@aztec-labs/ethereum 6.0.0-rc.3 → 6.0.0

package/src/deploy_aztec_l1_contracts.ts

@@ -1,17 +1,30 @@
 import { SlotNumber } from '@aztec-labs/foundation/branded-types';
 import { SecretValue, getActiveNetworkName } from '@aztec-labs/foundation/config';
+import { getEnv } from '@aztec-labs/foundation/config/env';
 import { EthAddress } from '@aztec-labs/foundation/eth-address';
 import { jsonStringify } from '@aztec-labs/foundation/json-rpc';
 import { createLogger } from '@aztec-labs/foundation/log';
 import { promiseWithResolvers } from '@aztec-labs/foundation/promise';
 import type { Fr } from '@aztec-labs/foundation/schemas';
+import { parse as parseToml } from '@iarna/toml';
 import { bn254 } from '@noble/curves/bn254';
 import type { Abi, Narrow } from 'abitype';
-import { spawn } from 'child_process';
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs';
+import { execFileSync, spawn } from 'child_process';
+import {
+  cpSync,
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  statSync,
+  utimesSync,
+  writeFileSync,
+} from 'fs';
 import { createRequire } from 'node:module';
 import { tmpdir } from 'os';
-import { basename, dirname, join, resolve } from 'path';
+import { basename, dirname, isAbsolute, join, resolve } from 'path';
 import readline from 'readline';
 import type { Hex } from 'viem';
 import { mainnet, sepolia } from 'viem/chains';
@@ -32,27 +45,96 @@ const require = createRequire(import.meta.url);
 
 const JSON_DEPLOY_RESULT_PREFIX = 'JSON DEPLOY RESULT:';
 
+/**
+ * Extends a broadcast deadline for a `--slow` broadcast, which waits for each transaction's receipt before sending the
+ * next, so on a chain that mines on an interval it needs at least one block per transaction.
+ */
+export function getSlowBroadcastTimeout(timeout: number | undefined, txCount: number): number | undefined {
+  return timeout === undefined ? undefined : timeout + txCount * SLOW_BROADCAST_ALLOWANCE_PER_TX_MS;
+}
+
+/** One mainnet slot per transaction, which also covers the slowest anvil block intervals the tests use. */
+const SLOW_BROADCAST_ALLOWANCE_PER_TX_MS = 12_000;
+
+/** Returns the broadcast deadline, with an optional environment override in milliseconds. */
+export function getForgeBroadcastTimeout(
+  chainId: number,
+  value = getEnv().FORGE_BROADCAST_TIMEOUT_MS,
+): number | undefined {
+  if (value === undefined || value === '') {
+    return isAnvilTestChain(chainId) ? 120_000 : undefined;
+  }
+  const timeout = Number(value);
+  if (!Number.isSafeInteger(timeout) || timeout < 0 || timeout > 2_147_483_647) {
+    throw new Error('FORGE_BROADCAST_TIMEOUT_MS must be an integer between 0 and 2147483647');
+  }
+  return timeout === 0 ? undefined : timeout;
+}
+
+/** Returns Forge broadcast flags for the target chain and artifact EVM version. */
+export function getForgeBroadcastArgs(l1ContractsPath: string, chainId: number): string[] {
+  const broadcastArgs = ['--broadcast', '--disable-external-identification'];
+  if (chainId !== sepolia.id) {
+    return broadcastArgs;
+  }
+
+  const foundryToml = readFileSync(join(l1ContractsPath, 'foundry.toml'), 'utf-8');
+  const profile = parseToml(foundryToml).profile;
+  const defaultProfile = typeof profile === 'object' && 'default' in profile ? profile.default : undefined;
+  const evmVersion =
+    defaultProfile && typeof defaultProfile === 'object' && 'evm_version' in defaultProfile
+      ? defaultProfile.evm_version
+      : undefined;
+  if (typeof evmVersion !== 'string' || !evmVersion) {
+    throw new Error('L1 deployment artifacts do not specify an EVM version');
+  }
+
+  // Plan with the artifact's EVM target; --skip-simulation makes Forge estimate each send through RPC.
+  return [...broadcastArgs, '--hardfork', evmVersion, '--skip-simulation'];
+}
+
 /**
  * Runs a process and parses JSON deploy results from stdout.
  * Lines starting with JSON_DEPLOY_RESULT_PREFIX are parsed and returned.
  * All other stdout goes to logger.info, stderr goes to logger.warn.
  */
-function runProcess<T>(
+export function runProcess<T>(
   command: string,
   args: string[],
   env: Record<string, string | undefined>,
   cwd: string,
+  timeoutMs?: number,
 ): Promise<T | undefined> {
   const { promise, resolve, reject } = promiseWithResolvers<T | undefined>();
   const proc = spawn(command, args, {
     cwd,
-    env: { ...process.env, ...env },
+    env: { ...getEnv(), ...env },
     stdio: ['ignore', 'pipe', 'pipe'],
   });
 
