/eth/v1/beacon/light_client/update as ssz does not follow the spec

[simon-jentzsch]

The spec defines the response when called with application/octet-stream as:

Sequence of zero or more response_chunk. Each successful response_chunk MUST contain a single LightClientUpdate payload:

 (
   response_chunk_len: Little-endian Uint64 byte length of `response_chunk`
   response_chunk: (
     context: 4 byte `ForkDigest`
     payload: SSZ serialized payload bytes
   )
 )

For each response_chunk, a ForkDigest-context based on compute_fork_version(compute_epoch_at_slot(update.attested_header.beacon.slot)) is used to select the fork namespace of the Response type. Note that this fork_version may be different from the one used to verify the update.sync_aggregate, which is based on update.signature_slot.

Currnetly the light client updates returned by lighthouse fail while others like nimbus or lodestar follow this spec and work fine.

[michaelsproul]

Is it a problem specifically with SSZ? Does LH work when you use JSON?

Can you share a script/program that you're using to test this?

[simon-jentzsch]

It's not only the SSZ-Format, but also the JSON-Values are not working.
There are 2 issues:

1. even though I used count=1, the resulting array returned 2 LightClientUpdates, where the second one had an older slot not even matching the required period.
2. The merkle proof (branch) does produce the correct state_root.

I wrote a simply test-script which takes the json values, and verifies the merkle proof by calculating the state root.
When I test this with the JSON-output from lodestar, it produces the correct state_root, but lighthouse does not.

Here is how to reproduce:

# fetch a light client update from lodestar
> curl https://lodestar-mainnet.chainsafe.io/eth/v1/beacon/light_client/updates?start_period=1487&count=1 > lodestar.json
> node light_client_update.js lodestar.json
valid state root 

# use the same script with lighthouse
>  curl https://gnosis-chiado.core.chainstack.com/<APIKEY>/eth/v1/beacon/light_client/updates?start_period=2140&count=1  > lighthouse.json
> node light_client_update.js lighthouse.json
State root mismatch
sync_root :  c90c77849e0476eb5af016f3d31e1ac92b9144fee7e322a68053658f2a9fc637
state_root_calculated :  ff64827679d5ca2ea540c824c39825d02b09df0db4ed16b6a56fb5f483644d32
state_root_expected :  2cff335d4a9ac9f93191fe81ed6967dddbcf75b14a49c974e48a317b21b9a5f1

The Version I tested with is Lighthouse/v7.0.0-54f7bc5/x86_64-linux ( using chainstack )

And here is the script I tested with:

const data = JSON.parse(require("fs").readFileSync(process.argv.pop(), 'utf8'))[0].data
const hash = (...values) => require("crypto").createHash("sha256").update(Buffer.concat(values.map(fromHex))).digest()
const fromHex = (hex) => Buffer.isBuffer(hex) ? hex : Buffer.from(hex.replace("0x", ""), "hex")
const hash_roots = (roots) => new Array(roots.length / 2).fill(0).map((_, i) => hash(roots[i * 2], (roots[i * 2 + 1] || Buffer.alloc(32))))
const hash_key = (key) => hash(key, Buffer.alloc(16))
const ELECTRA_NEXT_SYNC_COMMITTEE_GINDEX = 87 // used to be 55 before electra

function calculate_next_sync_committee_root(next_sync_committee) {
    let roots = next_sync_committee.pubkeys.map(hash_key) // adding 16 bytes of padding
    while (roots.length > 1) roots = hash_roots(roots)
    return hash(roots[0], hash_key(next_sync_committee.aggregate_pubkey))
}

function merkle_root_from_branch(gindex, branch, leaf) {
    let root = leaf, i = 0
    while (gindex > 1) {
        root = gindex % 2 ? hash(branch[i++], root) : hash(root, branch[i++])
        gindex >>= 1
    }
    return root
}


const sync_root = calculate_next_sync_committee_root(data.next_sync_committee)
const state_root_calculated = merkle_root_from_branch(ELECTRA_NEXT_SYNC_COMMITTEE_GINDEX, data.next_sync_committee_branch, sync_root) // we only check electra states
const state_root_expected = fromHex(data.attested_header.beacon.state_root)


if (Buffer.compare(state_root_calculated, state_root_expected)) {
    console.log("State root mismatch")
    console.log("sync_root : ", sync_root.toString("hex"))
    console.log("state_root_calculated : ", state_root_calculated.toString("hex"))
    console.log("state_root_expected : ", state_root_expected.toString("hex"))
    process.exit(1)
}

console.log("valid state root")

