@aztec/p2p 0.0.1-commit.7b97ef96e → 0.0.1-commit.7cbc774

package/dest/msg_validators/tx_validator/gas_validator.js

@@ -1,58 +1,41 @@
-import { AVM_MAX_PROCESSABLE_L2_GAS, FIXED_DA_GAS, FIXED_L2_GAS } from '@aztec/constants';
+import { MAX_PROCESSABLE_DA_GAS_PER_CHECKPOINT, MAX_PROCESSABLE_L2_GAS, PRIVATE_TX_L2_GAS_OVERHEAD, PUBLIC_TX_L2_GAS_OVERHEAD, TX_DA_GAS_OVERHEAD } from '@aztec/constants';
 import { createLogger } from '@aztec/foundation/log';
 import { computeFeePayerBalanceStorageSlot } from '@aztec/protocol-contracts/fee-juice';
 import { Gas } from '@aztec/stdlib/gas';
 import { TX_ERROR_GAS_LIMIT_TOO_HIGH, TX_ERROR_INSUFFICIENT_FEE_PAYER_BALANCE, TX_ERROR_INSUFFICIENT_FEE_PER_GAS, TX_ERROR_INSUFFICIENT_GAS_LIMIT } from '@aztec/stdlib/tx';
 import { getFeePayerClaimAmount, getTxFeeLimit } from './fee_payer_balance.js';
-export class GasTxValidator {
+/**
+ * Validates that a transaction's gas limits are within acceptable bounds.
+ *
+ * Rejects transactions whose gas limits fall below the fixed minimums (FIXED_DA_GAS,
+ * FIXED_L2_GAS) or exceed the AVM's maximum processable L2 gas. This is a cheap,
+ * stateless check that operates on gas settings alone.
+ *
+ * Generic over T so it can validate both full {@link Tx} objects and {@link TxMetaData}
+ * (used during pending pool migration).
+ *
+ * Used by: pending pool migration (via factory), and indirectly by {@link GasTxValidator}.
+ */ export class GasLimitsValidator {
     #log;
-    #publicDataSource;
-    #feeJuiceAddress;
-    #gasFees;
-    constructor(publicDataSource, feeJuiceAddress, gasFees, bindings){
-        this.#log = createLogger('sequencer:tx_validator:tx_gas', bindings);
-        this.#publicDataSource = publicDataSource;
-        this.#feeJuiceAddress = feeJuiceAddress;
-        this.#gasFees = gasFees;
-    }
-    async validateTx(tx) {
-        const gasLimitValidation = this.#validateGasLimit(tx);
-        if (gasLimitValidation.result === 'invalid') {
-            return Promise.resolve(gasLimitValidation);
-        }
-        if (this.#shouldSkip(tx)) {
-            return Promise.resolve({
-                result: 'skipped',
-                reason: [
-                    TX_ERROR_INSUFFICIENT_FEE_PER_GAS
-                ]
-            });
-        }
-        return await this.validateTxFee(tx);
+    #effectiveMaxL2Gas;
+    #effectiveMaxDAGas;
+    #rollupManaLimit;
+    #maxBlockL2Gas;
+    #maxBlockDAGas;
+    constructor(opts){
+        this.#log = createLogger('sequencer:tx_validator:tx_gas', opts?.bindings);
+        this.#rollupManaLimit = opts?.rollupManaLimit ?? Infinity;
+        this.#maxBlockL2Gas = opts?.maxBlockL2Gas ?? Infinity;
+        this.#maxBlockDAGas = opts?.maxBlockDAGas ?? Infinity;
+        this.#effectiveMaxL2Gas = Math.min(MAX_PROCESSABLE_L2_GAS, this.#rollupManaLimit, this.#maxBlockL2Gas);
+        this.#effectiveMaxDAGas = Math.min(MAX_PROCESSABLE_DA_GAS_PER_CHECKPOINT, this.#maxBlockDAGas);
     }
-    /**
-   * Check whether the tx's max fees are valid for the current block, and skip if not.
-   * We skip instead of invalidating since the tx may become eligible later.
-   * Note that circuits check max fees even if fee payer is unset, so we
-   * keep this validation even if the tx does not pay fees.
-   */ #shouldSkip(tx) {
-        const gasSettings = tx.data.constants.txContext.gasSettings;
-        // Skip the tx if its max fees are not enough for the current block's gas fees.
-        const maxFeesPerGas = gasSettings.maxFeesPerGas;
-        const notEnoughMaxFees = maxFeesPerGas.feePerDaGas < this.#gasFees.feePerDaGas || maxFeesPerGas.feePerL2Gas < this.#gasFees.feePerL2Gas;
-        if (notEnoughMaxFees) {
-            this.#log.verbose(`Skipping transaction ${tx.getTxHash().toString()} due to insufficient fee per gas`, {
-                txMaxFeesPerGas: maxFeesPerGas.toInspect(),
-                currentGasFees: this.#gasFees.toInspect()
-            });
-        }
-        return notEnoughMaxFees;
+    validateTx(tx) {
+        return Promise.resolve(this.validateGasLimit(tx));
     }
-    /**
-   * Check whether the tx's gas limit is above the minimum amount.
-   */ #validateGasLimit(tx) {
+    /** Checks gas limits are >= fixed minimums and <= effective max gas (L2 and DA). */ validateGasLimit(tx) {
         const gasLimits = tx.data.constants.txContext.gasSettings.gasLimits;
-        const minGasLimits = new Gas(FIXED_DA_GAS, FIXED_L2_GAS);
+        const minGasLimits = new Gas(TX_DA_GAS_OVERHEAD, tx.data.forPublic ? PUBLIC_TX_L2_GAS_OVERHEAD : PRIVATE_TX_L2_GAS_OVERHEAD);
         if (minGasLimits.gtAny(gasLimits)) {
             this.#log.verbose(`Rejecting transaction due to the gas limit(s) not being above the minimum gas limit`, {
                 gasLimits,
@@ -61,19 +44,74 @@ export class GasTxValidator {
             return {
                 result: 'invalid',
                 reason: [
-                    TX_ERROR_INSUFFICIENT_GAS_LIMIT
+                    `${TX_ERROR_INSUFFICIENT_GAS_LIMIT} (required=da:${minGasLimits.daGas},l2:${minGasLimits.l2Gas} got=da:${gasLimits.daGas},l2:${gasLimits.l2Gas})`
                 ]
             };
         }
-        if (gasLimits.l2Gas > AVM_MAX_PROCESSABLE_L2_GAS) {
-            this.#log.verbose(`Rejecting transaction due to the gas limit(s) being higher than the maximum processable gas`, {
+        if (gasLimits.l2Gas > this.#effectiveMaxL2Gas) {
+            this.#log.verbose(`Rejecting transaction due to the L2 gas limit being higher than the effective maximum`, {
