Skip to content

perf(beacon): walk the registry once in epoch steps 1-3 instead of per-index reads - #630

Closed
MegaRedHand wants to merge 3 commits into
beacon-chain-integrationfrom
perf/beacon-epoch-participation-a
Closed

MegaRedHand wants to merge 3 commits into
beacon-chain-integrationfrom
perf/beacon-epoch-participation-a

Conversation

@MegaRedHand

@MegaRedHand MegaRedHand commented Sep 30, 2026 •

Copy link
Copy Markdown
Collaborator

One of three alternative implementations of the same follow-up to the persistent-tree registry (epoch participation without per-index registry reads): (a) this PR, (b) #632, (c) #633. They are meant to be compared, and at most one of (a) and (b) should merge; (c) is stacked on (b).

Motivation

The registry is now a persistent Merkle tree, so state.validator(i) is a tree descent rather than an array index, while validators().iter() walks leaf slices.

Epoch steps 1-3 (justification, inactivity updates, rewards) built index Vecs, then did one descent per participant and one binary search per eligible validator. The pulled-up-tip check in fork choice repeats justification on every imported block, so part of that cost is paid per block, not per epoch.

Change: option (a), iterator passes, spec-shaped

Every spec function keeps its shape and signature. Each now walks validators().iter().enumerate() and indexes the flat participation and inactivity-score lists by position:

  • get_unslashed_participating_indices is one pass, no descents.
  • New get_unslashed_participating_balance, plus crate-internal one-pass versions of the total active balance and the base reward per increment. The public get_total_active_balance and get_base_reward_per_increment are untouched.
  • Justification uses those three passes and builds no index Vec.
  • get_flag_index_deltas and get_inactivity_penalty_deltas decide eligibility and participation inline, with the leak flag computed once.
  • process_inactivity_updates makes one immutable pass, then one pass over the scores.
  • process_rewards_and_penalties is unchanged: it still builds eight delta Vecs and does 8N get_mut. That is the known remaining cost of this option.

Testing

  • The previous implementations are kept as a test-only reference.
  • Randomized tests (altair and electra, 100-300 validators) compare outputs, errors and post-step state against the reference. They cover short lists, off-increment and zero effective balances, scores near u64::MAX, epochs 0, 1 and 2, and leaking epochs.
  • Clippy -D warnings and the ethlambda-state-transition lib tests pass.
  • Beacon spec filters epoch_processing, rewards, sanity, finality, random, fork_choice and transition pass on both presets.

Benchmark (all three options)

ethlambda benchmark import replay on ethlambda-5: cargo build --release, mainnet corpus of 128 blocks (slots 15279073..=15279200, 4 epoch-start blocks), legs interleaved base a b c for two rounds. Base against base: 0.996. Every leg imported all 128 blocks.

base (c913728) (a) iterator passes (b) summary pass (c) single pass
process wall 104.0 s 96.1 s 92.0 s 91.0 s
user CPU 215.1 s 208.4 s 205.1 s 203.8 s
stf, epoch-start block (mean of 4) 1503 ms 1126 ms 912 ms 709 ms
stf p50, other blocks 577 ms 517 ms 478 ms 479 ms
paired stf vs base (ratio of totals) 1 0.869 0.797 0.785
get_head p50 201 ms 214 ms 226 ms 225 ms
peak RSS 3.88 GiB 3.93 GiB 4.04 GiB 4.04 GiB
  • The per-block saving comes from the pulled-up tip, which reruns justification on every imported block.
  • (c) gains nothing over (b) on ordinary blocks, since their per-block path is the same.
  • get_head rises as stf falls, although no option touches the head computation. This is probably contention with the background state writer, as seen in earlier import benchmarks; it is not verified. Block wall time still falls.

Base

  • Based on beacon-chain-integration @ c79fabd5, merged into the branch.

…r-index reads

Justification, inactivity updates and rewards built index Vecs, then did a
tree descent (state.validator(i)) per participant and a binary search per
eligible validator, and the pulled-up-tip check repeats justification on
every imported block. Each of those reads is a tree walk; the registry's
iter() is a leaf-slice walk.

Every spec function keeps its shape and signature, but now iterates
validators().iter().enumerate() and indexes the flat participation and
score lists by position. New helpers compute the unslashed participating
balance and the total active balance (plus base reward per increment) in
one pass without an index Vec; the public get_total_active_balance and
get_base_reward_per_increment are untouched.

