@aztec-labs/p2p 6.0.0-rc.1 → 6.0.0-rc.2

package/src/mem_pools/tx_pool_v2/interfaces.ts

@@ -1,7 +1,7 @@
 import type { SlotNumber } from '@aztec-labs/foundation/branded-types';
 import type { TypedEventEmitter } from '@aztec-labs/foundation/types';
 import type { L2Block, L2BlockId, L2BlockSource } from '@aztec-labs/stdlib/block';
-import type { BlockMinFeesProvider } from '@aztec-labs/stdlib/gas';
+import type { NextBlockMinFeesProvider } from '@aztec-labs/stdlib/gas';
 import type { WorldStateSynchronizer } from '@aztec-labs/stdlib/interfaces/server';
 import type { BlockHeader, Tx, TxHash, TxValidator } from '@aztec-labs/stdlib/tx';
 
@@ -81,8 +81,11 @@ export type TxPoolV2Dependencies = {
   createTxValidator: () => Promise<TxValidator<TxMetaData>>;
   /** Checks whether a tx's setup-phase calls are on the allow list. Precomputed at receipt time. */
   checkAllowedSetupCalls: (tx: Tx) => Promise<boolean>;
-  /** Provides projected minimum fees for the next block. Used by eviction rules instead of stale block header fees. */
-  blockMinFeesProvider: BlockMinFeesProvider;
+  /**
+   * Provides the fee the next block will charge. Used by eviction rules instead of stale block header fees. Only the
+   * exact fee: admission pricing is applied by the validator `createTxValidator` builds.
+   */
+  nextBlockMinFeesProvider: NextBlockMinFeesProvider;
 };
 
 /**
@@ -163,6 +166,7 @@ export interface TxPoolV2 extends TypedEventEmitter<TxPoolV2Events> {
 
   /**
    * Handles a mined block - marks transactions as mined and evicts conflicting pending txs.
+   * Soft-deleted transactions in the block are re-added as mined from their retained data.
    * Uses nullifiers directly from the block to evict pending transactions with conflicts.
    * @param block - The complete mined block
    */
@@ -197,7 +201,9 @@ export interface TxPoolV2 extends TypedEventEmitter<TxPoolV2Events> {
 
   /**
    * Handles failed transaction execution.
-   * Deletes transactions that failed during block building.
+   * Deletes transactions that failed during block building. Transactions already mined are left in place, since a
+   * block containing them may have been synced while they were being executed, and they must be kept until that
+   * block is finalized.
    * @param txHashes - Hashes of transactions that failed
    */
   handleFailedExecution(txHashes: TxHash[]): Promise<void>;

package/src/mem_pools/tx_pool_v2/tx_pool_v2_impl.ts

@@ -139,7 +139,7 @@ export class TxPoolV2Impl {
 
     // Post-event eviction rules (run after events to check ALL pending txs)
     this.#evictionManager.registerRule(new InvalidTxsAfterMiningRule());
-    this.#evictionManager.registerRule(new InsufficientFeePerGasEvictionRule(deps.blockMinFeesProvider));
+    this.#evictionManager.registerRule(new InsufficientFeePerGasEvictionRule(deps.nextBlockMinFeesProvider));
     this.#evictionManager.registerRule(new InvalidTxsAfterReorgRule(deps.worldStateSynchronizer));
     this.#evictionManager.registerRule(new FeePayerBalanceEvictionRule(deps.worldStateSynchronizer));
     // LowPriorityEvictionRule handles cases where txs become pending via prepareForSlot (unprotect)
@@ -466,27 +466,21 @@ export class TxPoolV2Impl {
     const missing: TxHash[] = [];
     let softDeletedHits = 0;
     let missingPreviouslyEvicted = 0;
+    // A soft-deleted tx is never in the indices, so every tx loaded here is resurrected below.
+    const softDeleted = await this.#loadSoftDeletedTxs(txHashes);
 
     await this.#store.transactionAsync(async () => {
       for (const txHash of txHashes) {
         const txHashStr = txHash.toString();
+        const resurrectable = softDeleted.get(txHashStr);
 
         if (this.#indices.has(txHashStr)) {
           // Update protection for existing tx
           this.#indices.updateProtection(txHashStr, slotNumber);
-        } else if (this.#deletedPool.isSoftDeleted(txHashStr)) {
-          // Resurrect soft-deleted tx as protected. Load the proof too: #addTx rewrites both entries, so re-adding
-          // a proofless tx would wipe the stored proof.
-          const buffer = await this.#txsDB.getAsync(txHashStr);
-          if (buffer) {
-            const tx = await this.#loadTxWithProof(txHashStr, buffer);
-            await this.#addTx(tx, { protected: slotNumber });
-            softDeletedHits++;
-          } else {
-            // Data missing despite soft-delete flag — treat as truly missing
-            this.#indices.setProtection(txHashStr, slotNumber);
-            missing.push(txHash);
-          }
+        } else if (resurrectable) {
+          // Resurrect soft-deleted tx as protected
+          await this.#addTx(resurrectable.tx, { protected: slotNumber }, {}, resurrectable.meta);
+          softDeletedHits++;
         } else {
           // Truly missing — pre-record protection for tx we don't have yet
           this.#indices.setProtection(txHashStr, slotNumber);
@@ -546,41 +540,56 @@ export class TxPoolV2Impl {
     const txHashes = block.body.txEffects.map(tx => tx.txHash);
     const nullifiers = block.body.txEffects.flatMap(tx => tx.nullifiers.map(n => n.toString()));
 
