@aztec-labs/p2p 6.0.0-nightly.20260829

package/src/msg_validators/tx_validator/factory.ts

@@ -0,0 +1,490 @@
+/**
+ * Transaction validator factories for each tx entry point.
+ *
+ * Unsolicited transactions (gossip and RPC) are fully validated before acceptance.
+ * Transactions received via req/resp or block proposals are only checked for
+ * well-formedness because we must include them for block re-execution — they may
+ * ultimately be invalid, which is caught during block building and reported as
+ * part of block validation/attestation. See the README in this directory for the
+ * full validation strategy.
+ *
+ * 1. **Gossip** — full validation in two stages with a pool pre-check in between.
+ *    Stage 1 (fast): metadata, data, timestamps, double-spend, gas, phases, block header.
+ *    Pool pre-check: `canAddPendingTx` — skips proof verification if pool would reject.
+ *    Stage 2 (slow): proof verification.
+ *    Orchestrated by `handleGossipedTx` in `libp2p_service.ts`.
+ *
+ * 2. **JSON-RPC** — full validation including all state-dependent checks.
+ *    Proof verification and fee enforcement are configurable for testing purposes.
+ *
+ * 3. **Req/resp & block proposals** — well-formedness checks only (metadata, size,
+ *    data, proof). Stored for re-execution; validity against state is not checked here.
+ *
+ * 4. **Block building** — re-validates against current state immediately before
+ *    sequencing. Catches invalid txs that entered via req/resp or block proposals.
+ *    Proof and data checks are skipped since they were verified on entry.
+ *
+ * 5. **Pending pool migration** — when unmined txs (e.g. from req/resp or block
+ *    proposals) are migrated to the pending pool, the pool runs the state-dependent
+ *    checks they missed: double-spend, block header, gas limits, and timestamps.
+ *    This runs on every tx potentially entering the pending pool.
+ */
+import { BlockNumber } from '@aztec-labs/foundation/branded-types';
+import { Fr } from '@aztec-labs/foundation/curves/bn254';
+import type { LoggerBindings } from '@aztec-labs/foundation/log';
+import { getVKTreeRoot } from '@aztec-labs/noir-protocol-circuits-types/vk-tree';
+import { ProtocolContractAddress, protocolContractsHash } from '@aztec-labs/protocol-contracts';
+import type { BlockHash } from '@aztec-labs/stdlib/block';
+import type { ContractDataSource } from '@aztec-labs/stdlib/contract';
+import type { GasFees } from '@aztec-labs/stdlib/gas';
+import type {
+  AllowedElement,
+  ClientProtocolCircuitVerifier,
+  MerkleTreeReadOperations,
+  PublicProcessorValidator,
+  WorldStateSynchronizer,
+} from '@aztec-labs/stdlib/interfaces/server';
+import { PeerErrorSeverity } from '@aztec-labs/stdlib/p2p';
+import { DatabasePublicStateSource, MerkleTreeId, type PublicStateSource } from '@aztec-labs/stdlib/trees';
+import type { GlobalVariables, Tx, TxValidationResult, TxValidator } from '@aztec-labs/stdlib/tx';
+import type { UInt64 } from '@aztec-labs/stdlib/types';
+
+import type { TxMetaData } from '../../mem_pools/tx_pool_v2/tx_metadata.js';
+import { AggregateTxValidator } from './aggregate_tx_validator.js';
+import { ArchiveCache } from './archive_cache.js';
+import { type ArchiveSource, BlockHeaderTxValidator } from './block_header_validator.js';
+import { CachedTxValidator } from './cached_tx_validator.js';
+import { ContractInstanceTxValidator } from './contract_instance_validator.js';
+import { DataTxValidator } from './data_validator.js';
+import { DoubleSpendTxValidator, type NullifierSource } from './double_spend_validator.js';
+import { MaxGasLimitsValidator, MinGasLimitsValidator } from './gas_limits_validator.js';
+import { GasTxValidator, MaxFeePerGasValidator } from './gas_validator.js';
+import { MetadataTxValidator } from './metadata_validator.js';
+import { NullifierCache } from './nullifier_cache.js';
+import { AllowedSetupCallsMetaValidator, PhasesTxValidator } from './phases_validator.js';
+import { SizeTxValidator } from './size_validator.js';
+import { TimestampTxValidator } from './timestamp_validator.js';
+import { TxPermittedValidator } from './tx_permitted_validator.js';
+import { TxProofValidator } from './tx_proof_validator.js';
+import { TxValidationCache } from './tx_validation_cache.js';
+
+/**
+ * A validator paired with a peer penalty severity.
