
+//	        return
+//
+//	    # Add validator deposits to the queue
+//	    state.pending_deposits.append(
+//	        PendingDeposit(
+//	            pubkey=deposit_request.pubkey,
+//	            withdrawal_credentials=deposit_request.withdrawal_credentials,
+//	            amount=deposit_request.amount,
+//	            signature=deposit_request.signature,
+//	            slot=state.slot,
+//	        )
+//	    )
+//	</spec>
+func processDepositRequest(beaconState state.BeaconState, request *enginev1.DepositRequest) error {
+	if request == nil {
+		return errors.New("nil deposit request")
+	}
+
+	applied, err := applyBuilderDepositRequest(beaconState, request)
+	if err != nil {
+		return errors.Wrap(err, "could not apply builder deposit")
+	}
+	if applied {
+		return nil
+	}
+
+	if err := beaconState.AppendPendingDeposit(&ethpb.PendingDeposit{
+		PublicKey:             request.Pubkey,
+		WithdrawalCredentials: request.WithdrawalCredentials,
+		Amount:                request.Amount,
+		Signature:             request.Signature,
+		Slot:                  beaconState.Slot(),
+	}); err != nil {
+		return errors.Wrap(err, "could not append deposit request")
+	}
+	return nil
+}
+
+// <spec fn="apply_deposit_for_builder" fork="gloas" hash="e4bc98c7">
+// def apply_deposit_for_builder(
+//
+//	state: BeaconState,
+//	pubkey: BLSPubkey,
+//	withdrawal_credentials: Bytes32,
+//	amount: uint64,
+//	signature: BLSSignature,
+//	slot: Slot,
+//
+// ) -> None:
+//
+//	builder_pubkeys = [b.pubkey for b in state.builders]
+//	if pubkey not in builder_pubkeys:
+//	    # Verify the deposit signature (proof of possession) which is not checked by the deposit contract
+//	    if is_valid_deposit_signature(pubkey, withdrawal_credentials, amount, signature):
+//	        add_builder_to_registry(state, pubkey, withdrawal_credentials, amount, slot)
+//	else:
+//	    # Increase balance by deposit amount
+//	    builder_index = builder_pubkeys.index(pubkey)
+//	    state.builders[builder_index].balance += amount
+//
+// </spec>
+func applyBuilderDepositRequest(beaconState state.BeaconState, request *enginev1.DepositRequest) (bool, error) {
+	if beaconState.Version() < version.Gloas {
+		return false, nil
+	}
+
+	pubkey := bytesutil.ToBytes48(request.Pubkey)
+	_, isValidator := beaconState.ValidatorIndexByPubkey(pubkey)
+	idx, isBuilder := beaconState.BuilderIndexByPubkey(pubkey)
+	isBuilderPrefix := IsBuilderWithdrawalCredential(request.WithdrawalCredentials)
+	if !isBuilder && (!isBuilderPrefix || isValidator) {
+		return false, nil
+	}
+
+	if isBuilder {
+		if err := beaconState.IncreaseBuilderBalance(idx, request.Amount); err != nil {
+			return false, err
+		}
+		return true, nil
+	}
+
+	if err := applyDepositForNewBuilder(
+		beaconState,
+		request.Pubkey,
+		request.WithdrawalCredentials,
+		request.Amount,
+		request.Signature,
+	); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+func applyDepositForNewBuilder(
+	beaconState state.BeaconState,
+	pubkey []byte,
+	withdrawalCredentials []byte,
+	amount uint64,
+	signature []byte,
+) error {
+	pubkeyBytes := bytesutil.ToBytes48(pubkey)
+	valid, err := helpers.IsValidDepositSignature(&ethpb.Deposit_Data{
+		PublicKey:             pubkey,
+		WithdrawalCredentials: withdrawalCredentials,
+		Amount:                amount,
+		Signature:             signature,
+	})
+	if err != nil {
+		return errors.Wrap(err, "could not verify deposit signature")
+	}
+	if !valid {
+		log.WithFields(logrus.Fields{
+			"pubkey": fmt.Sprintf("%x", pubkey),
+		}).Warn("ignoring builder deposit: invalid signature")
+		return nil
+	}
+
+	withdrawalCredBytes := bytesutil.ToBytes32(withdrawalCredentials)
+	return beaconState.AddBuilderFromDeposit(pubkeyBytes, withdrawalCredBytes, amount)
+}
+
+func IsBuilderWithdrawalCredential(withdrawalCredentials []byte) bool {
+	return len(withdrawalCredentials) == fieldparams.RootLength &&
+		withdrawalCredentials[0] == params.BeaconConfig().BuilderWithdrawalPrefixByte
+}

beacon-chain/core/gloas/deposit_request_test.go

@@ -0,0 +1,150 @@
+package gloas
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/state"
+	state_native "github.com/OffchainLabs/prysm/v7/beacon-chain/state/state-native"
+	stateTesting "github.com/OffchainLabs/prysm/v7/beacon-chain/state/testing"
+	"github.com/OffchainLabs/prysm/v7/config/params"
+	"github.com/OffchainLabs/prysm/v7/crypto/bls"
+	enginev1 "github.com/OffchainLabs/prysm/v7/proto/engine/v1"
+	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
+	"github.com/OffchainLabs/prysm/v7/testing/require"
+)
+
+func TestProcessDepositRequests_EmptyAndNil(t *testing.T) {
+	st := newGloasState(t, nil, nil)
+
+	t.Run("empty requests continues", func(t *testing.T) {
+		err := processDepositRequests(t.Context(), st, []*enginev1.DepositRequest{})
+		require.NoError(t, err)
+	})
+
+	t.Run("nil request errors", func(t *testing.T) {
+		err := processDepositRequests(t.Context(), st, []*enginev1.DepositRequest{nil})
+		require.ErrorContains(t, "nil deposit request", err)
+	})
+}
+
+func TestProcessDepositRequest_BuilderDepositAddsBuilder(t *testing.T) {
+	sk, err := bls.RandKey()
+	require.NoError(t, err)
+
+	cred := builderWithdrawalCredentials()
+	pd := stateTesting.GeneratePendingDeposit(t, sk, 1234, cred, 0)
+	req := depositRequestFromPending(pd, 1)
+
+	st := newGloasState(t, nil, nil)
+	err = processDepositRequest(st, req)
+	require.NoError(t, err)
+
+	idx, ok := st.BuilderIndexByPubkey(toBytes48(req.Pubkey))
+	require.Equal(t, true, ok)
+
+	builder, err := st.Builder(idx)
+	require.NoError(t, err)
+	require.NotNil(t, builder)
+	require.DeepEqual(t, req.Pubkey, builder.Pubkey)
+	require.DeepEqual(t, []byte{cred[0]}, builder.Version)
+	require.DeepEqual(t, cred[12:], builder.ExecutionAddress)
+	require.Equal(t, uint64(1234), uint64(builder.Balance))
+	require.Equal(t, params.BeaconConfig().FarFutureEpoch, builder.WithdrawableEpoch)
+
+	pending, err := st.PendingDeposits()
+	require.NoError(t, err)
+	require.Equal(t, 0, len(pending))
+}
+
+func TestProcessDepositRequest_ExistingBuilderIncreasesBalance(t *testing.T) {
+	sk, err := bls.RandKey()
+	require.NoError(t, err)
+
+	pubkey := sk.PublicKey().Marshal()
+	builders := []*ethpb.Builder{
+		{
+			Pubkey:            pubkey,
+			Version:           []byte{0},
+			ExecutionAddress:  bytes.Repeat([]byte{0x11}, 20),
+			Balance:           5,
+			WithdrawableEpoch: params.BeaconConfig().FarFutureEpoch,
+		},
+	}
+	st := newGloasState(t, nil, builders)
+
+	cred := validatorWithdrawalCredentials()
+	pd := stateTesting.GeneratePendingDeposit(t, sk, 200, cred, 0)
+	req := depositRequestFromPending(pd, 9)
+
+	err = processDepositRequest(st, req)
+	require.NoError(t, err)
+
+	idx, ok := st.BuilderIndexByPubkey(toBytes48(pubkey))
+	require.Equal(t, true, ok)
+	builder, err := st.Builder(idx)
+	require.NoError(t, err)
+	require.Equal(t, uint64(205), uint64(builder.Balance))
+
+	pending, err := st.PendingDeposits()
+	require.NoError(t, err)
+	require.Equal(t, 0, len(pending))
+}
+
+func TestApplyDepositForBuilder_InvalidSignatureIgnoresDeposit(t *testing.T) {
+	sk, err := bls.RandKey()
+	require.NoError(t, err)
+
+	cred := builderWithdrawalCredentials()
+	st := newGloasState(t, nil, nil)
+	err = applyDepositForNewBuilder(st, sk.PublicKey().Marshal(), cred[:], 100, make([]byte, 96))
+	require.NoError(t, err)
+
+	_, ok := st.BuilderIndexByPubkey(toBytes48(sk.PublicKey().Marshal()))
+	require.Equal(t, false, ok)
+}
+
+func newGloasState(t *testing.T, validators []*ethpb.Validator, builders []*ethpb.Builder) state.BeaconState {
+	t.Helper()
+
+	st, err := state_native.InitializeFromProtoGloas(&ethpb.BeaconStateGloas{
+		DepositRequestsStartIndex: params.BeaconConfig().UnsetDepositRequestsStartIndex,
+		Validators:                validators,
+		Balances:                  make([]uint64, len(validators)),
+		PendingDeposits:           []*ethpb.PendingDeposit{},
+		Builders:                  builders,
+	})
+	require.NoError(t, err)
+
+	return st
+}
+
+func depositRequestFromPending(pd *ethpb.PendingDeposit, index uint64) *enginev1.DepositRequest {
+	return &enginev1.DepositRequest{
+		Pubkey:                pd.PublicKey,
+		WithdrawalCredentials: pd.WithdrawalCredentials,
+		Amount:                pd.Amount,
+		Signature:             pd.Signature,
+		Index:                 index,
+	}
+}
+
+func builderWithdrawalCredentials() [32]byte {
+	var cred [32]byte
+	cred[0] = params.BeaconConfig().BuilderWithdrawalPrefixByte
+	copy(cred[12:], bytes.Repeat([]byte{0x22}, 20))
+	return cred
+}
+
+func validatorWithdrawalCredentials() [32]byte {
+	var cred [32]byte
+	cred[0] = params.BeaconConfig().ETH1AddressWithdrawalPrefixByte
+	copy(cred[12:], bytes.Repeat([]byte{0x33}, 20))
+	return cred
+}
+
+func toBytes48(b []byte) [48]byte {
+	var out [48]byte
+	copy(out[:], b)
+	return out
+}

beacon-chain/core/gloas/log.go

@@ -0,0 +1,9 @@
+// Code generated by hack/gen-logs.sh; DO NOT EDIT.
+// This file is created and regenerated automatically. Anything added here might get removed.
+package gloas
+
+import "github.com/sirupsen/logrus"
+
+// The prefix for logs from this package will be the text after the last slash in the package path.
+// If you wish to change this, you should add your desired name in the runtime/logging/logrus-prefixed-formatter/prefix-replacement.go file.
+var log = logrus.WithField("package", "beacon-chain/core/gloas")

beacon-chain/core/gloas/payload.go

@@ -0,0 +1,345 @@
+package gloas
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+
+	requests "github.com/OffchainLabs/prysm/v7/beacon-chain/core/requests"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/core/signing"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/state"
+	"github.com/OffchainLabs/prysm/v7/config/params"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/interfaces"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+	"github.com/OffchainLabs/prysm/v7/crypto/bls"
+	enginev1 "github.com/OffchainLabs/prysm/v7/proto/engine/v1"
+	"github.com/OffchainLabs/prysm/v7/time/slots"
+	"github.com/pkg/errors"
+)
+
+// ProcessExecutionPayload processes the signed execution payload envelope for the Gloas fork.
+//
+//	<spec fn="process_execution_payload" fork="gloas" hash="36bd3af3">
+//	def process_execution_payload(
+//	    state: BeaconState,
+//	    # [Modified in Gloas:EIP7732]
+//	    # Removed `body`
+//	    # [New in Gloas:EIP7732]
+//	    signed_envelope: SignedExecutionPayloadEnvelope,
+//	    execution_engine: ExecutionEngine,
+//	    # [New in Gloas:EIP7732]
+//	    verify: bool = True,
+//	) -> None:
+//	    envelope = signed_envelope.message
+//	    payload = envelope.payload
+//
+//	    # Verify signature
+//	    if verify:
+//	        assert verify_execution_payload_envelope_signature(state, signed_envelope)
+//
+//	    # Cache latest block header state root
+//	    previous_state_root = hash_tree_root(state)
+//	    if state.latest_block_header.state_root == Root():
+//	        state.latest_block_header.state_root = previous_state_root
+//
+//	    # Verify consistency with the beacon block
+//	    assert envelope.beacon_block_root == hash_tree_root(state.latest_block_header)
+//	    assert envelope.slot == state.slot
+//
+//	    # Verify consistency with the committed bid
+//	    committed_bid = state.latest_execution_payload_bid
+//	    assert envelope.builder_index == committed_bid.builder_index
+//	    assert committed_bid.prev_randao == payload.prev_randao
+//
+//	    # Verify consistency with expected withdrawals
+//	    assert hash_tree_root(payload.withdrawals) == hash_tree_root(state.payload_expected_withdrawals)
+//
+//	    # Verify the gas_limit
+//	    assert committed_bid.gas_limit == payload.gas_limit
+//	    # Verify the block hash
+//	    assert committed_bid.block_hash == payload.block_hash
+//	    # Verify consistency of the parent hash with respect to the previous execution payload
+//	    assert payload.parent_hash == state.latest_block_hash
+//	    # Verify timestamp
+//	    assert payload.timestamp == compute_time_at_slot(state, state.slot)
+//	    # Verify the execution payload is valid
+//	    versioned_hashes = [
+//	        kzg_commitment_to_versioned_hash(commitment)
+//	        # [Modified in Gloas:EIP7732]
+//	        for commitment in committed_bid.blob_kzg_commitments
+//	    ]
+//	    requests = envelope.execution_requests
+//	    assert execution_engine.verify_and_notify_new_payload(
+//	        NewPayloadRequest(
+//	            execution_payload=payload,
+//	            versioned_hashes=versioned_hashes,
+//	            parent_beacon_block_root=state.latest_block_header.parent_root,
+//	            execution_requests=requests,
+//	        )
+//	    )
+//
+//	    def for_ops(operations: Sequence[Any], fn: Callable[[BeaconState, Any], None]) -> None:
+//	        for operation in operations:
+//	            fn(state, operation)
+//
+//	    for_ops(requests.deposits, process_deposit_request)
+//	    for_ops(requests.withdrawals, process_withdrawal_request)
+//	    for_ops(requests.consolidations, process_consolidation_request)
+//
+//	    # Queue the builder payment
+//	    payment = state.builder_pending_payments[SLOTS_PER_EPOCH + state.slot % SLOTS_PER_EPOCH]
+//	    amount = payment.withdrawal.amount
+//	    if amount > 0:
+//	        state.builder_pending_withdrawals.append(payment.withdrawal)
+//	    state.builder_pending_payments[SLOTS_PER_EPOCH + state.slot % SLOTS_PER_EPOCH] = (
+//	        BuilderPendingPayment()
+//	    )
+//
+//	    # Cache the execution payload hash
+//	    state.execution_payload_availability[state.slot % SLOTS_PER_HISTORICAL_ROOT] = 0b1
+//	    state.latest_block_hash = payload.block_hash
+//
+//	    # Verify the state root
+//	    if verify:
+//	        assert envelope.state_root == hash_tree_root(state)
+//	</spec>
+func ProcessExecutionPayload(
+	ctx context.Context,
+	st state.BeaconState,
+	signedEnvelope interfaces.ROSignedExecutionPayloadEnvelope,
+) error {
+	if err := verifyExecutionPayloadEnvelopeSignature(st, signedEnvelope); err != nil {
+		return errors.Wrap(err, "signature verification failed")
+	}
+
+	latestHeader := st.LatestBlockHeader()
+	if len(latestHeader.StateRoot) == 0 || bytes.Equal(latestHeader.StateRoot, make([]byte, 32)) {
+		previousStateRoot, err := st.HashTreeRoot(ctx)
+		if err != nil {
+			return errors.Wrap(err, "could not compute state root")
+		}
+		latestHeader.StateRoot = previousStateRoot[:]
+		if err := st.SetLatestBlockHeader(latestHeader); err != nil {
+			return errors.Wrap(err, "could not set latest block header")
+		}
+	}
+
+	blockHeaderRoot, err := latestHeader.HashTreeRoot()
+	if err != nil {
+		return errors.Wrap(err, "could not compute block header root")
+	}
+	envelope, err := signedEnvelope.Envelope()
+	if err != nil {
+		return errors.Wrap(err, "could not get envelope from signed envelope")
+	}
+
+	beaconBlockRoot := envelope.BeaconBlockRoot()
+	if !bytes.Equal(beaconBlockRoot[:], blockHeaderRoot[:]) {
+		return errors.Errorf("envelope beacon block root does not match state latest block header root: envelope=%#x, header=%#x", beaconBlockRoot, blockHeaderRoot)
+	}
+
+	if envelope.Slot() != st.Slot() {
+		return errors.Errorf("envelope slot does not match state slot: envelope=%d, state=%d", envelope.Slot(), st.Slot())
+	}
+
+	latestBid, err := st.LatestExecutionPayloadBid()
+	if err != nil {
+		return errors.Wrap(err, "could not get latest execution payload bid")
+	}
+	if latestBid == nil {
+		return errors.New("latest execution payload bid is nil")
+	}
+	if envelope.BuilderIndex() != latestBid.BuilderIndex() {
+		return errors.Errorf("envelope builder index does not match committed bid builder index: envelope=%d, bid=%d", envelope.BuilderIndex(), latestBid.BuilderIndex())
+	}
+
+	payload, err := envelope.Execution()
+	if err != nil {
+		return errors.Wrap(err, "could not get execution payload from envelope")
+	}
+	latestBidPrevRandao := latestBid.PrevRandao()
+	if !bytes.Equal(payload.PrevRandao(), latestBidPrevRandao[:]) {
+		return errors.Errorf("payload prev randao does not match committed bid prev randao: payload=%#x, bid=%#x", payload.PrevRandao(), latestBidPrevRandao)
+	}
+
+	withdrawals, err := payload.Withdrawals()
+	if err != nil {
+		return errors.Wrap(err, "could not get withdrawals from payload")
+	}
+
+	ok, err := st.WithdrawalsMatchPayloadExpected(withdrawals)
+	if err != nil {
+		return errors.Wrap(err, "could not validate payload withdrawals")
+	}
+	if !ok {
+		return errors.New("payload withdrawals do not match expected withdrawals")
+	}
+
+	if latestBid.GasLimit() != payload.GasLimit() {
+		return errors.Errorf("committed bid gas limit does not match payload gas limit: bid=%d, payload=%d", latestBid.GasLimit(), payload.GasLimit())
+	}
+
+	bidBlockHash := latestBid.BlockHash()
+	payloadBlockHash := payload.BlockHash()
+	if !bytes.Equal(bidBlockHash[:], payloadBlockHash) {
+		return errors.Errorf("committed bid block hash does not match payload block hash: bid=%#x, payload=%#x", bidBlockHash, payloadBlockHash)
+	}
+
+	latestBlockHash, err := st.LatestBlockHash()
+	if err != nil {
+		return errors.Wrap(err, "could not get latest block hash")
+	}
+	if !bytes.Equal(payload.ParentHash(), latestBlockHash[:]) {
+		return errors.Errorf("payload parent hash does not match state latest block hash: payload=%#x, state=%#x", payload.ParentHash(), latestBlockHash)
+	}
+
+	t, err := slots.StartTime(st.GenesisTime(), st.Slot())
+	if err != nil {
+		return errors.Wrap(err, "could not compute timestamp")
+	}
+	if payload.Timestamp() != uint64(t.Unix()) {
+		return errors.Errorf("payload timestamp does not match expected timestamp: payload=%d, expected=%d", payload.Timestamp(), uint64(t.Unix()))
+	}
+
+	if err := processExecutionRequests(ctx, st, envelope.ExecutionRequests()); err != nil {
+		return errors.Wrap(err, "could not process execution requests")
+	}
+
+	if err := st.QueueBuilderPayment(); err != nil {
+		return errors.Wrap(err, "could not queue builder payment")
+	}
+
+	if err := st.SetExecutionPayloadAvailability(st.Slot(), true); err != nil {
+		return errors.Wrap(err, "could not set execution payload availability")
+	}
+
+	if err := st.SetLatestBlockHash([32]byte(payload.BlockHash())); err != nil {
+		return errors.Wrap(err, "could not set latest block hash")
+	}
+
+	r, err := st.HashTreeRoot(ctx)
+	if err != nil {
+		return errors.Wrap(err, "could not get hash tree root")
+	}
+	if r != envelope.StateRoot() {
+		return fmt.Errorf("state root mismatch: expected %#x, got %#x", envelope.StateRoot(), r)
+	}
+
+	return nil
+}
+
+func envelopePublicKey(st state.BeaconState, builderIdx primitives.BuilderIndex) (bls.PublicKey, error) {
+	if builderIdx == params.BeaconConfig().BuilderIndexSelfBuild {
+		return proposerPublicKey(st)
+	}
+	return builderPublicKey(st, builderIdx)
+}
+
+func proposerPublicKey(st state.BeaconState) (bls.PublicKey, error) {
+	header := st.LatestBlockHeader()
+	if header == nil {
+		return nil, fmt.Errorf("latest block header is nil")
+	}
+	proposerPubkey := st.PubkeyAtIndex(header.ProposerIndex)
+	publicKey, err := bls.PublicKeyFromBytes(proposerPubkey[:])
+	if err != nil {
+		return nil, fmt.Errorf("invalid proposer public key: %w", err)
+	}
+	return publicKey, nil
+}
+
+func builderPublicKey(st state.BeaconState, builderIdx primitives.BuilderIndex) (bls.PublicKey, error) {
+	builder, err := st.Builder(builderIdx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get builder: %w", err)
+	}
+	if builder == nil {
+		return nil, fmt.Errorf("builder at index %d not found", builderIdx)
+	}
+	publicKey, err := bls.PublicKeyFromBytes(builder.Pubkey)
+	if err != nil {
+		return nil, fmt.Errorf("invalid builder public key: %w", err)
+	}
+	return publicKey, nil
+}
+
+// processExecutionRequests processes deposits, withdrawals, and consolidations from execution requests.
+// Spec v1.7.0-alpha.0 (pseudocode):
+// for op in requests.deposits: process_deposit_request(state, op)
+// for op in requests.withdrawals: process_withdrawal_request(state, op)
+// for op in requests.consolidations: process_consolidation_request(state, op)
+func processExecutionRequests(ctx context.Context, st state.BeaconState, rqs *enginev1.ExecutionRequests) error {
+	if err := processDepositRequests(ctx, st, rqs.Deposits); err != nil {
+		return errors.Wrap(err, "could not process deposit requests")
+	}
+
+	var err error
+	st, err = requests.ProcessWithdrawalRequests(ctx, st, rqs.Withdrawals)
+	if err != nil {
+		return errors.Wrap(err, "could not process withdrawal requests")
+	}
+	err = requests.ProcessConsolidationRequests(ctx, st, rqs.Consolidations)
+	if err != nil {
+		return errors.Wrap(err, "could not process consolidation requests")
+	}
+	return nil
+}
+
+// verifyExecutionPayloadEnvelopeSignature verifies the BLS signature on a signed execution payload envelope.
+// Spec v1.7.0-alpha.0 (pseudocode):
+// builder_index = signed_envelope.message.builder_index
+// if builder_index == BUILDER_INDEX_SELF_BUILD:
+//
+//	validator_index = state.latest_block_header.proposer_index
+//	pubkey = state.validators[validator_index].pubkey
+//
+// else:
+//
+//	pubkey = state.builders[builder_index].pubkey
+//
+// signing_root = compute_signing_root(
+//
+//	signed_envelope.message, get_domain(state, DOMAIN_BEACON_BUILDER)
+//
+// )
+// return bls.Verify(pubkey, signing_root, signed_envelope.signature)
+func verifyExecutionPayloadEnvelopeSignature(st state.BeaconState, signedEnvelope interfaces.ROSignedExecutionPayloadEnvelope) error {
+	envelope, err := signedEnvelope.Envelope()
+	if err != nil {
+		return fmt.Errorf("failed to get envelope: %w", err)
+	}
+
+	builderIdx := envelope.BuilderIndex()
+	publicKey, err := envelopePublicKey(st, builderIdx)
+	if err != nil {
+		return err
+	}
+
+	signatureBytes := signedEnvelope.Signature()
+	signature, err := bls.SignatureFromBytes(signatureBytes[:])
+	if err != nil {
+		return fmt.Errorf("invalid signature format: %w", err)
+	}
+
+	currentEpoch := slots.ToEpoch(envelope.Slot())
+	domain, err := signing.Domain(
+		st.Fork(),
+		currentEpoch,
+		params.BeaconConfig().DomainBeaconBuilder,
+		st.GenesisValidatorsRoot(),
+	)
+	if err != nil {
+		return fmt.Errorf("failed to compute signing domain: %w", err)
+	}
+
+	signingRoot, err := signedEnvelope.SigningRoot(domain)
+	if err != nil {
+		return fmt.Errorf("failed to compute signing root: %w", err)
+	}
+
+	if !signature.Verify(publicKey, signingRoot[:]) {
+		return fmt.Errorf("signature verification failed: %w", signing.ErrSigFailedToVerify)
+	}
+
+	return nil
+}

beacon-chain/core/gloas/payload_attestation.go

@@ -24,14 +24,21 @@ import (
 )
 
 // ProcessPayloadAttestations validates payload attestations in a block body.
-// Spec v1.7.0-alpha.0 (pseudocode):
-// process_payload_attestation(state: BeaconState, payload_attestation: PayloadAttestation):
 //
-//	data = payload_attestation.data
-//	assert data.beacon_block_root == state.latest_block_header.parent_root
-//	assert data.slot + 1 == state.slot
-//	indexed = get_indexed_payload_attestation(state, data.slot, payload_attestation)
-//	assert is_valid_indexed_payload_attestation(state, indexed)
+//	<spec fn="process_payload_attestation" fork="gloas" hash="f46bf0b0">
+//	def process_payload_attestation(
+//	    state: BeaconState, payload_attestation: PayloadAttestation
+//	) -> None:
+//	    data = payload_attestation.data
+//
+//	    # Check that the attestation is for the parent beacon block
+//	    assert data.beacon_block_root == state.latest_block_header.parent_root
+//	    # Check that the attestation is for the previous slot
+//	    assert data.slot + 1 == state.slot
+//	    # Verify signature
+//	    indexed_payload_attestation = get_indexed_payload_attestation(state, payload_attestation)
+//	    assert is_valid_indexed_payload_attestation(state, indexed_payload_attestation)
+//	</spec>
 func ProcessPayloadAttestations(ctx context.Context, st state.BeaconState, body interfaces.ReadOnlyBeaconBlockBody) error {
 	atts, err := body.PayloadAttestations()
 	if err != nil {
@@ -70,7 +77,7 @@ func ProcessPayloadAttestations(ctx context.Context, st state.BeaconState, body
 
 // indexedPayloadAttestation converts a payload attestation into its indexed form.
 func indexedPayloadAttestation(ctx context.Context, st state.ReadOnlyBeaconState, att *eth.PayloadAttestation) (*consensus_types.IndexedPayloadAttestation, error) {
-	committee, err := payloadCommittee(ctx, st, att.Data.Slot)
+	committee, err := PayloadCommittee(ctx, st, att.Data.Slot)
 	if err != nil {
 		return nil, err
 	}
@@ -89,19 +96,26 @@ func indexedPayloadAttestation(ctx context.Context, st state.ReadOnlyBeaconState
 	}, nil
 }
 
-// payloadCommittee returns the payload timeliness committee for a given slot for the state.
-// Spec v1.7.0-alpha.0 (pseudocode):
-// get_ptc(state: BeaconState, slot: Slot) -> Vector[ValidatorIndex, PTC_SIZE]:
+// PayloadCommittee returns the payload timeliness committee for a given slot for the state.
 //
-//	epoch = compute_epoch_at_slot(slot)
-//	seed = hash(get_seed(state, epoch, DOMAIN_PTC_ATTESTER) + uint_to_bytes(slot))
-//	indices = []
-//	committees_per_slot = get_committee_count_per_slot(state, epoch)
-//	for i in range(committees_per_slot):
-//	  committee = get_beacon_committee(state, slot, CommitteeIndex(i))
-//	  indices.extend(committee)
-//	return compute_balance_weighted_selection(state, indices, seed, size=PTC_SIZE, shuffle_indices=False)
-func payloadCommittee(ctx context.Context, st state.ReadOnlyBeaconState, slot primitives.Slot) ([]primitives.ValidatorIndex, error) {
+//	<spec fn="get_ptc" fork="gloas" hash="ae15f761">
+//	def get_ptc(state: BeaconState, slot: Slot) -> Vector[ValidatorIndex, PTC_SIZE]:
+//	    """
+//	    Get the payload timeliness committee for the given ``slot``.
+//	    """
+//	    epoch = compute_epoch_at_slot(slot)
+//	    seed = hash(get_seed(state, epoch, DOMAIN_PTC_ATTESTER) + uint_to_bytes(slot))
+//	    indices: List[ValidatorIndex] = []
+//	    # Concatenate all committees for this slot in order
+//	    committees_per_slot = get_committee_count_per_slot(state, epoch)
+//	    for i in range(committees_per_slot):
+//	        committee = get_beacon_committee(state, slot, CommitteeIndex(i))
+//	        indices.extend(committee)
+//	    return compute_balance_weighted_selection(
+//	        state, indices, seed, size=PTC_SIZE, shuffle_indices=False
+//	    )
+//	</spec>
+func PayloadCommittee(ctx context.Context, st state.ReadOnlyBeaconState, slot primitives.Slot) ([]primitives.ValidatorIndex, error) {
 	epoch := slots.ToEpoch(slot)
 	seed, err := ptcSeed(st, epoch, slot)
 	if err != nil {
@@ -152,17 +166,35 @@ func ptcSeed(st state.ReadOnlyBeaconState, epoch primitives.Epoch, slot primitiv
 }
 
 // selectByBalance selects a balance-weighted subset of input candidates.
-// Spec v1.7.0-alpha.0 (pseudocode):
-// compute_balance_weighted_selection(state, indices, seed, size, shuffle_indices):
-// Note: shuffle_indices is false for PTC.
 //
-//	total = len(indices); selected = []; i = 0
-//	while len(selected) < size:
-//	  next = i % total
-//	  if shuffle_indices: next = compute_shuffled_index(next, total, seed)
-//	  if compute_balance_weighted_acceptance(state, indices[next], seed, i):
-//	    selected.append(indices[next])
-//	  i += 1
+//	<spec fn="compute_balance_weighted_selection" fork="gloas" hash="2c9f1c23">
+//	def compute_balance_weighted_selection(
+//	    state: BeaconState,
+//	    indices: Sequence[ValidatorIndex],
+//	    seed: Bytes32,
+//	    size: uint64,
+//	    shuffle_indices: bool,
+//	) -> Sequence[ValidatorIndex]:
+//	    """
+//	    Return ``size`` indices sampled by effective balance, using ``indices``
+//	    as candidates. If ``shuffle_indices`` is ``True``, candidate indices
+//	    are themselves sampled from ``indices`` by shuffling it, otherwise
+//	    ``indices`` is traversed in order.
+//	    """
+//	    total = uint64(len(indices))
+//	    assert total > 0
+//	    selected: List[ValidatorIndex] = []
+//	    i = uint64(0)
+//	    while len(selected) < size:
+//	        next_index = i % total
+//	        if shuffle_indices:
+//	            next_index = compute_shuffled_index(next_index, total, seed)
+//	        candidate_index = indices[next_index]
+//	        if compute_balance_weighted_acceptance(state, candidate_index, seed, i):
+//	            selected.append(candidate_index)
+//	        i += 1
+//	    return selected
+//	</spec>
 func selectByBalanceFill(
 	ctx context.Context,
 	st state.ReadOnlyBeaconState,
@@ -199,15 +231,22 @@ func selectByBalanceFill(
 }
 
 // acceptByBalance determines if a validator is accepted based on its effective balance.
-// Spec v1.7.0-alpha.0 (pseudocode):
-// compute_balance_weighted_acceptance(state, index, seed, i):
 //
-//	MAX_RANDOM_VALUE = 2**16 - 1
-//	random_bytes = hash(seed + uint_to_bytes(i // 16))
-//	offset = i % 16 * 2
-//	random_value = bytes_to_uint64(random_bytes[offset:offset+2])
-//	effective_balance = state.validators[index].effective_balance
-//	return effective_balance * MAX_RANDOM_VALUE >= MAX_EFFECTIVE_BALANCE_ELECTRA * random_value
+//	<spec fn="compute_balance_weighted_acceptance" fork="gloas" hash="9954dcd0">
+//	def compute_balance_weighted_acceptance(
+//	    state: BeaconState, index: ValidatorIndex, seed: Bytes32, i: uint64
+//	) -> bool:
+//	    """
+//	    Return whether to accept the selection of the validator ``index``, with probability
+//	    proportional to its ``effective_balance``, and randomness given by ``seed`` and ``i``.
+//	    """
+//	    MAX_RANDOM_VALUE = 2**16 - 1
+//	    random_bytes = hash(seed + uint_to_bytes(i // 16))
+//	    offset = i % 16 * 2
+//	    random_value = bytes_to_uint64(random_bytes[offset : offset + 2])
+//	    effective_balance = state.validators[index].effective_balance
+//	    return effective_balance * MAX_RANDOM_VALUE >= MAX_EFFECTIVE_BALANCE_ELECTRA * random_value
+//	</spec>
 func acceptByBalance(st state.ReadOnlyBeaconState, idx primitives.ValidatorIndex, seedBuf []byte, hashFunc func([]byte) [32]byte, maxBalance uint64, round uint64) (bool, error) {
 	// Reuse the seed buffer by overwriting the last 8 bytes with the round counter.
 	binary.LittleEndian.PutUint64(seedBuf[len(seedBuf)-8:], round/16)
@@ -224,16 +263,26 @@ func acceptByBalance(st state.ReadOnlyBeaconState, idx primitives.ValidatorIndex
 }
 
