@aztec/p2p 0.0.1-commit.2f68f620 → 0.0.1-commit.321f6a9

package/src/msg_validators/proposal_validator/proposal_validator.ts

@@ -1,6 +1,7 @@
 import type { EpochCacheInterface } from '@aztec/epoch-cache';
 import { NoCommitteeError } from '@aztec/ethereum/contracts';
 import { type Logger, createLogger } from '@aztec/foundation/log';
+import { MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT } from '@aztec/stdlib/deserialization';
 import {
   type BlockProposal,
   type CheckpointProposalCore,
@@ -9,39 +10,39 @@ import {
   type ValidationResult,
   hasValidSignatureContext,
 } from '@aztec/stdlib/p2p';
-
-import { PipeliningWindow, isWithinClockTolerance } from '../clock_tolerance.js';
+import type { ConsensusTimetable } from '@aztec/stdlib/timetable';
 
 /** Validates header-level and tx-level fields of block and checkpoint proposals. */
 export class ProposalValidator {
   private epochCache: EpochCacheInterface;
+  private timetable: ConsensusTimetable;
   private logger: Logger;
   private txsPermitted: boolean;
   private maxTxsPerBlock?: number;
-  private maxBlocksPerCheckpoint?: number;
-  private pipeliningWindow: PipeliningWindow;
   private skipSlotValidation: boolean;
   private signatureContext: CoordinationSignatureContext;
+  private clockDisparityMs: number;
 
   constructor(
     epochCache: EpochCacheInterface,
+    timetable: ConsensusTimetable,
     opts: {
       txsPermitted: boolean;
       maxTxsPerBlock?: number;
       maxBlocksPerCheckpoint?: number;
-      p2pPropagationTime?: number;
       skipSlotValidation?: boolean;
       signatureContext: CoordinationSignatureContext;
+      clockDisparityMs: number;
     },
     loggerName: string,
   ) {
     this.epochCache = epochCache;
+    this.timetable = timetable;
     this.txsPermitted = opts.txsPermitted;
     this.maxTxsPerBlock = opts.maxTxsPerBlock;
-    this.maxBlocksPerCheckpoint = opts.maxBlocksPerCheckpoint;
-    this.pipeliningWindow = new PipeliningWindow(epochCache, { p2pPropagationTime: opts.p2pPropagationTime });
     this.skipSlotValidation = opts.skipSlotValidation ?? false;
     this.signatureContext = opts.signatureContext;
+    this.clockDisparityMs = opts.clockDisparityMs;
     this.logger = createLogger(loggerName);
   }
 
@@ -59,21 +60,31 @@ export class ProposalValidator {
         return { result: 'reject', severity: PeerErrorSeverity.LowToleranceError };
       }
 
-      // Slot check: use target slots since proposals target pipeline slots (slot + 1 when pipelining).
-      const { targetSlot, nextSlot } = this.epochCache.getTargetAndNextSlot();
-
+      // Slot check: the tight checkpoint proposal receive window (`[receiveStart - δ, target_slot_start -
+      // E - D + δ]`) is the sole acceptance gate, applied to both block and checkpoint proposals. The
+      // window itself bounds which slots are valid, so far/wrong slots fall outside it. Every block
+      // proposal for slot N is sent before the checkpoint proposal for slot N, so nothing legitimate can
+      // arrive after the checkpoint receive deadline; gating block proposals on the same window rejects
+      // late block proposals at p2p ingress. The attestation deadline remains their re-execution/
+      // validation deadline downstream, not their arrival gate.
       const slotNumber = proposal.slotNumber;
-      if (!this.skipSlotValidation && slotNumber !== targetSlot && slotNumber !== nextSlot) {
-        // When pipelining, accept proposals for the current slot (built in the previous slot)
-        // if they're still within the shared proposal acceptance window.
-        if (this.pipeliningWindow.acceptsProposal(slotNumber)) {
-          // Fall through to remaining validation (signature, proposer, etc.)
-        } else if (!isWithinClockTolerance(slotNumber, targetSlot, this.epochCache)) {
-          this.logger.warn(`Penalizing peer for invalid slot number ${slotNumber}`, { targetSlot, nextSlot });
+      if (!this.skipSlotValidation) {
+        // Proposal receive window: [checkpoint_proposal_receive_start, checkpoint_proposal_receive_deadline],
+        // widened by the configured clock-disparity tolerance on both ends.
+        const startSeconds = this.timetable.getCheckpointProposalReceiveStart(slotNumber);
+        const deadlineSeconds = this.timetable.getCheckpointProposalReceiveDeadline(slotNumber);
+        const nowMs = Number(this.epochCache.getEpochAndSlotNow().nowMs);
+        if (
+          nowMs < startSeconds * 1000 - this.clockDisparityMs ||
+          nowMs > deadlineSeconds * 1000 + this.clockDisparityMs
+        ) {
+          this.logger.warn(`Penalizing peer for invalid slot number ${slotNumber}`, {
+            slotNumber,
+            nowMs,
+            windowStartSeconds: startSeconds,
+            windowDeadlineSeconds: deadlineSeconds,
+          });
           return { result: 'reject', severity: PeerErrorSeverity.HighToleranceError };
-        } else {
-          this.logger.verbose(`Ignoring proposal for previous slot ${slotNumber} within clock tolerance`);
-          return { result: 'ignore' };
         }
       }
 
