@aztec/p2p 0.0.1-commit.3469e52 → 0.0.1-commit.350e0a4d

package/src/services/reqresp/interface.ts

@@ -1,13 +1,17 @@
-import { Fr } from '@aztec/foundation/curves/bn254';
-import { L2BlockNew } from '@aztec/stdlib/block';
 import { TxArray, TxHashArray } from '@aztec/stdlib/tx';
 
 import type { PeerId } from '@libp2p/interface';
 
 import type { P2PReqRespConfig } from './config.js';
+import type { ConnectionSampler } from './connection-sampler/connection_sampler.js';
 import { AuthRequest, AuthResponse } from './protocols/auth.js';
-import { BlockTxsRequest, BlockTxsResponse } from './protocols/block_txs/block_txs_reqresp.js';
+import {
+  BlockTxsRequest,
+  BlockTxsResponse,
+  calculateBlockTxsResponseSize,
+} from './protocols/block_txs/block_txs_reqresp.js';
 import { StatusMessage } from './protocols/status.js';
+import { calculateTxResponseSize } from './protocols/tx.js';
 import type { ReqRespStatus } from './status.js';
 
 /*
@@ -17,7 +21,6 @@ export const PING_PROTOCOL = '/aztec/req/ping/1.0.0';
 export const STATUS_PROTOCOL = '/aztec/req/status/1.0.0';
 export const GOODBYE_PROTOCOL = '/aztec/req/goodbye/1.0.0';
 export const TX_REQ_PROTOCOL = '/aztec/req/tx/1.0.0';
-export const BLOCK_REQ_PROTOCOL = '/aztec/req/block/1.0.0';
 export const AUTH_PROTOCOL = '/aztec/req/auth/1.0.0';
 export const BLOCK_TXS_REQ_PROTOCOL = '/aztec/req/block_txs/1.0.0';
 
@@ -26,7 +29,6 @@ export enum ReqRespSubProtocol {
   STATUS = STATUS_PROTOCOL,
   GOODBYE = GOODBYE_PROTOCOL,
   TX = TX_REQ_PROTOCOL,
-  BLOCK = BLOCK_REQ_PROTOCOL,
   AUTH = AUTH_PROTOCOL,
   BLOCK_TXS = BLOCK_TXS_REQ_PROTOCOL,
 }
@@ -76,32 +78,28 @@ export interface ProtocolRateLimitQuota {
   globalLimit: RateLimitQuota;
 }
 
-export const noopValidator = () => Promise.resolve(true);
-
 /**
  * A type mapping from supprotocol to it's handling function
  */
 export type ReqRespSubProtocolHandlers = Record<ReqRespSubProtocol, ReqRespSubProtocolHandler>;
 
-type ResponseValidator<RequestIdentifier, Response> = (
-  request: RequestIdentifier,
-  response: Response,
-  peerId: PeerId,
-) => Promise<boolean>;
-
-export type ReqRespSubProtocolValidators = {
-  [S in ReqRespSubProtocol]: ResponseValidator<any, any>;
-};
+/**
+ * Protocols that are always allowed without authentication, even when p2pAllowOnlyValidators is enabled.
+ * These are needed for the handshake and connection management flow.
+ * All other protocols require the remote peer to be authenticated.
+ */
+export const UNAUTHENTICATED_ALLOWED_PROTOCOLS: ReadonlySet<ReqRespSubProtocol> = new Set([
+  ReqRespSubProtocol.PING,
+  ReqRespSubProtocol.STATUS,
+  ReqRespSubProtocol.AUTH,
+  ReqRespSubProtocol.GOODBYE,
+]);
 
