@aztec/p2p 0.0.1-commit.96bb3f7 → 0.0.1-commit.993d240

package/src/services/reqresp/interface.ts

@@ -1,13 +1,17 @@
-import { Fr } from '@aztec/foundation/curves/bn254';
-import { L2Block } from '@aztec/stdlib/block';
 import { TxArray, TxHashArray } from '@aztec/stdlib/tx';
 
 import type { PeerId } from '@libp2p/interface';
 
 import type { P2PReqRespConfig } from './config.js';
+import type { ConnectionSampler } from './connection-sampler/connection_sampler.js';
 import { AuthRequest, AuthResponse } from './protocols/auth.js';
-import { BlockTxsRequest, BlockTxsResponse } from './protocols/block_txs/block_txs_reqresp.js';
+import {
+  BlockTxsRequest,
+  BlockTxsResponse,
+  calculateBlockTxsResponseSize,
+} from './protocols/block_txs/block_txs_reqresp.js';
 import { StatusMessage } from './protocols/status.js';
+import { calculateTxResponseSize } from './protocols/tx.js';
 import type { ReqRespStatus } from './status.js';
 
 /*
@@ -17,7 +21,6 @@ export const PING_PROTOCOL = '/aztec/req/ping/1.0.0';
 export const STATUS_PROTOCOL = '/aztec/req/status/1.0.0';
 export const GOODBYE_PROTOCOL = '/aztec/req/goodbye/1.0.0';
 export const TX_REQ_PROTOCOL = '/aztec/req/tx/1.0.0';
-export const BLOCK_REQ_PROTOCOL = '/aztec/req/block/1.0.0';
 export const AUTH_PROTOCOL = '/aztec/req/auth/1.0.0';
 export const BLOCK_TXS_REQ_PROTOCOL = '/aztec/req/block_txs/1.0.0';
 
@@ -26,7 +29,6 @@ export enum ReqRespSubProtocol {
   STATUS = STATUS_PROTOCOL,
   GOODBYE = GOODBYE_PROTOCOL,
   TX = TX_REQ_PROTOCOL,
-  BLOCK = BLOCK_REQ_PROTOCOL,
   AUTH = AUTH_PROTOCOL,
   BLOCK_TXS = BLOCK_TXS_REQ_PROTOCOL,
 }
@@ -76,32 +78,28 @@ export interface ProtocolRateLimitQuota {
   globalLimit: RateLimitQuota;
 }
 
-export const noopValidator = () => Promise.resolve(true);
-
 /**
  * A type mapping from supprotocol to it's handling function
  */
 export type ReqRespSubProtocolHandlers = Record<ReqRespSubProtocol, ReqRespSubProtocolHandler>;
 
-type ResponseValidator<RequestIdentifier, Response> = (
-  request: RequestIdentifier,
-  response: Response,
-  peerId: PeerId,
-) => Promise<boolean>;
-
-export type ReqRespSubProtocolValidators = {
-  [S in ReqRespSubProtocol]: ResponseValidator<any, any>;
-};
+/**
+ * Protocols that are always allowed without authentication, even when p2pAllowOnlyValidators is enabled.
+ * These are needed for the handshake and connection management flow.
+ * All other protocols require the remote peer to be authenticated.
+ */
+export const UNAUTHENTICATED_ALLOWED_PROTOCOLS: ReadonlySet<ReqRespSubProtocol> = new Set([
+  ReqRespSubProtocol.PING,
+  ReqRespSubProtocol.STATUS,
+  ReqRespSubProtocol.AUTH,
+  ReqRespSubProtocol.GOODBYE,
+]);
 
-export const DEFAULT_SUB_PROTOCOL_VALIDATORS: ReqRespSubProtocolValidators = {
-  [ReqRespSubProtocol.PING]: noopValidator,
-  [ReqRespSubProtocol.STATUS]: noopValidator,
-  [ReqRespSubProtocol.TX]: noopValidator,
-  [ReqRespSubProtocol.GOODBYE]: noopValidator,
-  [ReqRespSubProtocol.BLOCK]: noopValidator,
-  [ReqRespSubProtocol.AUTH]: noopValidator,
-  [ReqRespSubProtocol.BLOCK_TXS]: noopValidator,
-};
+/**
+ * Callback that checks whether a peer should be rejected from req/resp data protocols.
+ * Returns true if the peer should be rejected (i.e. p2pAllowOnlyValidators is on and peer is unauthenticated).
+ */
+export type ShouldRejectPeer = (peerId: string) => boolean;
 