                 gasLimits,
-                minGasLimits
+                effectiveMaxL2Gas: this.#effectiveMaxL2Gas,
+                rollupManaLimit: this.#rollupManaLimit,
+                maxBlockL2Gas: this.#maxBlockL2Gas
+            });
+            return {
+                result: 'invalid',
+                reason: [
+                    `${TX_ERROR_GAS_LIMIT_TOO_HIGH} (l2Gas=${gasLimits.l2Gas}, max=${this.#effectiveMaxL2Gas})`
+                ]
+            };
+        }
+        if (gasLimits.daGas > this.#effectiveMaxDAGas) {
+            this.#log.verbose(`Rejecting transaction due to the DA gas limit being higher than the effective maximum`, {
+                gasLimits,
+                effectiveMaxDAGas: this.#effectiveMaxDAGas,
+                maxBlockDAGas: this.#maxBlockDAGas
+            });
+            return {
+                result: 'invalid',
+                reason: [
+                    `${TX_ERROR_GAS_LIMIT_TOO_HIGH} (daGas=${gasLimits.daGas}, max=${this.#effectiveMaxDAGas})`
+                ]
+            };
+        }
+        return {
+            result: 'valid'
+        };
+    }
+}
+/**
+ * Validates that a transaction's max fee per gas meets the current block's gas fees.
+ *
+ * Rejects transactions whose maxFeesPerGas is below the current block's gas fees
+ * on either dimension (DA or L2). This is a cheap, stateless check.
+ *
+ * Generic over T so it can validate both full {@link Tx} objects and {@link TxMetaData}
+ * (used during pending pool migration).
+ *
+ * Used by: pending pool migration (via factory), and indirectly by {@link GasTxValidator}.
+ */ export class MaxFeePerGasValidator {
+    #log;
+    #gasFees;
+    constructor(gasFees, bindings){
+        this.#log = createLogger('sequencer:tx_validator:tx_gas', bindings);
+        this.#gasFees = gasFees;
+    }
+    validateTx(tx) {
+        return Promise.resolve(this.validateMaxFeePerGas(tx));
+    }
+    /** Checks maxFeesPerGas >= current block gas fees on both dimensions. */ validateMaxFeePerGas(tx) {
+        const maxFeesPerGas = tx.data.constants.txContext.gasSettings.maxFeesPerGas;
+        const notEnoughMaxFees = maxFeesPerGas.feePerDaGas < this.#gasFees.feePerDaGas || maxFeesPerGas.feePerL2Gas < this.#gasFees.feePerL2Gas;
+        if (notEnoughMaxFees) {
+            this.#log.verbose(`Rejecting transaction ${tx.txHash.toString()} due to insufficient fee per gas`, {
+                txMaxFeesPerGas: maxFeesPerGas.toInspect(),
+                currentGasFees: this.#gasFees.toInspect()
             });
             return {
                 result: 'invalid',
                 reason: [
-                    TX_ERROR_GAS_LIMIT_TOO_HIGH
+                    `${TX_ERROR_INSUFFICIENT_FEE_PER_GAS} (maxFee=da:${maxFeesPerGas.feePerDaGas},l2:${maxFeesPerGas.feePerL2Gas} required=da:${this.#gasFees.feePerDaGas},l2:${this.#gasFees.feePerL2Gas})`
                 ]
             };
         }
@@ -81,7 +119,53 @@ export class GasTxValidator {
             result: 'valid'
         };
     }
-    async validateTxFee(tx) {
+}
+/**
+ * Validates that a transaction can pay its gas fees.
+ *
+ * Runs three checks in order:
+ * 1. **Gas limits** (delegates to {@link GasLimitsValidator}) — rejects if limits are
+ *    out of bounds.
+ * 2. **Max fee per gas** — rejects the tx if its maxFeesPerGas is below
+ *    the current block's gas fees.
+ * 3. **Fee payer balance** — reads the fee payer's FeeJuice balance from public state,
+ *    adds any pending claim from a setup-phase `_increase_public_balance` call, and
+ *    rejects if the total is less than the tx's fee limit (gasLimits * maxFeePerGas).
+ *
+ * Used by: gossip (stage 1), RPC, and block building validators.
+ */ export class GasTxValidator {
+    bindings;
+    #log;
+    #publicDataSource;
+    #feeJuiceAddress;
+    #gasFees;
+    #gasLimitOpts;
+    constructor(publicDataSource, feeJuiceAddress, gasFees, bindings, opts){
+        this.bindings = bindings;
+        this.#log = createLogger('sequencer:tx_validator:tx_gas', bindings);
+        this.#publicDataSource = publicDataSource;
+        this.#feeJuiceAddress = feeJuiceAddress;
+        this.#gasFees = gasFees;
+        this.#gasLimitOpts = opts;
+    }
+    async validateTx(tx) {
+        const gasLimitValidation = new GasLimitsValidator({
+            ...this.#gasLimitOpts,
+            bindings: this.bindings
+        }).validateGasLimit(tx);
+        if (gasLimitValidation.result === 'invalid') {
+            return gasLimitValidation;
+        }
+        const maxFeeValidation = new MaxFeePerGasValidator(this.#gasFees, this.bindings).validateMaxFeePerGas(tx);
+        if (maxFeeValidation.result === 'invalid') {
+            return maxFeeValidation;
+        }
+        return await this.validateTxFee(tx);
+    }
+    /**
+   * Checks the fee payer has enough FeeJuice balance to cover the tx's fee limit.
+   * Accounts for any pending claim from a setup-phase `_increase_public_balance` call.
+   */ async validateTxFee(tx) {
         const feePayer = tx.data.feePayer;
         // Compute the maximum fee that this tx may pay, based on its gasLimits and maxFeePerGas
         const feeLimit = getTxFeeLimit(tx);
@@ -99,7 +183,7 @@ export class GasTxValidator {
             return {
                 result: 'invalid',
                 reason: [
-                    TX_ERROR_INSUFFICIENT_FEE_PAYER_BALANCE
+                    `${TX_ERROR_INSUFFICIENT_FEE_PAYER_BALANCE} (required=${feeLimit}, available=${balance})`
                 ]
             };
         }