@@ -86,7 +97,11 @@ export class ProposalValidator {
 
       // Proposer check
       const expectedProposer = await this.epochCache.getProposerAttesterAddressInSlot(slotNumber);
-      if (expectedProposer !== undefined && !proposer.equals(expectedProposer)) {
+      if (expectedProposer === undefined) {
+        this.logger.warn(`Penalizing peer for proposal with no expected proposer for current slot ${slotNumber}`);
+        return { result: 'reject', severity: PeerErrorSeverity.HighToleranceError };
+      }
+      if (!proposer.equals(expectedProposer)) {
         this.logger.warn(`Penalizing peer for invalid proposer for current slot ${slotNumber}`, {
           expectedProposer,
           proposer: proposer.toString(),
@@ -94,15 +109,17 @@ export class ProposalValidator {
         return { result: 'reject', severity: PeerErrorSeverity.MidToleranceError };
       }
 
-      if (
-        this.maxBlocksPerCheckpoint !== undefined &&
-        'indexWithinCheckpoint' in proposal &&
-        proposal.indexWithinCheckpoint >= this.maxBlocksPerCheckpoint
-      ) {
-        this.logger.warn(
-          `Penalizing peer for proposal with indexWithinCheckpoint ${proposal.indexWithinCheckpoint} >= max ${this.maxBlocksPerCheckpoint}`,
-        );
-        return { result: 'reject', severity: PeerErrorSeverity.MidToleranceError };
+      // A block proposal whose index lands at or beyond the hard attestable ceiling is structurally
+      // impossible garbage, so reject it immediately at ingress. Indices in
+      // `[maxBlocksPerCheckpoint, MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT)` are over the consensus limit
+      // but structurally valid proposer misbehavior; they pass gossip validation here so the offending
+      // proposal can be retained and re-broadcast as slashing evidence (handled downstream in the p2p
+      // service), rather than penalizing the relaying peer.
+      if ('indexWithinCheckpoint' in proposal) {
+        const indexResult = this.validateBlockIndexWithinCheckpoint(proposal);
+        if (indexResult.result !== 'accept') {
+          return indexResult;
+        }
       }
 
       return { result: 'accept' };
@@ -114,6 +131,28 @@ export class ProposalValidator {
     }
   }
 
+  /**
+   * Rejects a block proposal whose index within its checkpoint lands at or beyond the hard attestable
+   * ceiling `MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT` (a structurally impossible index that can never be
+   * part of any checkpoint we could attest to). `indexWithinCheckpoint` is 0-based, so a ceiling of 72
+   * rejects the 73rd block.
+   *
+   * Indices in `[maxBlocksPerCheckpoint, MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT)` are over the configured
+   * consensus limit but still structurally valid: they are proposer misbehavior, not relaying-peer
+   * fault, so they are *not* rejected here. The p2p service retains and re-broadcasts the first such
+   * proposal per (slot, proposer) as slashing evidence and skips processing it. Applies to standalone
+   * block proposals and to the terminal block embedded in a checkpoint proposal.
+   */
+  public validateBlockIndexWithinCheckpoint(proposal: BlockProposal): ValidationResult {
+    if (proposal.indexWithinCheckpoint >= MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT) {
+      this.logger.warn(
+        `Penalizing peer for proposal with indexWithinCheckpoint ${proposal.indexWithinCheckpoint} >= attestable ceiling ${MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT}`,
+      );
+      return { result: 'reject', severity: PeerErrorSeverity.MidToleranceError };
+    }
+    return { result: 'accept' };
+  }
+
   /** Validates transaction-related fields of a block proposal. */
   public async validateTxs(proposal: BlockProposal): Promise<ValidationResult> {
     // Transactions permitted check