The previous implementations are kept as a test-only reference, and
randomized tests (altair and electra, short lists, off-grid balances,
scores near the top of the range, leaking epochs) compare outputs, errors
and post-step state against it.
@MegaRedHand MegaRedHand mentioned this pull request Oct 5, 2026
4 tasks
@MegaRedHand MegaRedHand closed this Oct 5, 2026
@MegaRedHand
MegaRedHand deleted the perf/beacon-epoch-participation-a branch October 5, 2026 22:14
zexoverz pushed a commit to zexoverz/ethlambda that referenced this pull request Oct 22, 2026
## 🗒️ Description / Motivation

Merges `beacon-chain-integration` into `main`. This adds an **Ethereum
Beacon Chain** client (phase0 through fulu) to the ethlambda binary,
alongside the Lean consensus client:

- **`ethlambda beacon`**: a beacon node. It checkpoint-syncs, follows
the chain over gossip and req/resp, validates execution payloads through
an execution client's Engine API, and serves the Beacon API, including
the validator endpoints.
- **`ethlambda validator`**: a beacon validator client (attest,
aggregate, propose) that talks to any beacon node over the standard REST
API.
- **`ethlambda node`** (lean) keeps its behavior, apart from the items
under "Behavior changes for lean" below.

Both chains run on the same storage layer, P2P actor, RPC crate and
chain actor. `BeaconState` has a `Lean` variant holding lean's `State`,
and each shared handler dispatches on it once, at the top.

Each piece was reviewed as its own PR into the integration branch
(listed under "Related Issues / PRs"). This PR merges that branch.

## What Changed

| Area | Change |
|---|---|
| `ethlambda-types` (`beacon/`) | Containers for phase0 to fulu, presets
(compile-time `preset-minimal` feature), runtime fork config, and a
`Lean` variant on `ForkName` and `BeaconState` |
| `ethlambda-state-transition` (`beacon/`) | State transition, epoch
processing, fork upgrades, fork choice, BLS (`blst`), KZG (`c-kzg`),
gossip validation rules, DAS custody math |
| `ethlambda-ssz-tree` (**new**) | Persistent Merkle `List`/`Vector` for
the validator registry and balances, so consecutive states share
unchanged subtrees |
| `ethlambda-storage` | One `Store` for both chains. Beacon states are
stored as snapshots plus VCDIFF deltas and written on a background
thread. Adds a committee cache, and `db_version`/`chain`/`preset`
metadata that resume checks |
| `ethlambda-blockchain` | Beacon path in the chain actor
(`BlockChain::spawn_beacon`): import, holding blocks until their parent
or columns arrive, applying gossip aggregates to fork choice, block
production and aggregation |
| `ethlambda-engine` (**new**) | Engine API client with JWT auth:
`newPayload`, `forkchoiceUpdated`, `getPayload`, `getBlobs` |
| `ethlambda-p2p` | Beacon wire: blocks, aggregates, subnet attestations
and data columns are validated before relay;
`beacon_blocks_by_{range,root}/2` served and requested; range sync;
column custody and sampling; attestation subnet backbone; discv5 always
on for `beacon` |
| `ethlambda-rpc` | Beacon API under `/eth/v1` and `/eth/v2`: JSON by
default, SSZ on request. The router is picked by `Store::chain()`, so
`/lean/v0` and the Beacon API are never served together |
| `ethlambda-validator` (**new**) | Validator client: duties,
attestations, aggregation selection, proposals, keymanager API. It has
**no slashing protection** (recorded in `docs/spec_deviations.md`) |
| `bin/ethlambda` | `beacon` and `validator` sub-commands; `--network`
takes a built-in name (`mainnet`, `sepolia`, `hoodi`) or a directory of
published network files; beacon checkpoint sync; `benchmark import`
replays a real block corpus offline; `run_node` is one startup path for
both chains |
| CI / Makefile | One beacon spec-test job per preset, minimal-preset
check, `make test` split into `test-consensus` and `test-node` (one
runner's disk no longer fits both), benchmark-smoke and tooling jobs,
disk-cleanup action |
| Docs | New: `beacon_stf.md`, `beacon_wire.md`, `beacon_engine.md`,
`cli.md`. Updated: `data_storage.md`, `metrics.md`, `rpc.md`,
`checkpoint_sync.md`, `discovery.md`, `benchmarking.md`,
`spec_deviations.md`, README (beacon quickstart with ethrex) |

## Correctness / Behavior Guarantees

- **Separation:** beacon behavior lives in `beacon` modules that lean
code never reads, and those modules never read lean's. The shared crates
dispatch on the chain once per handler.
- **Lean state at a beacon accessor:** this panics, naming the function
it reached (`lean_state_unreachable` / `lean_fork_unreachable`), so the
caller never gets a wrong answer back. `ForkName::Lean` is left out of
`ForkName::ALL`, so neither `parse` nor a fork upgrade can reach it.
- **Spec conformance:** every consensus-specs `v1.6.1` fixture case
passes on both presets: 5705 mainnet and 40009 minimal, including 150
mainnet `fork_choice` cases. Gossip fixtures are pinned to
`v1.7.0-beta.1`.
- **Resume safety:** a data directory written by another chain, preset
or format version is refused at startup, before any state is read.

