@aztec/p2p 0.0.0-test.1 → 0.0.1-commit.017a351

package/src/services/libp2p/libp2p_service.ts

@@ -1,73 +1,121 @@
 import type { EpochCacheInterface } from '@aztec/epoch-cache';
-import { Fr } from '@aztec/foundation/fields';
-import { createLibp2pComponentLogger, createLogger } from '@aztec/foundation/log';
-import { SerialQueue } from '@aztec/foundation/queue';
+import { BlockNumber, type SlotNumber } from '@aztec/foundation/branded-types';
+import { maxBy, merge } from '@aztec/foundation/collection';
+import { type Logger, createLibp2pComponentLogger, createLogger } from '@aztec/foundation/log';
 import { RunningPromise } from '@aztec/foundation/running-promise';
+import { Timer } from '@aztec/foundation/timer';
 import type { AztecAsyncKVStore } from '@aztec/kv-store';
-import type { L2BlockSource } from '@aztec/stdlib/block';
+import { protocolContractsHash } from '@aztec/protocol-contracts';
+import type { EthAddress, L2BlockSource } from '@aztec/stdlib/block';
+import type { ContractDataSource } from '@aztec/stdlib/contract';
+import { type BlockMinFeesProvider, GasFees } from '@aztec/stdlib/gas';
 import type { ClientProtocolCircuitVerifier, PeerInfo, WorldStateSynchronizer } from '@aztec/stdlib/interfaces/server';
 import {
-  BlockAttestation,
   BlockProposal,
+  CheckpointAttestation,
+  CheckpointProposal,
+  type CheckpointProposalCore,
   type Gossipable,
-  P2PClientType,
+  P2PMessage,
   PeerErrorSeverity,
-  TopicTypeMap,
-  getTopicTypeForClientType,
+  PeerErrorSeverityByHarshness,
+  TopicType,
+  createTopicString,
+  getTopicsForConfig,
   metricsTopicStrToLabels,
 } from '@aztec/stdlib/p2p';
 import { MerkleTreeId } from '@aztec/stdlib/trees';
-import { Tx, type TxHash, type TxValidationResult } from '@aztec/stdlib/tx';
-import { Attributes, OtelMetricsAdapter, type TelemetryClient, WithTracer, trackSpan } from '@aztec/telemetry-client';
+import { Tx, type TxValidationResult } from '@aztec/stdlib/tx';
+import type { UInt64 } from '@aztec/stdlib/types';
+import { compressComponentVersions } from '@aztec/stdlib/versioning';
+import {
+  Attributes,
+  OtelMetricsAdapter,
+  SpanStatusCode,
+  type TelemetryClient,
+  WithTracer,
+  trackSpan,
+} from '@aztec/telemetry-client';
 
-import type { ENR } from '@chainsafe/enr';
 import {
   type GossipSub,
   type GossipSubComponents,
   type GossipsubMessage,
   gossipsub,
 } from '@chainsafe/libp2p-gossipsub';
-import { createPeerScoreParams, createTopicScoreParams } from '@chainsafe/libp2p-gossipsub/score';
+import { createPeerScoreParams } from '@chainsafe/libp2p-gossipsub/score';
 import { SignaturePolicy } from '@chainsafe/libp2p-gossipsub/types';
 import { noise } from '@chainsafe/libp2p-noise';
 import { yamux } from '@chainsafe/libp2p-yamux';
 import { bootstrap } from '@libp2p/bootstrap';
 import { identify } from '@libp2p/identify';
-import { type Message, type PeerId, TopicValidatorResult } from '@libp2p/interface';
-import type { ConnectionManager } from '@libp2p/interface-internal';
-import '@libp2p/kad-dht';
+import { type Message, type MultiaddrConnection, type PeerId, TopicValidatorResult } from '@libp2p/interface';
+import type { AddressManager, ConnectionManager } from '@libp2p/interface-internal';
 import { mplex } from '@libp2p/mplex';
 import { tcp } from '@libp2p/tcp';
+import { multiaddr } from '@multiformats/multiaddr';
+import { ENR } from '@nethermindeth/enr';
 import { createLibp2p } from 'libp2p';
 
 import type { P2PConfig } from '../../config.js';
+import { CheckpointProposalReceivedCallbackNotRegisteredError } from '../../errors/p2p-service.error.js';
 import type { MemPools } from '../../mem_pools/interface.js';
-import { AttestationValidator, BlockProposalValidator } from '../../msg_validators/index.js';
 import {
-  DataTxValidator,
+  BlockProposalValidator,
+  CheckpointAttestationValidator,
+  CheckpointProposalValidator,
   DoubleSpendTxValidator,
-  MetadataTxValidator,
-  TxProofValidator,
-} from '../../msg_validators/tx_validator/index.js';
+  FishermanAttestationValidator,
+  getDefaultAllowedSetupFunctions,
+} from '../../msg_validators/index.js';
+import { MessageSeenValidator } from '../../msg_validators/msg_seen_validator/msg_seen_validator.js';
+import {
+  type TransactionValidator,
+  createFirstStageTxValidationsForGossipedTransactions,
+  createSecondStageTxValidationsForGossipedTransactions,
+  createTxValidatorForBlockProposalReceivedTxs,
+} from '../../msg_validators/tx_validator/factory.js';
+import { TxValidationCache } from '../../msg_validators/tx_validator/tx_validation_cache.js';
 import { GossipSubEvent } from '../../types/index.js';
 import { type PubSubLibp2p, convertToMultiaddr } from '../../util.js';
+import { getVersions } from '../../versioning.js';
 import { AztecDatastore } from '../data_store.js';
+import { DiscV5Service } from '../discv5/discV5_service.js';
 import { SnappyTransform, fastMsgIdFn, getMsgIdFn, msgIdToStrFn } from '../encoding.js';
-import { gossipScoreThresholds } from '../gossipsub/scoring.js';
+import { APP_SPECIFIC_WEIGHT, gossipScoreThresholds } from '../gossipsub/scoring.js';
+import { createAllTopicScoreParams } from '../gossipsub/topic_score_params.js';
+import type { PeerManagerInterface } from '../peer-manager/interface.js';
 import { PeerManager } from '../peer-manager/peer_manager.js';
 import { PeerScoring } from '../peer-manager/peer_scoring.js';
-import { DEFAULT_SUB_PROTOCOL_VALIDATORS, ReqRespSubProtocol, type SubProtocolMap } from '../reqresp/interface.js';
-import { reqGoodbyeHandler } from '../reqresp/protocols/goodbye.js';
-import { pingHandler, reqRespBlockHandler, reqRespTxHandler, statusHandler } from '../reqresp/protocols/index.js';
+import type { BatchTxRequesterLibP2PService } from '../reqresp/batch-tx-requester/interface.js';
+import type { P2PReqRespConfig } from '../reqresp/config.js';
+import {
+  AuthRequest,
+  BlockTxsRequest,
+  BlockTxsResponse,
+  type ReqRespInterface,
+  type ReqRespResponse,
+  ReqRespSubProtocol,
+  type ReqRespSubProtocolHandler,
+  type ReqRespSubProtocolHandlers,
+  StatusMessage,
+  ValidationError,
+  pingHandler,
+  reqGoodbyeHandler,
+  reqRespBlockTxsHandler,
+  reqRespStatusHandler,
+  reqRespTxHandler,
+} from '../reqresp/index.js';
 import { ReqResp } from '../reqresp/reqresp.js';
-import type { P2PService, PeerDiscoveryService } from '../service.js';
-
-interface MessageValidator {
-  validator: {
-    validateTx(tx: Tx): Promise<TxValidationResult>;
-  };
-  severity: PeerErrorSeverity;
-}
+import type {
+  P2PBlockReceivedCallback,
+  P2PCheckpointAttestationCallback,
+  P2PCheckpointReceivedCallback,
+  P2PDuplicateAttestationCallback,
+  P2PService,
+  PeerDiscoveryService,
+} from '../service.js';
+import { P2PInstrumentation } from './instrumentation.js';
 
 interface ValidationResult {
   name: string;
@@ -77,146 +125,331 @@ interface ValidationResult {
 
 type ValidationOutcome = { allPassed: true } | { allPassed: false; failure: ValidationResult };
 
+// REFACTOR: Unify with the type above
+type ReceivedMessageValidationResult<T, M = undefined> =
+  | { obj: T; result: Exclude<TopicValidatorResult, TopicValidatorResult.Reject>; metadata?: M }
+  | { obj?: T; result: TopicValidatorResult.Reject; metadata?: M; severity: PeerErrorSeverity };
+
 /**
  * Lib P2P implementation of the P2PService interface.
  */
-export class LibP2PService<T extends P2PClientType> extends WithTracer implements P2PService {
-  private jobQueue: SerialQueue = new SerialQueue();
-  private peerManager: PeerManager;
+export class LibP2PService extends WithTracer implements P2PService {
   private discoveryRunningPromise?: RunningPromise;
+  private msgIdSeenValidators: Record<TopicType, MessageSeenValidator> = {} as Record<TopicType, MessageSeenValidator>;
 
   // Message validators
-  private attestationValidator: AttestationValidator;
   private blockProposalValidator: BlockProposalValidator;
+  private checkpointProposalValidator: CheckpointProposalValidator;
+  private checkpointAttestationValidator: CheckpointAttestationValidator;
 
-  // Request and response sub service
-  public reqresp: ReqResp;
+  private protocolVersion = '';
+  private topicStrings: Record<TopicType, string> = {} as Record<TopicType, string>;
+
+  /** Callback invoked when a duplicate proposal is detected (triggers slashing). */
+  private duplicateProposalCallback?: (info: {
+    slot: SlotNumber;
+    proposer: EthAddress;
+    type: 'checkpoint' | 'block';
+  }) => void;
+
+  /** Callback invoked when a duplicate attestation is detected (triggers slashing). */
+  private duplicateAttestationCallback?: P2PDuplicateAttestationCallback;
+
+  /** Callback invoked when a valid checkpoint attestation is accepted into the pool. */
+  private checkpointAttestationCallback?: P2PCheckpointAttestationCallback;
 
   /**
    * Callback for when a block is received from a peer.
    * @param block - The block received from the peer.
    * @returns The attestation for the block, if any.
    */
-  private blockReceivedCallback: (block: BlockProposal) => Promise<BlockAttestation | undefined>;
+  private blockReceivedCallback: P2PBlockReceivedCallback;
+
+  /**
+   * Callback for when a checkpoint proposal is received from a peer.
+   * @param checkpoint - The checkpoint proposal received from the peer.
+   * @returns The attestations for the checkpoint, if any.
+   */
+  private allNodesCheckpointReceivedCallback: P2PCheckpointReceivedCallback;
+  /**
+   * Callback for when a checkpoint proposal is received - specifically for validators - from a peer.
+   * @param checkpoint - The checkpoint proposal received from the peer.
+   * @returns The attestations for the checkpoint, if any.
+   */
+  private validatorCheckpointReceivedCallback: P2PCheckpointReceivedCallback;
+
+  private gossipSubEventHandler: (e: CustomEvent<GossipsubMessage>) => void;
+
+  private ipChangedHandler?: (ip: string) => void;
+  private discoveredP2pIp?: string;
+
+  private instrumentation: P2PInstrumentation;
+
+  private telemetry: TelemetryClient;
+
+  protected logger: Logger;
 
   constructor(
-    private clientType: T,
     private config: P2PConfig,
-    private node: PubSubLibp2p,
+    protected node: PubSubLibp2p,
     private peerDiscoveryService: PeerDiscoveryService,
-    private mempools: MemPools<T>,
-    private l2BlockSource: L2BlockSource,
-    epochCache: EpochCacheInterface,
+    private reqresp: ReqRespInterface,
+    protected peerManager: PeerManagerInterface,
+    protected mempools: MemPools,
+    protected archiver: L2BlockSource & ContractDataSource,
+    private epochCache: EpochCacheInterface,
     private proofVerifier: ClientProtocolCircuitVerifier,
     private worldStateSynchronizer: WorldStateSynchronizer,
+    private blockMinFeesProvider: BlockMinFeesProvider,
     telemetry: TelemetryClient,
-    private logger = createLogger('p2p:libp2p_service'),
+    logger: Logger = createLogger('p2p:libp2p_service'),
+    private txValidationCache?: TxValidationCache,
   ) {
     super(telemetry, 'LibP2PService');
+    this.telemetry = telemetry;
 
