@aztec-labs/stdlib 6.0.0 → 6.1.0-nightly.20261024

package/src/gas/rollup_fee_config.ts

@@ -0,0 +1,141 @@
+import type { RollupContract } from '@aztec-labs/ethereum/contracts';
+import { type Logger, createLogger } from '@aztec-labs/foundation/log';
+import { RunningPromise } from '@aztec-labs/foundation/running-promise';
+
+/** Rollup fee settings that governance can change on L1, as read at one L1 block. */
+export type RollupFeeConfig = {
+  manaTarget: bigint;
+  /** Read from L1 (getManaLimit), not derived as 2 x target. */
+  manaLimit: bigint;
+  provingCostPerManaInEth: bigint;
+  protocolFeeMarginBps: number;
+  /** L1 block the values were read at. */
+  l1BlockNumber: bigint;
+};
+
+/** Source of the rollup's live fee settings. */
+export interface RollupFeeConfigProvider {
+  /**
+   * Last config successfully read from L1. Usually at most one polling interval old, but it stays at the last good
+   * read for as long as L1 reads keep failing.
+   */
+  getFeeConfig(): RollupFeeConfig;
+}
+
+/**
+ * Default polling interval. Each pass reads L1's block number through the client's cache, and reads the fee settings
+ * only when that block is newer than the last read, so it is cheap.
+ */
+const DEFAULT_POLLING_INTERVAL_MS = 1_000;
+
+/** Keeps a RollupFeeConfig in step with L1 by polling the rollup. */
+export class RollupFeeConfigTracker implements RollupFeeConfigProvider {
+  private readonly loop: RunningPromise;
+
+  private constructor(
+    private readonly rollup: RollupContract,
+    private latest: RollupFeeConfig,
+    pollingIntervalMs: number,
+    private readonly log: Logger,
+  ) {
+    this.loop = new RunningPromise(() => this.poll(), log, pollingIntervalMs);
+  }
+
+  /** Does the first read, so getFeeConfig() always has a value. */
+  public static async create(
+    rollup: RollupContract,
+    opts: { pollingIntervalMs?: number; logger?: Logger } = {},
+  ): Promise<RollupFeeConfigTracker> {
+    const log = opts.logger ?? createLogger('rollup-fee-config');
+    const l1BlockNumber = await rollup.client.getBlockNumber();
+    const initial = await readRollupFeeConfig(rollup, l1BlockNumber);
+    log.info(`Read rollup fee config at L1 block ${l1BlockNumber}`, initial);
+    return new RollupFeeConfigTracker(rollup, initial, opts.pollingIntervalMs ?? DEFAULT_POLLING_INTERVAL_MS, log);
+  }
+
+  public start(): void {
+    this.loop.start();
+  }
+
+  public async stop(): Promise<void> {
+    await this.loop.stop();
+  }
+
+  public getFeeConfig(): RollupFeeConfig {
+    return this.latest;
+  }
+
+  /**
+   * One pass of the polling loop: reads the config at L1's latest block. It takes the client's cached block number and
+   * skips blocks it has already read, so a pass within the cache window costs no new reads, and a lagging RPC node
+   * cannot move the value back. A failed read only logs: the last value stays until a later pass succeeds.
+   */
+  private async poll(): Promise<void> {
+    try {
+      const l1BlockNumber = await this.rollup.client.getBlockNumber();
+      if (l1BlockNumber <= this.latest.l1BlockNumber) {
+        return;
+      }
+      this.update(await readRollupFeeConfig(this.rollup, l1BlockNumber));
+    } catch (err) {
+      this.log.warn(`Failed to refresh rollup fee config from L1, keeping the last value`, {
+        err,
+        l1BlockNumber: this.latest.l1BlockNumber,
+      });
+    }
+  }
+
+  private update(config: RollupFeeConfig): void {
+    const previous = this.latest;
+    this.latest = config;
+    if (
+      config.manaTarget !== previous.manaTarget ||
+      config.manaLimit !== previous.manaLimit ||
+      config.provingCostPerManaInEth !== previous.provingCostPerManaInEth ||
+      config.protocolFeeMarginBps !== previous.protocolFeeMarginBps
+    ) {
+      this.log.info(`Rollup fee config changed at L1 block ${config.l1BlockNumber}`, config);
+    }
+  }
+}
+
+/**
+ * A provider that never reads L1, for tests and for nodes that run without one. The default leaves the mana limit
+ * effectively unbounded.
+ */
+export class TestRollupFeeConfigProvider implements RollupFeeConfigProvider {
+  private config: RollupFeeConfig;
+
+  constructor(config: Partial<RollupFeeConfig> = {}) {
+    this.config = { ...DEFAULT_TEST_ROLLUP_FEE_CONFIG, ...config };
+  }
+
+  /** Replaces some of the values, as a governance update would. */
+  public setFeeConfig(config: Partial<RollupFeeConfig>): void {
+    this.config = { ...this.config, ...config };
+  }
+
+  public getFeeConfig(): RollupFeeConfig {
+    return this.config;
+  }
+}
+
+const DEFAULT_TEST_ROLLUP_FEE_CONFIG: RollupFeeConfig = {
+  manaTarget: BigInt(Math.floor(Number.MAX_SAFE_INTEGER / 2)),
+  manaLimit: BigInt(Number.MAX_SAFE_INTEGER),
+  provingCostPerManaInEth: 0n,
+  protocolFeeMarginBps: 0,
+  l1BlockNumber: 0n,
+};
+
+/** Reads every fee setting at the same L1 block, so the values describe one state. */
+async function readRollupFeeConfig(rollup: RollupContract, l1BlockNumber: bigint): Promise<RollupFeeConfig> {
+  const opts = { blockNumber: l1BlockNumber };
+  const [manaTarget, manaLimit, provingCostPerManaInEth, protocolFeeMarginBps] = await Promise.all([
+    rollup.getManaTarget(opts),
+    rollup.getManaLimit(opts),
+    rollup.getProvingCostPerMana(opts),
+    rollup.getProtocolFeeMargin(opts),
+  ]);
+  return { manaTarget, manaLimit, provingCostPerManaInEth, protocolFeeMarginBps, l1BlockNumber };
+}

