@aztec-labs/p2p 6.0.0-nightly.20260829

package/src/msg_validators/tx_validator/gas_validator.ts

@@ -0,0 +1,149 @@
+import { type Logger, type LoggerBindings, createLogger } from '@aztec-labs/foundation/log';
+import { computeFeePayerBalanceStorageSlot } from '@aztec-labs/protocol-contracts/fee-juice';
+import type { AztecAddress } from '@aztec-labs/stdlib/aztec-address';
+import type { GasFees } from '@aztec-labs/stdlib/gas';
+import type { PublicStateSource } from '@aztec-labs/stdlib/trees';
+import {
+  TX_ERROR_INSUFFICIENT_FEE_PAYER_BALANCE,
+  TX_ERROR_INSUFFICIENT_FEE_PER_GAS,
+  type Tx,
+  type TxValidationResult,
+  type TxValidator,
+} from '@aztec-labs/stdlib/tx';
+
+import { getFeePayerClaimAmount, getTxFeeLimit } from './fee_payer_balance.js';
+
+/** Structural interface for types that carry max fee per gas data, used by {@link MaxFeePerGasValidator}. */
+export interface HasMaxFeePerGasData {
+  txHash: { toString(): string };
+  data: {
+    constants: {
+      txContext: {
+        gasSettings: { maxFeesPerGas: GasFees };
+      };
+    };
+  };
+}
+
+/**
+ * Validates that a transaction's max fee per gas meets the current block's gas fees.
+ *
+ * Rejects transactions whose maxFeesPerGas is below the current block's gas fees
+ * on either dimension (DA or L2). This is a cheap, stateless check.
+ *
+ * Generic over T so it can validate both full {@link Tx} objects and {@link TxMetaData}
+ * (used during pending pool migration).
+ *
+ * Used by: pending pool migration (via factory), and indirectly by {@link GasTxValidator}.
+ */
+export class MaxFeePerGasValidator<T extends HasMaxFeePerGasData> implements TxValidator<T> {
+  #log: Logger;
+  #gasFees: GasFees;
+
+  constructor(gasFees: GasFees, bindings?: LoggerBindings) {
+    this.#log = createLogger('sequencer:tx_validator:tx_gas', bindings);
+    this.#gasFees = gasFees;
+  }
+
+  validateTx(tx: T): Promise<TxValidationResult> {
+    return Promise.resolve(this.validateMaxFeePerGas(tx));
+  }
+
+  /** Checks maxFeesPerGas >= current block gas fees on both dimensions. */
+  validateMaxFeePerGas(tx: T): TxValidationResult {
+    const maxFeesPerGas = tx.data.constants.txContext.gasSettings.maxFeesPerGas;
+    const notEnoughMaxFees =
+      maxFeesPerGas.feePerDaGas < this.#gasFees.feePerDaGas || maxFeesPerGas.feePerL2Gas < this.#gasFees.feePerL2Gas;
+
+    if (notEnoughMaxFees) {
+      this.#log.verbose(`Rejecting transaction ${tx.txHash.toString()} due to insufficient fee per gas`, {
+        txMaxFeesPerGas: maxFeesPerGas.toInspect(),
+        currentGasFees: this.#gasFees.toInspect(),
+      });
+      return {
+        result: 'invalid',
+        reason: [
+          `${TX_ERROR_INSUFFICIENT_FEE_PER_GAS} (maxFee=da:${maxFeesPerGas.feePerDaGas},l2:${maxFeesPerGas.feePerL2Gas} required=da:${this.#gasFees.feePerDaGas},l2:${this.#gasFees.feePerL2Gas})`,
+        ],
+      };
+    }
+    return { result: 'valid' };
+  }
+}
+
+/**
+ * Validates that a transaction can pay its gas fees.
