@aztec/p2p 0.0.1-commit.24de95ac → 0.0.1-commit.2606882

package/src/msg_validators/attestation_validator/README.md

@@ -0,0 +1,49 @@
+# Attestation Validation
+
+This module validates `CheckpointAttestation` gossipsub messages. Attestations are signatures from committee members endorsing a checkpoint proposal.
+
+**Topic**: `checkpoint_attestation` | **Snappy size limit**: 5 KB
+
+## Stage 1: AttestationValidator (Gossipsub Validation)
+
+| # | Rule | Consequence | Severity | File |
+|---|------|-------------|----------|------|
+| 1 | **Slot timeliness**: `currentSlot` or `nextSlot`. Previous slot within 500ms: IGNORE. Older: REJECT. | REJECT or IGNORE | HighToleranceError | `attestation_validator.ts` |
+| 2 | **Attester signature**: `getSender()` must recover valid address | REJECT | LowToleranceError | same |
+| 3 | **Attester in committee**: recovered address in committee for slot | REJECT | HighToleranceError | same |
+| 4 | **Proposer exists**: `getProposerAttesterAddressInSlot` must return defined | REJECT | HighToleranceError | same |
+| 5 | **Proposer signature**: `getProposer()` must recover valid address | REJECT | LowToleranceError | same |
+| 6 | **Proposer matches expected**: recovered proposer = expected for slot | REJECT | HighToleranceError | same |
+| 7 | **NoCommitteeError**: committee unavailable | REJECT | LowToleranceError | same |
+
+**Fisherman mode extension** (`FishermanAttestationValidator`): if a checkpoint proposal for the same archive exists in pool, the attestation's `ConsensusPayload` must `.equals()` the stored proposal's payload. On mismatch: REJECT + LowToleranceError.
+
+## Stage 2: Pool Admission
+
+| # | Rule | Consequence |
+|---|------|-------------|
+| 8 | Sender recoverable (pool-side) | Silent drop |
+| 9 | Not a duplicate (same slot + proposalId + signer) | IGNORE |
+| 10 | Per-signer cap: `MAX_ATTESTATIONS_PER_SLOT_AND_SIGNER` = 2 | IGNORE |
+
+Own attestations added via `addOwnCheckpointAttestations` bypass the per-signer cap.
+
+## Stage 3: Equivocation Detection
+
+When a signer's attestation count for a slot reaches exactly 2 (different proposals): `duplicateAttestationCallback` fires -> `WANT_TO_SLASH_EVENT` with `OffenseType.DUPLICATE_ATTESTATION`. Attestation still ACCEPTED and rebroadcast. Callback fires once (not again at count 3+).
+
+## Validation at L1 Checkpoint Submission (Archiver)
+
+| Rule | Consequence | File |
+|------|-------------|------|
+| Each attestation must have recoverable signature (or address-only is allowed but does not count toward quorum) | Checkpoint rejected as invalid | `archiver/src/modules/validation.ts` |
+| Attestation at index `i` must correspond to committee member at index `i` | Checkpoint rejected as invalid | same |
+| Valid attestation count >= floor(committee * 2/3) + 1 | Checkpoint rejected as invalid | same |
+| No committee / escape hatch open | Accepted unconditionally | same |
+
+Note: `skipValidateCheckpointAttestations` config flag bypasses all archiver attestation validation.
+
+## Gossipsub Topic Scoring
+
+P3 enabled with expected messages per slot = `targetCommitteeSize`. Conservative threshold (30% of convergence value). Max P3 penalty = -34 per topic.
+

package/src/msg_validators/attestation_validator/attestation_validator.ts

@@ -1,69 +1,114 @@
 import type { EpochCacheInterface } from '@aztec/epoch-cache';
-import { NoCommitteeError } from '@aztec/ethereum';
+import { NoCommitteeError } from '@aztec/ethereum/contracts';
 import { type Logger, createLogger } from '@aztec/foundation/log';
-import { type BlockAttestation, type P2PValidator, PeerErrorSeverity } from '@aztec/stdlib/p2p';
+import {
+  type CheckpointAttestation,
+  type CoordinationSignatureContext,
+  type P2PValidator,
+  PeerErrorSeverity,
+  type ValidationResult,
+  hasValidSignatureContext,
+} from '@aztec/stdlib/p2p';
 