-    const peerScoring = new PeerScoring(config);
-    this.reqresp = new ReqResp(config, node, peerScoring);
+    // Create child logger with fisherman prefix if in fisherman mode
+    this.logger = config.fishermanMode ? logger.createChild('[FISHERMAN]') : logger;
 
-    this.peerManager = new PeerManager(
-      node,
-      peerDiscoveryService,
-      config,
-      telemetry,
-      createLogger(`${logger.module}:peer_manager`),
-      peerScoring,
-      this.reqresp,
+    this.instrumentation = new P2PInstrumentation(telemetry, 'LibP2PService');
+
+    this.msgIdSeenValidators[TopicType.tx] = new MessageSeenValidator(config.seenMessageCacheSize);
+    this.msgIdSeenValidators[TopicType.block_proposal] = new MessageSeenValidator(config.seenMessageCacheSize);
+    this.msgIdSeenValidators[TopicType.checkpoint_proposal] = new MessageSeenValidator(config.seenMessageCacheSize);
+    this.msgIdSeenValidators[TopicType.checkpoint_attestation] = new MessageSeenValidator(config.seenMessageCacheSize);
+
+    const versions = getVersions(config);
+    this.protocolVersion = compressComponentVersions(versions);
+    logger.info(`Started libp2p service with protocol version ${this.protocolVersion}`);
+
+    this.topicStrings[TopicType.tx] = createTopicString(TopicType.tx, this.protocolVersion);
+    this.topicStrings[TopicType.block_proposal] = createTopicString(TopicType.block_proposal, this.protocolVersion);
+    this.topicStrings[TopicType.checkpoint_proposal] = createTopicString(
+      TopicType.checkpoint_proposal,
+      this.protocolVersion,
+    );
+    this.topicStrings[TopicType.checkpoint_attestation] = createTopicString(
+      TopicType.checkpoint_attestation,
+      this.protocolVersion,
     );
 
-    // Update gossipsub score params
-    this.node.services.pubsub.score.params.appSpecificScore = (peerId: string) => {
-      return this.peerManager.getPeerScore(peerId);
+    const p2pPropagationTime = config.attestationPropagationTime;
+    const proposalValidatorOpts = {
+      txsPermitted: !config.disableTransactions,
+      maxTxsPerBlock: config.validateMaxTxsPerBlock ?? config.validateMaxTxsPerCheckpoint,
+      maxBlocksPerCheckpoint: config.maxBlocksPerCheckpoint,
+      p2pPropagationTime,
+      skipSlotValidation: config.skipProposalSlotValidation,
+      signatureContext: {
+        chainId: config.l1ChainId,
+        rollupAddress: config.rollupAddress,
+      },
+    };
+    this.blockProposalValidator = new BlockProposalValidator(epochCache, proposalValidatorOpts);
+    this.checkpointProposalValidator = new CheckpointProposalValidator(epochCache, proposalValidatorOpts);
+    const attestationValidatorOpts = {
+      l1PublishingTime: config.l1PublishingTime,
+      p2pPropagationTime,
+      signatureContext: proposalValidatorOpts.signatureContext,
     };
-    this.node.services.pubsub.score.params.appSpecificWeight = 10;
+    this.checkpointAttestationValidator = config.fishermanMode
+      ? new FishermanAttestationValidator(epochCache, mempools.attestationPool, telemetry, attestationValidatorOpts)
+      : new CheckpointAttestationValidator(epochCache, attestationValidatorOpts);
 
-    this.attestationValidator = new AttestationValidator(epochCache);
-    this.blockProposalValidator = new BlockProposalValidator(epochCache);
+    this.gossipSubEventHandler = this.handleGossipSubEvent.bind(this);
 
-    this.blockReceivedCallback = async (block: BlockProposal): Promise<BlockAttestation | undefined> => {
-      this.logger.debug(
-        `Handler not yet registered: Block received callback not set. Received block for slot ${block.slotNumber.toNumber()} from peer.`,
-        { p2pMessageIdentifier: await block.p2pMessageIdentifier() },
+    this.blockReceivedCallback = async (block: BlockProposal): Promise<boolean> => {
+      this.logger.warn(
+        `Handler for block received not yet registered on P2P service. Received block ${block.blockNumber} for slot ${block.slotNumber} from peer.`,
+        { p2pMessageIdentifier: await block.p2pMessageLoggingIdentifier() },
       );
-      return undefined;
+      return true;
+    };
+
+    this.allNodesCheckpointReceivedCallback = (
+      _checkpoint: CheckpointProposalCore,
+    ): Promise<CheckpointAttestation[] | undefined> => {
+      throw new CheckpointProposalReceivedCallbackNotRegisteredError();
+    };
+
+    this.validatorCheckpointReceivedCallback = (
+      _checkpoint: CheckpointProposalCore,
+    ): Promise<CheckpointAttestation[] | undefined> => {
+      return Promise.resolve(undefined);
     };
   }
 
+  public updateConfig(config: Partial<P2PReqRespConfig & Pick<P2PConfig, 'skipIncomingProposals'>>) {
+    this.reqresp.updateConfig(config);
+    this.config = merge(this.config, config);
+  }
+
   /**
    * Creates an instance of the LibP2P service.
    * @param config - The configuration to use when creating the service.
    * @param txPool - The transaction pool to be accessed by the service.
    * @returns The new service.
    */
-  public static async new<T extends P2PClientType>(
-    clientType: T,
+  public static async new(
     config: P2PConfig,
-    peerDiscoveryService: PeerDiscoveryService,
     peerId: PeerId,
-    mempools: MemPools<T>,
-    l2BlockSource: L2BlockSource,
-    epochCache: EpochCacheInterface,
-    proofVerifier: ClientProtocolCircuitVerifier,
-    worldStateSynchronizer: WorldStateSynchronizer,
-    store: AztecAsyncKVStore,
-    telemetry: TelemetryClient,
-    logger = createLogger('p2p:libp2p_service'),
+    deps: {
+      mempools: MemPools;
+      l2BlockSource: L2BlockSource & ContractDataSource;
+      epochCache: EpochCacheInterface;
+      proofVerifier: ClientProtocolCircuitVerifier;
+      worldStateSynchronizer: WorldStateSynchronizer;
+      peerStore: AztecAsyncKVStore;
+      blockMinFeesProvider: BlockMinFeesProvider;
+      telemetry: TelemetryClient;
+      logger: Logger;
+      packageVersion: string;
+      txValidationCache?: TxValidationCache;
+    },
   ) {
-    const { tcpListenAddress, tcpAnnounceAddress, maxPeerCount } = config;
-    const bindAddrTcp = convertToMultiaddr(tcpListenAddress, 'tcp');
-    // We know tcpAnnounceAddress cannot be null here because we set it or throw when setting up the service.
-    const announceAddrTcp = convertToMultiaddr(tcpAnnounceAddress!, 'tcp');
+    const {
+      worldStateSynchronizer,
+      epochCache,
+      l2BlockSource,
+      mempools,
+      proofVerifier,
+      peerStore,
+      blockMinFeesProvider,
+      telemetry,
+      logger,
+      packageVersion,
+      txValidationCache,
+    } = deps;
+    const { p2pPort, maxPeerCount, listenAddress } = config;
+    const bindAddrTcp = convertToMultiaddr(listenAddress, p2pPort, 'tcp');
 
-    const datastore = new AztecDatastore(store);
+    const datastore = new AztecDatastore(peerStore);
 
-    const otelMetricsAdapter = new OtelMetricsAdapter(telemetry);
+    const otelMetricsAdapter = new OtelMetricsAdapter(telemetry, logger.getBindings());
+
+    const peerDiscoveryService = new DiscV5Service(
+      peerId,
+      config,
+      packageVersion,
+      telemetry,
+      createLogger(`${logger.module}:discv5_service`, logger.getBindings()),
+    );
+
+    // Seed libp2p's bootstrap discovery with private and trusted peers
+    const bootstrapNodes = [...config.privatePeers, ...config.trustedPeers];
 
-    // If bootstrap nodes are provided, also provide them to the p2p service
     const peerDiscovery = [];
-    if (peerDiscoveryService.bootstrapNodes.length > 0) {
-      peerDiscovery.push(bootstrap({ list: peerDiscoveryService.bootstrapNodes }));
+    if (bootstrapNodes.length > 0) {
+      peerDiscovery.push(bootstrap({ list: bootstrapNodes }));
     }
 
+    const versions = getVersions(config);
+    const protocolVersion = compressComponentVersions(versions);
+
+    const preferredPeersEnrs: ENR[] = config.preferredPeers.map(enr => ENR.decodeTxt(enr));
+    const directPeers = (
+      await Promise.all(
+        preferredPeersEnrs.map(async enr => {
+          const peerId = await enr.peerId();
+          const address = enr.getLocationMultiaddr('tcp');
+          if (address === undefined) {
+            throw new Error(`Direct peer ${peerId.toString()} has no TCP address, ENR: ${enr.encodeTxt()}`);
+          }
+          return {
+            id: peerId,
+            addrs: [address],
+          };
+        }),
+      )
+    ).filter(peer => peer !== undefined);
+
+    const announceTcpMultiaddr = config.p2pIp ? [convertToMultiaddr(config.p2pIp, p2pPort, 'tcp')] : [];
+
+    // Create dynamic topic score params based on network configuration
+    const l1Constants = epochCache.getL1Constants();
+    const topicScoreParams = createAllTopicScoreParams(protocolVersion, {
+      slotDurationMs: l1Constants.slotDuration * 1000,
+      ethereumSlotDuration: l1Constants.ethereumSlotDuration,
+      heartbeatIntervalMs: config.gossipsubInterval,
+      targetCommitteeSize: l1Constants.targetCommitteeSize,
+      blockDurationMs: config.blockDurationMs,
+      l1PublishingTime: config.l1PublishingTime,
+      p2pPropagationTime: config.attestationPropagationTime,
+      expectedBlockProposalsPerSlot: config.expectedBlockProposalsPerSlot,
+    });
+
     const node = await createLibp2p({
       start: false,
       peerId,
       addresses: {
         listen: [bindAddrTcp],
-        announce: [announceAddrTcp],
+        announce: announceTcpMultiaddr,
       },
       transports: [
         tcp({
-          maxConnections: config.maxPeerCount,
+          // It's better to have this number a bit higher than our maxPeerCount because it's sets the limit on transport (TCP) layer
+          // The connection attempts to the node on TCP layer are not necessarily valid Aztec peers so we want to have a bit of leeway here
+          // If we hit the limit, the connection will be temporarily accepted and immediately dropped.
+          // Docs: https://nodejs.org/api/net.html#servermaxconnections
+          maxConnections: maxPeerCount * 2,
           // socket option: the maximum length of the queue of pending connections
-          // https://nodejs.org/dist/latest-v18.x/docs/api/net.html#serverlisten
+          // https://nodejs.org/dist/latest-v22.x/docs/api/net.html#serverlisten
           // it's not safe if we increase this number
           backlog: 5,
           closeServerOnMaxConnections: {
-            closeAbove: maxPeerCount ?? Infinity,
-            listenBelow: maxPeerCount ?? Infinity,
+            // The property `maxConnections` will protect us against the most DDOS attack
+            // This property protects us in case of burst of new connections where server is not able to close them quickly enough
+            // In case closeAbove is reached, the server stops listening altogether
+            // It's important that there is enough difference between closeAbove and listenAbove,
+            // otherwise the server.listener will flap between being closed and open potentially degrading perf even more
+            closeAbove: maxPeerCount * 3,
+            listenBelow: Math.floor(maxPeerCount * 0.9),
           },
         }),
       ],
       datastore,
       peerDiscovery,
-      streamMuxers: [mplex(), yamux()],
+      streamMuxers: [yamux(), mplex()],
       connectionEncryption: [noise()],
       connectionManager: {
-        minConnections: 0,
-
+        minConnections: 0, // Disable libp2p peer dialing, we do it manually
+        // We set maxConnections above maxPeerCount because if we hit limit of maxPeerCount
+        // libp2p will start aggressively rejecting all new connections, preventing network discovery and crawling.
+        maxConnections: maxPeerCount * 2,
         maxParallelDials: 100,
         dialTimeout: 30_000,
         maxPeerAddrsToDial: 5,
         maxIncomingPendingConnections: 5,
       },
+      connectionGater: {
+        denyInboundConnection: (maConn: MultiaddrConnection) => {
+          const allowed = peerManager.isNodeAllowedToConnect(maConn.remoteAddr.nodeAddress().address);
+          if (allowed) {
+            return false;
+          }
+
+          logger.debug(`Connection gater: Denying inbound connection from ${maConn.remoteAddr.toString()}`);
+          return true;
+        },
+        denyInboundEncryptedConnection: (peerId: PeerId, _maConn: MultiaddrConnection) => {
+          //NOTE: it is not necessary to check address here because this was already done by
+          // denyInboundConnection
+          const allowed = peerManager.isNodeAllowedToConnect(peerId);
+          if (allowed) {
+            return false;
+          }
+
+          logger.debug(`Connection gater: Denying inbound encrypted connection from ${peerId.toString()}`);
+          return true;
+        },
+      },
       services: {
         identify: identify({
           protocolPrefix: 'aztec',
+          runOnConnectionOpen: true,
         }),
         pubsub: gossipsub({
+          directPeers,
           debugName: 'gossipsub',
           globalSignaturePolicy: SignaturePolicy.StrictNoSign,
           allowPublishToZeroTopicPeers: true,
@@ -228,55 +461,72 @@ export class LibP2PService<T extends P2PClientType> extends WithTracer implement
           heartbeatInterval: config.gossipsubInterval,
           mcacheLength: config.gossipsubMcacheLength,
           mcacheGossip: config.gossipsubMcacheGossip,
+          seenTTL: config.gossipsubSeenTTL,
           msgIdFn: getMsgIdFn,
           msgIdToStrFn: msgIdToStrFn,
           fastMsgIdFn: fastMsgIdFn,
           dataTransform: new SnappyTransform(),
           metricsRegister: otelMetricsAdapter,
-          metricsTopicStrToLabel: metricsTopicStrToLabels(),
+          metricsTopicStrToLabel: metricsTopicStrToLabels(protocolVersion),
           asyncValidation: true,
           scoreThresholds: gossipScoreThresholds,
           scoreParams: createPeerScoreParams({
             // IPColocation factor can be disabled for local testing - default to -5
             IPColocationFactorWeight: config.debugDisableColocationPenalty ? 0 : -5.0,
-            topics: {
-              [Tx.p2pTopic]: createTopicScoreParams({
-                topicWeight: 1,
-                invalidMessageDeliveriesWeight: -20,
-                invalidMessageDeliveriesDecay: 0.5,
-              }),
-              [BlockAttestation.p2pTopic]: createTopicScoreParams({
-                topicWeight: 1,
-                invalidMessageDeliveriesWeight: -20,
-                invalidMessageDeliveriesDecay: 0.5,
-              }),
-              [BlockProposal.p2pTopic]: createTopicScoreParams({
-                topicWeight: 1,
-                invalidMessageDeliveriesWeight: -20,
-                invalidMessageDeliveriesDecay: 0.5,
-              }),
-            },
+            topics: topicScoreParams,
           }),
         }) as (components: GossipSubComponents) => GossipSub,
-        components: (components: { connectionManager: ConnectionManager }) => ({
+        components: (components: { connectionManager: ConnectionManager; addressManager: AddressManager }) => ({
           connectionManager: components.connectionManager,
+          addressManager: components.addressManager,
         }),
       },
-      logger: createLibp2pComponentLogger(logger.module),
+      logger: createLibp2pComponentLogger(logger.module, logger.getBindings()),
     });
 