-export const DEFAULT_SUB_PROTOCOL_VALIDATORS: ReqRespSubProtocolValidators = {
-  [ReqRespSubProtocol.PING]: noopValidator,
-  [ReqRespSubProtocol.STATUS]: noopValidator,
-  [ReqRespSubProtocol.TX]: noopValidator,
-  [ReqRespSubProtocol.GOODBYE]: noopValidator,
-  [ReqRespSubProtocol.BLOCK]: noopValidator,
-  [ReqRespSubProtocol.AUTH]: noopValidator,
-  [ReqRespSubProtocol.BLOCK_TXS]: noopValidator,
-};
+/**
+ * Callback that checks whether a peer should be rejected from req/resp data protocols.
+ * Returns true if the peer should be rejected (i.e. p2pAllowOnlyValidators is on and peer is unauthenticated).
+ */
+export type ShouldRejectPeer = (peerId: string) => boolean;
 
 /*
  * Helper class to sub-protocol validation error*/
@@ -196,10 +194,6 @@ export const subProtocolMap = {
     request: RequestableBuffer,
     response: RequestableBuffer,
   },
-  [ReqRespSubProtocol.BLOCK]: {
-    request: Fr, // block number
-    response: L2BlockNew,
-  },
   [ReqRespSubProtocol.AUTH]: {
     request: AuthRequest,
     response: AuthResponse,
@@ -210,25 +204,28 @@ export const subProtocolMap = {
   },
 };
 
+/**
+ * Type for a function that calculates the expected response size in KB for a given request.
+ */
+export type ExpectedResponseSizeCalculator = (requestBuffer: Buffer) => number;
+
+/**
+ * Map of sub-protocols to their expected response size calculators.
+ * These are used to validate that responses don't exceed expected sizes based on request parameters.
+ */
+export const subProtocolSizeCalculators: Record<ReqRespSubProtocol, ExpectedResponseSizeCalculator> = {
+  [ReqRespSubProtocol.TX]: calculateTxResponseSize,
+  [ReqRespSubProtocol.BLOCK_TXS]: calculateBlockTxsResponseSize,
+  [ReqRespSubProtocol.STATUS]: () => 1,
+  [ReqRespSubProtocol.PING]: () => 1,
+  [ReqRespSubProtocol.AUTH]: () => 1,
+  [ReqRespSubProtocol.GOODBYE]: () => 1, // No response expected, but provide minimal limit
+};
+
 export interface ReqRespInterface {
-  start(
-    subProtocolHandlers: Partial<ReqRespSubProtocolHandlers>,
-    subProtocolValidators: ReqRespSubProtocolValidators,
-  ): Promise<void>;
-  addSubProtocol(
-    subProtocol: ReqRespSubProtocol,
-    handler: ReqRespSubProtocolHandler,
-    validator?: ReqRespSubProtocolValidators[ReqRespSubProtocol],
-  ): Promise<void>;
+  start(subProtocolHandlers: Partial<ReqRespSubProtocolHandlers>): Promise<void>;
+  addSubProtocol(subProtocol: ReqRespSubProtocol, handler: ReqRespSubProtocolHandler): Promise<void>;
   stop(): Promise<void>;
-  sendBatchRequest<SubProtocol extends ReqRespSubProtocol>(
-    subProtocol: SubProtocol,
-    requests: InstanceType<SubProtocolMap[SubProtocol]['request']>[],
-    pinnedPeer: PeerId | undefined,
-    timeoutMs?: number,
-    maxPeers?: number,
-    maxRetryAttempts?: number,
-  ): Promise<InstanceType<SubProtocolMap[SubProtocol]['response']>[]>;
   sendRequestToPeer(
     peerId: PeerId,
     subProtocol: ReqRespSubProtocol,
@@ -237,4 +234,9 @@ export interface ReqRespInterface {
   ): Promise<ReqRespResponse>;
 
   updateConfig(config: Partial<P2PReqRespConfig>): void;
+
+  /** Sets the callback used to reject unauthenticated peers on gated req/resp protocols. */
+  setShouldRejectPeer(checker: ShouldRejectPeer): void;
+
+  getConnectionSampler(): Pick<ConnectionSampler, 'getPeerListSortedByConnectionCountAsc'>;
 }

package/src/services/reqresp/metrics.ts

@@ -1,7 +1,9 @@
 // Request response metrics
-import { Attributes, Metrics } from '@aztec/telemetry-client';
+import { Attributes, Metrics, createUpDownCounterWithDefault } from '@aztec/telemetry-client';
 import type { TelemetryClient, Tracer, UpDownCounter } from '@aztec/telemetry-client';
 
