fix(blockchain): source attestations from the head state's justified

MegaRedHand · MegaRedHand · commit 0078a10aabd7 · 2026-06-18T18:47:01.000-03:00
Validators sourced their vote's `source` checkpoint from the store's global `latest_justified`, which is a highest-slot-wins maximum. When a minority fork justifies a slot the head chain never saw, that maximum latches onto an off-head sibling. Voting with an off-chain source makes every head-chain target fail `is_valid_vote` (the target no longer descends from the source), so the head can never re-justify and block production stalls. Source from the head state's `latest_justified` instead, which always lies on the head's own chain. The target walk-back is fed the same head-state justified so the emitted source and target stay mutually consistent. The store's `latest_justified` is left untouched; only vote production changes. `get_attestation_target` (used by the forkchoice spec-test harness) keeps reading the store checkpoints, so spec behavior is unchanged. This mirrors the head-state-driven treatment finalized already received in #437, but applied to vote production rather than the stored checkpoint. It is a deliberate divergence from leanSpec, which sources from `store.latest_justified` (leanSpec PR #595). Claude-Session: https://claude.ai/code/session_01783X9yFrkXfA7uY1cyL8E4
diff --git a/crates/blockchain/src/store.rs b/crates/blockchain/src/store.rs
@@ -697,15 +697,26 @@ pub fn get_attestation_target_with_checkpoints(
 
 /// Produce attestation data for the given slot.
 ///
-/// The source comes from the store's global `latest_justified` checkpoint.
-/// When the store's justified has advanced past the head state (a minority
-/// fork justified a slot the head chain hasn't seen yet), the next block
-/// produced on the head chain is expected to close the gap via the
-/// fixed-point attestation loop in `build_block`.
+/// The source is the **head state's** latest justified checkpoint, which always
+/// lies on the head's own chain. This deliberately diverges from leanSpec, which
+/// sources from the store's global `latest_justified` (see
+/// <https://github.com/leanEthereum/leanSpec/pull/595>).
 ///
-/// See: <https://github.com/leanEthereum/leanSpec/pull/595>
+/// The store's justified is a highest-slot-wins maximum that can latch onto an
+/// off-head sibling justified by a minority fork. Voting with such an off-chain
+/// source makes every head-chain target fail `is_valid_vote` (the target no
+/// longer descends from the source), so the head can never re-justify and block
+/// production stalls. Sourcing from the head state keeps the source and target
+/// on the same chain, letting justification advance again.
+///
+/// The target walk-back is fed the same head-state justified so its clamp guard
+/// stays consistent with the source we emit.
 pub fn produce_attestation_data(store: &Store, slot: u64) -> AttestationData {
     let head_root = store.head();
+    let source = store
+        .get_state(&head_root)
+        .expect("head state exists")
+        .latest_justified;
 
     let head_checkpoint = Checkpoint {
         root: head_root,
@@ -715,13 +726,14 @@ pub fn produce_attestation_data(store: &Store, slot: u64) -> AttestationData {
             .slot,
     };
 
-    let target_checkpoint = get_attestation_target(store);
+    let target_checkpoint =
+        get_attestation_target_with_checkpoints(store, source, store.latest_finalized());
 
     AttestationData {
         slot,
         head: head_checkpoint,
         target: target_checkpoint,
-        source: store.latest_justified(),
+        source,
     }
 }
 
@@ -1206,6 +1218,50 @@ mod tests {
         Store::from_anchor_state(backend, genesis_state)
     }
 
+    /// The produced attestation source must track the head state's justified
+    /// checkpoint, not the store's global `latest_justified`. When the store's
+    /// justified has latched onto a higher, off-head sibling (a minority fork),
+    /// sourcing from it would put the vote's source off the head chain and stall
+    /// re-justification; sourcing from the head state keeps it on-chain.
+    #[test]
+    fn produce_attestation_data_sources_from_head_state_not_store() {
+        let mut store = new_test_store();
+        let genesis = store.head();
+
+        // Head chain: genesis(0) <- a(1) <- b(2), with `b` as head.
+        let a = H256([1u8; 32]);
+        let b = H256([2u8; 32]);
+        insert_test_block(&mut store, a, 1, genesis);
+        insert_test_block(&mut store, b, 2, a);
+
+        // Head state justified `a` (slot 1), which lies on the head's chain.
+        let head_justified = Checkpoint { root: a, slot: 1 };
+        let mut head_state = State::from_genesis(1000, vec![]);
+        head_state.latest_justified = head_justified;
+        store.insert_state(b, head_state);
+
+        // Store's global justified latched onto a higher, off-head checkpoint,
+        // as it would after a minority fork justified a slot the head never saw.
+        let off_head_justified = Checkpoint {
+            root: H256([9u8; 32]),
+            slot: 5,
+        };
+        store.update_checkpoints(ForkCheckpoints::new(b, Some(off_head_justified), None));
+        store.set_time(2 * INTERVALS_PER_SLOT);
+
+        let data = produce_attestation_data(&store, 2);
+
+        assert_eq!(
+            data.source, head_justified,
+            "source should follow the head state's justified checkpoint"
+        );
+        assert_ne!(
+            data.source,
+            store.latest_justified(),
+            "source must not be the store's off-head global justified"
+        );
+    }
+
     /// leanSpec #833: a vote whose head sits on a sibling fork of the target
     /// must be rejected by gossip validation, even though every slot and
     /// availability check passes.