   let result: T | undefined;
   let parseError: Error | undefined;
   let settled = false;
+  let timedOut = false;
+  let killTimer: ReturnType<typeof setTimeout> | undefined;
+  const timeoutTimer = timeoutMs
+    ? setTimeout(() => {
+        timedOut = true;
+        proc.kill('SIGTERM');
+        killTimer = setTimeout(() => proc.kill('SIGKILL'), 1000);
+      }, timeoutMs)
+    : undefined;
+
+  const clearTimers = () => {
+    clearTimeout(timeoutTimer);
+    clearTimeout(killTimer);
+  };
+  const rejectProcess = (error: Error) => {
+    if (preparedDeployDirs.delete(cwd)) {
+      error.message += `; deployment artifacts preserved at ${cwd}. Transactions may already have been broadcast.`;
+    }
+    reject(error);
+  };
 
   readline.createInterface({ input: proc.stdout }).on('line', line => {
     const trimmedLine = line.trim();
@@ -74,18 +156,24 @@ function runProcess<T>(
       return;
     }
     settled = true;
-    reject(new Error(`Failed to spawn ${command}: ${error.message}`));
+    clearTimers();
+    rejectProcess(new Error(`Failed to spawn ${command}: ${error.message}`));
   });
 
-  proc.on('close', code => {
+  proc.on('close', (code, signal) => {
     if (settled) {
       return;
     }
     settled = true;
-    if (code !== 0) {
-      reject(new Error(`${command} exited with code ${code}`));
+    clearTimers();
+    if (timedOut) {
+      rejectProcess(new Error(`${command} timed out after ${timeoutMs}ms (signal ${signal ?? 'none'})`));
+    } else if (signal) {
+      rejectProcess(new Error(`${command} terminated by signal ${signal}`));
+    } else if (code !== 0) {
+      rejectProcess(new Error(`${command} exited with code ${code}`));
     } else if (parseError) {
-      reject(parseError);
+      rejectProcess(parseError);
     } else {
       resolve(result);
     }
@@ -129,52 +217,77 @@ async function runForgeScriptBroadcast<T extends { rollupAddress: Hex }>(
   const { forgeBin, l1ContractsPath, script, privateKey, rpcUrl, l1Client, env } = args;
   const baseArgs = ['script', script, '--sig', 'run()', '--private-key', privateKey, '--rpc-url', rpcUrl];
   const verifyArgs = args.verify ? ['--verify'] : [];
+  const chainId = await l1Client.getChainId();
+  const broadcastArgs = getForgeBroadcastArgs(l1ContractsPath, chainId);
+  const timeout = getForgeBroadcastTimeout(chainId);
 