package/src/gas/tx_gas_limits.ts

@@ -10,6 +10,7 @@ import {
 import { type ProposerTimetableConfig, buildProposerTimetable } from '../timetable/build_proposer_timetable.js';
 import type { SlotTimingConstants } from '../timetable/consensus_timetable.js';
 import { Gas } from './gas.js';
+import type { RollupFeeConfig } from './rollup_fee_config.js';
 
 /**
  * Network-minimum per-block budget multiplier for L2 gas and tx-count allocation. A block packer must
@@ -75,7 +76,7 @@ export function getDaCheckpointBudgetForTxs(maxBlocksPerCheckpoint: number): num
  * raw blob capacity net of encoding overhead for every block — so the admission limit is consistent with the
  * builder's blob-field cap.
  *
- * @param manaCheckpointBudget - L2 (mana) budget per checkpoint (`rollupManaLimit`).
+ * @param manaCheckpointBudget - L2 (mana) budget per checkpoint (the rollup's live mana limit).
  */
 export function computeNetworkTxGasLimits(opts: { maxBlocksPerCheckpoint: number; manaCheckpointBudget: number }): Gas {
   const blocks = Math.max(1, opts.maxBlocksPerCheckpoint);
@@ -101,15 +102,17 @@ export function computeNetworkTxGasLimits(opts: { maxBlocksPerCheckpoint: number
 }
 
 /**
- * Network tx gas limits derived from a sequencer/p2p config and the L1 slot-timing + mana constants. The
- * single source of truth shared by `getNodeInfo` (advertising) and the RPC/gossip/pool gas validators
- * (enforcing), so a node never rejects a tx it advertised as admissible. Always uses the network-minimum
- * multipliers, never the node's (possibly higher) configured multipliers.
+ * Network tx gas limits derived from a sequencer/p2p config, the L1 slot-timing constants and the rollup's live
+ * mana limit. The single source of truth shared by `getNodeInfo` (advertising) and the RPC/gossip/pool gas
+ * validators (enforcing), so a node never rejects a tx it advertised as admissible. Always uses the network-minimum
+ * multipliers, never the node's (possibly higher) configured multipliers. Callers pass the fee config they read for
+ * this call, so a mana limit raised by governance takes effect without a restart.
  */
 export function getNetworkTxGasLimits(
   config: ProposerTimetableConfig,
-  l1Constants: SlotTimingConstants & { rollupManaLimit: number },
+  l1Constants: SlotTimingConstants,
+  feeConfig: Pick<RollupFeeConfig, 'manaLimit'>,
 ): Gas {
   const maxBlocksPerCheckpoint = buildProposerTimetable(config, l1Constants).getMaxBlocksPerCheckpoint();
-  return computeNetworkTxGasLimits({ maxBlocksPerCheckpoint, manaCheckpointBudget: l1Constants.rollupManaLimit });
+  return computeNetworkTxGasLimits({ maxBlocksPerCheckpoint, manaCheckpointBudget: Number(feeConfig.manaLimit) });
 }

package/src/interfaces/block-builder.ts

@@ -87,7 +87,7 @@ export interface PublicProcessorValidator {
   nullifierCache?: { addNullifiers: (nullifiers: Buffer[]) => void };
 }
 