+    const peerScoring = new PeerScoring(config, telemetry);
+    const reqresp = new ReqResp(config, node, peerScoring, createLogger(`${logger.module}:reqresp`));
+
+    const peerManager = new PeerManager(
+      node,
+      peerDiscoveryService,
+      config,
+      telemetry,
+      createLogger(`${logger.module}:peer_manager`),
+      peerScoring,
+      reqresp,
+      worldStateSynchronizer,
+      protocolVersion,
+      epochCache,
+    );
+
+    // Gate req/resp data protocols for unauthenticated peers when p2pAllowOnlyValidators is enabled
+    reqresp.setShouldRejectPeer(peerId => peerManager.shouldDisableP2PGossip(peerId));
+
+    // Configure application-specific scoring for gossipsub.
+    // The weight scales app score to align with gossipsub thresholds:
+    // - Disconnect (-50) × 10 = -500 = gossipThreshold (stops receiving gossip)
+    // - Ban (-100) × 10 = -1000 = publishThreshold (cannot publish)
+    // Note: positive topic scores can offset penalties, so alignment is best-effort.
+    node.services.pubsub.score.params.appSpecificWeight = APP_SPECIFIC_WEIGHT;
+    node.services.pubsub.score.params.appSpecificScore = (peerId: string) =>
+      peerManager.shouldDisableP2PGossip(peerId) ? -Infinity : peerManager.getPeerScore(peerId);
+
     return new LibP2PService(
-      clientType,
       config,
       node,
       peerDiscoveryService,
+      reqresp,
+      peerManager,
       mempools,
       l2BlockSource,
       epochCache,
       proofVerifier,
       worldStateSynchronizer,
+      blockMinFeesProvider,
       telemetry,
       logger,
+      txValidationCache,
     );
   }
 
@@ -290,56 +540,98 @@ export class LibP2PService<T extends P2PClientType> extends WithTracer implement
       throw new Error('P2P service already started');
     }
 
-    // Get listen & announce addresses for logging
-    const { tcpListenAddress, tcpAnnounceAddress } = this.config;
-    if (!tcpAnnounceAddress) {
-      throw new Error('Announce address not provided.');
-    }
-    const announceTcpMultiaddr = convertToMultiaddr(tcpAnnounceAddress, 'tcp');
-
-    // Start job queue, peer discovery service and libp2p node
-    this.jobQueue.start();
-    await this.peerDiscoveryService.start();
-    await this.node.start();
-
-    // Subscribe to standard GossipSub topics by default
-    for (const topic of getTopicTypeForClientType(this.clientType)) {
-      this.subscribeToTopic(TopicTypeMap[topic].p2pTopic);
+    const { p2pIp, p2pPort } = this.config;
+    if (!p2pIp && !this.config.queryForIp) {
+      throw new Error('Announce address not provided and queryForIp is not enabled.');
     }
+    const announceTcpMultiaddr = p2pIp ? convertToMultiaddr(p2pIp, p2pPort, 'tcp') : undefined;
 
     // Create request response protocol handlers
     const txHandler = reqRespTxHandler(this.mempools);
     const goodbyeHandler = reqGoodbyeHandler(this.peerManager);
-    const blockHandler = reqRespBlockHandler(this.l2BlockSource);
+    const statusHandler = reqRespStatusHandler(this.protocolVersion, this.worldStateSynchronizer, this.logger);
 
-    const requestResponseHandlers = {
+    const requestResponseHandlers: Partial<ReqRespSubProtocolHandlers> = {
       [ReqRespSubProtocol.PING]: pingHandler,
-      [ReqRespSubProtocol.STATUS]: statusHandler,
-      [ReqRespSubProtocol.TX]: txHandler.bind(this),
+      [ReqRespSubProtocol.STATUS]: statusHandler.bind(this),
       [ReqRespSubProtocol.GOODBYE]: goodbyeHandler.bind(this),
-      [ReqRespSubProtocol.BLOCK]: blockHandler.bind(this),
     };
 
+    if (!this.config.disableTransactions) {
+      const blockTxsHandler = reqRespBlockTxsHandler(
+        this.mempools.attestationPool,
+        this.archiver,
+        this.mempools.txPool,
+      );
+      requestResponseHandlers[ReqRespSubProtocol.BLOCK_TXS] = blockTxsHandler.bind(this);
+    }
+
+    if (!this.config.disableTransactions) {
+      requestResponseHandlers[ReqRespSubProtocol.TX] = txHandler.bind(this);
+    }
+
+    await this.peerManager.initializePeers();
+
+    await this.reqresp.start(requestResponseHandlers);
+
+    await this.node.start();
+
+    // Subscribe to standard GossipSub topics by default
+    for (const topic of getTopicsForConfig(this.config.disableTransactions)) {
+      this.subscribeToTopic(this.topicStrings[topic]);
+    }
+
     // add GossipSub listener
-    this.node.services.pubsub.addEventListener(GossipSubEvent.MESSAGE, this.handleGossipSubEvent.bind(this));
+    this.node.services.pubsub.addEventListener(GossipSubEvent.MESSAGE, this.gossipSubEventHandler);
+
+    // Start running promise for peer discovery and metrics collection
+    if (!this.config.p2pDiscoveryDisabled) {
+      await this.peerDiscoveryService.start();
+    }
+
+    // Bridge discv5 IP changes to libp2p's AddressManager so peers see the updated address
+    if (this.config.queryForIp) {
+      this.discoveredP2pIp = this.config.p2pIp;
+      this.logger.info('IP change tracking enabled, bridging discv5 IP updates to libp2p AddressManager');
+      this.ipChangedHandler = (ip: string) => {
+        const addressManager = this.node.services.components.addressManager;
+        const newAddr = multiaddr(convertToMultiaddr(ip, this.config.p2pPort, 'tcp'));
+        const previousIp = this.discoveredP2pIp;
+
+        if (previousIp) {
+          const oldAddr = multiaddr(convertToMultiaddr(previousIp, this.config.p2pPort, 'tcp'));
+          addressManager.removeObservedAddr(oldAddr);
+          this.logger.info('Libp2p announce address updated due to IP change', {
+            previousIp,
+            newIp: ip,
+            newMultiaddr: newAddr.toString(),
+          });
+        } else {
+          this.logger.info('Libp2p announce address set from initial discv5 IP discovery', {
+            ip,
+            multiaddr: newAddr.toString(),
+          });
+        }
+
+        addressManager.addObservedAddr(newAddr);
+        addressManager.confirmObservedAddr(newAddr);
+        this.discoveredP2pIp = ip;
+      };
+      this.peerDiscoveryService.on('ip:changed', this.ipChangedHandler);
+    }
 
-    // Start running promise for peer discovery
     this.discoveryRunningPromise = new RunningPromise(
-      () => this.peerManager.heartbeat(),
+      async () => {
+        await this.peerManager.heartbeat();
+      },
       this.logger,
       this.config.peerCheckIntervalMS,
     );
     this.discoveryRunningPromise.start();
 
-    // Define the sub protocol validators - This is done within this start() method to gain a callback to the existing validateTx function
-    const reqrespSubProtocolValidators = {
-      ...DEFAULT_SUB_PROTOCOL_VALIDATORS,
-      // TODO(#11336): A request validator for blocks
-      [ReqRespSubProtocol.TX]: this.validateRequestedTx.bind(this),
-    };
-    await this.reqresp.start(requestResponseHandlers, reqrespSubProtocolValidators);
     this.logger.info(`Started P2P service`, {
-      listen: tcpListenAddress,
+      listen: this.config.listenAddress,
+      port: this.config.p2pPort,
       announce: announceTcpMultiaddr,
       peerId: this.node.peerId.toString(),
     });
@@ -351,14 +643,16 @@ export class LibP2PService<T extends P2PClientType> extends WithTracer implement
    */
   public async stop() {
     // Remove gossip sub listener
-    this.node.services.pubsub.removeEventListener(GossipSubEvent.MESSAGE, this.handleGossipSubEvent.bind(this));
+    this.node.services.pubsub.removeEventListener(GossipSubEvent.MESSAGE, this.gossipSubEventHandler);
+
+    if (this.ipChangedHandler) {
+      this.peerDiscoveryService.removeListener('ip:changed', this.ipChangedHandler);
+      this.ipChangedHandler = undefined;
+    }
 
     // Stop peer manager
     this.logger.debug('Stopping peer manager...');
     await this.peerManager.stop();
-
-    this.logger.debug('Stopping job queue...');
-    await this.jobQueue.end();
     this.logger.debug('Stopping running promise...');
     await this.discoveryRunningPromise?.stop();
     this.logger.debug('Stopping peer discovery service...');
@@ -370,10 +664,22 @@ export class LibP2PService<T extends P2PClientType> extends WithTracer implement
     this.logger.info('LibP2P service stopped');
   }
 
+  addReqRespSubProtocol(subProtocol: ReqRespSubProtocol, handler: ReqRespSubProtocolHandler): Promise<void> {
+    return this.reqresp.addSubProtocol(subProtocol, handler);
+  }
+
+  public registerThisValidatorAddresses(address: EthAddress[]): void {
+    this.peerManager.registerThisValidatorAddresses(address);
+  }
+
   public getPeers(includePending?: boolean): PeerInfo[] {
     return this.peerManager.getPeers(includePending);
   }
 