+ * Used for gossip validation where each validator's failure triggers a peer penalization
+ * with the associated severity level.
+ */
+export interface TransactionValidator {
+  validator: {
+    validateTx(tx: Tx): Promise<TxValidationResult>;
+  };
+  severity: PeerErrorSeverity;
+}
+
+/**
+ * First stage of gossip validation — fast checks run before the pool pre-check.
+ *
+ * If any validator fails, the peer is penalized and the tx is rejected immediately,
+ * without consulting the pool or running proof verification.
+ *
+ * The `doubleSpendValidator` failure is special-cased by the caller (`handleGossipedTx`)
+ * to determine severity based on how recently the nullifier appeared. The caller reports the
+ * first failing entry among equally severe ones.
+ */
+export function createFirstStageTxValidationsForGossipedTransactions(
+  timestamp: UInt64,
+  blockNumber: BlockNumber,
+  worldStateSynchronizer: WorldStateSynchronizer,
+  gasFees: GasFees,
+  l1ChainId: number,
+  rollupVersion: number,
+  protocolContractsHash: Fr,
+  contractDataSource: ContractDataSource,
+  txsPermitted: boolean,
+  allowedInSetup: AllowedElement[] = [],
+  bindings?: LoggerBindings,
+  gasLimitOpts?: { maxTxL2Gas?: number; maxTxDAGas?: number },
+): Record<string, TransactionValidator> {
+  const merkleTree = worldStateSynchronizer.getCommitted();
+
+  return {
+    timestampValidator: {
+      validator: new TimestampTxValidator<Tx>(
+        {
+          timestamp,
+          blockNumber,
+        },
+        bindings,
+      ),
+      severity: PeerErrorSeverity.HighToleranceError,
+    },
+    txsPermittedValidator: {
+      validator: new TxPermittedValidator(txsPermitted, bindings),
+      severity: PeerErrorSeverity.MidToleranceError,
+    },
+    txSizeValidator: {
+      validator: new SizeTxValidator(bindings),
+      severity: PeerErrorSeverity.MidToleranceError,
+    },
+    metadataValidator: {
+      validator: new MetadataTxValidator(
+        {
+          l1ChainId: new Fr(l1ChainId),
+          rollupVersion: new Fr(rollupVersion),
+          protocolContractsHash,
+          vkTreeRoot: getVKTreeRoot(),
+        },
+        bindings,
+      ),
+      severity: PeerErrorSeverity.MidToleranceError,
+    },
+    phasesValidator: {
+      validator: new PhasesTxValidator(contractDataSource, allowedInSetup, timestamp, bindings),
+      severity: PeerErrorSeverity.MidToleranceError,
+    },
+    blockHeaderValidator: {
+      validator: new BlockHeaderTxValidator(new ArchiveCache(merkleTree), bindings),
+      severity: PeerErrorSeverity.HighToleranceError,
+    },
+    doubleSpendValidator: {
+      validator: new DoubleSpendTxValidator(
+        {
+          nullifiersExist: async (nullifiers: Buffer[]) => {
+            const merkleTree = worldStateSynchronizer.getCommitted();
+            const indices = await merkleTree.findLeafIndices(MerkleTreeId.NULLIFIER_TREE, nullifiers);
+            return indices.map(index => index !== undefined);
+          },
+        },
+        bindings,
+      ),
+      severity: PeerErrorSeverity.MidToleranceError, // This is handled specifically at the point of rejection by considering a recent window where it may have been valid
+    },
+    minGasLimitsValidator: {
+      validator: new MinGasLimitsValidator<Tx>(bindings),
+      severity: PeerErrorSeverity.MidToleranceError,
+    },
+    maxGasLimitsValidator: {
+      validator: new MaxGasLimitsValidator<Tx>({ ...gasLimitOpts, bindings }),
+      severity: PeerErrorSeverity.MidToleranceError,
+    },
+    gasValidator: {
+      validator: new GasTxValidator(
+        new DatabasePublicStateSource(merkleTree),
+        ProtocolContractAddress.FeeJuice,
+        gasFees,
+        bindings,
+      ),
+      severity: PeerErrorSeverity.MidToleranceError,
+    },
+    dataValidator: {
+      validator: new DataTxValidator(bindings),
+      severity: PeerErrorSeverity.MidToleranceError,
+    },
+    contractInstanceValidator: {
+      validator: new ContractInstanceTxValidator(bindings),
+      severity: PeerErrorSeverity.MidToleranceError,
+    },
+  };
+}
+
+/**
+ * Second stage of gossip validation — expensive proof verification.