-    // Step 3: Collect fee payers from txs we have in the pool (for balance-based eviction)
-    const feePayers: string[] = [];
+    // A soft-deleted tx is never in the indices, so every tx loaded here is resurrected below.
+    const softDeleted = await this.#loadSoftDeletedTxs(txHashes);
     const found: TxMetaData[] = [];
-    for (const txHash of txHashes) {
-      const meta = this.#indices.getMetadata(txHash.toString());
-      if (meta) {
-        feePayers.push(meta.feePayer);
-        found.push(meta);
-      }
-    }
+    const resurrected: TxMetaData[] = [];
 
     await this.#store.transactionAsync(async () => {
-      // Step 4: Mark txs as mined (only those we have in the pool)
-      for (const meta of found) {
-        this.#indices.markAsMined(meta, blockId);
-        await this.#deletedPool.clearIfMinedHigher(meta.txHash, blockId.number);
+      // Step 3: Mark txs as mined, resurrecting soft-deleted ones. A mined tx must be kept until its block is
+      // finalized, whereas a slot-soft-deleted one is hard-deleted on the next slot.
+      for (const txHash of txHashes) {
+        const txHashStr = txHash.toString();
+        const meta = this.#indices.getMetadata(txHashStr);
+        const resurrectable = softDeleted.get(txHashStr);
+        if (meta) {
+          this.#indices.markAsMined(meta, blockId);
+          found.push(meta);
+        } else if (resurrectable) {
+          resurrected.push(await this.#addTx(resurrectable.tx, { mined: blockId }, {}, resurrectable.meta));
+        } else {
+          continue;
+        }
+        await this.#deletedPool.clearIfMinedHigher(txHashStr, blockId.number);
       }
 
-      // Step 5: Run post-event eviction rules (inside transaction for atomicity)
-      await this.#evictionManager.evictAfterNewBlock(block.header, nullifiers, feePayers);
+      // Step 4: Run post-event eviction rules (inside transaction for atomicity)
+      const feePayers = new Set([...found, ...resurrected].map(meta => meta.feePayer));
+      await this.#evictionManager.evictAfterNewBlock(block.header, nullifiers, [...feePayers]);
     });
 
-    if (found.length > 0) {
+    if (resurrected.length > 0) {
+      this.#instrumentation.recordSoftDeletedHits(resurrected.length);
+    }
+
+    if (found.length > 0 || resurrected.length > 0) {
       // receivedAt is 0 for txs hydrated from the DB on restart (true receive time lost) — leave
-      // their delay undefined so the metric isn't polluted by epoch-sized values.
+      // their delay undefined so the metric isn't polluted by epoch-sized values. A resurrected tx
+      // lost its receive time along with its metadata when it was deleted.
       const now = this.#dateProvider.now();
-      this.#callbacks.onTxsMined(
-        found.map(m => ({
+      this.#callbacks.onTxsMined([
+        ...found.map(m => ({
           txHash: m.txHash,
           minedDelayMs: m.receivedAt > 0 ? now - m.receivedAt : undefined,
         })),
-      );
+        ...resurrected.map(m => ({ txHash: m.txHash, minedDelayMs: undefined })),
+      ]);
     }
 
-    this.#log.info(`Marked ${found.length} txs as mined in block ${blockId.number}`);
+    this.#log.info(`Marked ${found.length + resurrected.length} txs as mined in block ${blockId.number}`, {
+      blockNumber: blockId.number,
+      resurrectedTxHashes: resurrected.map(m => m.txHash),
+    });
   }
 
   async prepareForSlot(slotNumber: SlotNumber): Promise<void> {
@@ -598,11 +607,14 @@ export class TxPoolV2Impl {
       const txsToRestore = this.#indices.filterRestorable(expiredProtected);
       if (txsToRestore.length === 0) {
         this.#log.debug(`Preparing for slot ${slotNumber}, no txs to unprotect`);
-        return;
+      } else {
+        this.#log.info(`Preparing for slot ${slotNumber}: unprotecting ${txsToRestore.length} txs`);
+        await this.#restoreUnprotectedToPending(txsToRestore, 'during prepareForSlot');
       }
 
-      this.#log.info(`Preparing for slot ${slotNumber}: unprotecting ${txsToRestore.length} txs`);
-      await this.#restoreUnprotectedToPending(txsToRestore, 'during prepareForSlot');
+      // Step 4: Sweep pending txs that can no longer pay the next block's fee. The fee is stable
+      // across the slot, so this runs here instead of after every mined block.
+      await this.#evictionManager.evictAfterSlotPrepared(slotNumber);
     });
   }
 