+import { ReqRespSubProtocol } from './interface.js';
+
 export class ReqRespMetrics {
   public readonly tracer: Tracer;
 
@@ -18,27 +20,49 @@ export class ReqRespMetrics {
     this.tracer = telemetryClient.getTracer(name);
 
     const meter = telemetryClient.getMeter(name);
-    this.sentRequests = meter.createUpDownCounter(Metrics.P2P_REQ_RESP_SENT_REQUESTS);
-    this.receivedRequests = meter.createUpDownCounter(Metrics.P2P_REQ_RESP_RECEIVED_REQUESTS);
+    const protocolAttrs = {
+      [Attributes.P2P_REQ_RESP_PROTOCOL]: [
+        ReqRespSubProtocol.PING,
+        ReqRespSubProtocol.STATUS,
+        ReqRespSubProtocol.GOODBYE,
+        ReqRespSubProtocol.TX,
+        ReqRespSubProtocol.AUTH,
+        ReqRespSubProtocol.BLOCK_TXS,
+      ],
+    };
+    this.sentRequests = createUpDownCounterWithDefault(meter, Metrics.P2P_REQ_RESP_SENT_REQUESTS, protocolAttrs);
+    this.receivedRequests = createUpDownCounterWithDefault(
+      meter,
+      Metrics.P2P_REQ_RESP_RECEIVED_REQUESTS,
+      protocolAttrs,
+    );
 
-    this.failedOutboundRequests = meter.createUpDownCounter(Metrics.P2P_REQ_RESP_FAILED_OUTBOUND_REQUESTS);
+    this.failedOutboundRequests = createUpDownCounterWithDefault(
+      meter,
+      Metrics.P2P_REQ_RESP_FAILED_OUTBOUND_REQUESTS,
+      protocolAttrs,
+    );
 
-    this.failedInboundRequests = meter.createUpDownCounter(Metrics.P2P_REQ_RESP_FAILED_INBOUND_REQUESTS);
+    this.failedInboundRequests = createUpDownCounterWithDefault(
+      meter,
+      Metrics.P2P_REQ_RESP_FAILED_INBOUND_REQUESTS,
+      protocolAttrs,
+    );
   }
 
-  public recordRequestSent(protocol: string) {
+  public recordRequestSent(protocol: ReqRespSubProtocol) {
     this.sentRequests.add(1, { [Attributes.P2P_REQ_RESP_PROTOCOL]: protocol });
   }
 
-  public recordRequestReceived(protocol: string) {
+  public recordRequestReceived(protocol: ReqRespSubProtocol) {
     this.receivedRequests.add(1, { [Attributes.P2P_REQ_RESP_PROTOCOL]: protocol });
   }
 
-  public recordRequestError(protocol: string) {
+  public recordRequestError(protocol: ReqRespSubProtocol) {
     this.failedOutboundRequests.add(1, { [Attributes.P2P_REQ_RESP_PROTOCOL]: protocol });
   }
 
-  public recordResponseError(protocol: string) {
+  public recordResponseError(protocol: ReqRespSubProtocol) {
     this.failedInboundRequests.add(1, { [Attributes.P2P_REQ_RESP_PROTOCOL]: protocol });
   }
 }

package/src/services/reqresp/protocols/block_txs/bitvector.ts

@@ -58,12 +58,20 @@ export class BitVector {
   }
 
   /**
-   * Returns all indices which are set to true
-   * */
+   * Returns all indices which are set to true.
+   * Ordered by index. No duplicates.
+   */
   getTrueIndices(): number[] {
     return Array.from({ length: this.length }, (_, i) => i).filter(i => this.isSet(i));
   }
 