-export class AttestationValidator implements P2PValidator<BlockAttestation> {
-  private epochCache: EpochCacheInterface;
-  private logger: Logger;
+import { PipeliningWindow, isWithinClockTolerance } from '../clock_tolerance.js';
 
-  constructor(epochCache: EpochCacheInterface) {
+export class CheckpointAttestationValidator implements P2PValidator<CheckpointAttestation> {
+  protected epochCache: EpochCacheInterface;
+  protected logger: Logger;
+  private readonly pipeliningWindow: PipeliningWindow;
+  protected readonly signatureContext: CoordinationSignatureContext;
+
+  constructor(
+    epochCache: EpochCacheInterface,
+    opts: {
+      l1PublishingTime?: number;
+      p2pPropagationTime?: number;
+      signatureContext: CoordinationSignatureContext;
+    },
+  ) {
     this.epochCache = epochCache;
-    this.logger = createLogger('p2p:attestation-validator');
+    this.pipeliningWindow = new PipeliningWindow(epochCache, {
+      l1PublishingTime: opts.l1PublishingTime,
+      p2pPropagationTime: opts.p2pPropagationTime,
+    });
+    this.signatureContext = opts.signatureContext;
+    this.logger = createLogger('p2p:checkpoint-attestation-validator');
   }
 
-  async validate(message: BlockAttestation): Promise<PeerErrorSeverity | undefined> {
-    const slotNumberBigInt = message.payload.header.slotNumber.toBigInt();
+  async validate(message: CheckpointAttestation): Promise<ValidationResult> {
+    const slotNumber = message.payload.header.slotNumber;
 
     try {
-      const { currentProposer, nextProposer, currentSlot, nextSlot } =
-        await this.epochCache.getProposerAttesterAddressInCurrentOrNextSlot();
+      // Cross-chain replay check: reject attestations that carry a foreign signing domain.
+      if (!hasValidSignatureContext(message.payload, this.signatureContext)) {
+        this.logger.warn(`Rejecting checkpoint attestation with foreign signature context for slot ${slotNumber}`, {
+          chainId: message.payload.signatureContext.chainId,
+          rollupAddress: message.payload.signatureContext.rollupAddress.toString(),
+          expectedChainId: this.signatureContext.chainId,
+          expectedRollupAddress: this.signatureContext.rollupAddress.toString(),
+        });
+        return { result: 'reject', severity: PeerErrorSeverity.LowToleranceError };
+      }
 
-      if (slotNumberBigInt !== currentSlot && slotNumberBigInt !== nextSlot) {
-        this.logger.warn(
-          `Attestation slot ${slotNumberBigInt} is not current (${currentSlot}) or next (${nextSlot}) slot`,
-        );
-        return PeerErrorSeverity.HighToleranceError;
+      // Use target slots since proposals target pipeline slots (slot + 1 when pipelining).
+      const { targetSlot, nextSlot } = this.epochCache.getTargetAndNextSlot();
+
+      if (slotNumber !== targetSlot && slotNumber !== nextSlot) {
+        // When pipelining, accept attestations for the current slot (built in the previous slot)
+        // until the target slot reaches its L1 publish cutoff.
+        if (this.pipeliningWindow.acceptsAttestation(slotNumber)) {
+          // Fall through to remaining validation (signature, committee, etc.)
+        } else if (!isWithinClockTolerance(slotNumber, targetSlot, this.epochCache)) {
+          this.logger.warn(
+            `Checkpoint attestation slot ${slotNumber} is not current (${targetSlot}) or next (${nextSlot}) slot`,
+          );
+          return { result: 'reject', severity: PeerErrorSeverity.HighToleranceError };
+        } else {
+          this.logger.debug(`Ignoring checkpoint attestation for previous slot ${slotNumber} within clock tolerance`);
+          return { result: 'ignore' };
+        }
       }
 
       // Verify the signature is valid
       const attester = message.getSender();
       if (attester === undefined) {
-        this.logger.warn(`Invalid signature in attestation for slot ${slotNumberBigInt}`);
-        return PeerErrorSeverity.LowToleranceError;
+        this.logger.warn(`Invalid signature in checkpoint attestation for slot ${slotNumber}`);
+        return { result: 'reject', severity: PeerErrorSeverity.LowToleranceError };
       }
 