-export type FullNodeBlockBuilderConfig = Pick<L1RollupConstants, 'l1GenesisTime' | 'slotDuration' | 'rollupManaLimit'> &
+export type FullNodeBlockBuilderConfig = Pick<L1RollupConstants, 'l1GenesisTime' | 'slotDuration'> &
   Pick<ChainConfig, 'l1ChainId' | 'rollupVersion'> &
   Pick<
     SequencerConfig,
@@ -112,7 +112,6 @@ export const FullNodeBlockBuilderConfigKeys: (keyof FullNodeBlockBuilderConfig)[
   'maxTxsPerCheckpoint',
   'maxL2BlockGas',
   'maxDABlockGas',
-  'rollupManaLimit',
 ] as const;
 
 /** Thrown when the number of successfully processed transactions is below the required minimum. */

package/src/p2p/checkpoint_proposal.ts

@@ -310,9 +310,11 @@ export class CheckpointProposal extends Gossipable implements Signable {
 
     // Decoding is lenient on purpose, for forward compatibility: trailing bytes are ignored and any non-zero
     // presence flag reads as present, so a newer version can append fields that older nodes skip over. Rejecting
-    // them would make every wire extension a coordinated upgrade. Lenient decoding does not let one proposal take
-    // several identities, since the P2P message identifier and the signature both cover the signed payload rather
-    // than the raw bytes.
+    // them would make every wire extension a coordinated upgrade. One signed payload can therefore reach the
+    // network under several encodings, each with its own P2P message identifier, which hashes the raw bytes. In
+    // particular the signature and the payload hash cover the checkpoint header, archive and fee modifier but not
+    // the embedded last block, so the same signed payload can travel with or without that block. The gossip layer
+    // must not treat a stored payload hash as covering the embedded block.
 
     const checkpointHeader = reader.readObject(CheckpointHeader);
     const archive = reader.readObject(Fr);

package/src/validators/errors.ts

@@ -66,6 +66,10 @@ export class ReExStateMismatchError extends ValidatorError {
   constructor(
     public readonly expectedArchiveRoot: Fr,
     public readonly actualArchiveRoot: Fr,
+    // Which of the two comparisons failed. Only an archive-only mismatch binds a checkpoint that commits to this block
+    // as the committed sequence's last; see checkpointCommitsToRejectedBlock.
+    public readonly headerMismatch: boolean,
+    public readonly archiveMismatch: boolean,
   ) {
     super('Re-execution state mismatch');
   }

package/src/validators/schemas.ts

@@ -13,6 +13,8 @@ import type {
 export const ValidatorStatusInSlotSchema = zodFor<ValidatorStatusInSlot>()(
   z.enum([
     'checkpoint-mined',
+    'checkpoint-unpublished',
+    'checkpoint-orphaned',
     'checkpoint-valid',
     'checkpoint-invalid',
     'checkpoint-unvalidated',

package/src/validators/types.ts

@@ -6,13 +6,19 @@ export type ValidatorStatusType = 'proposer' | 'attestation';
 /**
  * Per-slot status for a validator.
  *
- * Proposer statuses (six-case taxonomy):
+ * Proposer statuses (six-case taxonomy, with case 5 refined into 5a and 5b):
  * - `blocks-missed`           — no block proposals seen for the slot (case 1).
  * - `checkpoint-missed`       — block proposals seen but no checkpoint proposal (case 2).
  * - `checkpoint-unvalidated`  — checkpoint proposal seen but local re-execution couldn't
  *                               validate (missing txs, timeouts, etc.) (case 3).
  * - `checkpoint-invalid`      — checkpoint proposal re-executed and rejected as invalid (case 4).
- * - `checkpoint-valid`        — checkpoint proposal re-executed locally as valid (case 5).
+ * - `checkpoint-valid`        — checkpoint proposal re-executed locally as valid, but it did not reach L1 and
+ *                               could not be refined into 5a or 5b (e.g. below quorum, equivocation) (case 5).
+ * - `checkpoint-orphaned`     — valid checkpoint proposal that could not land because the parent it built on never
+ *                               landed on L1, or because an earlier slot landed its checkpoint number after it reached
+ *                               quorum (case 5b).
+ * - `checkpoint-unpublished`  — valid checkpoint proposal with its parent on L1 and a quorum of attestations,
+ *                               which the proposer still failed to land on L1 (case 5a).
  * - `checkpoint-mined`        — checkpoint published on L1 (case 6).
  *
  * Attestor statuses:
@@ -22,6 +28,8 @@ export type ValidatorStatusType = 'proposer' | 'attestation';
  */
 export type ValidatorStatusInSlot =
   | 'checkpoint-mined'
+  | 'checkpoint-unpublished'
+  | 'checkpoint-orphaned'
   | 'checkpoint-valid'
   | 'checkpoint-invalid'
   | 'checkpoint-unvalidated'