   const latestBlock = await l1Client.request({ method: 'eth_getBlockByNumber', params: ['latest', false] });
+  let result: T | undefined;
   if (!latestBlock || !isAmsterdamBlock(latestBlock)) {
-    const scriptPath = join(getL1ContractsPath(), 'scripts', 'forge_broadcast.js');
-    return runProcess<T>(
-      process.execPath,
-      [scriptPath, ...baseArgs.slice(1), ...verifyArgs],
-      // Resolved forge binary picked up by forge_broadcast.js, so it works without forge on PATH.
-      { ...env, FORGE_BIN: forgeBin },
+    result = await runProcess<T>(
+      forgeBin,
+      [...baseArgs, ...broadcastArgs, ...verifyArgs],
+      env,
+      l1ContractsPath,
+      timeout,
+    );
+  } else {
+    logger.info(`Dry-running ${script} to plan Glamsterdam gas limits`);
+    result = await runProcess<T>(
+      forgeBin,
+      [
+        ...baseArgs,
+        ...broadcastArgs.filter(arg => arg !== '--broadcast' && arg !== '--skip-simulation'),
+        '--gas-estimate-multiplier',
+        String(GLAMSTERDAM_GAS_ESTIMATE_MULTIPLIER),
+      ],
+      env,
       l1ContractsPath,
     );
-  }
 
-  logger.info(`Dry-running ${script} to plan Glamsterdam gas limits`);
-  const result = await runProcess<T>(
-    forgeBin,
-    [...baseArgs, '--gas-estimate-multiplier', String(GLAMSTERDAM_GAS_ESTIMATE_MULTIPLIER)],
-    env,
-    l1ContractsPath,
-  );
+    // Leave headroom for the block gas limit drifting down before the last tx lands.
+    const maxTxGas = (BigInt(latestBlock.gasLimit) * 99n) / 100n;
+    const sequencePath = join(
+      l1ContractsPath,
+      'broadcast',
+      basename(script),
+      String(chainId),
+      'dry-run',
+      'run-latest.json',
+    );
+    const sequence = JSON.parse(readFileSync(sequencePath, 'utf-8'));
+    for (const tx of sequence.transactions) {
+      const gas = BigInt(tx.transaction.gas);
+      tx.transaction.gas = `0x${(gas < maxTxGas ? gas : maxTxGas).toString(16)}`;
+    }
+    // Forge 1.8 resumes from a recovery snapshot under cache/ (fingerprinted, so it cannot be edited) instead of from the
+    // broadcast file, and would send the unclamped limits, some larger than a block. Dropping the snapshot and the
+    // generation the exported files point at makes it resume from the edited broadcast file, as older forge versions did.
+    delete sequence.recovery_generation;
+    writeFileSync(sequencePath, JSON.stringify(sequence, null, 2));
+    const cacheDir = join(l1ContractsPath, 'cache', basename(script), String(chainId), 'dry-run');
+    const sensitivePath = join(cacheDir, 'run-latest.json');
+    if (existsSync(sensitivePath)) {
+      const sensitive = JSON.parse(readFileSync(sensitivePath, 'utf-8'));
+      delete sensitive.recovery_generation;
+      writeFileSync(sensitivePath, JSON.stringify(sensitive, null, 2));
+    }
+    rmSync(join(cacheDir, 'run-latest.json.recovery.json'), { force: true });
 
-  // Leave headroom for the block gas limit drifting down before the last tx lands.
-  const maxTxGas = (BigInt(latestBlock.gasLimit) * 99n) / 100n;
-  const chainId = await l1Client.getChainId();
-  const sequencePath = join(
-    l1ContractsPath,
-    'broadcast',
-    basename(script),
-    String(chainId),
-    'dry-run',
-    'run-latest.json',
-  );
-  const sequence = JSON.parse(readFileSync(sequencePath, 'utf-8'));
-  for (const tx of sequence.transactions) {
-    const gas = BigInt(tx.transaction.gas);
-    tx.transaction.gas = `0x${(gas < maxTxGas ? gas : maxTxGas).toString(16)}`;
+    logger.info(`Broadcasting ${sequence.transactions.length} transactions from ${script}`, { maxTxGas });
+    // --slow waits for each receipt before sending the next tx, so the sender only needs balance for one gas limit at a
+    // time and a block-sized tx is not queued behind others from the same sender.
+    await runProcess(
+      forgeBin,
+      [...baseArgs, ...broadcastArgs, '--resume', '--slow', ...verifyArgs],
+      env,
+      l1ContractsPath,
+      getSlowBroadcastTimeout(timeout, sequence.transactions.length),
+    );
   }
-  writeFileSync(sequencePath, JSON.stringify(sequence, null, 2));
-
-  logger.info(`Broadcasting ${sequence.transactions.length} transactions from ${script}`, { maxTxGas });
-  // --slow waits for each receipt before sending the next tx, so the sender only needs balance for one gas limit at a
-  // time and a block-sized tx is not queued behind others from the same sender.
-  await runProcess(forgeBin, [...baseArgs, '--resume', '--slow', ...verifyArgs], env, l1ContractsPath);
 