       // Verify the attester is in the committee for this slot
-      if (!(await this.epochCache.isInCommittee(slotNumberBigInt, attester))) {
-        this.logger.warn(`Attester ${attester.toString()} is not in committee for slot ${slotNumberBigInt}`);
-        return PeerErrorSeverity.HighToleranceError;
+      if (!(await this.epochCache.isInCommittee(slotNumber, attester))) {
+        this.logger.warn(`Attester ${attester.toString()} is not in committee for slot ${slotNumber}`);
+        return { result: 'reject', severity: PeerErrorSeverity.HighToleranceError };
       }
 
-      // Verify the proposer signature matches the expected proposer for this slot
+      // Verify the proposer signature matches the expected proposer for the attestation's slot
+      // We look up the proposer for the specific slot rather than using currentSlot/nextSlot
+      // since timing differences could cause mismatches
       const proposer = message.getProposer();
-      const expectedProposer = slotNumberBigInt === currentSlot ? currentProposer : nextProposer;
+      const expectedProposer = await this.epochCache.getProposerAttesterAddressInSlot(slotNumber);
       if (!expectedProposer) {
-        this.logger.warn(`No proposer defined for slot ${slotNumberBigInt}`);
-        return PeerErrorSeverity.HighToleranceError;
+        this.logger.warn(`No proposer defined for slot ${slotNumber}`);
+        return { result: 'reject', severity: PeerErrorSeverity.HighToleranceError };
       }
       if (!proposer) {
-        this.logger.warn(`Invalid proposer signature in attestation for slot ${slotNumberBigInt}`);
-        return PeerErrorSeverity.LowToleranceError;
+        this.logger.warn(`Invalid proposer signature in checkpoint attestation for slot ${slotNumber}`);
+        return { result: 'reject', severity: PeerErrorSeverity.LowToleranceError };
       }
       if (!proposer.equals(expectedProposer)) {
         this.logger.warn(
-          `Proposer signature mismatch in attestation. ` +
-            `Expected ${expectedProposer?.toString() ?? 'none'} but got ${proposer.toString()} for slot ${slotNumberBigInt}`,
+          `Proposer signature mismatch in checkpoint attestation. ` +
+            `Expected ${expectedProposer?.toString() ?? 'none'} but got ${proposer.toString()} for slot ${slotNumber}`,
         );
-        return PeerErrorSeverity.HighToleranceError;
+        return { result: 'reject', severity: PeerErrorSeverity.HighToleranceError };
       }
 
-      return undefined;
+      return { result: 'accept' };
     } catch (e) {
       // People shouldn't be sending us attestations if the committee doesn't exist
       if (e instanceof NoCommitteeError) {
-        this.logger.warn(`No committee exists for attestation for slot ${slotNumberBigInt}`);
-        return PeerErrorSeverity.LowToleranceError;
+        this.logger.warn(`No committee exists for checkpoint attestation for slot ${slotNumber}`);
+        return { result: 'reject', severity: PeerErrorSeverity.LowToleranceError };
       }
       throw e;
     }

package/src/msg_validators/attestation_validator/fisherman_attestation_validator.ts

