Clean up and refactor RPC validations

Co-authored-by: Kasey Kirkham <kasey@users.noreply.github.com>

CHANGELOG.md

@@ -29,6 +29,7 @@ The format is based on Keep a Changelog, and this project adheres to Semantic Ve
 - PeerDAS: Added proto for `DataColumnIdentifier`, `DataColumnSidecar`, `DataColumnSidecarsByRangeRequest` and `MetadataV2`.
 - Better attestation packing for Electra. [PR](https://github.com/prysmaticlabs/prysm/pull/14534)
 - P2P: Add logs when a peer is (dis)connected. Add the reason of the disconnection when we initiate it.
+- Added a Prometheus error counter metric for HTTP requests to track beacon node requests.
 
 ### Changed
 
@@ -65,6 +66,7 @@ The format is based on Keep a Changelog, and this project adheres to Semantic Ve
 - Updated light client consensus types. [PR](https://github.com/prysmaticlabs/prysm/pull/14652)
 - Fixed pending deposits processing on Electra.
 - Modified `ListAttestationsV2`, `GetAttesterSlashingsV2` and `GetAggregateAttestationV2` endpoints to use slot to determine fork version.
+- Improvements to HTTP response handling. [pr](https://github.com/prysmaticlabs/prysm/pull/14673)
 
 ### Deprecated
 

api/client/builder/BUILD.bazel

@@ -12,6 +12,7 @@ go_library(
     visibility = ["//visibility:public"],
     deps = [
         "//api:go_default_library",
+        "//api/client:go_default_library",
         "//api/server/structs:go_default_library",
         "//config/fieldparams:go_default_library",
         "//consensus-types:go_default_library",

api/client/builder/client.go

@@ -14,6 +14,7 @@ import (
 
 	"github.com/pkg/errors"
 	"github.com/prysmaticlabs/prysm/v5/api"
+	"github.com/prysmaticlabs/prysm/v5/api/client"
 	"github.com/prysmaticlabs/prysm/v5/api/server/structs"
 	"github.com/prysmaticlabs/prysm/v5/consensus-types/blocks"
 	"github.com/prysmaticlabs/prysm/v5/consensus-types/interfaces"
@@ -176,7 +177,7 @@ func (c *Client) do(ctx context.Context, method string, path string, body io.Rea
 		err = non200Err(r)
 		return
 	}
-	res, err = io.ReadAll(r.Body)
+	res, err = io.ReadAll(io.LimitReader(r.Body, client.MaxBodySize))
 	if err != nil {
 		err = errors.Wrap(err, "error reading http response body from builder server")
 		return
@@ -358,7 +359,7 @@ func (c *Client) Status(ctx context.Context) error {
 }
 
 func non200Err(response *http.Response) error {
-	bodyBytes, err := io.ReadAll(response.Body)
+	bodyBytes, err := io.ReadAll(io.LimitReader(response.Body, client.MaxErrBodySize))
 	var errMessage ErrorMessage
 	var body string
 	if err != nil {

api/client/client.go

@@ -10,11 +10,17 @@ import (
 	"github.com/pkg/errors"
 )
 
+const (
+	MaxBodySize    int64 = 1 << 23 // 8MB default, WithMaxBodySize can override
+	MaxErrBodySize int64 = 1 << 17 // 128KB
+)
+
 // Client is a wrapper object around the HTTP client.
 type Client struct {
-	hc      *http.Client
-	baseURL *url.URL
-	token   string
+	hc          *http.Client
+	baseURL     *url.URL
+	token       string
+	maxBodySize int64
 }
 
 // NewClient constructs a new client with the provided options (ex WithTimeout).
@@ -26,8 +32,9 @@ func NewClient(host string, opts ...ClientOpt) (*Client, error) {
 		return nil, err
 	}
 	c := &Client{
-		hc:      &http.Client{},
-		baseURL: u,
+		hc:          &http.Client{},
+		baseURL:     u,
+		maxBodySize: MaxBodySize,
 	}
 	for _, o := range opts {
 		o(c)
@@ -72,7 +79,7 @@ func (c *Client) NodeURL() string {
 // Get is a generic, opinionated GET function to reduce boilerplate amongst the getters in this package.
 func (c *Client) Get(ctx context.Context, path string, opts ...ReqOption) ([]byte, error) {
 	u := c.baseURL.ResolveReference(&url.URL{Path: path})
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), http.NoBody)
 	if err != nil {
 		return nil, err
 	}
@@ -89,7 +96,7 @@ func (c *Client) Get(ctx context.Context, path string, opts ...ReqOption) ([]byt
 	if r.StatusCode != http.StatusOK {
 		return nil, Non200Err(r)
 	}
-	b, err := io.ReadAll(r.Body)
+	b, err := io.ReadAll(io.LimitReader(r.Body, c.maxBodySize))
 	if err != nil {
 		return nil, errors.Wrap(err, "error reading http response body")
 	}

