@aztec-labs/p2p 6.0.0-rc.2 → 6.0.0-rc.4

package/src/mem_pools/tx_pool_v2/tx_pool_v2_impl.ts

@@ -131,6 +131,8 @@ export class TxPoolV2Impl {
     this.#evictionManager = new EvictionManager(this.#createPoolOperations(), log);
 
     // Pre-add rules (run during addPendingTxs) - work with TxMetaData
+    // Order matters: each rule sees the pool without the txs that earlier rules picked for eviction.
+    // Each eviction pick is final: later rules cannot roll back an eviction.
     this.#evictionManager.registerPreAddRule(new NullifierConflictRule());
     this.#evictionManager.registerPreAddRule(new FeePayerBalancePreAddRule());
     this.#evictionManager.registerPreAddRule(
@@ -240,11 +242,17 @@ export class TxPoolV2Impl {
     const ignored: TxHash[] = [];
     const rejected: TxHash[] = [];
     const errors = new Map<string, TxPoolRejectionError>();
+    // Per-rejected-tx failure reasons, kept so receiver-local state drift can be told apart from a
+    // sender-attributable rejection: a tx that went stale against local state is not the relayer's fault.
+    const rejectionReasons = new Map<string, string[]>();
     const acceptedPending = new Set<string>();
 
     // Phase 1: Pre-compute all throwable I/O outside the transaction.
     // If any pre-computation throws, the entire call fails before mutations happen.
-    const precomputed = new Map<string, { meta: TxMetaData; minedBlockId: L2BlockId | undefined; isValid: boolean }>();
+    const precomputed = new Map<
+      string,
+      { meta: TxMetaData; minedBlockId: L2BlockId | undefined; isValid: boolean; reason?: string[] }
+    >();
 
     const validator = await this.#createTxValidator();
 
@@ -257,11 +265,14 @@ export class TxPoolV2Impl {
 
       // Validate non-mined txs (mined and pre-protected txs bypass validation inside the transaction)
       let isValid = true;
+      let reason: string[] | undefined;
       if (!minedBlockId) {
-        isValid = await this.#validateMeta(meta, validator);
+        const validation = await this.#validateMeta(meta, validator);
+        isValid = validation.valid;
+        reason = validation.reason;
       }
 
-      precomputed.set(txHashStr, { meta, minedBlockId, isValid });
+      precomputed.set(txHashStr, { meta, minedBlockId, isValid, reason });
     }
 
     // Phase 2: Apply mutations inside the transaction using only pre-computed results,
@@ -283,7 +294,7 @@ export class TxPoolV2Impl {
           continue;
         }
 
-        const { meta, minedBlockId, isValid } = precomputed.get(txHashStr)!;
+        const { meta, minedBlockId, isValid, reason } = precomputed.get(txHashStr)!;
         const preProtectedSlot = this.#indices.getProtectionSlot(txHashStr);
 
         if (minedBlockId) {
@@ -297,6 +308,9 @@ export class TxPoolV2Impl {
         } else if (!isValid) {
           // Failed pre-computed validation
           rejected.push(txHash);
+          if (reason && reason.length > 0) {
+            rejectionReasons.set(txHashStr, reason);
+          }
         } else {
           // Regular pending tx - run pre-add rules using pre-computed metadata
           const result = await this.#tryAddRegularPendingTx(
@@ -338,7 +352,13 @@ export class TxPoolV2Impl {
       this.#instrumentation.recordRejected(rejected.length);
     }
 
-    return { accepted, ignored, rejected, ...(errors.size > 0 ? { errors } : {}) };
+    return {
+      accepted,
+      ignored,
+      rejected,
+      ...(errors.size > 0 ? { errors } : {}),
+      ...(rejectionReasons.size > 0 ? { rejectionReasons } : {}),
+    };
   }
 
   /** Adds a validated pending tx, running pre-add rules and evicting conflicts. */
@@ -863,7 +883,18 @@ export class TxPoolV2Impl {
     if (!buffer) {
       return undefined;
     }
-    return opts.includeProof === false ? Tx.fromBuffer(buffer) : this.#loadTxWithProof(txHashStr, buffer);
+    if (opts.includeProof === false) {
+      return Tx.fromBuffer(buffer);
+    }
+    // The body and its separately-stored proof are read in two steps, not atomically: an eviction
+    // can delete the proof row after the body read. Serving a proofless tx makes the honest requester
+    // penalise us, so drop it. A present-but-empty proof is a valid sentinel; only a missing row is
+    // the evicted case.
+    const proofBuffer = await this.#proofsDB.getAsync(txHashStr);
+    if (!proofBuffer) {
+      return undefined;
+    }
+    return Tx.fromBuffers(buffer, proofBuffer);
   }
 
   async getTxsByHash(txHashes: TxHash[], opts: { includeProof?: boolean } = {}): Promise<(Tx | undefined)[]> {
@@ -1122,15 +1153,19 @@ export class TxPoolV2Impl {
   // ============================================================================
 