@@ -0,0 +1,101 @@
+import type { EpochCacheInterface } from '@aztec/epoch-cache';
+import {
+  type CheckpointAttestation,
+  type CoordinationSignatureContext,
+  PeerErrorSeverity,
+  type ValidationResult,
+} from '@aztec/stdlib/p2p';
+import { Attributes, Metrics, type TelemetryClient, createUpDownCounterWithDefault } from '@aztec/telemetry-client';
+
+import type { AttestationPoolApi } from '../../mem_pools/attestation_pool/attestation_pool.js';
+import { CheckpointAttestationValidator } from './attestation_validator.js';
+
+/**
+ * FishermanAttestationValidator extends the base AttestationValidator to add
+ * additional validation for fisherman nodes: verifying that attestations sign
+ * the same payload as the original proposal.
+ * Invalid attestations are rejected (not propagated), but peer penalization is
+ * handled by LibP2PService based on the fishermanMode config to ensure a better
+ * view of the network.
+ */
+export class FishermanAttestationValidator extends CheckpointAttestationValidator {
+  private invalidAttestationCounter;
+
+  constructor(
+    epochCache: EpochCacheInterface,
+    private attestationPool: AttestationPoolApi,
+    telemetryClient: TelemetryClient,
+    opts: {
+      l1PublishingTime?: number;
+      p2pPropagationTime?: number;
+      signatureContext: CoordinationSignatureContext;
+    },
+  ) {
+    super(epochCache, opts);
+    this.logger = this.logger.createChild('[FISHERMAN]');
+
+    const meter = telemetryClient.getMeter('FishermanAttestationValidator');
+    this.invalidAttestationCounter = createUpDownCounterWithDefault(
+      meter,
+      Metrics.VALIDATOR_INVALID_ATTESTATION_RECEIVED_COUNT,
+      {
+        [Attributes.ERROR_TYPE]: ['base_validation_failed', 'payload_mismatch'],
+      },
+    );
+  }
+
+  override async validate(message: CheckpointAttestation): Promise<ValidationResult> {
+    // First run the standard validation
+    const baseValidationResult = await super.validate(message);
+    if (baseValidationResult.result !== 'accept') {
+      // Track base validation failures (invalid signature, wrong committee, etc.)
+      this.invalidAttestationCounter.add(1, {
+        [Attributes.ERROR_TYPE]: 'base_validation_failed',
+      });
+      return baseValidationResult;
+    }
+
+    // fisherman validation: verify attestation payload matches proposal payload
+    const slotNumberBigInt = message.payload.header.slotNumber;
+    const attester = message.getSender();
+    const proposer = message.getProposer();
+
+    if (!attester || !proposer) {
+      return { result: 'accept' };
+    }
+
+    const proposal = await this.attestationPool.getCheckpointProposal(message.payload.header.slotNumber);
+
+    if (proposal) {
+      // Compare the attestation payload with the proposal payload
+      if (!message.payload.equals(proposal)) {
+        this.logger.error(
+          `Attestation payload mismatch for slot ${slotNumberBigInt}! ` +
+            `Attester ${attester.toString()} signed different data than the proposal.`,
+          {
+            slot: slotNumberBigInt.toString(),
+            attester: attester.toString(),
+            proposer: proposer.toString(),
+            proposalArchive: proposal.archive.toString(),
+            attestationArchive: message.archive.toString(),
+            proposalHeader: proposal.checkpointHeader.hash().toString(),
+            attestationHeader: message.payload.header.hash().toString(),
+          },
+        );
+
+        // Track invalid attestation metric
+        this.invalidAttestationCounter.add(1, {
+          [Attributes.ERROR_TYPE]: 'payload_mismatch',
+        });
+
+        // Return error to reject the message, but LibP2PService won't penalize in fisherman mode
+        return { result: 'reject', severity: PeerErrorSeverity.LowToleranceError };
+      }
+    } else {
+      // We might receive attestations before proposals in some cases
+      this.logger.debug(`Received attestation for slot ${slotNumberBigInt} but proposal not found yet.`);
+    }
+
+    return { result: 'accept' };
+  }
+}

package/src/msg_validators/attestation_validator/index.ts

@@ -1 +1,2 @@
 export * from './attestation_validator.js';
+export * from './fisherman_attestation_validator.js';