package/dest/msg_validators/tx_validator/index.d.ts

@@ -8,8 +8,12 @@ export * from './gas_validator.js';
 export * from './phases_validator.js';
 export * from './test_utils.js';
 export * from './allowed_public_setup.js';
+export * from './allowed_setup_helpers.js';
 export * from './archive_cache.js';
 export * from './tx_permitted_validator.js';
 export * from './timestamp_validator.js';
 export * from './size_validator.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tc2dfdmFsaWRhdG9ycy90eF92YWxpZGF0b3IvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYywyQkFBMkIsQ0FBQztBQUMxQyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLHFCQUFxQixDQUFDIn0=
+export * from './factory.js';
+export * from './tx_validation_cache.js';
+export * from './cached_tx_validator.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9tc2dfdmFsaWRhdG9ycy90eF92YWxpZGF0b3IvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYywyQkFBMkIsQ0FBQztBQUMxQyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDIn0=

package/dest/msg_validators/tx_validator/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/msg_validators/tx_validator/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/msg_validators/tx_validator/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,oBAAoB,CAAC;AACnC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC"}

package/dest/msg_validators/tx_validator/index.js

@@ -8,7 +8,11 @@ export * from './gas_validator.js';
 export * from './phases_validator.js';
 export * from './test_utils.js';
 export * from './allowed_public_setup.js';
+export * from './allowed_setup_helpers.js';
 export * from './archive_cache.js';
 export * from './tx_permitted_validator.js';
 export * from './timestamp_validator.js';
 export * from './size_validator.js';
+export * from './factory.js';
+export * from './tx_validation_cache.js';
+export * from './cached_tx_validator.js';

package/dest/msg_validators/tx_validator/metadata_validator.d.ts

@@ -12,4 +12,4 @@ export declare class MetadataTxValidator<T extends AnyTx> implements TxValidator
     }, bindings?: LoggerBindings);
     validateTx(tx: T): Promise<TxValidationResult>;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWV0YWRhdGFfdmFsaWRhdG9yLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbXNnX3ZhbGlkYXRvcnMvdHhfdmFsaWRhdG9yL21ldGFkYXRhX3ZhbGlkYXRvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssRUFBRSxFQUFFLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUN6RCxPQUFPLEVBQWUsS0FBSyxjQUFjLEVBQWdCLE1BQU0sdUJBQXVCLENBQUM7QUFDdkYsT0FBTyxFQUNMLEtBQUssS0FBSyxFQUtWLEtBQUssa0JBQWtCLEVBQ3ZCLEtBQUssV0FBVyxFQUNqQixNQUFNLGtCQUFrQixDQUFDO0FBRTFCLHFCQUFhLG1CQUFtQixDQUFDLENBQUMsU0FBUyxLQUFLLENBQUUsWUFBVyxXQUFXLENBQUMsQ0FBQyxDQUFDOztJQUl2RSxPQUFPLENBQUMsTUFBTTtJQURoQixZQUNVLE1BQU0sRUFBRTtRQUNkLFNBQVMsRUFBRSxFQUFFLENBQUM7UUFDZCxhQUFhLEVBQUUsRUFBRSxDQUFDO1FBQ2xCLFVBQVUsRUFBRSxFQUFFLENBQUM7UUFDZixxQkFBcUIsRUFBRSxFQUFFLENBQUM7S0FDM0IsRUFDRCxRQUFRLENBQUMsRUFBRSxjQUFjLEVBRzFCO0lBRUQsVUFBVSxDQUFDLEVBQUUsRUFBRSxDQUFDLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixDQUFDLENBZTdDO0NBcURGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWV0YWRhdGFfdmFsaWRhdG9yLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbXNnX3ZhbGlkYXRvcnMvdHhfdmFsaWRhdG9yL21ldGFkYXRhX3ZhbGlkYXRvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssRUFBRSxFQUFFLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUN6RCxPQUFPLEVBQWUsS0FBSyxjQUFjLEVBQWdCLE1BQU0sdUJBQXVCLENBQUM7QUFDdkYsT0FBTyxFQUNMLEtBQUssS0FBSyxFQUtWLEtBQUssa0JBQWtCLEVBQ3ZCLEtBQUssV0FBVyxFQUNqQixNQUFNLGtCQUFrQixDQUFDO0FBRTFCLHFCQUFhLG1CQUFtQixDQUFDLENBQUMsU0FBUyxLQUFLLENBQUUsWUFBVyxXQUFXLENBQUMsQ0FBQyxDQUFDOztJQUl2RSxPQUFPLENBQUMsTUFBTTtJQURoQixZQUNVLE1BQU0sRUFBRTtRQUNkLFNBQVMsRUFBRSxFQUFFLENBQUM7UUFDZCxhQUFhLEVBQUUsRUFBRSxDQUFDO1FBQ2xCLFVBQVUsRUFBRSxFQUFFLENBQUM7UUFDZixxQkFBcUIsRUFBRSxFQUFFLENBQUM7S0FDM0IsRUFDRCxRQUFRLENBQUMsRUFBRSxjQUFjLEVBRzFCO0lBRUQsVUFBVSxDQUFDLEVBQUUsRUFBRSxDQUFDLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixDQUFDLENBdUI3QztDQXFERiJ9

package/dest/msg_validators/tx_validator/metadata_validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metadata_validator.d.ts","sourceRoot":"","sources":["../../../src/msg_validators/tx_validator/metadata_validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACzD,OAAO,EAAe,KAAK,cAAc,EAAgB,MAAM,uBAAuB,CAAC;AACvF,OAAO,EACL,KAAK,KAAK,EAKV,KAAK,kBAAkB,EACvB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAE1B,qBAAa,mBAAmB,CAAC,CAAC,SAAS,KAAK,CAAE,YAAW,WAAW,CAAC,CAAC,CAAC;;IAIvE,OAAO,CAAC,MAAM;IADhB,YACU,MAAM,EAAE;QACd,SAAS,EAAE,EAAE,CAAC;QACd,aAAa,EAAE,EAAE,CAAC;QAClB,UAAU,EAAE,EAAE,CAAC;QACf,qBAAqB,EAAE,EAAE,CAAC;KAC3B,EACD,QAAQ,CAAC,EAAE,cAAc,EAG1B;IAED,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAe7C;CAqDF"}
+{"version":3,"file":"metadata_validator.d.ts","sourceRoot":"","sources":["../../../src/msg_validators/tx_validator/metadata_validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gCAAgC,CAAC;AACzD,OAAO,EAAe,KAAK,cAAc,EAAgB,MAAM,uBAAuB,CAAC;AACvF,OAAO,EACL,KAAK,KAAK,EAKV,KAAK,kBAAkB,EACvB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAE1B,qBAAa,mBAAmB,CAAC,CAAC,SAAS,KAAK,CAAE,YAAW,WAAW,CAAC,CAAC,CAAC;;IAIvE,OAAO,CAAC,MAAM;IADhB,YACU,MAAM,EAAE;QACd,SAAS,EAAE,EAAE,CAAC;QACd,aAAa,EAAE,EAAE,CAAC;QAClB,UAAU,EAAE,EAAE,CAAC;QACf,qBAAqB,EAAE,EAAE,CAAC;KAC3B,EACD,QAAQ,CAAC,EAAE,cAAc,EAG1B;IAED,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuB7C;CAqDF"}