+  /**
+   * Returns true if no indices are set to true
+   * */
+  isEmpty(): boolean {
+    return this.getTrueIndices().length === 0;
+  }
+
   /**
    * Serializes the BitVector object into a Buffer
    *

package/src/services/reqresp/protocols/block_txs/block_txs_handler.ts

@@ -1,9 +1,10 @@
-import { TxArray } from '@aztec/stdlib/tx';
+import type { L2BlockSource } from '@aztec/stdlib/block';
+import { TxArray, TxHash } from '@aztec/stdlib/tx';
 
 import type { PeerId } from '@libp2p/interface';
 
-import type { AttestationPool } from '../../../../mem_pools/attestation_pool/attestation_pool.js';
-import type { TxPool } from '../../../../mem_pools/index.js';
+import type { AttestationPoolApi } from '../../../../mem_pools/attestation_pool/attestation_pool.js';
+import type { TxPoolV2 } from '../../../../mem_pools/tx_pool_v2/interfaces.js';
 import type { ReqRespSubProtocolHandler } from '../../interface.js';
 import { ReqRespStatus, ReqRespStatusError } from '../../status.js';
 import { BitVector } from './bitvector.js';
@@ -12,10 +13,15 @@ import { BlockTxsRequest, BlockTxsResponse } from './block_txs_reqresp.js';
 /**
  * Handler for block txs requests
  * @param attestationPool - the attestation pool to check for block proposals
- * @param mempools - the mempools containing the tx pool
+ * @param archiver - the archiver to look up blocks by archive root
+ * @param txPool - the tx pool to fetch transactions from
  * @returns the BlockTxs request handler
  */
-export function reqRespBlockTxsHandler(attestationPool: AttestationPool, txPool: TxPool): ReqRespSubProtocolHandler {
+export function reqRespBlockTxsHandler(
+  attestationPool: AttestationPoolApi,
+  archiver: L2BlockSource,
+  txPool: TxPoolV2,
+): ReqRespSubProtocolHandler {
   /**
    * Handler for block txs requests
    * @param msg - the block txs request message
@@ -30,23 +36,44 @@ export function reqRespBlockTxsHandler(attestationPool: AttestationPool, txPool:
       throw new ReqRespStatusError(ReqRespStatus.BADLY_FORMED_REQUEST, { cause: err });
     }
 
-    const blockProposal = await attestationPool.getBlockProposal(request.blockHash.toString());
+    // In principle assume we haven't found the block. This is how that is signaled to the requester.
+    let availableIndicesBitVector: BitVector = BitVector.init(0, []);
+    // We always try to service the explicitly requested tx hashes, even if we don't have the block.
+    const requestedTxsHashes: Set<string> = new Set(request.txHashes.map(h => h.toString()));
 
-    if (!blockProposal) {
-      throw new ReqRespStatusError(ReqRespStatus.NOT_FOUND);
+    // First try attestation pool, then fall back to archiver.
+    let blockTxHashes = (await attestationPool.getBlockProposalByArchive(request.archiveRoot.toString()))?.txHashes;
+    if (!blockTxHashes) {
+      blockTxHashes = (await archiver.getBlock({ archive: request.archiveRoot }))?.body.txEffects.map(
+        effect => effect.txHash,
+      );
     }
 
-    const txsAvailableInPool = await txPool.hasTxs(blockProposal.txHashes);
-    //Map txs in the pool to their indices in the block proposal
-    const availableIndices = txsAvailableInPool.map((hasTx, idx) => (hasTx ? idx : -1)).filter(idx => idx !== -1);
-    const responseBitVector = BitVector.init(blockProposal.txHashes.length, availableIndices);
+    // If we have found the block,
+    if (blockTxHashes) {
+      // First confirm that we are talking about the same block (up to tx hashes and order).
+      // If we are not, then we can't:
+      // 1. Use the indices from the request to get the txs from the pool.
+      // 2. Respond to the peer with the txs we have using indices.
+      const blockTxHashesCommitment = BlockTxsRequest.computeBlockTxHashesCommitment(blockTxHashes);
+      if (blockTxHashesCommitment.equals(request.blockTxHashesCommitment)) {
+        // In that case, we can also get the available indices from the pool.
+        const txsAvailableInPool = await txPool.hasTxs(blockTxHashes);
+        // Map txs in the pool to their indices in the block
+        const availableIndices = txsAvailableInPool.map((hasTx, idx) => (hasTx ? idx : -1)).filter(idx => idx !== -1);
+        availableIndicesBitVector = BitVector.init(blockTxHashes.length, availableIndices);
 