+ *
+ * Only runs after the first stage passes AND `canAddPendingTx` confirms the pool would
+ * accept the tx. This avoids wasting CPU on proof verification for txs the pool would reject
+ * (e.g., duplicates, insufficient balance, pool full).
+ */
+export function createSecondStageTxValidationsForGossipedTransactions(
+  proofVerifier: ClientProtocolCircuitVerifier,
+  bindings?: LoggerBindings,
+): Record<string, TransactionValidator> {
+  return {
+    proofValidator: {
+      validator: new TxProofValidator(proofVerifier, bindings),
+      severity: PeerErrorSeverity.LowToleranceError,
+    },
+  };
+}
+
+/**
+ * Well-formedness checks only: metadata, size, data, and proof.
+ * Used for req/resp and block proposal txs. These txs must be accepted for block
+ * re-execution even though they may be invalid against current state — that is
+ * caught later by the block building validator.
+ */
+function createTxValidatorForMinimumTxIntegrityChecks(
+  verifier: ClientProtocolCircuitVerifier,
+  {
+    l1ChainId,
+    rollupVersion,
+  }: {
+    l1ChainId: number;
+    rollupVersion: number;
+  },
+  bindings?: LoggerBindings,
+  cache?: TxValidationCache,
+): TxValidator {
+  const aggregate = new AggregateTxValidator(
+    new SizeTxValidator(bindings),
+    new MetadataTxValidator(
+      {
+        l1ChainId: new Fr(l1ChainId),
+        rollupVersion: new Fr(rollupVersion),
+        protocolContractsHash,
+        vkTreeRoot: getVKTreeRoot(),
+      },
+      bindings,
+    ),
+    CachedTxValidator.new(new DataTxValidator(bindings), cache),
+    new ContractInstanceTxValidator(bindings),
+    CachedTxValidator.new(new TxProofValidator(verifier, bindings), cache),
+  );
+
+  // This validator is not state-dependent so we can cache it.
+  const identifier = Symbol('TxValidatorForMinimumTxIntegrityChecks');
+  return CachedTxValidator.newWithIdentifier(aggregate, identifier, cache);
+}
+
+/**
+ * Validators for txs received via req/resp or filestores.
+ * Checks well-formedness only — we must accept these for re-execution even if they
+ * are invalid against current state. State-dependent checks happen when the tx
+ * enters the pending pool or during block building.
+ */
+export function createTxValidatorForOnDemandReceivedTxs(
+  verifier: ClientProtocolCircuitVerifier,
+  {
+    l1ChainId,
+    rollupVersion,
+  }: {
+    l1ChainId: number;
+    rollupVersion: number;
+  },
+  bindings?: LoggerBindings,
+  cache?: TxValidationCache,
+): TxValidator {
+  return createTxValidatorForMinimumTxIntegrityChecks(verifier, { l1ChainId, rollupVersion }, bindings, cache);
+}
+
+/**
+ * Validators for txs received in block proposals.
