@aztec/p2p 0.0.1-commit.343b43af6 → 0.0.1-commit.350e0a4d

package/dest/mem_pools/tx_pool_v2/tx_pool_v2_impl.js

@@ -1,4 +1,5 @@
-import { BlockNumber } from '@aztec/foundation/branded-types';
+import { BlockNumber, SlotNumber } from '@aztec/foundation/branded-types';
+import { FifoSet } from '@aztec/foundation/fifo-set';
 import { ProtocolContractAddress } from '@aztec/protocol-contracts';
 import { computeFeePayerBalanceStorageSlot } from '@aztec/protocol-contracts/fee-juice';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
@@ -6,11 +7,16 @@ import { DatabasePublicStateSource } from '@aztec/stdlib/trees';
 import { Tx, TxHash } from '@aztec/stdlib/tx';
 import { TxArchive } from './archive/index.js';
 import { DeletedPool } from './deleted_pool.js';
-import { EvictionManager, FeePayerBalanceEvictionRule, FeePayerBalancePreAddRule, InvalidTxsAfterMiningRule, InvalidTxsAfterReorgRule, LowPriorityEvictionRule, LowPriorityPreAddRule, NullifierConflictRule, TxPoolRejectionCode } from './eviction/index.js';
+import { EvictionManager, FeePayerBalanceEvictionRule, FeePayerBalancePreAddRule, InsufficientFeePerGasEvictionRule, InvalidTxsAfterMiningRule, InvalidTxsAfterReorgRule, LowPriorityEvictionRule, LowPriorityPreAddRule, NullifierConflictRule, TxPoolRejectionCode } from './eviction/index.js';
 import { TxPoolV2Instrumentation } from './instrumentation.js';
 import { DEFAULT_TX_POOL_V2_CONFIG } from './interfaces.js';
 import { buildTxMetaData, checkNullifierConflict } from './tx_metadata.js';
 import { TxPoolIndices } from './tx_pool_indices.js';
+/**
+ * Maximum number of full transactions to load into memory at once when finalizing a block.
+ * Bounds peak memory while archiving and hard-deleting mined txs (~23k txs/epoch at 10 TPS would
+ * otherwise OOM the node).
+ */ const FINALIZE_BLOCK_CHUNK_SIZE = 100;
 /**
  * Implementation of TxPoolV2 logic.
  *
@@ -18,11 +24,13 @@ import { TxPoolIndices } from './tx_pool_indices.js';
  */ export class TxPoolV2Impl {
     // === Persistence ===
     #store;
-    #txsDB;
+    /** Tx data without its proof. Proofs live in #proofsDB so a tx can be read without loading its proof. */ #txsDB;
+    /** Tx proofs, keyed by tx hash. Written and deleted in lockstep with #txsDB. */ #proofsDB;
     // === Dependencies ===
     #l2BlockSource;
     #worldStateSynchronizer;
     #createTxValidator;
+    #checkAllowedSetupCalls;
     // === In-Memory Indices ===
     #indices = new TxPoolIndices();
     // === Config & Services ===
@@ -32,21 +40,24 @@ import { TxPoolIndices } from './tx_pool_indices.js';
     #evictionManager;
     #dateProvider;
     #instrumentation;
-    #evictedTxHashes = new Set();
+    #evictedTxHashes;
     #log;
     #callbacks;
     constructor(store, archiveStore, deps, callbacks, telemetry, config = {}, dateProvider, log){
         this.#store = store;
         this.#txsDB = store.openMap('txs');
+        this.#proofsDB = store.openMap('tx_proofs');
         this.#l2BlockSource = deps.l2BlockSource;
         this.#worldStateSynchronizer = deps.worldStateSynchronizer;
         this.#createTxValidator = deps.createTxValidator;
+        this.#checkAllowedSetupCalls = deps.checkAllowedSetupCalls;
         this.#config = {
             ...DEFAULT_TX_POOL_V2_CONFIG,
             ...config
         };
+        this.#evictedTxHashes = FifoSet.withLimit(this.#config.evictedTxCacheSize);
         this.#archive = new TxArchive(archiveStore, this.#config.archivedTxLimit, log);
-        this.#deletedPool = new DeletedPool(store, this.#txsDB, log);
+        this.#deletedPool = new DeletedPool(store, (txHashStr)=>this.#deleteTxData(txHashStr), log);
         this.#dateProvider = dateProvider;
         this.#instrumentation = new TxPoolV2Instrumentation(telemetry, ()=>this.#indices.getTotalMetadataBytes());
         this.#log = log;
@@ -61,6 +72,7 @@ import { TxPoolIndices } from './tx_pool_indices.js';
         }));
         // Post-event eviction rules (run after events to check ALL pending txs)
         this.#evictionManager.registerRule(new InvalidTxsAfterMiningRule());
+        this.#evictionManager.registerRule(new InsufficientFeePerGasEvictionRule(deps.blockMinFeesProvider));
         this.#evictionManager.registerRule(new InvalidTxsAfterReorgRule(deps.worldStateSynchronizer));
         this.#evictionManager.registerRule(new FeePayerBalanceEvictionRule(deps.worldStateSynchronizer));
         // LowPriorityEvictionRule handles cases where txs become pending via prepareForSlot (unprotect)
@@ -81,30 +93,63 @@ import { TxPoolIndices } from './tx_pool_indices.js';
    */ async hydrateFromDatabase() {
         // Step 0: Hydrate deleted pool state
         await this.#deletedPool.hydrateFromDatabase();
-        // Step 1: Load all transactions from DB (excluding soft-deleted)
-        const { loaded, errors: deserializationErrors } = await this.#loadAllTxsFromDb();
-        // Step 2: Check mined status for each tx
-        await this.#markMinedStatusBatch(loaded.map((l)=>l.meta));
-        // Step 3: Partition by mined status
-        const mined = [];
-        const nonMined = [];
-        for (const entry of loaded){
-            if (entry.meta.minedL2BlockId !== undefined) {
-                mined.push(entry.meta);
+        // Step 1: Stream txs from DB, building metadata and mined status one at a time.