-    const requestedIndices = new Set(request.txIndices.getTrueIndices());
-    const requestedTxsHashes = blockProposal.txHashes.filter((_, idx) => requestedIndices.has(idx));
-
-    const responseTxs = (await txPool.getTxsByHash(requestedTxsHashes)).filter(tx => !!tx);
+        // We add the requested tx hashes (by index) to the list of tx hashes we are sending to the peer.
+        const requestedIndices = new Set(request.txIndices.getTrueIndices());
+        blockTxHashes.filter((_, idx) => requestedIndices.has(idx)).forEach(h => requestedTxsHashes.add(h.toString()));
+      }
+    }
 
-    const response = new BlockTxsResponse(request.blockHash, new TxArray(...responseTxs), responseBitVector);
+    // Finally, get the txs from the pool and create the response.
+    const responseTxs = (
+      await txPool.getTxsByHash(Array.from(requestedTxsHashes).map(h => TxHash.fromString(h)))
+    ).filter(tx => !!tx);
+    const response = new BlockTxsResponse(new TxArray(...responseTxs), availableIndicesBitVector);
 
     return response.toBuffer();
   };

package/src/services/reqresp/protocols/block_txs/block_txs_reqresp.ts

@@ -1,20 +1,82 @@
+import { Buffer32 } from '@aztec/foundation/buffer';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
-import { TxArray } from '@aztec/stdlib/tx';
+import { MAX_TX_SIZE_KB } from '@aztec/stdlib/p2p';
+import { TxArray, type TxHash, TxHashArray } from '@aztec/stdlib/tx';
+
+import { createHash } from 'node:crypto';
 
 import { BitVector } from './bitvector.js';
 
+/** Minimal interface for a block source that provides tx hashes and an archive root. */
+export interface BlockTxsSource {
+  txHashes: TxHash[];
+  archive: Fr;
+}
+
 /**
  * Request message for requesting specific transactions from a block
  */
 export class BlockTxsRequest {
   constructor(
-    readonly blockHash: Fr, // 32 byte hash of the proposed block header
-    // BitVector indicating which txs from the proposal we are requesting
-    // 1 means we want the tx, 0 means we don't
+    // Archive root after the proposed block is applied (proposal identifier).
+    readonly archiveRoot: Fr,
+    // BitVector indicating which txs from the block (proposal) we are requesting
+    // 1 means we want the tx, 0 means we don't.
+    // This will only return txs in the response if the peer has the block (proposal).
     readonly txIndices: BitVector,
+    // If we ask for txs via indices, the responder needs to be sure that we are talking about the same block.
+    // Unfortunately, the archive root is not enough, since it's possible for the peer to have seen a different
+    // block (proposal) with the same archive root but different txs. We include a commitment to the tx hashes
+    // so that the responder can verify this (for its own sake, and not be penalized).
+    readonly blockTxHashesCommitment: Buffer32,
+    // Explicit hashes of txs we are requesting (optional). The peer will try to serve these txs even if
+    // it doesn't have the block. If the requester lists txs from the block here, this serves as a fallback.
+    // Note: if a hash here is NOT part of the block (proposal), the peer can decide to return it or not.
+    readonly txHashes: TxHashArray,
   ) {}
 