+ * Same as req/resp — well-formedness only. We must store these for block
+ * re-execution; their validity against state is checked during block building.
+ */
+export function createTxValidatorForBlockProposalReceivedTxs(
+  verifier: ClientProtocolCircuitVerifier,
+  {
+    l1ChainId,
+    rollupVersion,
+  }: {
+    l1ChainId: number;
+    rollupVersion: number;
+  },
+  bindings?: LoggerBindings,
+  cache?: TxValidationCache,
+): TxValidator {
+  return createTxValidatorForMinimumTxIntegrityChecks(verifier, { l1ChainId, rollupVersion }, bindings, cache);
+}
+
+/**
+ * Validators for unsolicited txs received over JSON-RPC (from a local wallet/PXE).
+ * Full validation — all state-dependent checks are run. Proof verification is optional
+ * (can be skipped for testing purposes). Fee enforcement is also optional (skipped for testing/dev).
+ * Called from `AztecNodeService.isValidTx()`.
+ */
+export function createTxValidatorForAcceptingTxsOverRPC(
+  db: MerkleTreeReadOperations,
+  contractDataSource: ContractDataSource,
+  verifier: ClientProtocolCircuitVerifier | undefined,
+  {
+    l1ChainId,
+    rollupVersion,
+    setupAllowList,
+    gasFees,
+    skipFeeEnforcement,
+    isSimulation,
+    timestamp,
+    blockNumber,
+    txsPermitted,
+    maxTxL2Gas,
+    maxTxDAGas,
+  }: {
+    l1ChainId: number;
+    rollupVersion: number;
+    setupAllowList: AllowedElement[];
+    gasFees: GasFees;
+    skipFeeEnforcement?: boolean;
+    isSimulation?: boolean;
+    timestamp: UInt64;
+    blockNumber: BlockNumber;
+    txsPermitted: boolean;
+    maxTxL2Gas?: number;
+    maxTxDAGas?: number;
+  },
+  bindings?: LoggerBindings,
+): TxValidator<Tx> {
+  const validators: TxValidator<Tx>[] = [
+    new TxPermittedValidator(txsPermitted, bindings),
+    new TimestampTxValidator(
+      {
+        timestamp,
+        blockNumber,
+      },
+      bindings,
+    ),
+    new SizeTxValidator(bindings),
+    new MetadataTxValidator(
+      {
+        l1ChainId: new Fr(l1ChainId),
+        rollupVersion: new Fr(rollupVersion),
+        protocolContractsHash,
+        vkTreeRoot: getVKTreeRoot(),
+      },
+      bindings,
+    ),
+    // Declared gas-limit admission is not fee enforcement, so it runs even when fees are skipped. The floor
+    // has no exemption: a tx declaring less than the fixed overheads can never be mined, so rejecting it
+    // during simulation is the earliest useful feedback rather than a surprise on sendTx.
+    new MinGasLimitsValidator<Tx>(bindings),
+    // Only the ceiling is exempted during simulation: gas estimation submits intentionally-inflated
+    // `forEstimation` limits (above the per-tx max) and the wallet clamps the real tx to the admission limit
+    // afterward, so enforcing the ceiling on the estimation tx would reject a valid estimation.
+    ...(!isSimulation ? [new MaxGasLimitsValidator<Tx>({ maxTxL2Gas, maxTxDAGas, bindings })] : []),
+    new PhasesTxValidator(contractDataSource, setupAllowList, timestamp, bindings),
+    new BlockHeaderTxValidator(new ArchiveCache(db), bindings),
+    new DoubleSpendTxValidator(new NullifierCache(db), bindings),
+    ...(!skipFeeEnforcement
+      ? [new GasTxValidator(new DatabasePublicStateSource(db), ProtocolContractAddress.FeeJuice, gasFees, bindings)]
+      : []),
+    new DataTxValidator(bindings),
+    new ContractInstanceTxValidator(bindings),
+    ...(verifier ? [new TxProofValidator(verifier, bindings)] : []),
+  ];
+
+  return new AggregateTxValidator(...validators);
+}
+
+/**
+ * Validators for txs about to be included in a block by the sequencer.