+  public getGossipMeshPeerCount(topicType: TopicType): number {
+    return this.node.services.pubsub.getMeshPeers(this.topicStrings[topicType]).length;
+  }
+
   private handleGossipSubEvent(e: CustomEvent<GossipsubMessage>) {
     this.logger.trace(`Received PUBSUB message.`);
 
@@ -387,47 +693,56 @@ export class LibP2PService<T extends P2PClientType> extends WithTracer implement
     setImmediate(() => void safeJob());
   }
 
+  public sendRequestToPeer(
+    peerId: PeerId,
+    subProtocol: ReqRespSubProtocol,
+    payload: Buffer,
+    dialTimeout?: number,
+  ): Promise<ReqRespResponse> {
+    return this.reqresp.sendRequestToPeer(peerId, subProtocol, payload, dialTimeout);
+  }
+
   /**
-   * Send Request via the ReqResp service
-   * The subprotocol defined will determine the request and response types
-   *
-   * See the subProtocolMap for the mapping of subprotocols to request/response types in `interface.ts`
-   *
-   * @param protocol The request response protocol to use
-   * @param request The request type to send
-   * @returns
+   * Get the ENR of the node
+   * @returns The ENR of the node
    */
-  sendRequest<SubProtocol extends ReqRespSubProtocol>(
-    protocol: SubProtocol,
-    request: InstanceType<SubProtocolMap[SubProtocol]['request']>,
-  ): Promise<InstanceType<SubProtocolMap[SubProtocol]['response']> | undefined> {
-    return this.reqresp.sendRequest(protocol, request);
+  public getEnr(): ENR | undefined {
+    return this.peerDiscoveryService.getEnr();
+  }
+
+  public registerBlockReceivedCallback(callback: P2PBlockReceivedCallback) {
+    this.blockReceivedCallback = callback;
+  }
+
+  public registerValidatorCheckpointReceivedCallback(callback: P2PCheckpointReceivedCallback) {
+    this.validatorCheckpointReceivedCallback = callback;
+  }
+
+  public registerAllNodesCheckpointReceivedCallback(callback: P2PCheckpointReceivedCallback) {
+    this.allNodesCheckpointReceivedCallback = callback;
   }
 
   /**
-   * Send a batch of requests to peers, and return the responses
-   * @param protocol - The request response protocol to use
-   * @param requests - The requests to send to the peers
-   * @returns The responses to the requests
+   * Registers a callback to be invoked when a duplicate proposal is detected.
+   * This callback is triggered on the first duplicate (when count goes from 1 to 2).
    */
-  sendBatchRequest<SubProtocol extends ReqRespSubProtocol>(
-    protocol: SubProtocol,
-    requests: InstanceType<SubProtocolMap[SubProtocol]['request']>[],
-  ): Promise<InstanceType<SubProtocolMap[SubProtocol]['response']>[] | undefined> {
-    return this.reqresp.sendBatchRequest(protocol, requests);
+  public registerDuplicateProposalCallback(
+    callback: (info: { slot: SlotNumber; proposer: EthAddress; type: 'checkpoint' | 'block' }) => void,
+  ): void {
+    this.duplicateProposalCallback = callback;
   }
 
   /**
-   * Get the ENR of the node
-   * @returns The ENR of the node
+   * Registers a callback to be invoked when a duplicate attestation is detected.
+   * A validator signing attestations for different proposals at the same slot.
+   * This callback is triggered on the first duplicate (when count goes from 1 to 2).
    */
-  public getEnr(): ENR | undefined {
-    return this.peerDiscoveryService.getEnr();
+  public registerDuplicateAttestationCallback(callback: P2PDuplicateAttestationCallback): void {
+    this.duplicateAttestationCallback = callback;
   }
 
-  public registerBlockReceivedCallback(callback: (block: BlockProposal) => Promise<BlockAttestation | undefined>) {
-    this.blockReceivedCallback = callback;
-    this.logger.verbose('Block received callback registered');
+  public registerCheckpointAttestationCallback(callback: P2PCheckpointAttestationCallback): void {
+    this.checkpointAttestationCallback = callback;
   }
 
   /**
@@ -444,175 +759,756 @@ export class LibP2PService<T extends P2PClientType> extends WithTracer implement
   /**
    * Publishes data to a topic.
    * @param topic - The topic to publish to.
-   * @param data - The data to publish.
+   * @param data - The message to publish.
    * @returns The number of recipients the data was sent to.
    */
-  private async publishToTopic(topic: string, data: Uint8Array) {
+  private async publishToTopic(topic: string, message: Gossipable) {
     if (!this.node.services.pubsub) {
       throw new Error('Pubsub service not available.');
     }
-    const result = await this.node.services.pubsub.publish(topic, data);
-
+    const isBlockProposal = topic === this.topicStrings[TopicType.block_proposal];
+    const traceContext =
+      this.config.debugP2PInstrumentMessages && isBlockProposal ? this.telemetry.getTraceContext() : undefined;
+    const p2pMessage = P2PMessage.fromGossipable(message, this.config.debugP2PInstrumentMessages, traceContext);
+    const result = await this.node.services.pubsub.publish(topic, p2pMessage.toMessageData());
     return result.recipients.length;
   }
 
+  /**
+   * Checks if this message has already been seen, based on its msgId computed from hashing the message data.
+   * Note that we do not rely on the seenCache from gossipsub since we want to keep a longer history of seen
+   * messages to avoid tx echoes across the network.
+   */
+  protected preValidateReceivedMessage(
+    msg: Message,
+    msgId: string,
+    source: PeerId,
+  ): { result: boolean; topicType?: TopicType } {
+    let topicType: TopicType | undefined;
+
+    switch (msg.topic) {
+      case this.topicStrings[TopicType.tx]:
+        topicType = TopicType.tx;
+        break;
+      case this.topicStrings[TopicType.block_proposal]:
+        topicType = TopicType.block_proposal;
+        break;
+      case this.topicStrings[TopicType.checkpoint_proposal]:
+        topicType = TopicType.checkpoint_proposal;
+        break;
+      case this.topicStrings[TopicType.checkpoint_attestation]:
+        topicType = TopicType.checkpoint_attestation;
+        break;
+      default:
+        this.logger.error(`Received message on unknown topic: ${msg.topic}`);
+        break;
+    }
+
+    const validator = topicType ? this.msgIdSeenValidators[topicType] : undefined;
+
+    if (!validator || !validator.addMessage(msgId)) {
+      this.instrumentation.incMessagePrevalidationStatus(false, topicType);
+      this.node.services.pubsub.reportMessageValidationResult(msgId, source.toString(), TopicValidatorResult.Ignore);
+      if (topicType === TopicType.tx) {
+        this.logger.verbose(`Ignoring already-seen tx gossip message`, { msgId, source: source.toString() });
+      }
+      return { result: false, topicType };
+    }
+
+    this.instrumentation.incMessagePrevalidationStatus(true, topicType);
+
+    return { result: true, topicType };
+  }
+
+  /**
+   * Safely deserializes a P2PMessage from raw message data.
+   * @param msgId - The message ID.
+   * @param source - The peer ID of the message source.
+   * @param data - The raw message data.
+   * @returns The deserialized P2PMessage or undefined if deserialization fails.
+   */
+  private safelyDeserializeP2PMessage(msgId: string, source: PeerId, data: Uint8Array): P2PMessage | undefined {
+    try {
+      return P2PMessage.fromMessageData(Buffer.from(data), this.config.debugP2PInstrumentMessages);
+    } catch (err) {
+      this.logger.error(`Error deserializing P2PMessage`, err, {
+        msgId,
+        source: source.toString(),
+      });
+      this.node.services.pubsub.reportMessageValidationResult(msgId, source.toString(), TopicValidatorResult.Reject);
+      this.peerManager.penalizePeer(source, PeerErrorSeverity.LowToleranceError);
+      return undefined;
+    }
+  }
+
   /**
    * Handles a new gossip message that was received by the client.
    * @param topic - The message's topic.
    * @param data - The message data
    */
-  private async handleNewGossipMessage(msg: Message, msgId: string, source: PeerId) {
-    if (msg.topic === Tx.p2pTopic) {
-      await this.handleGossipedTx(msg, msgId, source);
+  protected async handleNewGossipMessage(msg: Message, msgId: string, source: PeerId) {
+    const msgReceivedTime = Date.now();
+    let topicType: TopicType | undefined;
+    const p2pMessage = this.safelyDeserializeP2PMessage(msgId, source, msg.data);
+    if (!p2pMessage) {
+      return;
     }
-    if (msg.topic === BlockAttestation.p2pTopic && this.clientType === P2PClientType.Full) {
-      await this.processAttestationFromPeer(msg, msgId, source);
+
+    const preValidationResult = this.preValidateReceivedMessage(msg, msgId, source);
+
+    if (!preValidationResult.result) {
+      return;
     }
-    if (msg.topic == BlockProposal.p2pTopic) {
-      await this.processBlockFromPeer(msg, msgId, source);
+
+    // Determine topic type for attributes
+    if (msg.topic === this.topicStrings[TopicType.tx]) {
+      topicType = TopicType.tx;
+    } else if (msg.topic === this.topicStrings[TopicType.checkpoint_attestation]) {
+      topicType = TopicType.checkpoint_attestation;
+    } else if (msg.topic === this.topicStrings[TopicType.block_proposal]) {
+      topicType = TopicType.block_proposal;
+    } else if (msg.topic === this.topicStrings[TopicType.checkpoint_proposal]) {
+      topicType = TopicType.checkpoint_proposal;
+    }
+
+    // Process the message, optionally within a linked span for trace propagation
+    const processMessage = async () => {
+      if (
+        this.config.skipIncomingProposals &&
+        (msg.topic === this.topicStrings[TopicType.block_proposal] ||
+          msg.topic === this.topicStrings[TopicType.checkpoint_proposal])
+      ) {
+        this.logger.warn(`Ignoring incoming proposal (skipIncomingProposals is set)`, { topic: msg.topic });
+        this.node.services.pubsub.reportMessageValidationResult(msgId, source.toString(), TopicValidatorResult.Ignore);
+        return;
+      }
+      if (msg.topic === this.topicStrings[TopicType.tx]) {
+        await this.handleGossipedTx(p2pMessage.payload, msgId, source);
+      } else if (msg.topic === this.topicStrings[TopicType.checkpoint_attestation]) {
+        await this.processCheckpointAttestationFromPeer(p2pMessage.payload, msgId, source);
+      } else if (msg.topic === this.topicStrings[TopicType.block_proposal]) {
+        await this.processBlockFromPeer(p2pMessage.payload, msgId, source);
+      } else if (msg.topic === this.topicStrings[TopicType.checkpoint_proposal]) {
+        await this.handleGossipedCheckpointProposal(p2pMessage.payload, msgId, source);
+      } else {
+        this.logger.error(`Received message on unknown topic: ${msg.topic}`);
+      }
+    };
+
+    const latency = p2pMessage.timestamp !== undefined ? msgReceivedTime - p2pMessage.timestamp.getTime() : undefined;
+    const propagatedContext = p2pMessage.traceContext
+      ? this.telemetry.extractPropagatedContext(p2pMessage.traceContext)
+      : undefined;
+
+    if (propagatedContext) {
+      await this.tracer.startActiveSpan(
+        'LibP2PService.processMessage',
+        {
+          attributes: {
+            [Attributes.TOPIC_NAME]: topicType!,
+            [Attributes.PEER_ID]: source.toString(),
+          },
+        },
+        propagatedContext,
+        async span => {
+          try {
+            await processMessage();
+            span.setStatus({
+              code: SpanStatusCode.OK,
+            });
+          } catch (err) {
+            span.setStatus({
+              code: SpanStatusCode.ERROR,
+              message: String(err),
+            });
+            if (typeof err === 'string' || (err && err instanceof Error)) {
+              span.recordException(err);
+            }
+            throw err;
+          } finally {
+            span.end();
+          }
+        },
+      );
+    } else {
+      await processMessage();
+    }
+
+    if (latency !== undefined && topicType !== undefined) {
+      this.instrumentation.recordMessageLatency(topicType, latency);
     }
 
     return;
   }
 
-  private async validateReceivedMessage<T>(
-    validationFunc: () => Promise<{ result: boolean; obj: T }>,
+  protected async validateReceivedMessage<T, M = undefined>(
+    validationFunc: () => Promise<ReceivedMessageValidationResult<T, M>>,
     msgId: string,
     source: PeerId,
-  ): Promise<{ result: boolean; obj: T | undefined }> {
-    let resultAndObj: { result: boolean; obj: T | undefined } = { result: false, obj: undefined };
+    topicType: TopicType,
+  ): Promise<ReceivedMessageValidationResult<T, M>> {
+    // Default to reject result with a penalty if validation function throws an error
+    let resultAndObj: ReceivedMessageValidationResult<T, M> = {
+      result: TopicValidatorResult.Reject,
+      severity: PeerErrorSeverity.MidToleranceError,
+    };
+    const timer = new Timer();
     try {
       resultAndObj = await validationFunc();
     } catch (err) {
-      this.logger.error(`Error deserialising and validating message `, err);
+      this.logger.error(`Error validating gossipsub message`, err, { msgId, source: source.toString(), topicType });
     }
 