 /*
  * Helper class to sub-protocol validation error*/
@@ -196,10 +194,6 @@ export const subProtocolMap = {
     request: RequestableBuffer,
     response: RequestableBuffer,
   },
-  [ReqRespSubProtocol.BLOCK]: {
-    request: Fr, // block number
-    response: L2Block,
-  },
   [ReqRespSubProtocol.AUTH]: {
     request: AuthRequest,
     response: AuthResponse,
@@ -210,25 +204,28 @@ export const subProtocolMap = {
   },
 };
 
+/**
+ * Type for a function that calculates the expected response size in KB for a given request.
+ */
+export type ExpectedResponseSizeCalculator = (requestBuffer: Buffer) => number;
+
+/**
+ * Map of sub-protocols to their expected response size calculators.
+ * These are used to validate that responses don't exceed expected sizes based on request parameters.
+ */
+export const subProtocolSizeCalculators: Record<ReqRespSubProtocol, ExpectedResponseSizeCalculator> = {
+  [ReqRespSubProtocol.TX]: calculateTxResponseSize,
+  [ReqRespSubProtocol.BLOCK_TXS]: calculateBlockTxsResponseSize,
+  [ReqRespSubProtocol.STATUS]: () => 1,
+  [ReqRespSubProtocol.PING]: () => 1,
+  [ReqRespSubProtocol.AUTH]: () => 1,
+  [ReqRespSubProtocol.GOODBYE]: () => 1, // No response expected, but provide minimal limit
+};
+
 export interface ReqRespInterface {
-  start(
-    subProtocolHandlers: Partial<ReqRespSubProtocolHandlers>,
-    subProtocolValidators: ReqRespSubProtocolValidators,
-  ): Promise<void>;
-  addSubProtocol(
-    subProtocol: ReqRespSubProtocol,
-    handler: ReqRespSubProtocolHandler,
-    validator?: ReqRespSubProtocolValidators[ReqRespSubProtocol],
-  ): Promise<void>;
+  start(subProtocolHandlers: Partial<ReqRespSubProtocolHandlers>): Promise<void>;
+  addSubProtocol(subProtocol: ReqRespSubProtocol, handler: ReqRespSubProtocolHandler): Promise<void>;
   stop(): Promise<void>;
-  sendBatchRequest<SubProtocol extends ReqRespSubProtocol>(
-    subProtocol: SubProtocol,
-    requests: InstanceType<SubProtocolMap[SubProtocol]['request']>[],
-    pinnedPeer: PeerId | undefined,
-    timeoutMs?: number,
-    maxPeers?: number,
-    maxRetryAttempts?: number,
-  ): Promise<InstanceType<SubProtocolMap[SubProtocol]['response']>[]>;
   sendRequestToPeer(
     peerId: PeerId,
     subProtocol: ReqRespSubProtocol,
@@ -237,4 +234,9 @@ export interface ReqRespInterface {
   ): Promise<ReqRespResponse>;
 
   updateConfig(config: Partial<P2PReqRespConfig>): void;
+
+  /** Sets the callback used to reject unauthenticated peers on gated req/resp protocols. */
+  setShouldRejectPeer(checker: ShouldRejectPeer): void;
+
+  getConnectionSampler(): Pick<ConnectionSampler, 'getPeerListSortedByConnectionCountAsc'>;
 }

package/src/services/reqresp/metrics.ts

@@ -1,7 +1,9 @@
 // Request response metrics
-import { Attributes, Metrics } from '@aztec/telemetry-client';
+import { Attributes, Metrics, createUpDownCounterWithDefault } from '@aztec/telemetry-client';
 import type { TelemetryClient, Tracer, UpDownCounter } from '@aztec/telemetry-client';
 
+import { ReqRespSubProtocol } from './interface.js';
+
 export class ReqRespMetrics {
   public readonly tracer: Tracer;
 
