eth/eventhandler: classify remote-signer share decryption errors as malformed

[iurii-ssv]

Summary

A validator share that the signer cannot decrypt should be treated as a malformed registry event (logged and skipped), exactly as the local key manager already does. In remote-signing mode it wasn't: ssvsigner declared ShareDecryptionError as an interface alias of error, so the value the client returned on an HTTP 422 kept its underlying *errors.errorString dynamic type, and the event handler's errors.As(err, &ekm.ShareDecryptionError{}) (a struct type) never matched. A share that failed to decrypt was therefore handled as a non-malformed error instead of a skippable malformed event, inconsistently with local signing.

Change

• Consolidate the two identically-named ShareDecryptionError types into a single concrete struct in the ssvsigner package, used by the client, both key managers, and the event handler, so decryption failures are classified consistently across local and remote signing modes.
• Reserve HTTP 422 from the add-validator endpoint for shares that cannot be decrypted/validated: a random-password-generation failure now returns 500 (a transient, retryable error) rather than 422, so it is not misclassified as a malformed share.

Tests

• Replace the ShareDecryptionError errors.As assertions that passed for any error (the type was an interface) with ones that distinguish a decryption error from other failures.
• Add coverage for the remote client → AddShare path.

Compatibility

The classification fix is node-side and works with any ssv-signer version (it relies only on the existing HTTP 422 contract). The server-side 422 tightening is independent and degrades gracefully, so nodes and ssv-signer can still be upgraded independently.

[greptile-apps]

Greptile Summary

The PR consolidates share-decryption failures into a concrete error type so local and remote key managers classify malformed validator events consistently.

• Maps signer HTTP 422 responses to the concrete ShareDecryptionError.
• Reserves HTTP 422 for malformed shares and returns HTTP 500 for password generation, internal keystore, and Web3Signer failures.
• Adds event-handler, client, and remote-key-manager coverage for the classification contract.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
ssvsigner/server.go	Narrows HTTP 422 to malformed-share failures and maps internal keystore and downstream Web3Signer failures to retryable HTTP 500 responses.
ssvsigner/client.go	Converts add-validator HTTP 422 responses into the concrete share-decryption error while leaving other statuses on the ordinary error path.
ssvsigner/types.go	Replaces the error-interface alias with a concrete wrapping error that supports precise errors.As classification.
eth/eventhandler/handlers.go	Recognizes the shared concrete decryption error and converts it into a skippable malformed-event result.
ssvsigner/ekm/local_key_manager.go	Uses the shared signer-package error type for local share decryption and validation failures.
ssvsigner/ekm/remote_key_manager.go	Preserves the concrete decryption error through wrapping so the event handler can classify remote-signer failures correctly.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    E[ValidatorAdded event] --> N[SSV node]
    N --> S[ssv-signer add-validator endpoint]
    S --> V{Share decrypts and validates?}
    V -->|No| U[HTTP 422]
    U --> D[ShareDecryptionError]
    D --> M[Malformed event: log and skip]
    V -->|Yes| W[Import into Web3Signer]
    W --> I{Internal or downstream failure?}
    I -->|Yes| F[HTTP 500]
    F --> R[Retryable event-handler error]
    I -->|No| O[Share registered]

Loading

_{Reviews (3): Last reviewed commit: "ssvsigner: tighten 422 usage and error h..." | Re-trigger Greptile}

[codecov]

Codecov Report

❌ Patch coverage is 47.36842% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.3%. Comparing base (f8dd2c6) to head (cf9c513).

Files with missing lines	Patch %	Lines
ssvsigner/server.go	28.5%	4 Missing and 1 partial ⚠️
ssvsigner/ekm/local_key_manager.go	0.0%	3 Missing ⚠️
ssvsigner/types.go	66.6%	1 Missing and 1 partial ⚠️

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[iurii-ssv]

@greptile pls re-review

[iurii-ssv]

@greptile pls re-review