Integrate optional proof spec refactor

Makefile

@@ -334,10 +334,12 @@ install-audit:
 	cargo install --force cargo-audit
 
 audit-CI:
-	# RUSTSEC-2026-0098/0099: rustls-webpki 0.102.x (pulled via warp 0.3 → rustls 0.22)
-	# has no fix on that line; upgrading requires a warp major bump. The 0.103.x usage
-	# has been bumped to 0.103.12 which contains the fix.
-	cargo audit --ignore RUSTSEC-2026-0049 --ignore RUSTSEC-2026-0098 --ignore RUSTSEC-2026-0099
+	# RUSTSEC-2026-0098/0099/0104: rustls-webpki 0.102.x is pulled via
+	# warp 0.3 -> rustls 0.22; fixing that line requires a warp major bump.
+	# The 0.103.x usage is bumped to 0.103.13, which contains the 0104 fix.
+	# RUSTSEC-2026-0118/0119: hickory-proto 0.25.x is pulled via
+	# libp2p 0.56 -> libp2p-dns 0.44; fixing requires a libp2p/hickory upgrade.
+	cargo audit --ignore RUSTSEC-2026-0049 --ignore RUSTSEC-2026-0098 --ignore RUSTSEC-2026-0099 --ignore RUSTSEC-2026-0104 --ignore RUSTSEC-2026-0118 --ignore RUSTSEC-2026-0119
 
 # Runs cargo deny (check for banned crates, duplicate versions, and source restrictions)
 deny: install-deny deny-CI

beacon_node/Cargo.toml

@@ -38,6 +38,7 @@ store = { workspace = true }
 strum = { workspace = true }
 task_executor = { workspace = true }
 tracing = { workspace = true }
+typenum = { workspace = true }
 types = { workspace = true }
 
 [dev-dependencies]

beacon_node/beacon_chain/src/beacon_chain.rs

@@ -35,7 +35,6 @@ use crate::fetch_blobs::EngineGetBlobsOutput;
 use crate::fork_choice_signal::{ForkChoiceSignalRx, ForkChoiceSignalTx, ForkChoiceWaitResult};
 use crate::graffiti_calculator::{GraffitiCalculator, GraffitiSettings};
 use crate::internal_events::InternalBeaconNodeEvent;
-use crate::invalid_proof_tracker::{InvalidProofRecord, InvalidProofTracker};
 use crate::kzg_utils::reconstruct_blobs;
 use crate::light_client_finality_update_verification::{
     Error as LightClientFinalityUpdateError, VerifiedLightClientFinalityUpdate,
@@ -437,8 +436,6 @@ pub struct BeaconChain<T: BeaconChainTypes> {
         Mutex<ObservedOperations<SignedBlsToExecutionChange, T::EthSpec>>,
     /// Deduplication cache for execution proofs.
     pub observed_execution_proofs: RwLock<ObservedExecutionProofs>,
-    /// Persistent tracker of validators that signed invalid execution proofs.
-    pub invalid_proof_tracker: RwLock<InvalidProofTracker>,
     /// Interfaces with the execution client.
     pub execution_layer: Option<ExecutionLayer<T::EthSpec>>,
     /// Stores information about the canonical head and finalized/justified checkpoints of the
@@ -690,14 +687,6 @@ impl<T: BeaconChainTypes> BeaconChain<T> {
         Ok(())
     }
 
-    /// Persists the custody information to disk.
-    pub fn persist_invalid_proof_tracker(&self) -> Result<(), Error> {
-        self.invalid_proof_tracker
-            .read()
-            .persist_to_store(&self.store)
-            .map_err(Error::DBError)
-    }
-
     pub fn persist_custody_context(&self) -> Result<(), Error> {
         if !self.spec.is_peer_das_scheduled() {
             return Ok(());
@@ -7601,7 +7590,7 @@ impl<T: BeaconChainTypes> BeaconChain<T> {
             .observe_verification_attempt(
                 signed_proof.request_root(),
                 signed_proof.message.proof_type,
-                validator_pubkey,
+                signed_proof.validator_index,
             );
 
         // Step 2: ProofEngine verification
@@ -7687,15 +7676,10 @@ impl<T: BeaconChainTypes> BeaconChain<T> {
             return Ok((verification_result, Some((block_root, slot))));
         }
 