   // l1-contracts releases that ship this script no longer activate initial validators inside the deploy, and rely on
-  // forge_broadcast.js flushing the entry queue afterwards; we bypassed it, so flush here. Older releases flush inline.
+  // the broadcast wrapper flushing the entry queue afterwards; we bypassed it, so flush here. Older releases flush inline.
   if (
     result &&
     hasInitialValidators(env.INITIAL_VALIDATORS) &&
@@ -195,13 +308,12 @@ async function runForgeScriptBroadcast<T extends { rollupAddress: Hex }>(
         privateKey,
         '--rpc-url',
         rpcUrl,
+        ...broadcastArgs.filter(arg => arg !== '--skip-simulation'),
         '--skip-simulation',
-        '--batch-size',
-        '1',
-        '--broadcast',
       ],
       env,
       l1ContractsPath,
+      timeout,
     );
   }
   return result;
@@ -258,37 +370,32 @@ export function getL1ContractsPath(): string {
   return resolve(dirname(require.resolve('@aztec-foundation/l1-artifacts')), '..', 'l1-contracts');
 }
 
-// Cached deployment directory
-let preparedDeployDir: string | undefined;
+const preparedDeployDirs = new Set<string>();
 
 function cleanupDeployDir() {
-  if (preparedDeployDir) {
+  for (const directory of preparedDeployDirs) {
     try {
-      rmSync(preparedDeployDir, { recursive: true, force: true });
+      rmSync(directory, { recursive: true, force: true });
     } catch {
       // ignore cleanup errors
     }
-    preparedDeployDir = undefined;
   }
+  preparedDeployDirs.clear();
 }
 
+process.once('exit', cleanupDeployDir);
+
 /**
  * Prepares a temp directory for forge deployment.
  * Copies all artifacts with preserved timestamps (required for forge cache validity).
  * A fresh broadcast/ directory is created for deployment outputs.
  */
 export function prepareL1ContractsForDeployment(): string {
-  if (preparedDeployDir && existsSync(preparedDeployDir)) {
-    logger.verbose(`Using cached deployment directory: ${preparedDeployDir}`);
-    return preparedDeployDir;
-  }
-
   const basePath = getL1ContractsPath();
   logger.verbose(`Preparing L1 contracts from: ${basePath}`);
   const tempDir = mkdtempSync(join(tmpdir(), '.foundry-deploy-'));
   logger.verbose(`Created temp directory for deployment: ${tempDir}`);
-  preparedDeployDir = tempDir;
-  process.on('exit', cleanupDeployDir);
+  preparedDeployDirs.add(tempDir);
 
   // Copy all dirs with preserved timestamps (required for forge cache validity)
   const copyOpts = { recursive: true, preserveTimestamps: true };
@@ -315,12 +422,80 @@ export function prepareL1ContractsForDeployment(): string {
     foundryToml = foundryToml.replace(/solc\s*=\s*"\.\/solc-[^"]+"/, `solc = "${absoluteSolcPath}"`);
     logger.verbose(`Updated solc path in foundry.toml to: ${absoluteSolcPath}`);
   }
+
+  const cachePath = join(tempDir, FORGE_CACHE_FILE);
+  const cache: ForgeCache = JSON.parse(readFileSync(cachePath, 'utf-8'));
+  if (!cache.preprocessed) {
+    // A cache written without test preprocessing is only accepted by forge 1.8 if dynamic test linking is off. Test
+    // preprocessing does not affect the contracts and scripts we deploy.
+    foundryToml = foundryToml.replace(/^\[profile\.default\]$/m, '$&\ndynamic_test_linking = false');
+  }
   writeFileSync(join(tempDir, 'foundry.toml'), foundryToml);
 