### ⚠️ Behavior changes for lean (`ethlambda node`)

- **Existing data directories are refused on resume.** A directory
written by `main` has no `db_version` key, so `Store::from_db_state`
returns `DbVersionMismatch { found: 0, expected: 4 }`. There is no
migration: an upgraded node needs a fresh data directory (or checkpoint
sync).
- `blst` and `c-kzg` are now dependencies of the lean binary too, since
the state-transition crate holds both chains' rules. They are not
feature-gated.
- libssz is a git dependency pinned by `rev`: the beacon containers need
`DerefMut`/`IndexMut` on `SszList` (lambdaclass/libssz#33), which no
crates.io release has yet.
- The `release-fast` profile (used for tests) now sets `debug-assertions
= true`.
- `P2P::spawn` now runs before the chain actor is spawned, so gossip
arriving in that short window is dropped.
- `/lean/v0/blocks/finalized` answers JSON when asked for it by name.
SSZ stays the default.

## Tests Added / Run

- **Beacon spec tests:** `make test-beacon` (or `test-beacon-mainnet` /
`test-beacon-minimal`). Each fixture case is a separately named test,
e.g. `cargo test -p ethlambda-state-transition --test beacon_spec_tests
--features beacon-spec-tests -- electra/attester_slashing`. CI runs one
job per preset.
- **`make test`** still needs no consensus-spec download: the beacon
spec target is behind the `beacon-spec-tests` feature, and the BLS/KZG
vector tests report as ignored without it.
- **Minimal preset:** the `Test minimal preset` CI job builds and runs
the `ethlambda-types` unit tests with `preset-minimal` on.
- **Benchmark smoke:** a CI job runs the `benchmark` sub-command end to
end.
- Unit and integration tests in every new crate (`ssz-tree`, `engine`,
`validator`) and in the beacon paths of storage, p2p, rpc and the chain
actor.

## Related Issues / PRs

<details>
<summary>PRs merged into the integration branch (reviewed on
<code>lambdaclass/ethlambda_private</code>)</summary>

**Types and state transition**
- lambdaclass/ethlambda_private#1 Beacon Chain containers under a
`beacon` namespace
- lambdaclass/ethlambda_private#2 Beacon Chain state transition, phase0
through fulu
- lambdaclass/ethlambda_private#37 keep the registry and balances in
persistent Merkle trees

**Follower, sync and storage**
- lambdaclass/ethlambda_private#3 follow mainnet gossip behind an
`ethlambda beacon` sub-command
- lambdaclass/ethlambda_private#6 unify the lean and beacon storage
layer
- lambdaclass/ethlambda_private#7 checkpoint sync for the beacon chain
- lambdaclass/ethlambda_private#8 serve beacon blocks by range and by
root
- lambdaclass/ethlambda_private#9 give the follower a chain, from the
anchor to the tip
- lambdaclass/ethlambda_private#11 fulu data availability sampling,
custody through the availability gate
- lambdaclass/ethlambda_private#13 validate execution payloads over the
Engine API
- lambdaclass/ethlambda_private#15 follow a network described by files
on disk
- lambdaclass/ethlambda_private#26 add sepolia and hoodi as built-in
networks
- lambdaclass/ethlambda_private#48, lambdaclass/ethlambda_private#52,
lambdaclass/ethlambda_private#53, lambdaclass/ethlambda_private#54: held
blocks, their columns and range batches

**P2P**
- lambdaclass/ethlambda_private#18 stop outbound req/resp requests
crossing protocols
- lambdaclass/ethlambda_private#23 rank dial candidates by custody
redundancy
- lambdaclass/ethlambda_private#28 count why peers drop us
- lambdaclass/ethlambda_private#38 validate beacon gossip before
propagating it
- lambdaclass/ethlambda_private#43 run every data column check in p2p
- lambdaclass/ethlambda_private#47 validate beacon aggregates and subnet
attestations before relaying
- lambdaclass/ethlambda_private#19 apply gossip aggregates to fork
choice, backbone two attestation subnets

**API and validator**
- lambdaclass/ethlambda_private#21 serve the Beacon API from `ethlambda
beacon`
- lambdaclass/ethlambda_private#44 report the preset and constants from
`/eth/v1/config/spec`
- lambdaclass/ethlambda_private#16 beacon-chain validator client
- lambdaclass/ethlambda_private#34 serve the validator API
- lambdaclass/ethlambda_private#40 aggregate and propose through
`ethlambda beacon`
- lambdaclass/ethlambda_private#56 pack other nodes' attestations into
produced blocks

**Performance and metrics**
- lambdaclass/ethlambda_private#10, lambdaclass/ethlambda_private#20,
lambdaclass/ethlambda_private#22, lambdaclass/ethlambda_private#24,
lambdaclass/ethlambda_private#33, lambdaclass/ethlambda_private#49:
registry scans, parallel pubkey validation, committee cache, background
state writes, BLS key validation
- lambdaclass/ethlambda_private#17, lambdaclass/ethlambda_private#31:
import timing by phase
- lambdaclass/ethlambda_private#25 benchmark block import by replaying a
real corpus

