Validate a bid coming from the Builder API (Gloas)

[StefanBratanov]

PR Description

Implements the rules as per https://github.com/ethereum/builder-specs/blob/main/specs/gloas/validator.md#validating-a-signedexecutionpayloadbid and filters out any bids which fail validation. (warn message is logged in this case)

Fixed Issue(s)

fixes #11191

Documentation

• I thought about documentation and added the doc-change-required label to this PR if updates are required.

Changelog

• I thought about adding a changelog entry, and added one if I deemed necessary.

---

Note

Medium Risk
Changes which builder bids are accepted for block production and tightens BLS verification paths for execution payload bids; incorrect validation could drop valid bids or accept invalid ones, but scope is Gloas builder flow rather than core consensus.

Overview
Adds Gloas Builder API bid validation so SignedExecutionPayloadBid responses from staked builders are checked against the builder validator spec before they enter block production. A new BuilderBidValidator enforces active builder, slot/parent hash and root, prev_randao, optional proposer fee recipient and gas-limit compatibility (reusing public ExecutionPayloadBidGossipValidator.isGasLimitTargetCompatible), collateral coverage, and BLS signature via the spec-configured verifier. BuilderBidFetcher filters failed bids (warn on validation errors) and skips fetch when no builders are configured.

Related fixes: Gloas block processing and OperationSignatureVerifier now use getBLSSignatureVerifier() instead of BLSSignatureVerifier.SIMPLE; builder API bids also pass the configured min bid filter in ExecutionPayloadBidSelector. Wired in BeaconChainController with unit tests for validator rules and fetch filtering.

^{Reviewed by Cursor Bugbot for commit 83d83ac. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 0f04cb1. Configure here.}

[gfukushima]

reviewed this PR myself and it looked alright to me, but ran a sanity check on claude and it came back with a few things:

Correctness

1. Fail-open when proposer preferences are missing (BuilderBidValidator.java:99). If the in-memory preferences map has no entry for the slot, the fee-recipient and gas-limit checks are skipped and the bid is accepted. The builder-specs validate_bid asserts fee recipient unconditionally, and the gossip validator saves-for-future in the same case. A builder could set its own address as fee recipient and get paid via the pending withdrawal. The test skipsFeeAndGasLimitChecksWhenProposerPreferencesAbsent pins this behaviour as intended, which is probably wrong.
2. Parent block hash never compared to the requested parent (BuilderBidValidator.java:80). The bid is accepted if its parent matches either the FULL or EMPTY variant, and ExecutionPayloadBidSelector only applies the parent-hash filter to p2p bids. A builder bid built on the wrong variant can win selection and fail state transition on the execution requests root, causing a missed proposal. Fix by adding the same filter to the builder stream or passing the parent hash into validateBid.
3. Three cheap checks omitted that the block processor enforces: builder version equals PAYLOAD_BUILDER_VERSION, block hash differs from parent block hash, and blob commitment count within the max. Spec-faithful omission, but since builder bids bypass gossip validation, nothing else catches them before the proposer's own block is rejected.
4. Untrusted bid slot used before the slot check (BuilderBidValidator.java:63). Predicates and accessors resolve from bid.getSlot() before slot equality is verified. A pre-Gloas slot in the response throws IllegalArgumentException instead of a clean rejection.
5. Missing parent gas limit throws instead of returning false (BuilderBidValidator.java:111). After checkpoint sync at a Gloas slot the gas limit can be unavailable for a while, producing a stack-trace WARN per builder per slot. Should log a one-line reason and return false like every other check.

Test coverage

6. rejectsIfGasLimitNotCompatibleWithProposerPreferences uses different random addresses for the bid and preferences, so it rejects on fee-recipient mismatch first. The gas-limit branch has zero effective coverage. Deleting it leaves the suite green.
7. The new minBidPredicate filter on the builder-bid stream in ExecutionPayloadBidSelector has no test.

Design

8. The new class duplicates five checks already exposed by GossipValidationHelper in the same module, and its simple name collides with the existing MEV-boost BuilderBidValidator interface. Injecting the helper and renaming to something like ExecutionPayloadBidBuilderApiValidator would avoid a third copy that drifts, which finding 3 already demonstrates.

I was keen to collab on this PR or a next one if you don't mind

[StefanBratanov]

@gfukushima feel free to push to this PR with the changes suggested, I wouldn't work on it if you want?