+        const minedMetas = [];
+        const pendingMetas = [];
+        const deserializationErrors = [];
+        for await (const [txHashStr, buffer] of this.#txsDB.entriesAsync()){
+            // Skip soft-deleted transactions - they stay in DB but not in indices
+            if (this.#deletedPool.isSoftDeleted(txHashStr)) {
+                continue;
+            }
+            let meta;
+            let txEffect;
+            try {
+                const tx = Tx.fromBuffer(buffer);
+                // Resolve allowed-setup-calls and the tx effect concurrently
+                // getTxEffect failures are non-fatal (we just treat the tx as not-yet-mined), so
+                // its rejection is swallowed before the Promise.all so it can't fail-fast the batch.
+                const txEffectPromise = this.#l2BlockSource.getTxEffect(tx.getTxHash()).catch((err)=>{
+                    this.#log.warn(`Failed to check mined status for tx ${txHashStr}`, {
+                        err
+                    });
+                    return undefined;
+                });
+                const [allowedSetupCalls, fetchedTxEffect] = await Promise.all([
+                    this.#checkAllowedSetupCalls(tx),
+                    txEffectPromise
+                ]);
+                meta = await buildTxMetaData(tx, allowedSetupCalls);
+                txEffect = fetchedTxEffect;
+            } catch (err) {
+                this.#log.warn(`Failed to deserialize tx ${txHashStr}, deleting`, {
+                    err
+                });
+                deserializationErrors.push(txHashStr);
+                continue;
+            }
+            if (txEffect) {
+                meta.minedL2BlockId = {
+                    number: txEffect.l2BlockNumber,
+                    hash: txEffect.l2BlockHash.toString()
+                };
+            }
+            if (meta.minedL2BlockId !== undefined) {
+                minedMetas.push(meta);
             } else {
-                nonMined.push(entry);
+                pendingMetas.push(meta);
             }
         }
-        // Step 4: Validate non-mined transactions
-        const { valid, invalid } = await this.#revalidateMetadata(nonMined.map((e)=>e.meta), 'on startup');
-        // Step 5: Populate mined indices (these don't need conflict resolution)
-        for (const meta of mined){
+        // Step 2: Validate non-mined transactions
+        const { valid, invalid } = await this.#revalidateMetadata(pendingMetas, 'on startup');
+        // Step 3: Populate mined indices (these don't need conflict resolution)
+        for (const meta of minedMetas){
             this.#indices.addMined(meta);
         }
-        // Step 6: Rebuild pending pool by running pre-add rules for each tx
+        // Step 4: Rebuild pending pool by running pre-add rules for each tx
         // This resolves nullifier conflicts, fee payer balance issues, and pool size limits
         const { rejected } = await this.#rebuildPendingPool(valid);
-        // Step 7: Delete invalid and rejected txs from DB only (indices were never populated for these)
+        // Step 5: Delete invalid and rejected txs from DB only (indices were never populated for these)
         const toDelete = [
             ...deserializationErrors,
             ...invalid,
@@ -115,7 +160,7 @@ import { TxPoolIndices } from './tx_pool_indices.js';
         }
         await this.#store.transactionAsync(async ()=>{
             for (const txHashStr of toDelete){
-                await this.#txsDB.delete(txHashStr);
+                await this.#deleteTxData(txHashStr);
             }
         });
         this.#log.info(`Deleted ${toDelete.length} invalid/rejected transactions on startup`, {
@@ -295,23 +340,27 @@ import { TxPoolIndices } from './tx_pool_indices.js';
     }
     async addProtectedTxs(txs, block, opts) {
         const slotNumber = block.globalVariables.slotNumber;
+        // Precompute setup-call allow-list flags outside the store transaction
+        const allowedFlags = await Promise.all(txs.map((tx)=>this.#checkAllowedSetupCalls(tx)));
         await this.#store.transactionAsync(async ()=>{
-            for (const tx of txs){
+            for(let i = 0; i < txs.length; i++){
+                const tx = txs[i];
                 const txHash = tx.getTxHash();
                 const txHashStr = txHash.toString();
                 const isNew = !this.#indices.has(txHashStr);
                 const minedBlockId = await this.#getMinedBlockId(txHash);
                 if (isNew) {
+                    const meta = await buildTxMetaData(tx, allowedFlags[i]);
                     // New tx - add as mined or protected (callback emitted by #addTx)
                     if (minedBlockId) {
                         await this.#addTx(tx, {
                             mined: minedBlockId
-                        }, opts);