   /** Validates transaction metadata, returning true if valid */
-  async #validateMeta(meta: TxMetaData, validator?: TxValidator<TxMetaData>, context?: string): Promise<boolean> {
+  async #validateMeta(
+    meta: TxMetaData,
+    validator?: TxValidator<TxMetaData>,
+    context?: string,
+  ): Promise<{ valid: boolean; reason?: string[] }> {
     const txValidator = validator ?? (await this.#createTxValidator());
     const result = await txValidator.validateTx(meta);
     if (result.result !== 'valid') {
       const contextStr = context ? ` ${context}` : '';
       this.#log.info(`Tx ${meta.txHash}${contextStr} failed validation: ${result.reason?.join(', ')}`);
-      return false;
+      return { valid: false, reason: result.reason };
     }
-    return true;
+    return { valid: true };
   }
 
   /** Validates metadata directly */
@@ -1142,7 +1177,7 @@ export class TxPoolV2Impl {
     const invalid: string[] = [];
     const validator = await this.#createTxValidator();
     for (const meta of metas) {
-      if (await this.#validateMeta(meta, validator, context)) {
+      if ((await this.#validateMeta(meta, validator, context)).valid) {
         valid.push(meta);
       } else {
         invalid.push(meta.txHash);
@@ -1291,7 +1326,7 @@ export class TxPoolV2Impl {
       },
       getFeePayerPendingTxs: (feePayer: string) => this.#indices.getFeePayerPendingTxs(feePayer),
       getPendingTxCount: () => this.#indices.getPendingTxCount(),
-      getLowestPriorityPendingTx: () => this.#indices.getLowestPriorityPendingTx(),
+      iteratePendingByPriority: (order: 'asc' | 'desc') => this.#indices.iteratePendingByPriority(order),
     };
   }
 }

package/src/msg_validators/attestation_validator/README.md

@@ -10,11 +10,12 @@ This module validates `CheckpointAttestation` gossipsub messages. Attestations a
 |---|------|-------------|----------|------|
 | 1 | **Slot timeliness**: `currentSlot` or `nextSlot`. Previous slot within 500ms: IGNORE. Older: REJECT. | REJECT or IGNORE | HighToleranceError | `attestation_validator.ts` |
 | 2 | **Attester signature**: `getSender()` must recover valid address | REJECT | LowToleranceError | same |
-| 3 | **Attester in committee**: recovered address in committee for slot | REJECT | HighToleranceError | same |
-| 4 | **Proposer exists**: `getProposerAttesterAddressInSlot` must return defined | REJECT | HighToleranceError | same |
+| 3 | **Attester in committee**: recovered address in the slot's committee (an `open` or `none` committee has no members) | REJECT | HighToleranceError | same |
+| 4 | **Proposer exists**: `lookupProposer` must not be `open` | REJECT | HighToleranceError | same |
 | 5 | **Proposer signature**: `getProposer()` must recover valid address | REJECT | LowToleranceError | same |
 | 6 | **Proposer matches expected**: recovered proposer = expected for slot | REJECT | HighToleranceError | same |
-| 7 | **NoCommitteeError**: committee unavailable | REJECT | LowToleranceError | same |
+| 7 | **No committee**: proposer lookup is `none` | REJECT | LowToleranceError | same |
+| 8 | **Committee not stable**: either lookup is `unstable` (seed not fixed on L1), or it throws locally | IGNORE | none | same |
 
 **Fisherman mode extension** (`FishermanAttestationValidator`): if a checkpoint proposal for the same archive exists in pool, the attestation's `ConsensusPayload` must `.equals()` the stored proposal's payload. On mismatch: REJECT + LowToleranceError.
 

package/src/msg_validators/attestation_validator/attestation_validator.ts

@@ -1,4 +1,4 @@
-import type { EpochCacheInterface } from '@aztec-labs/epoch-cache';
+import type { CommitteeMembershipLookup, EpochCacheInterface, ProposerLookup } from '@aztec-labs/epoch-cache';
 import { type Logger, createLogger } from '@aztec-labs/foundation/log';
 import {
   type CheckpointAttestation,
@@ -10,7 +10,7 @@ import {
 } from '@aztec-labs/stdlib/p2p';
 import type { ConsensusTimetable } from '@aztec-labs/stdlib/timetable';
 