 // validIndexedPayloadAttestation verifies the signature of an indexed payload attestation.
-// Spec v1.7.0-alpha.0 (pseudocode):
-// is_valid_indexed_payload_attestation(state: BeaconState, indexed_payload_attestation: IndexedPayloadAttestation) -> bool:
 //
-//	indices = indexed_payload_attestation.attesting_indices
-//	return len(indices) > 0 and indices == sorted(indices) and
-//	  bls.FastAggregateVerify(
-//	    [state.validators[i].pubkey for i in indices],
-//	    compute_signing_root(indexed_payload_attestation.data, get_domain(state, DOMAIN_PTC_ATTESTER, compute_epoch_at_slot(attestation.data.slot)),
-//	    indexed_payload_attestation.signature,
-//	  )
+//	<spec fn="is_valid_indexed_payload_attestation" fork="gloas" hash="d76e0f89">
+//	def is_valid_indexed_payload_attestation(
+//	    state: BeaconState, attestation: IndexedPayloadAttestation
+//	) -> bool:
+//	    """
+//	    Check if ``attestation`` is non-empty, has sorted indices, and has
+//	    a valid aggregate signature.
+//	    """
+//	    # Verify indices are non-empty and sorted
+//	    indices = attestation.attesting_indices
+//	    if len(indices) == 0 or not indices == sorted(indices):
+//	        return False
+//
+//	    # Verify aggregate signature
+//	    pubkeys = [state.validators[i].pubkey for i in indices]
+//	    domain = get_domain(state, DOMAIN_PTC_ATTESTER, compute_epoch_at_slot(attestation.data.slot))
+//	    signing_root = compute_signing_root(attestation.data, domain)
+//	    return bls.FastAggregateVerify(pubkeys, signing_root, attestation.signature)
+//	</spec>
 func validIndexedPayloadAttestation(st state.ReadOnlyBeaconState, att *consensus_types.IndexedPayloadAttestation) error {
 	indices := att.AttestingIndices
 	if len(indices) == 0 || !slices.IsSorted(indices) {

beacon-chain/core/gloas/payload_test.go

@@ -0,0 +1,349 @@
+package gloas
+
+import (
+	"bytes"
+	"context"
+	"testing"
+
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/core/signing"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/state"
+	state_native "github.com/OffchainLabs/prysm/v7/beacon-chain/state/state-native"
+	"github.com/OffchainLabs/prysm/v7/config/params"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/blocks"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/interfaces"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+	"github.com/OffchainLabs/prysm/v7/crypto/bls"
+	enginev1 "github.com/OffchainLabs/prysm/v7/proto/engine/v1"
+	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
+	"github.com/OffchainLabs/prysm/v7/testing/require"
+	"github.com/OffchainLabs/prysm/v7/time/slots"
+	"google.golang.org/protobuf/proto"
+)
+
+type payloadFixture struct {
+	state       state.BeaconState
+	signed      interfaces.ROSignedExecutionPayloadEnvelope
+	signedProto *ethpb.SignedExecutionPayloadEnvelope
+	envelope    *ethpb.ExecutionPayloadEnvelope
+	payload     *enginev1.ExecutionPayloadDeneb
+	slot        primitives.Slot
+}
+
+func buildPayloadFixture(t *testing.T, mutate func(payload *enginev1.ExecutionPayloadDeneb, bid *ethpb.ExecutionPayloadBid, envelope *ethpb.ExecutionPayloadEnvelope)) payloadFixture {
+	t.Helper()
+
+	cfg := params.BeaconConfig()
+	slot := primitives.Slot(5)
+	builderIdx := primitives.BuilderIndex(0)
+
+	sk, err := bls.RandKey()
+	require.NoError(t, err)
+	pk := sk.PublicKey().Marshal()
+
+	randao := bytes.Repeat([]byte{0xAA}, 32)
+	parentHash := bytes.Repeat([]byte{0xBB}, 32)
+	blockHash := bytes.Repeat([]byte{0xCC}, 32)
+
+	withdrawals := []*enginev1.Withdrawal{
+		{Index: 0, ValidatorIndex: 1, Address: bytes.Repeat([]byte{0x01}, 20), Amount: 0},
+	}
+
+	payload := &enginev1.ExecutionPayloadDeneb{
+		ParentHash:    parentHash,
+		FeeRecipient:  bytes.Repeat([]byte{0x01}, 20),
+		StateRoot:     bytes.Repeat([]byte{0x02}, 32),
+		ReceiptsRoot:  bytes.Repeat([]byte{0x03}, 32),
+		LogsBloom:     bytes.Repeat([]byte{0x04}, 256),
+		PrevRandao:    randao,
+		BlockNumber:   1,
+		GasLimit:      1,
+		GasUsed:       0,
+		Timestamp:     100,
+		ExtraData:     []byte{},
+		BaseFeePerGas: bytes.Repeat([]byte{0x05}, 32),
+		BlockHash:     blockHash,
+		Transactions:  [][]byte{},
+		Withdrawals:   withdrawals,
+		BlobGasUsed:   0,
+		ExcessBlobGas: 0,
+	}
+
+	bid := &ethpb.ExecutionPayloadBid{
+		ParentBlockHash:        parentHash,
+		ParentBlockRoot:        bytes.Repeat([]byte{0xDD}, 32),
+		BlockHash:              blockHash,
+		PrevRandao:             randao,
+		GasLimit:               1,
+		BuilderIndex:           builderIdx,
+		Slot:                   slot,
+		Value:                  0,
+		ExecutionPayment:       0,
+		FeeRecipient:           bytes.Repeat([]byte{0xEE}, 20),
+	}
+
+	header := &ethpb.BeaconBlockHeader{
+		Slot:       slot,
+		ParentRoot: bytes.Repeat([]byte{0x11}, 32),
+		StateRoot:  bytes.Repeat([]byte{0x22}, 32),
+		BodyRoot:   bytes.Repeat([]byte{0x33}, 32),
+	}
+	headerRoot, err := header.HashTreeRoot()
+	require.NoError(t, err)
+
+	envelope := &ethpb.ExecutionPayloadEnvelope{
+		Slot:               slot,
+		BuilderIndex:       builderIdx,
+		BeaconBlockRoot:    headerRoot[:],
+		Payload:            payload,
+		ExecutionRequests:  &enginev1.ExecutionRequests{},
+	}
+
+	if mutate != nil {
+		mutate(payload, bid, envelope)
+	}
+
+	genesisRoot := bytes.Repeat([]byte{0xAB}, 32)
+	blockRoots := make([][]byte, cfg.SlotsPerHistoricalRoot)
+	stateRoots := make([][]byte, cfg.SlotsPerHistoricalRoot)
+	for i := range blockRoots {
+		blockRoots[i] = bytes.Repeat([]byte{0x44}, 32)
+		stateRoots[i] = bytes.Repeat([]byte{0x55}, 32)
+	}
+	randaoMixes := make([][]byte, cfg.EpochsPerHistoricalVector)
+	for i := range randaoMixes {
+		randaoMixes[i] = randao
+	}
+
+	withdrawalCreds := make([]byte, 32)
+	withdrawalCreds[0] = cfg.ETH1AddressWithdrawalPrefixByte
+
+	eth1Data := &ethpb.Eth1Data{
+		DepositRoot:  bytes.Repeat([]byte{0x66}, 32),
+		DepositCount: 0,
+		BlockHash:    bytes.Repeat([]byte{0x77}, 32),
+	}
+
+	vals := []*ethpb.Validator{
+		{
+			PublicKey:             pk,
+			WithdrawalCredentials: withdrawalCreds,
+			EffectiveBalance:      cfg.MinActivationBalance + 1_000,
+		},
+	}
+	balances := []uint64{cfg.MinActivationBalance + 1_000}
+
+	payments := make([]*ethpb.BuilderPendingPayment, cfg.SlotsPerEpoch*2)
+	for i := range payments {
+		payments[i] = &ethpb.BuilderPendingPayment{
+			Withdrawal: &ethpb.BuilderPendingWithdrawal{
+				FeeRecipient: make([]byte, 20),
+			},
+		}
+	}
+
+	executionPayloadAvailability := make([]byte, cfg.SlotsPerHistoricalRoot/8)
+
+	builders := make([]*ethpb.Builder, builderIdx+1)
+	builders[builderIdx] = &ethpb.Builder{
+		Pubkey:            pk,
+		Version:           []byte{0},
+		ExecutionAddress:  bytes.Repeat([]byte{0x09}, 20),
+		Balance:           0,
+		DepositEpoch:      0,
+		WithdrawableEpoch: 0,
+	}
+
+	genesisTime := uint64(0)
+	slotSeconds := cfg.SecondsPerSlot * uint64(slot)
+	if payload.Timestamp > slotSeconds {
+		genesisTime = payload.Timestamp - slotSeconds
+	}
+
+	stProto := &ethpb.BeaconStateGloas{
+		Slot:                  slot,
+		GenesisTime:           genesisTime,
+		GenesisValidatorsRoot: genesisRoot,
+		Fork: &ethpb.Fork{
+			CurrentVersion:  bytes.Repeat([]byte{0x01}, 4),
+			PreviousVersion: bytes.Repeat([]byte{0x01}, 4),
+			Epoch:           0,
+		},
+		LatestBlockHeader:            header,
+		BlockRoots:                   blockRoots,
+		StateRoots:                   stateRoots,
+		RandaoMixes:                  randaoMixes,
+		Eth1Data:                     eth1Data,
+		Validators:                   vals,
+		Balances:                     balances,
+		LatestBlockHash:              payload.ParentHash,
+		LatestExecutionPayloadBid:    bid,
+		BuilderPendingPayments:       payments,
+		ExecutionPayloadAvailability: executionPayloadAvailability,
+		BuilderPendingWithdrawals:    []*ethpb.BuilderPendingWithdrawal{},
+		PayloadExpectedWithdrawals:   payload.Withdrawals,
+		Builders:                     builders,
+	}
+
+	st, err := state_native.InitializeFromProtoGloas(stProto)
+	require.NoError(t, err)
+
+	expected := st.Copy()
+	ctx := context.Background()
+	require.NoError(t, processExecutionRequests(ctx, expected, envelope.ExecutionRequests))
+	require.NoError(t, expected.QueueBuilderPayment())
+	require.NoError(t, expected.SetExecutionPayloadAvailability(slot, true))
+	var blockHashArr [32]byte
+	copy(blockHashArr[:], payload.BlockHash)
+	require.NoError(t, expected.SetLatestBlockHash(blockHashArr))
+	expectedRoot, err := expected.HashTreeRoot(ctx)
+	require.NoError(t, err)
+	envelope.StateRoot = expectedRoot[:]
+
+	epoch := slots.ToEpoch(slot)
+	domain, err := signing.Domain(st.Fork(), epoch, cfg.DomainBeaconBuilder, st.GenesisValidatorsRoot())
+	require.NoError(t, err)
+	signingRoot, err := signing.ComputeSigningRoot(envelope, domain)
+	require.NoError(t, err)
+	signature := sk.Sign(signingRoot[:]).Marshal()
+
+	signedProto := &ethpb.SignedExecutionPayloadEnvelope{
+		Message:   envelope,
+		Signature: signature,
+	}
+	signed, err := blocks.WrappedROSignedExecutionPayloadEnvelope(signedProto)
+	require.NoError(t, err)
+
+	return payloadFixture{
+		state:       st,
+		signed:      signed,
+		signedProto: signedProto,
+		envelope:    envelope,
+		payload:     payload,
+		slot:        slot,
+	}
+}
+
+func TestProcessExecutionPayload_Success(t *testing.T) {
+	fixture := buildPayloadFixture(t, nil)
+	require.NoError(t, ProcessExecutionPayload(t.Context(), fixture.state, fixture.signed))
+
+	latestHash, err := fixture.state.LatestBlockHash()
+	require.NoError(t, err)
+	var expectedHash [32]byte
+	copy(expectedHash[:], fixture.payload.BlockHash)
+	require.Equal(t, expectedHash, latestHash)
+
+	slotsPerEpoch := params.BeaconConfig().SlotsPerEpoch
+	paymentIndex := slotsPerEpoch + (fixture.slot % slotsPerEpoch)
+	payments, err := fixture.state.BuilderPendingPayments()
+	require.NoError(t, err)
+	payment := payments[paymentIndex]
+	require.NotNil(t, payment)
+	require.Equal(t, primitives.Gwei(0), payment.Withdrawal.Amount)
+}
+
+func TestProcessExecutionPayload_PrevRandaoMismatch(t *testing.T) {
+	fixture := buildPayloadFixture(t, func(_ *enginev1.ExecutionPayloadDeneb, bid *ethpb.ExecutionPayloadBid, _ *ethpb.ExecutionPayloadEnvelope) {
+		bid.PrevRandao = bytes.Repeat([]byte{0xFF}, 32)
+	})
+
+	err := ProcessExecutionPayload(t.Context(), fixture.state, fixture.signed)
+	require.ErrorContains(t, "prev randao", err)
+}
+
+func TestQueueBuilderPayment_ZeroAmountClearsSlot(t *testing.T) {
+	fixture := buildPayloadFixture(t, nil)
+
+	require.NoError(t, fixture.state.QueueBuilderPayment())
+
+	slotsPerEpoch := params.BeaconConfig().SlotsPerEpoch
+	paymentIndex := slotsPerEpoch + (fixture.slot % slotsPerEpoch)
+	payments, err := fixture.state.BuilderPendingPayments()
+	require.NoError(t, err)
+	payment := payments[paymentIndex]
+	require.NotNil(t, payment)
+	require.Equal(t, primitives.Gwei(0), payment.Withdrawal.Amount)
+}
+
+func TestVerifyExecutionPayloadEnvelopeSignature(t *testing.T) {
+	fixture := buildPayloadFixture(t, nil)
+
+	t.Run("self build", func(t *testing.T) {
+		proposerSk, err := bls.RandKey()
+		require.NoError(t, err)
+		proposerPk := proposerSk.PublicKey().Marshal()
+
+		stPb, ok := fixture.state.ToProtoUnsafe().(*ethpb.BeaconStateGloas)
+		require.Equal(t, true, ok)
+		stPb = proto.Clone(stPb).(*ethpb.BeaconStateGloas)
+		stPb.Validators[0].PublicKey = proposerPk
+		st, err := state_native.InitializeFromProtoUnsafeGloas(stPb)
+		require.NoError(t, err)
+
+		msg := proto.Clone(fixture.signedProto.Message).(*ethpb.ExecutionPayloadEnvelope)
+		msg.BuilderIndex = params.BeaconConfig().BuilderIndexSelfBuild
+
+		epoch := slots.ToEpoch(msg.Slot)
+		domain, err := signing.Domain(st.Fork(), epoch, params.BeaconConfig().DomainBeaconBuilder, st.GenesisValidatorsRoot())
+		require.NoError(t, err)
+		signingRoot, err := signing.ComputeSigningRoot(msg, domain)
+		require.NoError(t, err)
+		signature := proposerSk.Sign(signingRoot[:]).Marshal()
+
+		signedProto := &ethpb.SignedExecutionPayloadEnvelope{
+			Message:   msg,
+			Signature: signature,
+		}
+		signed, err := blocks.WrappedROSignedExecutionPayloadEnvelope(signedProto)
+		require.NoError(t, err)
+
+		require.NoError(t, verifyExecutionPayloadEnvelopeSignature(st, signed))
+	})
+
+	t.Run("builder", func(t *testing.T) {
+		signed, err := blocks.WrappedROSignedExecutionPayloadEnvelope(fixture.signedProto)
+		require.NoError(t, err)
+
+		require.NoError(t, verifyExecutionPayloadEnvelopeSignature(fixture.state, signed))
+	})
+
+	t.Run("invalid signature", func(t *testing.T) {
+		t.Run("self build", func(t *testing.T) {
+			proposerSk, err := bls.RandKey()
+			require.NoError(t, err)
+			proposerPk := proposerSk.PublicKey().Marshal()
+
+			stPb, ok := fixture.state.ToProtoUnsafe().(*ethpb.BeaconStateGloas)
+			require.Equal(t, true, ok)
+			stPb = proto.Clone(stPb).(*ethpb.BeaconStateGloas)
+			stPb.Validators[0].PublicKey = proposerPk
+			st, err := state_native.InitializeFromProtoUnsafeGloas(stPb)
+			require.NoError(t, err)
+
+			msg := proto.Clone(fixture.signedProto.Message).(*ethpb.ExecutionPayloadEnvelope)
+			msg.BuilderIndex = params.BeaconConfig().BuilderIndexSelfBuild
+
+			signedProto := &ethpb.SignedExecutionPayloadEnvelope{
+				Message:   msg,
+				Signature: bytes.Repeat([]byte{0xFF}, 96),
+			}
+			badSigned, err := blocks.WrappedROSignedExecutionPayloadEnvelope(signedProto)
+			require.NoError(t, err)
+
+			err = verifyExecutionPayloadEnvelopeSignature(st, badSigned)
+			require.ErrorContains(t, "invalid signature format", err)
+		})
+
+		t.Run("builder", func(t *testing.T) {
+			signedProto := &ethpb.SignedExecutionPayloadEnvelope{
+				Message:   fixture.signedProto.Message,
+				Signature: bytes.Repeat([]byte{0xFF}, 96),
+			}
+			badSigned, err := blocks.WrappedROSignedExecutionPayloadEnvelope(signedProto)
+			require.NoError(t, err)
+
+			err = verifyExecutionPayloadEnvelopeSignature(fixture.state, badSigned)
+			require.ErrorContains(t, "invalid signature format", err)
+		})
+	})
+}

beacon-chain/core/gloas/pending_payment.go

@@ -10,17 +10,21 @@ import (
 )
 
 // ProcessBuilderPendingPayments processes the builder pending payments from the previous epoch.
-// Spec v1.7.0-alpha.0 (pseudocode):
-// def process_builder_pending_payments(state: BeaconState) -> None:
 //
-//	quorum = get_builder_payment_quorum_threshold(state)
-//	for payment in state.builder_pending_payments[:SLOTS_PER_EPOCH]:
-//	    if payment.weight >= quorum:
-//	        state.builder_pending_withdrawals.append(payment.withdrawal)
+//	<spec fn="process_builder_pending_payments" fork="gloas" hash="10da48dd">
+//	def process_builder_pending_payments(state: BeaconState) -> None:
+//	    """
+//	    Processes the builder pending payments from the previous epoch.
+//	    """
+//	    quorum = get_builder_payment_quorum_threshold(state)
+//	    for payment in state.builder_pending_payments[:SLOTS_PER_EPOCH]:
+//	        if payment.weight >= quorum:
+//	            state.builder_pending_withdrawals.append(payment.withdrawal)
 //
-//	old_payments = state.builder_pending_payments[SLOTS_PER_EPOCH:]
-//	new_payments = [BuilderPendingPayment() for _ in range(SLOTS_PER_EPOCH)]
-//	state.builder_pending_payments = old_payments + new_payments
+//	    old_payments = state.builder_pending_payments[SLOTS_PER_EPOCH:]
+//	    new_payments = [BuilderPendingPayment() for _ in range(SLOTS_PER_EPOCH)]
+//	    state.builder_pending_payments = old_payments + new_payments
+//	</spec>
 func ProcessBuilderPendingPayments(state state.BeaconState) error {
 	quorum, err := builderQuorumThreshold(state)
 	if err != nil {
@@ -53,12 +57,16 @@ func ProcessBuilderPendingPayments(state state.BeaconState) error {
 }
 
 // builderQuorumThreshold calculates the quorum threshold for builder payments.
-// Spec v1.7.0-alpha.0 (pseudocode):
-// def get_builder_payment_quorum_threshold(state: BeaconState) -> uint64:
 //
-//	per_slot_balance = get_total_active_balance(state) // SLOTS_PER_EPOCH
-//	quorum = per_slot_balance * BUILDER_PAYMENT_THRESHOLD_NUMERATOR
-//	return uint64(quorum // BUILDER_PAYMENT_THRESHOLD_DENOMINATOR)
+//	<spec fn="get_builder_payment_quorum_threshold" fork="gloas" hash="a64b7ffb">
+//	def get_builder_payment_quorum_threshold(state: BeaconState) -> uint64:
+//	    """
+//	    Calculate the quorum threshold for builder payments.
+//	    """
+//	    per_slot_balance = get_total_active_balance(state) // SLOTS_PER_EPOCH
+//	    quorum = per_slot_balance * BUILDER_PAYMENT_THRESHOLD_NUMERATOR
+//	    return uint64(quorum // BUILDER_PAYMENT_THRESHOLD_DENOMINATOR)
+//	</spec>
 func builderQuorumThreshold(state state.ReadOnlyBeaconState) (primitives.Gwei, error) {
 	activeBalance, err := helpers.TotalActiveBalance(state)
 	if err != nil {

beacon-chain/core/gloas/proposer_slashing.go

@@ -11,16 +11,20 @@ import (
 )
 
 // RemoveBuilderPendingPayment removes the pending builder payment for the proposal slot.
-// Spec v1.7.0 (pseudocode):
 //
+//	<spec fn="process_proposer_slashing" fork="gloas" lines="22-32" hash="4da721ef">
+//	# [New in Gloas:EIP7732]
+//	# Remove the BuilderPendingPayment corresponding to
+//	# this proposal if it is still in the 2-epoch window.
 //	slot = header_1.slot
 //	proposal_epoch = compute_epoch_at_slot(slot)
 //	if proposal_epoch == get_current_epoch(state):
-//	  payment_index = SLOTS_PER_EPOCH + slot % SLOTS_PER_EPOCH
-//	  state.builder_pending_payments[payment_index] = BuilderPendingPayment()
+//	    payment_index = SLOTS_PER_EPOCH + slot % SLOTS_PER_EPOCH
+//	    state.builder_pending_payments[payment_index] = BuilderPendingPayment()
 //	elif proposal_epoch == get_previous_epoch(state):
-//	  payment_index = slot % SLOTS_PER_EPOCH
-//	  state.builder_pending_payments[payment_index] = BuilderPendingPayment()
+//	    payment_index = slot % SLOTS_PER_EPOCH
+//	    state.builder_pending_payments[payment_index] = BuilderPendingPayment()
+//	</spec>
 func RemoveBuilderPendingPayment(st state.BeaconState, header *eth.BeaconBlockHeader) error {
 	proposalEpoch := slots.ToEpoch(header.Slot)
 	currentEpoch := time.CurrentEpoch(st)

beacon-chain/core/transition/transition.go

@@ -143,10 +143,11 @@ func ProcessSlot(ctx context.Context, state state.BeaconState) (state.BeaconStat
 		return nil, err
 	}
 
-	// Spec v1.6.1 (pseudocode):
+	// <spec fn="process_slot" fork="gloas" lines="11-13" hash="62b28839">
 	// # [New in Gloas:EIP7732]
 	// # Unset the next payload availability
 	// state.execution_payload_availability[(state.slot + 1) % SLOTS_PER_HISTORICAL_ROOT] = 0b0
+	// </spec>
 	if state.Version() >= version.Gloas {
 		index := uint64((state.Slot() + 1) % params.BeaconConfig().SlotsPerHistoricalRoot)
 		if err := state.UpdateExecutionPayloadAvailabilityAtIndex(index, 0x0); err != nil {

beacon-chain/core/transition/transition_gloas_test.go

@@ -78,7 +78,7 @@ func newGloasState(t *testing.T, slot primitives.Slot, availability []byte) stat
 			BlockHash:              make([]byte, 32),
 			PrevRandao:             make([]byte, 32),
 			FeeRecipient:           make([]byte, 20),
-			BlobKzgCommitmentsRoot: make([]byte, 32),
+			BlobKzgCommitments:     [][]byte{make([]byte, 48)},
 		},
 		Eth1Data: &ethpb.Eth1Data{
 			DepositRoot: make([]byte, 32),

beacon-chain/db/iface/interface.go

@@ -66,6 +66,10 @@ type ReadOnlyDatabase interface {
 	OriginCheckpointBlockRoot(ctx context.Context) ([32]byte, error)
 	BackfillStatus(context.Context) (*dbval.BackfillStatus, error)
 
+	// Execution payload envelope operations (Gloas+).
+	ExecutionPayloadEnvelope(ctx context.Context, blockRoot [32]byte) (*ethpb.SignedBlindedExecutionPayloadEnvelope, error)
+	HasExecutionPayloadEnvelope(ctx context.Context, blockRoot [32]byte) bool
+
 	// P2P Metadata operations.
 	MetadataSeqNum(ctx context.Context) (uint64, error)
 }
@@ -115,6 +119,10 @@ type NoHeadAccessDatabase interface {
 	SaveLightClientUpdate(ctx context.Context, period uint64, update interfaces.LightClientUpdate) error
 	SaveLightClientBootstrap(ctx context.Context, blockRoot []byte, bootstrap interfaces.LightClientBootstrap) error
 
+	// Execution payload envelope operations (Gloas+).
+	SaveExecutionPayloadEnvelope(ctx context.Context, envelope *ethpb.SignedExecutionPayloadEnvelope) error
+	DeleteExecutionPayloadEnvelope(ctx context.Context, blockRoot [32]byte) error
+
 	CleanUpDirtyStates(ctx context.Context, slotsPerArchivedPoint primitives.Slot) error
 	DeleteHistoricalDataBeforeSlot(ctx context.Context, slot primitives.Slot, batchSize int) (int, error)
 

beacon-chain/db/kv/BUILD.bazel

@@ -13,6 +13,7 @@ go_library(
         "encoding.go",
         "error.go",
         "execution_chain.go",
+        "execution_payload_envelope.go",
         "finalized_block_roots.go",
         "genesis.go",
         "key.go",
@@ -96,6 +97,7 @@ go_test(
         "deposit_contract_test.go",
         "encoding_test.go",
         "execution_chain_test.go",
+        "execution_payload_envelope_test.go",
         "finalized_block_roots_test.go",
         "genesis_test.go",
         "init_test.go",

beacon-chain/db/kv/archived_point.go

@@ -2,6 +2,7 @@ package kv
 
 import (
 	"context"
+	"slices"
 
 	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
 	"github.com/OffchainLabs/prysm/v7/encoding/bytesutil"
@@ -33,6 +34,9 @@ func (s *Store) LastArchivedRoot(ctx context.Context) [32]byte {
 	if err := s.db.View(func(tx *bolt.Tx) error {
 		bkt := tx.Bucket(stateSlotIndicesBucket)
 		_, blockRoot = bkt.Cursor().Last()
+		if len(blockRoot) > 0 {
+			blockRoot = slices.Clone(blockRoot)
+		}
 		return nil
 	}); err != nil { // This view never returns an error, but we'll handle anyway for sanity.
 		panic(err) // lint:nopanic -- View never returns an error.
@@ -51,6 +55,9 @@ func (s *Store) ArchivedPointRoot(ctx context.Context, slot primitives.Slot) [32
 	if err := s.db.View(func(tx *bolt.Tx) error {
 		bucket := tx.Bucket(stateSlotIndicesBucket)
 		blockRoot = bucket.Get(bytesutil.SlotToBytesBigEndian(slot))
+		if len(blockRoot) > 0 {
+			blockRoot = slices.Clone(blockRoot)
+		}
 		return nil
 	}); err != nil { // This view never returns an error, but we'll handle anyway for sanity.
 		panic(err) // lint:nopanic -- View never returns an error.

beacon-chain/db/kv/blocks.go

@@ -517,6 +517,10 @@ func (s *Store) DeleteHistoricalDataBeforeSlot(ctx context.Context, cutoffSlot p
 				return errors.Wrap(err, "could not delete validators")
 			}
 
+			// TODO: execution payload envelopes (Gloas+) are keyed by execution payload
+			// block hash, not beacon block root, so they cannot be pruned in this loop.
+			// A separate pruning mechanism is needed (e.g. secondary index or cursor scan).
+
 			numSlotsDeleted++
 		}
 
@@ -812,7 +816,10 @@ func (s *Store) FeeRecipientByValidatorID(ctx context.Context, id primitives.Val
 	var addr []byte
 	err := s.db.View(func(tx *bolt.Tx) error {
 		bkt := tx.Bucket(feeRecipientBucket)
-		addr = bkt.Get(bytesutil.Uint64ToBytesBigEndian(uint64(id)))
+		stored := bkt.Get(bytesutil.Uint64ToBytesBigEndian(uint64(id)))
+		if len(stored) > 0 {
+			addr = slices.Clone(stored)
+		}
 		// IF the fee recipient is not found in the standard fee recipient bucket, then
 		// check the registration bucket. The fee recipient may be there.
 		// This is to resolve imcompatility until we fully migrate to the registration bucket.
@@ -826,7 +833,7 @@ func (s *Store) FeeRecipientByValidatorID(ctx context.Context, id primitives.Val
 			if err := decode(ctx, enc, reg); err != nil {
 				return err
 			}
-			addr = reg.FeeRecipient
+			addr = slices.Clone(reg.FeeRecipient)
 		}
 		return nil
 	})
@@ -1247,6 +1254,12 @@ func unmarshalBlock(_ context.Context, enc []byte) (interfaces.ReadOnlySignedBea
 		if err := rawBlock.UnmarshalSSZ(enc[len(fuluBlindKey):]); err != nil {
 			return nil, errors.Wrap(err, "could not unmarshal blinded Fulu block")
 		}
+	case hasGloasKey(enc):
+		// post Gloas we save the full beacon block as EIP-7732 separates beacon block and payload
+		rawBlock = &ethpb.SignedBeaconBlockGloas{}
+		if err := rawBlock.UnmarshalSSZ(enc[len(gloasKey):]); err != nil {
+			return nil, errors.Wrap(err, "could not unmarshal Gloas block")
+		}
 	default:
 		// Marshal block bytes to phase 0 beacon block.
 		rawBlock = &ethpb.SignedBeaconBlock{}
@@ -1277,6 +1290,11 @@ func encodeBlock(blk interfaces.ReadOnlySignedBeaconBlock) ([]byte, error) {
 func keyForBlock(blk interfaces.ReadOnlySignedBeaconBlock) ([]byte, error) {
 	v := blk.Version()
 
+	if v >= version.Gloas {
+		// Gloas blocks are never blinded (no execution payload in block body).
+		return gloasKey, nil
+	}
+
 	if v >= version.Fulu {
 		if blk.IsBlinded() {
 			return fuluBlindKey, nil

beacon-chain/db/kv/blocks_test.go

@@ -151,6 +151,17 @@ var blockTests = []struct {
 			}
 			return blocks.NewSignedBeaconBlock(b)
 		}},
+	{
+		name: "gloas",
+		newBlock: func(slot primitives.Slot, root []byte) (interfaces.ReadOnlySignedBeaconBlock, error) {
+			b := util.NewBeaconBlockGloas()
+			b.Block.Slot = slot
+			if root != nil {
+				b.Block.ParentRoot = root
+			}
+			return blocks.NewSignedBeaconBlock(b)
+		},
+	},
 }
 
 func TestStore_SaveBlock_NoDuplicates(t *testing.T) {
@@ -211,7 +222,7 @@ func TestStore_BlocksCRUD(t *testing.T) {
 			retrievedBlock, err = db.Block(ctx, blockRoot)
 			require.NoError(t, err)
 			wanted := retrievedBlock
-			if retrievedBlock.Version() >= version.Bellatrix {
+			if retrievedBlock.Version() >= version.Bellatrix && retrievedBlock.Version() < version.Gloas {
 				wanted, err = retrievedBlock.ToBlinded()
 				require.NoError(t, err)
 			}
@@ -643,7 +654,7 @@ func TestStore_BlocksCRUD_NoCache(t *testing.T) {
 			require.NoError(t, err)
 
 			wanted := blk
-			if blk.Version() >= version.Bellatrix {
+			if blk.Version() >= version.Bellatrix && blk.Version() < version.Gloas {
 				wanted, err = blk.ToBlinded()
 				require.NoError(t, err)
 			}
@@ -1014,7 +1025,7 @@ func TestStore_SaveBlock_CanGetHighestAt(t *testing.T) {
 			b, err := db.Block(ctx, root)
 			require.NoError(t, err)
 			wanted := block1
-			if block1.Version() >= version.Bellatrix {
+			if block1.Version() >= version.Bellatrix && block1.Version() < version.Gloas {
 				wanted, err = wanted.ToBlinded()
 				require.NoError(t, err)
 			}
@@ -1032,7 +1043,7 @@ func TestStore_SaveBlock_CanGetHighestAt(t *testing.T) {
 			b, err = db.Block(ctx, root)
 			require.NoError(t, err)
 			wanted2 := block2
-			if block2.Version() >= version.Bellatrix {
+			if block2.Version() >= version.Bellatrix && block2.Version() < version.Gloas {
 				wanted2, err = block2.ToBlinded()
 				require.NoError(t, err)
 			}
@@ -1050,7 +1061,7 @@ func TestStore_SaveBlock_CanGetHighestAt(t *testing.T) {
 			b, err = db.Block(ctx, root)
 			require.NoError(t, err)
 			wanted = block3
-			if block3.Version() >= version.Bellatrix {
+			if block3.Version() >= version.Bellatrix && block3.Version() < version.Gloas {
 				wanted, err = wanted.ToBlinded()
 				require.NoError(t, err)
 			}
@@ -1086,7 +1097,7 @@ func TestStore_GenesisBlock_CanGetHighestAt(t *testing.T) {
 			b, err := db.Block(ctx, root)
 			require.NoError(t, err)
 			wanted := block1
-			if block1.Version() >= version.Bellatrix {
+			if block1.Version() >= version.Bellatrix && block1.Version() < version.Gloas {
 				wanted, err = block1.ToBlinded()
 				require.NoError(t, err)
 			}
@@ -1103,7 +1114,7 @@ func TestStore_GenesisBlock_CanGetHighestAt(t *testing.T) {
 			b, err = db.Block(ctx, root)
 			require.NoError(t, err)
 			wanted = genesisBlock
-			if genesisBlock.Version() >= version.Bellatrix {
+			if genesisBlock.Version() >= version.Bellatrix && genesisBlock.Version() < version.Gloas {
 				wanted, err = genesisBlock.ToBlinded()
 				require.NoError(t, err)
 			}
@@ -1120,7 +1131,7 @@ func TestStore_GenesisBlock_CanGetHighestAt(t *testing.T) {
 			b, err = db.Block(ctx, root)
 			require.NoError(t, err)
 			wanted = genesisBlock
-			if genesisBlock.Version() >= version.Bellatrix {
+			if genesisBlock.Version() >= version.Bellatrix && genesisBlock.Version() < version.Gloas {
 				wanted, err = genesisBlock.ToBlinded()
 				require.NoError(t, err)
 			}
@@ -1216,7 +1227,7 @@ func TestStore_BlocksBySlot_BlockRootsBySlot(t *testing.T) {
 			require.NoError(t, err)
 
 			wanted := b1
-			if b1.Version() >= version.Bellatrix {
+			if b1.Version() >= version.Bellatrix && b1.Version() < version.Gloas {
 				wanted, err = b1.ToBlinded()
 				require.NoError(t, err)
 			}
@@ -1232,7 +1243,7 @@ func TestStore_BlocksBySlot_BlockRootsBySlot(t *testing.T) {
 				t.Fatalf("Expected 2 blocks, received %d blocks", len(retrievedBlocks))
 			}
 			wanted = b2
-			if b2.Version() >= version.Bellatrix {
+			if b2.Version() >= version.Bellatrix && b2.Version() < version.Gloas {
 				wanted, err = b2.ToBlinded()
 				require.NoError(t, err)
 			}
@@ -1242,7 +1253,7 @@ func TestStore_BlocksBySlot_BlockRootsBySlot(t *testing.T) {
 			require.NoError(t, err)
 			assert.Equal(t, true, proto.Equal(wantedPb, retrieved0Pb), "Wanted: %v, received: %v", retrievedBlocks[0], wanted)
 			wanted = b3
-			if b3.Version() >= version.Bellatrix {
+			if b3.Version() >= version.Bellatrix && b3.Version() < version.Gloas {
 				wanted, err = b3.ToBlinded()
 				require.NoError(t, err)
 			}

beacon-chain/db/kv/deposit_contract.go

@@ -3,6 +3,7 @@ package kv
 import (
 	"context"
 	"fmt"
+	"slices"
 
 	"github.com/OffchainLabs/prysm/v7/monitoring/tracing/trace"
 	"github.com/ethereum/go-ethereum/common"
@@ -17,7 +18,10 @@ func (s *Store) DepositContractAddress(ctx context.Context) ([]byte, error) {
 	var addr []byte
 	if err := s.db.View(func(tx *bolt.Tx) error {
 		chainInfo := tx.Bucket(chainMetadataBucket)
-		addr = chainInfo.Get(depositContractAddressKey)
+		stored := chainInfo.Get(depositContractAddressKey)
+		if len(stored) > 0 {
+			addr = slices.Clone(stored)
+		}
 		return nil
 	}); err != nil { // This view never returns an error, but we'll handle anyway for sanity.
 		panic(err) // lint:nopanic -- View never returns an error.

