@aztec-labs/p2p 6.0.0-rc.1 → 6.0.0-rc.3

package/src/msg_validators/tx_validator/factory.ts

@@ -36,7 +36,7 @@ import { getVKTreeRoot } from '@aztec-labs/noir-protocol-circuits-types/vk-tree'
 import { ProtocolContractAddress, protocolContractsHash } from '@aztec-labs/protocol-contracts';
 import type { BlockHash } from '@aztec-labs/stdlib/block';
 import type { ContractDataSource } from '@aztec-labs/stdlib/contract';
-import type { GasFees } from '@aztec-labs/stdlib/gas';
+import { GasFees } from '@aztec-labs/stdlib/gas';
 import type {
   AllowedElement,
   ClientProtocolCircuitVerifier,
@@ -58,7 +58,7 @@ import { ContractInstanceTxValidator } from './contract_instance_validator.js';
 import { DataTxValidator } from './data_validator.js';
 import { DoubleSpendTxValidator, type NullifierSource } from './double_spend_validator.js';
 import { MaxGasLimitsValidator, MinGasLimitsValidator } from './gas_limits_validator.js';
-import { GasTxValidator, MaxFeePerGasValidator } from './gas_validator.js';
+import { FeePayerBalanceValidator, GasTxValidator, MaxFeePerGasValidator } from './gas_validator.js';
 import { MetadataTxValidator } from './metadata_validator.js';
 import { NullifierCache } from './nullifier_cache.js';
 import { AllowedSetupCallsMetaValidator, PhasesTxValidator } from './phases_validator.js';
@@ -69,22 +69,55 @@ import { TxProofValidator } from './tx_proof_validator.js';
 import { TxValidationCache } from './tx_validation_cache.js';
 
 /**
- * A validator paired with a peer penalty severity.
- * Used for gossip validation where each validator's failure triggers a peer penalization
- * with the associated severity level.
+ * Marks a gossip validator whose failure is not attributable to the sending peer: the tx is dropped without
+ * being added to the pool or propagated, and the peer's score is left alone.
  */
-export interface TransactionValidator {
+export const IgnoreWithoutPenalty = 'ignore-without-penalty';
+
+/**
+ * Consequence of a gossip validator failing: the sending peer is penalized with this severity, unless the
+ * failure is local policy rather than peer misbehavior, in which case it is {@link IgnoreWithoutPenalty}.
+ */
+export type GossipValidationFailure = PeerErrorSeverity | typeof IgnoreWithoutPenalty;
+
+/**
+ * The fees a gossiped tx is checked against. A tx below `admission` is not relayed. A tx below `penaltyFloor` as
+ * well is priced lower than any view of the chain this node considers plausible, so its sender is penalized.
+ * `penaltyFloor` is never above `admission`.
+ */
+export type GossipMinFees = { admission: GasFees; penaltyFloor: GasFees };
+
+/**
+ * Fraction of the lower of the admission and L1-forward fees below which a gossiped tx gets its sender penalized.
+ * A peer can legitimately price the next block below both: one that has seen a checkpoint this node has not can
+ * see the congestion fee drop, and the L1 gas components move with every L1 block. Halving leaves room for
+ * several such steps while still penalizing zero-fee and negligible-fee spam.
+ */
+export const GOSSIP_FEE_PENALTY_FLOOR_FRACTION = 0.5;
+
+/** Derives the gossip fee thresholds from this node's admission fee and its L1-forward fee. */
+export function computeGossipMinFees(admission: GasFees, l1Forward: GasFees): GossipMinFees {
+  return { admission, penaltyFloor: GasFees.min(admission, l1Forward).mul(GOSSIP_FEE_PENALTY_FLOOR_FRACTION) };
+}
+
+/**
+ * A validator paired with the consequence of its failure.
+ * Used for gossip validation where each validator's failure triggers a peer penalization with the associated
+ * severity level. Only stages that can also fail on local policy widen `F` to include
+ * {@link IgnoreWithoutPenalty}.
+ */
+export interface TransactionValidator<F extends GossipValidationFailure = PeerErrorSeverity> {
   validator: {
     validateTx(tx: Tx): Promise<TxValidationResult>;
   };
-  severity: PeerErrorSeverity;
+  severity: F;
 }
 