-import { mapEpochCacheLookupFailure } from '../epoch_cache_lookup.js';
+import { ignoreUnstableCommittee, mapEpochCacheLookupFailure, rejectNoCommittee } from '../epoch_cache_lookup.js';
 import { classifyReceiveWindowArrival } from '../receive_window.js';
 
 export class CheckpointAttestationValidator implements P2PValidator<CheckpointAttestation> {
@@ -84,13 +84,17 @@ export class CheckpointAttestationValidator implements P2PValidator<CheckpointAt
     }
 
     // Verify the attester is in the committee for this slot
-    let inCommittee: boolean;
+    let membership: CommitteeMembershipLookup<boolean>;
     try {
-      inCommittee = await this.epochCache.isInCommittee(slotNumber, attester);
+      membership = await this.epochCache.lookupMembership(slotNumber, attester);
     } catch (e) {
       return mapEpochCacheLookupFailure(e, this.logger, 'checkpoint attestation', slotNumber);
     }
-    if (!inCommittee) {
+    if (membership.state === 'unstable') {
+      return ignoreUnstableCommittee(membership, this.logger, 'checkpoint attestation', slotNumber);
+    }
+    // An open committee and a missing one have no members, so the attester cannot be one.
+    if (membership.state !== 'members' || !membership.inCommittee) {
       this.logger.warn(`Attester ${attester.toString()} is not in committee for slot ${slotNumber}`);
       return { result: 'reject', severity: PeerErrorSeverity.HighToleranceError };
     }
@@ -99,16 +103,24 @@ export class CheckpointAttestationValidator implements P2PValidator<CheckpointAt
     // We look up the proposer for the specific slot rather than using currentSlot/nextSlot
     // since timing differences could cause mismatches
     const proposer = message.getProposer();
-    let expectedProposer;
+    let proposerLookup: ProposerLookup;
     try {
-      expectedProposer = await this.epochCache.getProposerAttesterAddressInSlot(slotNumber);
+      proposerLookup = await this.epochCache.lookupProposer(slotNumber);
     } catch (e) {
       return mapEpochCacheLookupFailure(e, this.logger, 'checkpoint attestation', slotNumber);
     }
-    if (!expectedProposer) {
-      this.logger.warn(`No proposer defined for slot ${slotNumber}`);
-      return { result: 'reject', severity: PeerErrorSeverity.HighToleranceError };
+    switch (proposerLookup.state) {
+      case 'unstable':
+        return ignoreUnstableCommittee(proposerLookup, this.logger, 'checkpoint attestation', slotNumber);
+      case 'none':
+        return rejectNoCommittee();
+      case 'open':
+        this.logger.warn(`No proposer defined for slot ${slotNumber}`);
+        return { result: 'reject', severity: PeerErrorSeverity.HighToleranceError };
+      case 'members':
+        break;
     }
+    const expectedProposer = proposerLookup.proposer;
     if (!proposer) {
       this.logger.warn(`Invalid proposer signature in checkpoint attestation for slot ${slotNumber}`);
       return { result: 'reject', severity: PeerErrorSeverity.LowToleranceError };
@@ -116,7 +128,7 @@ export class CheckpointAttestationValidator implements P2PValidator<CheckpointAt
     if (!proposer.equals(expectedProposer)) {
       this.logger.warn(
         `Proposer signature mismatch in checkpoint attestation. ` +
-          `Expected ${expectedProposer?.toString() ?? 'none'} but got ${proposer.toString()} for slot ${slotNumber}`,
+          `Expected ${expectedProposer.toString()} but got ${proposer.toString()} for slot ${slotNumber}`,
       );
       return { result: 'reject', severity: PeerErrorSeverity.HighToleranceError };
     }

package/src/msg_validators/epoch_cache_lookup.ts

@@ -1,20 +1,41 @@
-import { NoCommitteeError } from '@aztec-labs/ethereum/contracts';
+import type { UnstableCommittee } from '@aztec-labs/epoch-cache';
 import type { SlotNumber } from '@aztec-labs/foundation/branded-types';
 import type { Logger } from '@aztec-labs/foundation/log';
 import { PeerErrorSeverity, type ValidationResult } from '@aztec-labs/stdlib/p2p';
 