**CI**
- lambdaclass/ethlambda_private#12, lambdaclass/ethlambda_private#30,
lambdaclass/ethlambda_private#45: split lint/test jobs, benchmark smoke
job, runner selection

</details>

Open PRs based on `beacon-chain-integration`, **not** included here:
lambdaclass#626, lambdaclass#627, lambdaclass#629, lambdaclass#630, lambdaclass#632, lambdaclass#634, lambdaclass#636, lambdaclass#638, lambdaclass#642, lambdaclass#644 to lambdaclass#652,
lambdaclass#656, lambdaclass#658.

## ✅ Verification Checklist

- [ ] Ran `make fmt` (clean)
- [ ] Ran `make lint` (clippy with `-D warnings`, clean)
- [ ] Ran `make test` (`test-consensus` plus `test-node`, at
`release-fast`), all passing
- [ ] Ran `make test-beacon` (both presets), all passing

---------

Co-authored-by: Pablo Deymonnaz <pdeymon@fi.uba.ar>
Co-authored-by: Klaus Lungwitz <klaus.lungwitz@lambdaclass.com>
Co-authored-by: Klaus @ LambdaClass <18153834+klaus993@users.noreply.github.com>
Co-authored-by: Chase Wright <chase.wright@ethereum.org>
dicethedev pushed a commit to dicethedev/ethlambda that referenced this pull request Nov 4, 2026
…#632)

One of three alternative implementations of the same follow-up to the
persistent-tree registry (epoch participation without per-index registry
reads): (a) lambdaclass#630, (b) this PR, (c) lambdaclass#633. They are meant to be compared,
and at most one of (a) and (b) should merge; (c) is stacked on this one.

## Motivation

The registry is now a persistent Merkle tree, so `state.validator(i)` is
a tree descent rather than an array index, while `validators().iter()`
walks leaf slices.

Epoch steps 1-3 (justification, inactivity updates, rewards) read the
registry through about 19 full scans and about 21 descents per active
validator. The pulled-up-tip check in fork choice repeats justification
on every imported block.

## Change: option (b), one summary pass, then flat passes

- New `helpers::participation`:
- `EpochSummary`: one walk of `validators().iter()`, zipped with the
flat participation lists, into per-validator flags, effective balances
and the balance totals.
- `ParticipationTotals`: the same scan without allocation. This is all
justification (and so the per-block pulled-up tip) needs.
- `RewardContext` and `ValidatorDeltas`: today's reward arithmetic per
validator, in today's operation order.
- `process_participation_steps` replaces the three step calls in the
altair, capella and electra drivers. It builds the summary once, then:
  1. runs justification on its totals;
  2. updates inactivity scores in place;
3. writes back only the balances that changed, applying each component
in spec order (never netted).
- The public step functions and `get_flag_index_deltas` /
`get_inactivity_penalty_deltas` keep their signatures, since the
fixtures call them one at a time. They become thin wrappers that build
what they need.
- Both effective-balance updates zip validators with
`balances().iter()`. Once only changed balances are written,
`balances()[i]` is a tree descent for most validators.
- `get_finality_delay` and `is_in_inactivity_leak` now return `Result`:
a finalized epoch past the previous epoch is an `ArithmeticOverflow`
rather than a debug panic or a release wrap into a permanent leak. The
spec calls that `uint64` underflow an invalid transition, and Lighthouse
and Grandine reject it the same way (Teku saturates to zero; Prysm and
Nimbus wrap). `RewardContext::new` passes the error up.
- `docs/beacon_stf.md`: a short note in "Registry and balances".
- `docs/spec_deviations.md`: from altair on, the fast path reads the
leak flag once per step, where the spec reads it per validator. So a
crafted state with the finalized epoch past the previous one fails here
even where the spec never reaches the check. No chain reaches that
state, since justification only finalizes an epoch behind the current
one.

## Testing

- The previous step 1-3 code is kept as a reference under `cfg(any(test,
debug_assertions))`.
- In debug builds, `process_participation_steps` runs the reference on a
clone for registries up to 4096. It asserts equal balances, scores,
justification bits and checkpoints, and that both paths error or neither
does. `release-fast` has debug assertions on, so this runs on every
fixture.
- Randomized tests (1500 cases across altair, bellatrix, capella,
electra and fulu) compare totals, flags, per-component deltas, the
isolated steps and error text against the reference.
- The random states keep the finalized epoch at or behind the previous
epoch, as every reachable state does. Past it, the fast path and the
reference fail at different points (see the deviation above), so the
comparison would test nothing. A unit test covers the error itself.
- The randomized tests also run in the `Test minimal preset` job, which
uses the dev profile with overflow checks on. `release-fast` turns them
off, which is how the underflow above went unnoticed under mainnet.
- Clippy `-D warnings` and the `ethlambda-state-transition` lib tests
pass.
- Beacon spec filters `epoch_processing`, `rewards`, `sanity`,
`finality`, `random`, `fork_choice` and `transition` pass on both
presets. That run predates the finality-delay change; CI's beacon spec
jobs cover it.