 /**
  * First stage of gossip validation — fast checks run before the pool pre-check.
  *
- * If any validator fails, the peer is penalized and the tx is rejected immediately,
- * without consulting the pool or running proof verification.
+ * If any validator fails, the tx is rejected immediately, without consulting the pool or running proof
+ * verification. The peer is penalized unless the only failures are marked {@link IgnoreWithoutPenalty}.
  *
  * The `doubleSpendValidator` failure is special-cased by the caller (`handleGossipedTx`)
  * to determine severity based on how recently the nullifier appeared. The caller reports the
@@ -94,7 +127,7 @@ export function createFirstStageTxValidationsForGossipedTransactions(
   timestamp: UInt64,
   blockNumber: BlockNumber,
   worldStateSynchronizer: WorldStateSynchronizer,
-  gasFees: GasFees,
+  gasFees: GossipMinFees,
   l1ChainId: number,
   rollupVersion: number,
   protocolContractsHash: Fr,
@@ -103,7 +136,7 @@ export function createFirstStageTxValidationsForGossipedTransactions(
   allowedInSetup: AllowedElement[] = [],
   bindings?: LoggerBindings,
   gasLimitOpts?: { maxTxL2Gas?: number; maxTxDAGas?: number },
-): Record<string, TransactionValidator> {
+): Record<string, TransactionValidator<GossipValidationFailure>> {
   const merkleTree = worldStateSynchronizer.getCommitted();
 
   return {
@@ -166,11 +199,24 @@ export function createFirstStageTxValidationsForGossipedTransactions(
       validator: new MaxGasLimitsValidator<Tx>({ ...gasLimitOpts, bindings }),
       severity: PeerErrorSeverity.MidToleranceError,
     },
-    gasValidator: {
-      validator: new GasTxValidator(
+    // The max-fee comparisons and the fee-payer balance check are separate entries because their failures mean
+    // different things. A tx below our admission fee is only invalid against a fee this node resolved: a peer
+    // ahead of us may be relaying against a lower checkpoint fee it legitimately sees, so the tx is dropped
+    // without penalizing the sender. That excuse only stretches down to the penalty floor, so a tx below it fails
+    // both entries and the harshest failure wins. An underfunded fee payer is invalid against shared state, so
+    // it stays penalized.
+    maxFeePerGasValidator: {
+      validator: new MaxFeePerGasValidator<Tx>(gasFees.admission, bindings),
+      severity: IgnoreWithoutPenalty,
+    },
+    maxFeePerGasFloorValidator: {
+      validator: new MaxFeePerGasValidator<Tx>(gasFees.penaltyFloor, bindings),
+      severity: PeerErrorSeverity.MidToleranceError,
+    },
+    feePayerBalanceValidator: {
+      validator: new FeePayerBalanceValidator(
         new DatabasePublicStateSource(merkleTree),
         ProtocolContractAddress.FeeJuice,
-        gasFees,
         bindings,
       ),
       severity: PeerErrorSeverity.MidToleranceError,

package/src/msg_validators/tx_validator/gas_validator.ts

@@ -72,52 +72,25 @@ export class MaxFeePerGasValidator<T extends HasMaxFeePerGasData> implements TxV
 }
 
 /**
- * Validates that a transaction can pay its gas fees.
- *
- * Runs two checks in order:
- * 1. **Max fee per gas** (delegates to {@link MaxFeePerGasValidator}) — rejects the tx if its
- *    maxFeesPerGas is below the current block's gas fees.
- * 2. **Fee payer balance** — reads the fee payer's FeeJuice balance from public state,
- *    adds any pending claim from a setup-phase `_increase_public_balance` call, and
- *    rejects if the total is less than the tx's fee limit (gasLimits * maxFeePerGas).
- *
- * Gas limits are deliberately not checked here: they are owned by {@link MinGasLimitsValidator} and
- * {@link MaxGasLimitsValidator}, which factories include separately so that exemptions (e.g. gas estimation)
- * don't change fee enforcement.
+ * Validates that a transaction's fee payer can cover its fee limit: reads the fee payer's FeeJuice balance from
+ * public state, adds any pending claim from a setup-phase `_increase_public_balance` call, and rejects if the total
+ * is less than the tx's fee limit (gasLimits * maxFeePerGas).
  *
- * Used by: gossip (stage 1), RPC, and block building validators.
+ * Does not check max fee per gas against any fee: a tx with zero max fees has a zero fee limit and passes here with
+ * no balance, so every caller must also run a {@link MaxFeePerGasValidator}, as {@link GasTxValidator} does.
  */
-export class GasTxValidator implements TxValidator<Tx> {
+export class FeePayerBalanceValidator implements TxValidator<Tx> {
   #log: Logger;
   #publicDataSource: PublicStateSource;
   #feeJuiceAddress: AztecAddress;
-  #maxFeePerGasValidator: MaxFeePerGasValidator<Tx>;
 