+// Verdicts shared by the proposal and attestation validators, so the "a local epoch-cache failure is never the
+// relaying peer's fault" rule lives in one place.
+
+/**
+ * A slot with no committee on L1 is the peer's fault — they should not be sending us a proposal or attestation for it
+ * — so it rejects. It is a routine peer-fault reject and needs no log line.
+ */
+export function rejectNoCommittee(): ValidationResult {
+  return { result: 'reject', severity: PeerErrorSeverity.LowToleranceError };
+}
+
+/**
+ * A committee whose seed is not fixed on L1 yet says nothing about the relaying peer, and is expected around epoch
+ * boundaries, so it ignores without a warning.
+ */
+export function ignoreUnstableCommittee(
+  lookup: UnstableCommittee,
+  logger: Logger,
+  subject: string,
+  slotNumber: SlotNumber,
+): ValidationResult {
+  logger.debug(`Ignoring ${subject} for slot ${slotNumber}: its committee is not stable on L1 yet`, {
+    slotNumber,
+    epoch: lookup.epoch,
+    l1BlockNumber: lookup.l1BlockNumber,
+  });
+  return { result: 'ignore' };
+}
+
 /**
- * Maps a failure of an epoch-cache lookup during p2p validation to a verdict, shared by the proposal
- * and attestation validators so the "a local epoch-cache failure is never the relaying peer's fault"
- * rule lives in one place.
- *
- * A missing committee (`NoCommitteeError`) is the peer's fault — they should not be sending us a
- * proposal/attestation for a slot with no committee — so it rejects. Any other failure is
- * receiver-local (an L1 RPC outage, or this node being behind) and says nothing about the relaying
- * peer, so it ignores rather than penalizes. Only the local failure is warned; a missing committee is
- * a routine peer-fault reject and needs no log line.
- *
- * `subject` names the gossip object for the log ("proposal" / "checkpoint attestation").
+ * A lookup that throws failed for a receiver-local reason (an L1 RPC outage, or this node being behind), so it ignores
+ * rather than penalizes, and warns. `subject` names the gossip object for the log ("proposal" / "checkpoint
+ * attestation").
  */
 export function mapEpochCacheLookupFailure(
   e: unknown,
@@ -22,9 +43,6 @@ export function mapEpochCacheLookupFailure(
   subject: string,
   slotNumber: SlotNumber,
 ): ValidationResult {
-  if (e instanceof NoCommitteeError) {
-    return { result: 'reject', severity: PeerErrorSeverity.LowToleranceError };
-  }
   logger.warn(`Ignoring ${subject} for slot ${slotNumber} after a local epoch-cache lookup failure`, {
     slotNumber,
     error: e instanceof Error ? e.message : String(e),

package/src/msg_validators/proposal_validator/README.md

@@ -17,9 +17,10 @@ File: `proposal_validator.ts`
 | 3 | **Txs permitted**: if `disableTransactions`, must have 0 txHashes and 0 embedded txs | REJECT | MidToleranceError |
 | 4 | **Max txs**: `txHashes.length <= MAX_TXS_PER_CHECKPOINT` (based on blob capacity), further restricted by `maxTxsPerBlock` when configured. Also applies to checkpoint-embedded blocks. | REJECT | MidToleranceError |
 | 5 | **Embedded txs in txHashes**: every embedded tx's hash must appear in `txHashes` | REJECT | MidToleranceError |
-| 6 | **Proposer check**: signer must match expected proposer for slot (skipped if committee size = 0) | REJECT | MidToleranceError |
+| 6 | **Proposer check**: signer must match expected proposer for slot (skipped when the committee is `open`, i.e. size 0) | REJECT | MidToleranceError |
 | 7 | **Tx hash integrity**: each embedded tx's recomputed hash must match declared hash | REJECT | LowToleranceError |
-| 8 | **NoCommitteeError**: epoch cache cannot determine committee | REJECT | LowToleranceError |
+| 8 | **No committee**: proposer lookup is `none` | REJECT | LowToleranceError |
+| 9 | **Committee not stable**: proposer lookup is `unstable` (seed not fixed on L1), or it throws locally | IGNORE | none |
 
 Deserialization guards: `BlockProposal.fromBuffer` and `SignedTxs.fromBuffer` both enforce `txCount <= MAX_TXS_PER_BLOCK` (65536). Violation -> REJECT + LowToleranceError.
 
@@ -29,7 +30,7 @@ Deserialization guards: `BlockProposal.fromBuffer` and `SignedTxs.fromBuffer` bo
 |---|------|-------------|
 | 9 | **Duplicate**: same archive root already stored | IGNORE (no penalty) |
 | 10 | **Per-position cap**: max 2 proposals per (slot, indexWithinCheckpoint) | IGNORE (receiver-local drop: no penalty, no re-broadcast) |
-| 11 | **Equivocation**: >1 distinct proposal for same (slot, index) | ACCEPT (rebroadcast for detection). At count=2: `duplicateProposalCallback` fires -> slash event (`OffenseType.DUPLICATE_PROPOSAL`, configured via `slashDuplicateProposalPenalty`) |
+| 11 | **Equivocation**: >1 distinct proposal for same (slot, index) | ACCEPT (rebroadcast for detection), not processed. At count=2: `duplicateProposalCallback` fires and the slot is marked as equivocated on the spot. No slash here: the count is per position, not per signer. The slasher's `BroadcastedProposalWatcher` later attributes `OffenseType.DUPLICATE_PROPOSAL` (configured via `slashDuplicateProposalPenalty`) to a signer only if that signer signed two different payloads at one position |
 