+  try {
+    patchForgeCache(tempDir, cache);
+  } catch (err) {
+    logger.warn(`Failed to patch the forge cache, forge will recompile the L1 contracts`, { err });
+  }
+
   mkdirSync(join(tempDir, 'broadcast'));
   return tempDir;
 }
 
+const FORGE_CACHE_FILE = join('cache', 'solidity-files-cache.json');
+
+/** The fields of forge's `solidity-files-cache.json` that depend on the forge version or the project location. */
+type ForgeCache = {
+  profiles?: Record<string, { solc?: Record<string, unknown> }>;
+  remappings?: string[];
+  preprocessed?: boolean;
+};
+
+/**
+ * Makes the forge build cache shipped in l1-artifacts valid in a deploy directory, so forge uses the shipped artifacts
+ * instead of recompiling all L1 contracts, which takes ~10s per process and yields bytecode with a different metadata
+ * hash than the published one.
+ *
+ * Since 1.8, forge stores the absolute remappings of the project in its cache, and discards a cache whose remappings do
+ * not match the current project root. So a cache written in the directory where l1-artifacts was built never matches a
+ * copy of it. We regenerate the remappings for the deploy directory in the format forge writes them, which lists every
+ * context remapping twice: once with a relative context and once with an absolute one.
+ *
+ * Caches written by forge before 1.8 also lack the `viaSSACFG` and `experimental` solc settings, and need dynamic test
+ * linking disabled (see `prepareL1ContractsForDeployment`).
+ *
+ * TODO: Once l1-artifacts is built with forge 1.8.5 or later, remove the `viaSSACFG`/`experimental` backfill and the
+ * `dynamic_test_linking = false` override, as such caches already carry both settings and record `preprocessed: true`.
+ * Keep the remappings rewrite: a forge 1.8 cache stays tied to the directory where it was written.
+ */
+function patchForgeCache(deployDir: string, cache: ForgeCache) {
+  const root = realpathSync(deployDir);
+  const remappings = execFileSync(resolveFoundryBinary('forge'), ['remappings'], { cwd: root, encoding: 'utf-8' })
+    .split('\n')
+    .filter(line => line.trim())
+    .flatMap(line => {
+      const separator = line.indexOf('=');
+      const context = line.slice(0, separator).trim();
+      const target = line.slice(separator + 1).trim();
+      const absoluteTarget = isAbsolute(target) ? target : `${root}/${target}`;
+      const remapping = `${context}=${absoluteTarget}`;
+      return context.includes(':') ? [remapping, `${root}/${remapping}`] : [remapping];
+    });
+
+  for (const profile of Object.values(cache.profiles ?? {})) {
+    if (profile.solc) {
+      profile.solc.viaSSACFG ??= false;
+      profile.solc.experimental ??= false;
+    }
+  }
+  cache.remappings = remappings;
+
+  const cachePath = join(deployDir, FORGE_CACHE_FILE);
+  const { atime, mtime } = statSync(cachePath);
+  writeFileSync(cachePath, JSON.stringify(cache));
+  utimesSync(cachePath, atime, mtime);
+}
+
 /**
  * Computes the validator data for passing to Solidity.
  * Only computes the G2 public key (which requires scalar multiplication on G2, not available in EVM).
@@ -450,9 +625,9 @@ export async function deployAztecL1Contracts(
 
   // Verify contracts on Etherscan when on mainnet/sepolia and ETHERSCAN_API_KEY is available.
   const isVerifiableChain = chainId === mainnet.id || chainId === sepolia.id;
-  const shouldVerify = isVerifiableChain && !!process.env.ETHERSCAN_API_KEY;
+  const shouldVerify = isVerifiableChain && !!getEnv().ETHERSCAN_API_KEY;
 