beacon-chain/db/kv/execution_payload_envelope.go

@@ -0,0 +1,123 @@
+package kv
+
+import (
+	"context"
+
+	"github.com/OffchainLabs/prysm/v7/encoding/bytesutil"
+	"github.com/OffchainLabs/prysm/v7/monitoring/tracing/trace"
+	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
+	"github.com/golang/snappy"
+	"github.com/pkg/errors"
+	bolt "go.etcd.io/bbolt"
+)
+
+// SaveExecutionPayloadEnvelope blinds and saves a signed execution payload envelope keyed by
+// beacon block root. The envelope is stored in blinded form: the full execution payload is replaced
+// with its block hash. The full payload can later be retrieved from the EL via
+// engine_getPayloadBodiesByHash.
+func (s *Store) SaveExecutionPayloadEnvelope(ctx context.Context, env *ethpb.SignedExecutionPayloadEnvelope) error {
+	_, span := trace.StartSpan(ctx, "BeaconDB.SaveExecutionPayloadEnvelope")
+	defer span.End()
+
+	if env == nil || env.Message == nil || env.Message.Payload == nil {
+		return errors.New("cannot save nil execution payload envelope")
+	}
+
+	blockRoot := bytesutil.ToBytes32(env.Message.BeaconBlockRoot)
+	blinded := blindEnvelope(env)
+
+	enc, err := encodeBlindedEnvelope(blinded)
+	if err != nil {
+		return err
+	}
+
+	return s.db.Update(func(tx *bolt.Tx) error {
+		bkt := tx.Bucket(executionPayloadEnvelopesBucket)
+		return bkt.Put(blockRoot[:], enc)
+	})
+}
+
+// ExecutionPayloadEnvelope retrieves the blinded signed execution payload envelope by beacon block root.
+func (s *Store) ExecutionPayloadEnvelope(ctx context.Context, blockRoot [32]byte) (*ethpb.SignedBlindedExecutionPayloadEnvelope, error) {
+	_, span := trace.StartSpan(ctx, "BeaconDB.ExecutionPayloadEnvelope")
+	defer span.End()
+
+	var enc []byte
+	if err := s.db.View(func(tx *bolt.Tx) error {
+		bkt := tx.Bucket(executionPayloadEnvelopesBucket)
+		enc = bkt.Get(blockRoot[:])
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+	if enc == nil {
+		return nil, errors.Wrap(ErrNotFound, "execution payload envelope not found")
+	}
+	return decodeBlindedEnvelope(enc)
+}
+
+// HasExecutionPayloadEnvelope checks whether an execution payload envelope exists for the given beacon block root.
+func (s *Store) HasExecutionPayloadEnvelope(ctx context.Context, blockRoot [32]byte) bool {
+	_, span := trace.StartSpan(ctx, "BeaconDB.HasExecutionPayloadEnvelope")
+	defer span.End()
+
+	var exists bool
+	if err := s.db.View(func(tx *bolt.Tx) error {
+		bkt := tx.Bucket(executionPayloadEnvelopesBucket)
+		exists = bkt.Get(blockRoot[:]) != nil
+		return nil
+	}); err != nil {
+		return false
+	}
+	return exists
+}
+
+// DeleteExecutionPayloadEnvelope removes a signed execution payload envelope by beacon block root.
+func (s *Store) DeleteExecutionPayloadEnvelope(ctx context.Context, blockRoot [32]byte) error {
+	_, span := trace.StartSpan(ctx, "BeaconDB.DeleteExecutionPayloadEnvelope")
+	defer span.End()
+
+	return s.db.Update(func(tx *bolt.Tx) error {
+		bkt := tx.Bucket(executionPayloadEnvelopesBucket)
+		return bkt.Delete(blockRoot[:])
+	})
+}
+
+// blindEnvelope converts a full signed envelope to its blinded form by replacing
+// the execution payload with its block hash. This avoids computing the expensive
+// payload hash tree root on the critical path.
+func blindEnvelope(env *ethpb.SignedExecutionPayloadEnvelope) *ethpb.SignedBlindedExecutionPayloadEnvelope {
+	return &ethpb.SignedBlindedExecutionPayloadEnvelope{
+		Message: &ethpb.BlindedExecutionPayloadEnvelope{
+			BlockHash:         env.Message.Payload.BlockHash,
+			ExecutionRequests: env.Message.ExecutionRequests,
+			BuilderIndex:      env.Message.BuilderIndex,
+			BeaconBlockRoot:   env.Message.BeaconBlockRoot,
+			Slot:              env.Message.Slot,
+			StateRoot:         env.Message.StateRoot,
+		},
+		Signature: env.Signature,
+	}
+}
+
+// encodeBlindedEnvelope SSZ-encodes and snappy-compresses a blinded envelope for storage.
+func encodeBlindedEnvelope(env *ethpb.SignedBlindedExecutionPayloadEnvelope) ([]byte, error) {
+	sszBytes, err := env.MarshalSSZ()
+	if err != nil {
+		return nil, errors.Wrap(err, "could not marshal blinded envelope")
+	}
+	return snappy.Encode(nil, sszBytes), nil
+}
+
+// decodeBlindedEnvelope snappy-decompresses and SSZ-decodes a blinded envelope from storage.
+func decodeBlindedEnvelope(enc []byte) (*ethpb.SignedBlindedExecutionPayloadEnvelope, error) {
+	dec, err := snappy.Decode(nil, enc)
+	if err != nil {
+		return nil, errors.Wrap(err, "could not snappy decode envelope")
+	}
+	blinded := &ethpb.SignedBlindedExecutionPayloadEnvelope{}
+	if err := blinded.UnmarshalSSZ(dec); err != nil {
+		return nil, errors.Wrap(err, "could not unmarshal blinded envelope")
+	}
+	return blinded, nil
+}

beacon-chain/db/kv/execution_payload_envelope_test.go

@@ -0,0 +1,124 @@
+package kv
+
+import (
+	"context"
+	"testing"
+
+	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+	"github.com/OffchainLabs/prysm/v7/encoding/bytesutil"
+	enginev1 "github.com/OffchainLabs/prysm/v7/proto/engine/v1"
+	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
+	"github.com/OffchainLabs/prysm/v7/testing/assert"
+	"github.com/OffchainLabs/prysm/v7/testing/require"
+)
+
+func testEnvelope(t *testing.T) *ethpb.SignedExecutionPayloadEnvelope {
+	t.Helper()
+	return &ethpb.SignedExecutionPayloadEnvelope{
+		Message: &ethpb.ExecutionPayloadEnvelope{
+			Payload: &enginev1.ExecutionPayloadDeneb{
+				ParentHash:    bytesutil.PadTo([]byte("parent"), 32),
+				FeeRecipient:  bytesutil.PadTo([]byte("fee"), 20),
+				StateRoot:     bytesutil.PadTo([]byte("stateroot"), 32),
+				ReceiptsRoot:  bytesutil.PadTo([]byte("receipts"), 32),
+				LogsBloom:     bytesutil.PadTo([]byte{}, 256),
+				PrevRandao:    bytesutil.PadTo([]byte("randao"), 32),
+				BlockNumber:   100,
+				GasLimit:      30000000,
+				GasUsed:       21000,
+				Timestamp:     1000,
+				ExtraData:     []byte("extra"),
+				BaseFeePerGas: bytesutil.PadTo([]byte{1}, 32),
+				BlockHash:     bytesutil.PadTo([]byte("blockhash"), 32),
+				Transactions:  [][]byte{[]byte("tx1"), []byte("tx2")},
+				Withdrawals:   []*enginev1.Withdrawal{{Index: 1, ValidatorIndex: 2, Address: bytesutil.PadTo([]byte("addr"), 20), Amount: 100}},
+				BlobGasUsed:   131072,
+				ExcessBlobGas: 0,
+			},
+			ExecutionRequests: &enginev1.ExecutionRequests{},
+			BuilderIndex:      primitives.BuilderIndex(42),
+			BeaconBlockRoot:   bytesutil.PadTo([]byte("beaconroot"), 32),
+			Slot:              primitives.Slot(99),
+			StateRoot:         bytesutil.PadTo([]byte("envelopestateroot"), 32),
+		},
+		Signature: bytesutil.PadTo([]byte("sig"), 96),
+	}
+}
+
+func TestStore_SaveAndRetrieveExecutionPayloadEnvelope(t *testing.T) {
+	db := setupDB(t)
+	ctx := context.Background()
+	env := testEnvelope(t)
+
+	// Keyed by beacon block root.
+	blockRoot := bytesutil.ToBytes32(env.Message.BeaconBlockRoot)
+
+	// Initially should not exist.
+	assert.Equal(t, false, db.HasExecutionPayloadEnvelope(ctx, blockRoot))
+
+	// Save (always blinds internally).
+	require.NoError(t, db.SaveExecutionPayloadEnvelope(ctx, env))
+
+	// Should exist now.
+	assert.Equal(t, true, db.HasExecutionPayloadEnvelope(ctx, blockRoot))
+
+	// Load and verify it's blinded.
+	loaded, err := db.ExecutionPayloadEnvelope(ctx, blockRoot)
+	require.NoError(t, err)
+
+	// Verify metadata is preserved.
+	assert.Equal(t, env.Message.Slot, loaded.Message.Slot)
+	assert.Equal(t, env.Message.BuilderIndex, loaded.Message.BuilderIndex)
+	assert.DeepEqual(t, env.Message.BeaconBlockRoot, loaded.Message.BeaconBlockRoot)
+	assert.DeepEqual(t, env.Message.StateRoot, loaded.Message.StateRoot)
+	assert.DeepEqual(t, env.Signature, loaded.Signature)
+
+	// BlockHash should be the payload's block hash (not a hash tree root).
+	assert.DeepEqual(t, env.Message.Payload.BlockHash, loaded.Message.BlockHash)
+}
+
+func TestStore_DeleteExecutionPayloadEnvelope(t *testing.T) {
+	db := setupDB(t)
+	ctx := context.Background()
+	env := testEnvelope(t)
+	blockRoot := bytesutil.ToBytes32(env.Message.BeaconBlockRoot)
+
+	require.NoError(t, db.SaveExecutionPayloadEnvelope(ctx, env))
+	assert.Equal(t, true, db.HasExecutionPayloadEnvelope(ctx, blockRoot))
+
+	require.NoError(t, db.DeleteExecutionPayloadEnvelope(ctx, blockRoot))
+	assert.Equal(t, false, db.HasExecutionPayloadEnvelope(ctx, blockRoot))
+}
+
+func TestStore_ExecutionPayloadEnvelope_NotFound(t *testing.T) {
+	db := setupDB(t)
+	ctx := context.Background()
+	nonExistent := bytesutil.ToBytes32([]byte("nonexistent"))
+
+	_, err := db.ExecutionPayloadEnvelope(ctx, nonExistent)
+	require.ErrorContains(t, "not found", err)
+}
+
+func TestStore_SaveExecutionPayloadEnvelope_NilRejected(t *testing.T) {
+	db := setupDB(t)
+	ctx := context.Background()
+
+	err := db.SaveExecutionPayloadEnvelope(ctx, nil)
+	require.ErrorContains(t, "nil", err)
+}
+
+func TestBlindEnvelope_PreservesBlockHash(t *testing.T) {
+	env := testEnvelope(t)
+
+	blinded := blindEnvelope(env)
+
+	// Should contain the block hash from the payload, not a hash tree root.
+	assert.DeepEqual(t, env.Message.Payload.BlockHash, blinded.Message.BlockHash)
+
+	// Metadata should be preserved.
+	assert.Equal(t, env.Message.BuilderIndex, blinded.Message.BuilderIndex)
+	assert.Equal(t, env.Message.Slot, blinded.Message.Slot)
+	assert.DeepEqual(t, env.Message.BeaconBlockRoot, blinded.Message.BeaconBlockRoot)
+	assert.DeepEqual(t, env.Message.StateRoot, blinded.Message.StateRoot)
+	assert.DeepEqual(t, env.Signature, blinded.Signature)
+}

beacon-chain/db/kv/key.go

@@ -87,3 +87,10 @@ func hasFuluBlindKey(enc []byte) bool {
 	}
 	return bytes.Equal(enc[:len(fuluBlindKey)], fuluBlindKey)
 }
+
+func hasGloasKey(enc []byte) bool {
+	if len(gloasKey) >= len(enc) {
+		return false
+	}
+	return bytes.Equal(enc[:len(gloasKey)], gloasKey)
+}

beacon-chain/db/kv/kv.go

@@ -126,6 +126,7 @@ var Buckets = [][]byte{
 	feeRecipientBucket,
 	registrationBucket,
 	custodyBucket,
+	executionPayloadEnvelopesBucket,
 }
 
 // KVStoreOption is a functional option that modifies a kv.Store.

beacon-chain/db/kv/migration_state_validators.go

@@ -199,7 +199,7 @@ func performValidatorStateMigration(ctx context.Context, bar *progressbar.Progre
 func stateBucketKeys(stateBucket *bolt.Bucket) ([][]byte, error) {
 	var keys [][]byte
 	if err := stateBucket.ForEach(func(pubKey, v []byte) error {
-		keys = append(keys, pubKey)
+		keys = append(keys, bytes.Clone(pubKey))
 		return nil
 	}); err != nil {
 		return nil, err

beacon-chain/db/kv/schema.go

@@ -7,16 +7,17 @@ package kv
 // it easy to scan for keys that have a certain shard number as a prefix and return those
 // corresponding attestations.
 var (
-	blocksBucket          = []byte("blocks")
-	stateBucket           = []byte("state")
-	stateSummaryBucket    = []byte("state-summary")
-	chainMetadataBucket   = []byte("chain-metadata")
-	checkpointBucket      = []byte("check-point")
-	powchainBucket        = []byte("powchain")
-	stateValidatorsBucket = []byte("state-validators")
-	feeRecipientBucket    = []byte("fee-recipient")
-	registrationBucket    = []byte("registration")
-	stateDiffBucket       = []byte("state-diff")
+	blocksBucket                    = []byte("blocks")
+	stateBucket                     = []byte("state")
+	stateSummaryBucket              = []byte("state-summary")
+	chainMetadataBucket             = []byte("chain-metadata")
+	checkpointBucket                = []byte("check-point")
+	powchainBucket                  = []byte("powchain")
+	stateValidatorsBucket           = []byte("state-validators")
+	feeRecipientBucket              = []byte("fee-recipient")
+	registrationBucket              = []byte("registration")
+	stateDiffBucket                 = []byte("state-diff")
+	executionPayloadEnvelopesBucket = []byte("execution-payload-envelopes")
 
 	// Light Client Updates Bucket
 	lightClientUpdatesBucket       = []byte("light-client-updates")
@@ -60,6 +61,8 @@ var (
 	electraBlindKey            = []byte("blind-electra")
 	fuluKey                    = []byte("fulu")
 	fuluBlindKey               = []byte("blind-fulu")
+	gloasKey                   = []byte("gloas")
+	// No gloasBlindKey needed - Gloas blocks are never blinded (no execution payload in block body).
 
 	// block root included in the beacon state used by weak subjectivity initial sync
 	originCheckpointBlockRootKey = []byte("origin-checkpoint-block-root")

beacon-chain/db/kv/state_diff.go

@@ -2,6 +2,7 @@ package kv
 
 import (
 	"context"
+	"slices"
 
 	"github.com/OffchainLabs/prysm/v7/beacon-chain/state"
 	"github.com/OffchainLabs/prysm/v7/cmd/beacon-chain/flags"
@@ -187,20 +188,23 @@ func (s *Store) getDiff(lvl int, slot uint64) (hdiff.HdiffBytes, error) {
 			return bolt.ErrBucketNotFound
 		}
 		buf := append(key, stateSuffix...)
-		stateDiff = bucket.Get(buf)
-		if stateDiff == nil {
+		rawStateDiff := bucket.Get(buf)
+		if len(rawStateDiff) == 0 {
 			return errors.New("state diff not found")
 		}
+		stateDiff = slices.Clone(rawStateDiff)
 		buf = append(key, validatorSuffix...)
-		validatorDiff = bucket.Get(buf)
-		if validatorDiff == nil {
+		rawValidatorDiff := bucket.Get(buf)
+		if len(rawValidatorDiff) == 0 {
 			return errors.New("validator diff not found")
 		}
+		validatorDiff = slices.Clone(rawValidatorDiff)
 		buf = append(key, balancesSuffix...)
-		balancesDiff = bucket.Get(buf)
-		if balancesDiff == nil {
+		rawBalancesDiff := bucket.Get(buf)
+		if len(rawBalancesDiff) == 0 {
 			return errors.New("balances diff not found")
 		}
+		balancesDiff = slices.Clone(rawBalancesDiff)
 		return nil
 	})
 
@@ -224,10 +228,11 @@ func (s *Store) getFullSnapshot(slot uint64) (state.BeaconState, error) {
 		if bucket == nil {
 			return bolt.ErrBucketNotFound
 		}
-		enc = bucket.Get(key)
-		if enc == nil {
+		rawEnc := bucket.Get(key)
+		if rawEnc == nil {
 			return errors.New("state not found")
 		}
+		enc = slices.Clone(rawEnc)
 		return nil
 	})
 

beacon-chain/db/kv/state_summary.go

@@ -2,6 +2,7 @@ package kv
 
 import (
 	"context"
+	"slices"
 
 	"github.com/OffchainLabs/prysm/v7/encoding/bytesutil"
 	"github.com/OffchainLabs/prysm/v7/monitoring/tracing/trace"
@@ -47,7 +48,11 @@ func (s *Store) StateSummary(ctx context.Context, blockRoot [32]byte) (*ethpb.St
 	}
 	var enc []byte
 	if err := s.db.View(func(tx *bolt.Tx) error {
-		enc = tx.Bucket(stateSummaryBucket).Get(blockRoot[:])
+		rawEnc := tx.Bucket(stateSummaryBucket).Get(blockRoot[:])
+		if len(rawEnc) == 0 {
+			return nil
+		}
+		enc = slices.Clone(rawEnc)
 		return nil
 	}); err != nil {
 		return nil, err

beacon-chain/execution/BUILD.bazel

@@ -8,6 +8,7 @@ go_library(
         "deposit.go",
         "engine_client.go",
         "errors.go",
+        "graffiti_info.go",
         "log.go",
         "log_processing.go",
         "metrics.go",
@@ -89,6 +90,7 @@ go_test(
         "engine_client_fuzz_test.go",
         "engine_client_test.go",
         "execution_chain_test.go",
+        "graffiti_info_test.go",
         "init_test.go",
         "log_processing_test.go",
         "mock_test.go",

beacon-chain/execution/engine_client.go

@@ -61,7 +61,17 @@ var (
 	}
 )
 
+// ClientVersionV1 represents the response from engine_getClientVersionV1.
+type ClientVersionV1 struct {
+	Code    string `json:"code"`
+	Name    string `json:"name"`
+	Version string `json:"version"`
+	Commit  string `json:"commit"`
+}
+
 const (
+	// GetClientVersionMethod is the engine_getClientVersionV1 method for JSON-RPC.
+	GetClientVersionMethod = "engine_getClientVersionV1"
 	// NewPayloadMethod v1 request string for JSON-RPC.
 	NewPayloadMethod = "engine_newPayloadV1"
 	// NewPayloadMethodV2 v2 request string for JSON-RPC.
@@ -350,6 +360,24 @@ func (s *Service) ExchangeCapabilities(ctx context.Context) ([]string, error) {
 	return elSupportedEndpointsSlice, nil
 }
 
+// GetClientVersion calls engine_getClientVersionV1 to retrieve EL client information.
+func (s *Service) GetClientVersion(ctx context.Context) ([]ClientVersionV1, error) {
+	ctx, span := trace.StartSpan(ctx, "powchain.engine-api-client.GetClientVersion")
+	defer span.End()
+
+	// Per spec, we send our own client info as the parameter
+	clVersion := ClientVersionV1{
+		Code:    CLCode,
+		Name:    Name,
+		Version: version.SemanticVersion(),
+		Commit:  version.GetCommitPrefix(),
+	}
+
+	var result []ClientVersionV1
+	err := s.rpcClient.CallContext(ctx, &result, GetClientVersionMethod, clVersion)
+	return result, handleRPCError(err)
+}
+
 // GetTerminalBlockHash returns the valid terminal block hash based on total difficulty.
 //
 // Spec code:

beacon-chain/execution/graffiti_info.go

@@ -0,0 +1,134 @@
+package execution
+
+import (
+	"strings"
+	"sync"
+
+	"github.com/OffchainLabs/prysm/v7/runtime/version"
+)
+
+const (
+	// CLCode is the two-letter client code for Prysm.
+	CLCode = "PR"
+	Name   = "Prysm"
+)
+
+// GraffitiInfo holds version information for generating block graffiti.
+// It is thread-safe and can be updated by the execution service and read by the validator server.
+type GraffitiInfo struct {
+	mu       sync.RWMutex
+	elCode   string // From engine_getClientVersionV1
+	elCommit string // From engine_getClientVersionV1
+	logOnce  sync.Once
+}
+
+// NewGraffitiInfo creates a new GraffitiInfo.
+func NewGraffitiInfo() *GraffitiInfo {
+	return &GraffitiInfo{}
+}
+
+// UpdateFromEngine updates the EL client information.
+func (g *GraffitiInfo) UpdateFromEngine(code, commit string) {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	g.elCode = code
+	g.elCommit = strings.TrimPrefix(commit, "0x")
+}
+
+// GenerateGraffiti generates graffiti using the flexible standard
+// with the provided user graffiti from the validator client request.
+// It places user graffiti first, then appends as much client info as space allows.
+//
+// A space separator is added between user graffiti and client info when it
+// fits without reducing the client version tier.
+//
+// Available Space | Format
+// ≥13 bytes       | user + space + EL(2)+commit(4)+CL(2)+commit(4)  e.g. "Sushi GEabcdPRe4f6"
+// 12 bytes        | user + EL(2)+commit(4)+CL(2)+commit(4)          e.g. "12345678901234567890GEabcdPRe4f6"
+// 9-11 bytes      | user + space + EL(2)+commit(2)+CL(2)+commit(2)  e.g. "12345678901234567890123 GEabPRe4"
+// 8 bytes         | user + EL(2)+commit(2)+CL(2)+commit(2)          e.g. "123456789012345678901234GEabPRe4"
+// 5-7 bytes       | user + space + EL(2)+CL(2)                      e.g. "123456789012345678901234567 GEPR"
+// 4 bytes         | user + EL(2)+CL(2)                              e.g. "1234567890123456789012345678GEPR"
+// 3 bytes         | user + space + code(2)                          e.g. "12345678901234567890123456789 GE"
+// 2 bytes         | user + code(2)                                  e.g. "123456789012345678901234567890GE"
+// <2 bytes        | user only                                       e.g. "1234567890123456789012345678901x"
+func (g *GraffitiInfo) GenerateGraffiti(userGraffiti []byte) [32]byte {
+	g.mu.RLock()
+	defer g.mu.RUnlock()
+
+	var result [32]byte
+	userStr := string(userGraffiti)
+	// Trim trailing null bytes
+	for len(userStr) > 0 && userStr[len(userStr)-1] == 0 {
+		userStr = userStr[:len(userStr)-1]
+	}
+
+	available := 32 - len(userStr)
+
+	clCommit := version.GetCommitPrefix()
+	clCommit4 := truncateCommit(clCommit, 4)
+	clCommit2 := truncateCommit(clCommit, 2)
+
+	// If no EL info, clear EL commits but still include CL info
+	var elCommit4, elCommit2 string
+	if g.elCode != "" {
+		elCommit4 = truncateCommit(g.elCommit, 4)
+		elCommit2 = truncateCommit(g.elCommit, 2)
+	}
+
+	// Add a space separator between user graffiti and client info,
+	// but only if it won't reduce the space available for client version info.
+	space := func(minForTier int) string {
+		if len(userStr) > 0 && available >= minForTier+1 {
+			return " "
+		}
+		return ""
+	}
+
+	var graffiti string
+	switch {
+	case available >= 12:
+		// Full: user+EL(2)+commit(4)+CL(2)+commit(4)
+		graffiti = userStr + space(12) + g.elCode + elCommit4 + CLCode + clCommit4
+	case available >= 8:
+		// Reduced commits: user+EL(2)+commit(2)+CL(2)+commit(2)
+		graffiti = userStr + space(8) + g.elCode + elCommit2 + CLCode + clCommit2
+	case available >= 4:
+		// Codes only: user+EL(2)+CL(2)
+		graffiti = userStr + space(4) + g.elCode + CLCode
+	case available >= 2:
+		// Single code: user+code(2)
+		if g.elCode != "" {
+			graffiti = userStr + space(2) + g.elCode
+		} else {
+			graffiti = userStr + space(2) + CLCode
+		}
+	default:
+		// User graffiti only
+		graffiti = userStr
+	}
+
+	g.logOnce.Do(func() {
+		logGraffitiInfo(graffiti, available)
+	})
+
+	copy(result[:], graffiti)
+	return result
+}
+
+// logGraffitiInfo logs the graffiti that will be used.
+func logGraffitiInfo(graffiti string, available int) {
+	if available >= 2 {
+		log.WithField("graffiti", graffiti).Info("Graffiti includes client version info appended after user graffiti")
+		return
+	}
+	log.WithField("graffiti", graffiti).Info("Prysm adds consensus and execution debugging information to the end of the graffiti field when possible. To prevent deletion of debugging info, please consider using a shorter graffiti")
+}
+
+// truncateCommit returns the first n characters of the commit string.
+func truncateCommit(commit string, n int) string {
+	if len(commit) <= n {
+		return commit
+	}
+	return commit[:n]
+}

beacon-chain/execution/graffiti_info_test.go

@@ -0,0 +1,250 @@
+package execution
+
+import (
+	"testing"
+
+	"github.com/OffchainLabs/prysm/v7/testing/require"
+)
+
+func TestGraffitiInfo_GenerateGraffiti(t *testing.T) {
+	tests := []struct {
+		name         string
+		elCode       string
+		elCommit     string
+		userGraffiti []byte
+		wantPrefix   string // user graffiti appears first
+		wantSuffix   string // client version info appended after
+	}{
+		// No EL info cases (CL info "PR" + commit still included when space allows)
+		{
+			name:         "No EL - empty user graffiti",
+			elCode:       "",
+			elCommit:     "",
+			userGraffiti: []byte{},
+			wantPrefix:   "PR", // Only CL code + commit (no user graffiti to prefix)
+		},
+		{
+			name:         "No EL - short user graffiti",
+			elCode:       "",
+			elCommit:     "",
+			userGraffiti: []byte("my validator"),
+			wantPrefix:   "my validator",
+			wantSuffix:   " PR", // space + CL code appended
+		},
+		{
+			name:         "No EL - 28 char user graffiti (4 bytes available)",
+			elCode:       "",
+			elCommit:     "",
+			userGraffiti: []byte("1234567890123456789012345678"), // 28 chars, 4 bytes available = codes only
+			wantPrefix:   "1234567890123456789012345678",
+			wantSuffix:   "PR", // CL code (no EL, so just PR)
+		},
+		{
+			name:         "No EL - 30 char user graffiti (2 bytes available)",
+			elCode:       "",
+			elCommit:     "",
+			userGraffiti: []byte("123456789012345678901234567890"), // 30 chars, 2 bytes available = fits PR
+			wantPrefix:   "123456789012345678901234567890",
+			wantSuffix:   "PR",
+		},
+		{
+			name:         "No EL - 31 char user graffiti (1 byte available)",
+			elCode:       "",
+			elCommit:     "",
+			userGraffiti: []byte("1234567890123456789012345678901"), // 31 chars, 1 byte available = not enough for code
+			wantPrefix:   "1234567890123456789012345678901",         // User only
+		},
+		{
+			name:         "No EL - 32 char user graffiti (0 bytes available)",
+			elCode:       "",
+			elCommit:     "",
+			userGraffiti: []byte("12345678901234567890123456789012"),
+			wantPrefix:   "12345678901234567890123456789012", // User only
+		},
+		// With EL info - flexible standard format cases
+		{
+			name:         "With EL - full format (empty user graffiti)",
+			elCode:       "GE",
+			elCommit:     "abcd1234",
+			userGraffiti: []byte{},
+			wantPrefix:   "GEabcdPR", // No user graffiti, starts with client info
+		},
+		{
+			name:         "With EL - full format (short user graffiti)",
+			elCode:       "GE",
+			elCommit:     "abcd1234",
+			userGraffiti: []byte("Bob"),
+			wantPrefix:   "Bob",
+			wantSuffix:   " GEabcdPR", // space + EL(2)+commit(4)+CL(2)+commit(4)
+		},
+		{
+			name:         "With EL - full format (20 char user, 12 bytes available) - no space, would reduce tier",
+			elCode:       "GE",
+			elCommit:     "abcd1234",
+			userGraffiti: []byte("12345678901234567890"), // 20 chars, leaves exactly 12 bytes = full format, no room for space
+			wantPrefix:   "12345678901234567890",
+			wantSuffix:   "GEabcdPR",
+		},
+		{
+			name:         "With EL - full format (19 char user, 13 bytes available) - space fits",
+			elCode:       "GE",
+			elCommit:     "abcd1234",
+			userGraffiti: []byte("1234567890123456789"), // 19 chars, leaves 13 bytes = full format + space
+			wantPrefix:   "1234567890123456789",
+			wantSuffix:   " GEabcdPR", 
+		},
+		{
+			name:         "With EL - reduced commits (24 char user, 8 bytes available) - no space, would reduce tier",
+			elCode:       "GE",
+			elCommit:     "abcd1234",
+			userGraffiti: []byte("123456789012345678901234"), // 24 chars, leaves exactly 8 bytes = reduced format, no room for space
+			wantPrefix:   "123456789012345678901234",
+			wantSuffix:   "GEabPR", 
+		},
+		{
+			name:         "With EL - reduced commits (23 char user, 9 bytes available) - space fits",
+			elCode:       "GE",
+			elCommit:     "abcd1234",
+			userGraffiti: []byte("12345678901234567890123"), // 23 chars, leaves 9 bytes = reduced format + space
+			wantPrefix:   "12345678901234567890123",
+			wantSuffix:   " GEabPR", 
+		},
+		{
+			name:         "With EL - codes only (28 char user, 4 bytes available) - no space, would reduce tier",
+			elCode:       "GE",
+			elCommit:     "abcd1234",
+			userGraffiti: []byte("1234567890123456789012345678"), // 28 chars, leaves exactly 4 bytes = codes only, no room for space
+			wantPrefix:   "1234567890123456789012345678",
+			wantSuffix:   "GEPR",
+		},
+		{
+			name:         "With EL - codes only (27 char user, 5 bytes available) - space fits",
+			elCode:       "GE",
+			elCommit:     "abcd1234",
+			userGraffiti: []byte("123456789012345678901234567"), // 27 chars, leaves 5 bytes = codes only + space
+			wantPrefix:   "123456789012345678901234567",
+			wantSuffix:   " GEPR",
+		},
+		{
+			name:         "With EL - EL code only (30 char user, 2 bytes available) - no space, would reduce tier",
+			elCode:       "GE",
+			elCommit:     "abcd1234",
+			userGraffiti: []byte("123456789012345678901234567890"), // 30 chars, leaves exactly 2 bytes = EL code only, no room for space
+			wantPrefix:   "123456789012345678901234567890",
+			wantSuffix:   "GE",
+		},
+		{
+			name:         "With EL - EL code only (29 char user, 3 bytes available) - space fits",
+			elCode:       "GE",
+			elCommit:     "abcd1234",
+			userGraffiti: []byte("12345678901234567890123456789"), // 29 chars, leaves 3 bytes = EL code + space
+			wantPrefix:   "12345678901234567890123456789",
+			wantSuffix:   " GE",
+		},
+		{
+			name:         "With EL - user only (31 char user, 1 byte available)",
+			elCode:       "GE",
+			elCommit:     "abcd1234",
+			userGraffiti: []byte("1234567890123456789012345678901"), // 31 chars, leaves 1 byte = not enough for code
+			wantPrefix:   "1234567890123456789012345678901",         // User only
+		},
+		{
+			name:         "With EL - user only (32 char user, 0 bytes available)",
+			elCode:       "GE",
+			elCommit:     "abcd1234",
+			userGraffiti: []byte("12345678901234567890123456789012"),
+			wantPrefix:   "12345678901234567890123456789012",
+		},
+		// Null byte handling
+		{
+			name:         "Null bytes - input with trailing nulls",
+			elCode:       "GE",
+			elCommit:     "abcd1234",
+			userGraffiti: append([]byte("test"), 0, 0, 0),
+			wantPrefix:   "test",
+			wantSuffix:   " GEabcdPR",
+		},
+		// 0x prefix handling - some ELs return 0x-prefixed commits
+		{
+			name:         "0x prefix - stripped from EL commit",
+			elCode:       "GE",
+			elCommit:     "0xabcd1234",
+			userGraffiti: []byte{},
+			wantPrefix:   "GEabcdPR",
+		},
+		{
+			name:         "No 0x prefix - commit used as-is",
+			elCode:       "NM",
+			elCommit:     "abcd1234",
+			userGraffiti: []byte{},
+			wantPrefix:   "NMabcdPR",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			g := NewGraffitiInfo()
+			if tt.elCode != "" {
+				g.UpdateFromEngine(tt.elCode, tt.elCommit)
+			}
+
+			result := g.GenerateGraffiti(tt.userGraffiti)
+			resultStr := string(result[:])
+			trimmed := trimNullBytes(resultStr)
+
+			// Check prefix (user graffiti comes first)
+			require.Equal(t, true, len(trimmed) >= len(tt.wantPrefix), "Result too short for prefix check")
+			require.Equal(t, tt.wantPrefix, trimmed[:len(tt.wantPrefix)], "Prefix mismatch")
+
+			// Check suffix if specified (client version info appended)
+			if tt.wantSuffix != "" {
+				require.Equal(t, true, len(trimmed) >= len(tt.wantSuffix), "Result too short for suffix check")
+				// The suffix should appear somewhere after the prefix
+				afterPrefix := trimmed[len(tt.wantPrefix):]
+				require.Equal(t, true, len(afterPrefix) >= len(tt.wantSuffix), "Not enough room for suffix after prefix")
+				require.Equal(t, tt.wantSuffix, afterPrefix[:len(tt.wantSuffix)], "Suffix mismatch")
+			}
+		})
+	}
+}
+
+func TestGraffitiInfo_UpdateFromEngine(t *testing.T) {
+	g := NewGraffitiInfo()
+
+	// Initially no EL info - should still have CL info (PR + commit)
+	result := g.GenerateGraffiti([]byte{})
+	resultStr := trimNullBytes(string(result[:]))
+	require.Equal(t, "PR", resultStr[:2], "Expected CL info before update")
+
+	// Update with EL info
+	g.UpdateFromEngine("GE", "1234abcd")
+
+	result = g.GenerateGraffiti([]byte{})
+	resultStr = trimNullBytes(string(result[:]))
+	require.Equal(t, "GE1234PR", resultStr[:8], "Expected EL+CL info after update")
+}
+
+func TestTruncateCommit(t *testing.T) {
+	tests := []struct {
+		commit string
+		n      int
+		want   string
+	}{
+		{"abcd1234", 4, "abcd"},
+		{"ab", 4, "ab"},
+		{"", 4, ""},
+		{"abcdef", 2, "ab"},
+	}
+
+	for _, tt := range tests {
+		got := truncateCommit(tt.commit, tt.n)
+		require.Equal(t, tt.want, got)
+	}
+}
+
+func trimNullBytes(s string) string {
+	for len(s) > 0 && s[len(s)-1] == 0 {
+		s = s[:len(s)-1]
+	}
+	return s
+}

beacon-chain/execution/options.go

@@ -124,3 +124,11 @@ func WithVerifierWaiter(v *verification.InitializerWaiter) Option {
 		return nil
 	}
 }
+
+// WithGraffitiInfo sets the GraffitiInfo for client version tracking.
+func WithGraffitiInfo(g *GraffitiInfo) Option {
+	return func(s *Service) error {
+		s.graffitiInfo = g
+		return nil
+	}
+}

beacon-chain/execution/service.go

@@ -162,6 +162,7 @@ type Service struct {
 	verifierWaiter          *verification.InitializerWaiter
 	blobVerifier            verification.NewBlobVerifier
 	capabilityCache         *capabilityCache
+	graffitiInfo            *GraffitiInfo
 }
 