package/dest/msg_validators/tx_validator/metadata_validator.js

@@ -10,16 +10,16 @@ export class MetadataTxValidator {
     validateTx(tx) {
         const errors = [];
         if (!this.#hasCorrectL1ChainId(tx)) {
-            errors.push(TX_ERROR_INCORRECT_L1_CHAIN_ID);
+            errors.push(`${TX_ERROR_INCORRECT_L1_CHAIN_ID} (tx: ${tx.data.constants.txContext.chainId.toNumber()}, expected: ${this.values.l1ChainId.toNumber()})`);
         }
         if (!this.#hasCorrectRollupVersion(tx)) {
-            errors.push(TX_ERROR_INCORRECT_ROLLUP_VERSION);
+            errors.push(`${TX_ERROR_INCORRECT_ROLLUP_VERSION} (tx: ${tx.data.constants.txContext.version.toNumber()}, expected: ${this.values.rollupVersion.toNumber()})`);
         }
         if (!this.#hasCorrectVkTreeRoot(tx)) {
-            errors.push(TX_ERROR_INCORRECT_VK_TREE_ROOT);
+            errors.push(`${TX_ERROR_INCORRECT_VK_TREE_ROOT} (tx: ${tx.data.constants.vkTreeRoot.toString()}, expected: ${this.values.vkTreeRoot.toString()})`);
         }
         if (!this.#hasCorrectprotocolContractsHash(tx)) {
-            errors.push(TX_ERROR_INCORRECT_PROTOCOL_CONTRACTS_HASH);
+            errors.push(`${TX_ERROR_INCORRECT_PROTOCOL_CONTRACTS_HASH} (tx: ${tx.data.constants.protocolContractsHash.toString()}, expected: ${this.values.protocolContractsHash.toString()})`);
         }
         return Promise.resolve(errors.length > 0 ? {
             result: 'invalid',

package/dest/msg_validators/tx_validator/nullifier_cache.d.ts

@@ -0,0 +1,14 @@
+import type { NullifierSource } from '@aztec/p2p';
+import type { MerkleTreeReadOperations } from '@aztec/stdlib/interfaces/server';
+/**
+ * Implements a nullifier source by checking a DB and an in-memory collection.
+ * Intended for validating transactions as they are added to a block.
+ */
+export declare class NullifierCache implements NullifierSource {
+    private db;
+    nullifiers: Set<string>;
+    constructor(db: MerkleTreeReadOperations);
+    nullifiersExist(nullifiers: Buffer[]): Promise<boolean[]>;
+    addNullifiers(nullifiers: Buffer[]): void;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibnVsbGlmaWVyX2NhY2hlLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbXNnX3ZhbGlkYXRvcnMvdHhfdmFsaWRhdG9yL251bGxpZmllcl9jYWNoZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssRUFBRSxlQUFlLEVBQUUsTUFBTSxZQUFZLENBQUM7QUFDbEQsT0FBTyxLQUFLLEVBQUUsd0JBQXdCLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUdoRjs7O0dBR0c7QUFDSCxxQkFBYSxjQUFlLFlBQVcsZUFBZTtJQUd4QyxPQUFPLENBQUMsRUFBRTtJQUZ0QixVQUFVLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBRXhCLFlBQW9CLEVBQUUsRUFBRSx3QkFBd0IsRUFFL0M7SUFFWSxlQUFlLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxHQUFHLE9BQU8sQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQU9yRTtJQUVNLGFBQWEsQ0FBQyxVQUFVLEVBQUUsTUFBTSxFQUFFLFFBSXhDO0NBQ0YifQ==

package/dest/msg_validators/tx_validator/nullifier_cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nullifier_cache.d.ts","sourceRoot":"","sources":["../../../src/msg_validators/tx_validator/nullifier_cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAGhF;;;GAGG;AACH,qBAAa,cAAe,YAAW,eAAe;IAGxC,OAAO,CAAC,EAAE;IAFtB,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAExB,YAAoB,EAAE,EAAE,wBAAwB,EAE/C;IAEY,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAOrE;IAEM,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,QAIxC;CACF"}

package/dest/msg_validators/tx_validator/nullifier_cache.js

@@ -0,0 +1,24 @@
+import { MerkleTreeId } from '@aztec/stdlib/trees';
+/**
+ * Implements a nullifier source by checking a DB and an in-memory collection.
+ * Intended for validating transactions as they are added to a block.
+ */ export class NullifierCache {
+    db;
+    nullifiers;
+    constructor(db){
+        this.db = db;
+        this.nullifiers = new Set();
+    }
+    async nullifiersExist(nullifiers) {
+        const cacheResults = nullifiers.map((n)=>this.nullifiers.has(n.toString()));
+        const toCheckDb = nullifiers.filter((_n, index)=>!cacheResults[index]);
+        const dbHits = await this.db.findLeafIndices(MerkleTreeId.NULLIFIER_TREE, toCheckDb);
+        let dbIndex = 0;
+        return nullifiers.map((_n, index)=>cacheResults[index] || dbHits[dbIndex++] !== undefined);
+    }
+    addNullifiers(nullifiers) {
+        for (const nullifier of nullifiers){
+            this.nullifiers.add(nullifier.toString());
+        }
+    }
+}

