temp

[pankajjagtapp]

Scratch PR for reviewing a diff. Not for merge. Based on
pankaj/feat/non-eigenpod-withdrawal-credentials rather than master, so the
diff is only the three new commits instead of all of #485.

Addresses the review conclusion on #485: "link them all, gate that function via
multisig, and make the change to the consolidation function."

Commits

SHA	What
6ffd3d1c	test: pin that a live pod constrains the consolidation target
5daa413f	feat(enm): require consolidation targets to be EtherFi-owned
80421985	feat(enm): gate linkLegacyValidatorIds behind the operating multisig

Why the target guard exists

EIP-7251's process_consolidation_request requires only that the target hold
0x02 credentials. There is no source/target same-address rule — the only
withdrawal_credentials[12:] check in the spec is against source_address.
A pod vets the target only when the pod is the caller, so a pod-less node
calling the predeploy directly had no target constraint at all.

test_livePod_rejectsAForeignConsolidationTarget records the pre-existing
control on the pod-backed path: mainnet's EigenPod reverts
ValidatorNotActiveInPod on an unproven target. That is what pod-less nodes
were missing.

The guard

Three grounds to accept, deny otherwise:

• src == target — a switch to compounding, moves no value
• linked in etherFiNodeFromPubkeyHash — one of ours
• ACTIVE in the source's own pod — EigenLayer merkle-verified the credentials

Cross-credential consolidation still works, which is the point of the feature:
a target on another node passes the second branch. ACTIVE rather than
!= INACTIVE because WITHDRAWN passes the looser check and the consensus
layer drops a withdrawn target, burning the fee and logging a consolidation
that never happens.

The role gate

The guard trusts etherFiNodeFromPubkeyHash, and linkLegacyValidatorIds
writes that map while verifying nothing about the pair. On the same role as
requestConsolidation, one key could link a validator it owned and then
consolidate into it. Now onlyOperatingMultisig (4-of-7), matching
setProofSubmitter. The power to grow the trusted set is separate from the
power to use it.

test_linkLegacyValidatorIds asserts that directly: an address holding only
EXECUTOR_OPERATIONS_ROLE is rejected.

Deployment order

The ~23k legacy backfill must run before this ships, or every one of ~73
batches needs a 4-of-7 signature. Ops runbook and workflow live in
protocol-ops.

Verification

Full suite 1679/1684. The 5 failures are pre-existing and environmental (a
NotRegistered setUp and 6 suites needing OP_RPC_URL), reproduced with these
changes reverted.

Known limit

The registry branch is trusted bookkeeping, not proof. The backfill's beacon
verification closes that for the legacy set and the pod-ACTIVE branch is
cryptographic, but a future mislink by the Safe would still be accepted. A
Lido-style beacon proof of the target's credentials is the full fix, as a
follow-up.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Note

High Risk
Changes staking consolidation authorization and who can populate the pubkey registry—both directly affect where validator ETH can be directed.

Overview
Closes a consolidation theft vector on pod-less nodes: EIP-7251 only checks that the target has 0x02 credentials, so requestConsolidation now always validates each target before forwarding. Allowed targets are switch-to-compounding (src == target), any pubkey in etherFiNodeFromPubkeyHash, or an ACTIVE validator in the source pod (not merely non-INACTIVE, to avoid withdrawn targets). Anything else reverts with UnknownConsolidationTarget.

linkLegacyValidatorIds is moved from executor ops to onlyOperatingMultisig, so the role that can extend the trusted pubkey map cannot also submit consolidations that rely on it. Tests and fixtures are updated for the new role split and for rejecting foreign consolidation targets on both pod-less and live-pod paths.

^{Reviewed by Cursor Bugbot for commit 8042198. Bugbot is set up for automated code reviews on this repo. Configure here.}