Implement weak subjectivity safety checks

beacon_node/beacon_chain/src/builder.rs

@@ -816,6 +816,24 @@ where
             ));
         }
 
+        // Check if the store is within the weak subjectivity period
+        if let Some(ws_checkpoint) = self.chain_config.weak_subjectivity_checkpoint {
+            let Ok(finalized_block) = fork_choice.get_finalized_block() else {
+                panic!("TODO(ws)")
+            };
+            if !store.is_within_weak_subjectivity_period(
+                ws_checkpoint,
+                finalized_block.slot,
+                finalized_block.state_root,
+                head_snapshot
+                    .beacon_state
+                    .slot()
+                    .epoch(E::slots_per_epoch()),
+            ) {
+                panic!("TODO(ws)")
+            }
+        };
+
         let validator_pubkey_cache = self
             .validator_pubkey_cache
             .map(|mut validator_pubkey_cache| {

beacon_node/src/lib.rs

@@ -29,14 +29,9 @@ pub type ProductionClient<E> = Client<
     >,
 >;
 
-/// The beacon node `Client` that will be used in production.
+/// The beacon node `Client` that is used in production.
 ///
 /// Generic over some `EthSpec`.
-///
-/// ## Notes:
-///
-/// Despite being titled `Production...`, this code is not ready for production. The name
-/// demonstrates an intention, not a promise.
 pub struct ProductionBeaconNode<E: EthSpec>(ProductionClient<E>);
 
 impl<E: EthSpec> ProductionBeaconNode<E> {

beacon_node/store/src/hot_cold_store.rs

@@ -2944,6 +2944,35 @@ impl<E: EthSpec, Hot: ItemStore<E>, Cold: ItemStore<E>> HotColdDB<E, Hot, Cold>
 
         Ok(())
     }
+
+    pub fn is_within_weak_subjectivity_period(
+        &self,
+        ws_checkpoint: Checkpoint,
+        fc_slot: Slot,
+        fc_state_root: Hash256,
+        current_epoch: Epoch,
+    ) -> bool {
+        let Ok(Some(finalized_state)) = self.get_state(&fc_state_root, Some(fc_slot), true) else {
+            // we cant get a finalized state from the db, we should force exit here?
+            return true;
+        };
+
+        if finalized_state.latest_block_header().state_root != ws_checkpoint.root {
+            return true;
+        }
+
+        let finalized_epoch = finalized_state.slot().epoch(E::slots_per_epoch());
+
+        if finalized_epoch != ws_checkpoint.epoch {
+            return false;
+        }
+
+        let Ok(ws_period) = finalized_state.compute_weak_subjectivity_period(&self.spec) else {
+            // TODO(ws) failed to calculate ws period, log and continue?
+            return true;
+        };
+        current_epoch <= finalized_epoch + ws_period
+    }
 }
 
 /// Advance the split point of the store, copying new finalized states to the freezer.

consensus/types/src/beacon_state.rs

@@ -2505,6 +2505,30 @@ impl<E: EthSpec> BeaconState<E> {
 
         Ok(())
     }
+
+    /// Returns the weak subjectivity period for `self`. This computation takes into
+    /// account the effect of validator set churn (bounded by `get_balance_churn_limit()` per epoch)
+    ///  A detailed calculation can be found at:
+    /// https://notes.ethereum.org/@CarlBeek/electra_weak_subjectivity
+    pub fn compute_weak_subjectivity_period(&self, spec: &ChainSpec) -> Result<Epoch, Error> {
+        // `SAFETY_DECAY` is defined as the maximum percentage tolerable loss in the one-third
+        // safety margin of FFG finality. Thus, any attack exploiting the Weak Subjectivity Period has
+        // a safety margin of at least `1/3 - SAFETY_DECAY/100`.
+        // Spec: https://github.com/ethereum/consensus-specs/blob/1937aff86b41b5171a9bc3972515986f1bbbf303/specs/phase0/weak-subjectivity.md?plain=1#L50-L71
+        // TODO(ws) move this to config
+        const SAFETY_DECAY: u64 = 10;
+
+        let total_active_balance = self.get_total_active_balance()?;
+        let balance_churn_limit = self.get_balance_churn_limit(spec)?;
+        let epochs_for_validator_set_churn = SAFETY_DECAY
+            .safe_mul(total_active_balance)?
+            .safe_div(balance_churn_limit.safe_mul(200)?)?;
+        let weak_subjectivity_period = spec
+            .min_validator_withdrawability_delay
+            .safe_mul(epochs_for_validator_set_churn)?;
+
+        Ok(weak_subjectivity_period)
+    }
 }
 
 impl<E: EthSpec> BeaconState<E> {