package/dest/msg_validators/tx_validator/phases_validator.d.ts

@@ -10,6 +10,26 @@ export declare class PhasesTxValidator implements TxValidator<Tx> {
     private contractsDB;
     constructor(contracts: ContractDataSource, setupAllowList: AllowedElement[], timestamp: UInt64, bindings?: LoggerBindings);
     validateTx(tx: Tx): Promise<TxValidationResult>;
-    private isOnAllowList;
+    private checkAllowList;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGhhc2VzX3ZhbGlkYXRvci5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL21zZ192YWxpZGF0b3JzL3R4X3ZhbGlkYXRvci9waGFzZXNfdmFsaWRhdG9yLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBZSxLQUFLLGNBQWMsRUFBZ0IsTUFBTSx1QkFBdUIsQ0FBQztBQUV2RixPQUFPLEtBQUssRUFBRSxrQkFBa0IsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ2pFLE9BQU8sS0FBSyxFQUFFLGNBQWMsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQ3RFLE9BQU8sRUFJTCxFQUFFLEVBRUYsS0FBSyxrQkFBa0IsRUFDdkIsS0FBSyxXQUFXLEVBQ2pCLE1BQU0sa0JBQWtCLENBQUM7QUFDMUIsT0FBTyxLQUFLLEVBQUUsTUFBTSxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFFbEQscUJBQWEsaUJBQWtCLFlBQVcsV0FBVyxDQUFDLEVBQUUsQ0FBQzs7SUFNckQsT0FBTyxDQUFDLGNBQWM7SUFDdEIsT0FBTyxDQUFDLFNBQVM7SUFMbkIsT0FBTyxDQUFDLFdBQVcsQ0FBb0I7SUFFdkMsWUFDRSxTQUFTLEVBQUUsa0JBQWtCLEVBQ3JCLGNBQWMsRUFBRSxjQUFjLEVBQUUsRUFDaEMsU0FBUyxFQUFFLE1BQU0sRUFDekIsUUFBUSxDQUFDLEVBQUUsY0FBYyxFQUkxQjtJQUVLLFVBQVUsQ0FBQyxFQUFFLEVBQUUsRUFBRSxHQUFHLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQyxDQXFDcEQ7WUFFYSxhQUFhO0NBaUQ1QiJ9
+/** Structural interface for the allowed-setup-calls flag check. */
+export interface HasAllowedSetupCallsData {
+    txHash: {
+        toString(): string;
+    };
+    allowedSetupCalls: boolean;
+}
+/**
+ * Validates that a transaction's setup-phase calls were allowed at receipt time.
+ *
+ * Checks the precomputed `allowedSetupCalls` flag on TxMetaData. The flag is
+ * computed by running the PhasesTxValidator on the full Tx when it first enters
+ * the pool. This lightweight validator is used during pending pool migration to
+ * reject txs whose setup calls are not on the allow list.
+ */
+export declare class AllowedSetupCallsMetaValidator<T extends HasAllowedSetupCallsData> implements TxValidator<T> {
+    #private;
+    constructor(bindings?: LoggerBindings);
+    validateTx(tx: T): Promise<TxValidationResult>;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGhhc2VzX3ZhbGlkYXRvci5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL21zZ192YWxpZGF0b3JzL3R4X3ZhbGlkYXRvci9waGFzZXNfdmFsaWRhdG9yLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBZSxLQUFLLGNBQWMsRUFBZ0IsTUFBTSx1QkFBdUIsQ0FBQztBQUd2RixPQUFPLEtBQUssRUFBRSxrQkFBa0IsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ2pFLE9BQU8sS0FBSyxFQUFFLGNBQWMsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQ3RFLE9BQU8sRUFRTCxFQUFFLEVBRUYsS0FBSyxrQkFBa0IsRUFDdkIsS0FBSyxXQUFXLEVBQ2pCLE1BQU0sa0JBQWtCLENBQUM7QUFDMUIsT0FBTyxLQUFLLEVBQUUsTUFBTSxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFFbEQscUJBQWEsaUJBQWtCLFlBQVcsV0FBVyxDQUFDLEVBQUUsQ0FBQzs7SUFNckQsT0FBTyxDQUFDLGNBQWM7SUFDdEIsT0FBTyxDQUFDLFNBQVM7SUFMbkIsT0FBTyxDQUFDLFdBQVcsQ0FBb0I7SUFFdkMsWUFDRSxTQUFTLEVBQUUsa0JBQWtCLEVBQ3JCLGNBQWMsRUFBRSxjQUFjLEVBQUUsRUFDaEMsU0FBUyxFQUFFLE1BQU0sRUFDekIsUUFBUSxDQUFDLEVBQUUsY0FBYyxFQUkxQjtJQUVLLFVBQVUsQ0FBQyxFQUFFLEVBQUUsRUFBRSxHQUFHLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQyxDQXNDcEQ7WUFHYSxjQUFjO0NBa0U3QjtBQUVELG1FQUFtRTtBQUNuRSxNQUFNLFdBQVcsd0JBQXdCO0lBQ3ZDLE1BQU0sRUFBRTtRQUFFLFFBQVEsSUFBSSxNQUFNLENBQUE7S0FBRSxDQUFDO0lBQy9CLGlCQUFpQixFQUFFLE9BQU8sQ0FBQztDQUM1QjtBQUVEOzs7Ozs7O0dBT0c7QUFDSCxxQkFBYSw4QkFBOEIsQ0FBQyxDQUFDLFNBQVMsd0JBQXdCLENBQUUsWUFBVyxXQUFXLENBQUMsQ0FBQyxDQUFDOztJQUd2RyxZQUFZLFFBQVEsQ0FBQyxFQUFFLGNBQWMsRUFFcEM7SUFFRCxVQUFVLENBQUMsRUFBRSxFQUFFLENBQUMsR0FBRyxPQUFPLENBQUMsa0JBQWtCLENBQUMsQ0FNN0M7Q0FDRiJ9

package/dest/msg_validators/tx_validator/phases_validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"phases_validator.d.ts","sourceRoot":"","sources":["../../../src/msg_validators/tx_validator/phases_validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,cAAc,EAAgB,MAAM,uBAAuB,CAAC;AAEvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAIL,EAAE,EAEF,KAAK,kBAAkB,EACvB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,qBAAa,iBAAkB,YAAW,WAAW,CAAC,EAAE,CAAC;;IAMrD,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,SAAS;IALnB,OAAO,CAAC,WAAW,CAAoB;IAEvC,YACE,SAAS,EAAE,kBAAkB,EACrB,cAAc,EAAE,cAAc,EAAE,EAChC,SAAS,EAAE,MAAM,EACzB,QAAQ,CAAC,EAAE,cAAc,EAI1B;IAEK,UAAU,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAqCpD;YAEa,aAAa;CAiD5B"}
+{"version":3,"file":"phases_validator.d.ts","sourceRoot":"","sources":["../../../src/msg_validators/tx_validator/phases_validator.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,cAAc,EAAgB,MAAM,uBAAuB,CAAC;AAGvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAQL,EAAE,EAEF,KAAK,kBAAkB,EACvB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,qBAAa,iBAAkB,YAAW,WAAW,CAAC,EAAE,CAAC;;IAMrD,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,SAAS;IALnB,OAAO,CAAC,WAAW,CAAoB;IAEvC,YACE,SAAS,EAAE,kBAAkB,EACrB,cAAc,EAAE,cAAc,EAAE,EAChC,SAAS,EAAE,MAAM,EACzB,QAAQ,CAAC,EAAE,cAAc,EAI1B;IAEK,UAAU,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsCpD;YAGa,cAAc;CAkE7B;AAED,mEAAmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE;QAAE,QAAQ,IAAI,MAAM,CAAA;KAAE,CAAC;IAC/B,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,8BAA8B,CAAC,CAAC,SAAS,wBAAwB,CAAE,YAAW,WAAW,CAAC,CAAC,CAAC;;IAGvG,YAAY,QAAQ,CAAC,EAAE,cAAc,EAEpC;IAED,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAM7C;CACF"}