-        // Ban the validator if the proof engine explicitly rejected the proof.
         if verification_result == ProofStatus::Invalid {
-            self.invalid_proof_tracker
+            self.observed_execution_proofs
                 .write()
-                .record_invalid_proof(InvalidProofRecord {
-                    validator_pubkey,
-                    request_root: signed_proof.request_root(),
-                    proof_type: signed_proof.message.proof_type,
-                });
+                .observe_invalid_proof(signed_proof.message.proof_type, signed_proof.proof_data());
         }
 
         Ok((verification_result, None))
@@ -7709,7 +7693,7 @@ impl<T: BeaconChainTypes> Drop for BeaconChain<T> {
             self.persist_op_pool()?;
             self.persist_custody_context()?;
             self.persist_proof_engine()?;
-            self.persist_invalid_proof_tracker()
+            Ok(())
         };
 
         if let Err(e) = drop() {

beacon_node/beacon_chain/src/builder.rs

@@ -9,7 +9,6 @@ use crate::data_availability_checker::DataAvailabilityChecker;
 use crate::fork_choice_signal::ForkChoiceSignalTx;
 use crate::fork_revert::{reset_fork_choice_to_finalization, revert_to_fork_boundary};
 use crate::graffiti_calculator::{GraffitiCalculator, GraffitiOrigin};
-use crate::invalid_proof_tracker::InvalidProofTracker;
 use crate::kzg_utils::build_data_column_sidecars;
 use crate::light_client_server_cache::LightClientServerCache;
 use crate::migrate::{BackgroundMigrator, MigratorConfig};
@@ -1051,9 +1050,6 @@ where
             observed_attester_slashings: <_>::default(),
             observed_bls_to_execution_changes: <_>::default(),
             observed_execution_proofs: <_>::default(),
-            invalid_proof_tracker: parking_lot::RwLock::new(InvalidProofTracker::load_from_store(
-                &store,
-            )),
             execution_layer: self.execution_layer.clone(),
             genesis_validators_root,
             genesis_time,

beacon_node/beacon_chain/src/events.rs

@@ -1,6 +1,4 @@
-pub use eth2::types::{
-    EventKind, SseBlock, SseExecutionProofValidated, SseFinalizedCheckpoint, SseHead,
-};
+pub use eth2::types::{EventKind, SseBlock, SseFinalizedCheckpoint, SseHead};
 use tokio::sync::broadcast;
 use tokio::sync::broadcast::{Receiver, Sender, error::SendError};
 use tracing::trace;
@@ -28,7 +26,6 @@ pub struct ServerSentEventHandler<E: EthSpec> {
     attester_slashing_tx: Sender<EventKind<E>>,
     bls_to_execution_change_tx: Sender<EventKind<E>>,
     block_gossip_tx: Sender<EventKind<E>>,
-    execution_proof_validated_tx: Sender<EventKind<E>>,
 }
 
 impl<E: EthSpec> ServerSentEventHandler<E> {
@@ -56,7 +53,6 @@ impl<E: EthSpec> ServerSentEventHandler<E> {
         let (attester_slashing_tx, _) = broadcast::channel(capacity);
         let (bls_to_execution_change_tx, _) = broadcast::channel(capacity);
         let (block_gossip_tx, _) = broadcast::channel(capacity);
-        let (execution_proof_validated_tx, _) = broadcast::channel(capacity);
 
         Self {
             attestation_tx,
@@ -78,7 +74,6 @@ impl<E: EthSpec> ServerSentEventHandler<E> {
             attester_slashing_tx,
             bls_to_execution_change_tx,
             block_gossip_tx,
-            execution_proof_validated_tx,
         }
     }
 
@@ -167,10 +162,6 @@ impl<E: EthSpec> ServerSentEventHandler<E> {
                 .block_gossip_tx
                 .send(kind)
                 .map(|count| log_count("block gossip", count)),
-            EventKind::ExecutionProofValidated(_) => self
-                .execution_proof_validated_tx
-                .send(kind)
-                .map(|count| log_count("execution proof validated", count)),
         };
         if let Err(SendError(event)) = result {
             trace!(?event, "No receivers registered to listen for event");
@@ -320,12 +311,4 @@ impl<E: EthSpec> ServerSentEventHandler<E> {
     pub fn has_block_gossip_subscribers(&self) -> bool {
         self.block_gossip_tx.receiver_count() > 0
     }
-
-    pub fn subscribe_execution_proof_validated(&self) -> Receiver<EventKind<E>> {
-        self.execution_proof_validated_tx.subscribe()
-    }
-
-    pub fn has_execution_proof_validated_subscribers(&self) -> bool {
-        self.execution_proof_validated_tx.receiver_count() > 0
-    }
 }