@@ -719,11 +731,24 @@ export class TxPoolV2Impl {
   }
 
   async handleFailedExecution(txHashes: TxHash[]): Promise<void> {
+    // A tx can be mined by a block that arrives while the sequencer is still executing it. A mined tx must be kept
+    // until its block is finalized, whereas deleting it could slot-soft-delete it and lose it on the next slot.
+    const toDelete: string[] = [];
+    const skippedMined: string[] = [];
+    for (const txHash of txHashes) {
+      const txHashStr = txHash.toString();
+      const isMined = this.#indices.getMetadata(txHashStr)?.minedL2BlockId !== undefined;
+      (isMined ? skippedMined : toDelete).push(txHashStr);
+    }
+
     await this.#store.transactionAsync(async () => {
-      await this.#deleteTxsBatch(txHashes.map(h => h.toString()));
+      await this.#deleteTxsBatch(toDelete);
     });
 
-    this.#log.info(`Deleted ${txHashes.length} failed txs`, { txHashes: txHashes.map(h => h.toString()) });
+    this.#log.info(`Deleted ${toDelete.length} failed txs, skipped ${skippedMined.length} already mined`, {
+      txHashes: toDelete,
+      skippedMinedTxHashes: skippedMined,
+    });
   }
 
   /**
@@ -1021,6 +1046,36 @@ export class TxPoolV2Impl {
     return meta;
   }
 
+  /**
+   * Loads the retained data of those given txs that are soft-deleted and rebuilds their metadata, so they can be
+   * re-added to the pool. Call it before the store transaction: it does all the throwable I/O, and leaves out a tx
+   * whose data is gone or unreadable, as if it were missing.
+   */
+  async #loadSoftDeletedTxs(txHashes: TxHash[]): Promise<Map<string, { tx: Tx; meta: TxMetaData }>> {
+    const loaded = new Map<string, { tx: Tx; meta: TxMetaData }>();
+    // Loaded sequentially: usually none of the given txs are soft-deleted, and each one that is costs only local reads.
+    for (const txHash of txHashes) {
+      const txHashStr = txHash.toString();
+      if (!this.#deletedPool.isSoftDeleted(txHashStr)) {
+        continue;
+      }
+      try {
+        const buffer = await this.#txsDB.getAsync(txHashStr);
+        if (!buffer) {
+          continue;
+        }
+        // Load the proof too: #addTx rewrites both entries, so re-adding a proofless tx would wipe the stored proof.
+        const tx = await this.#loadTxWithProof(txHashStr, buffer);
+        // The metadata was dropped on deletion, so recompute the setup-call flag instead of defaulting it to allowed.
+        const meta = await buildTxMetaData(tx, await this.#checkAllowedSetupCalls(tx));
+        loaded.set(txHashStr, { tx, meta });
+      } catch (err) {
+        this.#log.warn(`Failed to load soft-deleted tx ${txHashStr}`, { txHash: txHashStr, err });
+      }
+    }
+    return loaded;
+  }
+
   /**
    * Deletes a transaction from both indices and DB.
    * Emits onTxsRemoved callback immediately after DB delete.

package/src/msg_validators/attestation_validator/attestation_validator.ts

@@ -1,5 +1,4 @@
 import type { EpochCacheInterface } from '@aztec-labs/epoch-cache';
-import { NoCommitteeError } from '@aztec-labs/ethereum/contracts';
 import { type Logger, createLogger } from '@aztec-labs/foundation/log';
 import {
   type CheckpointAttestation,
@@ -11,6 +10,7 @@ import {
 } from '@aztec-labs/stdlib/p2p';
 import type { ConsensusTimetable } from '@aztec-labs/stdlib/timetable';
 
+import { mapEpochCacheLookupFailure } from '../epoch_cache_lookup.js';
 import { classifyReceiveWindowArrival } from '../receive_window.js';
 
 export class CheckpointAttestationValidator implements P2PValidator<CheckpointAttestation> {
@@ -38,26 +38,6 @@ export class CheckpointAttestationValidator implements P2PValidator<CheckpointAt
   async validate(message: CheckpointAttestation): Promise<ValidationResult> {
     const slotNumber = message.payload.header.slotNumber;
 