+                        }, opts, meta);
                         this.#indices.setProtection(txHashStr, slotNumber);
                     } else {
                         await this.#addTx(tx, {
                             protected: slotNumber
-                        }, opts);
+                        }, opts, meta);
                     }
                 } else {
                     // Existing tx - update protection and mined status
@@ -336,10 +385,11 @@ import { TxPoolIndices } from './tx_pool_indices.js';
                     // Update protection for existing tx
                     this.#indices.updateProtection(txHashStr, slotNumber);
                 } else if (this.#deletedPool.isSoftDeleted(txHashStr)) {
-                    // Resurrect soft-deleted tx as protected
+                    // Resurrect soft-deleted tx as protected. Load the proof too: #addTx rewrites both entries, so re-adding
+                    // a proofless tx would wipe the stored proof.
                     const buffer = await this.#txsDB.getAsync(txHashStr);
                     if (buffer) {
-                        const tx = Tx.fromBuffer(buffer);
+                        const tx = await this.#loadTxWithProof(txHashStr, buffer);
                         await this.#addTx(tx, {
                             protected: slotNumber
                         });
@@ -419,7 +469,13 @@ import { TxPoolIndices } from './tx_pool_indices.js';
             await this.#evictionManager.evictAfterNewBlock(block.header, nullifiers, feePayers);
         });
         if (found.length > 0) {
-            this.#callbacks.onTxsMined(found.map((m)=>m.txHash));
+            // receivedAt is 0 for txs hydrated from the DB on restart (true receive time lost) — leave
+            // their delay undefined so the metric isn't polluted by epoch-sized values.
+            const now = this.#dateProvider.now();
+            this.#callbacks.onTxsMined(found.map((m)=>({
+                    txHash: m.txHash,
+                    minedDelayMs: m.receivedAt > 0 ? now - m.receivedAt : undefined
+                })));
         }
         this.#log.info(`Marked ${found.length} txs as mined in block ${blockId.number}`);
     }
@@ -438,23 +494,50 @@ import { TxPoolIndices } from './tx_pool_indices.js';
                 return;
             }
             this.#log.info(`Preparing for slot ${slotNumber}: unprotecting ${txsToRestore.length} txs`);
-            // Step 4: Validate for pending pool
-            const { valid, invalid } = await this.#revalidateMetadata(txsToRestore, 'during prepareForSlot');
-            // Step 5: Resolve nullifier conflicts and add winners to pending indices
-            const { added, toEvict } = this.#applyNullifierConflictResolution(valid);
-            // Step 6: Delete invalid txs and evict conflict losers
-            await this.#deleteTxsBatch(invalid);
-            await this.#evictTxs(toEvict, 'NullifierConflict');
-            // Step 7: Run eviction rules (enforce pool size limit)
-            if (added.length > 0) {
-                const feePayers = added.map((meta)=>meta.feePayer);
-                const uniqueFeePayers = new Set(feePayers);
-                await this.#evictionManager.evictAfterNewTxs(added.map((m)=>m.txHash), [
-                    ...uniqueFeePayers
-                ]);
+            await this.#restoreUnprotectedToPending(txsToRestore, 'during prepareForSlot');
+        });
+    }
+    async unprotectTxs(txHashes, slotNumber) {
+        const hashStrs = txHashes.map((h)=>h.toString());
+        await this.#store.transactionAsync(async ()=>{
+            // Only release entries still recorded at this exact slot. A tx that another, still-live proposal
+            // raised to a higher slot via updateProtection must keep that protection. Mined txs have no
+            // protection entry and so are never matched here.
+            const matching = this.#indices.findProtectedTxsAtSlot(hashStrs, slotNumber);
+            if (matching.length === 0) {
+                this.#log.debug(`Unprotecting txs for slot ${slotNumber}: no matching protections to release`);
+                return;
             }
+            this.#indices.clearProtection(matching);
+            const txsToRestore = this.#indices.filterRestorable(matching);
+            if (txsToRestore.length === 0) {
+                return;
+            }
+            this.#log.info(`Unprotecting ${txsToRestore.length} txs from failed proposal at slot ${slotNumber}`);
+            await this.#restoreUnprotectedToPending(txsToRestore, 'during unprotectTxs');
         });
     }
+    /**
+   * Returns just-unprotected txs to the pending pool: revalidates them, resolves nullifier
+   * conflicts, deletes losers, then enforces the pool size limit. Must run inside a store
+   * transaction; callers clear the protection entries before invoking.