[simon-jentzsch]

And here is the same script but handling the ssz formated light client update:

const data = require("fs").readFileSync(process.argv.pop())
const hash = (...values) => require("crypto").createHash("sha256").update(Buffer.concat(values)).digest()
const hash_roots = (roots) => new Array(roots.length / 2).fill(0).map((_, i) => hash(roots[i * 2], (roots[i * 2 + 1] || Buffer.alloc(32))))
const hash_key = (key) => hash(key, Buffer.alloc(16))
const split_bytes = (bytes, len) => new Array(bytes.length / len).fill(0).map((_, i) => bytes.slice(i * len, (i + 1) * len))
const ELECTRA_NEXT_SYNC_COMMITTEE_GINDEX = 87 // used to be 55 before electra

function calculate_next_sync_committee_root(next_sync_committee) {
    let roots = next_sync_committee.pubkeys.map(hash_key) // adding 16 bytes of padding
    while (roots.length > 1) roots = hash_roots(roots)
    return hash(roots[0], hash_key(next_sync_committee.aggregate_pubkey))
}

function merkle_root_from_branch(gindex, branch, leaf) {
    let root = leaf, i = 0
    while (gindex > 1) {
        root = gindex % 2 ? hash(branch[i++], root) : hash(root, branch[i++])
        gindex >>= 1
    }
    return root
}

function decode_ssz(data) {
    function read_ssz(bytes, len) {
        const value = bytes.slice(offset.start, offset.start + len)
        offset.start += len
        return value
    }
    // decode ssz
    let offset = { start: 4 }
    const next_sync_committee = read_ssz(data, 513 * 48) // 512 keys + aggregated pubkey (48 bytes)
    const next_sync_committee_branch = read_ssz(data, 6 * 32) // 6 hashes in the branch ( for electra)  
    const attested_header = data.slice(data.readUInt32LE(0), data.readUInt32LE(offset.start)) // dynamic object between the offsets
    return {
        state_root: attested_header.slice(48, 48 + 32), // just take the stateroot out of the fixed header
        next_sync_committee: {
            pubkeys: split_bytes(next_sync_committee.slice(0, 512 * 48), 48),
            aggregate_pubkey: next_sync_committee.slice(512 * 48, 513 * 48)
        },
        next_sync_committee_branch: split_bytes(next_sync_committee_branch, 32)
    }
}

// decode the first chunk, by reading the length from the first 8 bytes and skipping the forkDigest since we expect electra
const chunk_len = data.slice(0,8)
const fork_digest = data.slice(8,12)
const update = decode_ssz(data.slice(12, 12 + chunk_len.readUInt32LE(0)))

// calculate the state_root
const sync_root = calculate_next_sync_committee_root(update.next_sync_committee)
const state_root_calculated = merkle_root_from_branch(ELECTRA_NEXT_SYNC_COMMITTEE_GINDEX, update.next_sync_committee_branch, sync_root) // we only check electra states
const state_root_expected = update.state_root

// check
if (Buffer.compare(state_root_calculated, state_root_expected)) {
    console.log("State root mismatch")
    console.log("sync_root : ", sync_root.toString("hex"))
    console.log("state_root_calculated : ", state_root_calculated.toString("hex"))
    console.log("state_root_expected : ", state_root_expected.toString("hex"))
    process.exit(1)
}

console.log("valid state root")

To test it:

> curl https://lodestar-mainnet.chainsafe.io/eth/v1/beacon/light_client/updates?start_period\=1487&count=1 -H 'Accept: application/octet-stream'  > lodestar.ssz
> node light_client_update.js lodestar.ssz
valid state root 

[michaelsproul]

Ah right, I think this is a duplicate of:

• next sync committee branch calculated incorrectly #7441

Can you try testing with v7.1.0? AFAIK this was only an issue in v7.0.0 and is fully resolved now.

[simon-jentzsch]

Thanks, I have now tested with 'Lighthouse/v7.1.0-cfb1f73/x86_64-linux' and can confirm the issue with not validating branch is fixed. This works, but 2 issues are still there:

• the ssz - format does not match the spec
• even with count=1, I get more then one LightClientUpdate in the Array.

[michaelsproul]

Thanks, will leave this issue open so we can fix those problems