@aztec-labs/validator-client 6.0.0-nightly.20260829

package/src/key_store/web3signer_key_store.ts

@@ -0,0 +1,188 @@
+import type { Buffer32 } from '@aztec-labs/foundation/buffer';
+import { normalizeSignature } from '@aztec-labs/foundation/crypto/secp256k1-signer';
+import { EthAddress } from '@aztec-labs/foundation/eth-address';
+import { Signature } from '@aztec-labs/foundation/eth-signature';
+import type { SigningContext } from '@aztec-labs/validator-ha-signer/types';
+import type { TypedDataDefinition } from 'viem';
+
+import type { ValidatorKeyStore } from './interface.js';
+
+/** Default hard timeout (ms) applied to each Web3Signer HTTP request. */
+const DEFAULT_WEB3SIGNER_REQUEST_TIMEOUT_MS = 30_000;
+
+/**
+ * Web3Signer Key Store
+ *
+ * An implementation of the Key store using Web3Signer remote signing service.
+ * This implementation uses the Web3Signer JSON-RPC API for secp256k1 signatures.
+ */
+export class Web3SignerKeyStore implements ValidatorKeyStore {
+  private readonly requestTimeoutMs: number;
+
+  constructor(
+    private addresses: EthAddress[],
+    private baseUrl: string,
+    requestTimeoutMs: number = DEFAULT_WEB3SIGNER_REQUEST_TIMEOUT_MS,
+  ) {
+    this.requestTimeoutMs = requestTimeoutMs;
+  }
+
+  /**
+   * Get the address of a signer by index
+   *
+   * @param index - The index of the signer
+   * @returns the address
+   */
+  public getAddress(index: number): EthAddress {
+    if (index >= this.addresses.length) {
+      throw new Error(`Index ${index} is out of bounds.`);
+    }
+    return this.addresses[index];
+  }
+
+  /**
+   * Get all addresses
+   *
+   * @returns all addresses
+   */
+  public getAddresses(): EthAddress[] {
+    return this.addresses;
+  }
+
+  /**
+   * Sign EIP-712 typed data with all keystore addresses
+   * @param typedData - The complete EIP-712 typed data structure (domain, types, primaryType, message)
+   * @param _context - Signing context (ignored by Web3SignerKeyStore, used for HA protection)
+   * @return signatures
+   */
+  public signTypedData(typedData: TypedDataDefinition, _context: SigningContext): Promise<Signature[]> {
+    return Promise.all(this.addresses.map(address => this.makeJsonRpcSignTypedDataRequest(address, typedData)));
+  }
+
+  /**
+   * Sign EIP-712 typed data with a specific address
+   * @param address - The address of the signer to use
+   * @param typedData - The complete EIP-712 typed data structure (domain, types, primaryType, message)
+   * @param _context - Signing context (ignored by Web3SignerKeyStore, used for HA protection)
+   * @returns signature for the specified address
+   * @throws Error if the address is not found in the keystore or signing fails
+   */
+  public async signTypedDataWithAddress(
+    address: EthAddress,
+    typedData: TypedDataDefinition,
+    _context: SigningContext,
+  ): Promise<Signature> {
+    if (!this.addresses.some(addr => addr.equals(address))) {
+      throw new Error(`Address ${address.toString()} not found in keystore`);
+    }
+
+    return await this.makeJsonRpcSignTypedDataRequest(address, typedData);
+  }
+
+  /**
+   * Sign a message with all keystore addresses using EIP-191 prefix
+   *
+   * @param message - The message to sign
+   * @param _context - Signing context (ignored by Web3SignerKeyStore, used for HA protection)
+   * @return signatures
+   */
+  public signMessage(message: Buffer32, _context: SigningContext): Promise<Signature[]> {
+    return Promise.all(this.addresses.map(address => this.makeJsonRpcSignRequest(address, message)));
+  }
+
+  /**
+   * Sign a message with a specific address using EIP-191 prefix
+   * @param address - The address of the signer to use
+   * @param message - The message to sign
+   * @param _context - Signing context (ignored by Web3SignerKeyStore, used for HA protection)
+   * @returns signature for the specified address
+   * @throws Error if the address is not found in the keystore or signing fails
+   */
+  public async signMessageWithAddress(
+    address: EthAddress,
+    message: Buffer32,
+    _context: SigningContext,
+  ): Promise<Signature> {
+    if (!this.addresses.some(addr => addr.equals(address))) {
+      throw new Error(`Address ${address.toString()} not found in keystore`);
+    }
+    return await this.makeJsonRpcSignRequest(address, message);
+  }
+
+  /**
+   * Make a JSON-RPC sign request to Web3Signer using eth_sign
+   * @param address - The Ethereum address to sign with
+   * @param data - The data to sign
+   * @returns The signature
+   */
+  private makeJsonRpcSignRequest(address: EthAddress, data: Buffer32): Promise<Signature> {
+    // eth_sign automatically applies Ethereum message prefixing to the raw data.
