Skip to content

BYO-BLS End-to-End Validation Report (Chain 286)

Environment

Property Value
Date (UTC) 2026-03-21
Network Centurion disposable mainnet
Chain ID 286 (0x11e)
Fork Fulu at genesis
Genesis validators 3 (indices 0, 1, 2)
DepositContractCTN 0x1cf70D9361DA31eE571625C2fA732614CcE5f011
EIP-7002 System Contract 0x00000961Ef480Eb55e80D19ad83579A64c007002
Contract Owner 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266
Seat Manager commit ffd9cde

Test Subject

Property Value
Seat ID 517
Operator byo-bls-e2e
Validator Index 3
Pubkey 0xaa74a83f10ea5fba2e0a2c1fc7c080180e01e857573b84200c3b238cb4028fa2a98e48b53c2d0218aadcfd69f6c5d1aa
Vault Address 0x412a91402f3d3baee3612d5b5d0ba43542b7adf9
Beneficiary 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266
Principal 32 CTN

What This Test Proves

This is a full BYO-BLS (Bring Your Own BLS) lifecycle test — the external operator model where the foundation never touches the operator's BLS signing key. The test exercises every step from seat creation through EIP-7002 force-exit, proving:

  1. Key separation: Foundation creates vault and seat without BLS key material
  2. Deposit data validation: Operator-submitted deposit data is validated (pubkey, withdrawal credentials, amount)
  3. On-chain allowlist: Intent hash consumed correctly on deposit
  4. Validator activation: CL picks up the new validator and it goes active_ongoing
  5. Force-exit without BLS key: EIP-7002 exit triggered via vault contract — no BLS signing key needed

Lifecycle Steps

Step 1: Create Seat with Vault

seat create-with-vault --operator byo-bls-e2e \
  --pubkey 0xaa74a83f10ea5fba2e0a2c1fc7c080180e01e857573b84200c3b238cb4028fa2a98e48b53c2d0218aadcfd69f6c5d1aa \
  --beneficiary 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266
  • Vault deployed at 0x412a91402f3d3baee3612d5b5d0ba43542b7adf9
  • Withdrawal credentials derived from vault address: 0x010000000000000000000000412a91402f3d3baee3612d5b5d0ba43542b7adf9
  • 7-property post-deploy verification passed (beneficiary, treasury, principal, phase, exitRequestContract, withdrawalCredentials, code)
  • Seat 517 created with status CREATED

Step 2: Operator Submits Deposit Data

POST /v1/seats/517/deposit-data
  • Operator generated deposit data externally (using their own BLS key, never shared)
  • Deposit data signed over the vault's withdrawal credentials
  • Server validated: pubkey match, withdrawal credentials match, amount = 32 CTN
  • Foundation never touched the BLS signing key

Step 3: Approve (Allowlist)

seat approve 517 --send
  • addAllowedDeposit(intentHash) sent to DepositContractCTN
  • Intent hash: keccak256(pubkey || wc) registered on-chain
  • Seat status: CREATED -> ALLOWLISTED

Step 4: Deposit 32 CTN

seat deposit 517 --amount-ctn 32 --send
  • deposit(pubkey, wc, signature, depositDataRoot) called with 32 CTN value
  • Intent consumed on-chain (one-use allowlist entry)
  • Seat status: ALLOWLISTED -> DEPOSITED

Step 5: Watcher Detects Deposit

  • EL watcher detected DepositEvent log from deposit contract
  • CL watcher observed validator appearing on beacon chain
  • Seat status: DEPOSITED -> SEEN_BY_CL

Step 6: Validator Activation

  • Validator 3 entered activation queue
  • Activated at epoch 11, status: active_ongoing
  • CL watcher confirmed from 2 distinct endpoint labels (local-dev + gcp-a1)
  • Seat status: SEEN_BY_CL -> ACTIVE

Step 7: EIP-7002 Force-Exit (Kill Switch)

seat force-exit 517 --send
  • Vault's triggerValidatorExit() called by treasury (owner)
  • Sends pubkey to EIP-7002 system contract at 0x00000961Ef480Eb55e80D19ad83579A64c007002
  • No BLS signing key required — exit triggered purely from execution layer

Force-exit transaction

Tx hash: 0x0674ec01ea195834be7f39923e3afebbf3856f9b834d7411c1ae550dbfcd19bc

Exit request confirmed on beacon chain

Beacon block at slot 385 contains the withdrawal request in execution_requests.withdrawals.

Exit Deferral: SHARD_COMMITTEE_PERIOD

The validator's exit is deferred due to SHARD_COMMITTEE_PERIOD = 256 epochs. A validator must be active for at least 256 epochs before the beacon chain processes its exit.

Property Value
Activation epoch 11
Earliest exit epoch 267 (= 11 + 256)
Estimated processing ~27 hours after activation

Once the exit processes at epoch 267, the validator will transition through active_exiting -> exited_unslashed -> withdrawal_done, and the settlement phase can begin.

Pending: Settlement E2E

After the validator exits and its balance is swept to the vault:

Step Command Status
Start exit settlement seat settle 517 --send Pending (epoch 267+)
Treasury claims principal claimPrincipal(32 CTN) Pending
Beneficiary claims rewards claimRewards(excess) Pending
Conservation law check balance + principalClaimed + rewardsClaimed == totalLifetime Pending

This section will be updated once the exit processes and settlement completes.

State Machine Evidence

CREATED ──approve──> ALLOWLISTED ──deposit──> DEPOSITED ──watcher──> SEEN_BY_CL ──2-label CL──> ACTIVE ──force-exit──> (exit pending)

stateDiagram-v2
    [*] --> CREATED : create-with-vault
    CREATED --> ALLOWLISTED : approve (tx on-chain)
    ALLOWLISTED --> DEPOSITED : deposit 32 CTN
    DEPOSITED --> SEEN_BY_CL : EL+CL watcher
    SEEN_BY_CL --> ACTIVE : 2-label CL confirmation
    ACTIVE --> EXIT_PENDING : force-exit (EIP-7002)
    EXIT_PENDING --> EXITED : epoch 267+ (pending)
    EXITED --> SETTLED : settlement (pending)

Key Takeaways

  1. BYO-BLS works end-to-end: External operator keeps full custody of BLS key. Foundation never generates, stores, or touches it.
  2. EIP-7002 kill switch works: Treasury can force-exit any validator without the operator's BLS key — critical safety property for the allowlist model.
  3. Deposit data validation is sound: Server correctly validates operator-submitted deposit data against seat metadata (pubkey, vault WC, amount).
  4. Two-label CL observation prevents false ACTIVE: Seat only transitions to ACTIVE when confirmed by 2+ independent CL endpoints, preventing single-source false positives.
  5. SHARD_COMMITTEE_PERIOD is load-bearing: Validators cannot be exited in the same epoch they activate. The 256-epoch minimum active period is a consensus-layer safety property that the seat manager must account for in operational planning.

Conclusion

PASS — The BYO-BLS onboarding pipeline and EIP-7002 force-exit are validated on a live chain. Settlement e2e will complete once the exit processes at epoch 267.