Cap self-built payload envelopes at one per valid proposer per slot

[potuz]

Problem

In queuePendingPayloadEnvelope, both capacity caps (maxPendingPayloadRoots=128, maxPendingBuildersPerRoot=2) are gated behind !isSelfBuild, and all self-build envelopes share one builder-index constant (BuilderIndexSelfBuild) so the per-root inner[builderIdx] dedup never fires across roots.

A malicious current-slot proposer holds the proposer key and can sign an unbounded number of self-build envelopes, each with a different beacon_block_root, all validly signed. Each new root both adds a pending-map entry and fires a sendBatchRootRequest goroutine to fetch the unknown block. The resulting flood of spurious block-by-root requests gets us banned by our peers.

Fix

Cap self-build at one queued payload per valid proposer index per slot, keyed on the head-state proposer for the current slot (helpers.BeaconProposerIndexAtSlot). A valid self-build signature already ties the envelope to exactly that proposer, so the key is deterministic and not attacker-controlled.

• The seen-proposer entry is recorded only after a successful signature verification, so a non-proposer peer cannot reserve or block the real proposer's slot with a bad envelope.
• Keying per proposer (not globally per slot) still admits one payload per distinct valid proposer in a forked scenario where the head reorgs to a branch with a different slot proposer — bounded by our own reorgs, not the attacker.
• The existing per-slot maxSelfBuildSigFailures budget is retained to bound bad-signature floods from non-proposers.
• queuePendingPayloadEnvelopeFromRootRequest needs no change — it already enforces the caps and never fires a root request.

Tests

Added to pending_payload_envelope_test.go:

• Flood (one proposer, many distinct roots) → exactly one queued payload.
• Distinct fork proposers (head reorg to a different valid slot proposer) → two queued payloads.
• Bad-sig-does-not-reserve → a bad-signature envelope neither reserves the proposer's slot nor blocks the subsequent valid one.

Pre-existing SelfBuildBypasses* tests still pass, confirming honest self-build is never starved by the external-builder caps; the new per-proposer bound is orthogonal.

🤖 Generated with Claude Code