api/client/errors.go

@@ -25,16 +25,16 @@ var ErrInvalidNodeVersion = errors.New("invalid node version response")
 var ErrConnectionIssue = errors.New("could not connect")
 
 // Non200Err is a function that parses an HTTP response to handle responses that are not 200 with a formatted error.
-func Non200Err(response *http.Response) error {
-	bodyBytes, err := io.ReadAll(response.Body)
+func Non200Err(r *http.Response) error {
+	b, err := io.ReadAll(io.LimitReader(r.Body, MaxErrBodySize))
 	var body string
 	if err != nil {
 		body = "(Unable to read response body.)"
 	} else {
-		body = "response body:\n" + string(bodyBytes)
+		body = "response body:\n" + string(b)
 	}
-	msg := fmt.Sprintf("code=%d, url=%s, body=%s", response.StatusCode, response.Request.URL, body)
-	switch response.StatusCode {
+	msg := fmt.Sprintf("code=%d, url=%s, body=%s", r.StatusCode, r.Request.URL, body)
+	switch r.StatusCode {
 	case http.StatusNotFound:
 		return errors.Wrap(ErrNotFound, msg)
 	default:

api/client/options.go

@@ -46,3 +46,10 @@ func WithAuthenticationToken(token string) ClientOpt {
 		c.token = token
 	}
 }
+
+// WithMaxBodySize overrides the default max body size of 8MB.
+func WithMaxBodySize(size int64) ClientOpt {
+	return func(c *Client) {
+		c.maxBodySize = size
+	}
+}

beacon-chain/rpc/BUILD.bazel

@@ -5,6 +5,7 @@ go_library(
     srcs = [
         "endpoints.go",
         "log.go",
+        "metrics.go",
         "service.go",
     ],
     importpath = "github.com/prysmaticlabs/prysm/v5/beacon-chain/rpc",

beacon-chain/rpc/endpoints.go

@@ -34,18 +34,41 @@ type endpoint struct {
 	methods    []string
 }
 
+// responseWriter is the wrapper to http Response writer.
+type responseWriter struct {
+	http.ResponseWriter
+	statusCode int
+}
+
+// WriteHeader wraps the WriteHeader method of the underlying http.ResponseWriter to capture the status code.
+// Refer for WriteHeader doc: https://pkg.go.dev/net/http@go1.23.3#ResponseWriter.
+func (w *responseWriter) WriteHeader(statusCode int) {
+	w.statusCode = statusCode
+	w.ResponseWriter.WriteHeader(statusCode)
+}
+
 func (e *endpoint) handlerWithMiddleware() http.HandlerFunc {
 	handler := http.Handler(e.handler)
 	for _, m := range e.middleware {
 		handler = m(handler)
 	}
-	return promhttp.InstrumentHandlerDuration(
+
+	handler = promhttp.InstrumentHandlerDuration(
 		httpRequestLatency.MustCurryWith(prometheus.Labels{"endpoint": e.name}),
 		promhttp.InstrumentHandlerCounter(
 			httpRequestCount.MustCurryWith(prometheus.Labels{"endpoint": e.name}),
 			handler,
 		),
 	)
+
+	return func(w http.ResponseWriter, r *http.Request) {
+		rw := &responseWriter{ResponseWriter: w, statusCode: http.StatusOK}
+		handler.ServeHTTP(rw, r)
+
+		if rw.statusCode >= 400 {
+			httpErrorCount.WithLabelValues(r.URL.Path, http.StatusText(rw.statusCode), r.Method).Inc()
+		}
+	}
 }
 