+  static computeBlockTxHashesCommitment(blockTxHashes: TxHash[]): Buffer32 {
+    return Buffer32.fromBuffer(createHash('sha256').update(serializeToBuffer(blockTxHashes)).digest());
+  }
+
+  /**
+   * Creates new BlockTxsRequest given a block txs source and missing tx hashes.
+   *
+   * @param blockTxsSource - The block or proposal for which we are making the request
+   * @param missingTxHashes - Tx hashes from the source we are missing
+   * @param includeFullTxHashes - Whether to include full list of missing tx hashes in the request or just Bitvector indices
+   *
+   * @returns undefined if there were no missingTxHashes matching the source hashes, otherwise
+   * returns new BlockTxsRequest
+   */
+  static fromTxsSourceAndMissingTxs(
+    blockTxsSource: BlockTxsSource,
+    missingTxHashes: TxHash[],
+    includeFullTxHashes = false,
+  ): BlockTxsRequest | undefined {
+    if (missingTxHashes.length === 0) {
+      return undefined; // No missing txs to request
+    }
+
+    const missingHashesSet = new Set(missingTxHashes.map(t => t.toString()));
+
+    // We cannot request txs that are not part of the block
+    if (!missingHashesSet.isSubsetOf(new Set(blockTxsSource.txHashes.map(t => t.toString())))) {
+      return undefined;
+    }
+
+    const missingIndices = blockTxsSource.txHashes
+      .map((hash, idx) => (missingHashesSet.has(hash.toString()) ? idx : -1))
+      .filter(i => i != -1);
+
+    const requestBitVector = BitVector.init(blockTxsSource.txHashes.length, missingIndices);
+    const hashes = includeFullTxHashes ? new TxHashArray(...missingTxHashes) : new TxHashArray();
+    const commitment = BlockTxsRequest.computeBlockTxHashesCommitment(blockTxsSource.txHashes);
+
+    return new BlockTxsRequest(blockTxsSource.archive, requestBitVector, commitment, hashes);
+  }
+
   /**
    * Deserializes the BlockTxRequest object from a Buffer
    * @param buffer - Buffer or BufferReader object to deserialize
@@ -22,10 +84,12 @@ export class BlockTxsRequest {
    */
   static fromBuffer(buffer: Buffer | BufferReader): BlockTxsRequest {
     const reader = BufferReader.asReader(buffer);
-    const blockHash = Fr.fromBuffer(reader);
+    const archiveRoot = Fr.fromBuffer(reader);
     const txIndices = BitVector.fromBuffer(reader);
+    const commitment = Buffer32.fromBuffer(reader);
+    const txHashes = TxHashArray.fromBuffer(reader);
 
-    return new BlockTxsRequest(blockHash, txIndices);
+    return new BlockTxsRequest(archiveRoot, txIndices, commitment, txHashes);
   }
 
   /**
@@ -33,7 +97,12 @@ export class BlockTxsRequest {
    * @returns Buffer representation of the BlockTxRequest object
    */
   toBuffer(): Buffer {
-    return serializeToBuffer([this.blockHash, this.txIndices.toBuffer()]);
+    return serializeToBuffer([
+      this.archiveRoot,
+      this.txIndices.toBuffer(),
+      this.blockTxHashesCommitment.toBuffer(),
+      this.txHashes.toBuffer(),
+    ]);
   }
 }
 
@@ -42,13 +111,23 @@ export class BlockTxsRequest {
  */
 export class BlockTxsResponse {
   constructor(
-    readonly blockHash: Fr,
-    readonly txs: TxArray, // List of transactions we requested and peer has
+    // List of transactions we requested and peer has.
+    readonly txs: TxArray,
     // BitVector indicating which txs from the proposal are available at the peer
-    // 1 means the tx is available, 0 means it is not
+    // 1 means the tx is available, 0 means it is not.
+    // The vector should be empty to signal that the peer doesn't have the block.
+    // Otherwise, it should be a subset of the indices of the block tx hashes.
     readonly txIndices: BitVector,
   ) {}
 
+  /**
+   * Whether the response indicates that the peer has the block.
+   * @returns True if the peer has the block, false otherwise.
+   */
+  peerHasBlock(): boolean {
+    return this.txIndices.getLength() > 0;
+  }
+
   /**
    * Deserializes the BlockTxResponse object from a Buffer
    * @param buffer - Buffer or BufferReader object to deserialize
@@ -56,24 +135,37 @@ export class BlockTxsResponse {
    */
   static fromBuffer(buffer: Buffer | BufferReader): BlockTxsResponse {
     const reader = BufferReader.asReader(buffer);
-    const blockHash = Fr.fromBuffer(reader);
     const txs = TxArray.fromBuffer(reader);
     const txIndices = BitVector.fromBuffer(reader);
 