 ### Stage 3: Validator-Client Processing (BlockProposalHandler)
 
@@ -51,7 +52,7 @@ Only runs on validator nodes. Non-validator nodes use a default handler that tri
 | 23 | **Re-execution**: no failed txs | `failed_txs` (ReExFailedTxsError) -- **SLASHABLE** |
 | 24 | **Re-execution**: archive root and header match proposal | `state_mismatch` (ReExStateMismatchError) -- **SLASHABLE** |
 
-**Escape hatch**: during escape hatch periods (`isEscapeHatchOpenAtSlot`), re-execution and slashing are both disabled, and the proposal is rejected locally.
+**Escape hatch**: during escape hatch periods (`lookupEscapeHatchAtSlot`), re-execution and slashing are both disabled, and the proposal is rejected locally.
 
 **Conditional re-execution**: rules 22-24 only run when at least one condition is true: `fishermanMode` enabled, `slashBroadcastedInvalidBlockPenalty > 0`, committee membership, `alwaysReexecuteBlockProposals`, or `blobClient.canUpload()`.
 

package/src/msg_validators/proposal_validator/proposal_validator.ts

@@ -1,4 +1,4 @@
-import type { EpochCacheInterface } from '@aztec-labs/epoch-cache';
+import type { EpochCacheInterface, ProposerLookup } from '@aztec-labs/epoch-cache';
 import { type Logger, createLogger } from '@aztec-labs/foundation/log';
 import { MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT, MAX_TXS_PER_CHECKPOINT } from '@aztec-labs/stdlib/deserialization';
 import {
@@ -11,7 +11,7 @@ import {
 } from '@aztec-labs/stdlib/p2p';
 import type { ConsensusTimetable } from '@aztec-labs/stdlib/timetable';
 
-import { mapEpochCacheLookupFailure } from '../epoch_cache_lookup.js';
+import { ignoreUnstableCommittee, mapEpochCacheLookupFailure, rejectNoCommittee } from '../epoch_cache_lookup.js';
 import { classifyReceiveWindowArrival } from '../receive_window.js';
 
 /** Validates header-level and tx-level fields of block and checkpoint proposals. */
@@ -117,22 +117,31 @@ export class ProposalValidator {
       }
     }
 
-    // An undefined proposer means an empty committee (anyone may propose), so skip the
-    // proposer-equality check and keep validating. Only this lookup can fail on a receiver-local
-    // cause (L1 RPC down, or this node behind); mapEpochCacheLookupFailure ignores that (it is not the
-    // relaying peer's fault) and rejects a missing committee (which is).
-    let expectedProposer;
+    // Only this lookup can fail on a receiver-local cause (L1 RPC down, or this node behind), which
+    // mapEpochCacheLookupFailure ignores as it is not the relaying peer's fault.
+    let expectedProposer: ProposerLookup;
     try {
-      expectedProposer = await this.epochCache.getProposerAttesterAddressInSlot(slotNumber);
+      expectedProposer = await this.epochCache.lookupProposer(slotNumber);
     } catch (e) {
       return mapEpochCacheLookupFailure(e, this.logger, 'proposal', slotNumber);
     }
-    if (expectedProposer !== undefined && !proposer.equals(expectedProposer)) {
-      this.logger.warn(`Penalizing peer for invalid proposer for current slot ${slotNumber}`, {
-        expectedProposer,
-        proposer: proposer.toString(),
-      });
-      return { result: 'reject', severity: PeerErrorSeverity.MidToleranceError };
+    switch (expectedProposer.state) {
+      case 'unstable':
+        return ignoreUnstableCommittee(expectedProposer, this.logger, 'proposal', slotNumber);
+      case 'none':
+        return rejectNoCommittee();
+      case 'open':
+        // Anyone may propose, so there is no proposer to check the signer against.
+        break;
+      case 'members':
+        if (!proposer.equals(expectedProposer.proposer)) {
+          this.logger.warn(`Penalizing peer for invalid proposer for current slot ${slotNumber}`, {
+            expectedProposer: expectedProposer.proposer,
+            proposer: proposer.toString(),
+          });
+          return { result: 'reject', severity: PeerErrorSeverity.MidToleranceError };
+        }
+        break;
     }
 
     return { result: 'accept' };

package/src/msg_validators/tx_validator/data_validator.ts

@@ -53,34 +53,68 @@ export class DataTxValidator implements TxValidator<Tx> {
     return undefined;
   }
 