+ *
+ * Runs two checks in order:
+ * 1. **Max fee per gas** (delegates to {@link MaxFeePerGasValidator}) — rejects the tx if its
+ *    maxFeesPerGas is below the current block's gas fees.
+ * 2. **Fee payer balance** — reads the fee payer's FeeJuice balance from public state,
+ *    adds any pending claim from a setup-phase `_increase_public_balance` call, and
+ *    rejects if the total is less than the tx's fee limit (gasLimits * maxFeePerGas).
+ *
+ * Gas limits are deliberately not checked here: they are owned by {@link MinGasLimitsValidator} and
+ * {@link MaxGasLimitsValidator}, which factories include separately so that exemptions (e.g. gas estimation)
+ * don't change fee enforcement.
+ *
+ * Used by: gossip (stage 1), RPC, and block building validators.
+ */
+export class GasTxValidator implements TxValidator<Tx> {
+  #log: Logger;
+  #publicDataSource: PublicStateSource;
+  #feeJuiceAddress: AztecAddress;
+  #maxFeePerGasValidator: MaxFeePerGasValidator<Tx>;
+
+  constructor(
+    publicDataSource: PublicStateSource,
+    feeJuiceAddress: AztecAddress,
+    gasFees: GasFees,
+    bindings?: LoggerBindings,
+  ) {
+    this.#log = createLogger('sequencer:tx_validator:tx_gas', bindings);
+    this.#publicDataSource = publicDataSource;
+    this.#feeJuiceAddress = feeJuiceAddress;
+    this.#maxFeePerGasValidator = new MaxFeePerGasValidator(gasFees, bindings);
+  }
+
+  async validateTx(tx: Tx): Promise<TxValidationResult> {
+    const maxFeeValidation = this.#maxFeePerGasValidator.validateMaxFeePerGas(tx);
+    if (maxFeeValidation.result === 'invalid') {
+      return maxFeeValidation;
+    }
+    return await this.validateTxFee(tx);
+  }
+
+  /**
+   * Checks the fee payer has enough FeeJuice balance to cover the tx's fee limit.
+   * Accounts for any pending claim from a setup-phase `_increase_public_balance` call.
+   */
+  public async validateTxFee(tx: Tx): Promise<TxValidationResult> {
+    const feePayer = tx.data.feePayer;
+
+    // Compute the maximum fee that this tx may pay, based on its gasLimits and maxFeePerGas
+    const feeLimit = getTxFeeLimit(tx);
+
+    // Read current balance of the feePayer
+    const initialBalance = await this.#publicDataSource.storageRead(
+      this.#feeJuiceAddress,
+      await computeFeePayerBalanceStorageSlot(feePayer),
+    );
+
+    // If there is a claim in this tx that increases the fee payer balance in Fee Juice, add it to balance
+    const claimAmount = await getFeePayerClaimAmount(tx, this.#feeJuiceAddress);
+    const balance = initialBalance.toBigInt() + claimAmount;
+
+    if (balance < feeLimit) {
+      this.#log.verbose(`Rejecting transaction due to not enough fee payer balance`, {
+        feePayer,
+        balance,
+        feeLimit,
+      });
+      return {
+        result: 'invalid',
+        reason: [`${TX_ERROR_INSUFFICIENT_FEE_PAYER_BALANCE} (required=${feeLimit}, available=${balance})`],
+      };
+    }
+    return { result: 'valid' };
+  }
+}