 func (s *Service) endpoints(

beacon-chain/rpc/eth/beacon/BUILD.bazel

@@ -6,6 +6,7 @@ go_library(
         "handlers.go",
         "handlers_pool.go",
         "handlers_state.go",
+        "handlers_validation.go",
         "handlers_validator.go",
         "log.go",
         "server.go",
@@ -58,6 +59,7 @@ go_library(
         "//runtime/version:go_default_library",
         "//time/slots:go_default_library",
         "@com_github_ethereum_go_ethereum//common/hexutil:go_default_library",
+        "@com_github_ethereum_go_ethereum//crypto/kzg4844:go_default_library",
         "@com_github_pkg_errors//:go_default_library",
         "@com_github_prysmaticlabs_fastssz//:go_default_library",
         "@com_github_sirupsen_logrus//:go_default_library",

beacon-chain/rpc/eth/beacon/handlers.go

@@ -17,7 +17,6 @@ import (
 	"github.com/prysmaticlabs/prysm/v5/api/server/structs"
 	"github.com/prysmaticlabs/prysm/v5/beacon-chain/cache/depositsnapshot"
 	corehelpers "github.com/prysmaticlabs/prysm/v5/beacon-chain/core/helpers"
-	"github.com/prysmaticlabs/prysm/v5/beacon-chain/core/transition"
 	"github.com/prysmaticlabs/prysm/v5/beacon-chain/db/filters"
 	"github.com/prysmaticlabs/prysm/v5/beacon-chain/rpc/eth/helpers"
 	"github.com/prysmaticlabs/prysm/v5/beacon-chain/rpc/eth/shared"
@@ -1029,63 +1028,6 @@ func unmarshalStrict(data []byte, v interface{}) error {
 	return dec.Decode(v)
 }
 
-func (s *Server) validateBroadcast(ctx context.Context, r *http.Request, blk *eth.GenericSignedBeaconBlock) error {
-	switch r.URL.Query().Get(broadcastValidationQueryParam) {
-	case broadcastValidationConsensus:
-		b, err := blocks.NewSignedBeaconBlock(blk.Block)
-		if err != nil {
-			return errors.Wrapf(err, "could not create signed beacon block")
-		}
-		if err = s.validateConsensus(ctx, b); err != nil {
-			return errors.Wrap(err, "consensus validation failed")
-		}
-	case broadcastValidationConsensusAndEquivocation:
-		b, err := blocks.NewSignedBeaconBlock(blk.Block)
-		if err != nil {
-			return errors.Wrapf(err, "could not create signed beacon block")
-		}
-		if err = s.validateConsensus(r.Context(), b); err != nil {
-			return errors.Wrap(err, "consensus validation failed")
-		}
-		if err = s.validateEquivocation(b.Block()); err != nil {
-			return errors.Wrap(err, "equivocation validation failed")
-		}
-	default:
-		return nil
-	}
-	return nil
-}
-
-func (s *Server) validateConsensus(ctx context.Context, blk interfaces.ReadOnlySignedBeaconBlock) error {
-	parentBlockRoot := blk.Block().ParentRoot()
-	parentBlock, err := s.Blocker.Block(ctx, parentBlockRoot[:])
-	if err != nil {
-		return errors.Wrap(err, "could not get parent block")
-	}
-
-	if err := blocks.BeaconBlockIsNil(blk); err != nil {
-		return errors.Wrap(err, "could not validate block")
-	}
-
-	parentStateRoot := parentBlock.Block().StateRoot()
-	parentState, err := s.Stater.State(ctx, parentStateRoot[:])
-	if err != nil {
-		return errors.Wrap(err, "could not get parent state")
-	}
-	_, err = transition.ExecuteStateTransition(ctx, parentState, blk)
-	if err != nil {
-		return errors.Wrap(err, "could not execute state transition")
-	}
-	return nil
-}
-
-func (s *Server) validateEquivocation(blk interfaces.ReadOnlyBeaconBlock) error {
-	if s.ForkchoiceFetcher.HighestReceivedBlockSlot() == blk.Slot() {
-		return errors.Wrapf(errEquivocatedBlock, "block for slot %d already exists in fork choice", blk.Slot())
-	}
-	return nil
-}
-
 // GetBlockRoot retrieves the root of a block.
 func (s *Server) GetBlockRoot(w http.ResponseWriter, r *http.Request) {
 	ctx, span := trace.StartSpan(r.Context(), "beacon.GetBlockRoot")

