Merge branch 'stage' into qbft-instance-log-stage-durations

Author: iurii-ssv

go.mod

@@ -41,7 +41,7 @@ require (
 	github.com/sourcegraph/conc v0.3.0
 	github.com/spf13/cobra v1.8.1
 	github.com/ssvlabs/eth2-key-manager v1.5.6
-	github.com/ssvlabs/ssv-spec v1.2.0
+	github.com/ssvlabs/ssv-spec v1.2.2
 	github.com/ssvlabs/ssv/ssvsigner v0.0.0-20251027161822-0b67ab2cd4f3
 	github.com/status-im/keycard-go v0.2.0
 	github.com/stretchr/testify v1.10.0

go.sum

@@ -772,6 +772,8 @@ github.com/ssvlabs/go-eth2-client v0.6.31-0.20250922150906-26179dd60c9c h1:iNQoR
 github.com/ssvlabs/go-eth2-client v0.6.31-0.20250922150906-26179dd60c9c/go.mod h1:fvULSL9WtNskkOB4i+Yyr6BKpNHXvmpGZj9969fCrfY=
 github.com/ssvlabs/ssv-spec v1.2.0 h1:RCrFTn3T+IN1oio+m0TnaosyrBXlBgFvAJ91GPnJK78=
 github.com/ssvlabs/ssv-spec v1.2.0/go.mod h1:GedhFYGHVJRYYH3nEp05Gn14tyvg6VbTbaIxrMtI7Cg=
+github.com/ssvlabs/ssv-spec v1.2.2 h1:as84CsvYAL4+czKBVeQSlxjDYVmU1wClwhc7YNcoBzY=
+github.com/ssvlabs/ssv-spec v1.2.2/go.mod h1:GedhFYGHVJRYYH3nEp05Gn14tyvg6VbTbaIxrMtI7Cg=
 github.com/ssvlabs/ssv/ssvsigner v0.0.0-20251027161822-0b67ab2cd4f3 h1:eIn/PpHupEa+8lp3E1Q1kNx0IK6udBqCNVEWaC9JlnM=
 github.com/ssvlabs/ssv/ssvsigner v0.0.0-20251027161822-0b67ab2cd4f3/go.mod h1:VSxiqWR75EXq29KpoAnp+M9w0MrE6AirTgoQ5LBiAwg=
 github.com/status-im/keycard-go v0.2.0 h1:QDLFswOQu1r5jsycloeQh3bVU8n/NatHHaZobtDnDzA=

operator/validator/controller.go

@@ -89,9 +89,10 @@ type ControllerOptions struct {
 	ProposerDelay                  time.Duration
 
 	// worker flags
-	WorkersCount    int    `yaml:"MsgWorkersCount" env:"MSG_WORKERS_COUNT" env-default:"256" env-description:"Number of message processing workers"`
-	QueueBufferSize int    `yaml:"MsgWorkerBufferSize" env:"MSG_WORKER_BUFFER_SIZE" env-default:"65536" env-description:"Size of message worker queue buffer"`
-	GasLimit        uint64 `yaml:"ExperimentalGasLimit" env:"EXPERIMENTAL_GAS_LIMIT" env-description:"Gas limit for MEV block proposals (must match across committee, otherwise MEV fails). Do not change unless you know what you're doing"`
+	WorkersCount                 int    `yaml:"MsgWorkersCount" env:"MSG_WORKERS_COUNT" env-default:"256" env-description:"Number of message processing workers"`
+	QueueBufferSize              int    `yaml:"MsgWorkerBufferSize" env:"MSG_WORKER_BUFFER_SIZE" env-default:"65536" env-description:"Size of message worker queue buffer"`
+	GasLimit                     uint64 `yaml:"ExperimentalGasLimit" env:"EXPERIMENTAL_GAS_LIMIT" env-description:"Gas limit for MEV block proposals (must match across committee, otherwise MEV fails). Do not change unless you know what you're doing"`
+	MajorityForkProtectionStrict bool   `yaml:"MajorityForkProtectionStrict" env:"MAJORITY_FORK_PROTECTION_STRICT" env-description:"Refuse to sign attestations with different target roots than your own. This does not increase validator safety. Instead, this is potentially more beneficial for Ethereum (area of active research), at the cost of potentially decrease validator performance during transitory disagreements between operators (e.g., when some of the operators' Beacon nodes are behind, and during re-orgs)."`
 }
 
 type Nonce uint16
@@ -170,7 +171,8 @@ type Controller struct {
 
 // NewController creates a new validator controller instance.
 func NewController(logger *zap.Logger, options ControllerOptions, exporterOptions exporter.Options) *Controller {
-	logger.Debug("setting up validator controller")
+	logger.Debug("setting up validator controller",
+		zap.Bool("mfp_strict", options.MajorityForkProtectionStrict))
 