package/src/msg_validators/clock_tolerance.ts

@@ -0,0 +1,121 @@
+import type { EpochCacheInterface } from '@aztec/epoch-cache';
+import { SlotNumber } from '@aztec/foundation/branded-types';
+import { DEFAULT_P2P_PROPAGATION_TIME, createPipelinedCheckpointTimingModel } from '@aztec/stdlib/timetable';
+
+/**
+ * Maximum clock disparity tolerance for P2P message validation (in milliseconds).
+ * Messages for the previous slot are accepted if we're within this many milliseconds
+ * of the current slot start. This prevents penalizing peers for messages that
+ * were valid when sent but arrived slightly late due to network latency.
+ *
+ * This follows Ethereum's MAXIMUM_GOSSIP_CLOCK_DISPARITY approach.
+ */
+export const MAXIMUM_GOSSIP_CLOCK_DISPARITY_MS = 500;
+
+/**
+ * Checks if a message for the previous slot should be accepted due to clock tolerance.
+ *
+ * @param messageSlot - The slot number from the received message
+ * @param currentSlot - The current slot number
+ * @param epochCache - EpochCache to get timing information
+ * @returns true if the message is for the previous slot AND we're within the clock tolerance window
+ */
+export function isWithinClockTolerance(
+  messageSlot: SlotNumber,
+  currentSlot: SlotNumber,
+  epochCache: EpochCacheInterface,
+): boolean {
+  // Guard against slot 0 edge case (genesis)
+  if (currentSlot === SlotNumber.ZERO) {
+    return false;
+  }
+
+  // Only apply tolerance to messages for the previous slot
+  const previousSlot = SlotNumber(currentSlot - 1);
+  if (messageSlot !== previousSlot) {
+    return false;
+  }
+
+  // Check how far we are into the current slot (in milliseconds)
+  const { ts: slotStartTs, nowMs } = epochCache.getEpochAndSlotNow();
+  const targetSlot = epochCache.getTargetSlot();
+
+  // Sanity check: ensure the epoch cache's target slot matches the expected current slot
+  if (targetSlot !== currentSlot) {
+    return false;
+  }
+
+  // ts is in seconds, convert to ms; nowMs is already in milliseconds
+  const slotStartMs = slotStartTs * 1000n;
+  const elapsedMs = Number(nowMs - slotStartMs);
+
+  return elapsedMs < MAXIMUM_GOSSIP_CLOCK_DISPARITY_MS;
+}
+
+/**
+ * Checks if a straggler message for the previous target slot should be accepted.
+ *
+ * Proposals and attestations carry the target slot N. Most of the time the receiver is either
+ * still in the build slot N-1 (accepted via the main `slotNumber === targetSlot` match) or in the
+ * target slot N (accepted again via `targetSlot`). Stragglers that arrive after the receiver has
+ * rolled past the target slot fall to this check: accept `messageSlot === slotNow` while we're
+ * still within the first `windowSeconds + clock-disparity` of the slot.
+ *
+ * Under the early-pipelining schedule `windowSeconds` is small (0 for proposals,
+ * `2*p2pPropagationTime` for attestations) since the proposer collects everything
+ * before the slot boundary.
+ *
+ * @param messageSlot - The slot number from the received message
+ * @param epochCache - EpochCache to get timing state
+ * @param windowSeconds - How far into the current slot we still accept previous-target messages
+ * @returns true if the message is for the current wallclock slot and we're within the grace period
+ */
+function isWithinPipeliningWindow(
+  messageSlot: SlotNumber,
+  epochCache: EpochCacheInterface,
+  windowSeconds: number,
+): boolean {
+  const currentSlot = epochCache.getSlotNow();
+  if (messageSlot !== currentSlot) {
+    return false;
+  }
+
+  const { ts: slotStartTs, nowMs } = epochCache.getEpochAndSlotNow();
+  const slotStartMs = slotStartTs * 1000n;
+  const elapsedMs = Number(nowMs - slotStartMs);
+  const windowMs = windowSeconds * 1000 + MAXIMUM_GOSSIP_CLOCK_DISPARITY_MS;
+
+  return elapsedMs < windowMs;
+}
+
+export class PipeliningWindow {
+  private readonly proposalWindowIntoTargetSlot: number;
+  private readonly attestationWindowIntoTargetSlot: number;
+
+  constructor(
+    private readonly epochCache: EpochCacheInterface,
+    opts: {
+      p2pPropagationTime?: number;
+      l1PublishingTime?: number;
+    } = {},
+  ) {
+    const l1Constants = epochCache.getL1Constants();
+    const checkpointTiming = createPipelinedCheckpointTimingModel({
+      aztecSlotDuration: l1Constants.slotDuration,
+      ethereumSlotDuration: l1Constants.ethereumSlotDuration,
+      l1PublishingTime: opts.l1PublishingTime ?? l1Constants.ethereumSlotDuration,
+      p2pPropagationTime: opts.p2pPropagationTime ?? DEFAULT_P2P_PROPAGATION_TIME,
+    });
+
+    this.proposalWindowIntoTargetSlot = checkpointTiming.proposalWindowIntoTargetSlot;
+    this.attestationWindowIntoTargetSlot = checkpointTiming.attestationWindowIntoTargetSlot;
+  }
+
+  public acceptsProposal(messageSlot: SlotNumber): boolean {
+    return isWithinPipeliningWindow(messageSlot, this.epochCache, this.proposalWindowIntoTargetSlot);
+  }
+
+  public acceptsAttestation(messageSlot: SlotNumber): boolean {
+    return isWithinPipeliningWindow(messageSlot, this.epochCache, this.attestationWindowIntoTargetSlot);
+  }
+}