 // NewService sets up a new instance with an ethclient when given a web3 endpoint as a string in the config.
@@ -318,6 +319,28 @@ func (s *Service) updateConnectedETH1(state bool) {
 	s.updateBeaconNodeStats()
 }
 
+// GraffitiInfo returns the GraffitiInfo struct for graffiti generation.
+func (s *Service) GraffitiInfo() *GraffitiInfo {
+	return s.graffitiInfo
+}
+
+// updateGraffitiInfo fetches EL client version and updates the graffiti info.
+func (s *Service) updateGraffitiInfo() {
+	if s.graffitiInfo == nil {
+		return
+	}
+	ctx, cancel := context.WithTimeout(s.ctx, time.Second)
+	defer cancel()
+	versions, err := s.GetClientVersion(ctx)
+	if err != nil {
+		log.WithError(err).Debug("Could not get execution client version for graffiti")
+		return
+	}
+	if len(versions) >= 1 {
+		s.graffitiInfo.UpdateFromEngine(versions[0].Code, versions[0].Commit)
+	}
+}
+
 // refers to the latest eth1 block which follows the condition: eth1_timestamp +
 // SECONDS_PER_ETH1_BLOCK * ETH1_FOLLOW_DISTANCE <= current_unix_time
 func (s *Service) followedBlockHeight(ctx context.Context) (uint64, error) {
@@ -598,6 +621,12 @@ func (s *Service) run(done <-chan struct{}) {
 	chainstartTicker := time.NewTicker(logPeriod)
 	defer chainstartTicker.Stop()
 
+	// Update graffiti info 4 times per epoch (~96 seconds with 12s slots and 32 slots/epoch)
+	graffitiTicker := time.NewTicker(96 * time.Second)
+	defer graffitiTicker.Stop()
+	// Initial update
+	s.updateGraffitiInfo()
+
 	for {
 		select {
 		case <-done:
@@ -622,6 +651,8 @@ func (s *Service) run(done <-chan struct{}) {
 				continue
 			}
 			s.logTillChainStart(context.Background())
+		case <-graffitiTicker.C:
+			s.updateGraffitiInfo()
 		}
 	}
 }

beacon-chain/forkchoice/doubly-linked-tree/BUILD.bazel

@@ -6,7 +6,6 @@ go_library(
         "doc.go",
         "errors.go",
         "forkchoice.go",
-        "last_root.go",
         "log.go",
         "metrics.go",
         "node.go",
@@ -51,7 +50,6 @@ go_test(
     srcs = [
         "ffg_update_test.go",
         "forkchoice_test.go",
-        "last_root_test.go",
         "no_vote_test.go",
         "node_test.go",
         "on_tick_test.go",

beacon-chain/forkchoice/doubly-linked-tree/forkchoice.go

@@ -32,7 +32,6 @@ func New() *ForkChoice {
 		finalizedCheckpoint:           &forkchoicetypes.Checkpoint{},
 		proposerBoostRoot:             [32]byte{},
 		nodeByRoot:                    make(map[[fieldparams.RootLength]byte]*Node),
-		nodeByPayload:                 make(map[[fieldparams.RootLength]byte]*Node),
 		slashedIndices:                make(map[primitives.ValidatorIndex]bool),
 		receivedBlocksLastEpoch:       [fieldparams.SlotsPerEpoch]primitives.Slot{},
 	}

beacon-chain/forkchoice/doubly-linked-tree/last_root.go

@@ -1,26 +0,0 @@
-package doublylinkedtree
-
-import (
-	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
-	"github.com/OffchainLabs/prysm/v7/time/slots"
-)
-
-// LastRoot returns the last canonical block root in the given epoch
-func (f *ForkChoice) LastRoot(epoch primitives.Epoch) [32]byte {
-	head := f.store.headNode
-	headEpoch := slots.ToEpoch(head.slot)
-	epochEnd, err := slots.EpochEnd(epoch)
-	if err != nil {
-		return [32]byte{}
-	}
-	if headEpoch <= epoch {
-		return head.root
-	}
-	for head != nil && head.slot > epochEnd {
-		head = head.parent
-	}
-	if head == nil {
-		return [32]byte{}
-	}
-	return head.root
-}

beacon-chain/forkchoice/doubly-linked-tree/last_root_test.go

@@ -1,38 +0,0 @@
-package doublylinkedtree
-
-import (
-	"testing"
-
-	"github.com/OffchainLabs/prysm/v7/config/params"
-	"github.com/OffchainLabs/prysm/v7/testing/require"
-)
-
-func TestLastRoot(t *testing.T) {
-	f := setup(0, 0)
-	ctx := t.Context()
-
-	st, root, err := prepareForkchoiceState(ctx, 1, [32]byte{'1'}, params.BeaconConfig().ZeroHash, [32]byte{'1'}, 0, 0)
-	require.NoError(t, err)
-	require.NoError(t, f.InsertNode(ctx, st, root))
-	st, root, err = prepareForkchoiceState(ctx, 2, [32]byte{'2'}, [32]byte{'1'}, [32]byte{'2'}, 0, 0)
-	require.NoError(t, err)
-	require.NoError(t, f.InsertNode(ctx, st, root))
-	st, root, err = prepareForkchoiceState(ctx, 3, [32]byte{'3'}, [32]byte{'1'}, [32]byte{'3'}, 0, 0)
-	require.NoError(t, err)
-	require.NoError(t, f.InsertNode(ctx, st, root))
-	st, root, err = prepareForkchoiceState(ctx, 32, [32]byte{'4'}, [32]byte{'3'}, [32]byte{'4'}, 0, 0)
-	require.NoError(t, err)
-	require.NoError(t, f.InsertNode(ctx, st, root))
-	st, root, err = prepareForkchoiceState(ctx, 33, [32]byte{'5'}, [32]byte{'2'}, [32]byte{'5'}, 0, 0)
-	require.NoError(t, err)
-	require.NoError(t, f.InsertNode(ctx, st, root))
-	st, root, err = prepareForkchoiceState(ctx, 34, [32]byte{'6'}, [32]byte{'5'}, [32]byte{'6'}, 0, 0)
-	require.NoError(t, err)
-	require.NoError(t, f.InsertNode(ctx, st, root))
-	headNode := f.store.nodeByRoot[[32]byte{'6'}]
-	f.store.headNode = headNode
-	require.Equal(t, [32]byte{'6'}, f.store.headNode.root)
-	require.Equal(t, [32]byte{'2'}, f.LastRoot(0))
-	require.Equal(t, [32]byte{'6'}, f.LastRoot(1))
-	require.Equal(t, [32]byte{'6'}, f.LastRoot(2))
-}

beacon-chain/forkchoice/doubly-linked-tree/optimistic_sync.go

@@ -94,6 +94,5 @@ func (s *Store) removeNodeAndChildren(ctx context.Context, node *Node, invalidRo
 		s.previousProposerBoostScore = 0
 	}
 	delete(s.nodeByRoot, node.root)
-	delete(s.nodeByPayload, node.payloadHash)
 	return invalidRoots, nil
 }

beacon-chain/forkchoice/doubly-linked-tree/store.go

@@ -113,7 +113,6 @@ func (s *Store) insert(ctx context.Context,
 		}
 	}
 
-	s.nodeByPayload[payloadHash] = n
 	s.nodeByRoot[root] = n
 	if parent == nil {
 		if s.treeRootNode == nil {
@@ -122,7 +121,6 @@ func (s *Store) insert(ctx context.Context,
 			s.highestReceivedNode = n
 		} else {
 			delete(s.nodeByRoot, root)
-			delete(s.nodeByPayload, payloadHash)
 			return nil, errInvalidParentRoot
 		}
 	} else {
@@ -191,7 +189,6 @@ func (s *Store) pruneFinalizedNodeByRootMap(ctx context.Context, node, finalized
 
 	node.children = nil
 	delete(s.nodeByRoot, node.root)
-	delete(s.nodeByPayload, node.payloadHash)
 	return nil
 }
 
@@ -273,21 +270,6 @@ func (f *ForkChoice) HighestReceivedBlockSlot() primitives.Slot {
 	return f.store.highestReceivedNode.slot
 }
 
-// HighestReceivedBlockDelay returns the number of slots that the highest
-// received block was late when receiving it. For example, a block was late by 12 slots,
-// then this method is expected to return 12.
-func (f *ForkChoice) HighestReceivedBlockDelay() primitives.Slot {
-	n := f.store.highestReceivedNode
-	if n == nil {
-		return 0
-	}
-	sss, err := slots.SinceSlotStart(n.slot, f.store.genesisTime, n.timestamp)
-	if err != nil {
-		return 0
-	}
-	return primitives.Slot(uint64(sss/time.Second) / params.BeaconConfig().SecondsPerSlot)
-}
-
 // ReceivedBlocksLastEpoch returns the number of blocks received in the last epoch
 func (f *ForkChoice) ReceivedBlocksLastEpoch() (uint64, error) {
 	count := uint64(0)

beacon-chain/forkchoice/doubly-linked-tree/store_test.go

@@ -128,10 +128,9 @@ func TestStore_Insert(t *testing.T) {
 	// The new node does not have a parent.
 	treeRootNode := &Node{slot: 0, root: indexToHash(0)}
 	nodeByRoot := map[[32]byte]*Node{indexToHash(0): treeRootNode}
-	nodeByPayload := map[[32]byte]*Node{indexToHash(0): treeRootNode}
 	jc := &forkchoicetypes.Checkpoint{Epoch: 0}
 	fc := &forkchoicetypes.Checkpoint{Epoch: 0}
-	s := &Store{nodeByRoot: nodeByRoot, treeRootNode: treeRootNode, nodeByPayload: nodeByPayload, justifiedCheckpoint: jc, finalizedCheckpoint: fc, highestReceivedNode: &Node{}}
+	s := &Store{nodeByRoot: nodeByRoot, treeRootNode: treeRootNode, justifiedCheckpoint: jc, finalizedCheckpoint: fc, highestReceivedNode: &Node{}}
 	payloadHash := [32]byte{'a'}
 	ctx := t.Context()
 	_, blk, err := prepareForkchoiceState(ctx, 100, indexToHash(100), indexToHash(0), payloadHash, 1, 1)
@@ -238,7 +237,6 @@ func TestStore_Prune_NoDanglingBranch(t *testing.T) {
 	s.finalizedCheckpoint.Root = indexToHash(1)
 	require.NoError(t, s.prune(t.Context()))
 	require.Equal(t, len(s.nodeByRoot), 1)
-	require.Equal(t, len(s.nodeByPayload), 1)
 }
 
 // This test starts with the following branching diagram
@@ -319,8 +317,6 @@ func TestStore_PruneMapsNodes(t *testing.T) {
 	s.finalizedCheckpoint.Root = indexToHash(1)
 	require.NoError(t, s.prune(t.Context()))
 	require.Equal(t, len(s.nodeByRoot), 1)
-	require.Equal(t, len(s.nodeByPayload), 1)
-
 }
 
 func TestForkChoice_ReceivedBlocksLastEpoch(t *testing.T) {
@@ -339,7 +335,6 @@ func TestForkChoice_ReceivedBlocksLastEpoch(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, uint64(1), count)
 	require.Equal(t, primitives.Slot(1), f.HighestReceivedBlockSlot())
-	require.Equal(t, primitives.Slot(0), f.HighestReceivedBlockDelay())
 
 	// 64
 	// Received block last epoch is 1
@@ -352,7 +347,6 @@ func TestForkChoice_ReceivedBlocksLastEpoch(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, uint64(1), count)
 	require.Equal(t, primitives.Slot(64), f.HighestReceivedBlockSlot())
-	require.Equal(t, primitives.Slot(0), f.HighestReceivedBlockDelay())
 
 	// 64 65
 	// Received block last epoch is 2
@@ -365,7 +359,6 @@ func TestForkChoice_ReceivedBlocksLastEpoch(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, uint64(2), count)
 	require.Equal(t, primitives.Slot(65), f.HighestReceivedBlockSlot())
-	require.Equal(t, primitives.Slot(1), f.HighestReceivedBlockDelay())
 
 	// 64 65 66
 	// Received block last epoch is 3
@@ -717,17 +710,3 @@ func TestStore_CleanupInserting(t *testing.T) {
 	require.NotNil(t, f.InsertNode(ctx, st, blk))
 	require.Equal(t, false, f.HasNode(blk.Root()))
 }
-
-func TestStore_HighestReceivedBlockDelay(t *testing.T) {
-	f := ForkChoice{
-		store: &Store{
-			genesisTime: time.Unix(0, 0),
-			highestReceivedNode: &Node{
-				slot:      10,
-				timestamp: time.Unix(int64(((10 + 12) * params.BeaconConfig().SecondsPerSlot)), 0), // 12 slots late
-			},
-		},
-	}
-
-	require.Equal(t, primitives.Slot(12), f.HighestReceivedBlockDelay())
-}

beacon-chain/forkchoice/doubly-linked-tree/types.go

@@ -36,7 +36,6 @@ type Store struct {
 	treeRootNode                  *Node                                  // the root node of the store tree.
 	headNode                      *Node                                  // last head Node
 	nodeByRoot                    map[[fieldparams.RootLength]byte]*Node // nodes indexed by roots.
-	nodeByPayload                 map[[fieldparams.RootLength]byte]*Node // nodes indexed by payload Hash
 	slashedIndices                map[primitives.ValidatorIndex]bool     // the list of equivocating validator indices
 	originRoot                    [fieldparams.RootLength]byte           // The genesis block root
 	genesisTime                   time.Time

beacon-chain/forkchoice/interfaces.go

@@ -67,13 +67,11 @@ type FastGetter interface {
 	HasNode([32]byte) bool
 	HighestReceivedBlockSlot() primitives.Slot
 	HighestReceivedBlockRoot() [32]byte
-	HighestReceivedBlockDelay() primitives.Slot
 	IsCanonical(root [32]byte) bool
 	IsOptimistic(root [32]byte) (bool, error)
 	IsViableForCheckpoint(*forkchoicetypes.Checkpoint) (bool, error)
 	JustifiedCheckpoint() *forkchoicetypes.Checkpoint
 	JustifiedPayloadBlockHash() [32]byte
-	LastRoot(primitives.Epoch) [32]byte
 	NodeCount() int
 	PreviousJustifiedCheckpoint() *forkchoicetypes.Checkpoint
 	ProposerBoost() [fieldparams.RootLength]byte

beacon-chain/forkchoice/ro.go

@@ -121,13 +121,6 @@ func (ro *ROForkChoice) HighestReceivedBlockRoot() [32]byte {
 	return ro.getter.HighestReceivedBlockRoot()
 }
 
-// HighestReceivedBlockDelay delegates to the underlying forkchoice call, under a lock.
-func (ro *ROForkChoice) HighestReceivedBlockDelay() primitives.Slot {
-	ro.l.RLock()
-	defer ro.l.RUnlock()
-	return ro.getter.HighestReceivedBlockDelay()
-}
-
 // ReceivedBlocksLastEpoch delegates to the underlying forkchoice call, under a lock.
 func (ro *ROForkChoice) ReceivedBlocksLastEpoch() (uint64, error) {
 	ro.l.RLock()
@@ -163,13 +156,6 @@ func (ro *ROForkChoice) Slot(root [32]byte) (primitives.Slot, error) {
 	return ro.getter.Slot(root)
 }
 
-// LastRoot delegates to the underlying forkchoice call, under a lock.
-func (ro *ROForkChoice) LastRoot(e primitives.Epoch) [32]byte {
-	ro.l.RLock()
-	defer ro.l.RUnlock()
-	return ro.getter.LastRoot(e)
-}
-
 // DependentRoot delegates to the underlying forkchoice call, under a lock.
 func (ro *ROForkChoice) DependentRoot(epoch primitives.Epoch) ([32]byte, error) {
 	ro.l.RLock()

beacon-chain/forkchoice/ro_test.go

@@ -30,7 +30,6 @@ const (
 	nodeCountCalled
 	highestReceivedBlockSlotCalled
 	highestReceivedBlockRootCalled
-	highestReceivedBlockDelayCalled
 	receivedBlocksLastEpochCalled
 	weightCalled
 	isOptimisticCalled
@@ -118,11 +117,6 @@ func TestROLocking(t *testing.T) {
 			call: highestReceivedBlockSlotCalled,
 			cb:   func(g FastGetter) { g.HighestReceivedBlockSlot() },
 		},
-		{
-			name: "highestReceivedBlockDelayCalled",
-			call: highestReceivedBlockDelayCalled,
-			cb:   func(g FastGetter) { g.HighestReceivedBlockDelay() },
-		},
 		{
 			name: "receivedBlocksLastEpochCalled",
 			call: receivedBlocksLastEpochCalled,
@@ -148,11 +142,6 @@ func TestROLocking(t *testing.T) {
 			call: slotCalled,
 			cb:   func(g FastGetter) { _, err := g.Slot([32]byte{}); _discard(t, err) },
 		},
-		{
-			name: "lastRootCalled",
-			call: lastRootCalled,
-			cb:   func(g FastGetter) { g.LastRoot(0) },
-		},
 		{
 			name: "targetRootForEpochCalled",
 			call: targetRootForEpochCalled,
@@ -265,11 +254,6 @@ func (ro *mockROForkchoice) HighestReceivedBlockRoot() [32]byte {
 	return [32]byte{}
 }
 
-func (ro *mockROForkchoice) HighestReceivedBlockDelay() primitives.Slot {
-	ro.calls = append(ro.calls, highestReceivedBlockDelayCalled)
-	return 0
-}
-
 func (ro *mockROForkchoice) ReceivedBlocksLastEpoch() (uint64, error) {
 	ro.calls = append(ro.calls, receivedBlocksLastEpochCalled)
 	return 0, nil
@@ -295,11 +279,6 @@ func (ro *mockROForkchoice) Slot(_ [32]byte) (primitives.Slot, error) {
 	return 0, nil
 }
 
-func (ro *mockROForkchoice) LastRoot(_ primitives.Epoch) [32]byte {
-	ro.calls = append(ro.calls, lastRootCalled)
-	return [32]byte{}
-}
-
 // DependentRoot impoements FastGetter.
 func (ro *mockROForkchoice) DependentRoot(_ primitives.Epoch) ([32]byte, error) {
 	ro.calls = append(ro.calls, dependentRootCalled)

beacon-chain/graffiti/graffiti-proposal-brief.md

@@ -1,95 +0,0 @@
-# Graffiti Version Info Implementation
-
-## Summary
-Add automatic EL+CL version info to block graffiti following [ethereum/execution-apis#517](https://github.com/ethereum/execution-apis/pull/517). Uses the [flexible standard](https://hackmd.io/@wmoBhF17RAOH2NZ5bNXJVg/BJX2c9gja) to pack client info into leftover space after user graffiti.
-
-More details: https://github.com/ethereum/execution-apis/blob/main/src/engine/identification.md 
-
-## Implementation
-
-### Core Component: GraffitiInfo Struct
-Thread-safe struct holding version information:
-```go
-const clCode = "PR"
-
-type GraffitiInfo struct {
-    mu           sync.RWMutex
-    userGraffiti string  // From --graffiti flag (set once at startup)
-    clCommit     string  // From version.GetCommitPrefix() helper function
-    elCode       string  // From engine_getClientVersionV1
-    elCommit     string  // From engine_getClientVersionV1
-}
-```
-
-### Flow
-1. **Startup**: Parse flags, create GraffitiInfo with user graffiti and CL info.
-2. **Wiring**: Pass struct to both execution service and RPC validator server
-3. **Runtime**: Execution service goroutine periodically calls `engine_getClientVersionV1` and updates EL fields
-4. **Block Proposal**: RPC validator server calls `GenerateGraffiti()` to get formatted graffiti
-
-### Flexible Graffiti Format
-Packs as much client info as space allows (after user graffiti):
-
-| Available Space | Format | Example |
-|----------------|--------|---------|
-| ≥12 bytes | `EL(2)+commit(4)+CL(2)+commit(4)+user` | `GE168dPR63afBob` |
-| 8-11 bytes | `EL(2)+commit(2)+CL(2)+commit(2)+user` | `GE16PR63my node here` |
-| 4-7 bytes | `EL(2)+CL(2)+user` | `GEPRthis is my graffiti msg` |
-| 2-3 bytes | `EL(2)+user` | `GEalmost full graffiti message` |
-| <2 bytes | user only | `full 32 byte user graffiti here` |
-
-```go
-func (g *GraffitiInfo) GenerateGraffiti() [32]byte {
-    available := 32 - len(userGraffiti)
-
-    if elCode == "" {
-        elCommit2 = elCommit4 = ""
-    }
-
-    switch {
-    case available >= 12:
-        return elCode + elCommit4 + clCode + clCommit4 + userGraffiti
-    case available >= 8:
-        return elCode + elCommit2 + clCode + clCommit2 + userGraffiti
-    case available >= 4:
-        return elCode + clCode + userGraffiti
-    case available >= 2:
-        return elCode + userGraffiti
-    default:
-        return userGraffiti
-    }
-}
-```
-
-### Update Logic
-Single testable function in execution service:
-```go
-func (s *Service) updateGraffitiInfo() {
-    versions, err := s.GetClientVersion(ctx)
-    if err != nil {
-        return  // Keep last good value
-    }
-    if len(versions) == 1 {
-        s.graffitiInfo.UpdateFromEngine(versions[0].Code, versions[0].Commit)
-    }
-}
-```
-
-Goroutine calls this on `slot % 8 == 4` timing (4 times per epoch, avoids slot boundaries).
-
-### Files Changes Required
-
-**New:**
-- `beacon-chain/execution/graffiti_info.go` - The struct and methods
-- `beacon-chain/execution/graffiti_info_test.go` - Unit tests
-- `runtime/version/version.go` - Add `GetCommitPrefix()` helper that extracts first 4 hex chars from the git commit injected via Bazel ldflags at build time
-
-**Modified:**
-- `beacon-chain/execution/service.go` - Add goroutine + updateGraffitiInfo()
-- `beacon-chain/execution/engine_client.go` - Add GetClientVersion() method that does engine call
-- `beacon-chain/rpc/.../validator/proposer.go` - Call GenerateGraffiti()
-- `beacon-chain/node/node.go` - Wire GraffitiInfo to services
-
-### Testing Strategy
-- Unit test GraffitiInfo methods (priority logic, thread safety)
-- Unit test updateGraffitiInfo() with mocked engine client

beacon-chain/node/node.go

@@ -785,6 +785,9 @@ func (b *BeaconNode) registerPOWChainService() error {
 		return err
 	}
 
+	// Create GraffitiInfo for client version tracking in block graffiti
+	graffitiInfo := execution.NewGraffitiInfo()
+
 	// skipcq: CRT-D0001
 	opts := append(
 		b.serviceFlagOpts.executionChainFlagOpts,
@@ -797,6 +800,7 @@ func (b *BeaconNode) registerPOWChainService() error {
 		execution.WithFinalizedStateAtStartup(b.finalizedStateAtStartUp),
 		execution.WithJwtId(b.cliCtx.String(flags.JwtId.Name)),
 		execution.WithVerifierWaiter(b.verifyInitWaiter),
+		execution.WithGraffitiInfo(graffitiInfo),
 	)
 	web3Service, err := execution.NewService(b.ctx, opts...)
 	if err != nil {
@@ -1003,6 +1007,7 @@ func (b *BeaconNode) registerRPCService(router *http.ServeMux) error {
 		TrackedValidatorsCache:    b.trackedValidatorsCache,
 		PayloadIDCache:            b.payloadIDCache,
 		LCStore:                   b.lcStore,
+		GraffitiInfo:              web3Service.GraffitiInfo(),
 	})
 
 	return b.services.RegisterService(rpcService)

beacon-chain/p2p/gossip_topic_mappings.go

@@ -25,6 +25,8 @@ var gossipTopicMappings = map[string]func() proto.Message{
 	LightClientOptimisticUpdateTopicFormat:    func() proto.Message { return &ethpb.LightClientOptimisticUpdateAltair{} },
 	LightClientFinalityUpdateTopicFormat:      func() proto.Message { return &ethpb.LightClientFinalityUpdateAltair{} },
 	DataColumnSubnetTopicFormat:               func() proto.Message { return &ethpb.DataColumnSidecar{} },
+	PayloadAttestationMessageTopicFormat:      func() proto.Message { return &ethpb.PayloadAttestationMessage{} },
+	ExecutionPayloadEnvelopeTopicFormat:       func() proto.Message { return &ethpb.SignedExecutionPayloadEnvelope{} },
 }
 
 // GossipTopicMappings is a function to return the assigned data type
@@ -144,4 +146,7 @@ func init() {
 
 	// Specially handle Fulu objects.
 	GossipTypeMapping[reflect.TypeFor[*ethpb.SignedBeaconBlockFulu]()] = BlockSubnetTopicFormat
+
+	// Payload attestation messages.
+	GossipTypeMapping[reflect.TypeFor[*ethpb.PayloadAttestationMessage]()] = PayloadAttestationMessageTopicFormat
 }

beacon-chain/p2p/testing/p2p.go

@@ -138,6 +138,9 @@ func connect(a, b host.Host) error {
 func (p *TestP2P) ReceiveRPC(topic string, msg proto.Message) {
 	h, err := libp2p.New(libp2p.ResourceManager(&network.NullResourceManager{}))
 	require.NoError(p.t, err)
+	p.t.Cleanup(func() {
+		require.NoError(p.t, h.Close())
+	})
 	if err := connect(h, p.BHost); err != nil {
 		p.t.Fatalf("Failed to connect two peers for RPC: %v", err)
 	}
@@ -169,6 +172,9 @@ func (p *TestP2P) ReceiveRPC(topic string, msg proto.Message) {
 func (p *TestP2P) ReceivePubSub(topic string, msg proto.Message) {
 	h, err := libp2p.New(libp2p.ResourceManager(&network.NullResourceManager{}))
 	require.NoError(p.t, err)
+	p.t.Cleanup(func() {
+		require.NoError(p.t, h.Close())
+	})
 	ps, err := pubsub.NewFloodSub(context.Background(), h,
 		pubsub.WithMessageSigning(false),
 		pubsub.WithStrictSignatureVerification(false),

beacon-chain/p2p/topics.go

@@ -46,6 +46,10 @@ const (
 	GossipLightClientOptimisticUpdateMessage = "light_client_optimistic_update"
 	// GossipDataColumnSidecarMessage is the name for the data column sidecar message type.
 	GossipDataColumnSidecarMessage = "data_column_sidecar"
+	// GossipPayloadAttestationMessageMessage is the name for the payload attestation message type.
+	GossipPayloadAttestationMessageMessage = "payload_attestation_message"
+	// GossipExecutionPayloadEnvelopeMessage is the name for the execution payload envelope message type.
+	GossipExecutionPayloadEnvelopeMessage = "execution_payload_envelope"
 
 	// Topic Formats
 	//
@@ -75,6 +79,10 @@ const (
 	LightClientOptimisticUpdateTopicFormat = GossipProtocolAndDigest + GossipLightClientOptimisticUpdateMessage
 	// DataColumnSubnetTopicFormat is the topic format for the data column subnet.
 	DataColumnSubnetTopicFormat = GossipProtocolAndDigest + GossipDataColumnSidecarMessage + "_%d"
+	// PayloadAttestationMessageTopicFormat is the topic format for payload attestation messages.
+	PayloadAttestationMessageTopicFormat = GossipProtocolAndDigest + GossipPayloadAttestationMessageMessage
+	// ExecutionPayloadEnvelopeTopicFormat is the topic format for execution payload envelopes.
+	ExecutionPayloadEnvelopeTopicFormat = GossipProtocolAndDigest + GossipExecutionPayloadEnvelopeMessage
 )
 
 // topic is a struct representing a single gossipsub topic.
@@ -141,7 +149,7 @@ func (s *Service) allTopics() []topic {
 	cfg := params.BeaconConfig()
 	// bellatrix: no special topics; electra: blobs topics handled all together
 	genesis, altair, capella := cfg.GenesisEpoch, cfg.AltairForkEpoch, cfg.CapellaForkEpoch
-	deneb, fulu, future := cfg.DenebForkEpoch, cfg.FuluForkEpoch, cfg.FarFutureEpoch
+	deneb, fulu, gloas, future := cfg.DenebForkEpoch, cfg.FuluForkEpoch, cfg.GloasForkEpoch, cfg.FarFutureEpoch
 	// Templates are starter topics - they have a placeholder digest and the subnet is set to the maximum value
 	// for the subnet (see how this is used in allSubnetsBelow). These are not directly returned by the method,
 	// they are copied and modified for each digest where they apply based on the start and end epochs.
@@ -158,6 +166,8 @@ func (s *Service) allTopics() []topic {
 		newTopic(altair, future, empty, GossipLightClientOptimisticUpdateMessage),
 		newTopic(altair, future, empty, GossipLightClientFinalityUpdateMessage),
 		newTopic(capella, future, empty, GossipBlsToExecutionChangeMessage),
+		newTopic(gloas, future, empty, GossipPayloadAttestationMessageMessage),
+		newTopic(gloas, future, empty, GossipExecutionPayloadEnvelopeMessage),
 	}
 	last := params.GetNetworkScheduleEntry(genesis)
 	schedule := []params.NetworkScheduleEntry{last}

beacon-chain/rpc/eth/config/handlers_test.go

@@ -86,6 +86,7 @@ func TestGetSpec(t *testing.T) {
 	config.GloasForkEpoch = 110
 	config.BLSWithdrawalPrefixByte = byte('b')
 	config.ETH1AddressWithdrawalPrefixByte = byte('c')
+	config.BuilderWithdrawalPrefixByte = byte('e')
 	config.GenesisDelay = 24
 	config.SecondsPerSlot = 25
 	config.SlotDurationMilliseconds = 120

beacon-chain/rpc/prysm/v1alpha1/validator/proposer.go

@@ -89,7 +89,13 @@ func (vs *Server) GetBeaconBlock(ctx context.Context, req *ethpb.BlockRequest) (
 	}
 	// Set slot, graffiti, randao reveal, and parent root.
 	sBlk.SetSlot(req.Slot)
-	sBlk.SetGraffiti(req.Graffiti)
+	// Generate graffiti with client version info using flexible standard
+	if vs.GraffitiInfo != nil {
+		graffiti := vs.GraffitiInfo.GenerateGraffiti(req.Graffiti)
+		sBlk.SetGraffiti(graffiti[:])
+	} else {
+		sBlk.SetGraffiti(req.Graffiti)
+	}
 	sBlk.SetRandaoReveal(req.RandaoReveal)
 	sBlk.SetParentRoot(parentRoot[:])
 

beacon-chain/rpc/prysm/v1alpha1/validator/server.go

@@ -83,6 +83,7 @@ type Server struct {
 	ClockWaiter             startup.ClockWaiter
 	CoreService             *core.Service
 	AttestationStateFetcher blockchain.AttestationStateFetcher
+	GraffitiInfo            *execution.GraffitiInfo
 }
 
 // Deprecated: The gRPC API will remain the default and fully supported through v8 (expected in 2026) but will be eventually removed in favor of REST API.

beacon-chain/rpc/service.go

@@ -125,6 +125,7 @@ type Config struct {
 	TrackedValidatorsCache    *cache.TrackedValidatorsCache
 	PayloadIDCache            *cache.PayloadIDCache
 	LCStore                   *lightClient.Store
+	GraffitiInfo              *execution.GraffitiInfo
 }
 
 // NewService instantiates a new RPC service instance that will
@@ -256,6 +257,7 @@ func NewService(ctx context.Context, cfg *Config) *Service {
 		TrackedValidatorsCache:  s.cfg.TrackedValidatorsCache,
 		PayloadIDCache:          s.cfg.PayloadIDCache,
 		AttestationStateFetcher: s.cfg.AttestationReceiver,
+		GraffitiInfo:            s.cfg.GraffitiInfo,
 	}
 	s.validatorServer = validatorServer
 	nodeServer := &nodev1alpha1.Server{

beacon-chain/state/interfaces_gloas.go

@@ -1,24 +1,55 @@
 package state
 
 import (
+	fieldparams "github.com/OffchainLabs/prysm/v7/config/fieldparams"
 	"github.com/OffchainLabs/prysm/v7/consensus-types/interfaces"
 	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+	enginev1 "github.com/OffchainLabs/prysm/v7/proto/engine/v1"
 	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
 )
 
 type writeOnlyGloasFields interface {
+	// Bids.
 	SetExecutionPayloadBid(h interfaces.ROExecutionPayloadBid) error
+
+	// Builder pending payments / withdrawals.
 	SetBuilderPendingPayment(index primitives.Slot, payment *ethpb.BuilderPendingPayment) error
 	ClearBuilderPendingPayment(index primitives.Slot) error
+	QueueBuilderPayment() error
 	RotateBuilderPendingPayments() error
 	AppendBuilderPendingWithdrawals([]*ethpb.BuilderPendingWithdrawal) error
+
+	// Execution payload availability.
 	UpdateExecutionPayloadAvailabilityAtIndex(idx uint64, val byte) error
+
+	// Misc.
+	SetLatestBlockHash(hash [32]byte) error
+	SetExecutionPayloadAvailability(index primitives.Slot, available bool) error
+
+	// Builders.
+	IncreaseBuilderBalance(index primitives.BuilderIndex, amount uint64) error
+	AddBuilderFromDeposit(pubkey [fieldparams.BLSPubkeyLength]byte, withdrawalCredentials [fieldparams.RootLength]byte, amount uint64) error
+	UpdatePendingPaymentWeight(att ethpb.Att, indices []uint64, participatedFlags map[uint8]bool) error
 }
 
 type readOnlyGloasFields interface {
+	// Bids.
+	LatestExecutionPayloadBid() (interfaces.ROExecutionPayloadBid, error)
+
+	// Builder pending payments / withdrawals.
+	BuilderPendingPayments() ([]*ethpb.BuilderPendingPayment, error)
+	WithdrawalsMatchPayloadExpected(withdrawals []*enginev1.Withdrawal) (bool, error)
+
+	// Misc.
+	LatestBlockHash() ([32]byte, error)
+
+	// Builders.
+	Builder(index primitives.BuilderIndex) (*ethpb.Builder, error)
 	BuilderPubkey(primitives.BuilderIndex) ([48]byte, error)
+	BuilderIndexByPubkey(pubkey [fieldparams.BLSPubkeyLength]byte) (primitives.BuilderIndex, bool)
 	IsActiveBuilder(primitives.BuilderIndex) (bool, error)
 	CanBuilderCoverBid(primitives.BuilderIndex, primitives.Gwei) (bool, error)
-	LatestBlockHash() ([32]byte, error)
-	BuilderPendingPayments() ([]*ethpb.BuilderPendingPayment, error)
+	IsAttestationSameSlot(blockRoot [32]byte, slot primitives.Slot) (bool, error)
+	BuilderPendingPayment(index uint64) (*ethpb.BuilderPendingPayment, error)
+	ExecutionPayloadAvailability(slot primitives.Slot) (uint64, error)
 }

beacon-chain/state/state-native/getters_gloas.go

@@ -1,13 +1,19 @@
 package state_native
 
 import (
+	"bytes"
 	"fmt"
 
