@aztec/p2p 0.0.1-commit.4d79d1f2d → 0.0.1-commit.5358163d3

package/src/msg_validators/proposal_validator/block_proposal_validator.ts

@@ -4,7 +4,7 @@ import type { BlockProposal, P2PValidator } from '@aztec/stdlib/p2p';
 import { ProposalValidator } from '../proposal_validator/proposal_validator.js';
 
 export class BlockProposalValidator extends ProposalValidator<BlockProposal> implements P2PValidator<BlockProposal> {
-  constructor(epochCache: EpochCacheInterface, opts: { txsPermitted: boolean }) {
+  constructor(epochCache: EpochCacheInterface, opts: { txsPermitted: boolean; maxTxsPerBlock?: number }) {
     super(epochCache, opts, 'p2p:block_proposal_validator');
   }
 }

package/src/msg_validators/proposal_validator/checkpoint_proposal_validator.ts

@@ -7,7 +7,7 @@ export class CheckpointProposalValidator
   extends ProposalValidator<CheckpointProposal>
   implements P2PValidator<CheckpointProposal>
 {
-  constructor(epochCache: EpochCacheInterface, opts: { txsPermitted: boolean }) {
+  constructor(epochCache: EpochCacheInterface, opts: { txsPermitted: boolean; maxTxsPerBlock?: number }) {
     super(epochCache, opts, 'p2p:checkpoint_proposal_validator');
   }
 }

package/src/msg_validators/proposal_validator/proposal_validator.ts

@@ -9,10 +9,16 @@ export abstract class ProposalValidator<TProposal extends BlockProposal | Checkp
   protected epochCache: EpochCacheInterface;
   protected logger: Logger;
   protected txsPermitted: boolean;
+  protected maxTxsPerBlock?: number;
 
-  constructor(epochCache: EpochCacheInterface, opts: { txsPermitted: boolean }, loggerName: string) {
+  constructor(
+    epochCache: EpochCacheInterface,
+    opts: { txsPermitted: boolean; maxTxsPerBlock?: number },
+    loggerName: string,
+  ) {
     this.epochCache = epochCache;
     this.txsPermitted = opts.txsPermitted;
+    this.maxTxsPerBlock = opts.maxTxsPerBlock;
     this.logger = createLogger(loggerName);
   }
 
@@ -47,6 +53,14 @@ export abstract class ProposalValidator<TProposal extends BlockProposal | Checkp
         return { result: 'reject', severity: PeerErrorSeverity.MidToleranceError };
       }
 
+      // Max txs per block check
+      if (this.maxTxsPerBlock !== undefined && proposal.txHashes.length > this.maxTxsPerBlock) {
+        this.logger.warn(
+          `Penalizing peer for proposal with ${proposal.txHashes.length} transaction(s) when max is ${this.maxTxsPerBlock}`,
+        );
+        return { result: 'reject', severity: PeerErrorSeverity.MidToleranceError };
+      }
+
       // Embedded txs must be listed in txHashes
       const hashSet = new Set(proposal.txHashes.map(h => h.toString()));
       const missingTxHashes =

package/src/msg_validators/proposal_validator/proposal_validator_test_suite.ts

@@ -1,4 +1,5 @@
 import type { EpochCacheInterface } from '@aztec/epoch-cache';
+import { NoCommitteeError } from '@aztec/ethereum/contracts';
 import type { Secp256k1Signer } from '@aztec/foundation/crypto/secp256k1-signer';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 import {
@@ -9,12 +10,13 @@ import {
 } from '@aztec/stdlib/p2p';
 import type { TxHash } from '@aztec/stdlib/tx';
 