@@ -18,27 +20,49 @@ export class ReqRespMetrics {
     this.tracer = telemetryClient.getTracer(name);
 
     const meter = telemetryClient.getMeter(name);
-    this.sentRequests = meter.createUpDownCounter(Metrics.P2P_REQ_RESP_SENT_REQUESTS);
-    this.receivedRequests = meter.createUpDownCounter(Metrics.P2P_REQ_RESP_RECEIVED_REQUESTS);
+    const protocolAttrs = {
+      [Attributes.P2P_REQ_RESP_PROTOCOL]: [
+        ReqRespSubProtocol.PING,
+        ReqRespSubProtocol.STATUS,
+        ReqRespSubProtocol.GOODBYE,
+        ReqRespSubProtocol.TX,
+        ReqRespSubProtocol.AUTH,
+        ReqRespSubProtocol.BLOCK_TXS,
+      ],
+    };
+    this.sentRequests = createUpDownCounterWithDefault(meter, Metrics.P2P_REQ_RESP_SENT_REQUESTS, protocolAttrs);
+    this.receivedRequests = createUpDownCounterWithDefault(
+      meter,
+      Metrics.P2P_REQ_RESP_RECEIVED_REQUESTS,
+      protocolAttrs,
+    );
 
-    this.failedOutboundRequests = meter.createUpDownCounter(Metrics.P2P_REQ_RESP_FAILED_OUTBOUND_REQUESTS);
+    this.failedOutboundRequests = createUpDownCounterWithDefault(
+      meter,
+      Metrics.P2P_REQ_RESP_FAILED_OUTBOUND_REQUESTS,
+      protocolAttrs,
+    );
 
-    this.failedInboundRequests = meter.createUpDownCounter(Metrics.P2P_REQ_RESP_FAILED_INBOUND_REQUESTS);
+    this.failedInboundRequests = createUpDownCounterWithDefault(
+      meter,
+      Metrics.P2P_REQ_RESP_FAILED_INBOUND_REQUESTS,
+      protocolAttrs,
+    );
   }
 
-  public recordRequestSent(protocol: string) {
+  public recordRequestSent(protocol: ReqRespSubProtocol) {
     this.sentRequests.add(1, { [Attributes.P2P_REQ_RESP_PROTOCOL]: protocol });
   }
 
-  public recordRequestReceived(protocol: string) {
+  public recordRequestReceived(protocol: ReqRespSubProtocol) {
     this.receivedRequests.add(1, { [Attributes.P2P_REQ_RESP_PROTOCOL]: protocol });
   }
 
-  public recordRequestError(protocol: string) {
+  public recordRequestError(protocol: ReqRespSubProtocol) {
     this.failedOutboundRequests.add(1, { [Attributes.P2P_REQ_RESP_PROTOCOL]: protocol });
   }
 
-  public recordResponseError(protocol: string) {
+  public recordResponseError(protocol: ReqRespSubProtocol) {
     this.failedInboundRequests.add(1, { [Attributes.P2P_REQ_RESP_PROTOCOL]: protocol });
   }
 }

package/src/services/reqresp/protocols/block_txs/bitvector.ts

@@ -1,5 +1,7 @@
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 
+import { MAX_TXS_PER_BLOCK } from '../../constants.js';
+
 /**
  * BitVector helper class for representing and serializing bit vectors
  */
@@ -62,6 +64,13 @@ export class BitVector {
     return Array.from({ length: this.length }, (_, i) => i).filter(i => this.isSet(i));
   }
 
+  /**
+   * Returns true if no indices are set to true
+   * */
+  isEmpty(): boolean {
+    return this.getTrueIndices().length === 0;
+  }
+
   /**
    * Serializes the BitVector object into a Buffer
    *
@@ -80,6 +89,13 @@ export class BitVector {
     const reader = BufferReader.asReader(buffer);
     const length = reader.readNumber();
 
+    if (length < 0) {
+      throw new Error(`BitVector length ${length} cannot be negative`);
+    }
+    if (length > MAX_TXS_PER_BLOCK) {
+      throw new Error(`BitVector length ${length} exceeds maximum ${MAX_TXS_PER_BLOCK}`);
+    }
+
     const bitBuffer = reader.readBytes(BitVector.byteLength(length));
     return new BitVector(bitBuffer, length);
   }

package/src/services/reqresp/protocols/block_txs/block_txs_handler.ts

@@ -1,9 +1,11 @@
+import { Fr } from '@aztec/foundation/curves/bn254';
+import type { L2BlockSource } from '@aztec/stdlib/block';
 import { TxArray } from '@aztec/stdlib/tx';
 
 import type { PeerId } from '@libp2p/interface';
 
