Verify blobs and data columns during backfill

[michaelsproul]

During backfill the only verification we do is of the block's signatures:

lighthouse/beacon_node/beacon_chain/src/historical_blocks.rs

Lines 205 to 213 in d96b731

	block_proposal_signature_set_from_parts(
	block,
	Some(block_root),
	block.message().proposer_index(),
	&self.spec.fork_at_epoch(block.message().epoch()),
	self.genesis_validators_root,
	|validator_index| pubkey_cache.get(validator_index).cloned().map(Cow::Owned),
	&self.spec,
	)

This does not cover the blobs or data columns, which could be mismatched/invalid.

For blobs we should check:

• KZG inclusion proof (already checked by the network crate:

  lighthouse/beacon_node/network/src/sync/network_context/requests/blobs_by_range.rs

  Line 36 in d96b731

  if !blob.verify_blob_sidecar_inclusion_proof() {

  ).
• Blob data matches the KZG commitment: TODO (verify KZG proof).
• Signature in the blob's block header matches the block's signature (equality check is fine).

Similarly for data columns.

[michaelsproul]

Cheers to @dapplion for raising this!

[SunnysidedJ]

Hi @michaelsproul, can I work on this?

[michaelsproul]

@SunnysidedJ yes that would be great, thanks!

[dapplion]

@SunnysidedJ I'm also working on it in a separate branch. Feel free to copy the code if you like the approach. I'm keen to fix this issue before merging my branch to reduce the diff #7352

verify signatures during range sync: https://github.com/sigp/lighthouse/pull/7352/files#diff-040e5811a1138cc99780af10517d4288761762d1bc610c719390db564eac524cR640-R664

verify signatures during backfill sync: https://github.com/sigp/lighthouse/pull/7352/files#diff-394c4b63116221e5cd8344f6f7046e7f6a02bc8c438da392c990e4c27802b6cfR127-R166

[SunnysidedJ]

@SunnysidedJ I'm also working on it in a separate branch. Feel free to copy the code if you like the approach. I'm keen to fix this issue before merging my branch to reduce the diff #7352

verify signatures during range sync: https://github.com/sigp/lighthouse/pull/7352/files#diff-040e5811a1138cc99780af10517d4288761762d1bc610c719390db564eac524cR640-R664

verify signatures during backfill sync: https://github.com/sigp/lighthouse/pull/7352/files#diff-394c4b63116221e5cd8344f6f7046e7f6a02bc8c438da392c990e4c27802b6cfR127-R166

Hi @dapplion, thank you for carefully checking the open issues and letting me know about this. I didn't know you've been working on this. I've been working on this over the Easter as well and was failing to test it as described in the draft PR that I just pushed with the work so far #7353. I will align and take the code changes ASAP so that we don't have much diffs and your changes can go in quickly.

I also left the test part as a comment, but wondering how did you test it under Deneb and Fulu setting. The test function testing the backfill works for pre-Deneb but fails for Deneb and beyond when you enable it. If you run it without fork name environment variables, the test doesn't generate blob and data column sidecars. So, I couldn't verify my changes. Please let me know if you have a better idea to test this!

[dapplion]

@SunnysidedJ changes look good on your end, what I'm adding on my branch is also tracking which columns are invalid so we can attribute fault to the right peers

I didn't got to test my changes

[SunnysidedJ]

@dapplion I've just raised mine as Full PR for review. I tried to minimize conflicts as much as possible. Please find the details here: #7353 (comment)