 	// lookup in a map that holds all relevant operators
 	operatorsIDs := &sync.Map{}
@@ -197,6 +199,7 @@ func NewController(logger *zap.Logger, options ControllerOptions, exporterOption
 		options.MessageValidator,
 		options.Graffiti,
 		options.ProposerDelay,
+		options.MajorityForkProtectionStrict,
 	)
 
 	cacheTTL := 2 * options.NetworkConfig.EpochDuration() // #nosec G115
@@ -1050,6 +1053,7 @@ func SetupCommitteeRunners(
 			options.OperatorSigner,
 			dutyGuard,
 			options.DoppelgangerHandler,
+			options.MajorityForkProtectionStrict,
 		)
 		if err != nil {
 			return nil, err

protocol/v2/ssv/runner/committee.go

@@ -54,6 +54,7 @@ type CommitteeRunner struct {
 	DutyGuard           CommitteeDutyGuard
 	doppelgangerHandler DoppelgangerProvider
 	measurements        *dutyMeasurements
+	mfpStrict           bool
 
 	// ValCheck is used to validate the qbft-value(s) proposed by other Operators.
 	ValCheck ssv.ValueChecker
@@ -72,6 +73,7 @@ func NewCommitteeRunner(
 	operatorSigner ssvtypes.OperatorSigner,
 	dutyGuard CommitteeDutyGuard,
 	doppelgangerHandler DoppelgangerProvider,
+	mfpStrict bool,
 ) (Runner, error) {
 	if len(share) == 0 {
 		return nil, errors.New("no shares")
@@ -94,6 +96,7 @@ func NewCommitteeRunner(
 		DutyGuard:           dutyGuard,
 		doppelgangerHandler: doppelgangerHandler,
 		measurements:        newMeasurementsStore(),
+		mfpStrict:           mfpStrict,
 	}, nil
 }
 
@@ -1062,6 +1065,7 @@ func (r *CommitteeRunner) executeDuty(ctx context.Context, logger *zap.Logger, d
 		r.attestingValidators,
 		r.GetNetworkConfig().EstimatedCurrentEpoch(),
 		vote,
+		r.mfpStrict,
 	)
 	if err := r.BaseRunner.decide(ctx, logger, duty.DutySlot(), vote, r.ValCheck); err != nil {
 		return fmt.Errorf("qbft-decide: %w", err)

protocol/v2/ssv/spectest/msg_processing_type.go

@@ -280,6 +280,7 @@ var baseCommitteeWithRunnerSample = func(
 			runnerSample.GetOperatorSigner(),
 			committeeDutyGuard,
 			runnerSample.GetDoppelgangerHandler(),
+			false,
 		)
 		return r.(*runner.CommitteeRunner), err
 	}