+ * Re-validates against current state. This is where invalid txs that entered via
+ * req/resp or block proposals are caught — their invalidity is reported as part
+ * of block validation/attestation. Proof and data checks are omitted since they
+ * were already verified on entry.
+ * Called from `CheckpointBuilder.makeBlockBuilderDeps()`.
+ */
+export function createTxValidatorForBlockBuilding(
+  db: MerkleTreeReadOperations,
+  contractDataSource: ContractDataSource,
+  globalVariables: GlobalVariables,
+  setupAllowList: AllowedElement[],
+  bindings?: LoggerBindings,
+): PublicProcessorValidator {
+  const nullifierCache = new NullifierCache(db);
+  const archiveCache = new ArchiveCache(db);
+  const publicStateSource = new DatabasePublicStateSource(db);
+
+  return {
+    preprocessValidator: createTxValidatorForValidatingAgainstCurrentState(
+      nullifierCache,
+      archiveCache,
+      publicStateSource,
+      contractDataSource,
+      globalVariables,
+      setupAllowList,
+      bindings,
+    ),
+    nullifierCache,
+  };
+}
+
+function createTxValidatorForValidatingAgainstCurrentState(
+  nullifierSource: NullifierSource,
+  archiveSource: ArchiveSource,
+  publicStateSource: PublicStateSource,
+  contractDataSource: ContractDataSource,
+  globalVariables: GlobalVariables,
+  setupAllowList: AllowedElement[],
+  bindings?: LoggerBindings,
+): TxValidator<Tx> {
+  // We don't include the TxProofValidator nor the DataTxValidator here because they are already checked by the time we get to block building.
+  return new AggregateTxValidator(
+    new TimestampTxValidator(
+      {
+        timestamp: globalVariables.timestamp,
+        blockNumber: globalVariables.blockNumber,
+      },
+      bindings,
+    ),
+    new MinGasLimitsValidator<Tx>(bindings),
+    // No limit opts: enforce only the per-tx protocol ceiling. Network admission limits are relay policy and
+    // must not invalidate a proposed block.
+    new MaxGasLimitsValidator<Tx>({ bindings }),
+    new PhasesTxValidator(contractDataSource, setupAllowList, globalVariables.timestamp, bindings),
+    new BlockHeaderTxValidator(archiveSource, bindings),
+    new DoubleSpendTxValidator(nullifierSource, bindings),
+    new GasTxValidator(publicStateSource, ProtocolContractAddress.FeeJuice, globalVariables.gasFees, bindings),
+  );
+}
+
+/**
+ * Validators for txs migrating to the pending pool.
+ *
+ * Txs that arrived via req/resp or block proposals only had well-formedness checks
+ * on receipt. When they fail to be mined and are migrated to the pending pool, we
+ * run the state-dependent checks they missed: double-spend, block header, gas limits,
+ * and timestamp expiry. This is run on EVERY tx potentially entering the pending pool
+ * — called inside `TxPoolV2Impl` during `addPendingTxs`, `prepareForSlot` (unprotect),
+ * `handlePrunedBlocks` (unmine), and startup hydration.
+ *
+ * Operates on `TxMetaData` rather than full `Tx` since metadata is pre-built by the pool.
+ * Injected into `TxPoolV2` as the `createTxValidator` factory in `TxPoolV2Dependencies`.