beacon-chain/rpc/eth/beacon/handlers_test.go

@@ -19,10 +19,8 @@ import (
 	"github.com/prysmaticlabs/prysm/v5/api/server/structs"
 	chainMock "github.com/prysmaticlabs/prysm/v5/beacon-chain/blockchain/testing"
 	"github.com/prysmaticlabs/prysm/v5/beacon-chain/cache/depositsnapshot"
-	"github.com/prysmaticlabs/prysm/v5/beacon-chain/core/transition"
 	"github.com/prysmaticlabs/prysm/v5/beacon-chain/db"
 	dbTest "github.com/prysmaticlabs/prysm/v5/beacon-chain/db/testing"
-	doublylinkedtree "github.com/prysmaticlabs/prysm/v5/beacon-chain/forkchoice/doubly-linked-tree"
 	mockp2p "github.com/prysmaticlabs/prysm/v5/beacon-chain/p2p/testing"
 	rpctesting "github.com/prysmaticlabs/prysm/v5/beacon-chain/rpc/eth/shared/testing"
 	"github.com/prysmaticlabs/prysm/v5/beacon-chain/rpc/lookup"
@@ -2910,69 +2908,6 @@ func TestPublishBlindedBlockV2SSZ(t *testing.T) {
 	})
 }
 
-func TestValidateConsensus(t *testing.T) {
-	ctx := context.Background()
-
-	parentState, privs := util.DeterministicGenesisState(t, params.MinimalSpecConfig().MinGenesisActiveValidatorCount)
-	parentBlock, err := util.GenerateFullBlock(parentState, privs, util.DefaultBlockGenConfig(), parentState.Slot())
-	require.NoError(t, err)
-	parentSbb, err := blocks.NewSignedBeaconBlock(parentBlock)
-	require.NoError(t, err)
-	st, err := transition.ExecuteStateTransition(ctx, parentState, parentSbb)
-	require.NoError(t, err)
-	block, err := util.GenerateFullBlock(st, privs, util.DefaultBlockGenConfig(), st.Slot())
-	require.NoError(t, err)
-	sbb, err := blocks.NewSignedBeaconBlock(block)
-	require.NoError(t, err)
-	parentRoot, err := parentSbb.Block().HashTreeRoot()
-	require.NoError(t, err)
-	server := &Server{
-		Blocker: &testutil.MockBlocker{RootBlockMap: map[[32]byte]interfaces.ReadOnlySignedBeaconBlock{parentRoot: parentSbb}},
-		Stater:  &testutil.MockStater{StatesByRoot: map[[32]byte]state.BeaconState{bytesutil.ToBytes32(parentBlock.Block.StateRoot): parentState}},
-	}
-
-	require.NoError(t, server.validateConsensus(ctx, sbb))
-}
-
-func TestValidateEquivocation(t *testing.T) {
-	t.Run("ok", func(t *testing.T) {
-		st, err := util.NewBeaconState()
-		require.NoError(t, err)
-		require.NoError(t, st.SetSlot(10))
-		blk, err := blocks.NewSignedBeaconBlock(util.NewBeaconBlock())
-		require.NoError(t, err)
-		roblock, err := blocks.NewROBlockWithRoot(blk, bytesutil.ToBytes32([]byte("root")))
-		require.NoError(t, err)
-		fc := doublylinkedtree.New()
-		require.NoError(t, fc.InsertNode(context.Background(), st, roblock))
-		server := &Server{
-			ForkchoiceFetcher: &chainMock.ChainService{ForkChoiceStore: fc},
-		}
-		blk.SetSlot(st.Slot() + 1)
-
-		require.NoError(t, server.validateEquivocation(blk.Block()))
-	})
-	t.Run("block already exists", func(t *testing.T) {
-		st, err := util.NewBeaconState()
-		require.NoError(t, err)
-		require.NoError(t, st.SetSlot(10))
-		blk, err := blocks.NewSignedBeaconBlock(util.NewBeaconBlock())
-		require.NoError(t, err)
-		blk.SetSlot(st.Slot())
-		roblock, err := blocks.NewROBlockWithRoot(blk, bytesutil.ToBytes32([]byte("root")))
-		require.NoError(t, err)
-
-		fc := doublylinkedtree.New()
-		require.NoError(t, fc.InsertNode(context.Background(), st, roblock))
-		server := &Server{
-			ForkchoiceFetcher: &chainMock.ChainService{ForkChoiceStore: fc},
-		}
-		err = server.validateEquivocation(blk.Block())
-		assert.ErrorContains(t, "already exists", err)
-		require.ErrorIs(t, err, errEquivocatedBlock)
-	})
-}
-
 func TestServer_GetBlockRoot(t *testing.T) {
 	beaconDB := dbTest.SetupDB(t)
 	ctx := context.Background()