-  if (isVerifiableChain && !process.env.ETHERSCAN_API_KEY) {
+  if (isVerifiableChain && !getEnv().ETHERSCAN_API_KEY) {
     logger.warn(
       `Deploying to chain ${chainId} (${chainId === mainnet.id ? 'mainnet' : 'sepolia'}) without ETHERSCAN_API_KEY. ` +
         `Contracts will NOT be verified on Etherscan. Set ETHERSCAN_API_KEY environment variable to enable verification.`,

package/src/foundry_binary.ts

@@ -1,3 +1,4 @@
+import { getEnv } from '@aztec-labs/foundation/config/env';
 import { spawnSync } from 'child_process';
 import { accessSync, constants } from 'fs';
 import { homedir } from 'os';
@@ -25,7 +26,7 @@ function isExecutable(path: string): boolean {
  */
 export function resolveFoundryBinary(name: string): string {
   const envVar = `${name.toUpperCase()}_BIN`;
-  const envBin = process.env[envVar];
+  const envBin = getEnv()[envVar];
   if (envBin) {
     if (!isExecutable(envBin)) {
       throw new Error(`$${envVar} is set to ${envBin}, which does not exist or is not executable.`);

package/src/l1_tx_utils/amsterdam.ts

@@ -37,8 +37,11 @@ export class AmsterdamForkDetector {
 
   /** Records a freshly fetched latest L1 block. */
   public observe(block: object | null | undefined): void {
-    if (isAmsterdamBlock(block)) {
+    if (!this.active && isAmsterdamBlock(block)) {
       this.active = true;
+      (this.opts.log ?? createLogger('ethereum:amsterdam-fork-detector')).debug('Amsterdam fork detected on L1', {
+        blockNumber: block && 'number' in block ? block.number : undefined,
+      });
     }
     this.lastObservedAtMs = this.now();
   }

package/src/l1_tx_utils/constants.ts

@@ -18,6 +18,10 @@ export const MAX_L1_TX_LIMIT = 16_777_216n;
 export const AMSTERDAM_MAX_L1_TX_LIMIT = 50_000_000n;
 export const AMSTERDAM_MAX_SLASHED_VALIDATORS_PER_ROUND = 35;
 
+// How long a publisher whose send was rejected for insufficient funds is skipped by publisher selection if its balance
+// does not increase in the meantime.
+export const INSUFFICIENT_FUNDS_BACKOFF_MS = 5 * 60 * 1000;
+
 // setting a minimum bump percentage to 10% due to geth's implementation
 // https://github.com/ethereum/go-ethereum/blob/e3d61e6db028c412f74bc4d4c7e117a9e29d0de0/core/txpool/legacypool/list.go#L298
 export const MIN_REPLACEMENT_BUMP_PERCENTAGE = 10;

package/src/l1_tx_utils/fee-strategies/p75_competitive.ts

@@ -28,7 +28,7 @@ export const P75AllTxsPriorityFeeStrategy: PriorityFeeStrategy = {
       await Promise.allSettled([
         client.getBlock({ blockTag: 'latest' }),
         isBlobTx ? client.getBlobBaseFee() : Promise.resolve(undefined),
-        client.estimateMaxPriorityFeePerGas().catch(() => 0n),
+        client.estimateMaxPriorityFeePerGas(),
         client.getBlock({ blockTag: 'pending', includeTransactions: true }).catch(() => null),
         client
           .getFeeHistory({
@@ -140,6 +140,16 @@ export const P75AllTxsPriorityFeeStrategy: PriorityFeeStrategy = {
       });
       competitiveFee = maxReasonableFee;
       debugInfo.cappedToGwei = formatGwei(maxReasonableFee);
+    } else if (networkEstimateResult.status === 'fulfilled' && networkEstimate === 0n && competitiveFee > 0n) {
+      logger?.warn(
+        'L1 RPC returned a zero priority fee estimate, disabling the competitive fee sanity cap. ' +
+          'You may be overpaying L1 transaction fees. Review your L1 RPC gas price oracle settings; ' +
+          'if using Reth, consider setting --gpo.ignoreprice=2 to exclude zero- and one-wei tips.',
+        {
+          networkEstimateGwei: formatGwei(networkEstimate),
+          competitiveFeeGwei: formatGwei(competitiveFee),
+        },
+      );
     }
 