+import { jest } from '@jest/globals';
 import type { MockProxy } from 'jest-mock-extended';
 
 export interface ProposalValidatorTestParams<TProposal extends BlockProposal | CheckpointProposal> {
   validatorFactory: (
     epochCache: EpochCacheInterface,
-    opts: { txsPermitted: boolean },
+    opts: { txsPermitted: boolean; maxTxsPerBlock?: number },
   ) => { validate: (proposal: TProposal) => Promise<ValidationResult> };
   makeProposal: (options?: any) => Promise<TProposal>;
   makeHeader: (epochNumber: number | bigint, slotNumber: number | bigint, blockNumber: number | bigint) => any;
@@ -105,6 +107,26 @@ export function sharedProposalValidatorTests<TProposal extends BlockProposal | C
       expect(result).toEqual({ result: 'ignore' });
     });
 
+    it('returns mid tolerance error if proposal has invalid signature', async () => {
+      const currentProposer = getSigner();
+      const header = makeHeader(1, 100, 100);
+      const mockProposal = await makeProposal({
+        blockHeader: header,
+        lastBlockHeader: header,
+        signer: currentProposer,
+      });
+
+      // Override getSender to return undefined (invalid signature)
+      jest.spyOn(mockProposal as any, 'getSender').mockReturnValue(undefined);
+
+      mockGetProposer(getAddress(currentProposer), getAddress());
+      const result = await validator.validate(mockProposal);
+      expect(result).toEqual({ result: 'reject', severity: PeerErrorSeverity.MidToleranceError });
+
+      // Should not try to resolve proposer if signature is invalid
+      expect(epochCache.getProposerAttesterAddressInSlot).not.toHaveBeenCalled();
+    });
+
     it('returns mid tolerance error if proposer is not current proposer for current slot', async () => {
       const currentProposer = getSigner();
       const nextProposer = getSigner();
@@ -152,6 +174,34 @@ export function sharedProposalValidatorTests<TProposal extends BlockProposal | C
       expect(result).toEqual({ result: 'reject', severity: PeerErrorSeverity.MidToleranceError });
     });
 