+    return this.sendSignRequest({
+      jsonrpc: '2.0',
+      method: 'eth_sign',
+      params: [address.toString(), data.toString()],
+      id: 1,
+    });
+  }
+
+  private makeJsonRpcSignTypedDataRequest(address: EthAddress, typedData: TypedDataDefinition): Promise<Signature> {
+    return this.sendSignRequest({
+      jsonrpc: '2.0',
+      method: 'eth_signTypedData',
+      params: [address.toString(), JSON.stringify(typedData)],
+      id: 1,
+    });
+  }
+
+  /**
+   * Send a JSON-RPC request to Web3Signer under a hard request timeout and parse the signature.
+   * A timed-out or aborted request is surfaced as a clear timeout error rather than hanging, so a
+   * slow or unreachable signer cannot stall an HA signing operation past its own timeout budget.
+   */
+  private async sendSignRequest(body: object): Promise<Signature> {
+    let response: Response;
+    try {
+      response = await fetch(this.baseUrl, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(this.requestTimeoutMs),
+      });
+    } catch (err) {
+      if (
+        (err instanceof Error || err instanceof DOMException) &&
+        (err.name === 'TimeoutError' || err.name === 'AbortError')
+      ) {
+        throw new Error(`Web3Signer request timed out after ${this.requestTimeoutMs}ms`);
+      }
+      throw err;
+    }
+
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`Web3Signer request failed: ${response.status} ${response.statusText} - ${errorText}`);
+    }
+
+    const result = await response.json();
+
+    // Handle JSON-RPC response format
+    if (result.error) {
+      throw new Error(`Web3Signer JSON-RPC error: ${result.error.code} - ${result.error.message}`);
+    }
+
+    if (!result.result) {
+      throw new Error('Invalid response from Web3Signer: no result found');
+    }
+
+    let signatureHex = result.result;
+
+    // Ensure the signature has the 0x prefix
+    if (!signatureHex.startsWith('0x')) {
+      signatureHex = '0x' + signatureHex;
+    }
+
+    return normalizeSignature(Signature.fromString(signatureHex as `0x${string}`));
+  }
+}

package/src/metrics.ts

@@ -0,0 +1,150 @@
+import type { EpochNumber } from '@aztec-labs/foundation/branded-types';
+import type { EthAddress } from '@aztec-labs/foundation/eth-address';
+import type { BlockProposal } from '@aztec-labs/stdlib/p2p';
+import {
+  Attributes,
+  type Gauge,
+  type Histogram,
+  Metrics,
+  type TelemetryClient,
+  type UpDownCounter,
+  createUpDownCounterWithDefault,
+} from '@aztec-labs/telemetry-client';
+
+import type { BlockProposalValidationFailureReason } from './proposal_handler.js';
+
+export class ValidatorMetrics {
+  private failedReexecutionCounter: UpDownCounter;
+  private successfulAttestationsCount: UpDownCounter;
+  private failedAttestationsBadProposalCount: UpDownCounter;
+  private failedAttestationsNodeIssueCount: UpDownCounter;
+  private currentEpoch: Gauge;
+  private attestedEpochCount: UpDownCounter;
+
+  private reexMana: Histogram;
+  private reexTx: Histogram;
+  private reexDuration: Gauge;
+  private checkpointProposalToPipelinedStateDuration: Histogram;
+  private checkpointProposalReceiveOffsetFromNextSlotBoundary: Histogram;
+
+  constructor(telemetryClient: TelemetryClient) {
+    const meter = telemetryClient.getMeter('Validator');
+
+    this.failedReexecutionCounter = createUpDownCounterWithDefault(meter, Metrics.VALIDATOR_FAILED_REEXECUTION_COUNT, {
+      [Attributes.STATUS]: ['failed'],
+    });
+
+    this.successfulAttestationsCount = createUpDownCounterWithDefault(
+      meter,
+      Metrics.VALIDATOR_ATTESTATION_SUCCESS_COUNT,
+    );
+
+    this.failedAttestationsBadProposalCount = createUpDownCounterWithDefault(
+      meter,