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/core/helpers"
 	fieldparams "github.com/OffchainLabs/prysm/v7/config/fieldparams"
 	"github.com/OffchainLabs/prysm/v7/config/params"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/blocks"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/interfaces"
 	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+	enginev1 "github.com/OffchainLabs/prysm/v7/proto/engine/v1"
 	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
 	"github.com/OffchainLabs/prysm/v7/runtime/version"
+	"github.com/pkg/errors"
 )
 
 // LatestBlockHash returns the hash of the latest execution block.
@@ -26,6 +32,45 @@ func (b *BeaconState) LatestBlockHash() ([32]byte, error) {
 	return [32]byte(b.latestBlockHash), nil
 }
 
+// IsAttestationSameSlot checks if the attestation is for the same slot as the block root in the state.
+// Spec v1.7.0-alpha pseudocode:
+//
+//	is_attestation_same_slot(state, data):
+//	    if data.slot == 0:
+//	        return True
+//
+//	    blockroot = data.beacon_block_root
+//	    slot_blockroot = get_block_root_at_slot(state, data.slot)
+//	    prev_blockroot = get_block_root_at_slot(state, Slot(data.slot - 1))
+//
+//	    return blockroot == slot_blockroot and blockroot != prev_blockroot
+func (b *BeaconState) IsAttestationSameSlot(blockRoot [32]byte, slot primitives.Slot) (bool, error) {
+	if b.version < version.Gloas {
+		return false, errNotSupported("IsAttestationSameSlot", b.version)
+	}
+
+	b.lock.RLock()
+	defer b.lock.RUnlock()
+
+	if slot == 0 {
+		return true, nil
+	}
+
+	blockRootAtSlot, err := helpers.BlockRootAtSlot(b, slot)
+	if err != nil {
+		return false, errors.Wrapf(err, "block root at slot %d", slot)
+	}
+	matchingBlockRoot := bytes.Equal(blockRoot[:], blockRootAtSlot)
+
+	blockRootAtPrevSlot, err := helpers.BlockRootAtSlot(b, slot-1)
+	if err != nil {
+		return false, errors.Wrapf(err, "block root at slot %d", slot-1)
+	}
+	matchingPrevBlockRoot := bytes.Equal(blockRoot[:], blockRootAtPrevSlot)
+
+	return matchingBlockRoot && !matchingPrevBlockRoot, nil
+}
+
 // BuilderPubkey returns the builder pubkey at the provided index.
 func (b *BeaconState) BuilderPubkey(builderIndex primitives.BuilderIndex) ([fieldparams.BLSPubkeyLength]byte, error) {
 	if b.version < version.Gloas {
@@ -46,14 +91,20 @@ func (b *BeaconState) BuilderPubkey(builderIndex primitives.BuilderIndex) ([fiel
 }
 
 // IsActiveBuilder returns true if the builder placement is finalized and it has not initiated exit.
-// Spec v1.7.0-alpha.0 (pseudocode):
-// def is_active_builder(state: BeaconState, builder_index: BuilderIndex) -> bool:
 //
-//	builder = state.builders[builder_index]
-//	return (
-//	    builder.deposit_epoch < state.finalized_checkpoint.epoch
-//	    and builder.withdrawable_epoch == FAR_FUTURE_EPOCH
-//	)
+//	<spec fn="is_active_builder" fork="gloas" hash="1a599fb2">
+//	def is_active_builder(state: BeaconState, builder_index: BuilderIndex) -> bool:
+//	    """
+//	    Check if the builder at ``builder_index`` is active for the given ``state``.
+//	    """
+//	    builder = state.builders[builder_index]
+//	    return (
+//	        # Placement in builder list is finalized
+//	        builder.deposit_epoch < state.finalized_checkpoint.epoch
+//	        # Has not initiated exit
+//	        and builder.withdrawable_epoch == FAR_FUTURE_EPOCH
+//	    )
+//	</spec>
 func (b *BeaconState) IsActiveBuilder(builderIndex primitives.BuilderIndex) (bool, error) {
 	if b.version < version.Gloas {
 		return false, errNotSupported("IsActiveBuilder", b.version)
@@ -72,15 +123,18 @@ func (b *BeaconState) IsActiveBuilder(builderIndex primitives.BuilderIndex) (boo
 }
 
 // CanBuilderCoverBid returns true if the builder has enough balance to cover the given bid amount.
-// Spec v1.7.0-alpha.0 (pseudocode):
-// def can_builder_cover_bid(state: BeaconState, builder_index: BuilderIndex, bid_amount: Gwei) -> bool:
 //
-//	builder_balance = state.builders[builder_index].balance
-//	pending_withdrawals_amount = get_pending_balance_to_withdraw_for_builder(state, builder_index)
-//	min_balance = MIN_DEPOSIT_AMOUNT + pending_withdrawals_amount
-//	if builder_balance < min_balance:
-//	    return False
-//	return builder_balance - min_balance >= bid_amount
+//	<spec fn="can_builder_cover_bid" fork="gloas" hash="9e3f2d7c">
+//	def can_builder_cover_bid(
+//	    state: BeaconState, builder_index: BuilderIndex, bid_amount: Gwei
+//	) -> bool:
+//	    builder_balance = state.builders[builder_index].balance
+//	    pending_withdrawals_amount = get_pending_balance_to_withdraw_for_builder(state, builder_index)
+//	    min_balance = MIN_DEPOSIT_AMOUNT + pending_withdrawals_amount
+//	    if builder_balance < min_balance:
+//	        return False
+//	    return builder_balance - min_balance >= bid_amount
+//	</spec>
 func (b *BeaconState) CanBuilderCoverBid(builderIndex primitives.BuilderIndex, bidAmount primitives.Gwei) (bool, error) {
 	if b.version < version.Gloas {
 		return false, errNotSupported("CanBuilderCoverBid", b.version)
@@ -147,3 +201,116 @@ func (b *BeaconState) BuilderPendingPayments() ([]*ethpb.BuilderPendingPayment,
 
 	return b.builderPendingPaymentsVal(), nil
 }
+
+// BuilderPendingPayment returns the builder pending payment for the given index.
+func (b *BeaconState) BuilderPendingPayment(index uint64) (*ethpb.BuilderPendingPayment, error) {
+	if b.version < version.Gloas {
+		return nil, errNotSupported("BuilderPendingPayment", b.version)
+	}
+
+	b.lock.RLock()
+	defer b.lock.RUnlock()
+
+	if index >= uint64(len(b.builderPendingPayments)) {
+		return nil, fmt.Errorf("builder pending payment index %d out of range (len=%d)", index, len(b.builderPendingPayments))
+	}
+	return ethpb.CopyBuilderPendingPayment(b.builderPendingPayments[index]), nil
+}
+
+// LatestExecutionPayloadBid returns the cached latest execution payload bid for Gloas.
+func (b *BeaconState) LatestExecutionPayloadBid() (interfaces.ROExecutionPayloadBid, error) {
+	if b.version < version.Gloas {
+		return nil, errNotSupported("LatestExecutionPayloadBid", b.version)
+	}
+
+	b.lock.RLock()
+	defer b.lock.RUnlock()
+
+	if b.latestExecutionPayloadBid == nil {
+		return nil, nil
+	}
+
+	return blocks.WrappedROExecutionPayloadBid(b.latestExecutionPayloadBid.Copy())
+}
+
+// WithdrawalsMatchPayloadExpected returns true if the given withdrawals root matches the state's
+// payload_expected_withdrawals root.
+func (b *BeaconState) WithdrawalsMatchPayloadExpected(withdrawals []*enginev1.Withdrawal) (bool, error) {
+	if b.version < version.Gloas {
+		return false, errNotSupported("WithdrawalsMatchPayloadExpected", b.version)
+	}
+
+	b.lock.RLock()
+	defer b.lock.RUnlock()
+
+	return withdrawalsEqual(withdrawals, b.payloadExpectedWithdrawals), nil
+}
+
+func withdrawalsEqual(a, b []*enginev1.Withdrawal) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		wa := a[i]
+		wb := b[i]
+		if wa.Index != wb.Index ||
+			wa.ValidatorIndex != wb.ValidatorIndex ||
+			wa.Amount != wb.Amount ||
+			!bytes.Equal(wa.Address, wb.Address) {
+			return false
+		}
+	}
+	return true
+}
+
+// ExecutionPayloadAvailability returns the execution payload availability bit for the given slot.
+func (b *BeaconState) ExecutionPayloadAvailability(slot primitives.Slot) (uint64, error) {
+	if b.version < version.Gloas {
+		return 0, errNotSupported("ExecutionPayloadAvailability", b.version)
+	}
+
+	b.lock.RLock()
+	defer b.lock.RUnlock()
+
+	slotIndex := slot % params.BeaconConfig().SlotsPerHistoricalRoot
+	byteIndex := slotIndex / 8
+	bitIndex := slotIndex % 8
+
+	bit := (b.executionPayloadAvailability[byteIndex] >> bitIndex) & 1
+
+	return uint64(bit), nil
+}
+
+// Builder returns the builder at the given index.
+func (b *BeaconState) Builder(index primitives.BuilderIndex) (*ethpb.Builder, error) {
+	b.lock.RLock()
+	defer b.lock.RUnlock()
+
+	if b.builders == nil {
+		return nil, nil
+	}
+	if uint64(index) >= uint64(len(b.builders)) {
+		return nil, fmt.Errorf("builder index %d out of bounds", index)
+	}
+	if b.builders[index] == nil {
+		return nil, nil
+	}
+
+	return ethpb.CopyBuilder(b.builders[index]), nil
+}
+
+// BuilderIndexByPubkey returns the builder index for the given pubkey, if present.
+func (b *BeaconState) BuilderIndexByPubkey(pubkey [fieldparams.BLSPubkeyLength]byte) (primitives.BuilderIndex, bool) {
+	b.lock.RLock()
+	defer b.lock.RUnlock()
+
+	for i, builder := range b.builders {
+		if builder == nil {
+			continue
+		}
+		if bytes.Equal(builder.Pubkey, pubkey[:]) {
+			return primitives.BuilderIndex(i), true
+		}
+	}
+	return 0, false
+}

beacon-chain/state/state-native/getters_gloas_test.go

@@ -5,8 +5,10 @@ import (
 	"testing"
 
 	state_native "github.com/OffchainLabs/prysm/v7/beacon-chain/state/state-native"
+	fieldparams "github.com/OffchainLabs/prysm/v7/config/fieldparams"
 	"github.com/OffchainLabs/prysm/v7/config/params"
 	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+	enginev1 "github.com/OffchainLabs/prysm/v7/proto/engine/v1"
 	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
 	"github.com/OffchainLabs/prysm/v7/testing/require"
 	"github.com/OffchainLabs/prysm/v7/testing/util"
@@ -44,6 +46,103 @@ func TestLatestBlockHash(t *testing.T) {
 	})
 }
 
+func TestLatestExecutionPayloadBid(t *testing.T) {
+	t.Run("returns error before gloas", func(t *testing.T) {
+		stIface, _ := util.DeterministicGenesisState(t, 1)
+		native, ok := stIface.(*state_native.BeaconState)
+		require.Equal(t, true, ok)
+
+		_, err := native.LatestExecutionPayloadBid()
+		require.ErrorContains(t, "is not supported", err)
+	})
+}
+
+func TestIsAttestationSameSlot(t *testing.T) {
+	buildStateWithBlockRoots := func(t *testing.T, stateSlot primitives.Slot, roots map[primitives.Slot][]byte) *state_native.BeaconState {
+		t.Helper()
+
+		cfg := params.BeaconConfig()
+		blockRoots := make([][]byte, cfg.SlotsPerHistoricalRoot)
+		for slot, root := range roots {
+			blockRoots[slot%cfg.SlotsPerHistoricalRoot] = root
+		}
+
+		stIface, err := state_native.InitializeFromProtoGloas(&ethpb.BeaconStateGloas{
+			Slot:       stateSlot,
+			BlockRoots: blockRoots,
+		})
+		require.NoError(t, err)
+		return stIface.(*state_native.BeaconState)
+	}
+
+	rootA := bytes.Repeat([]byte{0xAA}, 32)
+	rootB := bytes.Repeat([]byte{0xBB}, 32)
+	rootC := bytes.Repeat([]byte{0xCC}, 32)
+
+	tests := []struct {
+		name      string
+		stateSlot primitives.Slot
+		slot      primitives.Slot
+		blockRoot []byte
+		roots     map[primitives.Slot][]byte
+		want      bool
+	}{
+		{
+			name:      "slot zero always true",
+			stateSlot: 1,
+			slot:      0,
+			blockRoot: rootA,
+			roots:     map[primitives.Slot][]byte{},
+			want:      true,
+		},
+		{
+			name:      "matching current different previous",
+			stateSlot: 6,
+			slot:      4,
+			blockRoot: rootA,
+			roots: map[primitives.Slot][]byte{
+				4: rootA,
+				3: rootB,
+			},
+			want: true,
+		},
+		{
+			name:      "matching current same previous",
+			stateSlot: 6,
+			slot:      4,
+			blockRoot: rootA,
+			roots: map[primitives.Slot][]byte{
+				4: rootA,
+				3: rootA,
+			},
+			want: false,
+		},
+		{
+			name:      "non matching current",
+			stateSlot: 6,
+			slot:      4,
+			blockRoot: rootC,
+			roots: map[primitives.Slot][]byte{
+				4: rootA,
+				3: rootB,
+			},
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			st := buildStateWithBlockRoots(t, tt.stateSlot, tt.roots)
+			var rootArr [32]byte
+			copy(rootArr[:], tt.blockRoot)
+
+			got, err := st.IsAttestationSameSlot(rootArr, tt.slot)
+			require.NoError(t, err)
+			require.Equal(t, tt.want, got)
+		})
+	}
+}
+
 func TestBuilderPubkey(t *testing.T) {
 	t.Run("returns error before gloas", func(t *testing.T) {
 		stIface, _ := util.DeterministicGenesisState(t, 1)
@@ -166,3 +265,208 @@ func TestBuilderPendingPayments_UnsupportedVersion(t *testing.T) {
 	_, err = st.BuilderPendingPayments()
 	require.ErrorContains(t, "BuilderPendingPayments", err)
 }
+
+func TestWithdrawalsMatchPayloadExpected(t *testing.T) {
+	t.Run("returns error before gloas", func(t *testing.T) {
+		stIface, _ := util.DeterministicGenesisState(t, 1)
+		native, ok := stIface.(*state_native.BeaconState)
+		require.Equal(t, true, ok)
+
+		_, err := native.WithdrawalsMatchPayloadExpected(nil)
+		require.ErrorContains(t, "is not supported", err)
+	})
+
+	t.Run("returns true when roots match", func(t *testing.T) {
+		withdrawals := []*enginev1.Withdrawal{
+			{Index: 0, ValidatorIndex: 1, Address: bytes.Repeat([]byte{0x01}, 20), Amount: 10},
+		}
+		st, err := state_native.InitializeFromProtoGloas(&ethpb.BeaconStateGloas{
+			PayloadExpectedWithdrawals: withdrawals,
+		})
+		require.NoError(t, err)
+
+		ok, err := st.WithdrawalsMatchPayloadExpected(withdrawals)
+		require.NoError(t, err)
+		require.Equal(t, true, ok)
+	})
+
+	t.Run("returns false when roots do not match", func(t *testing.T) {
+		expected := []*enginev1.Withdrawal{
+			{Index: 0, ValidatorIndex: 1, Address: bytes.Repeat([]byte{0x01}, 20), Amount: 10},
+		}
+		actual := []*enginev1.Withdrawal{
+			{Index: 0, ValidatorIndex: 1, Address: bytes.Repeat([]byte{0x01}, 20), Amount: 11},
+		}
+
+		st, err := state_native.InitializeFromProtoGloas(&ethpb.BeaconStateGloas{
+			PayloadExpectedWithdrawals: expected,
+		})
+		require.NoError(t, err)
+
+		ok, err := st.WithdrawalsMatchPayloadExpected(actual)
+		require.NoError(t, err)
+		require.Equal(t, false, ok)
+	})
+}
+
+func TestBuilder(t *testing.T) {
+	t.Run("nil builders returns nil", func(t *testing.T) {
+		st, err := state_native.InitializeFromProtoGloas(&ethpb.BeaconStateGloas{
+			Builders: nil,
+		})
+		require.NoError(t, err)
+
+		got, err := st.Builder(0)
+		require.NoError(t, err)
+		require.Equal(t, (*ethpb.Builder)(nil), got)
+	})
+
+	t.Run("out of bounds returns error", func(t *testing.T) {
+		st, err := state_native.InitializeFromProtoGloas(&ethpb.BeaconStateGloas{
+			Builders: []*ethpb.Builder{{}},
+		})
+		require.NoError(t, err)
+
+		_, err = st.Builder(1)
+		require.ErrorContains(t, "out of bounds", err)
+	})
+
+	t.Run("returns copy", func(t *testing.T) {
+		pubkey := bytes.Repeat([]byte{0xAA}, fieldparams.BLSPubkeyLength)
+		st, err := state_native.InitializeFromProtoGloas(&ethpb.BeaconStateGloas{
+			Builders: []*ethpb.Builder{
+				{
+					Pubkey:            pubkey,
+					Balance:           42,
+					DepositEpoch:      3,
+					WithdrawableEpoch: 4,
+				},
+			},
+		})
+		require.NoError(t, err)
+
+		got1, err := st.Builder(0)
+		require.NoError(t, err)
+		require.NotEqual(t, (*ethpb.Builder)(nil), got1)
+		require.Equal(t, primitives.Gwei(42), got1.Balance)
+		require.DeepEqual(t, pubkey, got1.Pubkey)
+
+		// Mutate returned builder; state should be unchanged.
+		got1.Pubkey[0] = 0xFF
+		got2, err := st.Builder(0)
+		require.NoError(t, err)
+		require.Equal(t, byte(0xAA), got2.Pubkey[0])
+	})
+}
+
+func TestBuilderIndexByPubkey(t *testing.T) {
+	t.Run("not found returns false", func(t *testing.T) {
+		st, err := state_native.InitializeFromProtoGloas(&ethpb.BeaconStateGloas{
+			Builders: []*ethpb.Builder{
+				{Pubkey: bytes.Repeat([]byte{0x11}, fieldparams.BLSPubkeyLength)},
+			},
+		})
+		require.NoError(t, err)
+
+		var pk [fieldparams.BLSPubkeyLength]byte
+		copy(pk[:], bytes.Repeat([]byte{0x22}, fieldparams.BLSPubkeyLength))
+		idx, ok := st.BuilderIndexByPubkey(pk)
+		require.Equal(t, false, ok)
+		require.Equal(t, primitives.BuilderIndex(0), idx)
+	})
+
+	t.Run("skips nil entries and finds match", func(t *testing.T) {
+		wantIdx := primitives.BuilderIndex(1)
+		wantPkBytes := bytes.Repeat([]byte{0xAB}, fieldparams.BLSPubkeyLength)
+
+		st, err := state_native.InitializeFromProtoGloas(&ethpb.BeaconStateGloas{
+			Builders: []*ethpb.Builder{
+				nil,
+				{Pubkey: wantPkBytes},
+			},
+		})
+		require.NoError(t, err)
+
+		var pk [fieldparams.BLSPubkeyLength]byte
+		copy(pk[:], wantPkBytes)
+		idx, ok := st.BuilderIndexByPubkey(pk)
+		require.Equal(t, true, ok)
+		require.Equal(t, wantIdx, idx)
+	})
+}
+
+func TestBuilderPendingPayment(t *testing.T) {
+	t.Run("returns copy", func(t *testing.T) {
+		slotsPerEpoch := params.BeaconConfig().SlotsPerEpoch
+		payments := make([]*ethpb.BuilderPendingPayment, 2*slotsPerEpoch)
+		target := uint64(slotsPerEpoch + 1)
+		payments[target] = &ethpb.BuilderPendingPayment{Weight: 10}
+
+		st, err := state_native.InitializeFromProtoUnsafeGloas(&ethpb.BeaconStateGloas{
+			BuilderPendingPayments: payments,
+		})
+		require.NoError(t, err)
+
+		payment, err := st.BuilderPendingPayment(target)
+		require.NoError(t, err)
+
+		// mutate returned copy
+		payment.Weight = 99
+
+		original, err := st.BuilderPendingPayment(target)
+		require.NoError(t, err)
+		require.Equal(t, uint64(10), uint64(original.Weight))
+	})
+
+	t.Run("unsupported version", func(t *testing.T) {
+		stIface, err := state_native.InitializeFromProtoElectra(&ethpb.BeaconStateElectra{})
+		require.NoError(t, err)
+		st := stIface.(*state_native.BeaconState)
+
+		_, err = st.BuilderPendingPayment(0)
+		require.ErrorContains(t, "BuilderPendingPayment", err)
+	})
+
+	t.Run("out of range", func(t *testing.T) {
+		stIface, err := state_native.InitializeFromProtoUnsafeGloas(&ethpb.BeaconStateGloas{
+			BuilderPendingPayments: []*ethpb.BuilderPendingPayment{},
+		})
+		require.NoError(t, err)
+
+		_, err = stIface.BuilderPendingPayment(0)
+		require.ErrorContains(t, "out of range", err)
+	})
+}
+
+func TestExecutionPayloadAvailability(t *testing.T) {
+	t.Run("unsupported version", func(t *testing.T) {
+		stIface, err := state_native.InitializeFromProtoElectra(&ethpb.BeaconStateElectra{})
+		require.NoError(t, err)
+		st := stIface.(*state_native.BeaconState)
+
+		_, err = st.ExecutionPayloadAvailability(0)
+		require.ErrorContains(t, "ExecutionPayloadAvailability", err)
+	})
+
+	t.Run("reads expected bit", func(t *testing.T) {
+		// Ensure the backing slice is large enough.
+		availability := make([]byte, params.BeaconConfig().SlotsPerHistoricalRoot/8)
+
+		// Pick a slot and set its corresponding bit.
+		slot := primitives.Slot(9) // byteIndex=1, bitIndex=1
+		availability[1] = 0b00000010
+
+		stIface, err := state_native.InitializeFromProtoUnsafeGloas(&ethpb.BeaconStateGloas{
+			ExecutionPayloadAvailability: availability,
+		})
+		require.NoError(t, err)
+
+		bit, err := stIface.ExecutionPayloadAvailability(slot)
+		require.NoError(t, err)
+		require.Equal(t, uint64(1), bit)
+
+		otherBit, err := stIface.ExecutionPayloadAvailability(8)
+		require.NoError(t, err)
+		require.Equal(t, uint64(0), otherBit)
+	})
+}

beacon-chain/state/state-native/setters_gloas.go

@@ -5,11 +5,14 @@ import (
 
 	"github.com/OffchainLabs/prysm/v7/beacon-chain/state/state-native/types"
 	"github.com/OffchainLabs/prysm/v7/beacon-chain/state/stateutil"
+	fieldparams "github.com/OffchainLabs/prysm/v7/config/fieldparams"
 	"github.com/OffchainLabs/prysm/v7/config/params"
 	"github.com/OffchainLabs/prysm/v7/consensus-types/interfaces"
 	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+	"github.com/OffchainLabs/prysm/v7/encoding/bytesutil"
 	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
 	"github.com/OffchainLabs/prysm/v7/runtime/version"
+	"github.com/OffchainLabs/prysm/v7/time/slots"
 )
 
 // RotateBuilderPendingPayments rotates the queue by dropping slots per epoch payments from the
@@ -82,20 +85,20 @@ func (b *BeaconState) SetExecutionPayloadBid(h interfaces.ROExecutionPayloadBid)
 	parentBlockRoot := h.ParentBlockRoot()
 	blockHash := h.BlockHash()
 	randao := h.PrevRandao()
-	blobKzgCommitmentsRoot := h.BlobKzgCommitmentsRoot()
+	blobKzgCommitments := h.BlobKzgCommitments()
 	feeRecipient := h.FeeRecipient()
 	b.latestExecutionPayloadBid = &ethpb.ExecutionPayloadBid{
-		ParentBlockHash:        parentBlockHash[:],
-		ParentBlockRoot:        parentBlockRoot[:],
-		BlockHash:              blockHash[:],
-		PrevRandao:             randao[:],
-		GasLimit:               h.GasLimit(),
-		BuilderIndex:           h.BuilderIndex(),
-		Slot:                   h.Slot(),
-		Value:                  h.Value(),
-		ExecutionPayment:       h.ExecutionPayment(),
-		BlobKzgCommitmentsRoot: blobKzgCommitmentsRoot[:],
-		FeeRecipient:           feeRecipient[:],
+		ParentBlockHash:    parentBlockHash[:],
+		ParentBlockRoot:    parentBlockRoot[:],
+		BlockHash:          blockHash[:],
+		PrevRandao:         randao[:],
+		GasLimit:           h.GasLimit(),
+		BuilderIndex:       h.BuilderIndex(),
+		Slot:               h.Slot(),
+		Value:              h.Value(),
+		ExecutionPayment:   h.ExecutionPayment(),
+		BlobKzgCommitments: blobKzgCommitments,
+		FeeRecipient:       feeRecipient[:],
 	}
 	b.markFieldAsDirty(types.LatestExecutionPayloadBid)
 
@@ -121,6 +124,41 @@ func (b *BeaconState) ClearBuilderPendingPayment(index primitives.Slot) error {
 	return nil
 }
 
+// QueueBuilderPayment implements the builder payment queuing logic for Gloas.
+// Spec v1.7.0-alpha.0 (pseudocode):
+// payment = state.builder_pending_payments[SLOTS_PER_EPOCH + state.slot % SLOTS_PER_EPOCH]
+// amount = payment.withdrawal.amount
+// if amount > 0:
+//
+//	state.builder_pending_withdrawals.append(payment.withdrawal)
+//
+// state.builder_pending_payments[SLOTS_PER_EPOCH + state.slot % SLOTS_PER_EPOCH] = BuilderPendingPayment()
+func (b *BeaconState) QueueBuilderPayment() error {
+	if b.version < version.Gloas {
+		return errNotSupported("QueueBuilderPayment", b.version)
+	}
+
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	slot := b.slot
+	slotsPerEpoch := params.BeaconConfig().SlotsPerEpoch
+	paymentIndex := slotsPerEpoch + (slot % slotsPerEpoch)
+	if uint64(paymentIndex) >= uint64(len(b.builderPendingPayments)) {
+		return fmt.Errorf("builder pending payments index %d out of range (len=%d)", paymentIndex, len(b.builderPendingPayments))
+	}
+
+	payment := b.builderPendingPayments[paymentIndex]
+	if payment != nil && payment.Withdrawal != nil && payment.Withdrawal.Amount > 0 {
+		b.builderPendingWithdrawals = append(b.builderPendingWithdrawals, ethpb.CopyBuilderPendingWithdrawal(payment.Withdrawal))
+		b.markFieldAsDirty(types.BuilderPendingWithdrawals)
+	}
+
+	b.builderPendingPayments[paymentIndex] = emptyBuilderPendingPayment
+	b.markFieldAsDirty(types.BuilderPendingPayments)
+	return nil
+}
+
 // SetBuilderPendingPayment sets a builder pending payment at the specified index.
 func (b *BeaconState) SetBuilderPendingPayment(index primitives.Slot, payment *ethpb.BuilderPendingPayment) error {
 	if b.version < version.Gloas {
@@ -161,3 +199,249 @@ func (b *BeaconState) UpdateExecutionPayloadAvailabilityAtIndex(idx uint64, val
 	b.markFieldAsDirty(types.ExecutionPayloadAvailability)
 	return nil
 }
+
+// SetLatestBlockHash sets the latest execution block hash.
+func (b *BeaconState) SetLatestBlockHash(hash [32]byte) error {
+	if b.version < version.Gloas {
+		return errNotSupported("SetLatestBlockHash", b.version)
+	}
+
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	b.latestBlockHash = hash[:]
+	b.markFieldAsDirty(types.LatestBlockHash)
+	return nil
+}
+
+// SetExecutionPayloadAvailability sets the execution payload availability bit for a specific slot.
+func (b *BeaconState) SetExecutionPayloadAvailability(index primitives.Slot, available bool) error {
+	if b.version < version.Gloas {
+		return errNotSupported("SetExecutionPayloadAvailability", b.version)
+	}
+
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	bitIndex := index % params.BeaconConfig().SlotsPerHistoricalRoot
+	byteIndex := bitIndex / 8
+	bitPosition := bitIndex % 8
+
+	if uint64(byteIndex) >= uint64(len(b.executionPayloadAvailability)) {
+		return fmt.Errorf("bit index %d (byte index %d) out of range for execution payload availability length %d", bitIndex, byteIndex, len(b.executionPayloadAvailability))
+	}
+
+	// Set or clear the bit
+	if available {
+		b.executionPayloadAvailability[byteIndex] |= 1 << bitPosition
+	} else {
+		b.executionPayloadAvailability[byteIndex] &^= 1 << bitPosition
+	}
+
+	b.markFieldAsDirty(types.ExecutionPayloadAvailability)
+	return nil
+}
+
+// IncreaseBuilderBalance increases the balance of the builder at the given index.
+func (b *BeaconState) IncreaseBuilderBalance(index primitives.BuilderIndex, amount uint64) error {
+	if b.version < version.Gloas {
+		return errNotSupported("IncreaseBuilderBalance", b.version)
+	}
+
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	if b.builders == nil || uint64(index) >= uint64(len(b.builders)) {
+		return fmt.Errorf("builder index %d out of bounds", index)
+	}
+	if b.builders[index] == nil {
+		return fmt.Errorf("builder at index %d is nil", index)
+	}
+
+	builders := b.builders
+	if b.sharedFieldReferences[types.Builders].Refs() > 1 {
+		builders = make([]*ethpb.Builder, len(b.builders))
+		copy(builders, b.builders)
+		b.sharedFieldReferences[types.Builders].MinusRef()
+		b.sharedFieldReferences[types.Builders] = stateutil.NewRef(1)
+	}
+
+	builder := ethpb.CopyBuilder(builders[index])
+	builder.Balance += primitives.Gwei(amount)
+	builders[index] = builder
+	b.builders = builders
+
+	b.markFieldAsDirty(types.Builders)
+	return nil
+}
+
+// AddBuilderFromDeposit creates or replaces a builder entry derived from a deposit.
+func (b *BeaconState) AddBuilderFromDeposit(pubkey [fieldparams.BLSPubkeyLength]byte, withdrawalCredentials [fieldparams.RootLength]byte, amount uint64) error {
+	if b.version < version.Gloas {
+		return errNotSupported("AddBuilderFromDeposit", b.version)
+	}
+
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	currentEpoch := slots.ToEpoch(b.slot)
+	index := b.builderInsertionIndex(currentEpoch)
+
+	builder := &ethpb.Builder{
+		Pubkey:            bytesutil.SafeCopyBytes(pubkey[:]),
+		Version:           []byte{withdrawalCredentials[0]},
+		ExecutionAddress:  bytesutil.SafeCopyBytes(withdrawalCredentials[12:]),
+		Balance:           primitives.Gwei(amount),
+		DepositEpoch:      currentEpoch,
+		WithdrawableEpoch: params.BeaconConfig().FarFutureEpoch,
+	}
+
+	builders := b.builders
+	if b.sharedFieldReferences[types.Builders].Refs() > 1 {
+		builders = make([]*ethpb.Builder, len(b.builders))
+		copy(builders, b.builders)
+		b.sharedFieldReferences[types.Builders].MinusRef()
+		b.sharedFieldReferences[types.Builders] = stateutil.NewRef(1)
+	}
+
+	if index < primitives.BuilderIndex(len(builders)) {
+		builders[index] = builder
+	} else {
+		gap := index - primitives.BuilderIndex(len(builders)) + 1
+		builders = append(builders, make([]*ethpb.Builder, gap)...)
+		builders[index] = builder
+	}
+	b.builders = builders
+
+	b.markFieldAsDirty(types.Builders)
+	return nil
+}
+
+func (b *BeaconState) builderInsertionIndex(currentEpoch primitives.Epoch) primitives.BuilderIndex {
+	for i, builder := range b.builders {
+		if builder.WithdrawableEpoch <= currentEpoch && builder.Balance == 0 {
+			return primitives.BuilderIndex(i)
+		}
+	}
+	return primitives.BuilderIndex(len(b.builders))
+}
+
+// UpdatePendingPaymentWeight updates the builder pending payment weight based on attestation participation.
+//
+// This is a no-op for pre-Gloas forks.
+//
+// Spec v1.7.0-alpha pseudocode:
+//
+//	if data.target.epoch == get_current_epoch(state):
+//	    current_epoch_target = True
+//	    epoch_participation = state.current_epoch_participation
+//	    payment = state.builder_pending_payments[SLOTS_PER_EPOCH + data.slot % SLOTS_PER_EPOCH]
+//	else:
+//	    current_epoch_target = False
+//	    epoch_participation = state.previous_epoch_participation
+//	    payment = state.builder_pending_payments[data.slot % SLOTS_PER_EPOCH]
+//
+//	proposer_reward_numerator = 0
+//	for index in get_attesting_indices(state, attestation):
+//	    will_set_new_flag = False
+//	    for flag_index, weight in enumerate(PARTICIPATION_FLAG_WEIGHTS):
+//	        if flag_index in participation_flag_indices and not has_flag(epoch_participation[index], flag_index):
+//	            epoch_participation[index] = add_flag(epoch_participation[index], flag_index)
+//	            proposer_reward_numerator += get_base_reward(state, index) * weight
+//	            # [New in Gloas:EIP7732]
+//	            will_set_new_flag = True
+//	    if (
+//	        will_set_new_flag
+//	        and is_attestation_same_slot(state, data)
+//	        and payment.withdrawal.amount > 0
+//	    ):
+//	        payment.weight += state.validators[index].effective_balance
+//	if current_epoch_target:
+//	    state.builder_pending_payments[SLOTS_PER_EPOCH + data.slot % SLOTS_PER_EPOCH] = payment
+//	else:
+//	    state.builder_pending_payments[data.slot % SLOTS_PER_EPOCH] = payment
+func (b *BeaconState) UpdatePendingPaymentWeight(att ethpb.Att, indices []uint64, participatedFlags map[uint8]bool) error {
+	var (
+		paymentSlot    primitives.Slot
+		currentPayment *ethpb.BuilderPendingPayment
+		weight         primitives.Gwei
+	)
+
+	early, err := func() (bool, error) {
+		b.lock.RLock()
+		defer b.lock.RUnlock()
+
+		if b.version < version.Gloas {
+			return true, nil
+		}
+
+		data := att.GetData()
+		var beaconBlockRoot [32]byte
+		copy(beaconBlockRoot[:], data.BeaconBlockRoot)
+		sameSlot, err := b.IsAttestationSameSlot(beaconBlockRoot, data.Slot)
+		if err != nil {
+			return false, err
+		}
+		if !sameSlot {
+			return true, nil
+		}
+
+		slotsPerEpoch := params.BeaconConfig().SlotsPerEpoch
+		var epochParticipation []byte
+
+		if data.Target != nil && data.Target.Epoch == slots.ToEpoch(b.slot) {
+			paymentSlot = slotsPerEpoch + (data.Slot % slotsPerEpoch)
+			epochParticipation = b.currentEpochParticipation
+		} else {
+			paymentSlot = data.Slot % slotsPerEpoch
+			epochParticipation = b.previousEpochParticipation
+		}
+
+		if uint64(paymentSlot) >= uint64(len(b.builderPendingPayments)) {
+			return false, fmt.Errorf("builder pending payments index %d out of range (len=%d)", paymentSlot, len(b.builderPendingPayments))
+		}
+		currentPayment = b.builderPendingPayments[paymentSlot]
+		if currentPayment.Withdrawal.Amount == 0 {
+			return true, nil
+		}
+
+		cfg := params.BeaconConfig()
+		flagIndices := []uint8{cfg.TimelySourceFlagIndex, cfg.TimelyTargetFlagIndex, cfg.TimelyHeadFlagIndex}
+		for _, idx := range indices {
+			if idx >= uint64(len(epochParticipation)) {
+				return false, fmt.Errorf("index %d exceeds participation length %d", idx, len(epochParticipation))
+			}
+			participation := epochParticipation[idx]
+			for _, f := range flagIndices {
+				if !participatedFlags[f] {
+					continue
+				}
+				if participation&(1<<f) == 0 {
+					v, err := b.validatorAtIndexReadOnly(primitives.ValidatorIndex(idx))
+					if err != nil {
+						return false, fmt.Errorf("validator at index %d: %w", idx, err)
+					}
+					weight += primitives.Gwei(v.EffectiveBalance())
+					break
+				}
+			}
+		}
+		return false, nil
+	}()
+	if err != nil {
+		return err
+	}
+	if early || weight == 0 {
+		return nil
+	}
+
+	b.lock.Lock()
+	defer b.lock.Unlock()
+
+	newPayment := ethpb.CopyBuilderPendingPayment(currentPayment)
+	newPayment.Weight += weight
+	b.builderPendingPayments[paymentSlot] = newPayment
+	b.markFieldAsDirty(types.BuilderPendingPayments)
+
+	return nil
+}