-  constructor(
-    publicDataSource: PublicStateSource,
-    feeJuiceAddress: AztecAddress,
-    gasFees: GasFees,
-    bindings?: LoggerBindings,
-  ) {
+  constructor(publicDataSource: PublicStateSource, feeJuiceAddress: AztecAddress, bindings?: LoggerBindings) {
     this.#log = createLogger('sequencer:tx_validator:tx_gas', bindings);
     this.#publicDataSource = publicDataSource;
     this.#feeJuiceAddress = feeJuiceAddress;
-    this.#maxFeePerGasValidator = new MaxFeePerGasValidator(gasFees, bindings);
   }
 
   async validateTx(tx: Tx): Promise<TxValidationResult> {
-    const maxFeeValidation = this.#maxFeePerGasValidator.validateMaxFeePerGas(tx);
-    if (maxFeeValidation.result === 'invalid') {
-      return maxFeeValidation;
-    }
-    return await this.validateTxFee(tx);
-  }
-
-  /**
-   * Checks the fee payer has enough FeeJuice balance to cover the tx's fee limit.
-   * Accounts for any pending claim from a setup-phase `_increase_public_balance` call.
-   */
-  public async validateTxFee(tx: Tx): Promise<TxValidationResult> {
     const feePayer = tx.data.feePayer;
 
     // Compute the maximum fee that this tx may pay, based on its gasLimits and maxFeePerGas
@@ -147,3 +120,42 @@ export class GasTxValidator implements TxValidator<Tx> {
     return { result: 'valid' };
   }
 }
+
+/**
+ * Validates that a transaction can pay its gas fees.
+ *
+ * Runs two checks in order:
+ * 1. **Max fee per gas** (delegates to {@link MaxFeePerGasValidator}) — rejects the tx if its
+ *    maxFeesPerGas is below the current block's gas fees.
+ * 2. **Fee payer balance** (delegates to {@link FeePayerBalanceValidator}) — rejects if the fee payer cannot
+ *    cover the tx's fee limit (gasLimits * maxFeePerGas).
+ *
+ * Gas limits are deliberately not checked here: they are owned by {@link MinGasLimitsValidator} and
+ * {@link MaxGasLimitsValidator}, which factories include separately so that exemptions (e.g. gas estimation)
+ * don't change fee enforcement.
+ *
+ * Used by: RPC and block building validators. Gossip runs the two checks as separate entries, since their
+ * failures carry different peer penalties.
+ */
+export class GasTxValidator implements TxValidator<Tx> {
+  #maxFeePerGasValidator: MaxFeePerGasValidator<Tx>;
+  #feePayerBalanceValidator: FeePayerBalanceValidator;
+
+  constructor(
+    publicDataSource: PublicStateSource,
+    feeJuiceAddress: AztecAddress,
+    gasFees: GasFees,
+    bindings?: LoggerBindings,
+  ) {
+    this.#maxFeePerGasValidator = new MaxFeePerGasValidator(gasFees, bindings);
+    this.#feePayerBalanceValidator = new FeePayerBalanceValidator(publicDataSource, feeJuiceAddress, bindings);
+  }
+
+  async validateTx(tx: Tx): Promise<TxValidationResult> {
+    const maxFeeValidation = this.#maxFeePerGasValidator.validateMaxFeePerGas(tx);
+    if (maxFeeValidation.result === 'invalid') {
+      return maxFeeValidation;
+    }
+    return await this.#feePayerBalanceValidator.validateTx(tx);
+  }
+}

package/src/services/discv5/discV5_service.ts

@@ -10,7 +10,7 @@ import { Discv5, type Discv5EventEmitter, type IDiscv5CreateOptions } from '@net
 import { ENR, SignableENR } from '@nethermindeth/enr';
 import EventEmitter from 'events';
 
-import type { P2PConfig } from '../../config.js';
+import { DISCV5_RATE_LIMITER_OPTS, type P2PConfig } from '../../config.js';
 import { createNodeENR } from '../../enr/generate-enr.js';
 import { AZTEC_ENR_KEY, Discv5Event, PeerEvent } from '../../types/index.js';
 import { convertToMultiaddr } from '../../util.js';
@@ -126,6 +126,7 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
         ...configOverrides.config,
       },
       metricsRegistry,
+      rateLimiterOpts: DISCV5_RATE_LIMITER_OPTS,
     });
 