+   */ async #restoreUnprotectedToPending(txsToRestore, context) {
+        // Step 1: Validate for pending pool
+        const { valid, invalid } = await this.#revalidateMetadata(txsToRestore, context);
+        // Step 2: Resolve nullifier conflicts and add winners to pending indices
+        const { added, toEvict } = this.#applyNullifierConflictResolution(valid);
+        // Step 3: Delete invalid txs and evict conflict losers
+        await this.#deleteTxsBatch(invalid);
+        await this.#evictTxs(toEvict, 'NullifierConflict');
+        // Step 4: Run eviction rules (enforce pool size limit)
+        if (added.length > 0) {
+            const feePayers = added.map((meta)=>meta.feePayer);
+            const uniqueFeePayers = new Set(feePayers);
+            await this.#evictionManager.evictAfterNewTxs(added.map((m)=>m.txHash), [
+                ...uniqueFeePayers
+            ]);
+        }
+    }
     async handlePrunedBlocks(latestBlock, options) {
         // Step 1: Find transactions mined after the prune point
         const txsToUnmine = this.#indices.findTxsMinedAfter(latestBlock.number);
@@ -511,47 +594,101 @@ import { TxPoolIndices } from './tx_pool_indices.js';
     }
     async handleFinalizedBlock(block) {
         const blockNumber = block.globalVariables.blockNumber;
-        // Step 1: Find mined txs at or before finalized block
-        const minedTxsToFinalize = this.#indices.findTxsMinedAtOrBefore(blockNumber);
-        await this.#store.transactionAsync(async ()=>{
-            // Step 2: Collect mined txs for archiving (before deletion)
-            const txsToArchive = [];
-            if (this.#archive.isEnabled()) {
-                for (const txHashStr of minedTxsToFinalize){
+        // Hold finalized txs for a configurable margin behind the finalized tip so a prover still
+        // proving an epoch with already-finalized blocks isn't starved of its txs. 0 deletes at the finalized tip.
+        const cutoffBlock = await this.#finalizationCutoffBlock(block);
+        // Step 1: Find mined txs at or before the cutoff block
+        const minedTxsToFinalize = this.#indices.findTxsMinedAtOrBefore(cutoffBlock);
+        // Step 2: Archive in chunks if archiving is enabled. Hydrating an entire epoch's worth of
+        // mined txs at once would OOM under load. When archiving is disabled there is no need to hydrate the txs at all.
+        if (this.#archive.isEnabled()) {
+            for(let i = 0; i < minedTxsToFinalize.length; i += FINALIZE_BLOCK_CHUNK_SIZE){
+                const chunk = minedTxsToFinalize.slice(i, i + FINALIZE_BLOCK_CHUNK_SIZE);
+                const txsToArchive = [];
+                for (const txHashStr of chunk){
                     const buffer = await this.#txsDB.getAsync(txHashStr);
                     if (buffer) {
                         txsToArchive.push(Tx.fromBuffer(buffer));
                     }
                 }
+                if (txsToArchive.length > 0) {
+                    await this.#archive.archiveTxs(txsToArchive);
+                }
             }
-            // Step 3: Delete mined txs from active pool
+        }
+        // Step 3: Delete mined txs from the active pool and finalize soft-deleted txs in one
+        // transaction. Only tx hashes are touched here, so memory is bounded and atomicity is preserved.
+        await this.#store.transactionAsync(async ()=>{
             await this.#deleteTxsBatch(minedTxsToFinalize);
-            // Step 4: Finalize soft-deleted txs
-            await this.#deletedPool.finalizeBlock(blockNumber);
-            // Step 5: Archive mined txs
-            if (txsToArchive.length > 0) {
-                await this.#archive.archiveTxs(txsToArchive);
-            }
+            await this.#deletedPool.finalizeBlock(cutoffBlock);
         });
         if (minedTxsToFinalize.length > 0) {
-            this.#log.info(`Finalized ${minedTxsToFinalize.length} mined txs from blocks up to ${blockNumber}`, {
-                txHashes: minedTxsToFinalize
+            this.#log.info(`Finalized ${minedTxsToFinalize.length} mined txs from blocks up to ${cutoffBlock}`, {
+                txHashes: minedTxsToFinalize,
+                finalizedBlockNumber: blockNumber,
+                cutoffBlock
             });
         }
     }
+    /**
+   * Resolves the block up to which finalized txs may be deleted, given `keepFinalizedTxsForSlots`.
