Validate and canonicalize mux validator pubkeys

[pucedoteth]

The mux map is keyed on the raw validator_pubkeys strings from the config file, and getHeader looks a validator up with the raw pubkey segment from the request URL:

// server/service.go
pubkey = vars["pubkey"]
...
if mux, ok := m.muxMap[pubkey]; ok {

Neither side is validated or normalized, so two operator mistakes silently disable a mux instead of failing:

1. A malformed pubkey is accepted at startup — truncated, mistyped, missing the 0x prefix, or even the empty string. It can never match a request.
2. A correctly formed pubkey in a different case never matches — hex is case-insensitive, Go map keys are not.

In both cases mev-boost starts cleanly, reports the mux as loaded, and then quietly serves that validator from the default relay set. Nothing logs a warning. For a mux configured to restrict a validator to a specific relay set, that is a silent routing change.

The same raw comparison also defeats the duplicate check that already exists: the same pubkey listed in two muxes in different cases is not caught by ErrDuplicateValidatorPubkey, and silently lands in whichever entry is processed last.

Relay pubkeys already go through utils.HexToPubkey in types.NewRelayEntry — only the mux path skips validation.

Change

• ValidateMuxEntries validates the encoding and stores the lowercased key.
• GetConfigForValidator folds the case of the lookup key.

The check is syntactic (0x-prefixed, 48 bytes of hex) rather than a BLS point decompression. These strings are only ever lookup keys, and the getHeader pubkey is not curve-checked either, so requiring a valid curve point would be stricter than the matching logic — and would reject well-formed placeholder keys, including the one in the existing TestParseConfigWithMux fixture. Folding rather than parsing on lookup also keeps this off the getHeader hot path.

Behavior change

This rejects a mux config that was previously accepted: a malformed validator pubkey is now a startup error rather than a mux that never fires. That is the point of the change, but it is a visible difference for anyone currently running a typo, so flagging it explicitly. Happy to downgrade it to a warning-and-skip if you would rather not fail closed on startup.

Test plan

Four new tests, all failing before the change (verified by reverting only config/mux_config.go and server/service.go and keeping the tests):

test	failure without the fix
TestValidateMuxEntriesRejectsMalformedPubkey	malformed validator pubkey "0xdeadbeef" was accepted (also "", not-a-pubkey, over-long)
TestValidateMuxEntriesCanonicalizesPubkeys	mux map is not keyed by the canonical lowercase pubkey
TestValidateMuxEntriesDetectsDuplicateAcrossCase	duplicate not reported
TestGetConfigForValidatorIsCaseInsensitive	expected the mux relay ..., got the default set

go test ./... passes (including the existing TestParseConfigWithMux), plus go test -race on the changed packages, go vet, and gofmt -d -s.

---

🤖 Written with Claude Code. Every result above comes from a local build and test run.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.