+ */
+export async function createTxValidatorForTransactionsEnteringPendingTxPool(
+  worldStateSynchronizer: WorldStateSynchronizer,
+  timestamp: bigint,
+  blockNumber: BlockNumber,
+  gasLimitOpts: { maxTxL2Gas?: number; maxTxDAGas?: number },
+  gasFees: GasFees,
+  bindings?: LoggerBindings,
+): Promise<TxValidator<TxMetaData>> {
+  await worldStateSynchronizer.syncImmediate();
+  const merkleTree = worldStateSynchronizer.getCommitted();
+  const nullifierSource: NullifierSource = {
+    nullifiersExist: async (nullifiers: Buffer[]) => {
+      const indices = await merkleTree.findLeafIndices(MerkleTreeId.NULLIFIER_TREE, nullifiers);
+      return indices.map(index => index !== undefined);
+    },
+  };
+  const archiveSource: ArchiveSource = {
+    getArchiveIndices: (archives: BlockHash[]) => {
+      return merkleTree.findLeafIndices(MerkleTreeId.ARCHIVE, archives);
+    },
+  };
+  return new AggregateTxValidator<TxMetaData>(
+    new AllowedSetupCallsMetaValidator<TxMetaData>(bindings),
+    new TimestampTxValidator<TxMetaData>({ timestamp, blockNumber }, bindings),
+    new MinGasLimitsValidator<TxMetaData>(bindings),
+    new MaxGasLimitsValidator<TxMetaData>({ ...gasLimitOpts, bindings }),
+    new MaxFeePerGasValidator<TxMetaData>(gasFees, bindings),
+    new BlockHeaderTxValidator<TxMetaData>(archiveSource, bindings),
+    new DoubleSpendTxValidator<TxMetaData>(nullifierSource, bindings),
+  );
+}
+
+/**
+ * Creates a function that checks whether a tx's setup-phase calls are on the allow list.
+ *
+ * Uses the `PhasesTxValidator` on the full Tx. The result is stored as a boolean
+ * flag in `TxMetaData.allowedSetupCalls` at receipt time, so the pending pool
+ * migration validator can check it without needing the full Tx or its dependencies.
+ */
+export function createCheckAllowedSetupCalls(
+  contractDataSource: ContractDataSource,
+  setupAllowList: AllowedElement[],
+  getTimestamp: () => UInt64,
+): (tx: Tx) => Promise<boolean> {
+  return async (tx: Tx) => {
+    const validator = new PhasesTxValidator(contractDataSource, setupAllowList, getTimestamp());
+    const result = await validator.validateTx(tx);
+    return result.result === 'valid';
+  };
+}

package/src/msg_validators/tx_validator/fee_payer_balance.ts

@@ -0,0 +1,44 @@
+import { FeeJuiceArtifact } from '@aztec-labs/protocol-contracts/fee-juice';
+import { getCallRequestsWithCalldataByPhase } from '@aztec-labs/simulator/server';
+import { FunctionSelector, getAllFunctionAbis } from '@aztec-labs/stdlib/abi';
+import type { AztecAddress } from '@aztec-labs/stdlib/aztec-address';
+import { type Tx, TxExecutionPhase } from '@aztec-labs/stdlib/tx';
+
+export type FeePayerBalanceDelta = {
+  feeLimit: bigint;
+  claimAmount: bigint;
+};
+
+const increasePublicBalanceSelectorPromise = (() => {
+  const fn = getAllFunctionAbis(FeeJuiceArtifact).find(f => f.name === '_increase_public_balance')!;
+  return FunctionSelector.fromNameAndParameters(fn.name, fn.parameters);
+})();
+
+export function getTxFeeLimit(tx: Tx): bigint {
+  return tx.data.constants.txContext.gasSettings.getFeeLimit().toBigInt();
+}
+
+export async function getFeePayerClaimAmount(tx: Tx, feeJuiceAddress: AztecAddress): Promise<bigint> {
+  const setupFns = getCallRequestsWithCalldataByPhase(tx, TxExecutionPhase.SETUP);
+  const increasePublicBalanceSelector = await increasePublicBalanceSelectorPromise;
+  const feePayer = tx.data.feePayer;
+
+  const claimFunctionCall = setupFns.find(
+    fn =>
+      fn.request.contractAddress.equals(feeJuiceAddress) &&