beacon-chain/rpc/eth/beacon/handlers_validation.go

@@ -0,0 +1,109 @@
+package beacon
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/ethereum/go-ethereum/crypto/kzg4844"
+	"github.com/pkg/errors"
+	"github.com/prysmaticlabs/prysm/v5/beacon-chain/core/transition"
+	"github.com/prysmaticlabs/prysm/v5/consensus-types/blocks"
+	"github.com/prysmaticlabs/prysm/v5/consensus-types/interfaces"
+	eth "github.com/prysmaticlabs/prysm/v5/proto/prysm/v1alpha1"
+	"github.com/prysmaticlabs/prysm/v5/runtime/version"
+)
+
+func (s *Server) validateBroadcast(ctx context.Context, r *http.Request, blk *eth.GenericSignedBeaconBlock) error {
+	switch r.URL.Query().Get(broadcastValidationQueryParam) {
+	case broadcastValidationConsensus:
+		if err := s.validateConsensus(ctx, blk); err != nil {
+			return errors.Wrap(err, "consensus validation failed")
+		}
+	case broadcastValidationConsensusAndEquivocation:
+		b, err := blocks.NewSignedBeaconBlock(blk.Block)
+		if err != nil {
+			return errors.Wrapf(err, "could not create signed beacon block")
+		}
+		if err = s.validateConsensus(r.Context(), blk); err != nil {
+			return errors.Wrap(err, "consensus validation failed")
+		}
+		if err = s.validateEquivocation(b.Block()); err != nil {
+			return errors.Wrap(err, "equivocation validation failed")
+		}
+	default:
+		return nil
+	}
+	return nil
+}
+
+func (s *Server) validateBlobSidecars(blk interfaces.SignedBeaconBlock, blobs [][]byte, proofs [][]byte) error {
+	if blk.Version() < version.Deneb {
+		return nil
+	}
+	kzgs, err := blk.Block().Body().BlobKzgCommitments()
+	if err != nil {
+		return errors.Wrap(err, "could not get blob kzg commitments")
+	}
+	if len(blobs) != len(proofs) || len(blobs) != len(kzgs) {
+		return errors.New("number of blobs, proofs, and commitments do not match")
+	}
+	for i, blob := range blobs {
+		if err := kzg4844.VerifyBlobProof(kzg4844.Blob(blob), kzg4844.Commitment(kzgs[i]), kzg4844.Proof(proofs[i])); err != nil {
+			return errors.Wrap(err, "could not verify blob proof")
+		}
+	}
+	return nil
+}
+
+func (s *Server) validateConsensus(ctx context.Context, b *eth.GenericSignedBeaconBlock) error {
+	blk, err := blocks.NewSignedBeaconBlock(b.Block)
+	if err != nil {
+		return errors.Wrapf(err, "could not create signed beacon block")
+	}
+
+	parentBlockRoot := blk.Block().ParentRoot()
+	parentBlock, err := s.Blocker.Block(ctx, parentBlockRoot[:])
+	if err != nil {
+		return errors.Wrap(err, "could not get parent block")
+	}
+
+	if err := blocks.BeaconBlockIsNil(blk); err != nil {
+		return errors.Wrap(err, "could not validate block")
+	}
+
+	parentStateRoot := parentBlock.Block().StateRoot()
+	parentState, err := s.Stater.State(ctx, parentStateRoot[:])
+	if err != nil {
+		return errors.Wrap(err, "could not get parent state")
+	}
+	_, err = transition.ExecuteStateTransition(ctx, parentState, blk)
+	if err != nil {
+		return errors.Wrap(err, "could not execute state transition")
+	}
+
+	var blobs [][]byte
+	var proofs [][]byte
+	switch {
+	case blk.Version() == version.Electra:
+		blobs = b.GetElectra().Blobs
+		proofs = b.GetElectra().KzgProofs
+	case blk.Version() == version.Deneb:
+		blobs = b.GetDeneb().Blobs
+		proofs = b.GetDeneb().KzgProofs
+	default:
+		return nil
+	}
+
+	if err := s.validateBlobSidecars(blk, blobs, proofs); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *Server) validateEquivocation(blk interfaces.ReadOnlyBeaconBlock) error {
+	if s.ForkchoiceFetcher.HighestReceivedBlockSlot() == blk.Slot() {
+		return errors.Wrapf(errEquivocatedBlock, "block for slot %d already exists in fork choice", blk.Slot())
+	}
+	return nil
+}

