Marketplace checklist omits validator-to-Coffer credential binding

The marketplace README's bond-assessment checklist tells a buyer to read the stake from the beacon chain, but it does not say to derive the validator public key from the Coffer and confirm that the validator's withdrawal credentials point back to that Coffer.

The core README makes this the holder's first duty because CofferFactory.createCoffer accepts any public key and the contracts cannot read beacon state. If a buyer reads another validator's stake, or relies on a deposit event for a key that has not yet registered, that stake may never reach the Coffer and its exit requests may be ignored.

Secondary-market buyers following only the marketplace checklist can therefore price a bond as stake-backed when the named validator is not bound to its Coffer.

Make credential binding the first marketplace assessment step. Buyers should read iPublicKeyPart1() and iPublicKeyPart2() from the Coffer, find that validator in beacon state, and verify 0x01 or 0x02 withdrawal credentials whose address equals the Coffer address.

State that an unregistered public key cannot pass this check and that deposit events are not proof of registered withdrawal credentials. Repeat the requirement in the marketplace's default and impairment guidance, before asking buyers to evaluate stake or coverage.

Fixed. Commit 9383984 makes validator-to-Coffer credential binding the first marketplace assessment step. It explains how to reconstruct the withdrawal credential, rejects unregistered and 0x00 credentials, and states that a deposit event is not proof of binding.

Source: the corrected final report dated 22 October 2026. Final status and residual conditions are preserved in this write-up. Read the full report.