+      Metrics.VALIDATOR_ATTESTATION_FAILED_BAD_PROPOSAL_COUNT,
+      {
+        [Attributes.ERROR_TYPE]: [
+          'invalid_proposal',
+          'state_mismatch',
+          'failed_txs',
+          'parent_block_wrong_slot',
+          'duplicate_txs',
+          'invalid_embedded_txs',
+        ],
+        [Attributes.IS_COMMITTEE_MEMBER]: [true, false],
+      },
+    );
+
+    this.failedAttestationsNodeIssueCount = createUpDownCounterWithDefault(
+      meter,
+      Metrics.VALIDATOR_ATTESTATION_FAILED_NODE_ISSUE_COUNT,
+      {
+        [Attributes.ERROR_TYPE]: [
+          'parent_block_not_found',
+          'global_variables_mismatch',
+          'block_number_already_exists',
+          'txs_not_available',
+          'timeout',
+          'unknown_error',
+        ],
+        [Attributes.IS_COMMITTEE_MEMBER]: [true, false],
+      },
+    );
+
+    this.currentEpoch = meter.createGauge(Metrics.VALIDATOR_CURRENT_EPOCH);
+
+    this.attestedEpochCount = createUpDownCounterWithDefault(meter, Metrics.VALIDATOR_ATTESTED_EPOCH_COUNT);
+
+    this.reexMana = meter.createHistogram(Metrics.VALIDATOR_RE_EXECUTION_MANA);
+
+    this.reexTx = meter.createHistogram(Metrics.VALIDATOR_RE_EXECUTION_TX_COUNT);
+
+    this.reexDuration = meter.createGauge(Metrics.VALIDATOR_RE_EXECUTION_TIME);
+    this.checkpointProposalToPipelinedStateDuration = meter.createHistogram(
+      Metrics.VALIDATOR_CHECKPOINT_PROPOSAL_TO_PIPELINED_STATE_DURATION,
+    );
+    this.checkpointProposalReceiveOffsetFromNextSlotBoundary = meter.createHistogram(
+      Metrics.VALIDATOR_CHECKPOINT_PROPOSAL_RECEIVE_OFFSET_FROM_NEXT_SLOT_BOUNDARY,
+    );
+  }
+
+  public recordReex(time: number, txs: number, mManaTotal: number) {
+    this.reexDuration.record(Math.ceil(time));
+    this.reexTx.record(txs);
+    this.reexMana.record(mManaTotal);
+  }
+
+  public recordCheckpointProposalToPipelinedStateDuration(durationMs: number) {
+    this.checkpointProposalToPipelinedStateDuration.record(Math.ceil(durationMs));
+  }
+
+  public recordCheckpointProposalReceiveOffsetFromNextSlotBoundary(offsetMs: number) {
+    this.checkpointProposalReceiveOffsetFromNextSlotBoundary.record(Math.ceil(Math.abs(offsetMs)), {
+      [Attributes.SLOT_BOUNDARY_SIDE]: offsetMs < 0 ? 'before' : 'after',
+    });
+  }
+
+  public recordFailedReexecution(proposal: BlockProposal) {
+    const proposer = proposal.getSender();
+    this.failedReexecutionCounter.add(1, {
+      [Attributes.STATUS]: 'failed',
+      [Attributes.BLOCK_PROPOSER]: proposer?.toString() ?? 'unknown',
+    });
+  }
+
+  public incSuccessfulAttestations(num: number) {
+    this.successfulAttestationsCount.add(num);
+  }
+
+  public incFailedAttestationsBadProposal(
+    num: number,
+    reason: BlockProposalValidationFailureReason,
+    inCommittee: boolean,
+  ) {
+    this.failedAttestationsBadProposalCount.add(num, {
+      [Attributes.ERROR_TYPE]: reason,
+      [Attributes.IS_COMMITTEE_MEMBER]: inCommittee,
+    });
+  }
+
+  public incFailedAttestationsNodeIssue(
+    num: number,
+    reason: BlockProposalValidationFailureReason,
+    inCommittee: boolean,
+  ) {
+    this.failedAttestationsNodeIssueCount.add(num, {
+      [Attributes.ERROR_TYPE]: reason,
+      [Attributes.IS_COMMITTEE_MEMBER]: inCommittee,
+    });
+  }
+
+  /** Update the gauge tracking the current epoch number (proxy for total epochs elapsed). */
+  public setCurrentEpoch(epoch: EpochNumber) {
+    this.currentEpoch.record(Number(epoch));
+  }
+
+  /** Increment the count of epochs in which the given attester submitted at least one attestation. */
+  public incAttestedEpochCount(attester: EthAddress) {
+    this.attestedEpochCount.add(1, { [Attributes.ATTESTER_ADDRESS]: attester.toString() });
+  }
+}