package/src/msg_validators/index.ts

@@ -1,3 +1,3 @@
 export * from './tx_validator/index.js';
-export * from './block_proposal_validator/index.js';
+export * from './proposal_validator/index.js';
 export * from './attestation_validator/index.js';

package/src/msg_validators/proposal_validator/README.md

@@ -0,0 +1,123 @@
+# Proposal Validation
+
+This module validates `BlockProposal` and `CheckpointProposal` gossipsub messages. Both share the same base `ProposalValidator` (neither subclass overrides `validate()`), with checkpoint-specific logic layered on top in the gossipsub handler.
+
+## BlockProposal
+
+**Topic**: `block_proposal` | **Snappy size limit**: 10 MB
+
+### Stage 1: Gossipsub Validation (ProposalValidator)
+
+File: `proposal_validator.ts`
+
+| # | Rule | Consequence | Severity |
+|---|------|-------------|----------|
+| 1 | **Slot check**: must be `currentSlot` or `nextSlot`. Previous slot within 500ms tolerance: IGNORE. | REJECT | HighToleranceError |
+| 2 | **Signature**: `getSender()` must recover a valid address. If `signedTxs` present, its recovered sender must match. | REJECT | MidToleranceError |
+| 3 | **Txs permitted**: if `disableTransactions`, must have 0 txHashes and 0 embedded txs | REJECT | MidToleranceError |
+| 4 | **Max txs**: `txHashes.length <= maxTxsPerBlock` | REJECT | MidToleranceError |
+| 5 | **Embedded txs in txHashes**: every embedded tx's hash must appear in `txHashes` | REJECT | MidToleranceError |
+| 6 | **Proposer check**: signer must match expected proposer for slot (skipped if committee size = 0) | REJECT | MidToleranceError |
+| 7 | **Tx hash integrity**: each embedded tx's recomputed hash must match declared hash | REJECT | LowToleranceError |
+| 8 | **NoCommitteeError**: epoch cache cannot determine committee | REJECT | LowToleranceError |
+
+Deserialization guards: `BlockProposal.fromBuffer` and `SignedTxs.fromBuffer` both enforce `txCount <= MAX_TXS_PER_BLOCK` (65536). Violation -> REJECT + LowToleranceError.
+
+### Stage 2: Mempool (Attestation Pool)
+
+| # | Rule | Consequence |
+|---|------|-------------|
+| 9 | **Duplicate**: same archive root already stored | IGNORE (no penalty) |
+| 10 | **Per-position cap**: max 2 proposals per (slot, indexWithinCheckpoint) | REJECT + HighToleranceError |
+| 11 | **Equivocation**: >1 distinct proposal for same (slot, index) | ACCEPT (rebroadcast for detection). At count=2: `duplicateProposalCallback` fires -> slash event (`OffenseType.DUPLICATE_PROPOSAL`, configured via `slashDuplicateProposalPenalty`) |
+
+### Stage 3: Validator-Client Processing (BlockProposalHandler)
+
+Only runs on validator nodes. Non-validator nodes use a default handler that triggers tx collection without deep validation.
+
+| # | Rule | Failure Reason |
+|---|------|----------------|
+| 12 | Signature re-check | `invalid_proposal` |
+| 13 | ProposalValidator re-run | `invalid_proposal` |
+| 14 | Self-proposal filter | Ignored silently |
+| 15 | Parent block exists (`lastArchive.root` matches known block or genesis) | `parent_block_not_found` |
+| 16 | Parent block slot <= proposal slot | `parent_block_wrong_slot` |
+| 17 | Block number not already in archiver | `block_number_already_exists` |
+| 18 | Checkpoint number consistency (multiple sub-rules for first/non-first blocks) | `invalid_proposal` |
+| 19 | Global variables consistency (non-first block: chainId, version, slot, timestamp, coinbase, feeRecipient, gasFees match parent) | `global_variables_mismatch` |
+| 20 | L1-to-L2 message hash matches `proposal.inHash` | `in_hash_mismatch` |
+| 21 | All txs referenced by `txHashes` obtainable | `txs_not_available` |
+| 22 | **Re-execution**: processed tx count matches `txHashes.length` | `timeout` (ReExTimeoutError) |
+| 23 | **Re-execution**: no failed txs | `failed_txs` (ReExFailedTxsError) -- **SLASHABLE** |
+| 24 | **Re-execution**: archive root and header match proposal | `state_mismatch` (ReExStateMismatchError) -- **SLASHABLE** |
+