+   * With a margin of 0 this is just the finalized block. Otherwise we keep txs whose block is within
+   * the margin (in slots) of the finalized tip: take the target slot `finalizedSlot - margin`, find the
+   * latest checkpoint at or before it with a single reverse range query (`limit: 1`), and use that
+   * checkpoint's last block as the cutoff. This rounds to a checkpoint boundary, so it can retain slightly
+   * more than the configured margin but never less, and never deletes past the finalized block.
+   */ async #finalizationCutoffBlock(block) {
+        const keepSlots = this.#config.keepFinalizedTxsForSlots;
+        if (keepSlots <= 0) {
+            return block.globalVariables.blockNumber;
+        }
+        // The goal here really is to ensure we keep transactions long enough for them to be proven.
+        // So we could be smart and calculate the number of slots until the end of the proof submission window.
+        // Our approach here is a lot simpler however and we just keep transactions for the configured number
+        // of slots past L1 finalisation. This means we may keep transactions in the mined pool for longer
+        // than strictly necessary.
+        const targetSlot = block.getSlot() - keepSlots;
+        if (targetSlot < 0) {
+            // The margin reaches past genesis: keep everything.
+            return BlockNumber(0);
+        }
+        const [checkpoint] = await this.#l2BlockSource.getCheckpointsData({
+            fromSlot: SlotNumber(targetSlot),
+            limit: 1,
+            reverse: true
+        });
+        // No checkpoint at or before the target slot (e.g. early chain): keep everything.
+        return checkpoint ? BlockNumber(checkpoint.startBlock + checkpoint.blockCount - 1) : BlockNumber(0);
+    }
     // === Query Methods ===
-    async getTxByHash(txHash) {
-        const buffer = await this.#txsDB.getAsync(txHash.toString());
-        return buffer ? Tx.fromBuffer(buffer) : undefined;
+    async getTxByHash(txHash, opts = {}) {
+        const txHashStr = txHash.toString();
+        const buffer = await this.#txsDB.getAsync(txHashStr);
+        if (!buffer) {
+            return undefined;
+        }
+        return opts.includeProof === false ? Tx.fromBuffer(buffer) : this.#loadTxWithProof(txHashStr, buffer);
     }
-    async getTxsByHash(txHashes) {
+    async getTxsByHash(txHashes, opts = {}) {
         const results = [];
         for (const h of txHashes){
-            const buffer = await this.#txsDB.getAsync(h.toString());
-            results.push(buffer ? Tx.fromBuffer(buffer) : undefined);
+            results.push(await this.getTxByHash(h, opts));
         }
         return results;
     }
+    /** Deserializes a tx blob loaded from #txsDB together with its separately-stored proof. */ async #loadTxWithProof(txHashStr, buffer) {
+        const proofBuffer = await this.#proofsDB.getAsync(txHashStr);
+        if (!proofBuffer) {
+            // #addTx always writes a proof entry (an empty proof serializes to a 4-byte sentinel), so a missing entry
+            // means the blob/proof invariant is broken. Return the proofless tx but flag it, since a consumer that needs
+            // the proof (eg serving peers) would otherwise fail far away from the root cause.
+            this.#log.warn(`Missing stored proof for tx ${txHashStr}`, {
+                txHash: txHashStr
+            });
+            return Tx.fromBuffer(buffer);
+        }
+        return Tx.fromBuffers(buffer, proofBuffer);
+    }
     hasTxs(txHashes) {
         return txHashes.map((h)=>{
             const hashStr = h.toString();
@@ -584,6 +721,10 @@ import { TxPoolIndices } from './tx_pool_indices.js';
     getPendingTxCount() {
         return this.#indices.getPendingTxCount();
     }
+    hasEligiblePendingTxs(minCount) {
+        const maxReceivedAt = this.#dateProvider.now() - this.#config.minTxPoolAgeMs;
+        return this.#indices.hasEligiblePendingTxs(maxReceivedAt, minCount);
+    }
     getMinedTxHashes() {
         return this.#indices.getMinedTxs().map(([hash, blockId])=>[
                 TxHash.fromString(hash),
@@ -623,6 +764,9 @@ import { TxPoolIndices } from './tx_pool_indices.js';
         if (config.minTxPoolAgeMs !== undefined) {
             this.#config.minTxPoolAgeMs = config.minTxPoolAgeMs;
         }
+        if (config.keepFinalizedTxsForSlots !== undefined) {