package/src/msg_validators/tx_validator/index.ts

@@ -0,0 +1,19 @@
+export * from './aggregate_tx_validator.js';
+export * from './data_validator.js';
+export * from './double_spend_validator.js';
+export * from './metadata_validator.js';
+export * from './tx_proof_validator.js';
+export * from './block_header_validator.js';
+export * from './gas_limits_validator.js';
+export * from './gas_validator.js';
+export * from './phases_validator.js';
+export * from './test_utils.js';
+export * from './allowed_public_setup.js';
+export * from './allowed_setup_helpers.js';
+export * from './archive_cache.js';
+export * from './tx_permitted_validator.js';
+export * from './timestamp_validator.js';
+export * from './size_validator.js';
+export * from './factory.js';
+export * from './tx_validation_cache.js';
+export * from './cached_tx_validator.js';

package/src/msg_validators/tx_validator/metadata_validator.ts

@@ -0,0 +1,104 @@
+import type { Fr } from '@aztec-labs/foundation/curves/bn254';
+import { type Logger, type LoggerBindings, createLogger } from '@aztec-labs/foundation/log';
+import {
+  type AnyTx,
+  TX_ERROR_INCORRECT_L1_CHAIN_ID,
+  TX_ERROR_INCORRECT_PROTOCOL_CONTRACTS_HASH,
+  TX_ERROR_INCORRECT_ROLLUP_VERSION,
+  TX_ERROR_INCORRECT_VK_TREE_ROOT,
+  type TxValidationResult,
+  type TxValidator,
+} from '@aztec-labs/stdlib/tx';
+
+export class MetadataTxValidator<T extends AnyTx> implements TxValidator<T> {
+  #log: Logger;
+
+  constructor(
+    private values: {
+      l1ChainId: Fr;
+      rollupVersion: Fr;
+      vkTreeRoot: Fr;
+      protocolContractsHash: Fr;
+    },
+    bindings?: LoggerBindings,
+  ) {
+    this.#log = createLogger('p2p:tx_validator:tx_metadata', bindings);
+  }
+
+  validateTx(tx: T): Promise<TxValidationResult> {
+    const errors = [];
+    if (!this.#hasCorrectL1ChainId(tx)) {
+      errors.push(
+        `${TX_ERROR_INCORRECT_L1_CHAIN_ID} (tx: ${tx.data.constants.txContext.chainId.toNumber()}, expected: ${this.values.l1ChainId.toNumber()})`,
+      );
+    }
+    if (!this.#hasCorrectRollupVersion(tx)) {
+      errors.push(
+        `${TX_ERROR_INCORRECT_ROLLUP_VERSION} (tx: ${tx.data.constants.txContext.version.toNumber()}, expected: ${this.values.rollupVersion.toNumber()})`,
+      );
+    }
+    if (!this.#hasCorrectVkTreeRoot(tx)) {
+      errors.push(
+        `${TX_ERROR_INCORRECT_VK_TREE_ROOT} (tx: ${tx.data.constants.vkTreeRoot.toString()}, expected: ${this.values.vkTreeRoot.toString()})`,
+      );
+    }
+    if (!this.#hasCorrectprotocolContractsHash(tx)) {
+      errors.push(
+        `${TX_ERROR_INCORRECT_PROTOCOL_CONTRACTS_HASH} (tx: ${tx.data.constants.protocolContractsHash.toString()}, expected: ${this.values.protocolContractsHash.toString()})`,
+      );
+    }
+    return Promise.resolve(errors.length > 0 ? { result: 'invalid', reason: errors } : { result: 'valid' });
+  }
+
+  #hasCorrectVkTreeRoot(tx: T): boolean {
+    // This gets implicitly tested in the proof validator, but we can get a much cheaper check here by looking early at the vk.
+    if (!tx.data.constants.vkTreeRoot.equals(this.values.vkTreeRoot)) {
+      this.#log.verbose(
+        `Rejecting tx ${
+          'txHash' in tx ? tx.txHash : tx.hash
+        } because of incorrect vk tree root ${tx.data.constants.vkTreeRoot.toString()} != ${this.values.vkTreeRoot.toString()}`,
+      );
+      return false;
+    } else {
+      return true;
+    }
+  }
+
+  #hasCorrectprotocolContractsHash(tx: T): boolean {
+    if (!tx.data.constants.protocolContractsHash.equals(this.values.protocolContractsHash)) {
+      this.#log.verbose(
+        `Rejecting tx ${
+          'txHash' in tx ? tx.txHash : tx.hash
+        } because of incorrect protocol contracts hash ${tx.data.constants.protocolContractsHash.toString()} != ${this.values.protocolContractsHash.toString()}`,
+      );
+      return false;
+    }
+    return true;
+  }
+
+  #hasCorrectL1ChainId(tx: T): boolean {
+    if (!tx.data.constants.txContext.chainId.equals(this.values.l1ChainId)) {
+      this.#log.verbose(
+        `Rejecting tx ${
+          'txHash' in tx ? tx.txHash : tx.hash
+        } because of incorrect L1 chain ${tx.data.constants.txContext.chainId.toNumber()} != ${this.values.l1ChainId.toNumber()}`,
+      );
+      return false;
+    } else {
+      return true;
+    }
+  }
+
+  #hasCorrectRollupVersion(tx: T): boolean {
+    if (!tx.data.constants.txContext.version.equals(this.values.rollupVersion)) {
+      this.#log.verbose(
+        `Rejecting tx ${
+          'txHash' in tx ? tx.txHash : tx.hash
+        } because of incorrect rollup version ${tx.data.constants.txContext.version.toNumber()} != ${this.values.rollupVersion.toNumber()}`,
+      );
+      return false;
+    } else {
+      return true;
+    }
+  }
+}