     // Hook onto the onEstablished method to check the peer's version from the ENR,

package/src/services/libp2p/libp2p_service.ts

@@ -9,7 +9,7 @@ import { protocolContractsHash } from '@aztec-labs/protocol-contracts';
 import type { EthAddress, L2BlockSource } from '@aztec-labs/stdlib/block';
 import { DEFAULT_MAX_BLOCKS_PER_CHECKPOINT } from '@aztec-labs/stdlib/config';
 import type { ContractDataSource } from '@aztec-labs/stdlib/contract';
-import { type BlockMinFeesProvider, GasFees, getNetworkTxGasLimits } from '@aztec-labs/stdlib/gas';
+import { type TxAdmissionMinFeesProvider, getNetworkTxGasLimits } from '@aztec-labs/stdlib/gas';
 import type {
   ClientProtocolCircuitVerifier,
   P2PConnectivity,
@@ -77,7 +77,11 @@ import {
 } from '../../msg_validators/index.js';
 import { MessageSeenValidator } from '../../msg_validators/msg_seen_validator/msg_seen_validator.js';
 import {
+  type GossipMinFees,
+  type GossipValidationFailure,
+  IgnoreWithoutPenalty,
   type TransactionValidator,
+  computeGossipMinFees,
   createFirstStageTxValidationsForGossipedTransactions,
   createSecondStageTxValidationsForGossipedTransactions,
   createTxValidatorForBlockProposalReceivedTxs,
@@ -143,13 +147,21 @@ function buildConsensusTimetable(
   });
 }
 
-interface ValidationResult {
+interface ValidationResult<F extends GossipValidationFailure> {
   name: string;
   isValid: TxValidationResult;
-  severity: PeerErrorSeverity;
+  severity: F;
 }
 
-type ValidationOutcome = { allPassed: true } | { allPassed: false; failure: ValidationResult };
+/**
+ * Failure consequences ordered from mildest to harshest, so the outcome of a stage is the harshest failure it
+ * produced. A penalty-free ignore is the mildest: any penalized failure on the same tx wins over it.
+ */
+const GossipValidationFailureByHarshness = [IgnoreWithoutPenalty, ...PeerErrorSeverityByHarshness] as const;
+
+type ValidationOutcome<F extends GossipValidationFailure> =
+  | { allPassed: true }
+  | { allPassed: false; failure: ValidationResult<F> };
 
 // REFACTOR: Unify with the type above
 type ReceivedMessageValidationResult<T, M = undefined> =
@@ -229,7 +241,7 @@ export class LibP2PService extends WithTracer implements P2PService {
     private epochCache: EpochCacheInterface,
     private proofVerifier: ClientProtocolCircuitVerifier,
     private worldStateSynchronizer: WorldStateSynchronizer,
-    private blockMinFeesProvider: BlockMinFeesProvider,
+    private nextBlockMinFeesProvider: TxAdmissionMinFeesProvider,
     telemetry: TelemetryClient,
     logger: Logger = createLogger('p2p:libp2p_service'),
     private txValidationCache?: TxValidationCache,
@@ -345,7 +357,7 @@ export class LibP2PService extends WithTracer implements P2PService {
       proofVerifier: ClientProtocolCircuitVerifier;
       worldStateSynchronizer: WorldStateSynchronizer;
       peerStore: AztecAsyncKVStore;
-      blockMinFeesProvider: BlockMinFeesProvider;
+      nextBlockMinFeesProvider: TxAdmissionMinFeesProvider;
       telemetry: TelemetryClient;
       logger: Logger;
       packageVersion: string;
@@ -359,7 +371,7 @@ export class LibP2PService extends WithTracer implements P2PService {
       mempools,
       proofVerifier,
       peerStore,
-      blockMinFeesProvider,
+      nextBlockMinFeesProvider,
       telemetry,
       logger,
       packageVersion,
@@ -587,7 +599,7 @@ export class LibP2PService extends WithTracer implements P2PService {
       epochCache,
       proofVerifier,
       worldStateSynchronizer,
-      blockMinFeesProvider,
+      nextBlockMinFeesProvider,
       telemetry,
       logger,
       txValidationCache,
@@ -1121,6 +1133,12 @@ export class LibP2PService extends WithTracer implements P2PService {
         return { result: TopicValidatorResult.Reject, severity: PeerErrorSeverity.LowToleranceError };
       }
 