package/dest/msg_validators/tx_validator/phases_validator.js

@@ -1,6 +1,8 @@
+import { NULL_MSG_SENDER_CONTRACT_ADDRESS } from '@aztec/constants';
 import { createLogger } from '@aztec/foundation/log';
 import { PublicContractsDB, getCallRequestsWithCalldataByPhase } from '@aztec/simulator/server';
-import { TX_ERROR_DURING_VALIDATION, TX_ERROR_SETUP_FUNCTION_NOT_ALLOWED, TxExecutionPhase } from '@aztec/stdlib/tx';
+import { AztecAddress } from '@aztec/stdlib/aztec-address';
+import { TX_ERROR_DURING_VALIDATION, TX_ERROR_SETUP_FUNCTION_NOT_ALLOWED, TX_ERROR_SETUP_FUNCTION_UNKNOWN_CONTRACT, TX_ERROR_SETUP_NULL_MSG_SENDER, TX_ERROR_SETUP_ONLY_SELF_WRONG_SENDER, TX_ERROR_SETUP_WRONG_CALLDATA_LENGTH, TxExecutionPhase } from '@aztec/stdlib/tx';
 export class PhasesTxValidator {
     setupAllowList;
     timestamp;
@@ -19,7 +21,7 @@ export class PhasesTxValidator {
             // which are needed for public FPC flows, but fail if the account contract hasnt been deployed yet,
             // which is what we're trying to do as part of the current txs.
             // We only need to create/revert checkpoint here because of this addNewContracts call.
-            await this.contractsDB.addNewContracts(tx);
+            this.contractsDB.addNewContracts(tx);
             if (!tx.data.forPublic) {
                 this.#log.debug(`Tx ${tx.getTxHash().toString()} does not contain enqueued public functions. Skipping phases validation.`);
                 return {
@@ -28,14 +30,15 @@ export class PhasesTxValidator {
             }
             const setupFns = getCallRequestsWithCalldataByPhase(tx, TxExecutionPhase.SETUP);
             for (const setupFn of setupFns){
-                if (!await this.isOnAllowList(setupFn, this.setupAllowList)) {
+                const rejectionReason = await this.checkAllowList(setupFn, this.setupAllowList);
+                if (rejectionReason) {
                     this.#log.verbose(`Rejecting tx ${tx.getTxHash().toString()} because it calls setup function not on allow list: ${setupFn.request.contractAddress}:${setupFn.functionSelector}`, {
                         allowList: this.setupAllowList
                     });
                     return {
                         result: 'invalid',
                         reason: [
-                            TX_ERROR_SETUP_FUNCTION_NOT_ALLOWED
+                            rejectionReason
                         ]
                     };
                 }
@@ -55,39 +58,84 @@ export class PhasesTxValidator {
             this.contractsDB.revertCheckpoint();
         }
     }
-    async isOnAllowList(publicCall, allowList) {
+    /** Returns a rejection reason if the call is not on the allow list, or undefined if it is allowed. */ async checkAllowList(publicCall, allowList) {
         if (publicCall.isEmpty()) {
-            return true;
+            return undefined;
         }
         const contractAddress = publicCall.request.contractAddress;
         const functionSelector = publicCall.functionSelector;
-        // do these checks first since they don't require the contract class
+        // Check address-based entries first since they don't require the contract class.
         for (const entry of allowList){
-            if ('address' in entry && !('selector' in entry)) {
-                if (contractAddress.equals(entry.address)) {
-                    return true;
-                }
-            }
-            if ('address' in entry && 'selector' in entry) {
+            if ('address' in entry) {
                 if (contractAddress.equals(entry.address) && entry.selector.equals(functionSelector)) {
-                    return true;
+                    if (entry.calldataLength !== undefined && publicCall.calldata.length !== entry.calldataLength) {
+                        return TX_ERROR_SETUP_WRONG_CALLDATA_LENGTH;
+                    }
+                    if (entry.onlySelf && !publicCall.request.msgSender.equals(contractAddress)) {
+                        return TX_ERROR_SETUP_ONLY_SELF_WRONG_SENDER;
+                    }
+                    if (entry.rejectNullMsgSender && publicCall.request.msgSender.equals(AztecAddress.fromBigInt(NULL_MSG_SENDER_CONTRACT_ADDRESS))) {
+                        return TX_ERROR_SETUP_NULL_MSG_SENDER;
+                    }
+                    return undefined;
                 }
             }
-            const contractClass = await this.contractsDB.getContractInstance(contractAddress, this.timestamp);
-            if (!contractClass) {
-                throw new Error(`Contract not found: ${contractAddress}`);
+        }
+        // Check class-based entries. Fetch the contract instance lazily (only once).
+        let contractClassId;
+        for (const entry of allowList){
+            if (!('classId' in entry)) {
+                continue;
             }
-            if ('classId' in entry && !('selector' in entry)) {
-                if (contractClass.currentContractClassId.equals(entry.classId)) {
-                    return true;
+            if (contractClassId === undefined) {
+                const instance = await this.contractsDB.getContractInstance(contractAddress, this.timestamp);
+                contractClassId = {
+                    value: instance?.currentContractClassId.toString()
+                };
+                if (!contractClassId.value) {
+                    return TX_ERROR_SETUP_FUNCTION_UNKNOWN_CONTRACT;
                 }
             }
-            if ('classId' in entry && 'selector' in entry) {
-                if (contractClass.currentContractClassId.equals(entry.classId) && (entry.selector === undefined || entry.selector.equals(functionSelector))) {
-                    return true;
+            if (contractClassId.value === entry.classId.toString() && entry.selector.equals(functionSelector)) {
+                if (entry.calldataLength !== undefined && publicCall.calldata.length !== entry.calldataLength) {
+                    return TX_ERROR_SETUP_WRONG_CALLDATA_LENGTH;
+                }
+                if (entry.onlySelf && !publicCall.request.msgSender.equals(contractAddress)) {
+                    return TX_ERROR_SETUP_ONLY_SELF_WRONG_SENDER;
                 }
+                if (entry.rejectNullMsgSender && publicCall.request.msgSender.equals(AztecAddress.fromBigInt(NULL_MSG_SENDER_CONTRACT_ADDRESS))) {
+                    return TX_ERROR_SETUP_NULL_MSG_SENDER;
+                }
+                return undefined;
             }
         }
-        return false;
+        return TX_ERROR_SETUP_FUNCTION_NOT_ALLOWED;
+    }
+}
+/**
+ * Validates that a transaction's setup-phase calls were allowed at receipt time.
+ *
+ * Checks the precomputed `allowedSetupCalls` flag on TxMetaData. The flag is
+ * computed by running the PhasesTxValidator on the full Tx when it first enters
+ * the pool. This lightweight validator is used during pending pool migration to
+ * reject txs whose setup calls are not on the allow list.
+ */ export class AllowedSetupCallsMetaValidator {
+    #log;
+    constructor(bindings){
+        this.#log = createLogger('sequencer:tx_validator:tx_phases_meta', bindings);
+    }
+    validateTx(tx) {
+        if (!tx.allowedSetupCalls) {
+            this.#log.verbose(`Rejecting tx ${tx.txHash} because its setup calls are not on the allow list`);
+            return Promise.resolve({
+                result: 'invalid',
+                reason: [
+                    TX_ERROR_SETUP_FUNCTION_NOT_ALLOWED
+                ]
+            });
+        }
+        return Promise.resolve({
+            result: 'valid'
+        });
     }
 }