package/src/msg_validators/tx_validator/nullifier_cache.ts

@@ -0,0 +1,30 @@
+import type { NullifierSource } from '@aztec-labs/p2p';
+import type { MerkleTreeReadOperations } from '@aztec-labs/stdlib/interfaces/server';
+import { MerkleTreeId } from '@aztec-labs/stdlib/trees';
+
+/**
+ * Implements a nullifier source by checking a DB and an in-memory collection.
+ * Intended for validating transactions as they are added to a block.
+ */
+export class NullifierCache implements NullifierSource {
+  nullifiers: Set<string>;
+
+  constructor(private db: MerkleTreeReadOperations) {
+    this.nullifiers = new Set();
+  }
+
+  public async nullifiersExist(nullifiers: Buffer[]): Promise<boolean[]> {
+    const cacheResults = nullifiers.map(n => this.nullifiers.has(n.toString()));
+    const toCheckDb = nullifiers.filter((_n, index) => !cacheResults[index]);
+    const dbHits = await this.db.findLeafIndices(MerkleTreeId.NULLIFIER_TREE, toCheckDb);
+
+    let dbIndex = 0;
+    return nullifiers.map((_n, index) => cacheResults[index] || dbHits[dbIndex++] !== undefined);
+  }
+
+  public addNullifiers(nullifiers: Buffer[]) {
+    for (const nullifier of nullifiers) {
+      this.nullifiers.add(nullifier.toString());
+    }
+  }
+}