+**Escape hatch**: during escape hatch periods (`isEscapeHatchOpenAtSlot`), re-execution and slashing are both disabled, and the proposal is rejected locally.
+
+**Conditional re-execution**: rules 22-24 only run when at least one condition is true: `fishermanMode` enabled, `slashBroadcastedInvalidBlockPenalty > 0`, committee membership, `alwaysReexecuteBlockProposals`, or `blobClient.canUpload()`.
+
+**Slashing**: only `state_mismatch` and `failed_txs` trigger on-chain slashing (`OffenseType.BROADCASTED_INVALID_BLOCK_PROPOSAL`, gated by `slashBroadcastedInvalidBlockPenalty > 0`). Unknown errors during re-execution do NOT slash.
+
+**Embedded tx validation**: txs in `signedTxs` are validated via `createTxValidatorForBlockProposalReceivedTxs` (well-formedness only) when stored in the tx pool. Invalid embedded txs are rejected from the pool but do not cause the block proposal itself to be rejected at gossipsub level.
+
+### Gossipsub Topic Scoring
+
+| Parameter | Effect |
+|-----------|--------|
+| P4 (invalidMessageDeliveries) | weight = -20, decay over 4 slots |
+| P3 (meshMessageDeliveries) | Enabled only when `expectedBlockProposalsPerSlot > 0` (MBPS mode) |
+| P1/P2 | Only active when P3 is enabled |
+
+---
+
+## CheckpointProposal
+
+**Topic**: `checkpoint_proposal` | **Snappy size limit**: 10 MB
+
+### Stage 1: Gossipsub Validation (ProposalValidator)
+
+Same `ProposalValidator.validate()` as BlockProposal (shared implementation, neither subclass overrides it). See BlockProposal Stage 1 rules 1-8.
+
+### Stage 2: Embedded Block Proposal Validation (if `lastBlock` present)
+
+The checkpoint's embedded `lastBlock` is extracted via `getBlockProposal()` and validated through `BlockProposalValidator.validate()` plus block mempool checks.
+
+| Rule | Consequence | File |
+|------|-------------|------|
+| Block proposal must pass `BlockProposalValidator.validate()` | If REJECT: entire checkpoint REJECTED | `libp2p_service.ts` |
+| Block proposal must not exceed per-position cap (2) | Checkpoint REJECTED + HighToleranceError | same |
+| Block equivocation detected (>1 proposals for same slot+index) | Checkpoint REJECTED (block itself is ACCEPT for re-broadcast) | same |
+
+### Stage 3: Mempool (Attestation Pool)
+
+| Rule | Consequence | File |
+|------|-------------|------|
+| Duplicate (same archive ID) | IGNORE (no penalty). Embedded block still processed if valid. | `attestation_pool.ts` |
+| Per-slot cap: `MAX_CHECKPOINT_PROPOSALS_PER_SLOT` = 2 | REJECT + HighToleranceError. Embedded block still processed. | same |
+
+### Stage 4: Equivocation Detection
+
+When >1 checkpoint proposals exist for same slot (count > 1): ACCEPT (re-broadcast). At count == 2 (exactly): `duplicateProposalCallback` fires. Proposal NOT further processed. Callback fires only once per equivocation pair.
+
+### Stage 5: Validator-Client Consensus Validation
+
+Determines whether the validator signs an attestation.
+
+| Rule | Consequence | File |
+|------|-------------|------|
+| Escape hatch open | No attestation | `validator-client/src/validator.ts` |
+| Signature invalid (re-check) | No attestation | same |
+| Self-proposal | No attestation (ignored) | same |
+| `feeAssetPriceModifier` outside [-100, +100] bps | No attestation | same |
+| Not in committee (unless fisherman mode) | No attestation | same |
+| Checkpoint header mismatch (computed vs proposal) | No attestation | same |
+| Archive root mismatch | No attestation | same |
+| Epoch out hash mismatch | No attestation | same |
+| Last block not found / not matching | No attestation | same |
+| Already attested to this or earlier slot | No attestation (unless `attestToEquivocatedProposals`) | same |
+
+**`skipCheckpointProposalValidation` config**: when true, the re-execution checks (header/archive/epoch hash) are all skipped. Signature, fee modifier, committee, escape hatch, and equivocation checks still apply.
+
+### Gossipsub Topic Scoring
+
+P3 enabled with expected rate of 1 message per slot. P4 weight = -20, max P3 penalty = -34 per topic.
+

