fix(api): fail closed on registerValidator signature verify errors

common/utils.go

@@ -180,7 +180,7 @@ func StrToPhase0Hash(s string) (ret phase0.Hash32, err error) {
 func GetEnvDurationSec(key string, defaultValueSec int) time.Duration {
 	if value, ok := os.LookupEnv(key); ok {
 		val, err := strconv.Atoi(value)
-		if err != nil {
+		if err == nil {
 			return time.Duration(val) * time.Second
 		}
 	}

common/utils_test.go

@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"os"
 	"testing"
+	"time"
 
 	builderApiBellatrix "github.com/attestantio/go-builder-client/api/bellatrix"
 	builderApiCapella "github.com/attestantio/go-builder-client/api/capella"
@@ -191,3 +192,14 @@ func TestGetBlockSubmissionInfo(t *testing.T) {
 		})
 	}
 }
+
+func TestGetEnvDurationSec(t *testing.T) {
+	t.Setenv("TEST_ENV_DURATION_SEC", "7")
+	require.Equal(t, 7*time.Second, GetEnvDurationSec("TEST_ENV_DURATION_SEC", 3))
+
+	t.Setenv("TEST_ENV_DURATION_SEC", "not-an-int")
+	require.Equal(t, 3*time.Second, GetEnvDurationSec("TEST_ENV_DURATION_SEC", 3))
+
+	os.Unsetenv("TEST_ENV_DURATION_SEC")
+	require.Equal(t, 3*time.Second, GetEnvDurationSec("TEST_ENV_DURATION_SEC", 3))
+}

services/api/service.go

@@ -1176,16 +1176,16 @@ func (api *RelayAPI) handleRegisterValidator(w http.ResponseWriter, req *http.Re
 		regLog.Debug("verifying BLS signature...")
 		ok, err := ssz.VerifySignature(signedValidatorRegistration.Message, api.opts.EthNetDetails.DomainBuilder, signedValidatorRegistration.Message.Pubkey[:], signedValidatorRegistration.Signature[:])
 		if err != nil {
-			regLog.WithError(err).Error("error verifying registerValidator signature")
-			break
+			// Previously logged and broke, then still returned HTTP 200.
+			logAndReturnError(regLog, http.StatusBadRequest, "failed to verify validator signature for "+signedValidatorRegistration.Message.Pubkey.String(), err)
+			return
 		} else if !ok {
 			regLog.Info("invalid validator signature")
 			if api.ffRegValContinueOnInvalidSig {
 				continue
-			} else {
-				logAndReturnError(regLog, http.StatusBadRequest, "failed to verify validator signature for "+signedValidatorRegistration.Message.Pubkey.String(), err)
-				break
 			}
+			logAndReturnError(regLog, http.StatusBadRequest, "failed to verify validator signature for "+signedValidatorRegistration.Message.Pubkey.String(), err)
+			return
 		}
 
 		// Now we have a new registration to process (store in DB + Cache)

services/api/service_test.go

@@ -308,6 +308,23 @@ func TestRegisterValidator(t *testing.T) {
 		require.Contains(t, rr.Body.String(), "failed to verify validator signature")
 	})
 
+	t.Run("reject validator -- malformed signature encoding", func(t *testing.T) {
+		backend := newTestBackend(t, 1)
+
+		msg := common.ValidPayloadRegisterValidator
+		// All-0xff is invalid BLS point encoding: VerifySignature returns err
+		// (not just ok=false). Previously this path fell through to HTTP 200.
+		for i := range msg.Signature {
+			msg.Signature[i] = 0xff
+		}
+
+		backend.datastore.SetKnownValidator(common.PubkeyHex(msg.Message.Pubkey.String()), 1)
+
+		rr := backend.request(http.MethodPost, path, []builderApiV1.SignedValidatorRegistration{msg}, nil)
+		require.Equal(t, http.StatusBadRequest, rr.Code)
+		require.Contains(t, rr.Body.String(), "failed to verify validator signature")
+	})
+
 	t.Run("accept validator -- milliseconds dont matter", func(t *testing.T) {
 		backend := newTestBackend(t, 1)