feat(p2p): refuse execution payloads whose block hash is not their header's

crates/blockchain/state_transition/src/beacon/gossip/mod.rs

@@ -321,6 +321,10 @@ pub enum RejectReason {
     BuilderIndexMismatch,
     /// A gloas envelope's payload block hash is not its bid's.
     BlockHashMismatch,
+    /// An execution payload's `block_hash` is not the hash of the execution
+    /// block header rebuilt from the payload's own fields. A check stricter
+    /// than the specification's, run in p2p: see `docs/spec_deviations.md`.
+    PayloadBlockHashMismatch,
     /// The root of a gloas envelope's execution requests is not its bid's.
     ExecutionRequestsRootMismatch,
     /// A gloas envelope's payload carries more withdrawals than its limit.
@@ -384,6 +388,7 @@ impl RejectReason {
             Self::PayloadInvalid => "payload_invalid",
             Self::BuilderIndexMismatch => "builder_index_mismatch",
             Self::BlockHashMismatch => "block_hash_mismatch",
+            Self::PayloadBlockHashMismatch => "payload_block_hash_mismatch",
             Self::ExecutionRequestsRootMismatch => "execution_requests_root_mismatch",
             Self::TooManyWithdrawals => "too_many_withdrawals",
             Self::PreGloasSlot => "pre_gloas_slot",

crates/net/p2p/Cargo.toml

@@ -70,6 +70,9 @@ rand = "0.8"
 # against with nothing in the manifest saying so.
 ethrex-p2p = { git = "https://github.com/lambdaclass/ethrex", tag = "v25.0.0" }
 ethrex-rlp = { git = "https://github.com/lambdaclass/ethrex", tag = "v25.0.0" }
+# The ordered trie behind a payload's transactions root, which `ethrex-common`
+# only builds from decoded transactions, not the raw bytes a payload carries.
+ethrex-trie = { git = "https://github.com/lambdaclass/ethrex", tag = "v25.0.0" }
 ethrex-common = { git = "https://github.com/lambdaclass/ethrex", tag = "v25.0.0" }
 
 # `rand` seeds the throwaway signing keys the ENR tests build records with.

crates/net/p2p/src/beacon/envelope_checks.rs

@@ -33,6 +33,7 @@ use ethlambda_types::beacon::containers::gloas::SignedExecutionPayloadEnvelope;
 use tracing::{debug, error, warn};
 
 use crate::P2PServer;
+use crate::beacon::payload_hash;
 
 /// Whether a fetched envelope goes to the chain actor.
 pub(crate) fn forwards(outcome: &Outcome) -> bool {
@@ -48,10 +49,14 @@ fn judge(store: &Store, envelope: &SignedExecutionPayloadEnvelope) -> Outcome {
     // A fresh, empty cache: a fetched envelope is not a gossip duplicate of
     // anything, so the cache's one rule never fires.
     let seen = SeenEnvelopes::new(NonZeroUsize::MIN);
-    match cheap_checks(&seen, store, envelope) {
-        Ok(()) => stateful_checks(store, envelope),
-        Err(outcome) => outcome,
+    if let Err(outcome) = cheap_checks(&seen, store, envelope) {
+        return outcome;
     }
+    // The same stricter-than-the-specification rule the gossip topic runs.
+    if let Err(outcome) = payload_hash::reject_envelope_on_mismatch(envelope) {
+        return outcome;
+    }
+    stateful_checks(store, envelope)
 }
 
 /// Run the gossip rules on `envelopes` and send the chain actor the ones that
@@ -235,7 +240,13 @@ pub(crate) mod tests {
     }
 
     pub(crate) fn envelope(slot: u64, byte: u8) -> SignedExecutionPayloadEnvelope {
-        crate::beacon::encoding::test_support::envelope(H256::repeat_byte(byte), slot, H256::ZERO)
+        // Sealed: the fetched-envelope rules refuse a block hash that is not
+        // the payload's header's.
+        payload_hash::seal_envelope(crate::beacon::encoding::test_support::envelope(
+            H256::repeat_byte(byte),
+            slot,
+            H256::ZERO,
+        ))
     }
 
     #[test]

crates/net/p2p/src/beacon/mod.rs

@@ -21,6 +21,7 @@ pub mod envelope_checks;
 pub mod fork_schedule;
 pub mod handler;
 pub mod messages;
+pub mod payload_hash;
 pub mod protocols;
 pub mod scoring;
 pub mod subnets;