-    // Only the epochCache committee/proposer lookups can fail on receiver-local causes (L1 RPC down,
-    // or this node behind), and that says nothing about the relaying peer. Map such a failure to
-    // ignore rather than letting it throw, since a thrown validation defaults to reject + penalize
-    // and would punish an honest relayer for our own failure. A missing committee is still the peer's
-    // fault (they shouldn't be sending it), so it stays a reject. This is scoped to just the lookups:
-    // any other error in validation still throws and surfaces.
-    const onLookupFailure = (e: unknown): ValidationResult => {
-      if (e instanceof NoCommitteeError) {
-        this.logger.warn(`No committee exists for checkpoint attestation for slot ${slotNumber}`);
-        return { result: 'reject', severity: PeerErrorSeverity.LowToleranceError };
-      }
-      this.logger.warn(
-        `Ignoring checkpoint attestation for slot ${slotNumber} after a local committee lookup failure`,
-        {
-          error: e instanceof Error ? e.message : String(e),
-        },
-      );
-      return { result: 'ignore' };
-    };
-
     // Cross-chain replay check: reject attestations that carry a foreign signing domain.
     if (!hasValidSignatureContext(message.payload, this.signatureContext)) {
       this.logger.warn(`Rejecting checkpoint attestation with foreign signature context for slot ${slotNumber}`, {
@@ -108,7 +88,7 @@ export class CheckpointAttestationValidator implements P2PValidator<CheckpointAt
     try {
       inCommittee = await this.epochCache.isInCommittee(slotNumber, attester);
     } catch (e) {
-      return onLookupFailure(e);
+      return mapEpochCacheLookupFailure(e, this.logger, 'checkpoint attestation', slotNumber);
     }
     if (!inCommittee) {
       this.logger.warn(`Attester ${attester.toString()} is not in committee for slot ${slotNumber}`);
@@ -123,7 +103,7 @@ export class CheckpointAttestationValidator implements P2PValidator<CheckpointAt
     try {
       expectedProposer = await this.epochCache.getProposerAttesterAddressInSlot(slotNumber);
     } catch (e) {
-      return onLookupFailure(e);
+      return mapEpochCacheLookupFailure(e, this.logger, 'checkpoint attestation', slotNumber);
     }
     if (!expectedProposer) {
       this.logger.warn(`No proposer defined for slot ${slotNumber}`);

package/src/msg_validators/epoch_cache_lookup.ts

@@ -0,0 +1,33 @@
+import { NoCommitteeError } from '@aztec-labs/ethereum/contracts';
+import type { SlotNumber } from '@aztec-labs/foundation/branded-types';
+import type { Logger } from '@aztec-labs/foundation/log';
+import { PeerErrorSeverity, type ValidationResult } from '@aztec-labs/stdlib/p2p';
+
+/**
+ * Maps a failure of an epoch-cache lookup during p2p validation to a verdict, shared by the proposal
+ * and attestation validators so the "a local epoch-cache failure is never the relaying peer's fault"
+ * rule lives in one place.
+ *
+ * A missing committee (`NoCommitteeError`) is the peer's fault — they should not be sending us a
+ * proposal/attestation for a slot with no committee — so it rejects. Any other failure is
+ * receiver-local (an L1 RPC outage, or this node being behind) and says nothing about the relaying
+ * peer, so it ignores rather than penalizes. Only the local failure is warned; a missing committee is
+ * a routine peer-fault reject and needs no log line.
+ *
+ * `subject` names the gossip object for the log ("proposal" / "checkpoint attestation").
+ */
+export function mapEpochCacheLookupFailure(
+  e: unknown,
+  logger: Logger,
+  subject: string,
+  slotNumber: SlotNumber,
+): ValidationResult {
+  if (e instanceof NoCommitteeError) {
+    return { result: 'reject', severity: PeerErrorSeverity.LowToleranceError };
+  }
+  logger.warn(`Ignoring ${subject} for slot ${slotNumber} after a local epoch-cache lookup failure`, {
+    slotNumber,
+    error: e instanceof Error ? e.message : String(e),
+  });
+  return { result: 'ignore' };
+}

package/src/msg_validators/proposal_validator/README.md

@@ -28,7 +28,7 @@ Deserialization guards: `BlockProposal.fromBuffer` and `SignedTxs.fromBuffer` bo
 | # | Rule | Consequence |
 |---|------|-------------|
 | 9 | **Duplicate**: same archive root already stored | IGNORE (no penalty) |
-| 10 | **Per-position cap**: max 2 proposals per (slot, indexWithinCheckpoint) | REJECT + HighToleranceError |
+| 10 | **Per-position cap**: max 2 proposals per (slot, indexWithinCheckpoint) | IGNORE (receiver-local drop: no penalty, no re-broadcast) |
 | 11 | **Equivocation**: >1 distinct proposal for same (slot, index) | ACCEPT (rebroadcast for detection). At count=2: `duplicateProposalCallback` fires -> slash event (`OffenseType.DUPLICATE_PROPOSAL`, configured via `slashDuplicateProposalPenalty`) |
 
 ### Stage 3: Validator-Client Processing (BlockProposalHandler)
@@ -84,7 +84,7 @@ The checkpoint's embedded `lastBlock` is extracted via `getBlockProposal()` and
 | Rule | Consequence | File |
 |------|-------------|------|
 | Block proposal must pass `BlockProposalValidator.validate()` | If REJECT: entire checkpoint REJECTED | `libp2p_service.ts` |
-| Block proposal must not exceed per-position cap (2) | Checkpoint REJECTED + HighToleranceError | same |
+| Block proposal must not exceed per-position cap (2) | Checkpoint IGNORED (terminal block dropped as a receiver-local drop: no store, no re-broadcast, no penalty) | same |
 | Block equivocation detected (>1 proposals for same slot+index) | Checkpoint REJECTED (block itself is ACCEPT for re-broadcast) | same |
 