-import type { AttestationPool } from '../../../../mem_pools/attestation_pool/attestation_pool.js';
-import type { TxPool } from '../../../../mem_pools/index.js';
+import type { AttestationPoolApi } from '../../../../mem_pools/attestation_pool/attestation_pool.js';
+import type { TxPoolV2 } from '../../../../mem_pools/tx_pool_v2/interfaces.js';
 import type { ReqRespSubProtocolHandler } from '../../interface.js';
 import { ReqRespStatus, ReqRespStatusError } from '../../status.js';
 import { BitVector } from './bitvector.js';
@@ -12,10 +14,15 @@ import { BlockTxsRequest, BlockTxsResponse } from './block_txs_reqresp.js';
 /**
  * Handler for block txs requests
  * @param attestationPool - the attestation pool to check for block proposals
- * @param mempools - the mempools containing the tx pool
+ * @param archiver - the archiver to look up blocks by archive root
+ * @param txPool - the tx pool to fetch transactions from
  * @returns the BlockTxs request handler
  */
-export function reqRespBlockTxsHandler(attestationPool: AttestationPool, txPool: TxPool): ReqRespSubProtocolHandler {
+export function reqRespBlockTxsHandler(
+  attestationPool: AttestationPoolApi,
+  archiver: L2BlockSource,
+  txPool: TxPoolV2,
+): ReqRespSubProtocolHandler {
   /**
    * Handler for block txs requests
    * @param msg - the block txs request message
@@ -29,24 +36,42 @@ export function reqRespBlockTxsHandler(attestationPool: AttestationPool, txPool:
     } catch (err: any) {
       throw new ReqRespStatusError(ReqRespStatus.BADLY_FORMED_REQUEST, { cause: err });
     }
+    // First try attestation pool, then fall back to archiver
+    let txHashes = (await attestationPool.getBlockProposalByArchive(request.archiveRoot.toString()))?.txHashes;
+    if (!txHashes) {
+      txHashes = (await archiver.getBlock({ archive: request.archiveRoot }))?.body.txEffects.map(
+        effect => effect.txHash,
+      );
+    }
 
-    const blockProposal = await attestationPool.getBlockProposal(request.blockHash.toString());
+    let requestedTxsHashes;
+    if (request.txHashes.length > 0) {
+      requestedTxsHashes = request.txHashes;
+    }
 
-    if (!blockProposal) {
+    // This is scenario in which we don't have this block the peer is requesting from us
+    // But peer has sent requested tx hashes, so we can send them the transactions
+    if (!txHashes && requestedTxsHashes !== undefined) {
+      const responseTxs = (await txPool.getTxsByHash(requestedTxsHashes)).filter(tx => !!tx);
+      const response = new BlockTxsResponse(Fr.zero(), new TxArray(...responseTxs), BitVector.init(0, []));
+      return response.toBuffer();
+    }
+
+    // If we don't have this block and peer has not sent requested tx hashes
+    if (!txHashes) {
       throw new ReqRespStatusError(ReqRespStatus.NOT_FOUND);
     }
 
-    const txsAvailableInPool = await txPool.hasTxs(blockProposal.txHashes);
-    //Map txs in the pool to their indices in the block proposal
+    const txsAvailableInPool = await txPool.hasTxs(txHashes);
+    // Map txs in the pool to their indices in the block
     const availableIndices = txsAvailableInPool.map((hasTx, idx) => (hasTx ? idx : -1)).filter(idx => idx !== -1);
-    const responseBitVector = BitVector.init(blockProposal.txHashes.length, availableIndices);
+    const responseBitVector = BitVector.init(txHashes.length, availableIndices);
 
     const requestedIndices = new Set(request.txIndices.getTrueIndices());
-    const requestedTxsHashes = blockProposal.txHashes.filter((_, idx) => requestedIndices.has(idx));
+    requestedTxsHashes = txHashes.filter((_, idx) => requestedIndices.has(idx));
 
     const responseTxs = (await txPool.getTxsByHash(requestedTxsHashes)).filter(tx => !!tx);
-
-    const response = new BlockTxsResponse(request.blockHash, new TxArray(...responseTxs), responseBitVector);
+    const response = new BlockTxsResponse(request.archiveRoot, new TxArray(...responseTxs), responseBitVector);
 
     return response.toBuffer();
   };

package/src/services/reqresp/protocols/block_txs/block_txs_reqresp.ts

@@ -1,20 +1,68 @@
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
-import { TxArray } from '@aztec/stdlib/tx';
+import { MAX_TX_SIZE_KB } from '@aztec/stdlib/p2p';
+import { TxArray, type TxHash, TxHashArray } from '@aztec/stdlib/tx';
 
 import { BitVector } from './bitvector.js';
 