beacon-chain/state/state-native/setters_gloas_test.go

@@ -11,20 +11,21 @@ import (
 	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
 	"github.com/OffchainLabs/prysm/v7/runtime/version"
 	"github.com/OffchainLabs/prysm/v7/testing/require"
+	"github.com/OffchainLabs/prysm/v7/time/slots"
 )
 
 type testExecutionPayloadBid struct {
-	parentBlockHash        [32]byte
-	parentBlockRoot        [32]byte
-	blockHash              [32]byte
-	prevRandao             [32]byte
-	blobKzgCommitmentsRoot [32]byte
-	feeRecipient           [20]byte
-	gasLimit               uint64
-	builderIndex           primitives.BuilderIndex
-	slot                   primitives.Slot
-	value                  primitives.Gwei
-	executionPayment       primitives.Gwei
+	parentBlockHash    [32]byte
+	parentBlockRoot    [32]byte
+	blockHash          [32]byte
+	prevRandao         [32]byte
+	blobKzgCommitments [][]byte
+	feeRecipient       [20]byte
+	gasLimit           uint64
+	builderIndex       primitives.BuilderIndex
+	slot               primitives.Slot
+	value              primitives.Gwei
+	executionPayment   primitives.Gwei
 }
 
 func (t testExecutionPayloadBid) ParentBlockHash() [32]byte { return t.parentBlockHash }
@@ -40,9 +41,12 @@ func (t testExecutionPayloadBid) Value() primitives.Gwei { return t.value }
 func (t testExecutionPayloadBid) ExecutionPayment() primitives.Gwei {
 	return t.executionPayment
 }
-func (t testExecutionPayloadBid) BlobKzgCommitmentsRoot() [32]byte { return t.blobKzgCommitmentsRoot }
-func (t testExecutionPayloadBid) FeeRecipient() [20]byte           { return t.feeRecipient }
-func (t testExecutionPayloadBid) IsNil() bool                      { return false }
+func (t testExecutionPayloadBid) BlobKzgCommitments() [][]byte { return t.blobKzgCommitments }
+func (t testExecutionPayloadBid) BlobKzgCommitmentCount() uint64 {
+	return uint64(len(t.blobKzgCommitments))
+}
+func (t testExecutionPayloadBid) FeeRecipient() [20]byte { return t.feeRecipient }
+func (t testExecutionPayloadBid) IsNil() bool            { return false }
 
 func TestSetExecutionPayloadBid(t *testing.T) {
 	t.Run("previous fork returns expected error", func(t *testing.T) {
@@ -57,7 +61,7 @@ func TestSetExecutionPayloadBid(t *testing.T) {
 			parentBlockRoot = [32]byte(bytes.Repeat([]byte{0xCD}, 32))
 			blockHash       = [32]byte(bytes.Repeat([]byte{0xEF}, 32))
 			prevRandao      = [32]byte(bytes.Repeat([]byte{0x11}, 32))
-			blobRoot        = [32]byte(bytes.Repeat([]byte{0x22}, 32))
+			blobCommitments = [][]byte{bytes.Repeat([]byte{0x22}, 48)}
 			feeRecipient    [20]byte
 		)
 		copy(feeRecipient[:], bytes.Repeat([]byte{0x33}, len(feeRecipient)))
@@ -66,17 +70,17 @@ func TestSetExecutionPayloadBid(t *testing.T) {
 			dirtyFields: make(map[types.FieldIndex]bool),
 		}
 		bid := testExecutionPayloadBid{
-			parentBlockHash:        parentBlockHash,
-			parentBlockRoot:        parentBlockRoot,
-			blockHash:              blockHash,
-			prevRandao:             prevRandao,
-			blobKzgCommitmentsRoot: blobRoot,
-			feeRecipient:           feeRecipient,
-			gasLimit:               123,
-			builderIndex:           7,
-			slot:                   9,
-			value:                  11,
-			executionPayment:       22,
+			parentBlockHash:    parentBlockHash,
+			parentBlockRoot:    parentBlockRoot,
+			blockHash:          blockHash,
+			prevRandao:         prevRandao,
+			blobKzgCommitments: blobCommitments,
+			feeRecipient:       feeRecipient,
+			gasLimit:           123,
+			builderIndex:       7,
+			slot:               9,
+			value:              11,
+			executionPayment:   22,
 		}
 
 		require.NoError(t, st.SetExecutionPayloadBid(bid))
@@ -86,7 +90,7 @@ func TestSetExecutionPayloadBid(t *testing.T) {
 		require.DeepEqual(t, parentBlockRoot[:], st.latestExecutionPayloadBid.ParentBlockRoot)
 		require.DeepEqual(t, blockHash[:], st.latestExecutionPayloadBid.BlockHash)
 		require.DeepEqual(t, prevRandao[:], st.latestExecutionPayloadBid.PrevRandao)
-		require.DeepEqual(t, blobRoot[:], st.latestExecutionPayloadBid.BlobKzgCommitmentsRoot)
+		require.DeepEqual(t, blobCommitments, st.latestExecutionPayloadBid.BlobKzgCommitments)
 		require.DeepEqual(t, feeRecipient[:], st.latestExecutionPayloadBid.FeeRecipient)
 		require.Equal(t, uint64(123), st.latestExecutionPayloadBid.GasLimit)
 		require.Equal(t, primitives.BuilderIndex(7), st.latestExecutionPayloadBid.BuilderIndex)
@@ -163,7 +167,7 @@ func TestClearBuilderPendingPayment(t *testing.T) {
 		}
 
 		require.NoError(t, st.ClearBuilderPendingPayment(1))
-		require.Equal(t, emptyBuilderPendingPayment, st.builderPendingPayments[1])
+		require.DeepEqual(t, emptyBuilderPendingPayment, st.builderPendingPayments[1])
 		require.Equal(t, true, st.dirtyFields[types.BuilderPendingPayments])
 	})
 
@@ -181,6 +185,173 @@ func TestClearBuilderPendingPayment(t *testing.T) {
 	})
 }
 
+func TestQueueBuilderPayment(t *testing.T) {
+	t.Run("previous fork returns expected error", func(t *testing.T) {
+		st := &BeaconState{version: version.Fulu}
+		err := st.QueueBuilderPayment()
+		require.ErrorContains(t, "is not supported", err)
+	})
+
+	t.Run("appends withdrawal, clears payment, and marks dirty", func(t *testing.T) {
+		slotsPerEpoch := params.BeaconConfig().SlotsPerEpoch
+		slot := primitives.Slot(3)
+		paymentIndex := slotsPerEpoch + (slot % slotsPerEpoch)
+
+		st := &BeaconState{
+			version:                   version.Gloas,
+			slot:                      slot,
+			dirtyFields:               make(map[types.FieldIndex]bool),
+			rebuildTrie:               make(map[types.FieldIndex]bool),
+			sharedFieldReferences:     make(map[types.FieldIndex]*stateutil.Reference),
+			builderPendingPayments:    make([]*ethpb.BuilderPendingPayment, slotsPerEpoch*2),
+			builderPendingWithdrawals: []*ethpb.BuilderPendingWithdrawal{},
+		}
+		st.builderPendingPayments[paymentIndex] = &ethpb.BuilderPendingPayment{
+			Weight: 1,
+			Withdrawal: &ethpb.BuilderPendingWithdrawal{
+				FeeRecipient: bytes.Repeat([]byte{0xAB}, 20),
+				Amount:       99,
+				BuilderIndex: 1,
+			},
+		}
+
+		require.NoError(t, st.QueueBuilderPayment())
+		require.DeepEqual(t, emptyBuilderPendingPayment, st.builderPendingPayments[paymentIndex])
+		require.Equal(t, true, st.dirtyFields[types.BuilderPendingPayments])
+		require.Equal(t, true, st.dirtyFields[types.BuilderPendingWithdrawals])
+		require.Equal(t, 1, len(st.builderPendingWithdrawals))
+		require.DeepEqual(t, bytes.Repeat([]byte{0xAB}, 20), st.builderPendingWithdrawals[0].FeeRecipient)
+		require.Equal(t, primitives.Gwei(99), st.builderPendingWithdrawals[0].Amount)
+
+		// Ensure copied withdrawal is not aliased.
+		st.builderPendingPayments[paymentIndex].Withdrawal.FeeRecipient[0] = 0x01
+		require.Equal(t, byte(0xAB), st.builderPendingWithdrawals[0].FeeRecipient[0])
+	})
+
+	t.Run("zero amount does not append withdrawal", func(t *testing.T) {
+		slotsPerEpoch := params.BeaconConfig().SlotsPerEpoch
+		slot := primitives.Slot(3)
+		paymentIndex := slotsPerEpoch + (slot % slotsPerEpoch)
+
+		st := &BeaconState{
+			version:                   version.Gloas,
+			slot:                      slot,
+			dirtyFields:               make(map[types.FieldIndex]bool),
+			rebuildTrie:               make(map[types.FieldIndex]bool),
+			sharedFieldReferences:     make(map[types.FieldIndex]*stateutil.Reference),
+			builderPendingPayments:    make([]*ethpb.BuilderPendingPayment, slotsPerEpoch*2),
+			builderPendingWithdrawals: []*ethpb.BuilderPendingWithdrawal{},
+		}
+		st.builderPendingPayments[paymentIndex] = &ethpb.BuilderPendingPayment{
+			Weight: 1,
+			Withdrawal: &ethpb.BuilderPendingWithdrawal{
+				FeeRecipient: bytes.Repeat([]byte{0xAB}, 20),
+				Amount:       0,
+				BuilderIndex: 1,
+			},
+		}
+
+		require.NoError(t, st.QueueBuilderPayment())
+		require.DeepEqual(t, emptyBuilderPendingPayment, st.builderPendingPayments[paymentIndex])
+		require.Equal(t, true, st.dirtyFields[types.BuilderPendingPayments])
+		require.Equal(t, false, st.dirtyFields[types.BuilderPendingWithdrawals])
+		require.Equal(t, 0, len(st.builderPendingWithdrawals))
+	})
+}
+
+func TestUpdatePendingPaymentWeight(t *testing.T) {
+	cfg := params.BeaconConfig()
+	slotsPerEpoch := cfg.SlotsPerEpoch
+	slot := primitives.Slot(4)
+	stateSlot := slot + 1
+	stateEpoch := slots.ToEpoch(stateSlot)
+
+	rootA := bytes.Repeat([]byte{0xAA}, 32)
+	rootB := bytes.Repeat([]byte{0xBB}, 32)
+
+	tests := []struct {
+		name          string
+		targetEpoch   primitives.Epoch
+		blockRoot     []byte
+		initialAmount primitives.Gwei
+		initialWeight primitives.Gwei
+		wantWeight    primitives.Gwei
+	}{
+		{
+			name:          "same slot current epoch adds weight",
+			targetEpoch:   stateEpoch,
+			blockRoot:     rootA,
+			initialAmount: 1,
+			initialWeight: 0,
+			wantWeight:    primitives.Gwei(cfg.MinActivationBalance),
+		},
+		{
+			name:          "same slot zero amount no weight change",
+			targetEpoch:   stateEpoch,
+			blockRoot:     rootA,
+			initialAmount: 0,
+			initialWeight: 5,
+			wantWeight:    5,
+		},
+		{
+			name:          "non matching block root no change",
+			targetEpoch:   stateEpoch,
+			blockRoot:     rootB,
+			initialAmount: 1,
+			initialWeight: 7,
+			wantWeight:    7,
+		},
+		{
+			name:          "previous epoch target uses earlier slot",
+			targetEpoch:   stateEpoch - 1,
+			blockRoot:     rootA,
+			initialAmount: 1,
+			initialWeight: 0,
+			wantWeight:    primitives.Gwei(cfg.MinActivationBalance),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var paymentIdx int
+			if tt.targetEpoch == stateEpoch {
+				paymentIdx = int(slotsPerEpoch + (slot % slotsPerEpoch))
+			} else {
+				paymentIdx = int(slot % slotsPerEpoch)
+			}
+			state := buildGloasStateForPaymentWeightTest(t, stateSlot, paymentIdx, tt.initialAmount, tt.initialWeight, map[primitives.Slot][]byte{
+				slot:     tt.blockRoot,
+				slot - 1: rootB,
+			})
+
+			att := &ethpb.Attestation{
+				Data: &ethpb.AttestationData{
+					Slot:            slot,
+					CommitteeIndex:  0,
+					BeaconBlockRoot: tt.blockRoot,
+					Source:          &ethpb.Checkpoint{},
+					Target: &ethpb.Checkpoint{
+						Epoch: tt.targetEpoch,
+					},
+				},
+			}
+
+			participatedFlags := map[uint8]bool{
+				cfg.TimelySourceFlagIndex: true,
+				cfg.TimelyTargetFlagIndex: true,
+				cfg.TimelyHeadFlagIndex:   true,
+			}
+			indices := []uint64{0}
+
+			require.NoError(t, state.UpdatePendingPaymentWeight(att, indices, participatedFlags))
+
+			payment, err := state.BuilderPendingPayment(uint64(paymentIdx))
+			require.NoError(t, err)
+			require.Equal(t, tt.wantWeight, payment.Weight)
+		})
+	}
+}
+
 func TestRotateBuilderPendingPayments(t *testing.T) {
 	totalPayments := 2 * params.BeaconConfig().SlotsPerEpoch
 	payments := make([]*ethpb.BuilderPendingPayment, totalPayments)
@@ -318,6 +489,79 @@ func TestUpdateExecutionPayloadAvailabilityAtIndex_OutOfRange(t *testing.T) {
 	}
 }
 
+func buildGloasStateForPaymentWeightTest(
+	t *testing.T,
+	stateSlot primitives.Slot,
+	paymentIdx int,
+	amount primitives.Gwei,
+	weight primitives.Gwei,
+	roots map[primitives.Slot][]byte,
+) *BeaconState {
+	t.Helper()
+
+	cfg := params.BeaconConfig()
+	blockRoots := make([][]byte, cfg.SlotsPerHistoricalRoot)
+	for slot, root := range roots {
+		blockRoots[slot%cfg.SlotsPerHistoricalRoot] = root
+	}
+
+	stateRoots := make([][]byte, cfg.SlotsPerHistoricalRoot)
+	for i := range stateRoots {
+		stateRoots[i] = bytes.Repeat([]byte{0x44}, 32)
+	}
+	randaoMixes := make([][]byte, cfg.EpochsPerHistoricalVector)
+	for i := range randaoMixes {
+		randaoMixes[i] = bytes.Repeat([]byte{0x55}, 32)
+	}
+
+	validator := &ethpb.Validator{
+		PublicKey:             bytes.Repeat([]byte{0x01}, 48),
+		WithdrawalCredentials: append([]byte{cfg.ETH1AddressWithdrawalPrefixByte}, bytes.Repeat([]byte{0x02}, 31)...),
+		EffectiveBalance:      cfg.MinActivationBalance,
+	}
+
+	payments := make([]*ethpb.BuilderPendingPayment, cfg.SlotsPerEpoch*2)
+	for i := range payments {
+		payments[i] = &ethpb.BuilderPendingPayment{
+			Withdrawal: &ethpb.BuilderPendingWithdrawal{
+				FeeRecipient: make([]byte, 20),
+			},
+		}
+	}
+	payments[paymentIdx] = &ethpb.BuilderPendingPayment{
+		Weight: weight,
+		Withdrawal: &ethpb.BuilderPendingWithdrawal{
+			FeeRecipient: make([]byte, 20),
+			Amount:       amount,
+		},
+	}
+
+	execPayloadAvailability := make([]byte, cfg.SlotsPerHistoricalRoot/8)
+
+	stProto := &ethpb.BeaconStateGloas{
+		Slot:                         stateSlot,
+		GenesisValidatorsRoot:        bytes.Repeat([]byte{0x33}, 32),
+		BlockRoots:                   blockRoots,
+		StateRoots:                   stateRoots,
+		RandaoMixes:                  randaoMixes,
+		ExecutionPayloadAvailability: execPayloadAvailability,
+		Validators:                   []*ethpb.Validator{validator},
+		Balances:                     []uint64{cfg.MinActivationBalance},
+		CurrentEpochParticipation:    []byte{0},
+		PreviousEpochParticipation:   []byte{0},
+		BuilderPendingPayments:       payments,
+		Fork: &ethpb.Fork{
+			CurrentVersion:  bytes.Repeat([]byte{0x66}, 4),
+			PreviousVersion: bytes.Repeat([]byte{0x66}, 4),
+			Epoch:           0,
+		},
+	}
+
+	statePb, err := InitializeFromProtoGloas(stProto)
+	require.NoError(t, err)
+	return statePb.(*BeaconState)
+}
+
 func newGloasStateWithAvailability(t *testing.T, availability []byte) *BeaconState {
 	t.Helper()
 
@@ -328,3 +572,241 @@ func newGloasStateWithAvailability(t *testing.T, availability []byte) *BeaconSta
 
 	return st.(*BeaconState)
 }
+
+func TestSetLatestBlockHash(t *testing.T) {
+	t.Run("returns error before gloas", func(t *testing.T) {
+		var hash [32]byte
+		st := &BeaconState{version: version.Fulu}
+		err := st.SetLatestBlockHash(hash)
+		require.ErrorContains(t, "SetLatestBlockHash", err)
+	})
+
+	var hash [32]byte
+	copy(hash[:], []byte("latest-block-hash"))
+
+	state := &BeaconState{
+		version:     version.Gloas,
+		dirtyFields: make(map[types.FieldIndex]bool),
+	}
+
+	require.NoError(t, state.SetLatestBlockHash(hash))
+	require.Equal(t, true, state.dirtyFields[types.LatestBlockHash])
+	require.DeepEqual(t, hash[:], state.latestBlockHash)
+}
+
+func TestSetExecutionPayloadAvailability(t *testing.T) {
+	t.Run("returns error before gloas", func(t *testing.T) {
+		st := &BeaconState{version: version.Fulu}
+		err := st.SetExecutionPayloadAvailability(0, true)
+		require.ErrorContains(t, "SetExecutionPayloadAvailability", err)
+	})
+
+	state := &BeaconState{
+		version:                      version.Gloas,
+		executionPayloadAvailability: make([]byte, params.BeaconConfig().SlotsPerHistoricalRoot/8),
+		dirtyFields:                  make(map[types.FieldIndex]bool),
+	}
+
+	slot := primitives.Slot(10)
+	bitIndex := slot % params.BeaconConfig().SlotsPerHistoricalRoot
+	byteIndex := bitIndex / 8
+	bitPosition := bitIndex % 8
+
+	require.NoError(t, state.SetExecutionPayloadAvailability(slot, true))
+	require.Equal(t, true, state.dirtyFields[types.ExecutionPayloadAvailability])
+	require.Equal(t, byte(1<<bitPosition), state.executionPayloadAvailability[byteIndex]&(1<<bitPosition))
+
+	require.NoError(t, state.SetExecutionPayloadAvailability(slot, false))
+	require.Equal(t, byte(0), state.executionPayloadAvailability[byteIndex]&(1<<bitPosition))
+}
+
+func TestSetExecutionPayloadAvailability_OutOfRange(t *testing.T) {
+	state := &BeaconState{
+		version:                      version.Gloas,
+		executionPayloadAvailability: []byte{},
+		dirtyFields:                  make(map[types.FieldIndex]bool),
+	}
+
+	err := state.SetExecutionPayloadAvailability(0, true)
+	require.ErrorContains(t, "out of range", err)
+	require.Equal(t, false, state.dirtyFields[types.ExecutionPayloadAvailability])
+}
+
+func TestIncreaseBuilderBalance(t *testing.T) {
+	t.Run("returns error before gloas", func(t *testing.T) {
+		st := &BeaconState{version: version.Fulu}
+		err := st.IncreaseBuilderBalance(0, 1)
+		require.ErrorContains(t, "IncreaseBuilderBalance", err)
+	})
+
+	t.Run("out of bounds returns error", func(t *testing.T) {
+		st := &BeaconState{
+			version:     version.Gloas,
+			dirtyFields: make(map[types.FieldIndex]bool),
+			sharedFieldReferences: map[types.FieldIndex]*stateutil.Reference{
+				types.Builders: stateutil.NewRef(1),
+			},
+			builders: []*ethpb.Builder{},
+		}
+
+		err := st.IncreaseBuilderBalance(0, 1)
+		require.ErrorContains(t, "out of bounds", err)
+		require.Equal(t, false, st.dirtyFields[types.Builders])
+	})
+
+	t.Run("nil builder returns error", func(t *testing.T) {
+		st := &BeaconState{
+			version:     version.Gloas,
+			dirtyFields: make(map[types.FieldIndex]bool),
+			sharedFieldReferences: map[types.FieldIndex]*stateutil.Reference{
+				types.Builders: stateutil.NewRef(1),
+			},
+			builders: []*ethpb.Builder{nil},
+		}
+
+		err := st.IncreaseBuilderBalance(0, 1)
+		require.ErrorContains(t, "is nil", err)
+		require.Equal(t, false, st.dirtyFields[types.Builders])
+	})
+
+	t.Run("increments and marks dirty", func(t *testing.T) {
+		orig := &ethpb.Builder{Balance: 10}
+		st := &BeaconState{
+			version:     version.Gloas,
+			dirtyFields: make(map[types.FieldIndex]bool),
+			sharedFieldReferences: map[types.FieldIndex]*stateutil.Reference{
+				types.Builders: stateutil.NewRef(1),
+			},
+			builders: []*ethpb.Builder{orig},
+		}
+
+		require.NoError(t, st.IncreaseBuilderBalance(0, 5))
+		require.Equal(t, primitives.Gwei(15), st.builders[0].Balance)
+		require.Equal(t, true, st.dirtyFields[types.Builders])
+		// Copy-on-write semantics: builder pointer replaced.
+		require.NotEqual(t, orig, st.builders[0])
+	})
+}
+
+func TestIncreaseBuilderBalance_CopyOnWrite(t *testing.T) {
+	orig := &ethpb.Builder{Balance: 10}
+	statePb, err := InitializeFromProtoUnsafeGloas(&ethpb.BeaconStateGloas{
+		Builders: []*ethpb.Builder{orig},
+	})
+	require.NoError(t, err)
+
+	st, ok := statePb.(*BeaconState)
+	require.Equal(t, true, ok)
+
+	copied := st.Copy().(*BeaconState)
+	require.Equal(t, uint(2), st.sharedFieldReferences[types.Builders].Refs())
+
+	require.NoError(t, copied.IncreaseBuilderBalance(0, 5))
+	require.Equal(t, primitives.Gwei(10), st.builders[0].Balance)
+	require.Equal(t, primitives.Gwei(15), copied.builders[0].Balance)
+	require.Equal(t, uint(1), st.sharedFieldReferences[types.Builders].Refs())
+	require.Equal(t, uint(1), copied.sharedFieldReferences[types.Builders].Refs())
+}
+
+func TestAddBuilderFromDeposit(t *testing.T) {
+	t.Run("returns error before gloas", func(t *testing.T) {
+		var pubkey [48]byte
+		var wc [32]byte
+		st := &BeaconState{version: version.Fulu}
+		err := st.AddBuilderFromDeposit(pubkey, wc, 1)
+		require.ErrorContains(t, "AddBuilderFromDeposit", err)
+	})
+
+	t.Run("reuses empty withdrawable slot", func(t *testing.T) {
+		var pubkey [48]byte
+		copy(pubkey[:], bytes.Repeat([]byte{0xAA}, 48))
+		var wc [32]byte
+		copy(wc[:], bytes.Repeat([]byte{0xBB}, 32))
+		wc[0] = 0x42 // version byte
+
+		st := &BeaconState{
+			version:     version.Gloas,
+			slot:        0, // epoch 0
+			dirtyFields: make(map[types.FieldIndex]bool),
+			sharedFieldReferences: map[types.FieldIndex]*stateutil.Reference{
+				types.Builders: stateutil.NewRef(1),
+			},
+			builders: []*ethpb.Builder{
+				{
+					WithdrawableEpoch: 0,
+					Balance:           0,
+				},
+			},
+		}
+
+		require.NoError(t, st.AddBuilderFromDeposit(pubkey, wc, 123))
+		require.Equal(t, 1, len(st.builders))
+		got := st.builders[0]
+		require.NotNil(t, got)
+		require.DeepEqual(t, pubkey[:], got.Pubkey)
+		require.DeepEqual(t, []byte{0x42}, got.Version)
+		require.DeepEqual(t, wc[12:], got.ExecutionAddress)
+		require.Equal(t, primitives.Gwei(123), got.Balance)
+		require.Equal(t, primitives.Epoch(0), got.DepositEpoch)
+		require.Equal(t, params.BeaconConfig().FarFutureEpoch, got.WithdrawableEpoch)
+		require.Equal(t, true, st.dirtyFields[types.Builders])
+	})
+
+	t.Run("appends new builder when no reusable slot", func(t *testing.T) {
+		var pubkey [48]byte
+		copy(pubkey[:], bytes.Repeat([]byte{0xAA}, 48))
+		var wc [32]byte
+		copy(wc[:], bytes.Repeat([]byte{0xBB}, 32))
+
+		st := &BeaconState{
+			version:     version.Gloas,
+			slot:        0,
+			dirtyFields: make(map[types.FieldIndex]bool),
+			sharedFieldReferences: map[types.FieldIndex]*stateutil.Reference{
+				types.Builders: stateutil.NewRef(1),
+			},
+			builders: []*ethpb.Builder{
+				{
+					WithdrawableEpoch: params.BeaconConfig().FarFutureEpoch,
+					Balance:           1,
+				},
+			},
+		}
+
+		require.NoError(t, st.AddBuilderFromDeposit(pubkey, wc, 5))
+		require.Equal(t, 2, len(st.builders))
+		require.NotNil(t, st.builders[1])
+		require.Equal(t, primitives.Gwei(5), st.builders[1].Balance)
+	})
+}
+
+func TestAddBuilderFromDeposit_CopyOnWrite(t *testing.T) {
+	var pubkey [48]byte
+	copy(pubkey[:], bytes.Repeat([]byte{0xAA}, 48))
+	var wc [32]byte
+	copy(wc[:], bytes.Repeat([]byte{0xBB}, 32))
+	wc[0] = 0x42 // version byte
+
+	statePb, err := InitializeFromProtoUnsafeGloas(&ethpb.BeaconStateGloas{
+		Slot: 0,
+		Builders: []*ethpb.Builder{
+			{
+				WithdrawableEpoch: params.BeaconConfig().FarFutureEpoch,
+				Balance:           1,
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	st, ok := statePb.(*BeaconState)
+	require.Equal(t, true, ok)
+
+	copied := st.Copy().(*BeaconState)
+	require.Equal(t, uint(2), st.sharedFieldReferences[types.Builders].Refs())
+
+	require.NoError(t, copied.AddBuilderFromDeposit(pubkey, wc, 5))
+	require.Equal(t, 1, len(st.builders))
+	require.Equal(t, 2, len(copied.builders))
+	require.Equal(t, uint(1), st.sharedFieldReferences[types.Builders].Refs())
+	require.Equal(t, uint(1), copied.sharedFieldReferences[types.Builders].Refs())
+}

beacon-chain/sync/BUILD.bazel

@@ -47,6 +47,7 @@ go_library(
         "subscriber_bls_to_execution_change.go",
         "subscriber_data_column_sidecar.go",
         "subscriber_handlers.go",
+        "subscriber_payload_attestation.go",
         "subscriber_sync_committee_message.go",
         "subscriber_sync_contribution_proof.go",
         "subscription_topic_handler.go",
@@ -57,7 +58,9 @@ go_library(
         "validate_blob.go",
         "validate_bls_to_execution_change.go",
         "validate_data_column.go",
+        "validate_execution_payload_envelope.go",
         "validate_light_client.go",
+        "validate_payload_attestation.go",
         "validate_proposer_slashing.go",
         "validate_sync_committee_message.go",
         "validate_sync_contribution_proof.go",
@@ -114,6 +117,7 @@ go_library(
         "//config/params:go_default_library",
         "//consensus-types/blocks:go_default_library",
         "//consensus-types/interfaces:go_default_library",
+        "//consensus-types/payload-attestation:go_default_library",
         "//consensus-types/primitives:go_default_library",
         "//consensus-types/wrapper:go_default_library",
         "//container/leaky-bucket:go_default_library",
@@ -211,7 +215,9 @@ go_test(
         "validate_blob_test.go",
         "validate_bls_to_execution_change_test.go",
         "validate_data_column_test.go",
+        "validate_execution_payload_envelope_test.go",
         "validate_light_client_test.go",
+        "validate_payload_attestation_test.go",
         "validate_proposer_slashing_test.go",
         "validate_sync_committee_message_test.go",
         "validate_sync_contribution_proof_test.go",
@@ -264,6 +270,7 @@ go_test(
         "//config/params:go_default_library",
         "//consensus-types/blocks:go_default_library",
         "//consensus-types/interfaces:go_default_library",
+        "//consensus-types/payload-attestation:go_default_library",
         "//consensus-types/primitives:go_default_library",
         "//consensus-types/wrapper:go_default_library",
         "//container/leaky-bucket:go_default_library",

beacon-chain/sync/options.go

@@ -207,6 +207,13 @@ func WithTrackedValidatorsCache(c *cache.TrackedValidatorsCache) Option {
 	}
 }
 
+func WithPayloadAttestationCache(c *cache.PayloadAttestationCache) Option {
+	return func(s *Service) error {
+		s.payloadAttestationCache = c
+		return nil
+	}
+}
+
 // WithSlasherEnabled configures the sync package to support slashing detection.
 func WithSlasherEnabled(enabled bool) Option {
 	return func(s *Service) error {

beacon-chain/sync/service.go

@@ -38,6 +38,7 @@ import (
 	"github.com/OffchainLabs/prysm/v7/config/params"
 	"github.com/OffchainLabs/prysm/v7/consensus-types/blocks"
 	"github.com/OffchainLabs/prysm/v7/consensus-types/interfaces"
+	payloadattestation "github.com/OffchainLabs/prysm/v7/consensus-types/payload-attestation"
 	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
 	leakybucket "github.com/OffchainLabs/prysm/v7/container/leaky-bucket"
 	"github.com/OffchainLabs/prysm/v7/crypto/rand"
@@ -61,6 +62,7 @@ var _ runtime.Service = (*Service)(nil)
 const (
 	rangeLimit               uint64 = 1024
 	seenBlockSize                   = 1000
+	seenPayloadEnvelopeSize         = 1000
 	seenDataColumnSize              = seenBlockSize * 128 // Each block can have max 128 data columns.
 	seenUnaggregatedAttSize         = 20000
 	seenAggregatedAttSize           = 16384
@@ -117,10 +119,12 @@ type blockchainService interface {
 	blockchain.BlockReceiver
 	blockchain.BlobReceiver
 	blockchain.DataColumnReceiver
+	blockchain.ExecutionPayloadEnvelopeReceiver
 	blockchain.HeadFetcher
 	blockchain.FinalizationFetcher
 	blockchain.ForkFetcher
 	blockchain.AttestationReceiver
+	blockchain.PayloadAttestationReceiver
 	blockchain.TimeFetcher
 	blockchain.GenesisFetcher
 	blockchain.CanonicalFetcher
@@ -132,73 +136,78 @@ type blockchainService interface {
 // Service is responsible for handling all run time p2p related operations as the
 // main entry point for network messages.
 type Service struct {
-	cfg                              *config
-	ctx                              context.Context
-	cancel                           context.CancelFunc
-	slotToPendingBlocks              *gcache.Cache
-	seenPendingBlocks                map[[32]byte]bool
-	blkRootToPendingAtts             map[[32]byte][]any
-	subHandler                       *subTopicHandler
-	pendingAttsLock                  sync.RWMutex
-	pendingQueueLock                 sync.RWMutex
-	chainStarted                     *abool.AtomicBool
-	validateBlockLock                sync.RWMutex
-	rateLimiter                      *limiter
-	seenBlockLock                    sync.RWMutex
-	seenBlockCache                   *lru.Cache
-	seenBlobLock                     sync.RWMutex
-	seenBlobCache                    *lru.Cache
-	seenDataColumnCache              *slotAwareCache
-	seenAggregatedAttestationLock    sync.RWMutex
-	seenAggregatedAttestationCache   *lru.Cache
-	seenUnAggregatedAttestationLock  sync.RWMutex
-	seenUnAggregatedAttestationCache *lru.Cache
-	seenExitLock                     sync.RWMutex
-	seenExitCache                    *lru.Cache
-	seenProposerSlashingLock         sync.RWMutex
-	seenProposerSlashingCache        *lru.Cache
-	seenAttesterSlashingLock         sync.RWMutex
-	seenAttesterSlashingCache        map[uint64]bool
-	seenSyncMessageLock              sync.RWMutex
-	seenSyncMessageCache             *lru.Cache
-	seenSyncContributionLock         sync.RWMutex
-	seenSyncContributionCache        *lru.Cache
-	badBlockCache                    *lru.Cache
-	badBlockLock                     sync.RWMutex
-	syncContributionBitsOverlapLock  sync.RWMutex
-	syncContributionBitsOverlapCache *lru.Cache
-	signatureChan                    chan *signatureVerifier
-	clockWaiter                      startup.ClockWaiter
-	initialSyncComplete              chan struct{}
-	verifierWaiter                   *verification.InitializerWaiter
-	newBlobVerifier                  verification.NewBlobVerifier
-	newColumnsVerifier               verification.NewDataColumnsVerifier
-	columnSidecarsExecSingleFlight   singleflight.Group
-	reconstructionSingleFlight       singleflight.Group
-	availableBlocker                 coverage.AvailableBlocker
-	reconstructionRandGen            *rand.Rand
-	trackedValidatorsCache           *cache.TrackedValidatorsCache
-	ctxMap                           ContextByteVersions
-	slasherEnabled                   bool
-	lcStore                          *lightClient.Store
-	dataColumnLogCh                  chan dataColumnLogEntry
-	digestActions                    perDigestSet
-	subscriptionSpawner              func(func()) // see Service.spawn for details
+	cfg                                 *config
+	ctx                                 context.Context
+	cancel                              context.CancelFunc
+	slotToPendingBlocks                 *gcache.Cache
+	seenPendingBlocks                   map[[32]byte]bool
+	blkRootToPendingAtts                map[[32]byte][]any
+	subHandler                          *subTopicHandler
+	pendingAttsLock                     sync.RWMutex
+	pendingQueueLock                    sync.RWMutex
+	chainStarted                        *abool.AtomicBool
+	validateBlockLock                   sync.RWMutex
+	rateLimiter                         *limiter
+	seenBlockLock                       sync.RWMutex
+	seenBlockCache                      *lru.Cache
+	seenPayloadEnvelopeCache            *lru.Cache
+	seenBlobLock                        sync.RWMutex
+	seenBlobCache                       *lru.Cache
+	seenDataColumnCache                 *slotAwareCache
+	seenAggregatedAttestationLock       sync.RWMutex
+	seenAggregatedAttestationCache      *lru.Cache
+	seenUnAggregatedAttestationLock     sync.RWMutex
+	seenUnAggregatedAttestationCache    *lru.Cache
+	seenExitLock                        sync.RWMutex
+	seenExitCache                       *lru.Cache
+	seenProposerSlashingLock            sync.RWMutex
+	seenProposerSlashingCache           *lru.Cache
+	seenAttesterSlashingLock            sync.RWMutex
+	seenAttesterSlashingCache           map[uint64]bool
+	seenSyncMessageLock                 sync.RWMutex
+	seenSyncMessageCache                *lru.Cache
+	seenSyncContributionLock            sync.RWMutex
+	seenSyncContributionCache           *lru.Cache
+	badBlockCache                       *lru.Cache
+	badBlockLock                        sync.RWMutex
+	syncContributionBitsOverlapLock     sync.RWMutex
+	syncContributionBitsOverlapCache    *lru.Cache
+	signatureChan                       chan *signatureVerifier
+	clockWaiter                         startup.ClockWaiter
+	initialSyncComplete                 chan struct{}
+	verifierWaiter                      *verification.InitializerWaiter
+	newBlobVerifier                     verification.NewBlobVerifier
+	newColumnsVerifier                  verification.NewDataColumnsVerifier
+	newPayloadAttestationVerifier       verification.NewPayloadAttestationMsgVerifier
+	columnSidecarsExecSingleFlight      singleflight.Group
+	reconstructionSingleFlight          singleflight.Group
+	availableBlocker                    coverage.AvailableBlocker
+	reconstructionRandGen               *rand.Rand
+	trackedValidatorsCache              *cache.TrackedValidatorsCache
+	ctxMap                              ContextByteVersions
+	slasherEnabled                      bool
+	lcStore                             *lightClient.Store
+	dataColumnLogCh                     chan dataColumnLogEntry
+	payloadAttestationCache             *cache.PayloadAttestationCache
+	digestActions                       perDigestSet
+	subscriptionSpawner                 func(func()) // see Service.spawn for details
+	newExecutionPayloadEnvelopeVerifier verification.NewExecutionPayloadEnvelopeVerifier
 }
 