package/dest/msg_validators/tx_validator/tx_proof_validator.d.ts

@@ -4,7 +4,8 @@ import { Tx, type TxValidationResult, type TxValidator } from '@aztec/stdlib/tx'
 export declare class TxProofValidator implements TxValidator<Tx> {
     #private;
     private verifier;
+    readonly identifier: symbol;
     constructor(verifier: ClientProtocolCircuitVerifier, bindings?: LoggerBindings);
     validateTx(tx: Tx): Promise<TxValidationResult>;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHhfcHJvb2ZfdmFsaWRhdG9yLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbXNnX3ZhbGlkYXRvcnMvdHhfdmFsaWRhdG9yL3R4X3Byb29mX3ZhbGlkYXRvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQWUsS0FBSyxjQUFjLEVBQWdCLE1BQU0sdUJBQXVCLENBQUM7QUFDdkYsT0FBTyxLQUFLLEVBQUUsNkJBQTZCLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUNyRixPQUFPLEVBQTBCLEVBQUUsRUFBRSxLQUFLLGtCQUFrQixFQUFFLEtBQUssV0FBVyxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFFekcscUJBQWEsZ0JBQWlCLFlBQVcsV0FBVyxDQUFDLEVBQUUsQ0FBQzs7SUFJcEQsT0FBTyxDQUFDLFFBQVE7SUFEbEIsWUFDVSxRQUFRLEVBQUUsNkJBQTZCLEVBQy9DLFFBQVEsQ0FBQyxFQUFFLGNBQWMsRUFHMUI7SUFFSyxVQUFVLENBQUMsRUFBRSxFQUFFLEVBQUUsR0FBRyxPQUFPLENBQUMsa0JBQWtCLENBQUMsQ0FRcEQ7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHhfcHJvb2ZfdmFsaWRhdG9yLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvbXNnX3ZhbGlkYXRvcnMvdHhfdmFsaWRhdG9yL3R4X3Byb29mX3ZhbGlkYXRvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQWUsS0FBSyxjQUFjLEVBQWdCLE1BQU0sdUJBQXVCLENBQUM7QUFDdkYsT0FBTyxLQUFLLEVBQUUsNkJBQTZCLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQUNyRixPQUFPLEVBQTBCLEVBQUUsRUFBRSxLQUFLLGtCQUFrQixFQUFFLEtBQUssV0FBVyxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFFekcscUJBQWEsZ0JBQWlCLFlBQVcsV0FBVyxDQUFDLEVBQUUsQ0FBQzs7SUFNcEQsT0FBTyxDQUFDLFFBQVE7SUFMbEIsU0FBZ0IsVUFBVSxFQUFFLE1BQU0sQ0FBOEI7SUFJaEUsWUFDVSxRQUFRLEVBQUUsNkJBQTZCLEVBQy9DLFFBQVEsQ0FBQyxFQUFFLGNBQWMsRUFHMUI7SUFFSyxVQUFVLENBQUMsRUFBRSxFQUFFLEVBQUUsR0FBRyxPQUFPLENBQUMsa0JBQWtCLENBQUMsQ0FRcEQ7Q0FDRiJ9

package/dest/msg_validators/tx_validator/tx_proof_validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tx_proof_validator.d.ts","sourceRoot":"","sources":["../../../src/msg_validators/tx_validator/tx_proof_validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,cAAc,EAAgB,MAAM,uBAAuB,CAAC;AACvF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAA0B,EAAE,EAAE,KAAK,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEzG,qBAAa,gBAAiB,YAAW,WAAW,CAAC,EAAE,CAAC;;IAIpD,OAAO,CAAC,QAAQ;IADlB,YACU,QAAQ,EAAE,6BAA6B,EAC/C,QAAQ,CAAC,EAAE,cAAc,EAG1B;IAEK,UAAU,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQpD;CACF"}
+{"version":3,"file":"tx_proof_validator.d.ts","sourceRoot":"","sources":["../../../src/msg_validators/tx_validator/tx_proof_validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,cAAc,EAAgB,MAAM,uBAAuB,CAAC;AACvF,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAA0B,EAAE,EAAE,KAAK,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEzG,qBAAa,gBAAiB,YAAW,WAAW,CAAC,EAAE,CAAC;;IAMpD,OAAO,CAAC,QAAQ;IALlB,SAAgB,UAAU,EAAE,MAAM,CAA8B;IAIhE,YACU,QAAQ,EAAE,6BAA6B,EAC/C,QAAQ,CAAC,EAAE,cAAc,EAG1B;IAEK,UAAU,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAQpD;CACF"}

