produceBeaconBody dereferences the blobs bundle without checking it, immediately after a successful payload collection:
if len(bundles.Blobs) != len(bundles.Proofs) || ...
The in-process execution client always returns a non-nil bundle, so this is unreachable there. The remote engine-API client forwards resp.BlobsBundle unvalidated, so an external execution layer that answers engine_getPayload with a null blobsBundle produces a nil-pointer dereference.
It happens inside the goroutine that builds the execution payload, so it is not recovered: the panic takes the process down rather than failing the one proposal.
Reported by @yperbasis while reviewing #23274, recorded separately as it predates that change.
produceBeaconBodydereferences the blobs bundle without checking it, immediately after a successful payload collection:The in-process execution client always returns a non-nil bundle, so this is unreachable there. The remote engine-API client forwards
resp.BlobsBundleunvalidated, so an external execution layer that answersengine_getPayloadwith a nullblobsBundleproduces a nil-pointer dereference.It happens inside the goroutine that builds the execution payload, so it is not recovered: the panic takes the process down rather than failing the one proposal.
Reported by @yperbasis while reviewing #23274, recorded separately as it predates that change.