protocol/v2/ssv/testing/runner.go

@@ -89,7 +89,7 @@ var ConstructBaseRunner = func(
 	switch role {
 	case spectypes.RoleCommittee:
 		valCheck = ssv.NewVoteChecker(km, spectestingutils.TestingDutySlot,
-			[]phase0.BLSPubKey{phase0.BLSPubKey(share.SharePubKey)}, spectestingutils.TestingDutyEpoch, vote)
+			[]phase0.BLSPubKey{phase0.BLSPubKey(share.SharePubKey)}, spectestingutils.TestingDutyEpoch, vote, false)
 	case spectypes.RoleProposer:
 		valCheck = ssv.NewProposerChecker(km, networkconfig.TestNetwork.Beacon,
 			(spectypes.ValidatorPK)(spectestingutils.TestingValidatorPubKey), spectestingutils.TestingValidatorIndex,
@@ -138,6 +138,7 @@ var ConstructBaseRunner = func(
 			opSigner,
 			dutyGuard,
 			dgHandler,
+			false,
 		)
 	case spectypes.RoleAggregator:
 		rnr, err := runner.NewAggregatorRunner(
@@ -221,6 +222,7 @@ var ConstructBaseRunner = func(
 			opSigner,
 			dutyGuard,
 			dgHandler,
+			false,
 		)
 		r.(*runner.CommitteeRunner).BaseRunner.RunnerRoleType = spectestingutils.UnknownDutyType
 	default:
@@ -356,7 +358,7 @@ var ConstructBaseRunnerWithShareMap = func(
 		switch role {
 		case spectypes.RoleCommittee:
 			valCheck = ssv.NewVoteChecker(km, spectestingutils.TestingDutySlot,
-				sharePubKeys, spectestingutils.TestingDutyEpoch, vote)
+				sharePubKeys, spectestingutils.TestingDutyEpoch, vote, false)
 		case spectypes.RoleProposer:
 			valCheck = ssv.NewProposerChecker(km, networkconfig.TestNetwork.Beacon,
 				shareInstance.ValidatorPubKey, shareInstance.ValidatorIndex, phase0.BLSPubKey(shareInstance.SharePubKey))
@@ -400,6 +402,7 @@ var ConstructBaseRunnerWithShareMap = func(
 			opSigner,
 			dutyGuard,
 			dgHandler,
+			false,
 		)
 	case spectypes.RoleAggregator:
 		rnr, err := runner.NewAggregatorRunner(
@@ -483,6 +486,7 @@ var ConstructBaseRunnerWithShareMap = func(
 			opSigner,
 			dutyGuard,
 			dgHandler,
+			false,
 		)
 		if r != nil {
 			r.(*runner.CommitteeRunner).BaseRunner.RunnerRoleType = spectestingutils.UnknownDutyType

protocol/v2/ssv/validator/opts.go

@@ -29,21 +29,22 @@ type Options struct {
 
 // CommonOptions represents options that all validators share.
 type CommonOptions struct {
-	NetworkConfig       *networkconfig.Network
-	Network             specqbft.Network
-	Beacon              beacon.BeaconNode
-	Storage             *storage.ParticipantStores
-	Signer              ekm.BeaconSigner
-	OperatorSigner      ssvtypes.OperatorSigner
-	DoppelgangerHandler runner.DoppelgangerProvider
-	NewDecidedHandler   qbftctrl.NewDecidedHandler
-	FullNode            bool
-	ExporterOptions     exporter.Options
-	QueueSize           int
-	GasLimit            uint64
-	MessageValidator    validation.MessageValidator
-	Graffiti            []byte
-	ProposerDelay       time.Duration
+	NetworkConfig                *networkconfig.Network
+	Network                      specqbft.Network
+	Beacon                       beacon.BeaconNode
+	Storage                      *storage.ParticipantStores
+	Signer                       ekm.BeaconSigner
+	OperatorSigner               ssvtypes.OperatorSigner
+	DoppelgangerHandler          runner.DoppelgangerProvider
+	NewDecidedHandler            qbftctrl.NewDecidedHandler
+	FullNode                     bool
+	ExporterOptions              exporter.Options
+	QueueSize                    int
+	GasLimit                     uint64
+	MessageValidator             validation.MessageValidator
+	Graffiti                     []byte
+	ProposerDelay                time.Duration
+	MajorityForkProtectionStrict bool
 }
 
 func NewCommonOptions(
@@ -62,23 +63,25 @@ func NewCommonOptions(
 	messageValidator validation.MessageValidator,
 	graffiti []byte,
 	proposerDelay time.Duration,
+	mfpStrict bool,
 ) *CommonOptions {
 	result := &CommonOptions{
-		NetworkConfig:       networkConfig,
-		Network:             network,
-		Beacon:              beacon,
-		Storage:             storage,
-		Signer:              signer,
-		OperatorSigner:      operatorSigner,
-		DoppelgangerHandler: doppelgangerHandler,
-		NewDecidedHandler:   newDecidedHandler,
-		FullNode:            fullNode,
-		ExporterOptions:     exporterOptions,
-		QueueSize:           1000,
-		GasLimit:            gasLimit,
-		MessageValidator:    messageValidator,
-		Graffiti:            graffiti,
-		ProposerDelay:       proposerDelay,
+		NetworkConfig:                networkConfig,
+		Network:                      network,
+		Beacon:                       beacon,
+		Storage:                      storage,
+		Signer:                       signer,
+		OperatorSigner:               operatorSigner,
+		DoppelgangerHandler:          doppelgangerHandler,
+		NewDecidedHandler:            newDecidedHandler,
+		FullNode:                     fullNode,
+		ExporterOptions:              exporterOptions,
+		QueueSize:                    1000,
+		GasLimit:                     gasLimit,
+		MessageValidator:             messageValidator,
+		Graffiti:                     graffiti,
+		ProposerDelay:                proposerDelay,
+		MajorityForkProtectionStrict: mfpStrict,
 	}
 