+      fn.request.msgSender.equals(feeJuiceAddress) &&
+      fn.calldata.length > 2 &&
+      fn.functionSelector.equals(increasePublicBalanceSelector) &&
+      fn.args[0].equals(feePayer.toField()) &&
+      !fn.request.isStaticCall,
+  );
+
+  return claimFunctionCall ? claimFunctionCall.args[1].toBigInt() : 0n;
+}
+
+export async function getFeePayerBalanceDelta(tx: Tx, feeJuiceAddress: AztecAddress): Promise<FeePayerBalanceDelta> {
+  return {
+    feeLimit: getTxFeeLimit(tx),
+    claimAmount: await getFeePayerClaimAmount(tx, feeJuiceAddress),
+  };
+}

package/src/msg_validators/tx_validator/gas_limits_validator.ts

@@ -0,0 +1,148 @@
+import {
+  MAX_PROCESSABLE_L2_GAS,
+  MAX_TX_DA_GAS,
+  PRIVATE_TX_L2_GAS_OVERHEAD,
+  PUBLIC_TX_L2_GAS_OVERHEAD,
+  TX_DA_GAS_OVERHEAD,
+} from '@aztec-labs/constants';
+import { type Logger, type LoggerBindings, createLogger } from '@aztec-labs/foundation/log';
+import { Gas } from '@aztec-labs/stdlib/gas';
+import {
+  TX_ERROR_GAS_LIMIT_TOO_HIGH,
+  TX_ERROR_INSUFFICIENT_GAS_LIMIT,
+  type TxValidationResult,
+  type TxValidator,
+} from '@aztec-labs/stdlib/tx';
+
+/**
+ * Structural interface for types that carry gas limit data, used by {@link MinGasLimitsValidator} and
+ * {@link MaxGasLimitsValidator}.
+ */
+export interface HasGasLimitData {
+  txHash: { toString(): string };
+  data: {
+    // We just need to know whether there is something here or not
+    forPublic?: unknown;
+    constants: {
+      txContext: {
+        gasSettings: { gasLimits: Gas };
+      };
+    };
+  };
+}
+
+/**
+ * Validates that a transaction declares at least the gas it is guaranteed to be charged.
+ *
+ * Rejects transactions whose gas limits fall below the fixed protocol overheads
+ * ({@link TX_DA_GAS_OVERHEAD} and {@link PRIVATE_TX_L2_GAS_OVERHEAD} / {@link PUBLIC_TX_L2_GAS_OVERHEAD}).
+ * This is a cheap, stateless check that operates on gas settings alone.
+ *
+ * The floor is a protocol property with no exemptions: a tx below it can never be mined, so every entry
+ * point applies it, including gas estimation.
+ *
+ * Generic over T so it can validate both full {@link Tx} objects and {@link TxMetaData}
+ * (used during pending pool migration).
+ */
+export class MinGasLimitsValidator<T extends HasGasLimitData> implements TxValidator<T> {
+  #log: Logger;
+
+  constructor(bindings?: LoggerBindings) {
+    this.#log = createLogger('sequencer:tx_validator:tx_gas', bindings);
+  }
+
+  validateTx(tx: T): Promise<TxValidationResult> {
+    return Promise.resolve(this.validateGasLimit(tx));
+  }
+
+  /** Checks gas limits are >= the fixed protocol overheads (L2 and DA). */
+  validateGasLimit(tx: T): TxValidationResult {
+    const gasLimits = tx.data.constants.txContext.gasSettings.gasLimits;
+    const minGasLimits = new Gas(
+      TX_DA_GAS_OVERHEAD,
+      tx.data.forPublic ? PUBLIC_TX_L2_GAS_OVERHEAD : PRIVATE_TX_L2_GAS_OVERHEAD,
+    );
+
+    if (minGasLimits.gtAny(gasLimits)) {
+      this.#log.verbose(`Rejecting transaction due to the gas limit(s) not being above the minimum gas limit`, {
+        gasLimits,
+        minGasLimits,
+      });
+      return {
+        result: 'invalid',
+        reason: [
+          `${TX_ERROR_INSUFFICIENT_GAS_LIMIT} (required=da:${minGasLimits.daGas},l2:${minGasLimits.l2Gas} got=da:${gasLimits.daGas},l2:${gasLimits.l2Gas})`,
+        ],
+      };
+    }
+
+    return { result: 'valid' };
+  }
+}
+
+/**
+ * Validates that a transaction does not declare more gas than it is allowed to.