 ### Stage 3: Mempool (Attestation Pool)
@@ -92,7 +92,7 @@ The checkpoint's embedded `lastBlock` is extracted via `getBlockProposal()` and
 | Rule | Consequence | File |
 |------|-------------|------|
 | Duplicate (same archive ID) | IGNORE (no penalty). Embedded block still processed if valid. | `attestation_pool.ts` |
-| Per-slot cap: `MAX_CHECKPOINT_PROPOSALS_PER_SLOT` = 2 | REJECT + HighToleranceError. Embedded block still processed. | same |
+| Per-slot cap: `MAX_CHECKPOINT_PROPOSALS_PER_SLOT` = 2 | IGNORE (receiver-local drop: no penalty, no re-broadcast). Embedded block still processed. | same |
 
 ### Stage 4: Equivocation Detection
 

package/src/msg_validators/proposal_validator/proposal_validator.ts

@@ -1,5 +1,4 @@
 import type { EpochCacheInterface } from '@aztec-labs/epoch-cache';
-import { NoCommitteeError } from '@aztec-labs/ethereum/contracts';
 import { type Logger, createLogger } from '@aztec-labs/foundation/log';
 import { MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT, MAX_TXS_PER_CHECKPOINT } from '@aztec-labs/stdlib/deserialization';
 import {
@@ -12,6 +11,7 @@ import {
 } from '@aztec-labs/stdlib/p2p';
 import type { ConsensusTimetable } from '@aztec-labs/stdlib/timetable';
 
+import { mapEpochCacheLookupFailure } from '../epoch_cache_lookup.js';
 import { classifyReceiveWindowArrival } from '../receive_window.js';
 
 /** Validates header-level and tx-level fields of block and checkpoint proposals. */
@@ -50,91 +50,92 @@ export class ProposalValidator {
 
   /** Validates header-level fields: slot, signature, and proposer. */
   public async validate(proposal: BlockProposal | CheckpointProposalCore): Promise<ValidationResult> {
-    try {
-      // Cross-chain replay check: reject proposals that carry a foreign signing domain.
-      if (!hasValidSignatureContext(proposal, this.signatureContext)) {
-        this.logger.warn(`Penalizing peer for proposal with foreign signature context`, {
-          chainId: proposal.signatureContext.chainId,
-          rollupAddress: proposal.signatureContext.rollupAddress.toString(),
-          expectedChainId: this.signatureContext.chainId,
-          expectedRollupAddress: this.signatureContext.rollupAddress.toString(),
-        });
-        return { result: 'reject', severity: PeerErrorSeverity.LowToleranceError };
-      }
+    // Cross-chain replay check: reject proposals that carry a foreign signing domain.
+    if (!hasValidSignatureContext(proposal, this.signatureContext)) {
+      this.logger.warn(`Penalizing peer for proposal with foreign signature context`, {
+        chainId: proposal.signatureContext.chainId,
+        rollupAddress: proposal.signatureContext.rollupAddress.toString(),
+        expectedChainId: this.signatureContext.chainId,
+        expectedRollupAddress: this.signatureContext.rollupAddress.toString(),
+      });
+      return { result: 'reject', severity: PeerErrorSeverity.LowToleranceError };
+    }
 