package/src/msg_validators/tx_validator/README.md

@@ -120,6 +120,8 @@ The `AllowedSetupCallsMetaValidator` checks a precomputed boolean flag (`TxMetaD
 \* Gas balance check is skipped when `skipFeeEnforcement` is set (testing/dev). `GasTxValidator` internally delegates to `GasLimitsValidator` and `MaxFeePerGasValidator` as its first steps, so gas limits and fee-per-gas are checked wherever `GasTxValidator` runs. Pool migration uses `GasLimitsValidator` and `MaxFeePerGasValidator` standalone because it doesn't need the balance check.
 \** Proof verification is skipped for simulations (no verifier provided).
 
+The gas-limit bounds `GasLimitsValidator` enforces here — the per-tx protocol maxima and the network admission limits — are documented in [`stdlib/src/gas/README.md`](../../../../stdlib/src/gas/README.md) under "Gas and Data Limits".
+
 ## Fee-Per-Gas Rejection Strategy
 
 The `MaxFeePerGasValidator` and `InsufficientFeePerGasEvictionRule` reject and evict transactions whose `maxFeesPerGas` falls below the current block's gas fees. This is a simple strategy: if a tx can't pay the current fees, it gets rejected on entry and evicted after each new block.

package/src/msg_validators/tx_validator/factory.ts

@@ -100,7 +100,7 @@ export function createFirstStageTxValidationsForGossipedTransactions(
   txsPermitted: boolean,
   allowedInSetup: AllowedElement[] = [],
   bindings?: LoggerBindings,
-  gasLimitOpts?: { rollupManaLimit?: number; maxBlockL2Gas?: number; maxBlockDAGas?: number },
+  gasLimitOpts?: { maxTxL2Gas?: number; maxTxDAGas?: number },
 ): Record<string, TransactionValidator> {
   const merkleTree = worldStateSynchronizer.getCommitted();
 
@@ -292,24 +292,24 @@ export function createTxValidatorForAcceptingTxsOverRPC(
     setupAllowList,
     gasFees,
     skipFeeEnforcement,
+    isSimulation,
     timestamp,
     blockNumber,
     txsPermitted,
-    rollupManaLimit,
-    maxBlockL2Gas,
-    maxBlockDAGas,
+    maxTxL2Gas,
+    maxTxDAGas,
   }: {
     l1ChainId: number;
     rollupVersion: number;
     setupAllowList: AllowedElement[];
     gasFees: GasFees;
     skipFeeEnforcement?: boolean;
+    isSimulation?: boolean;
     timestamp: UInt64;
     blockNumber: BlockNumber;
     txsPermitted: boolean;
-    rollupManaLimit: number;
-    maxBlockL2Gas?: number;
-    maxBlockDAGas?: number;
+    maxTxL2Gas?: number;
+    maxTxDAGas?: number;
   },
   bindings?: LoggerBindings,
 ): TxValidator<Tx> {
@@ -339,13 +339,19 @@ export function createTxValidatorForAcceptingTxsOverRPC(
     new ContractInstanceTxValidator(bindings),
   ];
 
+  // Declared gas-limit admission is not fee enforcement, so it runs even when fees are skipped, but it is
+  // skipped during simulation: gas estimation submits intentionally-inflated `forEstimation` limits (above
+  // the per-tx max) and the wallet clamps the real tx to the admission limit afterward, so enforcing the
+  // limit on the estimation tx would reject a valid estimation. The fee-balance check below stays behind
+  // `skipFeeEnforcement`, and GasTxValidator is constructed without the limit opts so it does not re-run
+  // this same check.
+  if (!isSimulation) {
+    validators.push(new GasLimitsValidator<Tx>({ maxTxL2Gas, maxTxDAGas, bindings }));
+  }
+
   if (!skipFeeEnforcement) {
     validators.push(
-      new GasTxValidator(new DatabasePublicStateSource(db), ProtocolContractAddress.FeeJuice, gasFees, bindings, {
-        rollupManaLimit,
-        maxBlockL2Gas,
-        maxBlockDAGas,
-      }),
+      new GasTxValidator(new DatabasePublicStateSource(db), ProtocolContractAddress.FeeJuice, gasFees, bindings),
     );
   }
 