 // NewService initializes new regular sync service.
 func NewService(ctx context.Context, opts ...Option) *Service {
 	ctx, cancel := context.WithCancel(ctx)
 	r := &Service{
-		ctx:                   ctx,
-		cancel:                cancel,
-		chainStarted:          abool.New(),
-		cfg:                   &config{clock: startup.NewClock(time.Unix(0, 0), [32]byte{})},
-		slotToPendingBlocks:   gcache.New(pendingBlockExpTime /* exp time */, 0 /* disable janitor */),
-		seenPendingBlocks:     make(map[[32]byte]bool),
-		blkRootToPendingAtts:  make(map[[32]byte][]any),
-		dataColumnLogCh:       make(chan dataColumnLogEntry, 1000),
-		reconstructionRandGen: rand.NewGenerator(),
+		ctx:                     ctx,
+		cancel:                  cancel,
+		chainStarted:            abool.New(),
+		cfg:                     &config{clock: startup.NewClock(time.Unix(0, 0), [32]byte{})},
+		slotToPendingBlocks:     gcache.New(pendingBlockExpTime /* exp time */, 0 /* disable janitor */),
+		seenPendingBlocks:       make(map[[32]byte]bool),
+		blkRootToPendingAtts:    make(map[[32]byte][]any),
+		dataColumnLogCh:         make(chan dataColumnLogEntry, 1000),
+		reconstructionRandGen:   rand.NewGenerator(),
+		payloadAttestationCache: &cache.PayloadAttestationCache{},
 	}
 
 	for _, opt := range opts {
@@ -250,6 +259,12 @@ func newDataColumnsVerifierFromInitializer(ini *verification.Initializer) verifi
 	}
 }
 
+func newPayloadAttestationMessageFromInitializer(ini *verification.Initializer) verification.NewPayloadAttestationMsgVerifier {
+	return func(pa payloadattestation.ROMessage, reqs []verification.Requirement) verification.PayloadAttestationMsgVerifier {
+		return ini.NewPayloadAttestationMsgVerifier(pa, reqs)
+	}
+}
+
 // Start the regular sync service.
 func (s *Service) Start() {
 	v, err := s.verifierWaiter.WaitForInitializer(s.ctx)
@@ -259,6 +274,8 @@ func (s *Service) Start() {
 	}
 	s.newBlobVerifier = newBlobVerifierFromInitializer(v)
 	s.newColumnsVerifier = newDataColumnsVerifierFromInitializer(v)
+	s.newPayloadAttestationVerifier = newPayloadAttestationMessageFromInitializer(v)
+	s.newExecutionPayloadEnvelopeVerifier = newPayloadVerifierFromInitializer(v)
 
 	go s.verifierRoutine()
 	go s.startDiscoveryAndSubscriptions()
@@ -346,6 +363,7 @@ func (s *Service) Status() error {
 // and prevent DoS.
 func (s *Service) initCaches() {
 	s.seenBlockCache = lruwrpr.New(seenBlockSize)
+	s.seenPayloadEnvelopeCache = lruwrpr.New(seenPayloadEnvelopeSize)
 	s.seenBlobCache = lruwrpr.New(seenBlockSize * params.BeaconConfig().DeprecatedMaxBlobsPerBlockElectra)
 	s.seenDataColumnCache = newSlotAwareCache(seenDataColumnSize)
 	s.seenAggregatedAttestationCache = lruwrpr.New(seenAggregatedAttSize)
@@ -546,3 +564,9 @@ type Checker interface {
 	Status() error
 	Resync() error
 }
+
+func newPayloadVerifierFromInitializer(ini *verification.Initializer) verification.NewExecutionPayloadEnvelopeVerifier {
+	return func(e interfaces.ROSignedExecutionPayloadEnvelope, reqs []verification.Requirement) verification.ExecutionPayloadEnvelopeVerifier {
+		return ini.NewPayloadEnvelopeVerifier(e, reqs)
+	}
+}

beacon-chain/sync/subscriber.go

@@ -330,6 +330,27 @@ func (s *Service) registerSubscribers(nse params.NetworkScheduleEntry) bool {
 			})
 		})
 	}
+
+	// New gossip topic in Gloas.
+	if params.BeaconConfig().GloasForkEpoch <= nse.Epoch {
+		s.spawn(func() {
+			s.subscribe(
+				p2p.PayloadAttestationMessageTopicFormat,
+				s.validatePayloadAttestation,
+				s.payloadAttestationSubscriber,
+				nse,
+			)
+		})
+
+		s.spawn(func() {
+			s.subscribe(
+				p2p.ExecutionPayloadEnvelopeTopicFormat,
+				s.validateExecutionPayloadEnvelope,
+				s.executionPayloadEnvelopeSubscriber,
+				nse,
+			)
+		})
+	}
 	return true
 }
 

beacon-chain/sync/subscriber_payload_attestation.go

@@ -0,0 +1,21 @@
+package sync
+
+import (
+	"context"
+
+	eth "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
+	"google.golang.org/protobuf/proto"
+)
+
+func (s *Service) payloadAttestationSubscriber(ctx context.Context, msg proto.Message) error {
+	a, ok := msg.(*eth.PayloadAttestationMessage)
+	if !ok {
+		return errWrongMessage
+	}
+
+	if err := s.payloadAttestationCache.Add(a.Data.Slot, a.ValidatorIndex); err != nil {
+		return err
+	}
+
+	return s.cfg.chain.ReceivePayloadAttestationMessage(ctx, a)
+}

beacon-chain/sync/validate_execution_payload_envelope.go

@@ -0,0 +1,158 @@
+package sync
+
+import (
+	"context"
+
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/p2p"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/verification"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/blocks"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+	"github.com/OffchainLabs/prysm/v7/encoding/bytesutil"
+	"github.com/OffchainLabs/prysm/v7/monitoring/tracing"
+	"github.com/OffchainLabs/prysm/v7/monitoring/tracing/trace"
+	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
+	pubsub "github.com/libp2p/go-libp2p-pubsub"
+	"github.com/libp2p/go-libp2p/core/peer"
+	"github.com/pkg/errors"
+	"google.golang.org/protobuf/proto"
+)
+
+func (s *Service) validateExecutionPayloadEnvelope(ctx context.Context, pid peer.ID, msg *pubsub.Message) (pubsub.ValidationResult, error) {
+	if pid == s.cfg.p2p.PeerID() {
+		return pubsub.ValidationAccept, nil
+	}
+	if s.cfg.initialSync.Syncing() {
+		return pubsub.ValidationIgnore, nil
+	}
+
+	ctx, span := trace.StartSpan(ctx, "sync.validateExecutionPayloadEnvelope")
+	defer span.End()
+
+	if msg.Topic == nil {
+		return pubsub.ValidationReject, p2p.ErrInvalidTopic
+	}
+
+	m, err := s.decodePubsubMessage(msg)
+	if err != nil {
+		tracing.AnnotateError(span, err)
+		return pubsub.ValidationReject, err
+	}
+
+	signedEnvelope, ok := m.(*ethpb.SignedExecutionPayloadEnvelope)
+	if !ok {
+		return pubsub.ValidationReject, errWrongMessage
+	}
+	e, err := blocks.WrappedROSignedExecutionPayloadEnvelope(signedEnvelope)
+	if err != nil {
+		log.WithError(err).Error("failed to create read only signed payload execution envelope")
+		return pubsub.ValidationIgnore, err
+	}
+	v := s.newExecutionPayloadEnvelopeVerifier(e, verification.GossipExecutionPayloadEnvelopeRequirements)
+
+	env, err := e.Envelope()
+	if err != nil {
+		return pubsub.ValidationIgnore, err
+	}
+
+	// [IGNORE] The envelope's block root envelope.block_root has been seen (via gossip or non-gossip sources)
+	// (a client MAY queue payload for processing once the block is retrieved).
+	if err := v.VerifyBlockRootSeen(func(root [32]byte) bool { return s.cfg.chain.HasBlock(ctx, root) }); err != nil {
+		return pubsub.ValidationIgnore, err
+	}
+	root := env.BeaconBlockRoot()
+	// [IGNORE] The node has not seen another valid SignedExecutionPayloadEnvelope for this block root from this builder.
+	if s.hasSeenPayloadEnvelope(root, env.BuilderIndex()) {
+		return pubsub.ValidationIgnore, nil
+	}
+	finalized := s.cfg.chain.FinalizedCheckpt()
+	if finalized == nil {
+		return pubsub.ValidationIgnore, errors.New("nil finalized checkpoint")
+	}
+	// [IGNORE] The envelope is from a slot greater than or equal to the latest finalized slot --
+	// i.e. validate that envelope.slot >= compute_start_slot_at_epoch(store.finalized_checkpoint.epoch).
+	if err := v.VerifySlotAboveFinalized(finalized.Epoch); err != nil {
+		return pubsub.ValidationIgnore, err
+	}
+	// [REJECT] block passes validation.
+	if err := v.VerifyBlockRootValid(s.hasBadBlock); err != nil {
+		return pubsub.ValidationReject, err
+	}
+
+	// Let block be the block with envelope.beacon_block_root.
+	block, err := s.cfg.beaconDB.Block(ctx, root)
+	if err != nil {
+		return pubsub.ValidationIgnore, err
+	}
+	// [REJECT] block.slot equals envelope.slot.
+	if err := v.VerifySlotMatchesBlock(block.Block().Slot()); err != nil {
+		return pubsub.ValidationReject, err
+	}
+
+	// Let bid alias block.body.signed_execution_payload_bid.message
+	// (notice that this can be obtained from the state.latest_execution_payload_bid).
+	signedBid, err := block.Block().Body().SignedExecutionPayloadBid()
+	if err != nil {
+		return pubsub.ValidationIgnore, err
+	}
+	wrappedBid, err := blocks.WrappedROSignedExecutionPayloadBid(signedBid)
+	if err != nil {
+		return pubsub.ValidationIgnore, err
+	}
+	bid, err := wrappedBid.Bid()
+	if err != nil {
+		return pubsub.ValidationIgnore, err
+	}
+	// [REJECT] envelope.builder_index == bid.builder_index.
+	if err := v.VerifyBuilderValid(bid); err != nil {
+		return pubsub.ValidationReject, err
+	}
+	// [REJECT] payload.block_hash == bid.block_hash.
+	if err := v.VerifyPayloadHash(bid); err != nil {
+		return pubsub.ValidationReject, err
+	}
+
+	// For self-build, the state is retrived via how we retrieve for beacon block optimization
+	// For builder index, the state is retrived via head state read only
+	st, err := s.blockVerifyingState(ctx, block)
+	if err != nil {
+		return pubsub.ValidationIgnore, err
+	}
+
+	// [REJECT] signed_execution_payload_envelope.signature is valid with respect to the builder's public key.
+	if err := v.VerifySignature(st); err != nil {
+		return pubsub.ValidationReject, err
+	}
+	s.setSeenPayloadEnvelope(root, env.BuilderIndex())
+	return pubsub.ValidationAccept, nil
+}
+
+func (s *Service) executionPayloadEnvelopeSubscriber(ctx context.Context, msg proto.Message) error {
+	e, ok := msg.(*ethpb.SignedExecutionPayloadEnvelope)
+	if !ok {
+		return errWrongMessage
+	}
+	env, err := blocks.WrappedROSignedExecutionPayloadEnvelope(e)
+	if err != nil {
+		return errors.Wrap(err, "could not wrap signed execution payload envelope")
+	}
+	return s.cfg.chain.ReceiveExecutionPayloadEnvelope(ctx, env)
+}
+
+func (s *Service) hasSeenPayloadEnvelope(root [32]byte, builderIdx primitives.BuilderIndex) bool {
+	if s.seenPayloadEnvelopeCache == nil {
+		return false
+	}
+
+	b := append(bytesutil.Bytes32(uint64(builderIdx)), root[:]...)
+	_, seen := s.seenPayloadEnvelopeCache.Get(string(b))
+	return seen
+}
+
+func (s *Service) setSeenPayloadEnvelope(root [32]byte, builderIdx primitives.BuilderIndex) {
+	if s.seenPayloadEnvelopeCache == nil {
+		return
+	}
+
+	b := append(bytesutil.Bytes32(uint64(builderIdx)), root[:]...)
+	s.seenPayloadEnvelopeCache.Add(string(b), true)
+}

beacon-chain/sync/validate_execution_payload_envelope_test.go

@@ -0,0 +1,291 @@
+package sync
+
+import (
+	"bytes"
+	"context"
+	"reflect"
+	"testing"
+	"time"
+
+	mock "github.com/OffchainLabs/prysm/v7/beacon-chain/blockchain/testing"
+	dbtest "github.com/OffchainLabs/prysm/v7/beacon-chain/db/testing"
+	doublylinkedtree "github.com/OffchainLabs/prysm/v7/beacon-chain/forkchoice/doubly-linked-tree"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/p2p"
+	p2ptest "github.com/OffchainLabs/prysm/v7/beacon-chain/p2p/testing"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/startup"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/state"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/state/stategen"
+	mockSync "github.com/OffchainLabs/prysm/v7/beacon-chain/sync/initial-sync/testing"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/verification"
+	lruwrpr "github.com/OffchainLabs/prysm/v7/cache/lru"
+	"github.com/OffchainLabs/prysm/v7/config/params"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/blocks"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/interfaces"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+	"github.com/OffchainLabs/prysm/v7/encoding/bytesutil"
+	enginev1 "github.com/OffchainLabs/prysm/v7/proto/engine/v1"
+	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
+	"github.com/OffchainLabs/prysm/v7/testing/require"
+	"github.com/OffchainLabs/prysm/v7/testing/util"
+	pubsub "github.com/libp2p/go-libp2p-pubsub"
+	pb "github.com/libp2p/go-libp2p-pubsub/pb"
+	"github.com/pkg/errors"
+)
+
+func TestValidateExecutionPayloadEnvelope_InvalidTopic(t *testing.T) {
+	ctx := context.Background()
+	p := p2ptest.NewTestP2P(t)
+	s := &Service{cfg: &config{p2p: p, initialSync: &mockSync.Sync{}}}
+
+	result, err := s.validateExecutionPayloadEnvelope(ctx, "", &pubsub.Message{
+		Message: &pb.Message{},
+	})
+	require.ErrorIs(t, p2p.ErrInvalidTopic, err)
+	require.Equal(t, result, pubsub.ValidationReject)
+}
+
+func TestValidateExecutionPayloadEnvelope_AlreadySeen(t *testing.T) {
+	ctx := context.Background()
+	s, msg, builderIdx, root := setupExecutionPayloadEnvelopeService(t, 1, 1)
+	s.newExecutionPayloadEnvelopeVerifier = testNewExecutionPayloadEnvelopeVerifier(mockExecutionPayloadEnvelopeVerifier{})
+
+	s.setSeenPayloadEnvelope(root, builderIdx)
+	result, err := s.validateExecutionPayloadEnvelope(ctx, "", msg)
+	require.NoError(t, err)
+	require.Equal(t, result, pubsub.ValidationIgnore)
+}
+
+func TestValidateExecutionPayloadEnvelope_ErrorPathsWithMock(t *testing.T) {
+	ctx := context.Background()
+	tests := []struct {
+		name     string
+		verifier mockExecutionPayloadEnvelopeVerifier
+		result   pubsub.ValidationResult
+	}{
+		{
+			name:     "block root not seen",
+			verifier: mockExecutionPayloadEnvelopeVerifier{errBlockRootSeen: errors.New("not seen")},
+			result:   pubsub.ValidationIgnore,
+		},
+		{
+			name:     "slot below finalized",
+			verifier: mockExecutionPayloadEnvelopeVerifier{errSlotAboveFinalized: errors.New("below finalized")},
+			result:   pubsub.ValidationIgnore,
+		},
+		{
+			name:     "block root invalid",
+			verifier: mockExecutionPayloadEnvelopeVerifier{errBlockRootValid: errors.New("invalid block")},
+			result:   pubsub.ValidationReject,
+		},
+		{
+			name:     "slot mismatch",
+			verifier: mockExecutionPayloadEnvelopeVerifier{errSlotMatchesBlock: errors.New("slot mismatch")},
+			result:   pubsub.ValidationReject,
+		},
+		{
+			name:     "builder mismatch",
+			verifier: mockExecutionPayloadEnvelopeVerifier{errBuilderValid: errors.New("builder mismatch")},
+			result:   pubsub.ValidationReject,
+		},
+		{
+			name:     "payload hash mismatch",
+			verifier: mockExecutionPayloadEnvelopeVerifier{errPayloadHash: errors.New("payload hash mismatch")},
+			result:   pubsub.ValidationReject,
+		},
+		{
+			name:     "signature invalid",
+			verifier: mockExecutionPayloadEnvelopeVerifier{errSignature: errors.New("signature invalid")},
+			result:   pubsub.ValidationReject,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			s, msg, _, _ := setupExecutionPayloadEnvelopeService(t, 1, 1)
+			s.newExecutionPayloadEnvelopeVerifier = testNewExecutionPayloadEnvelopeVerifier(tc.verifier)
+
+			result, err := s.validateExecutionPayloadEnvelope(ctx, "", msg)
+			require.NotNil(t, err)
+			require.Equal(t, result, tc.result)
+		})
+	}
+}
+
+func TestValidateExecutionPayloadEnvelope_HappyPath(t *testing.T) {
+	ctx := context.Background()
+	s, msg, builderIdx, root := setupExecutionPayloadEnvelopeService(t, 1, 1)
+	s.newExecutionPayloadEnvelopeVerifier = testNewExecutionPayloadEnvelopeVerifier(mockExecutionPayloadEnvelopeVerifier{})
+
+	require.Equal(t, false, s.hasSeenPayloadEnvelope(root, builderIdx))
+	result, err := s.validateExecutionPayloadEnvelope(ctx, "", msg)
+	require.NoError(t, err)
+	require.Equal(t, result, pubsub.ValidationAccept)
+	require.Equal(t, true, s.hasSeenPayloadEnvelope(root, builderIdx))
+}
+
+func TestExecutionPayloadEnvelopeSubscriber_WrongMessage(t *testing.T) {
+	s := &Service{cfg: &config{}}
+	err := s.executionPayloadEnvelopeSubscriber(context.Background(), &ethpb.BeaconBlock{})
+	require.ErrorIs(t, errWrongMessage, err)
+}
+
+func TestExecutionPayloadEnvelopeSubscriber_HappyPath(t *testing.T) {
+	s := &Service{cfg: &config{chain: &mock.ChainService{}}}
+	root := [32]byte{0x01}
+	blockHash := [32]byte{0x02}
+	env := testSignedExecutionPayloadEnvelope(t, 1, 2, root, blockHash)
+
+	err := s.executionPayloadEnvelopeSubscriber(context.Background(), env)
+	require.NoError(t, err)
+}
+
+type mockExecutionPayloadEnvelopeVerifier struct {
+	errBlockRootSeen      error
+	errBlockRootValid     error
+	errSlotAboveFinalized error
+	errSlotMatchesBlock   error
+	errBuilderValid       error
+	errPayloadHash        error
+	errSignature          error
+}
+
+var _ verification.ExecutionPayloadEnvelopeVerifier = &mockExecutionPayloadEnvelopeVerifier{}
+
+func (m *mockExecutionPayloadEnvelopeVerifier) VerifyBlockRootSeen(_ func([32]byte) bool) error {
+	return m.errBlockRootSeen
+}
+
+func (m *mockExecutionPayloadEnvelopeVerifier) VerifyBlockRootValid(_ func([32]byte) bool) error {
+	return m.errBlockRootValid
+}
+
+func (m *mockExecutionPayloadEnvelopeVerifier) VerifySlotAboveFinalized(_ primitives.Epoch) error {
+	return m.errSlotAboveFinalized
+}
+
+func (m *mockExecutionPayloadEnvelopeVerifier) VerifySlotMatchesBlock(_ primitives.Slot) error {
+	return m.errSlotMatchesBlock
+}
+
+func (m *mockExecutionPayloadEnvelopeVerifier) VerifyBuilderValid(_ interfaces.ROExecutionPayloadBid) error {
+	return m.errBuilderValid
+}
+
+func (m *mockExecutionPayloadEnvelopeVerifier) VerifyPayloadHash(_ interfaces.ROExecutionPayloadBid) error {
+	return m.errPayloadHash
+}
+
+func (m *mockExecutionPayloadEnvelopeVerifier) VerifySignature(_ state.ReadOnlyBeaconState) error {
+	return m.errSignature
+}
+
+func (*mockExecutionPayloadEnvelopeVerifier) SatisfyRequirement(_ verification.Requirement) {}
+
+func testNewExecutionPayloadEnvelopeVerifier(m mockExecutionPayloadEnvelopeVerifier) verification.NewExecutionPayloadEnvelopeVerifier {
+	return func(_ interfaces.ROSignedExecutionPayloadEnvelope, _ []verification.Requirement) verification.ExecutionPayloadEnvelopeVerifier {
+		clone := m
+		return &clone
+	}
+}
+
+func setupExecutionPayloadEnvelopeService(t *testing.T, envelopeSlot, blockSlot primitives.Slot) (*Service, *pubsub.Message, primitives.BuilderIndex, [32]byte) {
+	t.Helper()
+
+	ctx := context.Background()
+	db := dbtest.SetupDB(t)
+	p := p2ptest.NewTestP2P(t)
+	chainService := &mock.ChainService{
+		Genesis:             time.Unix(time.Now().Unix()-int64(params.BeaconConfig().SecondsPerSlot), 0),
+		FinalizedCheckPoint: &ethpb.Checkpoint{},
+		DB:                  db,
+	}
+	stateGen := stategen.New(db, doublylinkedtree.New())
+	s := &Service{
+		seenPayloadEnvelopeCache: lruwrpr.New(10),
+		cfg: &config{
+			p2p:         p,
+			initialSync: &mockSync.Sync{},
+			chain:       chainService,
+			beaconDB:    db,
+			stateGen:    stateGen,
+			clock:       startup.NewClock(chainService.Genesis, chainService.ValidatorsRoot),
+		},
+	}
+
+	bid := util.GenerateTestSignedExecutionPayloadBid(blockSlot)
+	sb := util.NewBeaconBlockGloas()
+	sb.Block.Slot = blockSlot
+	sb.Block.Body.SignedExecutionPayloadBid = bid
+	signedBlock, err := blocks.NewSignedBeaconBlock(sb)
+	require.NoError(t, err)
+	root, err := signedBlock.Block().HashTreeRoot()
+	require.NoError(t, err)
+	require.NoError(t, db.SaveBlock(ctx, signedBlock))
+
+	state, err := util.NewBeaconStateFulu()
+	require.NoError(t, err)
+	require.NoError(t, db.SaveState(ctx, state, root))
+
+	blockHash := bytesutil.ToBytes32(bid.Message.BlockHash)
+	env := testSignedExecutionPayloadEnvelope(t, envelopeSlot, primitives.BuilderIndex(bid.Message.BuilderIndex), root, blockHash)
+	msg := envelopeToPubsub(t, s, p, env)
+
+	return s, msg, primitives.BuilderIndex(bid.Message.BuilderIndex), root
+}
+
+func envelopeToPubsub(t *testing.T, s *Service, p p2p.P2P, env *ethpb.SignedExecutionPayloadEnvelope) *pubsub.Message {
+	t.Helper()
+
+	buf := new(bytes.Buffer)
+	_, err := p.Encoding().EncodeGossip(buf, env)
+	require.NoError(t, err)
+
+	topic := p2p.GossipTypeMapping[reflect.TypeFor[*ethpb.SignedExecutionPayloadEnvelope]()]
+	digest, err := s.currentForkDigest()
+	require.NoError(t, err)
+	topic = s.addDigestToTopic(topic, digest)
+
+	return &pubsub.Message{
+		Message: &pb.Message{
+			Data:  buf.Bytes(),
+			Topic: &topic,
+		},
+	}
+}
+
+func testSignedExecutionPayloadEnvelope(t *testing.T, slot primitives.Slot, builderIdx primitives.BuilderIndex, root, blockHash [32]byte) *ethpb.SignedExecutionPayloadEnvelope {
+	t.Helper()
+
+	payload := &enginev1.ExecutionPayloadDeneb{
+		ParentHash:    bytes.Repeat([]byte{0x01}, 32),
+		FeeRecipient:  bytes.Repeat([]byte{0x02}, 20),
+		StateRoot:     bytes.Repeat([]byte{0x03}, 32),
+		ReceiptsRoot:  bytes.Repeat([]byte{0x04}, 32),
+		LogsBloom:     bytes.Repeat([]byte{0x05}, 256),
+		PrevRandao:    bytes.Repeat([]byte{0x06}, 32),
+		BlockNumber:   1,
+		GasLimit:      2,
+		GasUsed:       3,
+		Timestamp:     4,
+		BaseFeePerGas: bytes.Repeat([]byte{0x07}, 32),
+		BlockHash:     blockHash[:],
+		Transactions:  [][]byte{},
+		Withdrawals:   []*enginev1.Withdrawal{},
+		BlobGasUsed:   0,
+		ExcessBlobGas: 0,
+	}
+
+	return &ethpb.SignedExecutionPayloadEnvelope{
+		Message: &ethpb.ExecutionPayloadEnvelope{
+			Payload: payload,
+			ExecutionRequests: &enginev1.ExecutionRequests{
+				Deposits: []*enginev1.DepositRequest{},
+			},
+			BuilderIndex:    builderIdx,
+			BeaconBlockRoot: root[:],
+			Slot:            slot,
+			StateRoot:       bytes.Repeat([]byte{0xBB}, 32),
+		},
+		Signature: bytes.Repeat([]byte{0xAA}, 96),
+	}
+}

beacon-chain/sync/validate_payload_attestation.go

@@ -0,0 +1,131 @@
+package sync
+
+import (
+	"bytes"
+	"context"
+
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/core/transition"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/p2p"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/state"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/verification"
+	payloadattestation "github.com/OffchainLabs/prysm/v7/consensus-types/payload-attestation"
+	"github.com/OffchainLabs/prysm/v7/encoding/bytesutil"
+	"github.com/OffchainLabs/prysm/v7/monitoring/tracing/trace"
+	eth "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
+	"github.com/OffchainLabs/prysm/v7/time/slots"
+	pubsub "github.com/libp2p/go-libp2p-pubsub"
+	"github.com/libp2p/go-libp2p/core/peer"
+	"github.com/pkg/errors"
+)
+
+var (
+	errAlreadySeenPayloadAttestation = errors.New("payload attestation already seen for validator index")
+)
+
+func (s *Service) validatePayloadAttestation(ctx context.Context, pid peer.ID, msg *pubsub.Message) (pubsub.ValidationResult, error) {
+	if pid == s.cfg.p2p.PeerID() {
+		return pubsub.ValidationAccept, nil
+	}
+	if s.cfg.initialSync.Syncing() {
+		return pubsub.ValidationIgnore, nil
+	}
+	ctx, span := trace.StartSpan(ctx, "sync.validatePayloadAttestation")
+	defer span.End()
+
+	if msg.Topic == nil {
+		return pubsub.ValidationReject, p2p.ErrInvalidTopic
+	}
+	m, err := s.decodePubsubMessage(msg)
+	if err != nil {
+		return pubsub.ValidationReject, err
+	}
+	att, ok := m.(*eth.PayloadAttestationMessage)
+	if !ok {
+		return pubsub.ValidationReject, errWrongMessage
+	}
+	pa, err := payloadattestation.NewReadOnly(att)
+	if err != nil {
+		return pubsub.ValidationIgnore, err
+	}
+	v := s.newPayloadAttestationVerifier(pa, verification.GossipPayloadAttestationMessageRequirements)
+
+	// [IGNORE] The message's slot is for the current slot (with a MAXIMUM_GOSSIP_CLOCK_DISPARITY allowance),
+	// i.e. data.slot == current_slot.
+	if err := v.VerifyCurrentSlot(); err != nil {
+		return pubsub.ValidationIgnore, err
+	}
+
+	// [IGNORE] The payload_attestation_message is the first valid message received from the validator with
+	// index payload_attestation_message.validator_index.
+	if s.payloadAttestationCache.Seen(pa.Slot(), pa.ValidatorIndex()) {
+		return pubsub.ValidationIgnore, errAlreadySeenPayloadAttestation
+	}
+
+	// [IGNORE] The message's block data.beacon_block_root has been seen (via gossip or non-gossip sources)
+	// (a client MAY queue attestation for processing once the block is retrieved. Note a client might want to request payload after).
+	if err := v.VerifyBlockRootSeen(s.cfg.chain.InForkchoice); err != nil {
+		// TODO: queue attestation
+		return pubsub.ValidationIgnore, err
+	}
+
+	// [REJECT] The message's block data.beacon_block_root passes validation.
+	if err := v.VerifyBlockRootValid(s.hasBadBlock); err != nil {
+		return pubsub.ValidationReject, err
+	}
+
+	st, err := s.getPtcState(ctx, pa)
+	if err != nil {
+		return pubsub.ValidationIgnore, err
+	}
+
+	// [REJECT] The message's validator index is within the payload committee in get_ptc(state, data.slot).
+	// The state is the head state corresponding to processing the block up to the current slot.
+	if err := v.VerifyValidatorInPTC(ctx, st); err != nil {
+		return pubsub.ValidationReject, err
+	}
+
+	// [REJECT] payload_attestation_message.signature is valid with respect to the validator's public key.
+	if err := v.VerifySignature(st); err != nil {
+		return pubsub.ValidationReject, err
+	}
+
+	msg.ValidatorData = att
+
+	return pubsub.ValidationAccept, nil
+}
+
+func (s *Service) getPtcState(ctx context.Context, pa payloadattestation.ROMessage) (state.ReadOnlyBeaconState, error) {
+	blockRoot := pa.BeaconBlockRoot()
+	blockSlot := pa.Slot()
+	blockEpoch := slots.ToEpoch(blockSlot)
+	headSlot := s.cfg.chain.HeadSlot()
+	headEpoch := slots.ToEpoch(headSlot)
+	headRoot, err := s.cfg.chain.HeadRoot(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	if blockEpoch == headEpoch {
+		if bytes.Equal(blockRoot[:], headRoot) {
+			return s.cfg.chain.HeadStateReadOnly(ctx)
+		}
+
+		headDependent, err := s.cfg.chain.DependentRootForEpoch(bytesutil.ToBytes32(headRoot), blockEpoch)
+		if err != nil {
+			return nil, err
+		}
+		blockDependent, err := s.cfg.chain.DependentRootForEpoch(blockRoot, blockEpoch)
+		if err != nil {
+			return nil, err
+		}
+		if bytes.Equal(headDependent[:], blockDependent[:]) {
+			return s.cfg.chain.HeadStateReadOnly(ctx)
+		}
+	}
+
+	headState, err := s.cfg.chain.HeadState(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return transition.ProcessSlotsUsingNextSlotCache(ctx, headState, headRoot, blockSlot)
+}

