Skip to main content
netspecsEthereum networking

4.2.2.Attestation networking

Stage
In progress
Version
Sources
6 pinned sources

Unaggregated attestations use 64 subnet topics.

Aggregates use one global beacon_aggregate_and_proof topic. Both forms use the active fork digest and SSZ-Snappy encoding.

Wire types and duties

beacon_attestation_{subnet_id} carries an Attestation with one aggregation bit set. Its committee index is attestation.data.index, and the subnet is compute_subnet_for_attestation(committees_per_slot, slot, committee_index). A validator broadcasts one message for its assigned committee and the node keeps two long-lived random subnets for 256 epochs.

The subnet payload is:

SingleAttestation:
  committee_index: CommitteeIndex
  attester_index: ValidatorIndex
  data: AttestationData       # data.index must be zero
  signature: BLSSignature

beacon_aggregate_and_proof remains SignedAggregateAndProof, but Electra encodes the committee index in aggregate.committee_bits, requires exactly one bit, and requires aggregate.data.index == 0. The aggregate seen cache is keyed by (hash_tree_root(aggregate.data), committee_index).

Subnet validation

For every subnet message, the receiver rejects a committee index outside the per-slot count, a wrong subnet, an epoch that does not equal the data slot, a wrong bit length, or a signature that does not verify under DOMAIN_BEACON_ATTESTER. It ignores a future slot or an epoch outside the current or previous epoch, a duplicate validator vote, an unknown voted block, or a vote not descending from the finalized checkpoint.

The receiver also rejects a non-zero data.index and an attester outside the named committee.

The message has exactly one aggregation bit. The receiver checks the indexed attestation, target checkpoint ancestry, and block state before it records (target_epoch, validator_index) in the seen cache. An ignored unknown parent may be queued and retried; a rejected invalid parent or signature is not forwarded.

Aggregate validation

The receiver rejects an aggregate with no participants, an invalid committee bitfield, invalid aggregation-bit length, invalid selection proof, invalid aggregator signature, invalid aggregate signature, or an aggregator outside the committee. It ignores a future or stale epoch, a duplicate aggregator for the target epoch, an aggregate whose voted block is unknown, or a non-strict subset already covered by a seen aggregate. Valid aggregates must have a target checkpoint that is an ancestor of the LMD vote and must not conflict with the finalized checkpoint.

The seen cache stores bitsets per data root and ignores a new aggregate when a previous bitset is a non-strict superset. This prevents repeated signature work without penalizing an honest peer for a locally redundant aggregate.

Glamsterdam payload status

The aggregate wire type permits aggregate.data.index values 0 and 1. Same-slot attestations use index 0. Index 1 requires the matching execution-payload envelope to be present and valid. The receiver checks the payload status after the normal attestation and ancestry checks. A payload that is not yet available is an ignore or queue condition; a payload marked invalid prevents forwarding.

Subnet advertisements

attnets is an SSZ BitVector[ATTESTATION_SUBNET_COUNT]; mainnet sets ATTESTATION_SUBNET_COUNT to 64. A set bit means the node keeps the corresponding persistent attestation subnet. The node advertises only its two long-lived subnets (SUBNETS_PER_NODE = 2, held for EPOCHS_PER_SUBNET_SUBSCRIPTION = 256 epochs) and updates the ENR only for those, not for a short committee duty.

If any MetaData.attnets bit is set, the ENR MUST contain the same attnets value. When all bits are zero, the ENR may omit the field or include the zero vector. Metadata seq_number is independent of the ENR sequence number and increments whenever any metadata field changes, including a change to attnets.

A client MUST validate the bitvector length and SSZ encoding. It MUST NOT infer a live subscription from an absent field, and it SHOULD recheck metadata after connecting to an ENR candidate. A stale bit is not, by itself, proof of malicious behavior.

Reject malformed bitvectors and metadata with an unknown schema version. If a peer's metadata disagrees with its ENR, keep discovery and transport alive while the client refreshes the record. Apply a score penalty only after observed behavior fails the advertised service, such as refusing a required subnet stream.

Propagation window and scoring

ATTESTATION_PROPAGATION_SLOT_RANGE is 32 slots, with MAXIMUM_GOSSIP_CLOCK_DISPARITY of 500 milliseconds at both ends. A message outside that range is ignored, not rejected. Invalid signatures, wrong subnet, committee failures, and malformed SSZ are rejected and may reduce the sending peer's application score. Duplicates, missing state, and stale timing do not carry an invalid-delivery penalty.

Scope and status

This page defines attestation subnet and aggregate topics and the attnets subscription field. The wire and validation rules remain fork-selected by fork digest.