 	// If full node, increase the queue size to make enough room for history sync batches to be pushed whole.

protocol/v2/ssv/value_check.go

@@ -23,6 +23,7 @@ type voteChecker struct {
 	sharePublicKeys       []phase0.BLSPubKey
 	estimatedCurrentEpoch phase0.Epoch
 	expectedVote          *spectypes.BeaconVote
+	mfpStrict             bool
 }
 
 func NewVoteChecker(
@@ -31,13 +32,15 @@ func NewVoteChecker(
 	sharePublicKeys []phase0.BLSPubKey,
 	estimatedCurrentEpoch phase0.Epoch,
 	expectedVote *spectypes.BeaconVote,
+	mfpStrict bool,
 ) ValueChecker {
 	return &voteChecker{
 		signer:                signer,
 		slot:                  slot,
 		sharePublicKeys:       sharePublicKeys,
 		estimatedCurrentEpoch: estimatedCurrentEpoch,
 		expectedVote:          expectedVote,
+		mfpStrict:             mfpStrict,
 	}
 }
 
@@ -68,8 +71,8 @@ func (v *voteChecker) CheckValue(value []byte) error {
 		}
 	}
 
-	// Implemented according to https://github.com/ssvlabs/SIPs/pull/69, except the target root check is deleted
-	// because reorgs/orphaned blocks will trigger the protection and cause performance drops.
+	// Implemented according to https://github.com/ssvlabs/SIPs/pull/69, except the target root check is optional,
+	// because reorgs/orphaned blocks will trigger the target root mismatch and cause attestation misses.
 	if bv.Source.Epoch != v.expectedVote.Source.Epoch {
 		return fmt.Errorf("unexpected source epoch %v, expected %v", bv.Source.Epoch, v.expectedVote.Source.Epoch)
 	}
@@ -82,6 +85,12 @@ func (v *voteChecker) CheckValue(value []byte) error {
 		return fmt.Errorf("unexpected source root %x, expected %x", bv.Source.Root, v.expectedVote.Source.Root)
 	}
 
+	if v.mfpStrict {
+		if bv.Target.Root != v.expectedVote.Target.Root {
+			return fmt.Errorf("unexpected target root %x, expected %x", bv.Target.Root, v.expectedVote.Target.Root)
+		}
+	}
+
 	return nil
 }
 

ssvsigner/go.mod

@@ -31,7 +31,7 @@ require (
 	github.com/sourcegraph/conc v0.3.0
 	github.com/ssvlabs/eth2-key-manager v1.5.6
 	github.com/ssvlabs/ssv v1.2.1-0.20250904093034-64dc248758c3
-	github.com/ssvlabs/ssv-spec v1.2.0
+	github.com/ssvlabs/ssv-spec v1.2.2
 	github.com/stretchr/testify v1.10.0
 	github.com/testcontainers/testcontainers-go v0.37.0
 	github.com/valyala/fasthttp v1.58.0

ssvsigner/go.sum

@@ -333,6 +333,8 @@ github.com/ssvlabs/eth2-key-manager v1.5.6 h1:BMxVCsbcIlUiiO0hpePkHxzX0yhKgMkEzV
 github.com/ssvlabs/eth2-key-manager v1.5.6/go.mod h1:tjzhmMzrc0Lzc/OMW1h9Mz8AhmKH7FQC/nFiMNJ0bd8=
 github.com/ssvlabs/ssv-spec v1.2.0 h1:RCrFTn3T+IN1oio+m0TnaosyrBXlBgFvAJ91GPnJK78=
 github.com/ssvlabs/ssv-spec v1.2.0/go.mod h1:GedhFYGHVJRYYH3nEp05Gn14tyvg6VbTbaIxrMtI7Cg=
+github.com/ssvlabs/ssv-spec v1.2.2 h1:as84CsvYAL4+czKBVeQSlxjDYVmU1wClwhc7YNcoBzY=
+github.com/ssvlabs/ssv-spec v1.2.2/go.mod h1:GedhFYGHVJRYYH3nEp05Gn14tyvg6VbTbaIxrMtI7Cg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=