package/src/msg_validators/tx_validator/phases_validator.ts

@@ -0,0 +1,173 @@
+import { NULL_MSG_SENDER_CONTRACT_ADDRESS } from '@aztec-labs/constants';
+import { type Logger, type LoggerBindings, createLogger } from '@aztec-labs/foundation/log';
+import { PublicContractsDB, getCallRequestsWithCalldataByPhase } from '@aztec-labs/simulator/server';
+import { AztecAddress } from '@aztec-labs/stdlib/aztec-address';
+import type { ContractDataSource } from '@aztec-labs/stdlib/contract';
+import type { AllowedElement } from '@aztec-labs/stdlib/interfaces/server';
+import {
+  type PublicCallRequestWithCalldata,
+  TX_ERROR_DURING_VALIDATION,
+  TX_ERROR_SETUP_FUNCTION_NOT_ALLOWED,
+  TX_ERROR_SETUP_FUNCTION_UNKNOWN_CONTRACT,
+  TX_ERROR_SETUP_NULL_MSG_SENDER,
+  TX_ERROR_SETUP_ONLY_SELF_WRONG_SENDER,
+  TX_ERROR_SETUP_WRONG_CALLDATA_LENGTH,
+  Tx,
+  TxExecutionPhase,
+  type TxValidationResult,
+  type TxValidator,
+} from '@aztec-labs/stdlib/tx';
+import type { UInt64 } from '@aztec-labs/stdlib/types';
+
+export class PhasesTxValidator implements TxValidator<Tx> {
+  #log: Logger;
+  private contractsDB: PublicContractsDB;
+
+  constructor(
+    contracts: ContractDataSource,
+    private setupAllowList: AllowedElement[],
+    private timestamp: UInt64,
+    bindings?: LoggerBindings,
+  ) {
+    this.#log = createLogger('sequencer:tx_validator:tx_phases', bindings);
+    this.contractsDB = new PublicContractsDB(contracts, bindings);
+  }
+
+  async validateTx(tx: Tx): Promise<TxValidationResult> {
+    this.contractsDB.createCheckpoint();
+    try {
+      // TODO(@spalladino): We add this just to handle public authwit-check calls during setup
+      // which are needed for public FPC flows, but fail if the account contract hasnt been deployed yet,
+      // which is what we're trying to do as part of the current txs.
+      // We only need to create/revert checkpoint here because of this addNewContracts call.
+      this.contractsDB.addNewContracts(tx);
+
+      if (!tx.data.forPublic) {
+        this.#log.debug(
+          `Tx ${tx.getTxHash().toString()} does not contain enqueued public functions. Skipping phases validation.`,
+        );
+        return { result: 'valid' };
+      }
+
+      const setupFns = getCallRequestsWithCalldataByPhase(tx, TxExecutionPhase.SETUP);
+      for (const setupFn of setupFns) {
+        const rejectionReason = await this.checkAllowList(setupFn, this.setupAllowList);
+        if (rejectionReason) {
+          this.#log.verbose(
+            `Rejecting tx ${tx.getTxHash().toString()} because it calls setup function not on allow list: ${
+              setupFn.request.contractAddress
+            }:${setupFn.functionSelector}`,
+            { allowList: this.setupAllowList },
+          );
+
+          return { result: 'invalid', reason: [rejectionReason] };
+        }
+      }
+
+      return { result: 'valid' };
+    } catch (err) {
+      this.#log.error(`Error validating phases for tx`, err);
+      return { result: 'invalid', reason: [TX_ERROR_DURING_VALIDATION] };
+    } finally {
+      this.contractsDB.revertCheckpoint();
+    }
+  }
+
+  /** Returns a rejection reason if the call is not on the allow list, or undefined if it is allowed. */
+  private async checkAllowList(
+    publicCall: PublicCallRequestWithCalldata,
+    allowList: AllowedElement[],
+  ): Promise<string | undefined> {
+    if (publicCall.isEmpty()) {
+      return undefined;
+    }
+
+    const contractAddress = publicCall.request.contractAddress;