beacon-chain/rpc/eth/beacon/handlers_validation_test.go

@@ -0,0 +1,85 @@
+package beacon
+
+import (
+	"context"
+	"testing"
+
+	chainMock "github.com/prysmaticlabs/prysm/v5/beacon-chain/blockchain/testing"
+	"github.com/prysmaticlabs/prysm/v5/beacon-chain/core/transition"
+	doublylinkedtree "github.com/prysmaticlabs/prysm/v5/beacon-chain/forkchoice/doubly-linked-tree"
+	"github.com/prysmaticlabs/prysm/v5/beacon-chain/rpc/testutil"
+	"github.com/prysmaticlabs/prysm/v5/beacon-chain/state"
+	"github.com/prysmaticlabs/prysm/v5/config/params"
+	"github.com/prysmaticlabs/prysm/v5/consensus-types/blocks"
+	"github.com/prysmaticlabs/prysm/v5/consensus-types/interfaces"
+	"github.com/prysmaticlabs/prysm/v5/encoding/bytesutil"
+	eth "github.com/prysmaticlabs/prysm/v5/proto/prysm/v1alpha1"
+	"github.com/prysmaticlabs/prysm/v5/testing/assert"
+	"github.com/prysmaticlabs/prysm/v5/testing/require"
+	"github.com/prysmaticlabs/prysm/v5/testing/util"
+)
+
+func TestValidateConsensus(t *testing.T) {
+	ctx := context.Background()
+
+	parentState, privs := util.DeterministicGenesisState(t, params.MinimalSpecConfig().MinGenesisActiveValidatorCount)
+	parentBlock, err := util.GenerateFullBlock(parentState, privs, util.DefaultBlockGenConfig(), parentState.Slot())
+	require.NoError(t, err)
+	parentSbb, err := blocks.NewSignedBeaconBlock(parentBlock)
+	require.NoError(t, err)
+	st, err := transition.ExecuteStateTransition(ctx, parentState, parentSbb)
+	require.NoError(t, err)
+	block, err := util.GenerateFullBlock(st, privs, util.DefaultBlockGenConfig(), st.Slot())
+	require.NoError(t, err)
+	parentRoot, err := parentSbb.Block().HashTreeRoot()
+	require.NoError(t, err)
+	server := &Server{
+		Blocker: &testutil.MockBlocker{RootBlockMap: map[[32]byte]interfaces.ReadOnlySignedBeaconBlock{parentRoot: parentSbb}},
+		Stater:  &testutil.MockStater{StatesByRoot: map[[32]byte]state.BeaconState{bytesutil.ToBytes32(parentBlock.Block.StateRoot): parentState}},
+	}
+
+	require.NoError(t, server.validateConsensus(ctx, &eth.GenericSignedBeaconBlock{
+		Block: &eth.GenericSignedBeaconBlock_Phase0{
+			Phase0: block,
+		},
+	}))
+}
+
+func TestValidateEquivocation(t *testing.T) {
+	t.Run("ok", func(t *testing.T) {
+		st, err := util.NewBeaconState()
+		require.NoError(t, err)
+		require.NoError(t, st.SetSlot(10))
+		blk, err := blocks.NewSignedBeaconBlock(util.NewBeaconBlock())
+		require.NoError(t, err)
+		roblock, err := blocks.NewROBlockWithRoot(blk, bytesutil.ToBytes32([]byte("root")))
+		require.NoError(t, err)
+		fc := doublylinkedtree.New()
+		require.NoError(t, fc.InsertNode(context.Background(), st, roblock))
+		server := &Server{
+			ForkchoiceFetcher: &chainMock.ChainService{ForkChoiceStore: fc},
+		}
+		blk.SetSlot(st.Slot() + 1)
+
+		require.NoError(t, server.validateEquivocation(blk.Block()))
+	})
+	t.Run("block already exists", func(t *testing.T) {
+		st, err := util.NewBeaconState()
+		require.NoError(t, err)
+		require.NoError(t, st.SetSlot(10))
+		blk, err := blocks.NewSignedBeaconBlock(util.NewBeaconBlock())
+		require.NoError(t, err)
+		blk.SetSlot(st.Slot())
+		roblock, err := blocks.NewROBlockWithRoot(blk, bytesutil.ToBytes32([]byte("root")))
+		require.NoError(t, err)
+
+		fc := doublylinkedtree.New()
+		require.NoError(t, fc.InsertNode(context.Background(), st, roblock))
+		server := &Server{
+			ForkchoiceFetcher: &chainMock.ChainService{ForkChoiceStore: fc},
+		}
+		err = server.validateEquivocation(blk.Block())
+		assert.ErrorContains(t, "already exists", err)
+		require.ErrorIs(t, err, errEquivocatedBlock)
+	})
+}