+/** Minimal interface for a block source that provides tx hashes and an archive root. */
+export interface BlockTxsSource {
+  txHashes: TxHash[];
+  archive: Fr;
+}
+
 /**
  * Request message for requesting specific transactions from a block
  */
 export class BlockTxsRequest {
   constructor(
-    readonly blockHash: Fr, // 32 byte hash of the proposed block header
+    // Archive root after the proposed block is applied (proposal identifier)
+    readonly archiveRoot: Fr,
+    // Hashes of txs we are requesting
+    readonly txHashes: TxHashArray,
     // BitVector indicating which txs from the proposal we are requesting
     // 1 means we want the tx, 0 means we don't
+    // If we know peer has the Block Proposal then we can use this BitVector
+    // Otherwise we can use this optimization
     readonly txIndices: BitVector,
   ) {}
 
+  /**
+   * Creates new BlockTxsRequest given a block txs source and missing tx hashes.
+   *
+   * @param blockTxsSource - The block or proposal for which we are making the request
+   * @param missingTxHashes - Tx hashes from the source we are missing
+   * @param includeFullTxHashes - Whether to include full list of missing tx hashes in the request or just Bitvector indices
+   *
+   * @returns undefined if there were no missingTxHashes matching the source hashes, otherwise
+   * returns new BlockTxsRequest
+   */
+  static fromTxsSourceAndMissingTxs(
+    blockTxsSource: BlockTxsSource,
+    missingTxHashes: TxHash[],
+    includeFullTxHashes = false,
+  ): BlockTxsRequest | undefined {
+    if (missingTxHashes.length === 0) {
+      return undefined; // No missing txs to request
+    }
+
+    const missingHashesSet = new Set(missingTxHashes.map(t => t.toString()));
+
+    // We cannot request txs that are not part of the block
+    if (!missingHashesSet.isSubsetOf(new Set(blockTxsSource.txHashes.map(t => t.toString())))) {
+      return undefined;
+    }
+
+    const missingIndices = blockTxsSource.txHashes
+      .map((hash, idx) => (missingHashesSet.has(hash.toString()) ? idx : -1))
+      .filter(i => i != -1);
+
+    const requestBitVector = BitVector.init(blockTxsSource.txHashes.length, missingIndices);
+    const hashes = includeFullTxHashes ? new TxHashArray(...missingTxHashes) : new TxHashArray();
+
+    return new BlockTxsRequest(blockTxsSource.archive, hashes, requestBitVector);
+  }
+
   /**
    * Deserializes the BlockTxRequest object from a Buffer
    * @param buffer - Buffer or BufferReader object to deserialize
@@ -22,10 +70,11 @@ export class BlockTxsRequest {
    */
   static fromBuffer(buffer: Buffer | BufferReader): BlockTxsRequest {
     const reader = BufferReader.asReader(buffer);
-    const blockHash = Fr.fromBuffer(reader);
+    const archiveRoot = Fr.fromBuffer(reader);
+    const txHashes = TxHashArray.fromBuffer(reader);
     const txIndices = BitVector.fromBuffer(reader);
 
-    return new BlockTxsRequest(blockHash, txIndices);
+    return new BlockTxsRequest(archiveRoot, txHashes, txIndices);
   }
 
   /**
@@ -33,7 +82,7 @@ export class BlockTxsRequest {
    * @returns Buffer representation of the BlockTxRequest object
    */
   toBuffer(): Buffer {
-    return serializeToBuffer([this.blockHash, this.txIndices.toBuffer()]);
+    return serializeToBuffer([this.archiveRoot, this.txHashes.toBuffer(), this.txIndices.toBuffer()]);
   }
 }
 