+    const functionSelector = publicCall.functionSelector;
+
+    // Check address-based entries first since they don't require the contract class.
+    for (const entry of allowList) {
+      if ('address' in entry) {
+        if (contractAddress.equals(entry.address) && entry.selector.equals(functionSelector)) {
+          if (entry.calldataLength !== undefined && publicCall.calldata.length !== entry.calldataLength) {
+            return TX_ERROR_SETUP_WRONG_CALLDATA_LENGTH;
+          }
+          if (entry.onlySelf && !publicCall.request.msgSender.equals(contractAddress)) {
+            return TX_ERROR_SETUP_ONLY_SELF_WRONG_SENDER;
+          }
+          if (
+            entry.rejectNullMsgSender &&
+            publicCall.request.msgSender.equals(AztecAddress.fromBigIntUnsafe(NULL_MSG_SENDER_CONTRACT_ADDRESS))
+          ) {
+            return TX_ERROR_SETUP_NULL_MSG_SENDER;
+          }
+          return undefined;
+        }
+      }
+    }
+
+    // Check class-based entries. Fetch the contract instance lazily (only once).
+    let contractClassId: undefined | { value: string | undefined };
+    for (const entry of allowList) {
+      if (!('classId' in entry)) {
+        continue;
+      }
+
+      if (contractClassId === undefined) {
+        const instance = await this.contractsDB.getContractInstance(contractAddress, this.timestamp);
+        contractClassId = { value: instance?.currentContractClassId.toString() };
+        if (!contractClassId.value) {
+          return TX_ERROR_SETUP_FUNCTION_UNKNOWN_CONTRACT;
+        }
+      }
+
+      if (contractClassId.value === entry.classId.toString() && entry.selector.equals(functionSelector)) {
+        if (entry.calldataLength !== undefined && publicCall.calldata.length !== entry.calldataLength) {
+          return TX_ERROR_SETUP_WRONG_CALLDATA_LENGTH;
+        }
+        if (entry.onlySelf && !publicCall.request.msgSender.equals(contractAddress)) {
+          return TX_ERROR_SETUP_ONLY_SELF_WRONG_SENDER;
+        }
+        if (
+          entry.rejectNullMsgSender &&
+          publicCall.request.msgSender.equals(AztecAddress.fromBigIntUnsafe(NULL_MSG_SENDER_CONTRACT_ADDRESS))
+        ) {
+          return TX_ERROR_SETUP_NULL_MSG_SENDER;
+        }
+        return undefined;
+      }
+    }
+
+    return TX_ERROR_SETUP_FUNCTION_NOT_ALLOWED;
+  }
+}
+
+/** Structural interface for the allowed-setup-calls flag check. */
+export interface HasAllowedSetupCallsData {
+  txHash: { toString(): string };
+  allowedSetupCalls: boolean;
+}
+
+/**
+ * Validates that a transaction's setup-phase calls were allowed at receipt time.
+ *
+ * Checks the precomputed `allowedSetupCalls` flag on TxMetaData. The flag is
+ * computed by running the PhasesTxValidator on the full Tx when it first enters
+ * the pool. This lightweight validator is used during pending pool migration to
+ * reject txs whose setup calls are not on the allow list.
+ */
+export class AllowedSetupCallsMetaValidator<T extends HasAllowedSetupCallsData> implements TxValidator<T> {
+  #log: Logger;
+
+  constructor(bindings?: LoggerBindings) {
+    this.#log = createLogger('sequencer:tx_validator:tx_phases_meta', bindings);
+  }
+
+  validateTx(tx: T): Promise<TxValidationResult> {
+    if (!tx.allowedSetupCalls) {
+      this.#log.verbose(`Rejecting tx ${tx.txHash} because its setup calls are not on the allow list`);
+      return Promise.resolve({ result: 'invalid', reason: [TX_ERROR_SETUP_FUNCTION_NOT_ALLOWED] });
+    }
+    return Promise.resolve({ result: 'valid' });
+  }
+}