+      // Dedup on already-accepted content before validation: a tx hash already in the pool has been
+      // validated, so a re-encoded copy carries no new work and is ignored without running the stages.
+      if ((await this.mempools.txPool.hasTxs([tx.getTxHash()]))[0]) {
+        return { result: TopicValidatorResult.Ignore, obj: tx };
+      }
+
       // Stage 1 setup: chain tip, epoch info, gas fees, and L1 constants reads
       const { currentBlockNumber, firstStageValidators } = await timed('fast_validation_setup', async () => {
         const currentBlockNumber = await this.archiver.getBlockNumber();
@@ -1138,6 +1156,16 @@ export class LibP2PService extends WithTracer implements P2PService {
         const { name } = firstStageOutcome.failure;
         let { severity } = firstStageOutcome.failure;
 
+        // The tx failed a check that only holds against this node's own view (it pays less than the fee we
+        // resolved for the next block). Drop it without propagating, but leave the sender's score alone.
+        if (severity === IgnoreWithoutPenalty) {
+          this.logger.verbose(`Ignoring gossiped tx ${tx.getTxHash().toString()}: stage 1 local check failed`, {
+            validator: name,
+            source: source.toString(),
+          });
+          return { result: TopicValidatorResult.Ignore, obj: tx };
+        }
+
         // Double spend validator has a special case handler. We perform more detailed examination
         // as to how recently the nullifier was entered into the tree and if the transaction should
         // have 'known' the nullifier existed. This determines the severity of the penalty applied to the peer.
@@ -1228,7 +1256,7 @@ export class LibP2PService extends WithTracer implements P2PService {
    * Process a checkpoint attestation from a peer.
    * Validates the attestation and adds it to the pool.
    */
-  private async processCheckpointAttestationFromPeer(
+  protected async processCheckpointAttestationFromPeer(
     payloadData: Buffer,
     msgId: string,
     source: PeerId,
@@ -1264,6 +1292,24 @@ export class LibP2PService extends WithTracer implements P2PService {
     );
   }
 
+  // Bounded set of accepted checkpoint-attestation identities (slot, payload hash, signature bytes), so a
+  // re-encoded copy of an accepted attestation is ignored before the expensive signature recovery.
+  private readonly recentAcceptedAttestations = new Set<string>();
+  private static readonly MAX_RECENT_ATTESTATIONS = 8192;
+
+  private rememberAcceptedAttestation(key: string): void {
+    if (this.recentAcceptedAttestations.has(key)) {
+      return;
+    }
+    this.recentAcceptedAttestations.add(key);
+    if (this.recentAcceptedAttestations.size > LibP2PService.MAX_RECENT_ATTESTATIONS) {
+      const oldest = this.recentAcceptedAttestations.keys().next().value;
+      if (oldest !== undefined) {
+        this.recentAcceptedAttestations.delete(oldest);
+      }
+    }
+  }
+
   /** Validates a checkpoint attestation and adds it to the pool. Penalizes the peer if validation fails. */
   @trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId, attestation) => ({
     [Attributes.SLOT_NUMBER]: attestation.payload.header.slotNumber.toString(),
@@ -1272,6 +1318,15 @@ export class LibP2PService extends WithTracer implements P2PService {
     peerId: PeerId,
     attestation: CheckpointAttestation,
   ): Promise<ReceivedMessageValidationResult<CheckpointAttestation>> {
+    const attestationKey = `${attestation.payload.header.slotNumber}:${attestation
+      .getPayloadHash()
+      .toString()}:${attestation.signature.toBuffer().toString('hex')}`;
+    // Dedup on already-accepted content before validation: a re-encoded copy of an accepted attestation
+    // is ignored here, before the expensive signature recovery in validate().
+    if (this.recentAcceptedAttestations.has(attestationKey)) {
+      return { result: TopicValidatorResult.Ignore, obj: attestation };
+    }
+
     const validationResult = await this.checkpointAttestationValidator.validate(attestation);
 
     if (validationResult.result === 'reject') {
@@ -1302,16 +1357,18 @@ export class LibP2PService extends WithTracer implements P2PService {
       return { result: TopicValidatorResult.Ignore, obj: attestation };
     }
 