     // Log final decision

package/src/l1_tx_utils/index.ts

@@ -7,6 +7,7 @@ export * from './interfaces.js';
 export * from './l1_fee_analyzer.js';
 export * from './l1_tx_utils.js';
 export * from './readonly_l1_tx_utils.js';
+export * from './send_cost.js';
 export * from './signer.js';
 export * from './types.js';
 export * from './tx_delayer.js';

package/src/l1_tx_utils/l1_tx_utils.ts

@@ -10,25 +10,27 @@ import { Semaphore } from '@aztec-labs/foundation/queue';
 import { makeBackoff, retry, retryUntil } from '@aztec-labs/foundation/retry';
 import { sleep } from '@aztec-labs/foundation/sleep';
 import { DateProvider } from '@aztec-labs/foundation/timer';
+import { getErrorCause } from '@aztec-labs/foundation/types';
 import pickBy from 'lodash.pickby';
 import {
   type Abi,
   type BlockOverrides,
   type Hex,
+  InsufficientFundsError,
   type PrepareTransactionRequestRequest,
   type StateOverride,
   type TransactionReceipt,
   type TransactionSerializable,
   formatGwei,
-  serializeTransaction,
 } from 'viem';
 
+import { serializeSignedTransaction } from '../blob_tx.js';
 import type { ViemClient } from '../types.js';
 import { formatViemError } from '../utils.js';
 import { type L1TxUtilsConfig, l1TxUtilsConfigMappings } from './config.js';
-import { MAX_L1_TX_LIMIT } from './constants.js';
+import { INSUFFICIENT_FUNDS_BACKOFF_MS, MAX_L1_TX_LIMIT } from './constants.js';
 import type { IL1TxMetrics, IL1TxStore } from './interfaces.js';
-import { type L1SimulationResult, ReadOnlyL1TxUtils } from './readonly_l1_tx_utils.js';
+import { type L1SimulationResult, ReadOnlyL1TxUtils, isInsufficientFundsRpcError } from './readonly_l1_tx_utils.js';
 import { Delayer, createDelayer, wrapClientWithDelayer } from './tx_delayer.js';
 import {
   DroppedTransactionError,
@@ -61,6 +63,11 @@ export class L1TxUtils extends ReadOnlyL1TxUtils {
   public delayer?: Delayer;
   /** KZG instance for blob operations. */
   protected kzg?: BlobKzgInstance;
+  /**
+   * Sender balance and time when a send was last rejected for insufficient funds. Cleared once the balance rises above
+   * the recorded one or the backoff expires.
+   */
+  private insufficientFunds: { balance: bigint; atMs: number } | undefined;
 
   constructor(
     public override client: ViemClient,
@@ -156,6 +163,47 @@ export class L1TxUtils extends ReadOnlyL1TxUtils {
     });
   }
 