+  /**
+   * Checks the supplied public calldata entries against the calldata hashes of the public call requests. Every request
+   * must have an entry, and every entry must hash to its own hash and be used by some request. Several requests may
+   * share one entry, so a hash may appear at most as many times as requests use it. Both the calldata the calls receive
+   * and the supplied entries are capped. All of this is checked before hashing any entry.
+   */
   async #hasCorrectCalldata(tx: Tx): Promise<string | undefined> {
-    if (tx.publicFunctionCalldata.length !== tx.numberOfPublicCalls()) {
-      const reason = TX_ERROR_CALLDATA_COUNT_MISMATCH;
-      this.#log.verbose(
-        `Rejecting tx ${tx.getTxHash().toString()}. Reason: ${reason}. Expected ${tx.numberOfPublicCalls()}. Got ${
-          tx.publicFunctionCalldata.length
-        }.`,
-      );
-      return reason;
+    const txHash = tx.getTxHash().toString();
+    const calldataMap = tx.getCalldataMap();
+
+    const requestCountByHash = new Map<string, number>();
+    for (const [index, { request }] of tx.getPublicCallRequestsWithCalldata().entries()) {
+      const hash = request.calldataHash.toString();
+      if (!calldataMap.has(hash)) {
+        const reason = TX_ERROR_INCORRECT_CALLDATA;
+        this.#log.verbose(`Rejecting tx ${txHash}. Reason: ${reason}. Call request has no calldata entry.`, {
+          txHash,
+          callRequestIndex: index,
+        });
+        return reason;
+      }
+      requestCountByHash.set(hash, (requestCountByHash.get(hash) ?? 0) + 1);
     }
 
-    if (tx.getTotalPublicCalldataCount() > MAX_FR_CALLDATA_TO_ALL_ENQUEUED_CALLS) {
+    // A wrongly labeled entry can make the calls receive less calldata than is supplied, so both totals are capped.
+    const deliveredCount = tx.getDeliveredPublicCalldataCount();
+    const suppliedCount = tx.getTotalPublicCalldataCount();
+    if (
+      deliveredCount > MAX_FR_CALLDATA_TO_ALL_ENQUEUED_CALLS ||
+      suppliedCount > MAX_FR_CALLDATA_TO_ALL_ENQUEUED_CALLS
+    ) {
       const reason = TX_ERROR_CALLDATA_COUNT_TOO_LARGE;
       this.#log.verbose(
-        `Rejecting tx ${tx
-          .getTxHash()
-          .toString()}. Reason: ${reason}. Expected no greater than ${MAX_FR_CALLDATA_TO_ALL_ENQUEUED_CALLS} fields. Got ${tx.getTotalPublicCalldataCount()}.`,
+        `Rejecting tx ${txHash}. Reason: ${reason}. Expected no greater than ${MAX_FR_CALLDATA_TO_ALL_ENQUEUED_CALLS} fields.`,
+        { txHash, deliveredCount, suppliedCount },
       );
       return reason;
     }
 
-    const callRequests = tx.getPublicCallRequestsWithCalldata();
-    for (let i = 0; i < callRequests.length; i++) {
-      const { request, calldata } = callRequests[i];
-      const hash = await computeCalldataHash(calldata);
-      if (!hash.equals(request.calldataHash)) {
+    const entryCountByHash = new Map<string, number>();
+    for (const [index, cd] of tx.publicFunctionCalldata.entries()) {
+      const hash = cd.hash.toString();
+      const entryCount = (entryCountByHash.get(hash) ?? 0) + 1;
+      const requestCount = requestCountByHash.get(hash) ?? 0;
+      if (entryCount > requestCount) {
+        const reason = TX_ERROR_CALLDATA_COUNT_MISMATCH;
+        this.#log.verbose(
+          `Rejecting tx ${txHash}. Reason: ${reason}. Calldata entry is listed more times than call requests use it.`,
+          { txHash, calldataIndex: index, requestCount },
+        );
+        return reason;
+      }
+      entryCountByHash.set(hash, entryCount);
+    }
+
+    for (const [index, cd] of tx.publicFunctionCalldata.entries()) {
+      if (!(await computeCalldataHash(cd.values)).equals(cd.hash)) {
         const reason = TX_ERROR_INCORRECT_CALLDATA;
-        this.#log.verbose(`Rejecting tx ${tx.getTxHash().toString()}. Reason: ${reason}. Call request index: ${i}.`);
+        this.#log.verbose(`Rejecting tx ${txHash}. Reason: ${reason}. Calldata entry does not match its hash.`, {
+          txHash,
+          calldataIndex: index,
+        });
         return reason;
       }
     }
@@ -121,6 +155,17 @@ export class DataTxValidator implements TxValidator<Tx> {
         }
       }
 
