[petarjuki7]

Problem, Evidence, and Context

• Message validation adds an entry to its per-duty state for every signer listed in a message before it checks the signatures. Nothing checks that those signers belong to the committee.
• A connected peer can list made-up operator ids and grow that state without valid signatures. On active committees these entries are not cleaned up.
• go-ssv rejects such messages with ErrSignerNotInCommittee. Anchor already has SignerNotInCommittee but never returned it.
• Reported through the security email. Affects v1.3.2.

Change Overview

• Reject any message whose signers are not all in the committee, with SignerNotInCommittee (Reject), before signers are added to the duty state. This covers consensus and partial-signature messages.

Risks, Trade-offs, and Mitigations

• Honest messages are only signed by committee members, so they are not affected.
• Peers sending such messages are now penalised (Reject), the same as go-ssv.

Validation

• New test: a message signed by an operator outside the committee is rejected with SignerNotInCommittee and leaves the duty state empty. Without the fix it fails on both checks.
• make cargo-fmt-check, make lint, make test pass.

Rollback

• Revert this PR.

[dknopik]

LGTM 😅

[mergify]

Queued — the merge queue status continues in this comment ↓.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.21%. Comparing base (6817d74) to head (b718f71).
⚠️ Report is 10 commits behind head on epbs.

Additional details and impacted files

@@            Coverage Diff             @@
##             epbs    #1351      +/-   ##
==========================================
+ Coverage   80.88%   81.21%   +0.32%     
==========================================
  Files         179      180       +1     
  Lines       41247    41831     +584     
==========================================
+ Hits        33364    33973     +609     
+ Misses       7883     7858      -25     

Flag	Coverage Δ
rust	81.21% <100.00%> (+0.32%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-22 12:26 UTC · Rule: default · triggered by @petarjuki7 with the merge queue checkbox
• ✅ Checks passed · on draft merge queue: checking #1351 on epbs (ae53021) #1352
• ✅ Merged — 2026-10-22 12:55 UTC · at 8bfd72be5ef700c23a4ddf1d82d605d0ae9a4042 · squash

This pull request spent 29 minutes 43 seconds in the queue, including 27 minutes 20 seconds running CI.

Required conditions to merge

• check-success=cli-reference-check
• check-success=run-local-testnet
• check-success=test-suite-success