package/src/msg_validators/proposal_validator/block_proposal_validator.ts

@@ -0,0 +1,30 @@
+import type { EpochCacheInterface } from '@aztec/epoch-cache';
+import type { BlockProposal, CoordinationSignatureContext, P2PValidator, ValidationResult } from '@aztec/stdlib/p2p';
+
+import { ProposalValidator } from '../proposal_validator/proposal_validator.js';
+
+export class BlockProposalValidator implements P2PValidator<BlockProposal> {
+  private proposalValidator: ProposalValidator;
+
+  constructor(
+    epochCache: EpochCacheInterface,
+    opts: {
+      txsPermitted: boolean;
+      maxTxsPerBlock?: number;
+      maxBlocksPerCheckpoint?: number;
+      p2pPropagationTime?: number;
+      skipSlotValidation?: boolean;
+      signatureContext: CoordinationSignatureContext;
+    },
+  ) {
+    this.proposalValidator = new ProposalValidator(epochCache, opts, 'p2p:block_proposal_validator');
+  }
+
+  async validate(proposal: BlockProposal): Promise<ValidationResult> {
+    const headerResult = await this.proposalValidator.validate(proposal);
+    if (headerResult.result !== 'accept') {
+      return headerResult;
+    }
+    return this.proposalValidator.validateTxs(proposal);
+  }
+}

package/src/msg_validators/proposal_validator/checkpoint_proposal_validator.ts

@@ -0,0 +1,41 @@
+import type { EpochCacheInterface } from '@aztec/epoch-cache';
+import type {
+  CheckpointProposal,
+  CoordinationSignatureContext,
+  P2PValidator,
+  ValidationResult,
+} from '@aztec/stdlib/p2p';
+
+import { ProposalValidator } from '../proposal_validator/proposal_validator.js';
+
+export class CheckpointProposalValidator implements P2PValidator<CheckpointProposal> {
+  private proposalValidator: ProposalValidator;
+
+  constructor(
+    epochCache: EpochCacheInterface,
+    opts: {
+      txsPermitted: boolean;
+      maxTxsPerBlock?: number;
+      maxBlocksPerCheckpoint?: number;
+      p2pPropagationTime?: number;
+      skipSlotValidation?: boolean;
+      signatureContext: CoordinationSignatureContext;
+    },
+  ) {
+    this.proposalValidator = new ProposalValidator(epochCache, opts, 'p2p:checkpoint_proposal_validator');
+  }
+
+  async validate(proposal: CheckpointProposal): Promise<ValidationResult> {
+    const headerResult = await this.proposalValidator.validate(proposal);
+    if (headerResult.result !== 'accept') {
+      return headerResult;
+    }
+
+    const blockProposal = proposal.getBlockProposal();
+    if (blockProposal) {
+      return this.proposalValidator.validateTxs(blockProposal);
+    }
+
+    return { result: 'accept' };
+  }
+}

package/src/msg_validators/proposal_validator/index.ts

@@ -0,0 +1,3 @@
+export * from './block_proposal_validator.js';
+export * from './checkpoint_proposal_validator.js';
+export * from './proposal_validator.js';