-    this.node.services.pubsub.reportMessageValidationResult(
-      msgId,
-      source.toString(),
-      resultAndObj.result && resultAndObj.obj ? TopicValidatorResult.Accept : TopicValidatorResult.Reject,
-    );
+    const validationTimeMs = timer.ms();
+    const mcacheWindowMs = this.config.gossipsubMcacheLength * this.config.gossipsubInterval;
+    if (validationTimeMs > mcacheWindowMs * 0.75) {
+      this.instrumentation.incSlowValidation(topicType);
+      this.logger.warn(
+        `Gossip validation for ${topicType} took ${validationTimeMs}ms, approaching mcache eviction window of ${mcacheWindowMs}ms. ` +
+          `Message forwarding may be skipped if validation exceeds the window.`,
+        { msgId, source: source.toString(), topicType, validationTimeMs, mcacheWindowMs },
+      );
+    }
+
+    if (resultAndObj.result === TopicValidatorResult.Accept) {
+      this.logger.debug(`Message ${topicType} accepted by validator`, { msgId, source: source.toString(), topicType });
+      this.instrumentation.recordMessageValidation(topicType, timer);
+    } else if (resultAndObj.result === TopicValidatorResult.Reject) {
+      this.logger.warn(`Message ${topicType} rejected by validator with severity ${resultAndObj.severity}`, {
+        msgId,
+        source: source.toString(),
+        topicType,
+        severity: resultAndObj.severity,
+      });
+      this.peerManager.penalizePeer(source, resultAndObj.severity);
+    } else {
+      this.logger.trace(`Message ${topicType} ignored by validator`, { msgId, source: source.toString(), topicType });
+    }
+
+    this.node.services.pubsub.reportMessageValidationResult(msgId, source.toString(), resultAndObj.result);
     return resultAndObj;
   }
 
-  private async handleGossipedTx(msg: Message, msgId: string, source: PeerId) {
-    const validationFunc = async () => {
-      const tx = Tx.fromBuffer(Buffer.from(msg.data));
-      const result = await this.validatePropagatedTx(tx, source);
-      return { result, obj: tx };
+  private tryDeserialize<T>(deserializeFunc: () => T, msgId: string, source: PeerId): T | undefined {
+    try {
+      return deserializeFunc();
+    } catch (err) {
+      this.logger.warn(`Failed to deserialize gossipsub message from buffer`, {
+        err,
+        msgId,
+        source: source.toString(),
+      });
+      return undefined;
+    }
+  }
+
+  protected async handleGossipedTx(payloadData: Buffer, msgId: string, source: PeerId) {
+    const validationFunc: () => Promise<ReceivedMessageValidationResult<Tx>> = async () => {
+      const tx = this.tryDeserialize(() => Tx.fromBuffer(payloadData), msgId, source);
+      if (!tx) {
+        return { result: TopicValidatorResult.Reject, severity: PeerErrorSeverity.LowToleranceError };
+      }
+
+      const currentBlockNumber = await this.archiver.getBlockNumber();
+      const { ts: nextSlotTimestamp } = this.epochCache.getEpochAndSlotInNextL1Slot();
+
+      // Stage 1: fast validators (metadata, data, timestamps, double-spend, gas, phases, block header)
+      const firstStageValidators = await this.createFirstStageMessageValidators(currentBlockNumber, nextSlotTimestamp);
+      const firstStageOutcome = await this.runValidations(tx, firstStageValidators);
+      if (!firstStageOutcome.allPassed) {
+        const { name } = firstStageOutcome.failure;
+        let { severity } = firstStageOutcome.failure;
+
+        // Double spend validator has a special case handler. We perform more detailed examination
+        // as to how recently the nullifier was entered into the tree and if the transaction should
+        // have 'known' the nullifier existed. This determines the severity of the penalty applied to the peer.
+        if (name === 'doubleSpendValidator') {
+          const txBlockNumber = BlockNumber(currentBlockNumber + 1);
+          severity = await this.handleDoubleSpendFailure(tx, txBlockNumber);
+        }
+
+        this.logger.verbose(`Rejecting gossiped tx ${tx.getTxHash().toString()}: stage 1 validation failed`, {
+          validator: name,
+          severity,
+          source: source.toString(),
+        });
+        return { result: TopicValidatorResult.Reject, severity };
+      }
+
+      // Pool pre-check: see if the pool would accept this tx before doing expensive proof verification
+      const canAdd = await this.mempools.txPool.canAddPendingTx(tx);
+      if (canAdd === 'ignored') {
+        this.logger.verbose(`Ignoring gossiped tx ${tx.getTxHash().toString()}: pool pre-check returned ignored`, {
+          source: source.toString(),
+        });
+        return { result: TopicValidatorResult.Ignore, obj: tx };
+      }
+
+      // Stage 2: expensive proof verification
+      const secondStageValidators = this.createSecondStageMessageValidators();
+      const secondStageOutcome = await this.runValidations(tx, secondStageValidators);
+      if (!secondStageOutcome.allPassed) {
+        const { severity, name } = secondStageOutcome.failure;
+        this.logger.verbose(`Rejecting gossiped tx ${tx.getTxHash().toString()}: stage 2 validation failed`, {
+          validator: name,
+          severity,
+          source: source.toString(),
+        });
+        return { result: TopicValidatorResult.Reject, severity };
+      }
+
+      // Pool add: persist the tx
+      const txHash = tx.getTxHash();
+      const addResult = await this.mempools.txPool.addPendingTxs([tx], { source: 'gossip' });
+
+      const wasAccepted = addResult.accepted.some(h => h.equals(txHash));
+      const wasIgnored = addResult.ignored.some(h => h.equals(txHash));
+
+      this.logger.verbose(`Validate propagated tx ${txHash.toString()}`, {
+        wasAccepted,
+        wasIgnored,
+        [Attributes.P2P_ID]: source.toString(),
+      });
+
+      if (wasAccepted) {
+        return { result: TopicValidatorResult.Accept, obj: tx };
+      } else if (wasIgnored) {
+        return { result: TopicValidatorResult.Ignore, obj: tx };
+      } else {
+        this.logger.warn(`Gossiped tx ${txHash.toString()} unexpectedly rejected by pool`, {
+          source: source.toString(),
+          txHash: txHash.toString(),
+        });
+        return { result: TopicValidatorResult.Reject, severity: PeerErrorSeverity.HighToleranceError };
+      }
     };
 
-    const { result, obj: tx } = await this.validateReceivedMessage<Tx>(validationFunc, msgId, source);
-    if (!result || !tx) {
+    const { result, obj: tx } = await this.validateReceivedMessage<Tx>(validationFunc, msgId, source, TopicType.tx);
+    if (result !== TopicValidatorResult.Accept || !tx) {
       return;
     }
-    const txHash = await tx.getTxHash();
+
+    // Tx was accepted into pool and will be propagated - just log and record metrics
+    const txHash = tx.getTxHash();
     const txHashString = txHash.toString();
-    this.logger.verbose(`Received tx ${txHashString} from external peer ${source.toString()}.`);
-    await this.mempools.txPool.addTxs([tx]);
+    this.logger.verbose(`Received tx ${txHashString} from external peer ${source.toString()} via gossip`, {
+      source: source.toString(),
+      txHash: txHashString,
+    });
+
+    this.instrumentation.incrementTxReceived(1);
   }
 
-  /**Process Attestation From Peer
-   * When a proposal is received from a peer, we add it to the attestation pool, so it can be accessed by other services.
-   *
-   * @param attestation - The attestation to process.
+  /**
+   * Process a checkpoint attestation from a peer.
+   * Validates the attestation and adds it to the pool.
    */
-  private async processAttestationFromPeer(msg: Message, msgId: string, source: PeerId): Promise<void> {
-    const validationFunc = async () => {
-      const attestation = BlockAttestation.fromBuffer(Buffer.from(msg.data));
-      const result = await this.validateAttestation(source, attestation);
-      this.logger.trace(`validatePropagatedAttestation: ${result}`, {
-        [Attributes.SLOT_NUMBER]: attestation.payload.header.globalVariables.slotNumber.toString(),
-        [Attributes.P2P_ID]: source.toString(),
-      });
-      return { result, obj: attestation };
-    };
-
-    const { result, obj: attestation } = await this.validateReceivedMessage<BlockAttestation>(
-      validationFunc,
+  private async processCheckpointAttestationFromPeer(
+    payloadData: Buffer,
+    msgId: string,
+    source: PeerId,
+  ): Promise<void> {
+    const { result, obj: attestation } = await this.validateReceivedMessage<CheckpointAttestation>(
+      () => {
+        const attestation = this.tryDeserialize(() => CheckpointAttestation.fromBuffer(payloadData), msgId, source);
+        if (!attestation) {
+          return Promise.resolve({
+            result: TopicValidatorResult.Reject,
+            severity: PeerErrorSeverity.LowToleranceError,
+          });
+        }
+        return this.validateAndStoreCheckpointAttestation(source, attestation);
+      },
       msgId,
       source,
+      TopicType.checkpoint_attestation,
     );
-    if (!result || !attestation) {
+
+    if (result !== TopicValidatorResult.Accept || !attestation) {
       return;
     }
-    this.logger.debug(
-      `Received attestation for block ${attestation.blockNumber.toNumber()} slot ${attestation.slotNumber.toNumber()} from external peer.`,
+
+    this.logger.verbose(
+      `Received valid checkpoint attestation for slot ${attestation.slotNumber} from external peer ${source.toString()}`,
       {
-        p2pMessageIdentifier: await attestation.p2pMessageIdentifier(),
-        slot: attestation.slotNumber.toNumber(),
+        p2pMessageIdentifier: await attestation.p2pMessageLoggingIdentifier(),
+        slot: attestation.slotNumber,
         archive: attestation.archive.toString(),
-        block: attestation.blockNumber.toNumber(),
+        source: source.toString(),
       },
     );
-    await this.mempools.attestationPool!.addAttestations([attestation]);
   }
 
-  private async processBlockFromPeer(msg: Message, msgId: string, source: PeerId): Promise<void> {
-    const validationFunc = async () => {
-      const block = BlockProposal.fromBuffer(Buffer.from(msg.data));
-      const result = await this.validateBlockProposal(source, block);
-      this.logger.trace(`validatePropagatedBlock: ${result}`, {
-        [Attributes.SLOT_NUMBER]: block.payload.header.globalVariables.slotNumber.toString(),
-        [Attributes.P2P_ID]: source.toString(),
+  /** Validates a checkpoint attestation and adds it to the pool. Penalizes the peer if validation fails. */
+  @trackSpan('Libp2pService.validateAndStoreCheckpointAttestation', (_peerId, attestation) => ({
+    [Attributes.SLOT_NUMBER]: attestation.payload.header.slotNumber.toString(),
+  }))
+  protected async validateAndStoreCheckpointAttestation(
+    peerId: PeerId,
+    attestation: CheckpointAttestation,
+  ): Promise<ReceivedMessageValidationResult<CheckpointAttestation>> {
+    const validationResult = await this.checkpointAttestationValidator.validate(attestation);
+
+    if (validationResult.result === 'reject') {
+      this.logger.warn(`Penalizing peer ${peerId} for checkpoint attestation validation failure`);
+      return { result: TopicValidatorResult.Reject, severity: validationResult.severity };
+    }
+
+    if (validationResult.result === 'ignore') {
+      return { result: TopicValidatorResult.Ignore, obj: attestation };
+    }
+
+    // Try to add the attestation: this handles existence check, cap check, and adding in one call
+    // count is the number of attestations by this signer for this slot (for duplicate detection)
+    const slot = attestation.payload.header.slotNumber;
+    const { added, alreadyExists, count } =
+      await this.mempools.attestationPool.tryAddCheckpointAttestation(attestation);
+
+    this.logger.trace(`Validate propagated checkpoint attestation`, {
+      added,
+      alreadyExists,
+      count,
+      [Attributes.SLOT_NUMBER]: slot.toString(),
+      [Attributes.P2P_ID]: peerId.toString(),
+    });
+
+    // Exact same attestation received, no need to re-broadcast
+    if (alreadyExists) {
+      return { result: TopicValidatorResult.Ignore, obj: attestation };
+    }
+
+    // Could not add (cap reached for signer), penalize and do not re-broadcast
+    if (!added) {
+      this.logger.warn(`Rejecting checkpoint attestation due to cap`, {
+        slot: slot.toString(),
+        archive: attestation.archive.toString(),
+        source: peerId.toString(),
+        attester: attestation.getSender()?.toString(),
+        count,
       });
-      return { result, obj: block };
-    };
+      return { result: TopicValidatorResult.Reject, severity: PeerErrorSeverity.HighToleranceError };
+    }
 