beacon-chain/rpc/metrics.go

@@ -0,0 +1,31 @@
+package rpc
+
+import (
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+var (
+	httpRequestLatency = promauto.NewHistogramVec(
+		prometheus.HistogramOpts{
+			Name:    "http_request_latency_seconds",
+			Help:    "Latency of HTTP requests in seconds",
+			Buckets: []float64{0.001, 0.01, 0.025, 0.1, 0.25, 1, 2.5, 10},
+		},
+		[]string{"endpoint", "code", "method"},
+	)
+	httpRequestCount = promauto.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "http_request_count",
+			Help: "Number of HTTP requests",
+		},
+		[]string{"endpoint", "code", "method"},
+	)
+	httpErrorCount = promauto.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "http_error_count",
+			Help: "Total HTTP errors for beacon node requests",
+		},
+		[]string{"endpoint", "code", "method"},
+	)
+)

beacon-chain/rpc/prysm/v1alpha1/beacon/attestations.go

@@ -303,7 +303,7 @@ func (bs *Server) ListIndexedAttestationsElectra(
 // that it was included in a block. The attestation may have expired.
 // Refer to the ethereum consensus specification for more details on how
 // attestations are processed and when they are no longer valid.
-// https://github.com/ethereum/consensus-specs/blob/dev/specs/core/0_beacon-chain.md#attestations
+// https://github.com/ethereum/consensus-specs/blob/dev/specs/phase0/beacon-chain.md#attestations
 func (bs *Server) AttestationPool(_ context.Context, req *ethpb.AttestationPoolRequest) (*ethpb.AttestationPoolResponse, error) {
 	atts, err := attestationsFromPool[*ethpb.Attestation](req.PageSize, bs.AttestationsPool)
 	if err != nil {

beacon-chain/rpc/service.go

@@ -14,8 +14,6 @@ import (
 	grpcopentracing "github.com/grpc-ecosystem/go-grpc-middleware/tracing/opentracing"
 	grpcprometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
 	"github.com/pkg/errors"
-	"github.com/prometheus/client_golang/prometheus"
-	"github.com/prometheus/client_golang/prometheus/promauto"
 	"github.com/prysmaticlabs/prysm/v5/beacon-chain/blockchain"
 	"github.com/prysmaticlabs/prysm/v5/beacon-chain/builder"
 	"github.com/prysmaticlabs/prysm/v5/beacon-chain/cache"
@@ -57,24 +55,6 @@ import (
 
 const attestationBufferSize = 100
 
-var (
-	httpRequestLatency = promauto.NewHistogramVec(
-		prometheus.HistogramOpts{
-			Name:    "http_request_latency_seconds",
-			Help:    "Latency of HTTP requests in seconds",
-			Buckets: []float64{0.001, 0.01, 0.025, 0.1, 0.25, 1, 2.5, 10},
-		},
-		[]string{"endpoint", "code", "method"},
-	)
-	httpRequestCount = promauto.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: "http_request_count",
-			Help: "Number of HTTP requests",
-		},
-		[]string{"endpoint", "code", "method"},
-	)
-)
-
 // Service defining an RPC server for a beacon node.
 type Service struct {
 	cfg                  *Config

beacon-chain/sync/checkpoint/BUILD.bazel

@@ -10,6 +10,7 @@ go_library(
     importpath = "github.com/prysmaticlabs/prysm/v5/beacon-chain/sync/checkpoint",
     visibility = ["//visibility:public"],
     deps = [
+        "//api/client:go_default_library",
         "//api/client/beacon:go_default_library",
         "//beacon-chain/db:go_default_library",
         "//config/params:go_default_library",

beacon-chain/sync/checkpoint/api.go

@@ -4,11 +4,14 @@ import (
 	"context"
 