## Benchmark (all three options)

`ethlambda benchmark import replay` on ethlambda-5: `cargo build
--release`, mainnet corpus of 128 blocks (slots 15279073..=15279200, 4
epoch-start blocks), legs interleaved `base a b c` for two rounds. Base
against base: 0.996. Every leg imported all 128 blocks.

| | base (c913728) | (a) iterator passes | (b) summary pass | (c)
single pass |
|---|---|---|---|---|
| process wall | 104.0 s | 96.1 s | 92.0 s | 91.0 s |
| user CPU | 215.1 s | 208.4 s | 205.1 s | 203.8 s |
| `stf`, epoch-start block (mean of 4) | 1503 ms | 1126 ms | 912 ms |
709 ms |
| `stf` p50, other blocks | 577 ms | 517 ms | 478 ms | 479 ms |
| paired `stf` vs base (ratio of totals) | 1 | 0.869 | 0.797 | 0.785 |
| `get_head` p50 | 201 ms | 214 ms | 226 ms | 225 ms |
| peak RSS | 3.88 GiB | 3.93 GiB | 4.04 GiB | 4.04 GiB |

- The per-block saving comes from the pulled-up tip, which reruns
justification on every imported block.
- (c) gains nothing over (b) on ordinary blocks, since their per-block
path is the same.
- `get_head` rises as `stf` falls, although no option touches the head
computation. This is probably contention with the background state
writer, as seen in earlier import benchmarks; it is not verified. Block
wall time still falls.

## Base

- Based on `beacon-chain-integration` @ `c79fabd5`, merged into the
branch.
dicethedev pushed a commit to dicethedev/ethlambda that referenced this pull request Nov 4, 2026
…mbdaclass#633)

One of three alternative implementations of the same follow-up to the
persistent-tree registry (epoch participation without per-index registry
reads): (a) lambdaclass#630, (b) lambdaclass#632, (c) this PR. **Stacked on (b)**: this PR's
diff is the fusion only, and it targets (b)'s branch.

## Motivation

After (b), electra and fulu still walk the tree-backed registry once per
remaining epoch step: registry updates, slashings, pending deposits and
effective-balance updates. Several of those steps also recompute
`get_total_active_balance`, which descends once per active validator.
This is option (c) of the plan, the Lighthouse-style single pass
(`process_epoch_single_pass`).

## Change: fuse electra/fulu epoch steps 2-9 into one loop

`stf::epoch::single_pass` visits each validator once, in index order,
working on a local copy of the validator and its balance. Per validator,
in spec order:

1. inactivity score;
2. rewards and penalties;
3. registry action (queue, eject or activate);
4. slashing penalty;
5. planned deposit top-up;
6. effective-balance update.

Changes are written back after the loop. What depends on more than one
validator stays outside it, as in Lighthouse:

- **Exit churn:** the cursor is advanced locally in index order and
written back once.
- **Pending deposits:** the queue is planned before the loop. A deposit
counts as "exited" if the validator already has an exit or this epoch's
registry update will eject it. Top-ups of existing validators apply
inside the loop; deposits that create validators apply after it, and one
registry walk serves all pubkey lookups.
- **Consolidations:** pending consolidations run after the loop. The
effective-balance update of every validator they name, and of every
validator created by deposits, waits until then.
- **Total active balance:** taken from the summary and reused for
slashings and every churn limit. It equals `get_total_active_balance`
through step 8.

The hysteresis test both effective-balance updates use is now one
checked `leaves_hysteresis_band`: a balance near `u64::MAX` is an
`ArithmeticOverflow`, as in the spec and Lighthouse's `safe_add`, rather
than a debug panic or a release wrap that moves the effective balance.
It keeps the spec's short-circuit `or`.

The genesis epoch, and states whose registry-sized lists differ in
length, fall back to the step-by-step path. The step functions stay
public and callable in isolation for the fixtures. The per-step rules
both paths share were factored out so both run the same code: registry
action, slashing penalty, effective-balance hysteresis, inactivity score
and the exit-cursor advance.