-    const { result, obj: block } = await this.validateReceivedMessage<BlockProposal>(validationFunc, msgId, source);
-    if (!result || !block) {
+    // Check if this is a duplicate attestation (signer attested to a different proposal at the same slot)
+    // count is the number of attestations by this signer for this slot
+    if (count === 2) {
+      const attester = attestation.getSender();
+      if (attester) {
+        this.logger.warn(`Detected duplicate attestation (equivocation) at slot ${slot}`, {
+          slot: slot.toString(),
+          archive: attestation.archive.toString(),
+          source: peerId.toString(),
+          attester: attester.toString(),
+        });
+        this.duplicateAttestationCallback?.({ slot, attester });
+      }
+    }
+
+    // Attestation was added successfully - accept it so other nodes can also detect the equivocation
+    this.checkpointAttestationCallback?.(attestation);
+    return { result: TopicValidatorResult.Accept, obj: attestation };
+  }
+
+  protected async processBlockFromPeer(payloadData: Buffer, msgId: string, source: PeerId): Promise<void> {
+    const {
+      result,
+      obj: block,
+      metadata: { isEquivocated } = {},
+    } = await this.validateReceivedMessage<BlockProposal, { isEquivocated: boolean }>(
+      () => this.validateAndStoreBlockProposal(source, BlockProposal.fromBuffer(payloadData)),
+      msgId,
+      source,
+      TopicType.block_proposal,
+    );
+
+    // If not accepted or equivocated, return
+    if (result !== TopicValidatorResult.Accept || !block || isEquivocated) {
       return;
     }
-    await this.processValidBlockProposal(block);
+
+    await this.processValidBlockProposal(block, source);
   }
 
-  // REVIEW: callback pattern https://github.com/AztecProtocol/aztec-packages/issues/7963
+  /** Validates a block proposal. Triggers a penalization to the peer that sent it if invalid. Adds to the mempool if valid. */
+  @trackSpan('Libp2pService.validateAndStoreBlockProposal', (_peerId, block) => ({
+    [Attributes.BLOCK_NUMBER]: block.blockNumber.toString(),
+    [Attributes.SLOT_NUMBER]: block.slotNumber.toString(),
+  }))
+  protected async validateAndStoreBlockProposal(
+    peerId: PeerId,
+    block: BlockProposal,
+  ): Promise<ReceivedMessageValidationResult<BlockProposal, { isEquivocated: boolean }>> {
+    const validationResult = await this.blockProposalValidator.validate(block);
+
+    if (validationResult.result === 'reject') {
+      this.logger.warn(`Penalizing peer ${peerId} for block proposal validation failure`);
+      return { result: TopicValidatorResult.Reject, severity: validationResult.severity };
+    }
+
+    if (validationResult.result === 'ignore') {
+      return { result: TopicValidatorResult.Ignore, obj: block };
+    }
+
+    // Try to add the proposal: this handles existence check, cap check, and adding in one call
+    const { added, alreadyExists, count } = await this.mempools.attestationPool.tryAddBlockProposal(block);
+    const isEquivocated = count !== undefined && count > 1;
+
+    // Duplicate proposal received, no need to re-broadcast
+    if (alreadyExists) {
+      this.logger.debug(`Ignoring duplicate block proposal received`, {
+        ...block.toBlockInfo(),
+        indexWithinCheckpoint: block.indexWithinCheckpoint,
+        proposer: block.getSender()?.toString(),
+        source: peerId.toString(),
+      });
+      return { result: TopicValidatorResult.Ignore, obj: block, metadata: { isEquivocated } };
+    }
+
+    // Too many blocks received for this slot and index, penalize peer and do not re-broadcast
+    if (!added) {
+      this.logger.warn(`Penalizing peer for block proposal exceeding per-position cap`, {
+        ...block.toBlockInfo(),
+        indexWithinCheckpoint: block.indexWithinCheckpoint,
+        count,
+        proposer: block.getSender()?.toString(),
+        source: peerId.toString(),
+      });
+      return {
+        result: TopicValidatorResult.Reject,
+        metadata: { isEquivocated },
+        severity: PeerErrorSeverity.HighToleranceError,
+      };
+    }
+
+    // If this was a duplicate proposal, do not process it, but do invoke the duplicate callback,
+    // and do re-broadcast it so other nodes in the network know to slash the proposer
+    if (isEquivocated) {
+      const proposer = block.getSender();
+      this.logger.warn(`Detected duplicate block proposal (equivocation) at slot ${block.slotNumber}`, {
+        ...block.toBlockInfo(),
+        source: peerId.toString(),
+        proposer: proposer?.toString(),
+      });
+      // Invoke the duplicate callback on the first duplicate spotted only
+      if (proposer && count === 2) {
+        this.duplicateProposalCallback?.({ slot: block.slotNumber, proposer, type: 'block' });
+      }
+      return { result: TopicValidatorResult.Accept, obj: block, metadata: { isEquivocated } };
+    }
+
+    // Otherwise, we're good to go!
+    return { result: TopicValidatorResult.Accept, obj: block };
+  }
+
+  // REFACTOR(palla): This method should be moved to the p2p_client or to a separate component,
+  // should not be here as it does not deal with p2p networking.
   @trackSpan('Libp2pService.processValidBlockProposal', async block => ({
-    [Attributes.BLOCK_NUMBER]: block.blockNumber.toNumber(),
-    [Attributes.SLOT_NUMBER]: block.slotNumber.toNumber(),
+    [Attributes.SLOT_NUMBER]: block.slotNumber,
     [Attributes.BLOCK_ARCHIVE]: block.archive.toString(),
-    [Attributes.P2P_ID]: await block.p2pMessageIdentifier().then(i => i.toString()),
+    [Attributes.P2P_ID]: await block.p2pMessageLoggingIdentifier().then(i => i.toString()),
   }))
-  private async processValidBlockProposal(block: BlockProposal) {
-    this.logger.verbose(
-      `Received block ${block.blockNumber.toNumber()} for slot ${block.slotNumber.toNumber()} from external peer.`,
-      {
-        p2pMessageIdentifier: await block.p2pMessageIdentifier(),
-        slot: block.slotNumber.toNumber(),
-        archive: block.archive.toString(),
-        block: block.blockNumber.toNumber(),
-      },
+  protected async processValidBlockProposal(block: BlockProposal, sender: PeerId) {
+    const slot = block.slotNumber;
+    this.logger.verbose(`Received block proposal for slot ${slot} from external peer ${sender.toString()}.`, {
+      p2pMessageIdentifier: await block.p2pMessageLoggingIdentifier(),
+      source: sender.toString(),
+      ...block.toBlockInfo(),
+    });
+
+    // Mark the txs in this proposal as protected
+    await this.mempools.txPool.protectTxs(block.txHashes, block.blockHeader);
+
+    // Call the block received callback to validate the proposal.
+    // Note: Validators do NOT attest to individual blocks, only to checkpoint proposals.
+    const isValid = await this.blockReceivedCallback(block, sender);
+    if (!isValid) {
+      this.logger.info(`Block proposal validation failed for block ${block.blockNumber}`, block.toBlockInfo());
+    }
+  }
+
+  /**
+   * Handle a gossiped checkpoint proposal.
+   * Validates and processes the checkpoint proposal, then triggers the callback for attestation.
+   */
+  protected async handleGossipedCheckpointProposal(payloadData: Buffer, msgId: string, source: PeerId): Promise<void> {
+    const {
+      result,
+      obj: checkpoint,
+      metadata: { isEquivocated, processBlock } = {},
+    } = await this.validateReceivedMessage<CheckpointProposal, { isEquivocated: boolean; processBlock: boolean }>(
+      () => this.validateAndStoreCheckpointProposal(source, CheckpointProposal.fromBuffer(payloadData)),
+      msgId,
+      source,
+      TopicType.checkpoint_proposal,
     );
-    const attestation = await this.blockReceivedCallback(block);
 
-    // TODO: fix up this pattern - the abstraction is not nice
-    // The attestation can be undefined if no handler is registered / the validator deems the block invalid
-    if (attestation != undefined) {
-      this.logger.verbose(
-        `Broadcasting attestation for block ${attestation.blockNumber.toNumber()} slot ${attestation.slotNumber.toNumber()}`,
-        {
-          p2pMessageIdentifier: await attestation.p2pMessageIdentifier(),
-          slot: attestation.slotNumber.toNumber(),
-          archive: attestation.archive.toString(),
-          block: attestation.blockNumber.toNumber(),
-        },
-      );
-      await this.broadcastAttestation(attestation);
+    // Process checkpoint proposal if valid and not equivocated.
+    const processCheckpointFn = () =>
+      result === TopicValidatorResult.Accept && checkpoint && !isEquivocated
+        ? this.processValidCheckpointProposal(checkpoint.toCore(), source)
+        : Promise.resolve();
+
+    // If the checkpoint contained a valid last block, we process it even if the checkpoint itself is to be rejected
+    // TODO(palla/mbps): Is this ok? Should we be considering a block from a checkpoint that was equivocated?
+    const processBlockFn = () =>
+      processBlock && checkpoint && checkpoint.getBlockProposal()
+        ? this.processValidBlockProposal(checkpoint.getBlockProposal()!, source)
+        : Promise.resolve();
+
+    // A node that skips checkpoint validation attests without re-executing the embedded last block, so run
+    // the checkpoint callback first: this creates and broadcasts the attestation before the block is
+    // processed. Otherwise the block's re-execution — which can stall until the re-execution deadline
+    // waiting for a parent that may never arrive — would delay the attestation past the slot's attestation
+    // window, after which peers reject it as stale.
+    if (this.config.skipCheckpointProposalValidation) {
+      await processCheckpointFn();
+      await processBlockFn();
+      return;
     }
+
+    // Process the block first, since it's required for the checkpoint proposal validation.
+    await processBlockFn();
+    await processCheckpointFn();
   }
 