+            this.#config.keepFinalizedTxsForSlots = config.keepFinalizedTxsForSlots;
+        }
         // Update eviction rules with new config
         this.#evictionManager.updateConfig(config);
     }
@@ -652,7 +796,8 @@ import { TxPoolIndices } from './tx_pool_indices.js';
         const txHashStr = tx.getTxHash().toString();
         const meta = precomputedMeta ?? await buildTxMetaData(tx);
         meta.receivedAt = this.#dateProvider.now();
-        await this.#txsDB.set(txHashStr, tx.toBuffer());
+        await this.#txsDB.set(txHashStr, tx.withoutProof().toBuffer());
+        await this.#proofsDB.set(txHashStr, tx.chonkProof.toBuffer());
         await this.#deletedPool.clearSoftDeleted(txHashStr);
         this.#callbacks.onTxsAdded([
             tx
@@ -688,6 +833,10 @@ import { TxPoolIndices } from './tx_pool_indices.js';
         ]);
         await this.#deletedPool.deleteTx(txHashStr);
     }
+    /** Hard-deletes a tx's stored data (tx blob and proof) from the DB. */ async #deleteTxData(txHashStr) {
+        await this.#txsDB.delete(txHashStr);
+        await this.#proofsDB.delete(txHashStr);
+    }
     /** Deletes a batch of transactions, emitting callbacks individually for each. */ async #deleteTxsBatch(txHashes) {
         for (const txHashStr of txHashes){
             await this.#deleteTx(txHashStr);
@@ -703,18 +852,10 @@ import { TxPoolIndices } from './tx_pool_indices.js';
                 txHash: txHashStr,
                 reason
             });
-            this.#addToEvictedCache(txHashStr);
+            this.#evictedTxHashes.add(txHashStr);
         }
         await this.#deleteTxsBatch(txHashes);
     }
-    /** Adds a tx hash to the bounded evicted cache, evicting the oldest entry if at capacity. */ #addToEvictedCache(txHashStr) {
-        if (this.#evictedTxHashes.size >= this.#config.evictedTxCacheSize) {
-            // FIFO eviction: remove the first (oldest) entry
-            const oldest = this.#evictedTxHashes.values().next().value;
-            this.#evictedTxHashes.delete(oldest);
-        }
-        this.#evictedTxHashes.add(txHashStr);
-    }
     // ============================================================================
     // PRIVATE HELPERS - Validation & Conflict Resolution
     // ============================================================================
@@ -795,50 +936,6 @@ import { TxPoolIndices } from './tx_pool_indices.js';
             hash: txEffect.l2BlockHash.toString()
         };
     }
-    /** Loads all transactions from the database, returning loaded txs and deserialization errors */ async #loadAllTxsFromDb() {
-        const loaded = [];
-        const errors = [];
-        for await (const [txHashStr, buffer] of this.#txsDB.entriesAsync()){
-            // Skip soft-deleted transactions - they stay in DB but not in indices
-            if (this.#deletedPool.isSoftDeleted(txHashStr)) {
-                continue;
-            }
-            try {
-                const tx = Tx.fromBuffer(buffer);
-                const meta = await buildTxMetaData(tx);
-                loaded.push({
-                    tx,
-                    meta
-                });
-            } catch (err) {
-                this.#log.warn(`Failed to deserialize tx ${txHashStr}, deleting`, {
-                    err
-                });
-                errors.push(txHashStr);
-            }
-        }
-        return {
-            loaded,
-            errors
-        };
-    }
-    /** Queries block source and marks mined status on transaction metadata */ async #markMinedStatusBatch(metas) {
-        for (const meta of metas){
-            try {
-                const txEffect = await this.#l2BlockSource.getTxEffect(TxHash.fromString(meta.txHash));
-                if (txEffect) {
-                    meta.minedL2BlockId = {
-                        number: txEffect.l2BlockNumber,
-                        hash: txEffect.l2BlockHash.toString()
-                    };
-                }
-            } catch (err) {
-                this.#log.warn(`Failed to check mined status for tx ${meta.txHash}`, {
-                    err
-                });
-            }
-        }
-    }
     /**
    * Rebuilds the pending pool by processing each tx through pre-add rules.
    * Starts with an empty pending pool and adds txs one by one, resolving conflicts.