-    // Could not add (cap reached for signer), penalize and do not re-broadcast
+    // Local per-(slot, signer) retention cap is full. That is receiver-local state, not evidence the sender
+    // forwarded invalid data (it could not know our cache was full), so drop the extra payload without
+    // penalizing the peer. Do not re-broadcast.
     if (!added) {
-      this.logger.warn(`Rejecting checkpoint attestation due to cap`, {
+      this.logger.debug(`Ignoring checkpoint attestation exceeding per-signer cap`, {
         slot: slot.toString(),
         archive: attestation.archive.toString(),
         source: peerId.toString(),
         attester: attestation.getSender()?.toString(),
         count,
       });
-      return { result: TopicValidatorResult.Reject, severity: PeerErrorSeverity.HighToleranceError };
+      return { result: TopicValidatorResult.Ignore, obj: attestation };
     }
 
     // Check if this is a duplicate attestation (signer attested to a different proposal at the same slot)
@@ -1330,6 +1387,7 @@ export class LibP2PService extends WithTracer implements P2PService {
     }
 
     // Attestation was added successfully - accept it so other nodes can also detect the equivocation
+    this.rememberAcceptedAttestation(attestationKey);
     this.checkpointAttestationCallback?.(attestation);
     return { result: TopicValidatorResult.Accept, obj: attestation };
   }
@@ -1339,7 +1397,10 @@ export class LibP2PService extends WithTracer implements P2PService {
       result,
       obj: block,
       metadata: { isEquivocated, isOversized } = {},
-    } = await this.validateReceivedMessage<BlockProposal, { isEquivocated: boolean; isOversized: boolean }>(
+    } = await this.validateReceivedMessage<
+      BlockProposal,
+      { isEquivocated: boolean; isOversized: boolean; capFull?: boolean }
+    >(
       () => this.validateAndStoreBlockProposal(source, BlockProposal.fromBuffer(payloadData)),
       msgId,
       source,
@@ -1363,7 +1424,22 @@ export class LibP2PService extends WithTracer implements P2PService {
   protected async validateAndStoreBlockProposal(
     peerId: PeerId,
     block: BlockProposal,
-  ): Promise<ReceivedMessageValidationResult<BlockProposal, { isEquivocated: boolean; isOversized: boolean }>> {
+  ): Promise<
+    ReceivedMessageValidationResult<BlockProposal, { isEquivocated: boolean; isOversized: boolean; capFull?: boolean }>
+  > {
+    // Dedup on already-accepted content before validation: an exact signed payload already stored at
+    // this (slot, index) has been validated, so a re-encoded copy is ignored without re-running it. A
+    // different payload hash at the same position is not stored, so equivocation still takes the full path.
+    if (
+      await this.mempools.attestationPool.hasBlockProposal(
+        block.slotNumber,
+        block.indexWithinCheckpoint,
+        block.getPayloadHash(),
+      )
+    ) {
+      return { result: TopicValidatorResult.Ignore, obj: block };
+    }
+
     const validationResult = await this.blockProposalValidator.validate(block);
 
     if (validationResult.result === 'reject') {
@@ -1396,9 +1472,11 @@ export class LibP2PService extends WithTracer implements P2PService {
       return { result: TopicValidatorResult.Ignore, obj: block, metadata: { isEquivocated, isOversized } };
     }
 
-    // Too many blocks received for this slot and index, penalize peer and do not re-broadcast
+    // Local per-position retention cap is full. That is receiver-local state, not evidence the
+    // sender forwarded invalid data (it could not know our cache was full), so drop the extra
+    // payload without penalizing the peer. Do not re-broadcast.
     if (!added) {
-      this.logger.warn(`Penalizing peer for block proposal exceeding per-position cap`, {
+      this.logger.debug(`Ignoring block proposal exceeding per-position cap`, {
         ...block.toBlockInfo(),
         indexWithinCheckpoint: block.indexWithinCheckpoint,
         count,
@@ -1406,9 +1484,14 @@ export class LibP2PService extends WithTracer implements P2PService {
         source: peerId.toString(),
       });
       return {
-        result: TopicValidatorResult.Reject,
-        metadata: { isEquivocated, isOversized },
-        severity: PeerErrorSeverity.HighToleranceError,
+        // isEquivocated is false here even when count > 1: a full cache is a receiver-local drop, not
+        // a fresh equivocation by this block. Genuine equivocation is already captured on the add
+        // (duplicateProposalCallback below). capFull tells the checkpoint path, whose terminal block
+        // this may be, to ignore the whole checkpoint too, rather than store and re-broadcast it while
+        // its terminal block was dropped.
+        result: TopicValidatorResult.Ignore,
+        obj: block,
+        metadata: { isEquivocated: false, isOversized, capFull: true },
       };
     }
 