@@ -431,7 +437,7 @@ export async function createTxValidatorForTransactionsEnteringPendingTxPool(
   worldStateSynchronizer: WorldStateSynchronizer,
   timestamp: bigint,
   blockNumber: BlockNumber,
-  gasLimitOpts: { rollupManaLimit?: number; maxBlockL2Gas?: number; maxBlockDAGas?: number },
+  gasLimitOpts: { maxTxL2Gas?: number; maxTxDAGas?: number },
   gasFees: GasFees,
   bindings?: LoggerBindings,
 ): Promise<TxValidator<TxMetaData>> {

package/src/msg_validators/tx_validator/gas_validator.ts

@@ -1,6 +1,6 @@
 import {
-  MAX_PROCESSABLE_DA_GAS_PER_CHECKPOINT,
   MAX_PROCESSABLE_L2_GAS,
+  MAX_TX_DA_GAS,
   PRIVATE_TX_L2_GAS_OVERHEAD,
   PUBLIC_TX_L2_GAS_OVERHEAD,
   TX_DA_GAS_OVERHEAD,
@@ -64,22 +64,21 @@ export class GasLimitsValidator<T extends HasGasLimitData> implements TxValidato
   #log: Logger;
   #effectiveMaxL2Gas: number;
   #effectiveMaxDAGas: number;
-  #rollupManaLimit: number;
-  #maxBlockL2Gas: number;
-  #maxBlockDAGas: number;
 
-  constructor(opts?: {
-    rollupManaLimit?: number;
-    maxBlockL2Gas?: number;
-    maxBlockDAGas?: number;
-    bindings?: LoggerBindings;
-  }) {
+  /**
+   * @param maxTxL2Gas - The network admission limit on L2 gas a single tx may declare (the per-block mana
+   * allocation, see {@link computeNetworkTxGasLimits}). Defaults to the per-tx protocol maximum, so callers
+   * that pass nothing (e.g. block building) enforce only the protocol ceiling.
+   * @param maxTxDAGas - The network admission limit on DA gas a single tx may declare. Defaults to the
+   * per-tx protocol maximum {@link MAX_TX_DA_GAS}.
+   */
+  constructor(opts?: { maxTxL2Gas?: number; maxTxDAGas?: number; bindings?: LoggerBindings }) {
     this.#log = createLogger('sequencer:tx_validator:tx_gas', opts?.bindings);
-    this.#rollupManaLimit = opts?.rollupManaLimit ?? Infinity;
-    this.#maxBlockL2Gas = opts?.maxBlockL2Gas ?? Infinity;
-    this.#maxBlockDAGas = opts?.maxBlockDAGas ?? Infinity;
-    this.#effectiveMaxL2Gas = Math.min(MAX_PROCESSABLE_L2_GAS, this.#rollupManaLimit, this.#maxBlockL2Gas);
-    this.#effectiveMaxDAGas = Math.min(MAX_PROCESSABLE_DA_GAS_PER_CHECKPOINT, this.#maxBlockDAGas);
+    // The passed limits are network admission limits; clamp to the per-tx protocol maxima as a hard ceiling.
+    // MAX_TX_DA_GAS bounds DA by what a single tx can actually post to a blob; declaring more is meaningless
+    // and would let a tx reserve checkpoint/block DA budget during proposal building it can't use.
+    this.#effectiveMaxL2Gas = Math.min(MAX_PROCESSABLE_L2_GAS, opts?.maxTxL2Gas ?? Infinity);
+    this.#effectiveMaxDAGas = Math.min(MAX_TX_DA_GAS, opts?.maxTxDAGas ?? Infinity);
   }
 