## Testing

- In debug builds, a registry of up to 4096 validators also runs through
the specification-shaped steps 1-9 on a clone, and the two full
post-states must have equal `hash_tree_root`. A mismatch names the
differing fields.
- A randomized fused-vs-unfused test runs 800 electra and fulu cases.
They cover ejections that move the churn cursor, activations and the
activation queue, slashings, every pending-deposit branch (including new
pubkeys with valid and invalid signatures), and processed, slashed and
not-yet-withdrawable consolidations. Two deliberately injected bugs were
caught within a few seeds. About one state in ten carries a
near-`u64::MAX` balance, since one now fails the whole epoch; those
cases check that both paths fail together. As in (b), the finalized
epoch stays at or behind the previous epoch.
- Clippy `-D warnings` and the `ethlambda-state-transition` lib tests
pass, including the dev-profile `Test minimal preset` run, where
overflow checks are on.
- Beacon spec filters `epoch_processing`, `rewards`, `sanity`,
`finality`, `random`, `fork_choice` and `transition` pass on both
presets. That run predates the rebase onto (b)'s finality-delay fix and
the checked hysteresis; CI's beacon spec jobs cover both.

Over (b), this saves about 200 ms per epoch-start block and nothing on
other blocks. That is more than the plan estimated, probably because the
fusion also removes the repeated total-active-balance calls and the
per-deposit pubkey scans (not profiled). A per-epoch total cache
(follow-up 01) and a pubkey-to-index map would recover part of that gain
more simply.

## Benchmark (all three options)

`ethlambda benchmark import replay` on ethlambda-5: `cargo build
--release`, mainnet corpus of 128 blocks (slots 15279073..=15279200, 4
epoch-start blocks), legs interleaved `base a b c` for two rounds. Base
against base: 0.996. Every leg imported all 128 blocks.

| | base (c913728) | (a) iterator passes | (b) summary pass | (c)
single pass |
|---|---|---|---|---|
| process wall | 104.0 s | 96.1 s | 92.0 s | 91.0 s |
| user CPU | 215.1 s | 208.4 s | 205.1 s | 203.8 s |
| `stf`, epoch-start block (mean of 4) | 1503 ms | 1126 ms | 912 ms |
709 ms |
| `stf` p50, other blocks | 577 ms | 517 ms | 478 ms | 479 ms |
| paired `stf` vs base (ratio of totals) | 1 | 0.869 | 0.797 | 0.785 |
| `get_head` p50 | 201 ms | 214 ms | 226 ms | 225 ms |
| peak RSS | 3.88 GiB | 3.93 GiB | 4.04 GiB | 4.04 GiB |

- The per-block saving comes from the pulled-up tip, which reruns
justification on every imported block.
- (c) gains nothing over (b) on ordinary blocks, since their per-block
path is the same.
- `get_head` rises as `stf` falls, although no option touches the head
computation. This is probably contention with the background state
writer, as seen in earlier import benchmarks; it is not verified. Block
wall time still falls.

## Base

- Stacked on lambdaclass#632; its head, which carries `beacon-chain-integration` @
`c79fabd5`, is merged into the branch.
dicethedev pushed a commit to dicethedev/ethlambda that referenced this pull request Nov 4, 2026
…cursor (lambdaclass#647)

## Motivation

An epoch boundary writes every balance. `get_mut` on a tree list buffers
a copy of each element in a dense map, sorts the map into a second
`Vec`, then rebuilds every touched leaf and recomputes the root of every
written element, changed or not. The altair rewards step calls it up to
eight times per validator (four reward/penalty pairs, each as increase
then decrease), and `process_effective_balance_updates` reads
`balances()[i]` per validator, which was only cheap because the rewards
pass had just filled the map.

This PR adds an in-order lazy copy-on-write write cursor to
`ethlambda-ssz-tree` and moves the epoch balance writes onto it.
Expected gain (estimate, not measured on a real chain): tens of ms off
each epoch-start block at mainnet registry size. The import-replay
benchmark was not run for this PR.

## Changes

| commit | what |
|---|---|
| `perf(ssz-tree): add an in-order copy-on-write write cursor` |
`List`/`Vector::iter_cow`, `IterCow::next_cow`, `ElemCow::{index,
make_mut, set}`, `try_update_each`; `with_updated_leaves` generalized
over a leaf source; unit tests and model-based property tests |
| `perf(beacon): apply epoch balance and effective-balance writes
through the cursor` | `BeaconState::registry_mut` (disjoint borrows of
validators and balances); `apply_balance_deltas` used by the altair+ and
phase0 `process_rewards_and_penalties`; both
`process_effective_balance_updates`; new `tree_bench` rows; docs |

How the cursor works: it walks leaves in order and copies a leaf on the
first write that reaches it. At the leaf's end it compares only the
touched offsets with the original; if all are equal, the original leaf
(its `Arc` and cached hash) is kept. Otherwise the new leaf carries over
the element roots of unchanged elements and computes the changed ones.
On drop, one descent swaps the changed leaves in and rebuilds only their
paths. Pending buffered writes are applied before the pass starts.