@@ -42,7 +91,7 @@ export class BlockTxsRequest {
  */
 export class BlockTxsResponse {
   constructor(
-    readonly blockHash: Fr,
+    readonly archiveRoot: Fr,
     readonly txs: TxArray, // List of transactions we requested and peer has
     // BitVector indicating which txs from the proposal are available at the peer
     // 1 means the tx is available, 0 means it is not
@@ -56,11 +105,11 @@ export class BlockTxsResponse {
    */
   static fromBuffer(buffer: Buffer | BufferReader): BlockTxsResponse {
     const reader = BufferReader.asReader(buffer);
-    const blockHash = Fr.fromBuffer(reader);
+    const archiveRoot = Fr.fromBuffer(reader);
     const txs = TxArray.fromBuffer(reader);
     const txIndices = BitVector.fromBuffer(reader);
 
-    return new BlockTxsResponse(blockHash, txs, txIndices);
+    return new BlockTxsResponse(archiveRoot, txs, txIndices);
   }
 
   /**
@@ -70,10 +119,26 @@ export class BlockTxsResponse {
    * @returns Buffer representation of the BlockTxResponse object
    */
   toBuffer(): Buffer {
-    return serializeToBuffer([this.blockHash, this.txs.toBuffer(), this.txIndices.toBuffer()]);
+    return serializeToBuffer([this.archiveRoot, this.txs.toBuffer(), this.txIndices.toBuffer()]);
   }
 
   static empty(): BlockTxsResponse {
     return new BlockTxsResponse(Fr.ZERO, new TxArray(), BitVector.init(0, []));
   }
 }
+
+/**
+ * Calculate the expected response size for a BLOCK_TXS request.
+ * @param requestBuffer - The serialized request buffer containing BlockTxsRequest
+ * @returns Expected response size in KB
+ */
+export function calculateBlockTxsResponseSize(requestBuffer: Buffer): number {
+  try {
+    const request = BlockTxsRequest.fromBuffer(requestBuffer);
+    const requestedTxCount = request.txIndices.getTrueIndices().length;
+    return requestedTxCount * MAX_TX_SIZE_KB + 1; // +1 KB overhead for serialization
+  } catch {
+    // If we can't parse the request, fall back to allowing a single transaction response
+    return MAX_TX_SIZE_KB + 1;
+  }
+}

package/src/services/reqresp/protocols/index.ts

@@ -5,6 +5,5 @@ export * from './ping.js';
 export * from './status.js';
 export * from './tx.js';
 export * from './goodbye.js';
-export * from './block.js';
 export * from './auth.js';
 export * from './block_txs/index.js';

package/src/services/reqresp/protocols/status.ts

@@ -7,6 +7,8 @@ import type { WorldStateSyncStatus, WorldStateSynchronizer } from '@aztec/stdlib
 
 import type { PeerId } from '@libp2p/interface';
 
+import { MAX_BLOCK_HASH_STRING_LENGTH, MAX_VERSION_STRING_LENGTH } from '../constants.js';
+
 /*
  * P2P Status Message
  * It is used to establish Status handshake between to peers
@@ -32,12 +34,12 @@ export class StatusMessage {
   static fromBuffer(buffer: Buffer | BufferReader): StatusMessage {
     const reader = BufferReader.asReader(buffer);
     return new StatusMessage(
-      reader.readString(), // compressedComponentsVersion
+      reader.readString(MAX_VERSION_STRING_LENGTH), // compressedComponentsVersion
       BlockNumber(reader.readNumber()), // latestBlockNumber
-      reader.readString(), // latestBlockHash
+      reader.readString(MAX_BLOCK_HASH_STRING_LENGTH), // latestBlockHash
       BlockNumber(reader.readNumber()), // finalizedBlockNumber
       //TODO: add finalizedBlockHash
-      //reader.readString(), // finalizedBlockHash
+      //reader.readString(MAX_BLOCK_HASH_STRING_LENGTH), // finalizedBlockHash
     );
   }
 

package/src/services/reqresp/protocols/tx.ts

@@ -1,4 +1,5 @@
 import { chunk } from '@aztec/foundation/collection';
+import { MAX_TX_SIZE_KB } from '@aztec/stdlib/p2p';
 import { TxArray, TxHash, TxHashArray } from '@aztec/stdlib/tx';
 