+    it('accepts proposal when proposer is undefined (open committee)', async () => {
+      const currentProposer = getSigner();
+      const header = makeHeader(1, 100, 100);
+      const mockProposal = await makeProposal({
+        blockHeader: header,
+        lastBlockHeader: header,
+        signer: currentProposer,
+      });
+
+      epochCache.getProposerAttesterAddressInSlot.mockResolvedValue(undefined);
+      const result = await validator.validate(mockProposal);
+      expect(result).toEqual({ result: 'accept' });
+    });
+
+    it('returns low tolerance error when getProposerAttesterAddressInSlot throws NoCommitteeError', async () => {
+      const currentProposer = getSigner();
+      const header = makeHeader(1, 100, 100);
+      const mockProposal = await makeProposal({
+        blockHeader: header,
+        lastBlockHeader: header,
+        signer: currentProposer,
+      });
+
+      epochCache.getProposerAttesterAddressInSlot.mockRejectedValue(new NoCommitteeError());
+      const result = await validator.validate(mockProposal);
+      expect(result).toEqual({ result: 'reject', severity: PeerErrorSeverity.LowToleranceError });
+    });
+
     it('returns undefined if proposal is valid for current slot and proposer', async () => {
       const currentProposer = getSigner();
       const nextProposer = getSigner();
@@ -226,5 +276,98 @@ export function sharedProposalValidatorTests<TProposal extends BlockProposal | C
         expect(result).toEqual({ result: 'accept' });
       });
     });
+
+    describe('embedded tx validation', () => {
+      it('returns mid tolerance error if embedded txs are not listed in txHashes', async () => {
+        const currentProposer = getSigner();
+        const txHashes = getTxHashes(2);
+        const header = makeHeader(1, 100, 100);
+        const mockProposal = await makeProposal({
+          blockHeader: header,
+          lastBlockHeader: header,
+          signer: currentProposer,
+          txHashes,
+        });
+
+        // Create a fake tx whose hash is NOT in txHashes
+        const fakeTxHash = getTxHashes(1)[0];
+        const fakeTx = { getTxHash: () => fakeTxHash, validateTxHash: () => Promise.resolve(true) };
+        Object.defineProperty(mockProposal, 'txs', { get: () => [fakeTx], configurable: true });
+
+        mockGetProposer(getAddress(currentProposer), getAddress());
+        const result = await validator.validate(mockProposal);
+        expect(result).toEqual({ result: 'reject', severity: PeerErrorSeverity.MidToleranceError });
+      });
+
+      it('returns low tolerance error if embedded tx has invalid tx hash', async () => {
+        const currentProposer = getSigner();
+        const txHashes = getTxHashes(2);
+        const header = makeHeader(1, 100, 100);
+        const mockProposal = await makeProposal({
+          blockHeader: header,
+          lastBlockHeader: header,
+          signer: currentProposer,
+          txHashes,
+        });
+
+        // Create a fake tx whose hash IS in txHashes but validateTxHash returns false
+        const fakeTx = { getTxHash: () => txHashes[0], validateTxHash: () => Promise.resolve(false) };
+        Object.defineProperty(mockProposal, 'txs', { get: () => [fakeTx], configurable: true });
+
+        mockGetProposer(getAddress(currentProposer), getAddress());
+        const result = await validator.validate(mockProposal);
+        expect(result).toEqual({ result: 'reject', severity: PeerErrorSeverity.LowToleranceError });
+      });
+    });
+
+    describe('maxTxsPerBlock validation', () => {
+      it('rejects proposal when txHashes exceed maxTxsPerBlock', async () => {
+        const validatorWithMaxTxs = validatorFactory(epochCache, { txsPermitted: true, maxTxsPerBlock: 2 });
+        const currentProposer = getSigner();
+        const header = makeHeader(1, 100, 100);
+        const mockProposal = await makeProposal({
+          blockHeader: header,
+          lastBlockHeader: header,
+          signer: currentProposer,
+          txHashes: getTxHashes(3),
+        });
+
+        mockGetProposer(getAddress(currentProposer), getAddress());
+        const result = await validatorWithMaxTxs.validate(mockProposal);
+        expect(result).toEqual({ result: 'reject', severity: PeerErrorSeverity.MidToleranceError });
+      });
+
+      it('accepts proposal when txHashes count equals maxTxsPerBlock', async () => {
+        const validatorWithMaxTxs = validatorFactory(epochCache, { txsPermitted: true, maxTxsPerBlock: 2 });
+        const currentProposer = getSigner();
+        const header = makeHeader(1, 100, 100);
+        const mockProposal = await makeProposal({
+          blockHeader: header,
+          lastBlockHeader: header,
+          signer: currentProposer,
+          txHashes: getTxHashes(2),
+        });
+
+        mockGetProposer(getAddress(currentProposer), getAddress());
+        const result = await validatorWithMaxTxs.validate(mockProposal);
+        expect(result).toEqual({ result: 'accept' });
+      });
+
+      it('accepts proposal when maxTxsPerBlock is not set (unlimited)', async () => {
+        // Default validator has no maxTxsPerBlock
+        const currentProposer = getSigner();
+        const header = makeHeader(1, 100, 100);
+        const mockProposal = await makeProposal({
+          blockHeader: header,
+          lastBlockHeader: header,
+          signer: currentProposer,
+          txHashes: getTxHashes(10),
+        });
+
+        mockGetProposer(getAddress(currentProposer), getAddress());
+        const result = await validator.validate(mockProposal);
+        expect(result).toEqual({ result: 'accept' });
+      });
+    });
   });
 }