+      // The private kernel tail requires every contract class log within the claimed count to have a non-zero length,
+      // and the tx base treats a zero-length log as absent, so a tx carrying one can never be proven.
+      if (logHash.logHash.length === 0) {
+        const txHash = tx.getTxHash().toString();
+        this.#log.verbose(`Rejecting tx ${txHash} because of a zero-length contract class log at index ${i}.`, {
+          txHash,
+          logIndex: i,
+        });
+        return TX_ERROR_CONTRACT_CLASS_LOG_LENGTH;
+      }
+
       // The tx base requires exactly the trimmed length; any other length makes the tx unprovable.
       const expectedLength = 1 + tx.contractClassLogFields[i].fields.findLastIndex(f => !f.isZero());
       if (logHash.logHash.length !== expectedLength) {

package/src/services/discv5/discV5_service.ts

@@ -8,9 +8,10 @@ import type { PeerId } from '@libp2p/interface';
 import { type Multiaddr, multiaddr } from '@multiformats/multiaddr';
 import { Discv5, type Discv5EventEmitter, type IDiscv5CreateOptions } from '@nethermindeth/discv5';
 import { ENR, SignableENR } from '@nethermindeth/enr';
+import { Buffer } from 'buffer';
 import EventEmitter from 'events';
 
-import { DISCV5_RATE_LIMITER_OPTS, type P2PConfig } from '../../config.js';
+import type { P2PConfig } from '../../config.js';
 import { createNodeENR } from '../../enr/generate-enr.js';
 import { AZTEC_ENR_KEY, Discv5Event, PeerEvent } from '../../types/index.js';
 import { convertToMultiaddr } from '../../util.js';
@@ -126,7 +127,6 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
         ...configOverrides.config,
       },
       metricsRegistry,
-      rateLimiterOpts: DISCV5_RATE_LIMITER_OPTS,
     });
 
     // Hook onto the onEstablished method to check the peer's version from the ENR,

package/src/services/dummy_service.ts

@@ -4,6 +4,7 @@ import type { Gossipable, PeerErrorSeverity, TopicType } from '@aztec-labs/stdli
 import { Tx, TxHash } from '@aztec-labs/stdlib/tx';
 import type { PeerId } from '@libp2p/interface';
 import type { ENR } from '@nethermindeth/enr';
+import { Buffer } from 'buffer';
 import EventEmitter from 'events';
 
 import type { PeerManagerInterface } from './peer-manager/interface.js';

package/src/services/encoding.ts

@@ -3,6 +3,7 @@ import { createLogger } from '@aztec-labs/foundation/log';
 import { MAX_TX_SIZE_KB, TopicType, getTopicFromString } from '@aztec-labs/stdlib/p2p';
 import type { DataTransform } from '@chainsafe/libp2p-gossipsub/types';
 import type { Message } from '@libp2p/interface';
+import { Buffer } from 'buffer';
 import { webcrypto } from 'node:crypto';
 import { compressSync, uncompressSync } from 'snappy';
 

package/src/services/libp2p/libp2p_service.ts

@@ -33,7 +33,7 @@ import {
 } from '@aztec-labs/stdlib/p2p';
 import { ConsensusTimetable, getDefaultCheckpointProposalSyncGrace } from '@aztec-labs/stdlib/timetable';
 import { MerkleTreeId } from '@aztec-labs/stdlib/trees';
-import { Tx, type TxValidationResult } from '@aztec-labs/stdlib/tx';
+import { Tx, type TxValidationResult, isReceiverLocalStateDrift } from '@aztec-labs/stdlib/tx';
 import type { UInt64 } from '@aztec-labs/stdlib/types';
 import { InvalidBlockProposalTxsError } from '@aztec-labs/stdlib/validators';
 import { compressComponentVersions } from '@aztec-labs/stdlib/versioning';
@@ -62,6 +62,7 @@ import type { AddressManager, ConnectionManager } from '@libp2p/interface-intern
 import { tcp } from '@libp2p/tcp';
 import { multiaddr } from '@multiformats/multiaddr';
 import { ENR } from '@nethermindeth/enr';
+import { Buffer } from 'buffer';
 import { createLibp2p } from 'libp2p';
 
 import type { P2PConfig } from '../../config.js';
@@ -183,7 +184,10 @@ export class LibP2PService extends WithTracer implements P2PService {
   private protocolVersion = '';
   private topicStrings: Record<TopicType, string> = {} as Record<TopicType, string>;
 