 import type { PeerId } from '@libp2p/interface';
@@ -50,8 +51,27 @@ export function reqRespTxHandler(mempools: MemPools): ReqRespSubProtocolHandler
  *  Per: https://github.com/AztecProtocol/aztec-packages/issues/15149#issuecomment-2999054485
  *  we define Q as max number of transactions per batch, the comment explains why we use 8.
  */
-//TODO: (mralj) chunk size should by default be 8, this is just temporary until the protocol is implemented correctly
-//more info:  https://github.com/AztecProtocol/aztec-packages/pull/15516#pullrequestreview-2995474321
-export function chunkTxHashesRequest(hashes: TxHash[], chunkSize = 1): Array<TxHashArray> {
+export function chunkTxHashesRequest(hashes: TxHash[], chunkSize = 8): Array<TxHashArray> {
   return chunk(hashes, chunkSize).map(chunk => new TxHashArray(...chunk));
 }
+
+/**
+ * Calculate the expected response size for a TX request.
+ * @param requestBuffer - The serialized request buffer containing TxHashArray
+ * @returns Expected response size in KB
+ */
+export function calculateTxResponseSize(requestBuffer: Buffer): number {
+  try {
+    const txHashes = TxHashArray.fromBuffer(requestBuffer);
+    // TxHashArray.fromBuffer returns empty array on parse failure, so check for that
+    if (txHashes.length === 0 && requestBuffer.length > 0) {
+      // If we got an empty array but had a non-empty buffer, parsing likely failed
+      // Fall back to allowing a single transaction response
+      return MAX_TX_SIZE_KB + 1;
+    }
+    return Math.max(txHashes.length, 1) * MAX_TX_SIZE_KB + 1; // +1 KB overhead, at least 1 tx
+  } catch {
+    // If we can't parse the request, fall back to allowing a single transaction response
+    return MAX_TX_SIZE_KB + 1;
+  }
+}

package/src/services/reqresp/rate-limiter/rate_limiter.ts

@@ -97,9 +97,10 @@ export function prettyPrintRateLimitStatus(status: RateLimitStatus) {
  * 2. Individual rate limits for each peer.
  *
  * How it works:
- * - When a request comes in, it first checks against the global rate limit.
- * - If the global limit allows, it then checks against the specific peer's rate limit.
- * - The request is only allowed if both the global and peer-specific limits allow it.
+ * - When a request comes in, it first checks against the peer's individual rate limit.
+ * - If the peer limit allows, it then checks against the global rate limit.
+ * - The request is only allowed if both the peer-specific and global limits allow it.
+ * - Checking peer limit first ensures a rate-limited peer cannot exhaust the global quota.
  * - It automatically creates and manages rate limiters for new peers as they make requests.
  * - It periodically cleans up rate limiters for inactive peers to conserve memory.
  *
@@ -119,10 +120,6 @@ export class SubProtocolRateLimiter {
   }
 
   allow(peerId: PeerId): RateLimitStatus {
-    if (!this.globalLimiter.allow()) {
-      return RateLimitStatus.DeniedGlobal;
-    }
-
     const peerIdStr = peerId.toString();
     let peerLimiter: PeerRateLimiter | undefined = this.peerLimiters.get(peerIdStr);
     if (!peerLimiter) {
@@ -135,10 +132,17 @@ export class SubProtocolRateLimiter {
     } else {
       peerLimiter.lastAccess = Date.now();
     }
-    const peerLimitAllowed = peerLimiter.limiter.allow();
-    if (!peerLimitAllowed) {
+
+    // Check peer limit first: a rate-limited peer must not consume global quota,
+    // otherwise one spamming peer can starve all others by exhausting the global bucket.
+    if (!peerLimiter.limiter.allow()) {
       return RateLimitStatus.DeniedPeer;
     }
+
+    if (!this.globalLimiter.allow()) {
+      return RateLimitStatus.DeniedGlobal;
+    }
+
     return RateLimitStatus.Allowed;
   }
 

package/src/services/reqresp/rate-limiter/rate_limits.ts

@@ -42,16 +42,6 @@ export const DEFAULT_RATE_LIMITS: ReqRespSubProtocolRateLimits = {
       quotaCount: 200,
     },
   },
-  [ReqRespSubProtocol.BLOCK]: {
-    peerLimit: {
-      quotaTimeMs: 1000,
-      quotaCount: 2,
-    },
-    globalLimit: {
-      quotaTimeMs: 1000,
-      quotaCount: 5,
-    },
-  },
   [ReqRespSubProtocol.GOODBYE]: {
     peerLimit: {
       quotaTimeMs: 1000,