 	"github.com/pkg/errors"
+	"github.com/prysmaticlabs/prysm/v5/api/client"
 	"github.com/prysmaticlabs/prysm/v5/api/client/beacon"
 	"github.com/prysmaticlabs/prysm/v5/beacon-chain/db"
 	"github.com/prysmaticlabs/prysm/v5/config/params"
 )
 
+const stateSizeLimit int64 = 1 << 29 // 512MB
+
 // APIInitializer manages initializing the beacon node using checkpoint sync, retrieving the checkpoint state and root
 // from the remote beacon node api.
 type APIInitializer struct {
@@ -18,7 +21,7 @@ type APIInitializer struct {
 // NewAPIInitializer creates an APIInitializer, handling the set up of a beacon node api client
 // using the provided host string.
 func NewAPIInitializer(beaconNodeHost string) (*APIInitializer, error) {
-	c, err := beacon.NewClient(beaconNodeHost)
+	c, err := beacon.NewClient(beaconNodeHost, client.WithMaxBodySize(stateSizeLimit))
 	if err != nil {
 		return nil, errors.Wrapf(err, "unable to parse beacon node url or hostname - %s", beaconNodeHost)
 	}
@@ -32,10 +35,9 @@ func (dl *APIInitializer) Initialize(ctx context.Context, d db.Database) error {
 	if err == nil && origin != params.BeaconConfig().ZeroHash {
 		log.Warnf("Origin checkpoint root %#x found in db, ignoring checkpoint sync flags", origin)
 		return nil
-	} else {
-		if !errors.Is(err, db.ErrNotFound) {
-			return errors.Wrap(err, "error while checking database for origin root")
-		}
+	}
+	if err != nil && !errors.Is(err, db.ErrNotFound) {
+		return errors.Wrap(err, "error while checking database for origin root")
 	}
 	od, err := beacon.DownloadFinalizedData(ctx, dl.c)
 	if err != nil {

cmd/prysmctl/checkpointsync/download.go

@@ -42,11 +42,13 @@ var downloadCmd = &cli.Command{
 	},
 }
 
+const stateSizeLimit int64 = 1 << 29 // 512MB to accommodate future state growth
+
 func cliActionDownload(_ *cli.Context) error {
 	ctx := context.Background()
 	f := downloadFlags
 
-	opts := []client.ClientOpt{client.WithTimeout(f.Timeout)}
+	opts := []client.ClientOpt{client.WithTimeout(f.Timeout), client.WithMaxBodySize(stateSizeLimit)}
 	client, err := beacon.NewClient(downloadFlags.BeaconNodeHost, opts...)
 	if err != nil {
 		return err

proto/prysm/v1alpha1/beacon_chain.proto

@@ -91,7 +91,7 @@ service BeaconChain {
     // that it was included in a block. The attestation may have expired.
     // Refer to the Ethereum Beacon Chain specification for more details on how
     // attestations are processed and when they are no longer valid.
-    // https://github.com/ethereum/consensus-specs/blob/dev/specs/core/0_beacon-chain.md#attestations
+    // https://github.com/ethereum/consensus-specs/blob/dev/specs/phase0/beacon-chain.md#attestations
     rpc AttestationPool(AttestationPoolRequest) returns (AttestationPoolResponse) {
         option (google.api.http) = {
             get: "/eth/v1alpha1/beacon/attestations/pool"
@@ -106,7 +106,7 @@ service BeaconChain {
     // that it was included in a block. The attestation may have expired.
     // Refer to the Ethereum Beacon Chain specification for more details on how
     // attestations are processed and when they are no longer valid.
-    // https://github.com/ethereum/consensus-specs/blob/dev/specs/core/0_beacon-chain.md#attestations
+    // https://github.com/ethereum/consensus-specs/blob/dev/specs/phase0/beacon-chain.md#attestations
     rpc AttestationPoolElectra(AttestationPoolRequest) returns (AttestationPoolElectraResponse) {
         option (google.api.http) = {
             get: "/eth/v1alpha1/beacon/attestations/pool_electra"