-    return new BlockTxsResponse(blockHash, txs, txIndices);
+    return new BlockTxsResponse(txs, txIndices);
   }
 
   /**
    * Serializes the BlockTxResponse object into a Buffer
-   * @dev: In current implementation, txIndices is serialized as Buffer of unknown length,
-   * thus we serialize it last
    * @returns Buffer representation of the BlockTxResponse object
    */
   toBuffer(): Buffer {
-    return serializeToBuffer([this.blockHash, this.txs.toBuffer(), this.txIndices.toBuffer()]);
+    return serializeToBuffer([this.txs.toBuffer(), this.txIndices.toBuffer()]);
   }
 
   static empty(): BlockTxsResponse {
-    return new BlockTxsResponse(Fr.ZERO, new TxArray(), BitVector.init(0, []));
+    return new BlockTxsResponse(new TxArray(), BitVector.init(0, []));
+  }
+}
+
+/**
+ * Calculate the expected response size for a BLOCK_TXS request.
+ * @param requestBuffer - The serialized request buffer containing BlockTxsRequest
+ * @returns Expected response size in KB
+ */
+export function calculateBlockTxsResponseSize(requestBuffer: Buffer): number {
+  try {
+    const request = BlockTxsRequest.fromBuffer(requestBuffer);
+    const requestedTxCount = request.txIndices.getTrueIndices().length;
+    return requestedTxCount * MAX_TX_SIZE_KB + 1; // +1 KB overhead for serialization
+  } catch {
+    // If we can't parse the request, fall back to allowing a single transaction response
+    return MAX_TX_SIZE_KB + 1;
   }
 }

package/src/services/reqresp/protocols/index.ts

@@ -5,6 +5,5 @@ export * from './ping.js';
 export * from './status.js';
 export * from './tx.js';
 export * from './goodbye.js';
-export * from './block.js';
 export * from './auth.js';
 export * from './block_txs/index.js';

package/src/services/reqresp/protocols/tx.ts

@@ -1,4 +1,5 @@
 import { chunk } from '@aztec/foundation/collection';
+import { MAX_TX_SIZE_KB } from '@aztec/stdlib/p2p';
 import { TxArray, TxHash, TxHashArray } from '@aztec/stdlib/tx';
 
 import type { PeerId } from '@libp2p/interface';
@@ -50,8 +51,27 @@ export function reqRespTxHandler(mempools: MemPools): ReqRespSubProtocolHandler
  *  Per: https://github.com/AztecProtocol/aztec-packages/issues/15149#issuecomment-2999054485
  *  we define Q as max number of transactions per batch, the comment explains why we use 8.
  */
-//TODO: (mralj) chunk size should by default be 8, this is just temporary until the protocol is implemented correctly
-//more info:  https://github.com/AztecProtocol/aztec-packages/pull/15516#pullrequestreview-2995474321
-export function chunkTxHashesRequest(hashes: TxHash[], chunkSize = 1): Array<TxHashArray> {
+export function chunkTxHashesRequest(hashes: TxHash[], chunkSize = 8): Array<TxHashArray> {
   return chunk(hashes, chunkSize).map(chunk => new TxHashArray(...chunk));
 }
+
+/**
+ * Calculate the expected response size for a TX request.
+ * @param requestBuffer - The serialized request buffer containing TxHashArray
+ * @returns Expected response size in KB
+ */
+export function calculateTxResponseSize(requestBuffer: Buffer): number {
+  try {
+    const txHashes = TxHashArray.fromBuffer(requestBuffer);
+    // TxHashArray.fromBuffer returns empty array on parse failure, so check for that
+    if (txHashes.length === 0 && requestBuffer.length > 0) {
+      // If we got an empty array but had a non-empty buffer, parsing likely failed
+      // Fall back to allowing a single transaction response
+      return MAX_TX_SIZE_KB + 1;
+    }
+    return Math.max(txHashes.length, 1) * MAX_TX_SIZE_KB + 1; // +1 KB overhead, at least 1 tx
+  } catch {
+    // If we can't parse the request, fall back to allowing a single transaction response
+    return MAX_TX_SIZE_KB + 1;
+  }
+}