## Design decisions

- `Drop` does the work, and the tree is untouched during the pass, so an
early return or a panic leaves a consistent list holding the writes so
far (tested with `catch_unwind`).
- Names as in the design: `iter_cow`, `next_cow`, `make_mut`, `set`,
`try_update_each`. No `set_with`.
- Changed composite elements get their root computed eagerly, on the
state-transition thread.
- A kept `Arc` or carried root always follows an actual comparison. The
cursor only creates fresh empty hash cells, or carried roots for a leaf
it owns; it never fills a shared `OnceLock`.
- Spec order for balances: per index, each pair is
`saturating_add(reward)` then `saturating_sub(penalty)`, pairs in order.
Deltas are never netted. Each balance depends only on its own deltas, so
index-by-index equals the spec's pair-by-pair loop.
- `apply_balance_deltas` lives in `helpers/mutators.rs` and is shared by
the phase0 and altair+ paths. It keeps the old error for a balances list
shorter than the registry, and does not touch balances past the registry
length.
- Rewards and both effective-balance passes move together: once rewards
bypass the map, the effective-balance reads would otherwise become tree
descents.
- Effective-balance updates only copy a leaf when the new effective
balance differs from the old one (it can equal it when capped at the
maximum).
- No leaf-slice API, no parallel bulk update.

## Not in this PR

- Switching `Balances` to a sparse `BTreeMap` update map: to be decided
after measuring whether a dense writer remains.
- `List::filled`: its only consumer is the participation-list work,
which is deferred.
- Migrating slashings, inactivity, and registry updates: sparse, flat
lists, or part of the epoch single-pass rewrite (lambdaclass#630, lambdaclass#632, lambdaclass#633).
Expect a merge conflict with lambdaclass#632 in `process_rewards_and_penalties`.
- Import-replay benchmark and any remote profiling.

## Testing

| command | result |
|---|---|
| `cargo test -p ethlambda-ssz-tree --profile release-fast` | 71 unit +
31 model tests passed (before the second commit) |
| `cargo test -p ethlambda-types --profile release-fast --lib` | 197
passed |
| `cargo test -p ethlambda-state-transition --profile release-fast
--lib` | 324 passed, 16 ignored |
| beacon spec suite, mainnet preset, full | 5734 passed, 4 failed |
| beacon spec suite, minimal preset, full | 40038 passed, 4 failed |
| `cargo clippy --locked --workspace --all-targets --profile
release-fast -- -D warnings` and the state-transition
`beacon-spec-tests` variant | clean |
| `cargo check -p ethlambda --profile release-fast` | ok |

The 4 spec failures in each preset are the `gossip/*` suites
(`gossip_beacon_block`, `gossip_data_column_sidecar`,
`gossip_beacon_aggregate_and_proof`, `gossip_beacon_attestation`): the
local gossip fixture directory is intentionally empty, so they match no
cases. Every other suite, including `epoch_processing`, `rewards`,
`sanity`, `finality`, `random` and `transition`, passes.

### tree_bench (2.4M validators, `--ignored`, single run)

Noisy: run while the machine was under a load average above 100 from
other builds, so absolute numbers (and even the order of the old rows)
are unreliable; read them as rough ratios only.

| row | ms |
|---|---|
| `epoch_sweep_tree` (old path) | 333.8 |
| `epoch_sweep_tree_phases` | write 58.1, apply 70.0, hash 83.1 |
| `epoch_sweep_cursor_tree` | 26.8 |
| `epoch_sweep_noop_cursor_tree` | 90.4 |
| `epoch_sweep_rebuild_tree` (rebuild baseline) | 105.8 |
| `rewards_apply_4_pairs_get_mut` | 342.5 |
| `rewards_apply_4_pairs_cursor` | 158.9 |
| `eb_updates_indexed` | 253.8 |
| `eb_updates_cursor` | 115.4 |
| `lockstep_three_lists_cursor` | 136.2 |

The bench asserts the cursor rows produce the same roots as the old
paths, and that a no-op sweep keeps the tree (`ptr_eq`).
dicethedev pushed a commit to dicethedev/ethlambda that referenced this pull request Nov 4, 2026
## Motivation

`get_total_active_balance` rescans the registry about ten times per
ordinary block: once per attestation (through
`get_base_reward_per_increment`), twice in the sync aggregate, plus
churn and fork-choice callers. Each call built an index `Vec` of the
active validators and then read every index back with a `validator(i)`
tree descent. In the profile taken for the persistent-tree registry
change, this was the largest cost left after hashing (the plan's
estimate: about 414 ms per block at mainnet scale; an estimate, not
measured here).