   /**
-   * Broadcast an attestation to all peers.
-   * @param attestation - The attestation to broadcast.
+   * Validates a checkpoint proposal. Penalizes peer if validation fails. Adds the checkpoint and
+   * its last block (if present) to the mempool if valid. Triggers equivocation detection on both.
    */
-  @trackSpan('Libp2pService.broadcastAttestation', async attestation => ({
-    [Attributes.BLOCK_NUMBER]: attestation.payload.header.globalVariables.blockNumber.toNumber(),
-    [Attributes.SLOT_NUMBER]: attestation.payload.header.globalVariables.slotNumber.toNumber(),
-    [Attributes.BLOCK_ARCHIVE]: attestation.archive.toString(),
-    [Attributes.P2P_ID]: await attestation.p2pMessageIdentifier().then(i => i.toString()),
+  @trackSpan('Libp2pService.validateAndStoreCheckpointProposal', (_peerId, checkpoint) => ({
+    [Attributes.SLOT_NUMBER]: checkpoint.slotNumber.toString(),
   }))
-  private async broadcastAttestation(attestation: BlockAttestation) {
-    await this.propagate(attestation);
+  protected async validateAndStoreCheckpointProposal(
+    peerId: PeerId,
+    checkpoint: CheckpointProposal,
+  ): Promise<ReceivedMessageValidationResult<CheckpointProposal, { isEquivocated: boolean; processBlock: boolean }>> {
+    const validationResult = await this.checkpointProposalValidator.validate(checkpoint);
+
+    if (validationResult.result === 'reject') {
+      this.logger.warn(`Penalizing peer ${peerId} for checkpoint proposal validation failure`);
+      return { result: TopicValidatorResult.Reject, severity: validationResult.severity };
+    }
+
+    if (validationResult.result === 'ignore') {
+      return { result: TopicValidatorResult.Ignore, obj: checkpoint };
+    }
+
+    // Extract and try to add the block proposal first if present
+    const blockProposal = checkpoint.getBlockProposal();
+    let processBlock = false;
+    if (blockProposal) {
+      this.logger.debug(`Validating block proposal from propagated checkpoint`, {
+        [Attributes.SLOT_NUMBER]: checkpoint.slotNumber.toString(),
+        [Attributes.P2P_ID]: peerId.toString(),
+      });
+      const blockProposalResult = await this.validateAndStoreBlockProposal(peerId, blockProposal);
+      const { obj, metadata: { isEquivocated } = {} } = blockProposalResult;
+      if (blockProposalResult.result === TopicValidatorResult.Reject || !obj || isEquivocated) {
+        this.logger.debug(`Rejecting checkpoint due to invalid last block proposal`, {
+          [Attributes.SLOT_NUMBER]: checkpoint.slotNumber.toString(),
+          [Attributes.P2P_ID]: peerId.toString(),
+          isEquivocated,
+          result: blockProposalResult.result,
+        });
+        return {
+          result: TopicValidatorResult.Reject,
+          severity:
+            'severity' in blockProposalResult ? blockProposalResult.severity : PeerErrorSeverity.MidToleranceError,
+        };
+      } else if (blockProposalResult.result === TopicValidatorResult.Accept && obj && !isEquivocated) {
+        processBlock = true;
+      }
+    }
+
+    // Try to add the checkpoint proposal core: this handles existence check, cap check, and adding in one call
+    const checkpointCore = checkpoint.toCore();
+    const tryAddResult = await this.mempools.attestationPool.tryAddCheckpointProposal(checkpointCore);
+    const { added, alreadyExists, count } = tryAddResult;
+    const isEquivocated = count !== undefined && count > 1;
+
+    // Duplicate proposal received, do not re-broadcast
+    if (alreadyExists) {
+      this.logger.debug(`Ignoring duplicate checkpoint proposal received`, {
+        ...checkpoint.toCheckpointInfo(),
+        source: peerId.toString(),
+      });
+      return {
+        result: TopicValidatorResult.Ignore,
+        obj: checkpoint,
+        metadata: { isEquivocated, processBlock },
+      };
+    }
+
+    // Too many checkpoint proposals received for this slot, penalize peer and do not re-broadcast
+    // Note: We still return the checkpoint obj so the lastBlock can be processed if valid
+    if (!added) {
+      this.logger.warn(`Penalizing peer for checkpoint proposal exceeding per-slot cap`, {
+        ...checkpoint.toCheckpointInfo(),
+        count,
+        source: peerId.toString(),
+      });
+      return {
+        result: TopicValidatorResult.Reject,
+        obj: checkpoint,
+        metadata: { isEquivocated, processBlock },
+        severity: PeerErrorSeverity.HighToleranceError,
+      };
+    }
+
+    // If this was a duplicate proposal, do not process it, but do invoke the duplicate callback,
+    // and do re-broadcast it so other nodes in the network know to slash the proposer
+    if (isEquivocated) {
+      const proposer = checkpoint.getSender();
+      this.logger.warn(`Detected duplicate checkpoint proposal (equivocation) at slot ${checkpoint.slotNumber}`, {
+        ...checkpoint.toCheckpointInfo(),
+        source: peerId.toString(),
+        proposer: proposer?.toString(),
+      });
+      // Invoke the duplicate callback on the first duplicate spotted only
+      if (proposer && count === 2) {
+        this.duplicateProposalCallback?.({ slot: checkpoint.slotNumber, proposer, type: 'checkpoint' });
+      }
+      return {
+        result: TopicValidatorResult.Accept,
+        obj: checkpoint,
+        metadata: { isEquivocated, processBlock },
+      };
+    }
+
+    // Otherwise, we're good to go!
+    return { result: TopicValidatorResult.Accept, obj: checkpoint, metadata: { processBlock, isEquivocated } };
+  }
+
+  /**
+   * Process a validated checkpoint proposal.
+   * Note: The proposal was already added to the pool by tryAddCheckpointProposal in handleGossipedCheckpointProposal.
+   */
+  @trackSpan('Libp2pService.processValidCheckpointProposal', async checkpoint => ({
+    [Attributes.SLOT_NUMBER]: checkpoint.slotNumber,
+    [Attributes.BLOCK_ARCHIVE]: checkpoint.archive.toString(),
+    [Attributes.P2P_ID]: await checkpoint.p2pMessageLoggingIdentifier().then(i => i.toString()),
+  }))
+  protected async processValidCheckpointProposal(checkpoint: CheckpointProposalCore, sender: PeerId) {
+    const slot = checkpoint.slotNumber;
+    this.logger.verbose(`Received checkpoint proposal for slot ${slot} from external peer ${sender.toString()}.`, {
+      p2pMessageIdentifier: await checkpoint.p2pMessageLoggingIdentifier(),
+      slot: checkpoint.slotNumber,
+      archive: checkpoint.archive.toString(),
+      source: sender.toString(),
+    });
+
+    await this.allNodesCheckpointReceivedCallback(checkpoint, sender);
+
+    // Call the checkpoint received callback with the core version (without lastBlock)
+    // to validate and potentially generate attestations
+    const attestations = await this.validatorCheckpointReceivedCallback(checkpoint, sender);
+    if (attestations && attestations.length > 0) {
+      // If the callback returned attestations, add them to the pool and propagate them
+      await this.mempools.attestationPool.addOwnCheckpointAttestations(attestations);
+      for (const attestation of attestations) {
+        await this.propagate(attestation);
+      }
+    }
   }
 
   /**
@@ -620,113 +1516,186 @@ export class LibP2PService<T extends P2PClientType> extends WithTracer implement
    * @param message - The message to propagate.
    */
   public async propagate<T extends Gossipable>(message: T) {
-    const p2pMessageIdentifier = await message.p2pMessageIdentifier();
+    const p2pMessageIdentifier = await message.p2pMessageLoggingIdentifier();
     this.logger.trace(`Message ${p2pMessageIdentifier} queued`, { p2pMessageIdentifier });
-    void this.jobQueue
-      .put(async () => {
-        await this.sendToPeers(message);
-      })
-      .catch(error => {
-        this.logger.error(`Error propagating message ${p2pMessageIdentifier}`, { error });
-      });
+    void this.sendToPeers(message).catch(error => {
+      this.logger.error(`Error propagating message ${p2pMessageIdentifier}`, { error });
+    });
   }
 
   /**
-   * Validate a tx that has been requested from a peer.
-   *
-   * The core component of this validator is that the tx hash MUST match the requested tx hash,
-   * In order to perform this check, the tx proof must be verified.
-   *
-   * Note: This function is called from within `ReqResp.sendRequest` as part of the
-   * ReqRespSubProtocol.TX subprotocol validation.
-   *
-   * @param requestedTxHash - The hash of the tx that was requested.
-   * @param responseTx - The tx that was received as a response to the request.
-   * @param peerId - The peer ID of the peer that sent the tx.
-   * @returns True if the tx is valid, false otherwise.
+   * Validate the requested block transactions request-response consistency.
+   * It does NOT validate the transactions themselves.
+   * @param request - The block transactions request.
+   * @param response - The block transactions response.
+   * @param peerId - The ID of the peer that made the request.
+   * @returns True if the request-response is consistent, false otherwise.
    */
-  @trackSpan('Libp2pService.validateRequestedTx', (requestedTxHash, _responseTx) => ({
-    [Attributes.TX_HASH]: requestedTxHash.toString(),
+  @trackSpan('Libp2pService.validateRequestedBlockTxsConsistency', request => ({
+    [Attributes.BLOCK_ARCHIVE]: request.archiveRoot.toString(),
   }))
-  private async validateRequestedTx(requestedTxHash: TxHash, responseTx: Tx, peerId: PeerId): Promise<boolean> {
-    const proofValidator = new TxProofValidator(this.proofVerifier);
-    const validProof = await proofValidator.validateTx(responseTx);
-
-    // If the node returns the wrong data, we penalize it
-    if (!requestedTxHash.equals(await responseTx.getTxHash())) {
-      // Returning the wrong data is a low tolerance error
-      this.peerManager.penalizePeer(peerId, PeerErrorSeverity.MidToleranceError);
-      return false;
-    }
+  protected async validateRequestedBlockTxsConsistency(
+    request: BlockTxsRequest,
+    response: BlockTxsResponse,
+    peerId: PeerId,
+  ): Promise<boolean> {
+    try {
+      // Check for duplicates txs (or hashes) in the response.
+      const returnedHashes = response.txs.map(tx => tx.getTxHash().toString());
+      const uniqueReturned = new Set(returnedHashes.map(h => h.toString()));
+      if (uniqueReturned.size !== returnedHashes.length) {
+        this.peerManager.penalizePeer(peerId, PeerErrorSeverity.MidToleranceError);
+        throw new ValidationError(`Received duplicate txs in block txs response`);
+      }
 
-    if (validProof.result === 'invalid') {
-      // If the proof is invalid, but the txHash is correct, then this is an active attack and we severly punish
-      this.peerManager.penalizePeer(peerId, PeerErrorSeverity.LowToleranceError);
-      return false;
-    }
+      // We get the block tx hashes from the proposal or the archiver.
+      const proposal = await this.mempools.attestationPool.getBlockProposalByArchive(request.archiveRoot.toString());
+      const blockTxHashes =
+        proposal?.txHashes ??
+        (await this.archiver.getBlock({ archive: request.archiveRoot }))?.body.txEffects.map(e => e.txHash);
+
+      // If we don't have the block, we can't verify membership/order of the returned txs.
+      if (!blockTxHashes) {
+        // This shouldn't happen, since we asked for the block (proposal).
+        // Neither a local proposal nor an archived block: we cannot verify membership/order of the
+        // returned txs. This is a local-state gap, not a peer fault, so we do not penalize.
+        this.logger.warn(
+          `Block ${request.archiveRoot.toString()} not found in attestation pool or archiver; cannot validate membership/order of returned txs`,
+        );
+        // NOTE: We mark the response as invalid, given the limitations of a true/false return value.
+        return false;
+      }
 
-    return true;
-  }
+      // Verify that the returned tx hashes are a subset of (tx hashes by index) U (explicitly requested tx hashes).
+      const uniqueRequestedHashes = new Set([
+        // tx hashes requested by index.
+        ...request.txIndices.getTrueIndices().map(i => blockTxHashes[i].toString()),
+        // explicitly requested tx hashes.
+        ...request.txHashes.map(h => h.toString()),
+      ]);
+      if (!returnedHashes.every(h => uniqueRequestedHashes.has(h))) {
+        this.peerManager.penalizePeer(peerId, PeerErrorSeverity.LowToleranceError);
+        throw new ValidationError(
+          'Returned txs should be a subset of (tx hashes by index) U (explicitly requested tx hashes)',
+        );
+      }
 
-  @trackSpan('Libp2pService.validatePropagatedTx', async tx => ({
-    [Attributes.TX_HASH]: (await tx.getTxHash()).toString(),
-  }))
-  private async validatePropagatedTx(tx: Tx, peerId: PeerId): Promise<boolean> {
-    const blockNumber = (await this.l2BlockSource.getBlockNumber()) + 1;
-    const messageValidators = this.createMessageValidators(blockNumber);
-    const outcome = await this.runValidations(tx, messageValidators);
+      // Tx indices information is optional, but if present, we need to verify a few things.
+      if (!response.peerHasBlock()) {
+        this.logger.debug(`Peer ${peerId.toString()} signalled missing block`);
+        return true;
+      }
+
+      // If the response has a non-empty bitvector, it needs to be consistent with the number of txs in the block.
+      if (response.txIndices.getLength() !== blockTxHashes.length) {
+        this.peerManager.penalizePeer(peerId, PeerErrorSeverity.MidToleranceError);
+        throw new ValidationError(
+          `Received block txs with mismatched bitvector length: expected ${blockTxHashes.length}, got ${response.txIndices.getLength()}`,
+        );
+      }
+
+      // For every index we requested that the peer claims to have (per its bitvector), the
+      // corresponding tx must be present in the response. A peer advertising availability but
+      // withholding the tx is inconsistent.
+      const returnedHashSet = new Set(returnedHashes);
+      const expectedIndices = request.txIndices.getTrueIndices().filter(i => response.txIndices.isSet(i));
+      const missingExpected = expectedIndices.some(i => !returnedHashSet.has(blockTxHashes[i].toString()));
+      if (missingExpected) {
+        this.peerManager.penalizePeer(peerId, PeerErrorSeverity.LowToleranceError);
+        throw new ValidationError('Peer advertised requested txs via indices but did not return them');
+      }
 
