Reject attestations to blocks prior to the split (#7084)

Squashed commit of the following:

commit 0a53a24
Merge: 5c56a83 27aabe8
Author: Michael Sproul <[email protected]>
Date:   Tue Mar 18 16:28:25 2025 +1100

    Merge branch 'release-v7.0.0' into reject-attestations-prior-to-split

commit 5c56a83
Merge: fb9e049 3a555f5
Author: Eitan Seri-Levi <[email protected]>
Date:   Thu Mar 13 00:29:08 2025 -0600

    Merge branch 'release-v7.0.0' into reject-attestations-prior-to-split

commit fb9e049
Merge: f121c4a 9c4fc6e
Author: Eitan Seri-Levi <[email protected]>
Date:   Wed Mar 12 10:35:38 2025 -0600

    Merge branch 'release-v7.0.0' into reject-attestations-prior-to-split

commit f121c4a
Author: Eitan Seri-Levi <[email protected]>
Date:   Tue Mar 11 11:00:40 2025 -0600

    lump into

commit b8d2a8c
Author: Eitan Seri-Levi <[email protected]>
Date:   Tue Mar 11 10:58:46 2025 -0600

    add is descendant to fork-choice

commit 72ef42b
Author: Eitan Seri-Levi <[email protected]>
Date:   Tue Mar 11 10:53:16 2025 -0600

    fix descent from split check

commit 9d2ebf7
Author: Eitan Seri-Levi <[email protected]>
Date:   Tue Mar 11 10:46:00 2025 -0600

    remove unused error variant, lump finalization check into

commit 21478e5
Author: Eitan Seri-Levi <[email protected]>
Date:   Mon Mar 10 15:25:13 2025 -0600

    remove unneeded error variant

commit efaab87
Author: Eitan Seri-Levi <[email protected]>
Date:   Sat Mar 8 11:25:49 2025 -0700

    fix test

commit b911048
Author: Eitan Seri-Levi <[email protected]>
Date:   Wed Mar 5 23:42:46 2025 -0700

    Reject attestations on gossip that attest to blocks prior to the current split point

Author: michaelsproul

beacon_node/beacon_chain/src/attestation_verification.rs

@@ -1128,6 +1128,12 @@ fn verify_head_block_is_known<T: BeaconChainTypes>(
             }
         }
 
+        if !verify_attestation_is_finalized_checkpoint_or_descendant(attestation.data(), chain) {
+            return Err(Error::HeadBlockFinalized {
+                beacon_block_root: attestation.data().beacon_block_root,
+            });
+        }
+
         Ok(block)
     } else if chain.is_pre_finalization_block(attestation.data().beacon_block_root)? {
         Err(Error::HeadBlockFinalized {
@@ -1361,6 +1367,29 @@ pub fn verify_committee_index<E: EthSpec>(attestation: AttestationRef<E>) -> Res
     Ok(())
 }
 
+fn verify_attestation_is_finalized_checkpoint_or_descendant<T: BeaconChainTypes>(
+    attestation_data: &AttestationData,
+    chain: &BeaconChain<T>,
+) -> bool {
+    // If we have a split block newer than finalization then we also ban attestations which are not
+    // descended from that split block. It's important not to try checking `is_descendant` if
+    // finality is ahead of the split and the split block has been pruned, as `is_descendant` will
+    // return `false` in this case.
+    let fork_choice = chain.canonical_head.fork_choice_read_lock();
+    let attestation_block_root = attestation_data.beacon_block_root;
+    let finalized_slot = fork_choice
+        .finalized_checkpoint()
+        .epoch
+        .start_slot(T::EthSpec::slots_per_epoch());
+    let split = chain.store.get_split_info();
+    let is_descendant_from_split_block = split.slot == 0
+        || split.slot <= finalized_slot
+        || fork_choice.is_descendant(split.block_root, attestation_block_root);
+
+    fork_choice.is_finalized_checkpoint_or_descendant(attestation_block_root)
+        && is_descendant_from_split_block
+}
+
 /// Assists in readability.
 type CommitteesPerSlot = u64;