-      // Slot check: the tight checkpoint proposal receive window (`[receiveStart - δ, target_slot_start -
-      // E - D + δ]`) is the sole acceptance gate, applied to both block and checkpoint proposals. The
-      // window itself bounds which slots are valid, so far/wrong slots fall outside it. Every block
-      // proposal for slot N is sent before the checkpoint proposal for slot N, so nothing legitimate can
-      // arrive after the checkpoint receive deadline; gating block proposals on the same window rejects
-      // late block proposals at p2p ingress. The attestation deadline remains their re-execution/
-      // validation deadline downstream, not their arrival gate.
-      const slotNumber = proposal.slotNumber;
-      if (!this.skipSlotValidation) {
-        // Proposal receive window: [checkpoint_proposal_receive_start, checkpoint_proposal_receive_deadline],
-        // widened by the configured clock-disparity tolerance on both ends.
-        const startSeconds = this.timetable.getCheckpointProposalReceiveStart(slotNumber);
-        const deadlineSeconds = this.timetable.getCheckpointProposalReceiveDeadline(slotNumber);
-        const nowMs = Number(this.epochCache.getEpochAndSlotNow().nowMs);
-        const windowMiss = classifyReceiveWindowArrival(
-          nowMs,
-          startSeconds * 1000 - this.clockDisparityMs,
-          deadlineSeconds * 1000 + this.clockDisparityMs,
+    // Slot check: the tight checkpoint proposal receive window (`[receiveStart - δ, target_slot_start -
+    // E - D + δ]`) is the sole acceptance gate, applied to both block and checkpoint proposals. The
+    // window itself bounds which slots are valid, so far/wrong slots fall outside it. Every block
+    // proposal for slot N is sent before the checkpoint proposal for slot N, so nothing legitimate can
+    // arrive after the checkpoint receive deadline; gating block proposals on the same window rejects
+    // late block proposals at p2p ingress. The attestation deadline remains their re-execution/
+    // validation deadline downstream, not their arrival gate.
+    const slotNumber = proposal.slotNumber;
+    if (!this.skipSlotValidation) {
+      // Proposal receive window: [checkpoint_proposal_receive_start, checkpoint_proposal_receive_deadline],
+      // widened by the configured clock-disparity tolerance on both ends.
+      const startSeconds = this.timetable.getCheckpointProposalReceiveStart(slotNumber);
+      const deadlineSeconds = this.timetable.getCheckpointProposalReceiveDeadline(slotNumber);
+      const nowMs = Number(this.epochCache.getEpochAndSlotNow().nowMs);
+      const windowMiss = classifyReceiveWindowArrival(
+        nowMs,
+        startSeconds * 1000 - this.clockDisparityMs,
+        deadlineSeconds * 1000 + this.clockDisparityMs,
+      );
+      if (windowMiss) {
+        this.logger.warn(
+          `Proposal for slot ${slotNumber} is outside its receive window (${windowMiss.outcome.result})`,
+          {
+            slotNumber,
+            nowMs,
+            missMs: windowMiss.missMs,
+            windowStartSeconds: startSeconds,
+            windowDeadlineSeconds: deadlineSeconds,
+          },
         );
-        if (windowMiss) {
-          this.logger.warn(
-            `Proposal for slot ${slotNumber} is outside its receive window (${windowMiss.outcome.result})`,
-            {
-              slotNumber,
-              nowMs,
-              missMs: windowMiss.missMs,
-              windowStartSeconds: startSeconds,
-              windowDeadlineSeconds: deadlineSeconds,
-            },
-          );
-          return windowMiss.outcome;
-        }
-      }
-
-      // Signature validity
-      const proposer = proposal.getSender();
-      if (!proposer) {
-        this.logger.warn(`Penalizing peer for proposal with invalid signature`);
-        return { result: 'reject', severity: PeerErrorSeverity.MidToleranceError };
+        return windowMiss.outcome;
       }
+    }
 
-      // An undefined proposer means an empty committee (anyone may propose), so skip the
-      // proposer-equality check and keep validating. A missing committee instead throws
-      // NoCommitteeError, handled as a reject below.
-      const expectedProposer = await this.epochCache.getProposerAttesterAddressInSlot(slotNumber);
-      if (expectedProposer !== undefined && !proposer.equals(expectedProposer)) {
-        this.logger.warn(`Penalizing peer for invalid proposer for current slot ${slotNumber}`, {
-          expectedProposer,
-          proposer: proposer.toString(),
-        });
-        return { result: 'reject', severity: PeerErrorSeverity.MidToleranceError };
-      }
+    // Signature validity
+    const proposer = proposal.getSender();
+    if (!proposer) {
+      this.logger.warn(`Penalizing peer for proposal with invalid signature`);
+      return { result: 'reject', severity: PeerErrorSeverity.MidToleranceError };
+    }
 
-      // A block proposal whose index lands at or beyond the hard attestable ceiling is structurally
-      // impossible garbage, so reject it immediately at ingress. Indices in
-      // `[maxBlocksPerCheckpoint, MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT)` are over the consensus limit
-      // but structurally valid proposer misbehavior; they pass gossip validation here so the offending
-      // proposal can be retained and re-broadcast as slashing evidence (handled downstream in the p2p
-      // service), rather than penalizing the relaying peer.
-      if ('indexWithinCheckpoint' in proposal) {
-        const indexResult = this.validateBlockIndexWithinCheckpoint(proposal);
-        if (indexResult.result !== 'accept') {
-          return indexResult;
-        }
+    // A block proposal whose index lands at or beyond the hard attestable ceiling is structurally
+    // impossible garbage, so reject it immediately at ingress. This is peer-attributable and needs no
+    // epoch-cache lookup, so it runs before the proposer lookup: a structurally-invalid index must be
+    // rejected even when a local lookup fails. Indices in
+    // `[maxBlocksPerCheckpoint, MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT)` are over the consensus limit
+    // but structurally valid proposer misbehavior; they pass gossip validation here so the offending
+    // proposal can be retained and re-broadcast as slashing evidence (handled downstream in the p2p
+    // service), rather than penalizing the relaying peer.
+    if ('indexWithinCheckpoint' in proposal) {
+      const indexResult = this.validateBlockIndexWithinCheckpoint(proposal);
+      if (indexResult.result !== 'accept') {
+        return indexResult;
       }
+    }
 