package/src/msg_validators/tx_validator/README.md

@@ -0,0 +1,115 @@
+# Transaction Validation
+
+This module defines the transaction validators and the factory functions that assemble them for each entry point into the system.
+
+## Validation Strategy
+
+Transactions enter the system through different paths. **Unsolicited** transactions (gossip and RPC) are fully validated before acceptance. **Solicited** transactions (req/resp and block proposals) are only checked for well-formedness because we must store them for block re-execution — they may ultimately be invalid, which is caught during block building and reported as part of block validation/attestation.
+
+When solicited transactions fail to be mined, they may be migrated to the pending pool. At that point, the pool runs the state-dependent checks that were skipped on initial receipt.
+
+## Entry Points
+
+### 1. Gossip (libp2p pubsub)
+
+**Factory**: `createFirstStageTxValidationsForGossipedTransactions` + `createSecondStageTxValidationsForGossipedTransactions`
+**Called from**: `LibP2PService.handleGossipedTx()` in `libp2p_service.ts`
+
+Unsolicited transactions from any peer. Fully validated in two stages with a pool pre-check in between to avoid wasting CPU on proof verification for transactions the pool would reject:
+
+| Step | What runs | On failure |
+|------|-----------|------------|
+| **Stage 1** (fast) | TxPermitted, Data, Metadata, Timestamp, DoubleSpend, Gas, Phases, BlockHeader | Penalize peer, reject tx |
+| **Pool pre-check** | `canAddPendingTx` — checks for duplicates, pool capacity | Ignore tx (no penalty) |
+| **Stage 2** (slow) | Proof verification | Penalize peer, reject tx |
+| **Pool add** | `addPendingTxs` | Accept, ignore, or reject |
+
+Each stage-1 and stage-2 validator is paired with a `PeerErrorSeverity`. If a validator fails, the sending peer is penalized with that severity. The `doubleSpendValidator` has special handling: its severity is determined by how recently the nullifier appeared (recent = high tolerance, old = low tolerance).
+
+### 2. JSON-RPC
+
+**Factory**: `createTxValidatorForAcceptingTxsOverRPC`
+**Called from**: `AztecNodeService.isValidTx()` in `aztec-node/server.ts`
+
+Unsolicited transactions from a local wallet/PXE. Runs the full set of checks as a single aggregate validator:
+
+- TxPermitted, Size, Data, Metadata, Timestamp, DoubleSpend, Phases, BlockHeader
+- Gas (optional — skipped when `skipFeeEnforcement` is set)
+- Proof verification (optional — skipped for simulations when no verifier is provided)
+
+### 3. Req/resp and block proposals
+
+**Factories**: `createTxValidatorForReqResponseReceivedTxs`, `createTxValidatorForBlockProposalReceivedTxs`
+**Called from**: `LibP2PService.validateRequestedTx()`, `LibP2PService.validateTxsReceivedInBlockProposal()`, and `BatchRequestTxValidator` in `batch-tx-requester/tx_validator.ts`
+
+Solicited transactions — we requested these from peers or received them as part of a block proposal we need to validate. We must accept them for re-execution even if they are invalid against the current state. Only well-formedness is checked:
+
+- Metadata, Size, Data, Proof
+
+State-dependent checks are deferred to either the block building validator (for txs included in blocks) or the pending pool migration validator (for unmined txs migrating to pending).
+
+### 4. Block building
+
+**Factory**: `createTxValidatorForBlockBuilding`
+**Called from**: `CheckpointBuilder.makeBlockBuilderDeps()` in `validator-client/checkpoint_builder.ts`
+
+Transactions already in the pool, about to be sequenced into a block. Re-validates against the current state of the block being built. **This is where invalid txs that entered via req/resp or block proposals are caught** — their invalidity is reported as part of block validation/attestation.