package/src/msg_validators/tx_validator/size_validator.ts

@@ -0,0 +1,22 @@
+import { type Logger, type LoggerBindings, createLogger } from '@aztec-labs/foundation/log';
+import { MAX_TX_SIZE_KB } from '@aztec-labs/stdlib/p2p';
+import { Tx, type TxValidationResult, type TxValidator } from '@aztec-labs/stdlib/tx';
+
+export class SizeTxValidator implements TxValidator<Tx> {
+  #log: Logger;
+
+  constructor(bindings?: LoggerBindings) {
+    this.#log = createLogger('p2p:tx_validator:tx_size', bindings);
+  }
+
+  validateTx(tx: Tx): Promise<TxValidationResult> {
+    const txSize = tx.getSize();
+    if (txSize > MAX_TX_SIZE_KB * 1024) {
+      this.#log.verbose(
+        `Rejecting transaction ${tx.getTxHash().toString()}. Reason: size above size limit. ${txSize}bytes > ${MAX_TX_SIZE_KB}Kb`,
+      );
+      return Promise.resolve({ result: 'invalid', reason: ['Transaction size above size limit'] });
+    }
+    return Promise.resolve({ result: 'valid' });
+  }
+}

package/src/msg_validators/tx_validator/test_utils.ts

@@ -0,0 +1,43 @@
+import type { Fr } from '@aztec-labs/foundation/curves/bn254';
+import type { FunctionSelector } from '@aztec-labs/stdlib/abi';
+import type { AztecAddress } from '@aztec-labs/stdlib/aztec-address';
+import { HashedValues, type Tx } from '@aztec-labs/stdlib/tx';
+
+export function patchNonRevertibleFn(
+  tx: Tx,
+  index: number,
+  overrides: { address?: AztecAddress; selector: FunctionSelector; args?: Fr[]; msgSender?: AztecAddress },
+): Promise<AztecAddress> {
+  return patchFn('nonRevertibleAccumulatedData', tx, index, overrides);
+}
+
+export function patchRevertibleFn(
+  tx: Tx,
+  index: number,
+  overrides: { address?: AztecAddress; selector: FunctionSelector; args?: Fr[]; msgSender?: AztecAddress },
+): Promise<AztecAddress> {
+  return patchFn('revertibleAccumulatedData', tx, index, overrides);
+}
+
+async function patchFn(
+  where: 'revertibleAccumulatedData' | 'nonRevertibleAccumulatedData',
+  tx: Tx,
+  index: number,
+  overrides: { address?: AztecAddress; selector: FunctionSelector; args?: Fr[]; msgSender?: AztecAddress },
+): Promise<AztecAddress> {
+  const calldataIndex =
+    where === 'nonRevertibleAccumulatedData'
+      ? index
+      : index + tx.data.forPublic!.nonRevertibleAccumulatedData.publicCallRequests.length;
+  const calldata = [overrides.selector.toField(), ...(overrides.args ?? [])];
+  const hashedCalldata = await HashedValues.fromCalldata(calldata);
+  tx.publicFunctionCalldata[calldataIndex] = hashedCalldata;
+
+  const request = tx.data.forPublic![where].publicCallRequests[index];
+  request.contractAddress = overrides.address ?? request.contractAddress;
+  request.msgSender = overrides.msgSender ?? request.msgSender;
+  request.calldataHash = hashedCalldata.hash;
+  tx.data.forPublic![where].publicCallRequests[index] = request;
+
+  return request.contractAddress;
+}