   validateTx(tx: T): Promise<TxValidationResult> {
@@ -111,8 +110,6 @@ export class GasLimitsValidator<T extends HasGasLimitData> implements TxValidato
       this.#log.verbose(`Rejecting transaction due to the L2 gas limit being higher than the effective maximum`, {
         gasLimits,
         effectiveMaxL2Gas: this.#effectiveMaxL2Gas,
-        rollupManaLimit: this.#rollupManaLimit,
-        maxBlockL2Gas: this.#maxBlockL2Gas,
       });
       return {
         result: 'invalid',
@@ -124,7 +121,6 @@ export class GasLimitsValidator<T extends HasGasLimitData> implements TxValidato
       this.#log.verbose(`Rejecting transaction due to the DA gas limit being higher than the effective maximum`, {
         gasLimits,
         effectiveMaxDAGas: this.#effectiveMaxDAGas,
-        maxBlockDAGas: this.#maxBlockDAGas,
       });
       return {
         result: 'invalid',
@@ -201,14 +197,14 @@ export class GasTxValidator implements TxValidator<Tx> {
   #publicDataSource: PublicStateSource;
   #feeJuiceAddress: AztecAddress;
   #gasFees: GasFees;
-  #gasLimitOpts?: { rollupManaLimit?: number; maxBlockL2Gas?: number; maxBlockDAGas?: number };
+  #gasLimitOpts?: { maxTxL2Gas?: number; maxTxDAGas?: number };
 
   constructor(
     publicDataSource: PublicStateSource,
     feeJuiceAddress: AztecAddress,
     gasFees: GasFees,
     private bindings?: LoggerBindings,
-    opts?: { rollupManaLimit?: number; maxBlockL2Gas?: number; maxBlockDAGas?: number },
+    opts?: { maxTxL2Gas?: number; maxTxDAGas?: number },
   ) {
     this.#log = createLogger('sequencer:tx_validator:tx_gas', bindings);
     this.#publicDataSource = publicDataSource;

package/src/msg_validators/tx_validator/phases_validator.ts

@@ -97,7 +97,7 @@ export class PhasesTxValidator implements TxValidator<Tx> {
           }
           if (
             entry.rejectNullMsgSender &&
-            publicCall.request.msgSender.equals(AztecAddress.fromBigInt(NULL_MSG_SENDER_CONTRACT_ADDRESS))
+            publicCall.request.msgSender.equals(AztecAddress.fromBigIntUnsafe(NULL_MSG_SENDER_CONTRACT_ADDRESS))
           ) {
             return TX_ERROR_SETUP_NULL_MSG_SENDER;
           }
@@ -130,7 +130,7 @@ export class PhasesTxValidator implements TxValidator<Tx> {
         }
         if (
           entry.rejectNullMsgSender &&
-          publicCall.request.msgSender.equals(AztecAddress.fromBigInt(NULL_MSG_SENDER_CONTRACT_ADDRESS))
+          publicCall.request.msgSender.equals(AztecAddress.fromBigIntUnsafe(NULL_MSG_SENDER_CONTRACT_ADDRESS))
         ) {
           return TX_ERROR_SETUP_NULL_MSG_SENDER;
         }

package/src/services/discv5/discV5_service.ts

@@ -1,5 +1,7 @@
 import { createLogger } from '@aztec/foundation/log';
 import { sleep } from '@aztec/foundation/sleep';
+import { DateProvider } from '@aztec/foundation/timer';
+import type { AztecAsyncKVStore } from '@aztec/kv-store';
 import { type ComponentsVersions, checkCompressedComponentVersion } from '@aztec/stdlib/versioning';
 import { OtelMetricsAdapter, type TelemetryClient, getTelemetryClient } from '@aztec/telemetry-client';
 
@@ -14,9 +16,13 @@ import { createNodeENR } from '../../enr/generate-enr.js';
 import { AZTEC_ENR_KEY, Discv5Event, PeerEvent } from '../../types/index.js';
 import { convertToMultiaddr } from '../../util.js';
 import { type PeerDiscoveryService, PeerDiscoveryState } from '../service.js';
+import { PersistedEnrStore } from './persisted_enr_store.js';
 
 const delayBeforeStart = 2000; // 2sec
 
+/** Upper bound on persisted peer ENRs, to keep the store bounded as peers churn. */
+const MAX_PERSISTED_PEER_ENRS = 100;
+
 /**
  * Peer discovery service using Discv5.
  */
@@ -35,14 +41,19 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
   private bootstrapNodePeerIds: PeerId[] = [];
   public bootstrapNodeEnrs: ENR[] = [];
   private trustedPeerEnrs: ENR[] = [];
+  /** Node IDs of all config-provided peers (bootstrap, trusted, private); these are never persisted. */
+  private readonly configProvidedNodeIds: Set<string>;
 
   private startTime = 0;
 
   private currentIp: string | undefined;
 