+
+Runs:
+- Timestamp, DoubleSpend, Phases, Gas, BlockHeader
+
+Does **not** run:
+- Proof, Data — already verified on entry (by gossip, RPC, or req/resp validators)
+
+### 5. Pending pool migration
+
+**Factory**: `createTxValidatorForTransactionsEnteringPendingTxPool`
+**Called from**: `TxPoolV2Impl` (injected as the `createTxValidator` factory via `TxPoolV2Dependencies`)
+
+When transactions that arrived via req/resp or block proposals fail to be mined, they may need to be included in our pending pool. These txs only had well-formedness checks on receipt, so the pool runs the state-dependent checks they missed before accepting them.
+
+This validator is invoked on **every** transaction potentially entering the pending pool:
+- `addPendingTxs` — validating each tx before adding
+- `prepareForSlot` — unprotecting txs back to pending after a slot ends
+- `handlePrunedBlocks` — unmining txs from pruned blocks back to pending
+- Startup hydration — revalidating persisted non-mined txs on node restart
+
+Runs:
+- DoubleSpend, BlockHeader, GasLimits, Timestamp
+
+Operates on `TxMetaData` (pre-built by the pool) rather than full `Tx` objects.
+
+## Individual Validators
+
+| Validator | What it checks | Benchmarked verification duration |
+|-----------|---------------|---------------|
+| `TxPermittedValidator` | Whether the system is accepting transactions (controlled by config flag) | 1.56 us |
+| `DataTxValidator` | Transaction data integrity — correct structure, non-empty fields | 4.10–18.18 ms |
+| `SizeTxValidator` | Transaction does not exceed maximum size limits | 2.28 us |
+| `MetadataTxValidator` | Chain ID, rollup version, protocol contracts hash, VK tree root | 4.18 us |
+| `TimestampTxValidator` | Transaction has not expired (expiration timestamp vs next slot) | 1.56 us |
+| `DoubleSpendTxValidator` | Nullifiers do not already exist in the nullifier tree | 106.08 us |
+| `GasTxValidator` | Gas limits are within bounds (delegates to `GasLimitsValidator`), max fee per gas meets current block fees, and fee payer has sufficient FeeJuice balance | 1.02 ms |
+| `GasLimitsValidator` | Gas limits are >= fixed minimums and <= AVM max processable L2 gas. Used standalone in pool migration; also called internally by `GasTxValidator` | 3–10 us |
+| `PhasesTxValidator` | Public function calls in setup phase are on the allow list | 10.12–13.12 us |
+| `BlockHeaderTxValidator` | Transaction's anchor block hash exists in the archive tree | 98.88 us |
+| `TxProofValidator` | Client proof verifies correctly | ~250ms |
+
+## Validator Coverage by Entry Point
+
+| Validator | Gossip | RPC | Req/resp | Block building | Pool migration |
+|-----------|--------|-----|----------|----------------|----------------|
+| TxPermitted | Stage 1 | Yes | — | — | — |
+| Data | Stage 1 | Yes | Yes | — | — |
+| Size | — | Yes | Yes | — | — |
+| Metadata | Stage 1 | Yes | Yes | — | — |
+| Timestamp | Stage 1 | Yes | — | Yes | Yes |
+| DoubleSpend | Stage 1 | Yes | — | Yes | Yes |
+| Gas (balance + limits) | Stage 1 | Optional* | — | Yes | — |
+| GasLimits (standalone) | — | — | — | — | Yes |
+| Phases | Stage 1 | Yes | — | Yes | — |
+| BlockHeader | Stage 1 | Yes | — | Yes | Yes |
+| Proof | Stage 2 | Optional** | Yes | — | — |
+
+\* Gas balance check is skipped when `skipFeeEnforcement` is set (testing/dev). `GasTxValidator` internally delegates to `GasLimitsValidator` as its first step, so gas limits are checked wherever `GasTxValidator` runs. Pool migration uses `GasLimitsValidator` standalone because it doesn't need the balance or fee-per-gas checks.
+\** Proof verification is skipped for simulations (no verifier provided).