package/src/msg_validators/tx_validator/timestamp_validator.ts

@@ -0,0 +1,61 @@
+import type { BlockNumber } from '@aztec-labs/foundation/branded-types';
+import { type Logger, type LoggerBindings, createLogger } from '@aztec-labs/foundation/log';
+import {
+  TX_ERROR_INVALID_EXPIRATION_TIMESTAMP,
+  type TxValidationResult,
+  type TxValidator,
+} from '@aztec-labs/stdlib/tx';
+import type { UInt64 } from '@aztec-labs/stdlib/types';
+
+/** Structural interface for timestamp validation. */
+export interface HasTimestampData {
+  txHash: { toString(): string };
+  data: {
+    expirationTimestamp: bigint;
+    constants: {
+      anchorBlockHeader: {
+        globalVariables: {
+          blockNumber: BlockNumber;
+        };
+      };
+    };
+  };
+}
+
+export class TimestampTxValidator<T extends HasTimestampData> implements TxValidator<T> {
+  #log: Logger;
+
+  constructor(
+    private values: {
+      // Timestamp at which we will validate that the tx is not expired. This is typically the timestamp of the block
+      // being built.
+      timestamp: UInt64;
+      // Block number in which the tx is considered to be included.
+      blockNumber: BlockNumber;
+    },
+    bindings?: LoggerBindings,
+  ) {
+    this.#log = createLogger('p2p:tx_validator:timestamp', bindings);
+  }
+
+  validateTx(tx: T): Promise<TxValidationResult> {
+    const expirationTimestamp = tx.data.expirationTimestamp;
+    // If building block 1, we skip the expiration check. For details on why see the `validate_expiration_timestamp`
+    // function in `noir-projects/fnd/noir-protocol-circuits/crates/rollup-lib/src/tx_base/components/private_tail_validator.nr`.
+    const buildingBlock1 = this.values.blockNumber === 1;
+
+    if (!buildingBlock1 && expirationTimestamp < this.values.timestamp) {
+      if (tx.data.constants.anchorBlockHeader.globalVariables.blockNumber === 0) {
+        this.#log.warn(
+          `A tx built against a genesis block failed to be included in block 1 which is the only block in which txs built against a genesis block are allowed to be included.`,
+        );
+      }
+      this.#log.verbose(
+        `Rejecting tx ${tx.txHash} for low expiration timestamp. Tx expiration timestamp: ${expirationTimestamp}, timestamp: ${this.values.timestamp}.`,
+      );
+      return Promise.resolve({ result: 'invalid', reason: [TX_ERROR_INVALID_EXPIRATION_TIMESTAMP] });
+    } else {
+      return Promise.resolve({ result: 'valid' });
+    }
+  }
+}

package/src/msg_validators/tx_validator/tx_permitted_validator.ts

@@ -0,0 +1,22 @@
+import { type Logger, type LoggerBindings, createLogger } from '@aztec-labs/foundation/log';
+import type { Tx, TxValidationResult, TxValidator } from '@aztec-labs/stdlib/tx';
+
+export class TxPermittedValidator implements TxValidator<Tx> {
+  #log: Logger;
+
+  constructor(
+    private permitted: boolean,
+    bindings?: LoggerBindings,
+  ) {
+    this.#log = createLogger('p2p:tx_validator:tx_permitted', bindings);
+  }
+
+  validateTx(tx: Tx): Promise<TxValidationResult> {
+    if (!this.permitted) {
+      const txHash = tx.getTxHash();
+      this.#log.verbose(`Rejecting tx ${txHash.toString()}. Reason: Transactions are not permitted`);
+      return Promise.resolve({ result: 'invalid', reason: ['Transactions are not permitted'] });
+    }
+    return Promise.resolve({ result: 'valid' });
+  }
+}

package/src/msg_validators/tx_validator/tx_proof_validator.ts

@@ -0,0 +1,26 @@
+import { type Logger, type LoggerBindings, createLogger } from '@aztec-labs/foundation/log';
+import type { ClientProtocolCircuitVerifier } from '@aztec-labs/stdlib/interfaces/server';
+import { TX_ERROR_INVALID_PROOF, Tx, type TxValidationResult, type TxValidator } from '@aztec-labs/stdlib/tx';
+
+export class TxProofValidator implements TxValidator<Tx> {
+  public readonly identifier: symbol = Symbol('TxProofValidator');
+
+  #log: Logger;
+
+  constructor(
+    private verifier: ClientProtocolCircuitVerifier,
+    bindings?: LoggerBindings,
+  ) {
+    this.#log = createLogger('p2p:tx_validator:proof', bindings);
+  }
+
+  async validateTx(tx: Tx): Promise<TxValidationResult> {
+    const result = await this.verifier.verifyProof(tx);
+    if (!result.valid) {
+      this.#log.verbose(`Rejecting tx ${tx.getTxHash().toString()} for invalid proof`);
+      return { result: 'invalid', reason: [TX_ERROR_INVALID_PROOF] };
+    }
+    this.#log.trace(`Accepted ${tx.getTxHash().toString()} with valid proof`);
+    return { result: 'valid' };
+  }
+}