-  /** Callback invoked when a duplicate proposal is detected (triggers slashing). */
+  /**
+   * Callback invoked when a second proposal is seen at one position, so the slot is marked as equivocated. It does not
+   * slash: the slasher attributes DUPLICATE_PROPOSAL per signer from the retained proposals.
+   */
   private duplicateProposalCallback?: (info: {
     slot: SlotNumber;
     proposer: EthAddress;
@@ -818,15 +822,25 @@ export class LibP2PService extends WithTracer implements P2PService {
    * empty committee every signer is accepted, so two distinct honest proposers for the same slot look
    * like equivocation; without an expected proposer there is no one to attribute the offense to.
    * Mirrors the guard in checkpoint_equivocation_watcher, which refuses to slash when the slot has no
-   * proposer.
+   * proposer. While the slot's committee is not stable on L1 there is no expected proposer yet either.
    */
   private async canAttributeDuplicateProposal(slot: SlotNumber): Promise<boolean> {
-    const expectedProposer = await this.epochCache.getProposerAttesterAddressInSlot(slot);
-    if (expectedProposer === undefined) {
-      this.logger.warn(`Not attributing duplicate proposal at slot ${slot}: no expected proposer (empty committee)`);
-      return false;
+    const expectedProposer = await this.epochCache.lookupProposer(slot);
+    switch (expectedProposer.state) {
+      case 'members':
+        return true;
+      case 'open':
+      case 'unstable':
+        this.logger.warn(
+          `Not attributing duplicate proposal at slot ${slot}: no expected proposer (empty or not yet stable committee)`,
+          { slot, committeeState: expectedProposer.state },
+        );
+        return false;
+      case 'none':
+        // The proposal validator rejects a slot without a committee before duplicates are counted, so this needs the
+        // committee to vanish in between. Throwing makes the gossip validator reject the message, as it does for that.
+        throw new Error(`No committee on L1 for slot ${slot}`);
     }
-    return true;
   }
 
   /**
@@ -1222,9 +1236,24 @@ export class LibP2PService extends WithTracer implements P2PService {
       } else if (wasIgnored) {
         return { result: TopicValidatorResult.Ignore, obj: tx };
       } else {
+        // The final pool insert rebuilt a fresh validator and rejected a tx that passed the earlier
+        // checks and proof. If the rejection is receiver-local state drift, the relayer forwarded a tx
+        // valid from its own view - ignore without penalizing it; only a sender-attributable reject penalizes.
+        const rejectionReasons = addResult.rejectionReasons?.get(txHash.toString()) ?? [];
+        if (isReceiverLocalStateDrift(rejectionReasons)) {
+          this.logger.verbose(
+            `Ignoring gossiped tx ${txHash.toString()}: pool rejected on receiver-local state drift`,
+            {
+              source: source.toString(),
+              reasons: rejectionReasons,
+            },
+          );
+          return { result: TopicValidatorResult.Ignore, obj: tx };
+        }
         this.logger.warn(`Gossiped tx ${txHash.toString()} unexpectedly rejected by pool`, {
           source: source.toString(),
           txHash: txHash.toString(),
+          reasons: rejectionReasons,
         });
         return { result: TopicValidatorResult.Reject, severity: PeerErrorSeverity.HighToleranceError };
       }

package/src/services/peer-manager/peer_manager.ts

@@ -3,6 +3,7 @@ import { compactArray } from '@aztec-labs/foundation/collection';
 import { makeEthSignDigest, tryRecoverAddress } from '@aztec-labs/foundation/crypto/secp256k1-signer';
 import { Fr } from '@aztec-labs/foundation/curves/bn254';
 import type { EthAddress } from '@aztec-labs/foundation/eth-address';
+import { inspect } from '@aztec-labs/foundation/inspect';
 import { createLogger } from '@aztec-labs/foundation/log';
 import { bufferToHex } from '@aztec-labs/foundation/string';
 import { DateProvider } from '@aztec-labs/foundation/timer';
@@ -13,7 +14,7 @@ import type { Connection, PeerId } from '@libp2p/interface';
 import { peerIdFromString } from '@libp2p/peer-id';
 import type { Multiaddr } from '@multiformats/multiaddr';
 import { ENR } from '@nethermindeth/enr';
-import { inspect } from 'util';
+import { Buffer } from 'buffer';
 
 import type { P2PConfig } from '../../config.js';
 import { PeerEvent } from '../../types/index.js';
@@ -424,6 +425,9 @@ export class PeerManager implements PeerManagerInterface {
       this.authenticatedPeerIdToValidatorAddress.delete(peerIdStr);
     }
 
+    // Keep a disconnected non-healthy peer's score so a reconnect resumes its penalty rather than starting
+    // clean. The score and ban maps are bounded (PeerScoring retention caps), so retaining them cannot grow
+    // the heartbeat-scanned state without limit under identity churn. A healthy peer carries no penalty to keep.
     if (this.peerScoring.getScoreState(peerIdStr) === PeerScoreState.Healthy) {
       this.peerScoring.removePeer(peerIdStr);
     }