package/src/services/reqresp/rate-limiter/rate_limiter.ts

@@ -97,9 +97,10 @@ export function prettyPrintRateLimitStatus(status: RateLimitStatus) {
  * 2. Individual rate limits for each peer.
  *
  * How it works:
- * - When a request comes in, it first checks against the global rate limit.
- * - If the global limit allows, it then checks against the specific peer's rate limit.
- * - The request is only allowed if both the global and peer-specific limits allow it.
+ * - When a request comes in, it first checks against the peer's individual rate limit.
+ * - If the peer limit allows, it then checks against the global rate limit.
+ * - The request is only allowed if both the peer-specific and global limits allow it.
+ * - Checking peer limit first ensures a rate-limited peer cannot exhaust the global quota.
  * - It automatically creates and manages rate limiters for new peers as they make requests.
  * - It periodically cleans up rate limiters for inactive peers to conserve memory.
  *
@@ -119,10 +120,6 @@ export class SubProtocolRateLimiter {
   }
 
   allow(peerId: PeerId): RateLimitStatus {
-    if (!this.globalLimiter.allow()) {
-      return RateLimitStatus.DeniedGlobal;
-    }
-
     const peerIdStr = peerId.toString();
     let peerLimiter: PeerRateLimiter | undefined = this.peerLimiters.get(peerIdStr);
     if (!peerLimiter) {
@@ -135,10 +132,17 @@ export class SubProtocolRateLimiter {
     } else {
       peerLimiter.lastAccess = Date.now();
     }
-    const peerLimitAllowed = peerLimiter.limiter.allow();
-    if (!peerLimitAllowed) {
+
+    // Check peer limit first: a rate-limited peer must not consume global quota,
+    // otherwise one spamming peer can starve all others by exhausting the global bucket.
+    if (!peerLimiter.limiter.allow()) {
       return RateLimitStatus.DeniedPeer;
     }
+
+    if (!this.globalLimiter.allow()) {
+      return RateLimitStatus.DeniedGlobal;
+    }
+
     return RateLimitStatus.Allowed;
   }
 

package/src/services/reqresp/rate-limiter/rate_limits.ts

@@ -9,7 +9,7 @@ export const DEFAULT_RATE_LIMITS: ReqRespSubProtocolRateLimits = {
     },
     globalLimit: {
       quotaTimeMs: 1000,
-      quotaCount: 10,
+      quotaCount: 50,
     },
   },
   [ReqRespSubProtocol.STATUS]: {
@@ -19,7 +19,7 @@ export const DEFAULT_RATE_LIMITS: ReqRespSubProtocolRateLimits = {
     },
     globalLimit: {
       quotaTimeMs: 1000,
-      quotaCount: 10,
+      quotaCount: 50,
     },
   },
   [ReqRespSubProtocol.AUTH]: {
@@ -42,16 +42,6 @@ export const DEFAULT_RATE_LIMITS: ReqRespSubProtocolRateLimits = {
       quotaCount: 200,
     },
   },
-  [ReqRespSubProtocol.BLOCK]: {
-    peerLimit: {
-      quotaTimeMs: 1000,
-      quotaCount: 2,
-    },
-    globalLimit: {
-      quotaTimeMs: 1000,
-      quotaCount: 5,
-    },
-  },
   [ReqRespSubProtocol.GOODBYE]: {
     peerLimit: {
       quotaTimeMs: 1000,
@@ -59,7 +49,7 @@ export const DEFAULT_RATE_LIMITS: ReqRespSubProtocolRateLimits = {
     },
     globalLimit: {
       quotaTimeMs: 1000,
-      quotaCount: 10,
+      quotaCount: 50,
     },
   },
   [ReqRespSubProtocol.BLOCK_TXS]: {