-    if (outcome.allPassed) {
       return true;
-    }
-    const { name } = outcome.failure;
-    let { severity } = outcome.failure;
+    } catch (e: any) {
+      if (e instanceof ValidationError) {
+        this.logger.warn(`Failed validation for requested block txs from peer ${peerId.toString()}`);
+      } else {
+        this.logger.error(`Error during validation of requested block txs`, e);
+      }
 
-    // Double spend validator has a special case handler
-    if (name === 'doubleSpendValidator') {
-      severity = await this.handleDoubleSpendFailure(tx, blockNumber);
+      return false;
     }
+  }
 
-    this.peerManager.penalizePeer(peerId, severity);
-    return false;
+  private getGasFees(): Promise<GasFees> {
+    return this.blockMinFeesProvider.getCurrentMinFees();
   }
 
   /**
-   * Create message validators for the given block number.
-   *
-   * Each validator is a pair of a validator and a severity.
-   * If a validator fails, the peer is penalized with the severity of the validator.
-   *
-   * @param blockNumber - The block number to create validators for.
-   * @returns The message validators.
+   * Get the BatchTxRequesterLibP2PService dependencies for creating BatchTxRequester instances
    */
-  private createMessageValidators(blockNumber: number): Record<string, MessageValidator> {
+  public getBatchTxRequesterService(): BatchTxRequesterLibP2PService {
     return {
-      dataValidator: {
-        validator: new DataTxValidator(),
-        severity: PeerErrorSeverity.HighToleranceError,
-      },
-      metadataValidator: {
-        validator: new MetadataTxValidator(new Fr(this.config.l1ChainId), new Fr(blockNumber)),
-        severity: PeerErrorSeverity.HighToleranceError,
-      },
-      proofValidator: {
-        validator: new TxProofValidator(this.proofVerifier),
-        severity: PeerErrorSeverity.MidToleranceError,
-      },
-      doubleSpendValidator: {
-        validator: new DoubleSpendTxValidator({
-          nullifiersExist: async (nullifiers: Buffer[]) => {
-            const merkleTree = this.worldStateSynchronizer.getCommitted();
-            const indices = await merkleTree.findLeafIndices(MerkleTreeId.NULLIFIER_TREE, nullifiers);
-            return indices.map(index => index !== undefined);
-          },
-        }),
-        severity: PeerErrorSeverity.HighToleranceError,
+      reqResp: this.reqresp,
+      connectionSampler: this.reqresp.getConnectionSampler(),
+      txValidatorConfig: {
+        l1ChainId: this.config.l1ChainId,
+        rollupVersion: this.config.rollupVersion,
+        proofVerifier: this.proofVerifier,
+        txValidationCache: this.txValidationCache,
       },
+      peerScoring: this.peerManager,
+      validateRequestedBlockTxsConsistency: this.validateRequestedBlockTxsConsistency.bind(this),
     };
   }
 
+  public async validateTxsReceivedInBlockProposal(txs: Tx[]): Promise<void> {
+    const validator = createTxValidatorForBlockProposalReceivedTxs(
+      this.proofVerifier,
+      { l1ChainId: this.config.l1ChainId, rollupVersion: this.config.rollupVersion },
+      this.logger.getBindings(),
+      this.txValidationCache,
+    );
+
+    const results = await Promise.all(
+      txs.map(async tx => {
+        const result = await validator.validateTx(tx);
+        return result.result !== 'invalid';
+      }),
+    );
+    if (results.some(value => value === false)) {
+      throw new Error('Invalid tx detected');
+    }
+  }
+
+  /** Creates the first stage (fast) validators for gossiped transactions. */
+  protected async createFirstStageMessageValidators(
+    currentBlockNumber: BlockNumber,
+    nextSlotTimestamp: UInt64,
+  ): Promise<Record<string, TransactionValidator>> {
+    const gasFees = await this.getGasFees();
+    const allowedInSetup = [
+      ...(await getDefaultAllowedSetupFunctions()),
+      ...(this.config.txPublicSetupAllowListExtend ?? []),
+    ];
+    const blockNumber = BlockNumber(currentBlockNumber + 1);
+    const l1Constants = await this.archiver.getL1Constants();
+
+    return createFirstStageTxValidationsForGossipedTransactions(
+      nextSlotTimestamp,
+      blockNumber,
+      this.worldStateSynchronizer,
+      gasFees,
+      this.config.l1ChainId,
+      this.config.rollupVersion,
+      protocolContractsHash,
+      this.archiver,
+      !this.config.disableTransactions,
+      allowedInSetup,
+      this.logger.getBindings(),
+      {
+        rollupManaLimit: l1Constants.rollupManaLimit,
+        maxBlockL2Gas: this.config.validateMaxL2BlockGas,
+        maxBlockDAGas: this.config.validateMaxDABlockGas,
+      },
+    );
+  }
+
+  /** Creates the second stage (expensive proof verification) validators for gossiped transactions. */
+  protected createSecondStageMessageValidators(): Record<string, TransactionValidator> {
+    return createSecondStageTxValidationsForGossipedTransactions(this.proofVerifier, this.logger.getBindings());
+  }
+
   /**
    * Run validations on a tx.
    * @param tx - The tx to validate.
@@ -735,32 +1704,32 @@ export class LibP2PService<T extends P2PClientType> extends WithTracer implement
    */
   private async runValidations(
     tx: Tx,
-    messageValidators: Record<string, MessageValidator>,
+    messageValidators: Record<string, TransactionValidator>,
   ): Promise<ValidationOutcome> {
     const validationPromises = Object.entries(messageValidators).map(async ([name, { validator, severity }]) => {
       const { result } = await validator.validateTx(tx);
-      return { name, isValid: result === 'valid', severity };
+      return { name, isValid: result !== 'invalid', severity };
     });
 
     // A promise that resolves when all validations have been run
-    const allValidations = Promise.all(validationPromises);
-
-    // A promise that resolves when the first validation fails
-    const firstFailure = Promise.race(
-      validationPromises.map(async promise => {
-        const result = await promise;
-        return result.isValid ? new Promise(() => {}) : result;
-      }),
-    );
-
-    // Wait for the first validation to fail or all validations to pass
-    const result = await Promise.race([
-      allValidations.then(() => ({ allPassed: true as const })),
-      firstFailure.then(failure => ({ allPassed: false as const, failure: failure as ValidationResult })),
-    ]);
-
-    // If all validations pass, allPassed will be true, if failed, then the failure will be the first validation to fail
-    return result;
+    const allValidations = await Promise.all(validationPromises);
+    const failures = allValidations.filter(x => !x.isValid);
+    if (failures.length > 0) {
+      // Pick the most severe failure (lowest tolerance = harshest penalty)
+      const failed = maxBy(failures, f => PeerErrorSeverityByHarshness.indexOf(f.severity))!;
+      return {
+        allPassed: false,
+        failure: {
+          isValid: { result: 'invalid' as const, reason: ['Failed validation'] },
+          name: failed.name,
+          severity: failed.severity,
+        },
+      };
+    } else {
+      return {
+        allPassed: true,
+      };
+    }
   }
 
   /**
@@ -774,20 +1743,23 @@ export class LibP2PService<T extends P2PClientType> extends WithTracer implement
    * @param peerId - The peer ID of the peer that sent the tx.
    * @returns Severity
    */
-  private async handleDoubleSpendFailure(tx: Tx, blockNumber: number): Promise<PeerErrorSeverity> {
+  private async handleDoubleSpendFailure(tx: Tx, blockNumber: BlockNumber): Promise<PeerErrorSeverity> {
     if (blockNumber <= this.config.doubleSpendSeverePeerPenaltyWindow) {
       return PeerErrorSeverity.HighToleranceError;
     }
 
-    const snapshotValidator = new DoubleSpendTxValidator({
-      nullifiersExist: async (nullifiers: Buffer[]) => {
-        const merkleTree = this.worldStateSynchronizer.getSnapshot(
-          blockNumber - this.config.doubleSpendSeverePeerPenaltyWindow,
-        );
-        const indices = await merkleTree.findLeafIndices(MerkleTreeId.NULLIFIER_TREE, nullifiers);
-        return indices.map(index => index !== undefined);
+    const snapshotValidator = new DoubleSpendTxValidator(
+      {
+        nullifiersExist: async (nullifiers: Buffer[]) => {
+          const merkleTree = this.worldStateSynchronizer.getSnapshot(
+            BlockNumber(blockNumber - this.config.doubleSpendSeverePeerPenaltyWindow),
+          );
+          const indices = await merkleTree.findLeafIndices(MerkleTreeId.NULLIFIER_TREE, nullifiers);
+          return indices.map(index => index !== undefined);
+        },
       },
-    });
+      this.logger.getBindings(),
+    );
 
     const validSnapshot = await snapshotValidator.validateTx(tx);
     if (validSnapshot.result !== 'valid') {
@@ -797,58 +1769,21 @@ export class LibP2PService<T extends P2PClientType> extends WithTracer implement
     return PeerErrorSeverity.HighToleranceError;
   }
 
-  /**
-   * Validate an attestation.
-   *
-   * @param attestation - The attestation to validate.
-   * @returns True if the attestation is valid, false otherwise.
-   */
-  @trackSpan('Libp2pService.validateAttestation', async (_, attestation) => ({
-    [Attributes.BLOCK_NUMBER]: attestation.payload.header.globalVariables.blockNumber.toNumber(),
-    [Attributes.SLOT_NUMBER]: attestation.payload.header.globalVariables.slotNumber.toNumber(),
-    [Attributes.BLOCK_ARCHIVE]: attestation.archive.toString(),
-    [Attributes.P2P_ID]: await attestation.p2pMessageIdentifier().then(i => i.toString()),
-  }))
-  public async validateAttestation(peerId: PeerId, attestation: BlockAttestation): Promise<boolean> {
-    const severity = await this.attestationValidator.validate(attestation);
-    if (severity) {
-      this.peerManager.penalizePeer(peerId, severity);
-      return false;
-    }
-
-    return true;
-  }
-
-  /**
-   * Validate a block proposal.
-   *
-   * @param block - The block proposal to validate.
-   * @returns True if the block proposal is valid, false otherwise.
-   */
-  @trackSpan('Libp2pService.validateBlockProposal', (_peerId, block) => ({
-    [Attributes.SLOT_NUMBER]: block.payload.header.globalVariables.slotNumber.toString(),
-  }))
-  public async validateBlockProposal(peerId: PeerId, block: BlockProposal): Promise<boolean> {
-    const severity = await this.blockProposalValidator.validate(block);
-    if (severity) {
-      this.peerManager.penalizePeer(peerId, severity);
-      return false;
-    }
-
-    return true;
-  }
-
   public getPeerScore(peerId: PeerId): number {
     return this.node.services.pubsub.score.score(peerId.toString());
   }
 
+  public handleAuthRequestFromPeer(authRequest: AuthRequest, peerId: PeerId): Promise<StatusMessage> {
+    return this.peerManager.handleAuthRequestFromPeer(authRequest, peerId);
+  }
+
   private async sendToPeers<T extends Gossipable>(message: T) {
     const parent = message.constructor as typeof Gossipable;
 
-    const identifier = await message.p2pMessageIdentifier().then(i => i.toString());
+    const identifier = await message.p2pMessageLoggingIdentifier().then(i => i.toString());
     this.logger.trace(`Sending message ${identifier}`, { p2pMessageIdentifier: identifier });
 
-    const recipientsNum = await this.publishToTopic(parent.p2pTopic, message.toBuffer());
+    const recipientsNum = await this.publishToTopic(this.topicStrings[parent.p2pTopic], message);
     this.logger.debug(`Sent message ${identifier} to ${recipientsNum} peers`, {
       p2pMessageIdentifier: identifier,
       sourcePeer: this.node.peerId.toString(),