@@ -1558,6 +1641,13 @@ export class LibP2PService extends WithTracer implements P2PService {
       { isEquivocated: boolean; processBlock: boolean; isOversized: boolean }
     >
   > {
+    // Dedup on already-accepted content before validation: an exact signed checkpoint payload already
+    // stored for this slot has been validated, so a re-encoded copy is ignored without re-running it. A
+    // different payload hash at the same slot is not stored, so equivocation still takes the full path.
+    if (await this.mempools.attestationPool.hasCheckpointProposal(checkpoint.slotNumber, checkpoint.getPayloadHash())) {
+      return { result: TopicValidatorResult.Ignore, obj: checkpoint };
+    }
+
     const validationResult = await this.checkpointProposalValidator.validate(checkpoint);
 
     if (validationResult.result === 'reject') {
@@ -1579,14 +1669,14 @@ export class LibP2PService extends WithTracer implements P2PService {
         [Attributes.P2P_ID]: peerId.toString(),
       });
       const blockProposalResult = await this.validateAndStoreBlockProposal(peerId, blockProposal);
-      const { obj, metadata: { isEquivocated, isOversized: blockIsOversized } = {} } = blockProposalResult;
+      const { obj, metadata: { isEquivocated, isOversized: blockIsOversized, capFull: blockCapFull } = {} } =
+        blockProposalResult;
       isOversized = blockIsOversized ?? false;
 
-      if (blockProposalResult.result === TopicValidatorResult.Reject || !obj || isEquivocated) {
+      if (blockProposalResult.result === TopicValidatorResult.Reject || !obj) {
         this.logger.debug(`Rejecting checkpoint due to invalid last block proposal`, {
           [Attributes.SLOT_NUMBER]: checkpoint.slotNumber.toString(),
           [Attributes.P2P_ID]: peerId.toString(),
-          isEquivocated,
           result: blockProposalResult.result,
         });
         return {
@@ -1594,6 +1684,15 @@ export class LibP2PService extends WithTracer implements P2PService {
           severity:
             'severity' in blockProposalResult ? blockProposalResult.severity : PeerErrorSeverity.MidToleranceError,
         };
+      } else if (blockCapFull || isEquivocated) {
+        // Both cases depend on our local cache, not on anything the relaying peer could check, so do not
+        // penalize it. Genuine equivocation was already reported at the block level. Drop the checkpoint:
+        // no store, no re-broadcast, no processing or attestation.
+        this.logger.debug(`Ignoring checkpoint whose terminal block was a receiver-local drop`, {
+          [Attributes.SLOT_NUMBER]: checkpoint.slotNumber.toString(),
+          [Attributes.P2P_ID]: peerId.toString(),
+        });
+        return { result: TopicValidatorResult.Ignore, obj: checkpoint };
       } else if (blockProposalResult.result === TopicValidatorResult.Accept && obj && !isEquivocated && !isOversized) {
         // An oversized terminal block is re-broadcast as slashing evidence but never processed.
         processBlock = true;
@@ -1619,19 +1718,19 @@ export class LibP2PService extends WithTracer implements P2PService {
       };
     }
 
-    // Too many checkpoint proposals received for this slot, penalize peer and do not re-broadcast.
-    // Note: We still return the checkpoint obj so the lastBlock can be processed if valid
+    // Local per-slot retention cap is full. That is receiver-local state, not evidence the sender
+    // forwarded invalid data, so drop the extra payload without penalizing the peer. Do not
+    // re-broadcast. We still return the checkpoint obj so the lastBlock can be processed if valid.
     if (!added) {
-      this.logger.warn(`Penalizing peer for checkpoint proposal exceeding per-slot cap`, {
+      this.logger.debug(`Ignoring checkpoint proposal exceeding per-slot cap`, {
         ...checkpoint.toCheckpointInfo(),
         count,
         source: peerId.toString(),
       });
       return {
-        result: TopicValidatorResult.Reject,
+        result: TopicValidatorResult.Ignore,
         obj: checkpoint,
         metadata: { isEquivocated, processBlock, isOversized },
-        severity: PeerErrorSeverity.HighToleranceError,
       };
     }
 