+  /** Persistent store of discovered peer ENRs, used to re-seed discovery after a restart. */
+  private readonly persistedEnrs?: PersistedEnrStore;
+
   private handlers = {
     onMultiaddrUpdated: this.onMultiaddrUpdated.bind(this),
-    onDiscovered: this.onDiscovered.bind(this),
+    onPeerDiscovered: this.onPeerDiscovered.bind(this),
     onEnrAdded: this.onEnrAdded.bind(this),
   };
 
@@ -52,16 +63,27 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
     private readonly packageVersion: string,
     telemetry: TelemetryClient = getTelemetryClient(),
     private logger = createLogger('p2p:discv5_service'),
+    store?: AztecAsyncKVStore,
     configOverrides: Partial<IDiscv5CreateOptions> = {},
+    private readonly dateProvider: DateProvider = new DateProvider(),
   ) {
     super();
 
+    this.persistedEnrs = store
+      ? new PersistedEnrStore(store, MAX_PERSISTED_PEER_ENRS, createLogger(`${this.logger.module}:enr-store`))
+      : undefined;
+
     const { p2pIp, p2pPort, p2pBroadcastPort, bootstrapNodes, trustedPeers, privatePeers } = config;
 
     this.currentIp = p2pIp;
     this.bootstrapNodeEnrs = bootstrapNodes.map(x => ENR.decodeTxt(x));
     const privatePeerEnrs = new Set(privatePeers);
     this.trustedPeerEnrs = trustedPeers.filter(x => !privatePeerEnrs.has(x)).map(x => ENR.decodeTxt(x));
+    // Peers supplied via config are re-injected from config on every start, so they must never end up
+    // in the persisted (discovered-peer) store — private peers especially must not be written there.
+    this.configProvidedNodeIds = new Set(
+      [...bootstrapNodes, ...trustedPeers, ...privatePeers].map(x => ENR.decodeTxt(x).nodeId),
+    );
 
     // If no overridden broadcast port is provided, use the p2p port as the broadcast port
     if (!p2pBroadcastPort) {
@@ -126,7 +148,7 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
       }
     };
 
-    this.discv5.on(Discv5Event.DISCOVERED, this.handlers.onDiscovered);
+    this.discv5.on(Discv5Event.DISCOVERED, this.handlers.onPeerDiscovered);
     this.discv5.on(Discv5Event.ENR_ADDED, this.handlers.onEnrAdded);
     this.discv5.on(Discv5Event.MULTIADDR_UPDATED, this.handlers.onMultiaddrUpdated);
   }
@@ -168,7 +190,7 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
     }
     this.logger.debug('Starting DiscV5');
     await this.discv5.start();
-    this.startTime = Date.now();
+    this.startTime = this.dateProvider.now();
 
     const enrUpdateEnabled = this.config.queryForIp || !this.config.p2pIp;
     this.logger.info(`DiscV5 service started`, {
@@ -220,6 +242,26 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
         this.discv5.addEnr(enr);
       }
     }
+
+    // Re-seed discovery from peers persisted on previous runs. This lets a node rejoin the network
+    // after a restart even when no bootstrap node is reachable: discv5 has no on-disk routing table,
+    // so without this its DHT would start empty and rediscovery would depend on inbound dials alone.
+    if (this.persistedEnrs) {
+      // Drop peers that are now config-provided (re-injected above) or fail version checks.
+      const enrs = await this.persistedEnrs.load(
+        enr => this.validateEnr(enr) && !this.configProvidedNodeIds.has(enr.nodeId),
+      );
+      for (const enr of enrs) {
+        try {
+          this.discv5.addEnr(enr);
+        } catch (err) {
+          this.logger.debug(`Error re-seeding persisted ENR ${enr.nodeId}`, err);
+        }
+      }
+      if (enrs.length > 0) {
+        this.logger.info(`Re-seeded discovery with ${enrs.length} persisted peer ENRs`);
+      }
+    }
   }
 
   public async runRandomNodesQuery(): Promise<void> {
@@ -229,8 +271,8 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
 
     // First, wait some time before starting the peer discovery
     // reference: https://github.com/ChainSafe/lodestar/issues/3423
-    const msSinceStart = Date.now() - this.startTime;
-    if (Date.now() - this.startTime <= delayBeforeStart) {
+    const msSinceStart = this.dateProvider.now() - this.startTime;
+    if (this.dateProvider.now() - this.startTime <= delayBeforeStart) {
       await sleep(delayBeforeStart - msSinceStart);
     }
 
@@ -265,7 +307,7 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
     if (this.currentState !== PeerDiscoveryState.RUNNING) {
       return;
     }
-    await this.discv5.off(Discv5Event.DISCOVERED, this.handlers.onDiscovered);
+    await this.discv5.off(Discv5Event.DISCOVERED, this.handlers.onPeerDiscovered);
     await this.discv5.off(Discv5Event.ENR_ADDED, this.handlers.onEnrAdded);
     await this.discv5.off(Discv5Event.MULTIADDR_UPDATED, this.handlers.onMultiaddrUpdated);
 
@@ -275,12 +317,38 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
   }
 
   private async onEnrAdded(enr: ENR) {
-    const multiAddrTcp = await enr.getFullMultiaddr('tcp');
-    const multiAddrUdp = await enr.getFullMultiaddr('udp');
-    this.logger.debug(`Added ENR ${enr.encodeTxt()}`, { multiAddrTcp, multiAddrUdp, nodeId: enr.nodeId });
+    try {
+      const multiAddrTcp = await enr.getFullMultiaddr('tcp');
+      const multiAddrUdp = await enr.getFullMultiaddr('udp');
+      this.logger.debug(`Added ENR ${enr.encodeTxt()}`, { multiAddrTcp, multiAddrUdp, nodeId: enr.nodeId });
+      // A peer just entered the routing table — persist it so we can re-seed discovery after a restart.
+      if (this.persistedEnrs && this.shouldPersist(enr)) {
+        await this.persistedEnrs.persist(enr);
+      }
+      this.onDiscovered(enr);
+    } catch (err) {
+      // A malformed ENR address field (e.g. a 3-byte TCP port) makes @nethermindeth/enr throw while
+      // parsing the multiaddr. This is an async event listener, so an unhandled rejection would crash
+      // the process — catch, log, and drop the ENR instead.
+      this.logger.warn(`Dropping ENR with unparseable address`, { nodeId: enr.nodeId, err });
+    }
+  }
+
+  private async onPeerDiscovered(enr: ENR) {
+    // discv5 updates an existing routing-table entry on an ENR sequence bump without emitting enrAdded,
+    // so DISCOVERED is our only signal that a peer we already track may have changed address. Refresh
+    // the persisted copy (a no-op for peers we don't already store) so we don't keep dialing a stale ENR.
+    if (this.persistedEnrs && this.shouldPersist(enr)) {
+      await this.persistedEnrs.refresh(enr);
+    }
     this.onDiscovered(enr);
   }
 
+  /** Whether an ENR belongs in the persisted store: a validated, non-config peer that isn't ourselves. */
+  private shouldPersist(enr: ENR): boolean {
+    return !this.configProvidedNodeIds.has(enr.nodeId) && enr.nodeId !== this.enr.nodeId && this.validateEnr(enr);
+  }
+
   private isOurBootnode(enr: ENR) {
     return this.bootstrapNodeEnrs.some(x => x.nodeId === enr.nodeId);
   }
@@ -314,6 +382,17 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
       return false;
     }
 
+    // A malformed TCP field (e.g. a non-2-byte port) makes @nethermindeth/enr throw while building the
+    // multiaddr. Reject such an ENR here so it's never emitted as a full peer or re-parsed by an
+    // unguarded listener (which would crash the process). A missing TCP addr is allowed — those peers
+    // are simply skipped at dial time.
+    try {
+      enr.getLocationMultiaddr('tcp');
+    } catch (err) {
+      this.logger.debug(`Peer node ${enr.nodeId} has an unparseable TCP address`, { err });
+      return false;
+    }
+
     // And check it has the correct version
     let compressedVersion;
     try {