@@ -905,7 +1002,7 @@ import { TxPoolIndices } from './tx_pool_indices.js';
             getFeePayerBalance: async (feePayer)=>{
                 const db = this.#worldStateSynchronizer.getCommitted();
                 const publicStateSource = new DatabasePublicStateSource(db);
-                const balance = await publicStateSource.storageRead(ProtocolContractAddress.FeeJuice, await computeFeePayerBalanceStorageSlot(AztecAddress.fromString(feePayer)));
+                const balance = await publicStateSource.storageRead(ProtocolContractAddress.FeeJuice, await computeFeePayerBalanceStorageSlot(AztecAddress.fromStringUnsafe(feePayer)));
                 return balance.toBigInt();
             },
             getFeePayerPendingTxs: (feePayer)=>this.#indices.getFeePayerPendingTxs(feePayer),

package/dest/msg_validators/attestation_validator/attestation_validator.d.ts

@@ -1,10 +1,17 @@
 import type { EpochCacheInterface } from '@aztec/epoch-cache';
 import { type Logger } from '@aztec/foundation/log';
-import { type CheckpointAttestation, type P2PValidator, type ValidationResult } from '@aztec/stdlib/p2p';
+import { type CheckpointAttestation, type CoordinationSignatureContext, type P2PValidator, type ValidationResult } from '@aztec/stdlib/p2p';
+import type { ConsensusTimetable } from '@aztec/stdlib/timetable';
 export declare class CheckpointAttestationValidator implements P2PValidator<CheckpointAttestation> {
     protected epochCache: EpochCacheInterface;
     protected logger: Logger;
-    constructor(epochCache: EpochCacheInterface);
+    private readonly timetable;
+    protected readonly signatureContext: CoordinationSignatureContext;
+    private readonly clockDisparityMs;
+    constructor(epochCache: EpochCacheInterface, timetable: ConsensusTimetable, opts: {
+        signatureContext: CoordinationSignatureContext;
+        clockDisparityMs: number;
+    });
     validate(message: CheckpointAttestation): Promise<ValidationResult>;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXR0ZXN0YXRpb25fdmFsaWRhdG9yLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbXNnX3ZhbGlkYXRvcnMvYXR0ZXN0YXRpb25fdmFsaWRhdG9yL2F0dGVzdGF0aW9uX3ZhbGlkYXRvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssRUFBRSxtQkFBbUIsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBRTlELE9BQU8sRUFBRSxLQUFLLE1BQU0sRUFBZ0IsTUFBTSx1QkFBdUIsQ0FBQztBQUNsRSxPQUFPLEVBQ0wsS0FBSyxxQkFBcUIsRUFDMUIsS0FBSyxZQUFZLEVBRWpCLEtBQUssZ0JBQWdCLEVBQ3RCLE1BQU0sbUJBQW1CLENBQUM7QUFJM0IscUJBQWEsOEJBQStCLFlBQVcsWUFBWSxDQUFDLHFCQUFxQixDQUFDO0lBQ3hGLFNBQVMsQ0FBQyxVQUFVLEVBQUUsbUJBQW1CLENBQUM7SUFDMUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUM7SUFFekIsWUFBWSxVQUFVLEVBQUUsbUJBQW1CLEVBRzFDO0lBRUssUUFBUSxDQUFDLE9BQU8sRUFBRSxxQkFBcUIsR0FBRyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsQ0E2RHhFO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXR0ZXN0YXRpb25fdmFsaWRhdG9yLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbXNnX3ZhbGlkYXRvcnMvYXR0ZXN0YXRpb25fdmFsaWRhdG9yL2F0dGVzdGF0aW9uX3ZhbGlkYXRvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssRUFBRSxtQkFBbUIsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBRTlELE9BQU8sRUFBRSxLQUFLLE1BQU0sRUFBZ0IsTUFBTSx1QkFBdUIsQ0FBQztBQUNsRSxPQUFPLEVBQ0wsS0FBSyxxQkFBcUIsRUFDMUIsS0FBSyw0QkFBNEIsRUFDakMsS0FBSyxZQUFZLEVBRWpCLEtBQUssZ0JBQWdCLEVBRXRCLE1BQU0sbUJBQW1CLENBQUM7QUFDM0IsT0FBTyxLQUFLLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUVsRSxxQkFBYSw4QkFBK0IsWUFBVyxZQUFZLENBQUMscUJBQXFCLENBQUM7SUFDeEYsU0FBUyxDQUFDLFVBQVUsRUFBRSxtQkFBbUIsQ0FBQztJQUMxQyxTQUFTLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQztJQUN6QixPQUFPLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBcUI7SUFDL0MsU0FBUyxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsRUFBRSw0QkFBNEIsQ0FBQztJQUNsRSxPQUFPLENBQUMsUUFBUSxDQUFDLGdCQUFnQixDQUFTO0lBRTFDLFlBQ0UsVUFBVSxFQUFFLG1CQUFtQixFQUMvQixTQUFTLEVBQUUsa0JBQWtCLEVBQzdCLElBQUksRUFBRTtRQUNKLGdCQUFnQixFQUFFLDRCQUE0QixDQUFDO1FBQy9DLGdCQUFnQixFQUFFLE1BQU0sQ0FBQztLQUMxQixFQU9GO0lBRUssUUFBUSxDQUFDLE9BQU8sRUFBRSxxQkFBcUIsR0FBRyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsQ0ErRXhFO0NBQ0YifQ==

package/dest/msg_validators/attestation_validator/attestation_validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attestation_validator.d.ts","sourceRoot":"","sources":["../../../src/msg_validators/attestation_validator/attestation_validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,KAAK,MAAM,EAAgB,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EAEjB,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAI3B,qBAAa,8BAA+B,YAAW,YAAY,CAAC,qBAAqB,CAAC;IACxF,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAC1C,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IAEzB,YAAY,UAAU,EAAE,mBAAmB,EAG1C;IAEK,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA6DxE;CACF"}
