Skip to main content
netspecsEthereum networking

4.2.3.Validator operations

Stage
Current
Version
Sources
4 pinned sources

Validator operations are low-rate global gossip. Nodes send complete SSZ objects, keep a seen set keyed by the affected validator, and forward only a message that passes every operation check. A block proposer may include a valid operation after it learns it from gossip or another source.

Wire inventory

SignedVoluntaryExit:
  message: VoluntaryExit        # epoch, validator_index
  signature: BLSSignature

ProposerSlashing:
  signed_header_1: SignedBeaconBlockHeader
  signed_header_2: SignedBeaconBlockHeader

AttesterSlashing:
  attestation_1: IndexedAttestation
  attestation_2: IndexedAttestation

The topics are voluntary_exit, proposer_slashing, and attester_slashing.

The topic set also includes:

BLSToExecutionChange:
  validator_index: ValidatorIndex
  from_bls_pubkey: BLSPubkey
  to_execution_address: ExecutionAddress

SignedBLSToExecutionChange:
  message: BLSToExecutionChange
  signature: BLSSignature

The bls_to_execution_change topic carries this signed object.

Voluntary exits

The receiver ignores a second valid exit for the same validator. It rejects an out-of-range index, an inactive validator, a validator that already started an exit, an exit epoch in the future, or a validator active for less than SHARD_COMMITTEE_PERIOD. The signature must verify under DOMAIN_VOLUNTARY_EXIT for the exit epoch. A valid message enters seen.voluntary_exit_indices.

Proposer and attester slashings

For a proposer slashing, both headers must have the same slot and proposer index, must differ, identify an in-range slashable proposer, and carry valid DOMAIN_BEACON_PROPOSER signatures. A duplicate proposer index is ignored.

For an attester slashing, the two indexed attestations must be slashable by a double vote or surround vote. All indices must be valid, both indexed attestations and signatures must verify, and at least one shared index must be slashable at the current epoch. A duplicate set of slashable indices is ignored.

The indexed-attestation capacity is MAX_VALIDATORS_PER_COMMITTEE * MAX_COMMITTEES_PER_SLOT.

BLS-to-execution changes

The Capella topic is ignored before CAPELLA_FORK_EPOCH and after a valid change for the same validator. It rejects an out-of-range index, a validator without BLS_WITHDRAWAL_PREFIX credentials, or a from_bls_pubkey whose hash does not equal the validator's withdrawal credentials. The signature must use DOMAIN_BLS_TO_EXECUTION_CHANGE with the genesis validators root and verify under from_bls_pubkey. A valid message enters seen.bls_to_execution_change_indices.

The operation is one-time and irreversible on chain. The destination address is carried in the signed message; the network does not treat a valid gossip message as proof that a withdrawal has already occurred.

Forwarding and scoring

Malformed SSZ, invalid signatures, conflicting headers, invalid indices, and state-ineligible operations are REJECT results and may lower the peer's application score. Already-seen or pre-fork operations are IGNORE results and are not invalid-delivery evidence. A node marks an operation seen only after all checks pass, so an invalid message cannot suppress a later valid one.

Scope and status

This page defines validator-operation gossip and the seen-set rule. Forks can change operation limits and attester-slashing capacity without changing the global gossip envelope.