## Changes

| Commit | Change |
|---|---|
| `perf(beacon): sum the total active balance in one registry pass` |
`get_total_active_balance` is one in-order `validators().iter()` pass
with the same `saturating_add` and one-increment floor as
`get_total_balance`. No index `Vec`, no descents. Every caller gets it,
cached or not. Randomized test (inline SplitMix64) against
`get_total_balance(get_active_validator_indices(..))`, plus an all-zero
registry. |
| `perf(beacon): cache the total active balance per epoch in the store`
| New `ActiveBalanceCache` (`ethlambda-storage`), held by the `Store`
beside the committee cache (`Store::active_balance_cache()`). Key
derivation and lookup in `ActiveBalanceCacheExt`
(`helpers/accessors.rs`). Attestation processing (altair, deneb,
electra) and `process_sync_aggregate` take it; plumbed up through block
processing and `state_transition`. New metric
`lean_beacon_total_active_balance_lookups_total{result}`. Docs in
`beacon_stf.md` and `metrics.md`. |
| `perf(beacon): read each attester's validator once per attestation` |
The effective balance is read once per attester, lazily on the first
newly earned flag, instead of once per flag. |

## Design decisions

- **External cache, not a state field.** The design review chose a
store-held table like `CommitteeCache` over a non-SSZ cache field on
`BeaconState`. That keeps the state type, its SSZ derive and its fork
upgrades untouched: no libssz change, no `rebase_on` adoption, no reset
at upgrades.
- **Why the key is sound.** The total for a state in epoch E is fixed by
two inputs. Effective balances are written only by epoch E-1's
`process_effective_balance_updates`; the Electra upgrade zeroes only
never-activated validators, which are not active at E. The active set at
E cannot change inside E, because every activation and exit lands at
least `MAX_SEED_LOOKAHEAD` epochs ahead; deposits append validators that
are not yet active; slashing sets `slashed` but leaves effective
balances alone (the spec's total keeps slashed validators). So `(E,
block root at the last slot of E-1)` identifies the history: two states
agreeing on it agree on the total. Sibling branches that diverge during
E-1 have different roots, so they get different entries.
- **Decision root differs from the shuffling key.** The shuffling key
uses the last slot of E-2, since the seed is fixed ahead of use; the
total is not, so it needs the later root. A new key type
(`ActiveBalanceKey`) keeps the two apart.
- **Epoch 0** keys on the genesis block root (slot 0), like the
shuffling key does for its first epochs. A state that cannot name the
root (the genesis state itself, or a root outside the history window) is
`unkeyable`: computed, not cached.
- **Only block processing uses the cache.** Between
`process_effective_balance_updates` and the slot increment a state is in
epoch E-1 but already carries E's balances, so a key rooted at the end
of E-2 would be wrong there. Block processing never runs in that window
(`process_slots` has already advanced the state), and epoch processing
keeps the uncached one-pass function. Documented on
`active_balance_key`.
- **Debug cross-check.** Every hit is compared against a fresh
computation under `debug_assert_eq!`, so a missed writer fails the
fixtures (`release-fast` keeps debug assertions on).
- **No single-flight.** A concurrent double compute on a miss is
accepted: the value is one cheap registry pass and both callers compute
the same number.
- **`on_block` reads the store's cache itself**
(`store.active_balance_cache()`), so its signature and the chain actor
are unchanged. Other callers (spec runners, block production, unit
tests) pass `ActiveBalanceCache::default()`.
- **Capacity** is a small constant with eviction of the lowest epoch;
entries are tiny, so room for several forks is cheap.
- **Per-attester read stays lazy** so that an attester earning no flag
is still never read, which keeps error behavior identical.

## Not in this PR

- Fork choice's `get_proposer_score` and `calculate_committee_fraction`
keep calling the uncached function; another change replaces that total
with a justified-balances snapshot.
- Epoch processing and the pulled-up tip: they compute totals inside the
single-pass epoch summary work (lambdaclass#630, lambdaclass#632, lambdaclass#633).
- Churn helpers (exits, consolidations, slashings): rare per block, they
use the one-pass function.
- A flat effective-balance epoch cache (progressive balances): waits
until something consumes it.

## Testing

Measured on release-fast with debug assertions. The import-replay
benchmark was not run for this PR, so there is no measured speedup to
report.

| Command | Result |
|---|---|
| `cargo clippy --locked --workspace --all-targets --profile
release-fast -- -D warnings` | clean |
| `cargo clippy -p ethlambda-state-transition ... --features
beacon-spec-tests -- -D warnings` | clean |
| `cargo test -p ethlambda-storage --lib` | 142 passed, 1 ignored (run
before the store-sharing test was added; not re-run after) |
| `cargo test -p ethlambda-state-transition --lib` | 330 passed, 16
ignored |
| beacon spec suite, mainnet (full) | 5734 passed, 152 ignored, 4 failed
|
| beacon spec suite, minimal (full) | 40038 passed, 3692 ignored, 4
failed |
| `cargo check -p ethlambda --profile release-fast` | clean |

The 4 failures per preset are the gossip `matched_fixture_cases` checks:
the gossip fixture tree is empty in this environment, so they match no
cases. Every other suite passes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

beacon Ethereum Beacon Chain client

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant