fix(db): validate block signatures against committed state

framework/src/main/java/org/tron/core/db/Manager.java

@@ -1228,7 +1228,8 @@ public List<TransactionCapsule> getVerifyTxs(BlockCapsule block) {
 
   /**
    * Save a block. Untrusted callers must first use network prevalidation to check its timestamp,
-   * transaction structure, Merkle root and block signature.
+   * transaction structure and Merkle root. Check witness signatures before broadcast as well.
+   * Received block witness authorization is checked against committed state before admission.
    */
   public void pushBlock(final BlockCapsule block)
       throws ValidateSignatureException, ContractValidateException, ContractExeException,
@@ -1261,18 +1262,24 @@ public void pushBlock(final BlockCapsule block)
                 block.getNum(), rePushTransactions.size(), pendingTransactions.size(),
                 block.getTransactions().size(), txs.size());
 
-        if (CommonParameter.getInstance().getShutdownBlockTime() != null
-                && CommonParameter.getInstance().getShutdownBlockTime()
-                .isSatisfiedBy(new Date(block.getTimeStamp()))) {
-          latestSolidityNumShutDown = block.getNum();
-        }
-
         try (PendingManager pm = new PendingManager(this)) {
 
           if (!block.generatedByMyself) {
+            // Pending changes have been reset; use committed witness permissions for admission.
+            // switchFork also verifies admitted fork blocks against their own parent state.
+            if (!block.validateSignature(getDynamicPropertiesStore(), getAccountStore())) {
+              throw new ValidateSignatureException(
+                  "block " + block.getNum() + " signature invalid");
+            }
             consensus.receiveBlock(block);
           }
 
+          if (CommonParameter.getInstance().getShutdownBlockTime() != null
+                  && CommonParameter.getInstance().getShutdownBlockTime()
+                  .isSatisfiedBy(new Date(block.getTimeStamp()))) {
+            latestSolidityNumShutDown = block.getNum();
+          }
+
           if (block.getTransactions().stream()
                   .filter(tran -> isShieldedTransaction(tran.getInstance()))
                   .count() > SHIELDED_TRANS_IN_BLOCK_COUNTS) {

framework/src/main/java/org/tron/core/net/TronNetDelegate.java

@@ -353,6 +353,10 @@ public void validSignature(BlockCapsule block) throws P2pException {
     }
   }
 
+  /**
+   * Validate block structure and Merkle root. Advertisement also checks witness authorization;
+   * sync defers it to Manager, which checks committed state and revalidates forks after rewind.
+   */
   public void validBlock(BlockCapsule block) throws P2pException {
     for (Transaction transaction : block.getInstance().getTransactionsList()) {
       int contractCount = transaction.getRawData().getContractCount();
@@ -373,7 +377,6 @@ public void validBlock(BlockCapsule block) throws P2pException {
     } catch (BadBlockException e) {
       throw new P2pException(TypeEnum.BLOCK_MERKLE_INVALID, e.getMessage());
     }
-    validSignature(block);
   }
 
   public boolean validAdvBlock(PeerConnection peer, BlockCapsule block) throws P2pException {
@@ -391,6 +394,7 @@ public boolean validAdvBlock(PeerConnection peer, BlockCapsule block) throws P2p
       }
     }
     validBlock(block);
+    validSignature(block);
     return activeWitness;
   }