+ *
+ * Rejects transactions whose gas limits exceed the per-tx protocol maxima, optionally tightened to the
+ * network admission limits. This is a cheap, stateless check that operates on gas settings alone.
+ *
+ * Unlike the floor, the ceiling is exempted on the gas estimation path, where limits are deliberately
+ * inflated past what the protocol allows (see {@link GasSettings.forEstimation}).
+ *
+ * Generic over T so it can validate both full {@link Tx} objects and {@link TxMetaData}
+ * (used during pending pool migration).
+ */
+export class MaxGasLimitsValidator<T extends HasGasLimitData> implements TxValidator<T> {
+  #log: Logger;
+  #effectiveMaxL2Gas: number;
+  #effectiveMaxDAGas: number;
+
+  /**
+   * @param maxTxL2Gas - The network admission limit on L2 gas a single tx may declare (the per-block mana
+   * allocation, see {@link computeNetworkTxGasLimits}). Defaults to the per-tx protocol maximum, so callers
+   * that pass nothing (e.g. block building) enforce only the protocol ceiling.
+   * @param maxTxDAGas - The network admission limit on DA gas a single tx may declare. Defaults to the
+   * per-tx protocol maximum {@link MAX_TX_DA_GAS}.
+   */
+  constructor(opts?: { maxTxL2Gas?: number; maxTxDAGas?: number; bindings?: LoggerBindings }) {
+    this.#log = createLogger('sequencer:tx_validator:tx_gas', opts?.bindings);
+    // The passed limits are network admission limits; clamp to the per-tx protocol maxima as a hard ceiling.
+    // MAX_TX_DA_GAS bounds DA by what a single tx can actually post to a blob; declaring more is meaningless
+    // and would let a tx reserve checkpoint/block DA budget during proposal building it can't use.
+    this.#effectiveMaxL2Gas = Math.min(MAX_PROCESSABLE_L2_GAS, opts?.maxTxL2Gas ?? Infinity);
+    this.#effectiveMaxDAGas = Math.min(MAX_TX_DA_GAS, opts?.maxTxDAGas ?? Infinity);
+  }
+
+  validateTx(tx: T): Promise<TxValidationResult> {
+    return Promise.resolve(this.validateGasLimit(tx));
+  }
+
+  /** Checks gas limits are <= the effective max gas (L2 and DA). */
+  validateGasLimit(tx: T): TxValidationResult {
+    const gasLimits = tx.data.constants.txContext.gasSettings.gasLimits;
+
+    if (gasLimits.l2Gas > this.#effectiveMaxL2Gas) {
+      this.#log.verbose(`Rejecting transaction due to the L2 gas limit being higher than the effective maximum`, {
+        gasLimits,
+        effectiveMaxL2Gas: this.#effectiveMaxL2Gas,
+      });
+      return {
+        result: 'invalid',
+        reason: [`${TX_ERROR_GAS_LIMIT_TOO_HIGH} (l2Gas=${gasLimits.l2Gas}, max=${this.#effectiveMaxL2Gas})`],
+      };
+    }
+
+    if (gasLimits.daGas > this.#effectiveMaxDAGas) {
+      this.#log.verbose(`Rejecting transaction due to the DA gas limit being higher than the effective maximum`, {
+        gasLimits,
+        effectiveMaxDAGas: this.#effectiveMaxDAGas,
+      });
+      return {
+        result: 'invalid',
+        reason: [`${TX_ERROR_GAS_LIMIT_TOO_HIGH} (daGas=${gasLimits.daGas}, max=${this.#effectiveMaxDAGas})`],
+      };
+    }
+
+    return { result: 'valid' };
+  }
+}