package/dest/msg_validators/tx_validator/tx_proof_validator.js

@@ -2,9 +2,11 @@ import { createLogger } from '@aztec/foundation/log';
 import { TX_ERROR_INVALID_PROOF } from '@aztec/stdlib/tx';
 export class TxProofValidator {
     verifier;
+    identifier;
     #log;
     constructor(verifier, bindings){
         this.verifier = verifier;
+        this.identifier = Symbol('TxProofValidator');
         this.#log = createLogger('p2p:tx_validator:proof', bindings);
     }
     async validateTx(tx) {

package/dest/msg_validators/tx_validator/tx_validation_cache.d.ts

@@ -0,0 +1,48 @@
+import type { Tx, TxValidationResult } from '@aztec/stdlib/tx';
+/**
+ * Minimal interface consumed by {@link CachedTxValidator}.
+ * Keeping the dependency on an interface lets callers (and tests) substitute any cache implementation.
+ */
+export interface ITxValidationCache {
+    /** Returns the cached promise if present, otherwise calls `validate`, caches its promise, and returns it. */
+    getOrValidate(validatorSymbol: symbol, tx: Tx, validate: () => Promise<TxValidationResult>): Promise<TxValidationResult>;
+}
+/**
+ * Caches per-validator tx validation results to avoid redundant work across repeated validation calls.
+ *
+ * The cache key is composed from the validator symbol and tx hash, ensuring results are
+ * scoped to the specific validator that produced them.
+ *
+ * Promises are stored before they are awaited, so concurrent calls for the same pair share
+ * a single in-flight validation rather than launching duplicate work.
+ *
+ * Entries are evicted in least-recently-used order once the cache reaches `maxSize`.
+ */
+export declare class TxValidationCache implements ITxValidationCache {
+    #private;
+    private readonly entries;
+    private readonly txHashesCache;
+    constructor(maxSize: number);
+    /**
+     * Computes the cache key scoping a validation result to a specific validator and tx.
+     *
+     * @param validatorSymbol - The symbol of the validator.
+     * @param tx - The tx to compute the key for.
+     * @returns The cache key.
+     *
+     * Note: the key should NOT use the tx.hash because it can't be trusted at this point.
+     */
+    key(validatorSymbol: symbol, tx: Tx): Promise<string>;
+    /** Returns the cached promise for the given key, or undefined if not cached. Refreshes recency. */
+    get(key: string): Promise<TxValidationResult> | undefined;
+    /** Stores a validation promise under the given key, evicting the LRU entry if at capacity. */
+    set(key: string, result: Promise<TxValidationResult>): void;
+    /** Removes the cached validation promise for the given key. */
+    delete(key: string): void;
+    /**
+     * Returns the cached promise if present, otherwise calls `validate`, stores its promise
+     * immediately (before awaiting), and returns it.
+     */
+    getOrValidate(validatorSymbol: symbol, tx: Tx, validate: () => Promise<TxValidationResult>): Promise<TxValidationResult>;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHhfdmFsaWRhdGlvbl9jYWNoZS5kLnRzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL21zZ192YWxpZGF0b3JzL3R4X3ZhbGlkYXRvci90eF92YWxpZGF0aW9uX2NhY2hlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE9BQU8sS0FBSyxFQUFFLEVBQUUsRUFBRSxrQkFBa0IsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBSS9EOzs7R0FHRztBQUNILE1BQU0sV0FBVyxrQkFBa0I7SUFDakMsNkdBQTZHO0lBQzdHLGFBQWEsQ0FDWCxlQUFlLEVBQUUsTUFBTSxFQUN2QixFQUFFLEVBQUUsRUFBRSxFQUNOLFFBQVEsRUFBRSxNQUFNLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQyxHQUMxQyxPQUFPLENBQUMsa0JBQWtCLENBQUMsQ0FBQztDQUNoQztBQUVEOzs7Ozs7Ozs7O0dBVUc7QUFDSCxxQkFBYSxpQkFBa0IsWUFBVyxrQkFBa0I7O0lBRzFELE9BQU8sQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUE4QztJQUd0RSxPQUFPLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBc0M7SUFFcEUsWUFBWSxPQUFPLEVBQUUsTUFBTSxFQUcxQjtJQUVEOzs7Ozs7OztPQVFHO0lBQ1UsR0FBRyxDQUFDLGVBQWUsRUFBRSxNQUFNLEVBQUUsRUFBRSxFQUFFLEVBQUUsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLENBU2pFO0lBRUQsbUdBQW1HO0lBQzVGLEdBQUcsQ0FBQyxHQUFHLEVBQUUsTUFBTSxHQUFHLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLFNBQVMsQ0FFL0Q7SUFFRCw4RkFBOEY7SUFDdkYsR0FBRyxDQUFDLEdBQUcsRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLElBQUksQ0FFakU7SUFFRCwrREFBK0Q7SUFDeEQsTUFBTSxDQUFDLEdBQUcsRUFBRSxNQUFNLEdBQUcsSUFBSSxDQUUvQjtJQUVEOzs7T0FHRztJQUNVLGFBQWEsQ0FDeEIsZUFBZSxFQUFFLE1BQU0sRUFDdkIsRUFBRSxFQUFFLEVBQUUsRUFDTixRQUFRLEVBQUUsTUFBTSxPQUFPLENBQUMsa0JBQWtCLENBQUMsR0FDMUMsT0FBTyxDQUFDLGtCQUFrQixDQUFDLENBYzdCO0NBQ0YifQ==

package/dest/msg_validators/tx_validator/tx_validation_cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tx_validation_cache.d.ts","sourceRoot":"","sources":["../../../src/msg_validators/tx_validator/tx_validation_cache.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAI/D;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,6GAA6G;IAC7G,aAAa,CACX,eAAe,EAAE,MAAM,EACvB,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,GAC1C,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,qBAAa,iBAAkB,YAAW,kBAAkB;;IAG1D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8C;IAGtE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsC;IAEpE,YAAY,OAAO,EAAE,MAAM,EAG1B;IAED;;;;;;;;OAQG;IACU,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CASjE;IAED,mGAAmG;IAC5F,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAE/D;IAED,8FAA8F;IACvF,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAEjE;IAED,+DAA+D;IACxD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAE/B;IAED;;;OAGG;IACU,aAAa,CACxB,eAAe,EAAE,MAAM,EACvB,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,GAC1C,OAAO,CAAC,kBAAkB,CAAC,CAc7B;CACF"}