package/src/msg_validators/tx_validator/aggregate_tx_validator.ts

@@ -1,18 +1,18 @@
 import type { TxValidationResult, TxValidator } from '@aztec/stdlib/tx';
 
 export class AggregateTxValidator<T> implements TxValidator<T> {
-  #validators: TxValidator<T>[];
+  readonly validators: TxValidator<T>[];
   constructor(...validators: TxValidator<T>[]) {
     if (validators.length === 0) {
       throw new Error('At least one validator must be provided');
     }
 
-    this.#validators = validators;
+    this.validators = validators;
   }
 
   async validateTx(tx: T): Promise<TxValidationResult> {
     const aggregate: { result: string; reason?: string[] } = { result: 'valid', reason: [] };
-    for (const validator of this.#validators) {
+    for (const validator of this.validators) {
       const result = await validator.validateTx(tx);
       if (result.result === 'invalid') {
         aggregate.result = 'invalid';

package/src/msg_validators/tx_validator/allowed_public_setup.ts

@@ -1,33 +1,47 @@
-import { FPCContract } from '@aztec/noir-contracts.js/FPC';
 import { TokenContractArtifact } from '@aztec/noir-contracts.js/Token';
 import { ProtocolContractAddress } from '@aztec/protocol-contracts';
+import { FunctionSelector } from '@aztec/stdlib/abi';
 import { getContractClassFromArtifact } from '@aztec/stdlib/contract';
 import type { AllowedElement } from '@aztec/stdlib/interfaces/server';
 
-let defaultAllowedSetupFunctions: AllowedElement[] | undefined = undefined;
+let defaultAllowedSetupFunctions: AllowedElement[] | undefined;
+
+/** Returns the default list of functions allowed to run in the setup phase of a transaction. */
 export async function getDefaultAllowedSetupFunctions(): Promise<AllowedElement[]> {
   if (defaultAllowedSetupFunctions === undefined) {
+    const tokenClassId = (await getContractClassFromArtifact(TokenContractArtifact)).id;
+    const setAuthorizedInternalSelector = await FunctionSelector.fromSignature('_set_authorized((Field),Field,bool)');
+    const setAuthorizedSelector = await FunctionSelector.fromSignature('set_authorized(Field,bool)');
+    const increaseBalanceSelector = await FunctionSelector.fromSignature('_increase_public_balance((Field),u128)');
+    const transferInPublicSelector = await FunctionSelector.fromSignature(
+      'transfer_in_public((Field),(Field),u128,Field)',
+    );
+
     defaultAllowedSetupFunctions = [
-      // needed for authwit support
+      // AuthRegistry: needed for authwit support via private path (set_authorized_private enqueues _set_authorized)
+      {
+        address: ProtocolContractAddress.AuthRegistry,
+        selector: setAuthorizedInternalSelector,
+      },
+      // AuthRegistry: needed for authwit support via public path (PublicFeePaymentMethod calls set_authorized directly)
       {
         address: ProtocolContractAddress.AuthRegistry,
+        selector: setAuthorizedSelector,
       },
-      // needed for claiming on the same tx as a spend
+      // FeeJuice: needed for claiming on the same tx as a spend (claim_and_end_setup enqueues this)
       {
         address: ProtocolContractAddress.FeeJuice,
-        // We can't restrict the selector because public functions get routed via dispatch.
-        // selector: FunctionSelector.fromSignature('_increase_public_balance((Field),u128)'),
+        selector: increaseBalanceSelector,
       },
-      // needed for private transfers via FPC
+      // Token: needed for private transfers via FPC (transfer_to_public enqueues this)
       {
-        classId: (await getContractClassFromArtifact(TokenContractArtifact)).id,
-        // We can't restrict the selector because public functions get routed via dispatch.
-        // selector: FunctionSelector.fromSignature('_increase_public_balance((Field),u128)'),
+        classId: tokenClassId,
+        selector: increaseBalanceSelector,
       },
+      // Token: needed for public transfers via FPC (fee_entrypoint_public enqueues this)
       {
-        classId: (await getContractClassFromArtifact(FPCContract.artifact)).id,
-        // We can't restrict the selector because public functions get routed via dispatch.
-        // selector: FunctionSelector.fromSignature('prepare_fee((Field),Field,(Field),Field)'),
+        classId: tokenClassId,
+        selector: transferInPublicSelector,
       },
     ];
   }