-      return { result: 'accept' };
+    // An undefined proposer means an empty committee (anyone may propose), so skip the
+    // proposer-equality check and keep validating. Only this lookup can fail on a receiver-local
+    // cause (L1 RPC down, or this node behind); mapEpochCacheLookupFailure ignores that (it is not the
+    // relaying peer's fault) and rejects a missing committee (which is).
+    let expectedProposer;
+    try {
+      expectedProposer = await this.epochCache.getProposerAttesterAddressInSlot(slotNumber);
     } catch (e) {
-      if (e instanceof NoCommitteeError) {
-        return { result: 'reject', severity: PeerErrorSeverity.LowToleranceError };
-      }
-      throw e;
+      return mapEpochCacheLookupFailure(e, this.logger, 'proposal', slotNumber);
     }
+    if (expectedProposer !== undefined && !proposer.equals(expectedProposer)) {
+      this.logger.warn(`Penalizing peer for invalid proposer for current slot ${slotNumber}`, {
+        expectedProposer,
+        proposer: proposer.toString(),
+      });
+      return { result: 'reject', severity: PeerErrorSeverity.MidToleranceError };
+    }
+
+    return { result: 'accept' };
   }
 
   /**

package/src/msg_validators/tx_validator/README.md

@@ -22,12 +22,14 @@ Unsolicited transactions from any peer. Fully validated in two stages with a poo
 
 | Step | What runs | On failure |
 |------|-----------|------------|
-| **Stage 1** (fast) | TxPermitted, Data, Metadata, Timestamp, DoubleSpend, MinGasLimits, MaxGasLimits, Gas, Phases, BlockHeader | Penalize peer, reject tx |
+| **Stage 1** (fast) | TxPermitted, Data, Metadata, Timestamp, DoubleSpend, MinGasLimits, MaxGasLimits, MaxFeePerGas, MaxFeePerGasFloor, FeePayerBalance, Phases, BlockHeader | Penalize peer, reject tx (except MaxFeePerGas: ignore tx, no penalty) |
 | **Pool pre-check** | `canAddPendingTx` — checks for duplicates, pool capacity | Ignore tx (no penalty) |
 | **Stage 2** (slow) | Proof verification | Penalize peer, reject tx |
 | **Pool add** | `addPendingTxs` | Accept, ignore, or reject |
 
-Each stage-1 and stage-2 validator is paired with a `PeerErrorSeverity`. If a validator fails, the sending peer is penalized with that severity. The `doubleSpendValidator` has special handling: its severity is determined by how recently the nullifier appeared (recent = high tolerance, old = low tolerance).
+Each stage-1 and stage-2 validator is paired with a `PeerErrorSeverity`, and the sending peer is penalized with that severity when it fails. When several validators fail, the harshest consequence wins. The `doubleSpendValidator` has special handling: its severity is determined by how recently the nullifier appeared (recent = high tolerance, old = low tolerance).
+
+`maxFeePerGasValidator` is the exception, marked `IgnoreWithoutPenalty`: a tx below this node's admission fee (the next-block fee, or the L1-forward fee while the next block cannot be priced) may be perfectly valid for a peer ahead of us, so it is dropped without propagating and the peer keeps its score. That excuse stops at a penalty floor, half the lower of the admission and L1-forward fees: `maxFeePerGasFloorValidator` checks it with a mid-tolerance penalty. The slack covers a peer that has seen a checkpoint we have not, or a fresher L1 block, while zero-fee and negligible-fee spam still costs the sender. Being the mildest consequence, the ignore never masks a penalized failure on the same tx — which is also why the fee-payer balance check is a separate entry (`feePayerBalanceValidator`) that stays penalized.
 
 ### 2. JSON-RPC
 
@@ -96,10 +98,11 @@ The `AllowedSetupCallsMetaValidator` checks a precomputed boolean flag (`TxMetaD
 | `MetadataTxValidator` | Chain ID, rollup version, protocol contracts hash, VK tree root | 4.18 us |
 | `TimestampTxValidator` | Transaction has not expired (expiration timestamp vs next slot) | 1.56 us |
 | `DoubleSpendTxValidator` | Nullifiers do not already exist in the nullifier tree | 106.08 us |
-| `GasTxValidator` | Max fee per gas meets current block fees (delegates to `MaxFeePerGasValidator`), and fee payer has sufficient FeeJuice balance | 1.02 ms |
+| `GasTxValidator` | Max fee per gas meets current block fees (delegates to `MaxFeePerGasValidator`), and fee payer has sufficient FeeJuice balance (delegates to `FeePayerBalanceValidator`) | 1.02 ms |
+| `FeePayerBalanceValidator` | Fee payer's FeeJuice balance, plus any setup-phase claim, covers the tx's fee limit. Used standalone in gossip, alongside `MaxFeePerGasValidator`; also called internally by `GasTxValidator` | ~1 ms |
 | `MinGasLimitsValidator` | Gas limits are >= the fixed protocol overheads. Applies on every entry point, with no exemptions | 3–10 us |
 | `MaxGasLimitsValidator` | Gas limits are <= AVM max processable L2 gas (optionally clamped further by network admission limits). Exempted on the gas estimation path | 3–10 us |
-| `MaxFeePerGasValidator` | Max fee per gas >= current block gas fees on both dimensions (DA and L2). Used standalone in pool migration; also called internally by `GasTxValidator` | 3–10 us |
+| `MaxFeePerGasValidator` | Max fee per gas >= current block gas fees on both dimensions (DA and L2). Used standalone in pool migration and in gossip; also called internally by `GasTxValidator` | 3–10 us |
 | `PhasesTxValidator` | Public function calls in setup phase are on the allow list | 10.12–13.12 us |
 | `AllowedSetupCallsMetaValidator` | Checks the precomputed `allowedSetupCalls` flag on `TxMetaData`. Used in pool migration instead of the full `PhasesTxValidator` | — |
 | `BlockHeaderTxValidator` | Transaction's anchor block hash exists in the archive tree | 98.88 us |
@@ -115,16 +118,17 @@ The `AllowedSetupCallsMetaValidator` checks a precomputed boolean flag (`TxMetaD
 | Metadata | Stage 1 | Yes | Yes | — | — |
 | Timestamp | Stage 1 | Yes | — | Yes | Yes |
 | DoubleSpend | Stage 1 | Yes | — | Yes | Yes |
-| Gas (fee balance) | Stage 1 | Optional* | — | Yes | — |
+| Gas (fee balance) | — | Optional* | — | Yes | — |
 | MinGasLimits | Stage 1 | Yes | — | Yes | Yes |
 | MaxGasLimits | Stage 1 | Yes*** | — | Yes | Yes |
-| MaxFeePerGas (standalone) | — | — | — | — | Yes |
+| MaxFeePerGas (standalone) | Stage 1 | — | — | — | Yes |
+| FeePayerBalance (standalone) | Stage 1 | — | — | — | — |
 | Phases | Stage 1 | Yes | — | Yes | — |
 | AllowedSetupCalls | — | — | — | — | Yes |
 | BlockHeader | Stage 1 | Yes | — | Yes | Yes |
 | Proof | Stage 2 | Optional** | Yes | — | — |
 