+  /** Returns the sender balance recorded when a send was last rejected for insufficient funds, if any. */
+  public getInsufficientFundsAtBalance(): bigint | undefined {
+    return this.insufficientFunds?.balance;
+  }
+
+  /**
+   * Returns whether this sender should be skipped because a previous send was rejected for insufficient funds and its
+   * balance has not increased since. Clears the mark once the given current balance is above the recorded one, or once
+   * INSUFFICIENT_FUNDS_BACKOFF_MS have elapsed since the rejection: a rejection can come from a send whose gas limit was
+   * far above what later sends need, so a balance that did not move is not proof the publisher cannot afford them.
+   */
+  public isBackedOffForInsufficientFunds(currentBalance: bigint): boolean {
+    if (this.insufficientFunds === undefined) {
+      return false;
+    }
+    if (this.hasActiveInsufficientFundsBackoff(currentBalance)) {
+      return true;
+    }
+    const { balance } = this.insufficientFunds;
+    this.logger.info(`Clearing insufficient funds backoff for publisher`, {
+      account: this.getSenderAddress().toString(),
+      balance: currentBalance,
+      insufficientFundsAtBalance: balance,
+      reason: currentBalance > balance ? 'balance-increased' : 'expired',
+    });
+    this.insufficientFunds = undefined;
+    return false;
+  }
+
+  /**
+   * Same check as {@link isBackedOffForInsufficientFunds}, but without clearing a lifted backoff or logging, so it can be
+   * used for reporting without affecting publisher selection.
+   */
+  public hasActiveInsufficientFundsBackoff(currentBalance: bigint): boolean {
+    if (this.insufficientFunds === undefined) {
+      return false;
+    }
+    const { balance, atMs } = this.insufficientFunds;
+    return currentBalance <= balance && this.dateProvider.now() - atMs < INSUFFICIENT_FUNDS_BACKOFF_MS;
+  }
+
   /**
    * Rehydrates transaction states from the store and resumes monitoring for pending transactions.
    * This should be called on startup to restore state and resume monitoring of any in-flight transactions.
@@ -220,11 +268,12 @@ export class L1TxUtils extends ReadOnlyL1TxUtils {
 
   private async signTransaction(txRequest: TransactionSerializable): Promise<`0x${string}`> {
     const signature = await this.signer(txRequest, this.getSenderAddress());
-    return serializeTransaction(txRequest, signature);
+    return serializeSignedTransaction(txRequest, signature);
   }
 
   protected async prepareSignedTransaction(txData: PrepareTransactionRequestRequest) {
-    const txRequest = await this.client.prepareTransactionRequest(txData);
+    // Passing the chain id keeps viem from routing a fully specified request through eth_fillTransaction.
+    const txRequest = await this.client.prepareTransactionRequest({ chainId: this.client.chain.id, ...txData });
     return await this.signTransaction(txRequest as TransactionSerializable);
   }
 
@@ -340,6 +389,9 @@ export class L1TxUtils extends ReadOnlyL1TxUtils {
 
       return { txHash, state: l1TxState };
     } catch (err: any) {
+      if (isInsufficientFundsRpcError(err) || getErrorCause(err, InsufficientFundsError)) {
+        await this.recordInsufficientFunds();
+      }
       const viemError = formatViemError(err, request.abi);
       this.logger.error(`Failed to send L1 transaction: ${viemError.message}`, viemError, {
         request: pick(request, 'to', 'value'),
@@ -348,6 +400,21 @@ export class L1TxUtils extends ReadOnlyL1TxUtils {
     }
   }
 
+  /** Records the current sender balance as one that cannot afford a send, so selection skips it for a while. */
+  private async recordInsufficientFunds(): Promise<void> {
+    try {
+      const balance = await this.getSenderBalance();
+      this.insufficientFunds = { balance, atMs: this.dateProvider.now() };
+      this.logger.warn(`L1 send rejected for insufficient funds, backing off publisher until its balance increases`, {
+        account: this.getSenderAddress().toString(),
+        balance,
+        backoffMs: INSUFFICIENT_FUNDS_BACKOFF_MS,
+      });
+    } catch (err) {
+      this.logger.warn(`Failed to read balance after an insufficient funds rejection`, { err });
+    }
+  }
+
   private async tryGetTxReceipt(
     txHashes: Hex[],
     nonce: number,

package/src/l1_tx_utils/readonly_l1_tx_utils.ts

@@ -51,7 +51,7 @@ const INSUFFICIENT_FUNDS_RPC_ERROR_CODE = -38014;
  * error code, since RPC gateways differ in how they wrap node errors. Apply this only to transport errors: an
  * execution revert string can mention insufficient funds without being this kind of rejection.
  */
-function isInsufficientFundsRpcError(err: unknown): boolean {
+export function isInsufficientFundsRpcError(err: unknown): boolean {
   if (getL1RpcErrorCode(err) === INSUFFICIENT_FUNDS_RPC_ERROR_CODE) {
     return true;
   }