@@ -1805,8 +1904,13 @@ export class LibP2PService extends WithTracer implements P2PService {
     }
   }
 
-  private getGasFees(): Promise<GasFees> {
-    return this.blockMinFeesProvider.getCurrentMinFees();
+  /** The fees a gossiped transaction is checked against (see {@link computeGossipMinFees}). */
+  protected async getGasFees(): Promise<GossipMinFees> {
+    const [admission, l1Forward] = await Promise.all([
+      this.nextBlockMinFeesProvider.getAdmissionMinFees(),
+      this.nextBlockMinFeesProvider.getL1ForwardMinFees(),
+    ]);
+    return computeGossipMinFees(admission, l1Forward);
   }
 
   /**
@@ -1852,7 +1956,7 @@ export class LibP2PService extends WithTracer implements P2PService {
   protected async createFirstStageMessageValidators(
     currentBlockNumber: BlockNumber,
     nextSlotTimestamp: UInt64,
-  ): Promise<Record<string, TransactionValidator>> {
+  ): Promise<Record<string, TransactionValidator<GossipValidationFailure>>> {
     const gasFees = await this.getGasFees();
     const allowedInSetup = [
       ...(await getDefaultAllowedSetupFunctions()),
@@ -1892,10 +1996,10 @@ export class LibP2PService extends WithTracer implements P2PService {
    * @param messageValidators - The message validators to run.
    * @returns The validation outcome.
    */
-  private async runValidations(
+  private async runValidations<F extends GossipValidationFailure>(
     tx: Tx,
-    messageValidators: Record<string, TransactionValidator>,
-  ): Promise<ValidationOutcome> {
+    messageValidators: Record<string, TransactionValidator<F>>,
+  ): Promise<ValidationOutcome<F>> {
     // Gossip validation stays exhaustive within each stage because peer scoring uses the harshest failure severity;
     // failing fast would make the penalty depend on validator order. The stage boundaries themselves fail fast.
     const validationPromises = Object.entries(messageValidators).map(async ([name, { validator, severity }]) => {
@@ -1908,7 +2012,7 @@ export class LibP2PService extends WithTracer implements P2PService {
     const failures = allValidations.filter(x => !x.isValid);
     if (failures.length > 0) {
       // Pick the most severe failure (lowest tolerance = harshest penalty)
-      const failed = maxBy(failures, f => PeerErrorSeverityByHarshness.indexOf(f.severity))!;
+      const failed = maxBy(failures, f => GossipValidationFailureByHarshness.indexOf(f.severity))!;
       return {
         allPassed: false,
         failure: {

package/src/services/peer-manager/peer_manager.ts

@@ -923,6 +923,20 @@ export class PeerManager implements PeerManagerInterface {
           timeoutUntilMs:
             this.dateProvider.now() + (this.config.peerFailedBanTimeMs ?? DEFAULT_FAILED_PEER_BAN_TIME_MS),
         });
+        // Drop the address-book record written before the dial. Nothing else deletes /peers/
+        // rows, so a stream of unreachable discovered peers would otherwise grow the durable
+        // peerstore without bound. Keep operator-configured peers (trusted, private, preferred),
+        // and keep any peer we currently hold a connection to: an inbound connect or a concurrent
+        // rediscovery may have refreshed the record while this dial was failing.
+        if (!this.isProtectedPeer(peer.peerId) && this.libP2PNode.getConnections(peer.peerId).length === 0) {
+          try {
+            await this.libP2PNode.peerStore.delete(peer.peerId);
+          } catch (deleteError) {
+            this.logger.trace(`Failed to remove dropped peer ${id} from the peer store`, {
+              error: inspect(deleteError),
+            });
+          }
+        }
       }
     }
   }

package/src/services/tx_provider.ts

@@ -189,6 +189,9 @@ export class TxProvider implements ITxProvider {
     const moreTxsFromPool = compactArray(await this.txPool.getTxsByHash([...missingTxHashes].map(TxHash.fromString)));
 
     if (moreTxsFromPool.length > 0) {
+      for (const tx of moreTxsFromPool) {
+        missingTxHashes.delete(tx.getTxHash().toString());
+      }
       this.instrumentation.incTxsFromMempool(moreTxsFromPool.length);
       this.log.debug(
         `Retrieved ${moreTxsFromPool.length} txs from pool retry for block proposal (${missingTxHashes.size} pending)`,