-\* Gas balance check is skipped when `skipFeeEnforcement` is set (testing/dev). `GasTxValidator` internally delegates to `MaxFeePerGasValidator` as its first step, so fee-per-gas is checked wherever `GasTxValidator` runs. Pool migration uses `MaxFeePerGasValidator` standalone because it doesn't need the balance check. Declared gas-limit validation is owned solely by `MinGasLimitsValidator` and `MaxGasLimitsValidator`.
+\* Gas balance check is skipped when `skipFeeEnforcement` is set (testing/dev). `GasTxValidator` internally delegates to `MaxFeePerGasValidator` as its first step, so fee-per-gas is checked wherever `GasTxValidator` runs. Gossip runs both halves standalone instead, so each can carry its own peer penalty. Pool migration uses `MaxFeePerGasValidator` standalone because it doesn't need the balance check. Declared gas-limit validation is owned solely by `MinGasLimitsValidator` and `MaxGasLimitsValidator`.
 \** Proof verification is skipped for simulations (no verifier provided).
 \*** Only the ceiling is skipped for simulations: gas estimation submits limits above the per-tx maximum, and the wallet clamps the real tx to the admission limit afterward. The floor still applies, since a tx below it can never be mined.
 
@@ -132,6 +136,6 @@ The gas-limit bounds `MaxGasLimitsValidator` enforces here — the per-tx protoc
 
 ## Fee-Per-Gas Rejection Strategy
 
-The `MaxFeePerGasValidator` and `InsufficientFeePerGasEvictionRule` reject and evict transactions whose `maxFeesPerGas` falls below the current block's gas fees. This is a simple strategy: if a tx can't pay the current fees, it gets rejected on entry and evicted after each new block.
+The `MaxFeePerGasValidator` and `InsufficientFeePerGasEvictionRule` reject and evict transactions whose `maxFeesPerGas` falls below the fee the next block will charge. Admission falls back to the L1-forward fee while the next block cannot be priced; eviction only acts on the exact next-block fee and skips its sweep otherwise. This is a simple strategy: if a tx can't pay the current fees, it gets rejected on entry and evicted when the node prepares for the next slot.
 
 **Caveat**: This may evict transactions that would become valid again if block fees drop. A more nuanced approach would be to define a threshold (e.g., 50%) and only reject/evict when the tx's max fee falls below that fraction of the current fees. The current approach is simpler and ensures the pool doesn't accumulate transactions with low max fees that are unlikely to be mined soon.

package/src/msg_validators/tx_validator/data_validator.ts

@@ -121,12 +121,13 @@ export class DataTxValidator implements TxValidator<Tx> {
         }
       }
 
-      const expectedMinLength = 1 + tx.contractClassLogFields[i].fields.findLastIndex(f => !f.isZero());
-      if (logHash.logHash.length < expectedMinLength) {
+      // The tx base requires exactly the trimmed length; any other length makes the tx unprovable.
+      const expectedLength = 1 + tx.contractClassLogFields[i].fields.findLastIndex(f => !f.isZero());
+      if (logHash.logHash.length !== expectedLength) {
         this.#log.verbose(
           `Rejecting tx ${tx
             .getTxHash()
-            .toString()} because of incorrect contract class log length. Expected the length to be at least ${expectedMinLength}. Got ${
+            .toString()} because of incorrect contract class log length. Expected ${expectedLength}. Got ${
             logHash.logHash.length
           }.`,
         );