beacon-chain/sync/validate_payload_attestation_test.go

@@ -0,0 +1,165 @@
+package sync
+
+import (
+	"bytes"
+	"context"
+	"reflect"
+	"testing"
+	"time"
+
+	mock "github.com/OffchainLabs/prysm/v7/beacon-chain/blockchain/testing"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/cache"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/p2p"
+	p2ptest "github.com/OffchainLabs/prysm/v7/beacon-chain/p2p/testing"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/startup"
+	mockSync "github.com/OffchainLabs/prysm/v7/beacon-chain/sync/initial-sync/testing"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/verification"
+	fieldparams "github.com/OffchainLabs/prysm/v7/config/fieldparams"
+	"github.com/OffchainLabs/prysm/v7/config/params"
+	payloadattestation "github.com/OffchainLabs/prysm/v7/consensus-types/payload-attestation"
+	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
+	"github.com/OffchainLabs/prysm/v7/testing/require"
+	"github.com/OffchainLabs/prysm/v7/testing/util"
+	pubsub "github.com/libp2p/go-libp2p-pubsub"
+	pb "github.com/libp2p/go-libp2p-pubsub/pb"
+	"github.com/pkg/errors"
+)
+
+func TestValidatePayloadAttestationMessage_IncorrectTopic(t *testing.T) {
+	ctx := context.Background()
+	p := p2ptest.NewTestP2P(t)
+	chainService := &mock.ChainService{Genesis: time.Unix(time.Now().Unix()-int64(params.BeaconConfig().SecondsPerSlot), 0)}
+	s := &Service{
+		payloadAttestationCache: &cache.PayloadAttestationCache{},
+		cfg:                     &config{chain: chainService, p2p: p, initialSync: &mockSync.Sync{}, clock: startup.NewClock(chainService.Genesis, chainService.ValidatorsRoot)}}
+
+	msg := util.HydratePayloadAttestation(&ethpb.PayloadAttestation{}) // Using payload attestation for message should fail.
+	buf := new(bytes.Buffer)
+	_, err := p.Encoding().EncodeGossip(buf, msg)
+	require.NoError(t, err)
+
+	topic := p2p.GossipTypeMapping[reflect.TypeFor[*ethpb.PayloadAttestation]()]
+	digest, err := s.currentForkDigest()
+	require.NoError(t, err)
+	topic = s.addDigestToTopic(topic, digest)
+
+	result, err := s.validatePayloadAttestation(ctx, "", &pubsub.Message{
+		Message: &pb.Message{
+			Data:  buf.Bytes(),
+			Topic: &topic,
+		}})
+	require.ErrorContains(t, "extraction failed for topic", err)
+	require.Equal(t, result, pubsub.ValidationReject)
+}
+
+func TestValidatePayloadAttestationMessage_ErrorPathsWithMock(t *testing.T) {
+	tests := []struct {
+		error    error
+		verifier verification.NewPayloadAttestationMsgVerifier
+		result   pubsub.ValidationResult
+	}{
+		{
+			error: errors.New("incorrect slot"),
+			verifier: func(pa payloadattestation.ROMessage, reqs []verification.Requirement) verification.PayloadAttestationMsgVerifier {
+				return &verification.MockPayloadAttestation{ErrIncorrectPayloadAttSlot: errors.New("incorrect slot")}
+			},
+			result: pubsub.ValidationIgnore,
+		},
+		{
+			error: errors.New("block root seen"),
+			verifier: func(pa payloadattestation.ROMessage, reqs []verification.Requirement) verification.PayloadAttestationMsgVerifier {
+				return &verification.MockPayloadAttestation{ErrPayloadAttBlockRootNotSeen: errors.New("block root seen")}
+			},
+			result: pubsub.ValidationIgnore,
+		},
+		{
+			error: errors.New("block root invalid"),
+			verifier: func(pa payloadattestation.ROMessage, reqs []verification.Requirement) verification.PayloadAttestationMsgVerifier {
+				return &verification.MockPayloadAttestation{ErrPayloadAttBlockRootInvalid: errors.New("block root invalid")}
+			},
+			result: pubsub.ValidationReject,
+		},
+		{
+			error: errors.New("validator not in PTC"),
+			verifier: func(pa payloadattestation.ROMessage, reqs []verification.Requirement) verification.PayloadAttestationMsgVerifier {
+				return &verification.MockPayloadAttestation{ErrIncorrectPayloadAttValidator: errors.New("validator not in PTC")}
+			},
+			result: pubsub.ValidationReject,
+		},
+		{
+			error: errors.New("incorrect signature"),
+			verifier: func(pa payloadattestation.ROMessage, reqs []verification.Requirement) verification.PayloadAttestationMsgVerifier {
+				return &verification.MockPayloadAttestation{ErrInvalidMessageSignature: errors.New("incorrect signature")}
+			},
+			result: pubsub.ValidationReject,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.error.Error(), func(t *testing.T) {
+			ctx := context.Background()
+			p := p2ptest.NewTestP2P(t)
+			chainService := &mock.ChainService{Genesis: time.Unix(time.Now().Unix()-int64(params.BeaconConfig().SecondsPerSlot), 0)}
+			s := &Service{
+				payloadAttestationCache: &cache.PayloadAttestationCache{},
+				cfg:                     &config{chain: chainService, p2p: p, initialSync: &mockSync.Sync{}, clock: startup.NewClock(chainService.Genesis, chainService.ValidatorsRoot)}}
+			s.newPayloadAttestationVerifier = tt.verifier
+
+			msg := newPayloadAttestationMessage()
+			buf := new(bytes.Buffer)
+			_, err := p.Encoding().EncodeGossip(buf, msg)
+			require.NoError(t, err)
+
+			topic := p2p.GossipTypeMapping[reflect.TypeFor[*ethpb.PayloadAttestationMessage]()]
+			digest, err := s.currentForkDigest()
+			require.NoError(t, err)
+			topic = s.addDigestToTopic(topic, digest)
+
+			result, err := s.validatePayloadAttestation(ctx, "", &pubsub.Message{
+				Message: &pb.Message{
+					Data:  buf.Bytes(),
+					Topic: &topic,
+				}})
+
+			require.ErrorContains(t, tt.error.Error(), err)
+			require.Equal(t, result, tt.result)
+		})
+	}
+}
+
+func TestValidatePayloadAttestationMessage_Accept(t *testing.T) {
+	ctx := context.Background()
+	p := p2ptest.NewTestP2P(t)
+	chainService := &mock.ChainService{Genesis: time.Unix(time.Now().Unix()-int64(params.BeaconConfig().SecondsPerSlot), 0)}
+	s := &Service{
+		payloadAttestationCache: &cache.PayloadAttestationCache{},
+		cfg:                     &config{chain: chainService, p2p: p, initialSync: &mockSync.Sync{}, clock: startup.NewClock(chainService.Genesis, chainService.ValidatorsRoot)}}
+	s.newPayloadAttestationVerifier = func(pa payloadattestation.ROMessage, reqs []verification.Requirement) verification.PayloadAttestationMsgVerifier {
+		return &verification.MockPayloadAttestation{}
+	}
+
+	msg := newPayloadAttestationMessage()
+	buf := new(bytes.Buffer)
+	_, err := p.Encoding().EncodeGossip(buf, msg)
+	require.NoError(t, err)
+
+	topic := p2p.GossipTypeMapping[reflect.TypeFor[*ethpb.PayloadAttestationMessage]()]
+	digest, err := s.currentForkDigest()
+	require.NoError(t, err)
+	topic = s.addDigestToTopic(topic, digest)
+
+	result, err := s.validatePayloadAttestation(ctx, "", &pubsub.Message{
+		Message: &pb.Message{
+			Data:  buf.Bytes(),
+			Topic: &topic,
+		}})
+	require.NoError(t, err)
+	require.Equal(t, result, pubsub.ValidationAccept)
+}
+
+func newPayloadAttestationMessage() *ethpb.PayloadAttestationMessage {
+	return &ethpb.PayloadAttestationMessage{
+		ValidatorIndex: 0,
+		Data:           util.HydratePayloadAttestationData(&ethpb.PayloadAttestationData{Slot: 1}),
+		Signature:      make([]byte, fieldparams.BLSSignatureLength),
+	}
+}

beacon-chain/verification/BUILD.bazel

@@ -8,6 +8,7 @@ go_library(
         "cache.go",
         "data_column.go",
         "error.go",
+        "execution_payload_envelope.go",
         "fake.go",
         "filesystem.go",
         "initializer.go",
@@ -15,12 +16,16 @@ go_library(
         "log.go",
         "metrics.go",
         "mock.go",
+        "payload_attestation.go",
+        "payload_attestation_mock.go",
+        "requirements.go",
         "result.go",
     ],
     importpath = "github.com/OffchainLabs/prysm/v7/beacon-chain/verification",
     visibility = ["//visibility:public"],
     deps = [
         "//beacon-chain/blockchain/kzg:go_default_library",
+        "//beacon-chain/core/gloas:go_default_library",
         "//beacon-chain/core/helpers:go_default_library",
         "//beacon-chain/core/peerdas:go_default_library",
         "//beacon-chain/core/signing:go_default_library",
@@ -32,6 +37,8 @@ go_library(
         "//config/fieldparams:go_default_library",
         "//config/params:go_default_library",
         "//consensus-types/blocks:go_default_library",
+        "//consensus-types/interfaces:go_default_library",
+        "//consensus-types/payload-attestation:go_default_library",
         "//consensus-types/primitives:go_default_library",
         "//crypto/bls:go_default_library",
         "//encoding/bytesutil:go_default_library",
@@ -55,14 +62,17 @@ go_test(
         "blob_test.go",
         "cache_test.go",
         "data_column_test.go",
+        "execution_payload_envelope_test.go",
         "filesystem_test.go",
         "initializer_test.go",
+        "payload_attestation_test.go",
         "result_test.go",
         "verification_test.go",
     ],
     embed = [":go_default_library"],
     deps = [
         "//beacon-chain/blockchain/kzg:go_default_library",
+        "//beacon-chain/core/helpers:go_default_library",
         "//beacon-chain/core/peerdas:go_default_library",
         "//beacon-chain/core/signing:go_default_library",
         "//beacon-chain/db:go_default_library",
@@ -73,9 +83,13 @@ go_test(
         "//config/fieldparams:go_default_library",
         "//config/params:go_default_library",
         "//consensus-types/blocks:go_default_library",
+        "//consensus-types/interfaces:go_default_library",
+        "//consensus-types/payload-attestation:go_default_library",
         "//consensus-types/primitives:go_default_library",
         "//crypto/bls:go_default_library",
+        "//crypto/bls/common:go_default_library",
         "//encoding/bytesutil:go_default_library",
+        "//proto/engine/v1:go_default_library",
         "//proto/prysm/v1alpha1:go_default_library",
         "//runtime/interop:go_default_library",
         "//testing/require:go_default_library",

beacon-chain/verification/blob.go

@@ -14,24 +14,6 @@ import (
 	"github.com/pkg/errors"
 )
 
-const (
-	RequireBlobIndexInBounds Requirement = iota
-	RequireNotFromFutureSlot
-	RequireSlotAboveFinalized
-	RequireValidProposerSignature
-	RequireSidecarParentSeen
-	RequireSidecarParentValid
-	RequireSidecarParentSlotLower
-	RequireSidecarDescendsFromFinalized
-	RequireSidecarInclusionProven
-	RequireSidecarKzgProofVerified
-	RequireSidecarProposerExpected
-
-	// Data columns specific.
-	RequireValidFields
-	RequireCorrectSubnet
-)
-
 var allBlobSidecarRequirements = []Requirement{
 	RequireBlobIndexInBounds,
 	RequireNotFromFutureSlot,

beacon-chain/verification/execution_payload_envelope.go

@@ -0,0 +1,229 @@
+package verification
+
+import (
+	"fmt"
+
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/core/signing"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/state"
+	"github.com/OffchainLabs/prysm/v7/config/params"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/interfaces"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+	"github.com/OffchainLabs/prysm/v7/crypto/bls"
+	"github.com/OffchainLabs/prysm/v7/time/slots"
+	"github.com/pkg/errors"
+)
+
+// ExecutionPayloadEnvelopeVerifier defines the methods implemented by the ROSignedExecutionPayloadEnvelope.
+type ExecutionPayloadEnvelopeVerifier interface {
+	VerifyBlockRootSeen(func([32]byte) bool) error
+	VerifyBlockRootValid(func([32]byte) bool) error
+	VerifySlotAboveFinalized(primitives.Epoch) error
+	VerifySlotMatchesBlock(primitives.Slot) error
+	VerifyBuilderValid(interfaces.ROExecutionPayloadBid) error
+	VerifyPayloadHash(interfaces.ROExecutionPayloadBid) error
+	VerifySignature(state.ReadOnlyBeaconState) error
+	SatisfyRequirement(Requirement)
+}
+
+// NewExecutionPayloadEnvelopeVerifier is a function signature that can be used by code that needs to be
+// able to mock Initializer.NewExecutionPayloadEnvelopeVerifier without complex setup.
+type NewExecutionPayloadEnvelopeVerifier func(e interfaces.ROSignedExecutionPayloadEnvelope, reqs []Requirement) ExecutionPayloadEnvelopeVerifier
+
+// ExecutionPayloadEnvelopeGossipRequirements defines the list of requirements for gossip
+// execution payload envelopes.
+var ExecutionPayloadEnvelopeGossipRequirements = []Requirement{
+	RequireBlockRootSeen,
+	RequireBlockRootValid,
+	RequireEnvelopeSlotAboveFinalized,
+	RequireEnvelopeSlotMatchesBlock,
+	RequireBuilderValid,
+	RequirePayloadHashValid,
+	RequireBuilderSignatureValid,
+}
+
+// GossipExecutionPayloadEnvelopeRequirements is a requirement list for gossip execution payload envelopes.
+var GossipExecutionPayloadEnvelopeRequirements = requirementList(ExecutionPayloadEnvelopeGossipRequirements)
+
+var (
+	ErrEnvelopeBlockRootNotSeen    = errors.New("block root not seen")
+	ErrEnvelopeBlockRootInvalid    = errors.New("block root invalid")
+	ErrEnvelopeSlotBeforeFinalized = errors.New("envelope slot is before finalized checkpoint")
+	ErrEnvelopeSlotMismatch        = errors.New("envelope slot does not match block slot")
+	ErrIncorrectEnvelopeBuilder    = errors.New("builder index does not match committed header")
+	ErrIncorrectEnvelopeBlockHash  = errors.New("block hash does not match committed header")
+)
+
+var _ ExecutionPayloadEnvelopeVerifier = &EnvelopeVerifier{}
+
+// EnvelopeVerifier is a read-only verifier for execution payload envelopes.
+type EnvelopeVerifier struct {
+	results *results
+	e       interfaces.ROSignedExecutionPayloadEnvelope
+}
+
+// VerifyBlockRootSeen verifies if the block root has been seen before.
+func (v *EnvelopeVerifier) VerifyBlockRootSeen(blockRootSeen func([32]byte) bool) (err error) {
+	defer v.record(RequireBlockRootSeen, &err)
+	env, err := v.e.Envelope()
+	if err != nil {
+		return errors.Wrap(err, "failed to get envelope")
+	}
+	if blockRootSeen != nil && blockRootSeen(env.BeaconBlockRoot()) {
+		return nil
+	}
+	return fmt.Errorf("%w: root=%#x slot=%d builder=%d", ErrEnvelopeBlockRootNotSeen, env.BeaconBlockRoot(), env.Slot(), env.BuilderIndex())
+}
+
+// VerifyBlockRootValid verifies if the block root is valid.
+func (v *EnvelopeVerifier) VerifyBlockRootValid(badBlock func([32]byte) bool) (err error) {
+	defer v.record(RequireBlockRootValid, &err)
+	env, err := v.e.Envelope()
+	if err != nil {
+		return errors.Wrap(err, "failed to get envelope")
+	}
+	if badBlock != nil && badBlock(env.BeaconBlockRoot()) {
+		return fmt.Errorf("%w: root=%#x slot=%d builder=%d", ErrEnvelopeBlockRootInvalid, env.BeaconBlockRoot(), env.Slot(), env.BuilderIndex())
+	}
+	return nil
+}
+
+// VerifySlotAboveFinalized ensures the envelope slot is not before the latest finalized epoch start.
+func (v *EnvelopeVerifier) VerifySlotAboveFinalized(finalizedEpoch primitives.Epoch) (err error) {
+	defer v.record(RequireEnvelopeSlotAboveFinalized, &err)
+	env, err := v.e.Envelope()
+	if err != nil {
+		return errors.Wrap(err, "failed to get envelope")
+	}
+	startSlot, err := slots.EpochStart(finalizedEpoch)
+	if err != nil {
+		return errors.Wrapf(ErrEnvelopeSlotBeforeFinalized, "error computing epoch start slot for finalized checkpoint (%d) %s", finalizedEpoch, err.Error())
+	}
+	if env.Slot() < startSlot {
+		return fmt.Errorf("%w: slot=%d start=%d", ErrEnvelopeSlotBeforeFinalized, env.Slot(), startSlot)
+	}
+	return nil
+}
+
+// VerifySlotMatchesBlock ensures the envelope slot matches the block slot.
+func (v *EnvelopeVerifier) VerifySlotMatchesBlock(blockSlot primitives.Slot) (err error) {
+	defer v.record(RequireEnvelopeSlotMatchesBlock, &err)
+	env, err := v.e.Envelope()
+	if err != nil {
+		return errors.Wrap(err, "failed to get envelope")
+	}
+	if env.Slot() != blockSlot {
+		return fmt.Errorf("%w: envelope=%d block=%d", ErrEnvelopeSlotMismatch, env.Slot(), blockSlot)
+	}
+	return nil
+}
+
+// VerifyBuilderValid checks that the builder index matches the one in the bid.
+func (v *EnvelopeVerifier) VerifyBuilderValid(bid interfaces.ROExecutionPayloadBid) (err error) {
+	defer v.record(RequireBuilderValid, &err)
+	env, err := v.e.Envelope()
+	if err != nil {
+		return errors.Wrap(err, "failed to get envelope")
+	}
+	if bid.BuilderIndex() != env.BuilderIndex() {
+		return fmt.Errorf("%w: envelope=%d bid=%d", ErrIncorrectEnvelopeBuilder, env.BuilderIndex(), bid.BuilderIndex())
+	}
+	return nil
+}
+
+// VerifyPayloadHash checks that the payload blockhash matches the one in the bid.
+func (v *EnvelopeVerifier) VerifyPayloadHash(bid interfaces.ROExecutionPayloadBid) (err error) {
+	defer v.record(RequirePayloadHashValid, &err)
+	env, err := v.e.Envelope()
+	if err != nil {
+		return errors.Wrap(err, "failed to get envelope")
+	}
+	if env.IsBlinded() {
+		return nil
+	}
+	payload, err := env.Execution()
+	if err != nil {
+		return errors.Wrap(err, "failed to get payload execution")
+	}
+	if bid.BlockHash() != [32]byte(payload.BlockHash()) {
+		return fmt.Errorf("%w: payload=%#x bid=%#x", ErrIncorrectEnvelopeBlockHash, payload.BlockHash(), bid.BlockHash())
+	}
+	return nil
+}
+
+// VerifySignature verifies the signature of the execution payload envelope.
+func (v *EnvelopeVerifier) VerifySignature(st state.ReadOnlyBeaconState) (err error) {
+	defer v.record(RequireBuilderSignatureValid, &err)
+
+	err = validatePayloadEnvelopeSignature(st, v.e)
+	if err != nil {
+		env, envErr := v.e.Envelope()
+		if envErr != nil {
+			return errors.Wrap(err, "failed to get envelope for signature validation")
+		}
+		return errors.Wrapf(err, "signature validation failed: root=%#x slot=%d builder=%d", env.BeaconBlockRoot(), env.Slot(), env.BuilderIndex())
+	}
+	return nil
+}
+
+// SatisfyRequirement allows the caller to manually mark a requirement as satisfied.
+func (v *EnvelopeVerifier) SatisfyRequirement(req Requirement) {
+	v.record(req, nil)
+}
+
+// record records the result of a requirement verification.
+func (v *EnvelopeVerifier) record(req Requirement, err *error) {
+	if err == nil || *err == nil {
+		v.results.record(req, nil)
+		return
+	}
+
+	v.results.record(req, *err)
+}
+
+// validatePayloadEnvelopeSignature verifies the signature of a signed execution payload envelope
+func validatePayloadEnvelopeSignature(st state.ReadOnlyBeaconState, e interfaces.ROSignedExecutionPayloadEnvelope) error {
+	env, err := e.Envelope()
+	if err != nil {
+		return errors.Wrap(err, "failed to get envelope")
+	}
+	var pubkey []byte
+	if env.BuilderIndex() == params.BeaconConfig().BuilderIndexSelfBuild {
+		header := st.LatestBlockHeader()
+		if header == nil {
+			return errors.New("latest block header is nil")
+		}
+		val, err := st.ValidatorAtIndex(primitives.ValidatorIndex(header.ProposerIndex))
+		if err != nil {
+			return errors.Wrap(err, "failed to get proposer validator")
+		}
+		pubkey = val.PublicKey
+	} else {
+		builderPubkey, err := st.BuilderPubkey(env.BuilderIndex())
+		if err != nil {
+			return errors.Wrap(err, "failed to get builder pubkey")
+		}
+		pubkey = builderPubkey[:]
+	}
+	pub, err := bls.PublicKeyFromBytes(pubkey)
+	if err != nil {
+		return errors.Wrap(err, "invalid public key")
+	}
+	s := e.Signature()
+	sig, err := bls.SignatureFromBytes(s[:])
+	if err != nil {
+		return errors.Wrap(err, "invalid signature format")
+	}
+	currentEpoch := slots.ToEpoch(st.Slot())
+	domain, err := signing.Domain(st.Fork(), currentEpoch, params.BeaconConfig().DomainBeaconBuilder, st.GenesisValidatorsRoot())
+	if err != nil {
+		return errors.Wrap(err, "failed to compute signing domain")
+	}
+	root, err := e.SigningRoot(domain)
+	if err != nil {
+		return errors.Wrap(err, "failed to compute signing root")
+	}
+	if !sig.Verify(pub, root[:]) {
+		return signing.ErrSigFailedToVerify
+	}
+	return nil
+}

beacon-chain/verification/execution_payload_envelope_test.go

@@ -0,0 +1,258 @@
+package verification
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/core/signing"
+	"github.com/OffchainLabs/prysm/v7/beacon-chain/state"
+	"github.com/OffchainLabs/prysm/v7/config/params"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/blocks"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/interfaces"
+	"github.com/OffchainLabs/prysm/v7/consensus-types/primitives"
+	"github.com/OffchainLabs/prysm/v7/crypto/bls"
+	"github.com/OffchainLabs/prysm/v7/encoding/bytesutil"
+	enginev1 "github.com/OffchainLabs/prysm/v7/proto/engine/v1"
+	ethpb "github.com/OffchainLabs/prysm/v7/proto/prysm/v1alpha1"
+	"github.com/OffchainLabs/prysm/v7/testing/require"
+	"github.com/OffchainLabs/prysm/v7/testing/util"
+	"github.com/OffchainLabs/prysm/v7/time/slots"
+)
+
+func TestEnvelopeVerifier_VerifySlotAboveFinalized(t *testing.T) {
+	root := bytesutil.ToBytes32(bytes.Repeat([]byte{0xAA}, 32))
+	blockHash := bytesutil.ToBytes32(bytes.Repeat([]byte{0xBB}, 32))
+	env := testSignedExecutionPayloadEnvelope(t, 1, 1, root, blockHash)
+	wrapped, err := blocks.WrappedROSignedExecutionPayloadEnvelope(env)
+	require.NoError(t, err)
+
+	verifier := &EnvelopeVerifier{results: newResults(RequireEnvelopeSlotAboveFinalized), e: wrapped}
+	require.ErrorIs(t, verifier.VerifySlotAboveFinalized(1), ErrEnvelopeSlotBeforeFinalized)
+
+	verifier = &EnvelopeVerifier{results: newResults(RequireEnvelopeSlotAboveFinalized), e: wrapped}
+	require.NoError(t, verifier.VerifySlotAboveFinalized(0))
+}
+
+func TestEnvelopeVerifier_VerifySlotMatchesBlock(t *testing.T) {
+	root := bytesutil.ToBytes32(bytes.Repeat([]byte{0xAA}, 32))
+	blockHash := bytesutil.ToBytes32(bytes.Repeat([]byte{0xBB}, 32))
+	env := testSignedExecutionPayloadEnvelope(t, 2, 1, root, blockHash)
+	wrapped, err := blocks.WrappedROSignedExecutionPayloadEnvelope(env)
+	require.NoError(t, err)
+
+	verifier := &EnvelopeVerifier{results: newResults(RequireEnvelopeSlotMatchesBlock), e: wrapped}
+	require.ErrorIs(t, verifier.VerifySlotMatchesBlock(3), ErrEnvelopeSlotMismatch)
+
+	verifier = &EnvelopeVerifier{results: newResults(RequireEnvelopeSlotMatchesBlock), e: wrapped}
+	require.NoError(t, verifier.VerifySlotMatchesBlock(2))
+}
+
+func TestEnvelopeVerifier_VerifyBlockRootSeen(t *testing.T) {
+	root := bytesutil.ToBytes32(bytes.Repeat([]byte{0xAA}, 32))
+	blockHash := bytesutil.ToBytes32(bytes.Repeat([]byte{0xBB}, 32))
+	env := testSignedExecutionPayloadEnvelope(t, 1, 1, root, blockHash)
+	wrapped, err := blocks.WrappedROSignedExecutionPayloadEnvelope(env)
+	require.NoError(t, err)
+
+	verifier := &EnvelopeVerifier{results: newResults(RequireBlockRootSeen), e: wrapped}
+	require.ErrorIs(t, verifier.VerifyBlockRootSeen(func([32]byte) bool { return false }), ErrEnvelopeBlockRootNotSeen)
+
+	verifier = &EnvelopeVerifier{results: newResults(RequireBlockRootSeen), e: wrapped}
+	require.NoError(t, verifier.VerifyBlockRootSeen(func([32]byte) bool { return true }))
+}
+
+func TestEnvelopeVerifier_VerifyBlockRootValid(t *testing.T) {
+	root := bytesutil.ToBytes32(bytes.Repeat([]byte{0xAA}, 32))
+	blockHash := bytesutil.ToBytes32(bytes.Repeat([]byte{0xBB}, 32))
+	env := testSignedExecutionPayloadEnvelope(t, 1, 1, root, blockHash)
+	wrapped, err := blocks.WrappedROSignedExecutionPayloadEnvelope(env)
+	require.NoError(t, err)
+
+	verifier := &EnvelopeVerifier{results: newResults(RequireBlockRootValid), e: wrapped}
+	require.ErrorIs(t, verifier.VerifyBlockRootValid(func([32]byte) bool { return true }), ErrEnvelopeBlockRootInvalid)
+
+	verifier = &EnvelopeVerifier{results: newResults(RequireBlockRootValid), e: wrapped}
+	require.NoError(t, verifier.VerifyBlockRootValid(func([32]byte) bool { return false }))
+}
+
+func TestEnvelopeVerifier_VerifyBuilderValid(t *testing.T) {
+	root := bytesutil.ToBytes32(bytes.Repeat([]byte{0xAA}, 32))
+	blockHash := bytesutil.ToBytes32(bytes.Repeat([]byte{0xBB}, 32))
+	env := testSignedExecutionPayloadEnvelope(t, 1, 1, root, blockHash)
+	wrapped, err := blocks.WrappedROSignedExecutionPayloadEnvelope(env)
+	require.NoError(t, err)
+
+	badBid := testExecutionPayloadBid(t, 1, 2, blockHash)
+	verifier := &EnvelopeVerifier{results: newResults(RequireBuilderValid), e: wrapped}
+	require.ErrorIs(t, verifier.VerifyBuilderValid(badBid), ErrIncorrectEnvelopeBuilder)
+
+	okBid := testExecutionPayloadBid(t, 1, 1, blockHash)
+	verifier = &EnvelopeVerifier{results: newResults(RequireBuilderValid), e: wrapped}
+	require.NoError(t, verifier.VerifyBuilderValid(okBid))
+}
+
+func TestEnvelopeVerifier_VerifyPayloadHash(t *testing.T) {
+	root := bytesutil.ToBytes32(bytes.Repeat([]byte{0xAA}, 32))
+	blockHash := bytesutil.ToBytes32(bytes.Repeat([]byte{0xBB}, 32))
+	env := testSignedExecutionPayloadEnvelope(t, 1, 1, root, blockHash)
+	wrapped, err := blocks.WrappedROSignedExecutionPayloadEnvelope(env)
+	require.NoError(t, err)
+
+	badHash := bytesutil.ToBytes32(bytes.Repeat([]byte{0xCC}, 32))
+	badBid := testExecutionPayloadBid(t, 1, 1, badHash)
+	verifier := &EnvelopeVerifier{results: newResults(RequirePayloadHashValid), e: wrapped}
+	require.ErrorIs(t, verifier.VerifyPayloadHash(badBid), ErrIncorrectEnvelopeBlockHash)
+
+	okBid := testExecutionPayloadBid(t, 1, 1, blockHash)
+	verifier = &EnvelopeVerifier{results: newResults(RequirePayloadHashValid), e: wrapped}
+	require.NoError(t, verifier.VerifyPayloadHash(okBid))
+}
+
+func TestEnvelopeVerifier_VerifySignature_Builder(t *testing.T) {
+	slot := primitives.Slot(1)
+	root := bytesutil.ToBytes32(bytes.Repeat([]byte{0xAA}, 32))
+	blockHash := bytesutil.ToBytes32(bytes.Repeat([]byte{0xBB}, 32))
+	env := testSignedExecutionPayloadEnvelope(t, slot, 0, root, blockHash)
+
+	sk, err := bls.RandKey()
+	require.NoError(t, err)
+	builderPubkey := sk.PublicKey().Marshal()
+
+	st := newGloasState(t, slot, nil, nil, []*ethpb.Builder{{Pubkey: builderPubkey}})
+
+	sig := signEnvelope(t, sk, env.Message, st.Fork(), st.GenesisValidatorsRoot(), slot)
+	env.Signature = sig[:]
+	wrapped, err := blocks.WrappedROSignedExecutionPayloadEnvelope(env)
+	require.NoError(t, err)
+
+	verifier := &EnvelopeVerifier{results: newResults(RequireBuilderSignatureValid), e: wrapped}
+	require.NoError(t, verifier.VerifySignature(st))
+
+	sk2, err := bls.RandKey()
+	require.NoError(t, err)
+	badSig := signEnvelope(t, sk2, env.Message, st.Fork(), st.GenesisValidatorsRoot(), slot)
+	env.Signature = badSig[:]
+	wrapped, err = blocks.WrappedROSignedExecutionPayloadEnvelope(env)
+	require.NoError(t, err)
+	verifier = &EnvelopeVerifier{results: newResults(RequireBuilderSignatureValid), e: wrapped}
+	require.ErrorIs(t, verifier.VerifySignature(st), signing.ErrSigFailedToVerify)
+}
+
+func TestEnvelopeVerifier_VerifySignature_SelfBuild(t *testing.T) {
+	slot := primitives.Slot(2)
+	root := bytesutil.ToBytes32(bytes.Repeat([]byte{0xAA}, 32))
+	blockHash := bytesutil.ToBytes32(bytes.Repeat([]byte{0xBB}, 32))
+	env := testSignedExecutionPayloadEnvelope(t, slot, params.BeaconConfig().BuilderIndexSelfBuild, root, blockHash)
+
+	sk, err := bls.RandKey()
+	require.NoError(t, err)
+	validatorPubkey := sk.PublicKey().Marshal()
+
+	validators := []*ethpb.Validator{{PublicKey: validatorPubkey}}
+	balances := []uint64{0}
+	st := newGloasState(t, slot, validators, balances, nil)
+
+	sig := signEnvelope(t, sk, env.Message, st.Fork(), st.GenesisValidatorsRoot(), slot)
+	env.Signature = sig[:]
+	wrapped, err := blocks.WrappedROSignedExecutionPayloadEnvelope(env)
+	require.NoError(t, err)
+
+	verifier := &EnvelopeVerifier{results: newResults(RequireBuilderSignatureValid), e: wrapped}
+	require.NoError(t, verifier.VerifySignature(st))
+}
+
+func testSignedExecutionPayloadEnvelope(t *testing.T, slot primitives.Slot, builderIdx primitives.BuilderIndex, root, blockHash [32]byte) *ethpb.SignedExecutionPayloadEnvelope {
+	t.Helper()
+
+	payload := &enginev1.ExecutionPayloadDeneb{
+		ParentHash:    bytes.Repeat([]byte{0x01}, 32),
+		FeeRecipient:  bytes.Repeat([]byte{0x02}, 20),
+		StateRoot:     bytes.Repeat([]byte{0x03}, 32),
+		ReceiptsRoot:  bytes.Repeat([]byte{0x04}, 32),
+		LogsBloom:     bytes.Repeat([]byte{0x05}, 256),
+		PrevRandao:    bytes.Repeat([]byte{0x06}, 32),
+		BlockNumber:   1,
+		GasLimit:      2,
+		GasUsed:       3,
+		Timestamp:     4,
+		BaseFeePerGas: bytes.Repeat([]byte{0x07}, 32),
+		BlockHash:     blockHash[:],
+		Transactions:  [][]byte{},
+		Withdrawals:   []*enginev1.Withdrawal{},
+		BlobGasUsed:   0,
+		ExcessBlobGas: 0,
+	}
+
+	return &ethpb.SignedExecutionPayloadEnvelope{
+		Message: &ethpb.ExecutionPayloadEnvelope{
+			Payload: payload,
+			ExecutionRequests: &enginev1.ExecutionRequests{
+				Deposits: []*enginev1.DepositRequest{},
+			},
+			BuilderIndex:    builderIdx,
+			BeaconBlockRoot: root[:],
+			Slot:            slot,
+			StateRoot:       bytes.Repeat([]byte{0xBB}, 32),
+		},
+		Signature: bytes.Repeat([]byte{0xCC}, 96),
+	}
+}
+
+func testExecutionPayloadBid(t *testing.T, slot primitives.Slot, builderIdx primitives.BuilderIndex, blockHash [32]byte) interfaces.ROExecutionPayloadBid {
+	t.Helper()
+
+	signed := util.GenerateTestSignedExecutionPayloadBid(slot)
+	signed.Message.BuilderIndex = builderIdx
+	copy(signed.Message.BlockHash, blockHash[:])
+
+	wrapped, err := blocks.WrappedROSignedExecutionPayloadBid(signed)
+	require.NoError(t, err)
+	bid, err := wrapped.Bid()
+	require.NoError(t, err)
+	return bid
+}
+
+func newGloasState(
+	t *testing.T,
+	slot primitives.Slot,
+	validators []*ethpb.Validator,
+	balances []uint64,
+	builders []*ethpb.Builder,
+) state.BeaconState {
+	t.Helper()
+
+	genesisRoot := bytes.Repeat([]byte{0x11}, 32)
+	st, err := util.NewBeaconStateGloas(func(s *ethpb.BeaconStateGloas) error {
+		s.Slot = slot
+		s.GenesisValidatorsRoot = genesisRoot
+		if validators != nil {
+			s.Validators = validators
+		}
+		if balances != nil {
+			s.Balances = balances
+		}
+		if s.LatestBlockHeader != nil {
+			s.LatestBlockHeader.ProposerIndex = 0
+		}
+		if builders != nil {
+			s.Builders = builders
+		}
+		return nil
+	})
+	require.NoError(t, err)
+	return st
+}
+
+func signEnvelope(t *testing.T, sk bls.SecretKey, env *ethpb.ExecutionPayloadEnvelope, fork *ethpb.Fork, genesisRoot []byte, slot primitives.Slot) [96]byte {
+	t.Helper()
+
+	epoch := slots.ToEpoch(slot)
+	domain, err := signing.Domain(fork, epoch, params.BeaconConfig().DomainBeaconBuilder, genesisRoot)
+	require.NoError(t, err)
+	root, err := signing.ComputeSigningRoot(env, domain)
+	require.NoError(t, err)
+	sig := sk.Sign(root[:]).Marshal()
+	var out [96]byte
+	copy(out[:], sig)
+	return out
+}