+{"version":3,"file":"attestation_validator.d.ts","sourceRoot":"","sources":["../../../src/msg_validators/attestation_validator/attestation_validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,KAAK,MAAM,EAAgB,MAAM,uBAAuB,CAAC;AAClE,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EACjC,KAAK,YAAY,EAEjB,KAAK,gBAAgB,EAEtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE,qBAAa,8BAA+B,YAAW,YAAY,CAAC,qBAAqB,CAAC;IACxF,SAAS,CAAC,UAAU,EAAE,mBAAmB,CAAC;IAC1C,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,SAAS,CAAC,QAAQ,CAAC,gBAAgB,EAAE,4BAA4B,CAAC;IAClE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAE1C,YACE,UAAU,EAAE,mBAAmB,EAC/B,SAAS,EAAE,kBAAkB,EAC7B,IAAI,EAAE;QACJ,gBAAgB,EAAE,4BAA4B,CAAC;QAC/C,gBAAgB,EAAE,MAAM,CAAC;KAC1B,EAOF;IAEK,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+ExE;CACF"}

package/dest/msg_validators/attestation_validator/attestation_validator.js

@@ -1,30 +1,53 @@
 import { NoCommitteeError } from '@aztec/ethereum/contracts';
 import { createLogger } from '@aztec/foundation/log';
-import { PeerErrorSeverity } from '@aztec/stdlib/p2p';
-import { isWithinClockTolerance } from '../clock_tolerance.js';
+import { PeerErrorSeverity, hasValidSignatureContext } from '@aztec/stdlib/p2p';
 export class CheckpointAttestationValidator {
     epochCache;
     logger;
-    constructor(epochCache){
+    timetable;
+    signatureContext;
+    clockDisparityMs;
+    constructor(epochCache, timetable, opts){
         this.epochCache = epochCache;
+        this.timetable = timetable;
+        this.signatureContext = opts.signatureContext;
+        this.clockDisparityMs = opts.clockDisparityMs;
         this.logger = createLogger('p2p:checkpoint-attestation-validator');
     }
     async validate(message) {
         const slotNumber = message.payload.header.slotNumber;
         try {
-            const { currentSlot, nextSlot } = this.epochCache.getCurrentAndNextSlot();
-            if (slotNumber !== currentSlot && slotNumber !== nextSlot) {
-                // Check if message is for previous slot and within clock tolerance
-                if (!isWithinClockTolerance(slotNumber, currentSlot, this.epochCache)) {
-                    this.logger.warn(`Checkpoint attestation slot ${slotNumber} is not current (${currentSlot}) or next (${nextSlot}) slot`);
-                    return {
-                        result: 'reject',
-                        severity: PeerErrorSeverity.HighToleranceError
-                    };
-                }
-                this.logger.debug(`Ignoring checkpoint attestation for previous slot ${slotNumber} within clock tolerance`);
+            // Cross-chain replay check: reject attestations that carry a foreign signing domain.
+            if (!hasValidSignatureContext(message.payload, this.signatureContext)) {
+                this.logger.warn(`Rejecting checkpoint attestation with foreign signature context for slot ${slotNumber}`, {
+                    chainId: message.payload.signatureContext.chainId,
+                    rollupAddress: message.payload.signatureContext.rollupAddress.toString(),
+                    expectedChainId: this.signatureContext.chainId,
+                    expectedRollupAddress: this.signatureContext.rollupAddress.toString()
+                });
                 return {
-                    result: 'ignore'
+                    result: 'reject',
+                    severity: PeerErrorSeverity.LowToleranceError
+                };
+            }
+            // Accept attestations whose explicit per-slot receive window contains the current wall-clock time.
+            // The window spans the build-frame start (attestation_receive_start) to the attestation deadline
+            // (target_slot_start + S - 2E), widened by the configured clock-disparity tolerance on both ends, so
+            // it covers the build slot, the target slot, and clock-disparity grace. This is the sole arrival
+            // gate; attestations are otherwise attributed by content, not by current/next slot.
+            const startSeconds = this.timetable.getAttestationReceiveStart(slotNumber);
+            const deadlineSeconds = this.timetable.getAttestationDeadline(slotNumber);
+            const nowMs = Number(this.epochCache.getEpochAndSlotNow().nowMs);
+            if (nowMs < startSeconds * 1000 - this.clockDisparityMs || nowMs > deadlineSeconds * 1000 + this.clockDisparityMs) {
+                this.logger.warn(`Checkpoint attestation slot ${slotNumber} is outside its receive window`, {
+                    slotNumber,
+                    nowMs,
+                    windowStartSeconds: startSeconds,
+                    windowDeadlineSeconds: deadlineSeconds
+                });
+                return {
+                    result: 'reject',
+                    severity: PeerErrorSeverity.HighToleranceError
                 };
             }
             // Verify the signature is valid