@aztec/p2p 0.0.1-commit.993d240 → 0.0.1-commit.9a89641

package/src/services/libp2p/libp2p_service.ts

@@ -1,14 +1,15 @@
 import type { EpochCacheInterface } from '@aztec/epoch-cache';
 import { BlockNumber, type SlotNumber } from '@aztec/foundation/branded-types';
-import { maxBy, merge } from '@aztec/foundation/collection';
+import { compactArray, maxBy, merge } from '@aztec/foundation/collection';
 import { type Logger, createLibp2pComponentLogger, createLogger } from '@aztec/foundation/log';
 import { RunningPromise } from '@aztec/foundation/running-promise';
 import { Timer } from '@aztec/foundation/timer';
 import type { AztecAsyncKVStore } from '@aztec/kv-store';
 import { protocolContractsHash } from '@aztec/protocol-contracts';
 import type { EthAddress, L2BlockSource } from '@aztec/stdlib/block';
+import { DEFAULT_MAX_BLOCKS_PER_CHECKPOINT } from '@aztec/stdlib/config';
 import type { ContractDataSource } from '@aztec/stdlib/contract';
-import { type BlockMinFeesProvider, GasFees } from '@aztec/stdlib/gas';
+import { type BlockMinFeesProvider, GasFees, getNetworkTxGasLimits } from '@aztec/stdlib/gas';
 import type { ClientProtocolCircuitVerifier, PeerInfo, WorldStateSynchronizer } from '@aztec/stdlib/interfaces/server';
 import {
   BlockProposal,
@@ -24,9 +25,11 @@ import {
   getTopicsForConfig,
   metricsTopicStrToLabels,
 } from '@aztec/stdlib/p2p';
+import { ConsensusTimetable, getDefaultCheckpointProposalSyncGrace } from '@aztec/stdlib/timetable';
 import { MerkleTreeId } from '@aztec/stdlib/trees';
 import { Tx, type TxValidationResult } from '@aztec/stdlib/tx';
 import type { UInt64 } from '@aztec/stdlib/types';
+import { InvalidBlockProposalTxsError } from '@aztec/stdlib/validators';
 import { compressComponentVersions } from '@aztec/stdlib/versioning';
 import {
   Attributes,
@@ -81,14 +84,14 @@ import { type PubSubLibp2p, convertToMultiaddr } from '../../util.js';
 import { getVersions } from '../../versioning.js';
 import { AztecDatastore } from '../data_store.js';
 import { DiscV5Service } from '../discv5/discV5_service.js';
-import { SnappyTransform, fastMsgIdFn, getMsgIdFn, msgIdToStrFn } from '../encoding.js';
+import { SnappyTransform, getMsgIdFn, msgIdToStrFn } from '../encoding.js';
 import { APP_SPECIFIC_WEIGHT, gossipScoreThresholds } from '../gossipsub/scoring.js';
 import { createAllTopicScoreParams } from '../gossipsub/topic_score_params.js';
 import type { PeerManagerInterface } from '../peer-manager/interface.js';
 import { PeerManager } from '../peer-manager/peer_manager.js';
 import { PeerScoring } from '../peer-manager/peer_scoring.js';
 import type { BatchTxRequesterLibP2PService } from '../reqresp/batch-tx-requester/interface.js';
-import type { P2PReqRespConfig } from '../reqresp/config.js';
+import { type P2PReqRespConfig, YAMUX_MAX_MESSAGE_SIZE_BYTES } from '../reqresp/config.js';
 import {
   AuthRequest,
   BlockTxsRequest,
@@ -112,11 +115,30 @@ import type {
   P2PCheckpointAttestationCallback,
   P2PCheckpointReceivedCallback,
   P2PDuplicateAttestationCallback,
+  P2POversizedProposalCallback,
   P2PService,
   PeerDiscoveryService,
 } from '../service.js';
 import { P2PInstrumentation } from './instrumentation.js';
 
+/**
+ * Builds the {@link ConsensusTimetable} shared by the gossip validators for proposal/attestation receive-window
+ * bounds. Derived purely from protocol slot-timing constants plus the block sub-slot duration and the consensus
+ * materialization grace, so every node agrees on these bounds without depending on proposer operational budgets.
+ */
+function buildConsensusTimetable(
+  config: P2PConfig,
+  l1Constants: ReturnType<EpochCacheInterface['getL1Constants']>,
+): ConsensusTimetable {
+  const blockDuration = config.blockDurationMs / 1000;
+  return new ConsensusTimetable({
+    l1Constants,
+    blockDuration,
+    checkpointProposalSyncGrace:
+      config.checkpointProposalSyncGraceSeconds ?? getDefaultCheckpointProposalSyncGrace(blockDuration),
+  });
+}
+
 interface ValidationResult {
   name: string;
   isValid: TxValidationResult;
@@ -152,6 +174,9 @@ export class LibP2PService extends WithTracer implements P2PService {
     type: 'checkpoint' | 'block';
   }) => void;
 
+  /** Callback invoked when an oversized block proposal is stored as slashing evidence (triggers slashing). */
+  private oversizedProposalCallback?: P2POversizedProposalCallback;
+
   /** Callback invoked when a duplicate attestation is detected (triggers slashing). */
   private duplicateAttestationCallback?: P2PDuplicateAttestationCallback;
 
@@ -233,28 +258,39 @@ export class LibP2PService extends WithTracer implements P2PService {
       this.protocolVersion,
     );
 
-    const p2pPropagationTime = config.attestationPropagationTime;
+    // Build the consensus timetable once from protocol slot-timing constants and inject it into every
+    // validator so they share one set of receive-window bounds, independent of proposer operational budgets.
+    const consensusTimetable = buildConsensusTimetable(config, epochCache.getL1Constants());
     const proposalValidatorOpts = {
       txsPermitted: !config.disableTransactions,
       maxTxsPerBlock: config.validateMaxTxsPerBlock ?? config.validateMaxTxsPerCheckpoint,
       maxBlocksPerCheckpoint: config.maxBlocksPerCheckpoint,
-      p2pPropagationTime,
       skipSlotValidation: config.skipProposalSlotValidation,
       signatureContext: {
         chainId: config.l1ChainId,
         rollupAddress: config.rollupAddress,
       },
+      clockDisparityMs: config.maxGossipClockDisparityMs,
     };
-    this.blockProposalValidator = new BlockProposalValidator(epochCache, proposalValidatorOpts);
-    this.checkpointProposalValidator = new CheckpointProposalValidator(epochCache, proposalValidatorOpts);
+    this.blockProposalValidator = new BlockProposalValidator(epochCache, consensusTimetable, proposalValidatorOpts);
+    this.checkpointProposalValidator = new CheckpointProposalValidator(
+      epochCache,
+      consensusTimetable,
+      proposalValidatorOpts,
+    );
     const attestationValidatorOpts = {
-      l1PublishingTime: config.l1PublishingTime,
-      p2pPropagationTime,
       signatureContext: proposalValidatorOpts.signatureContext,
+      clockDisparityMs: config.maxGossipClockDisparityMs,
     };
     this.checkpointAttestationValidator = config.fishermanMode
-      ? new FishermanAttestationValidator(epochCache, mempools.attestationPool, telemetry, attestationValidatorOpts)
-      : new CheckpointAttestationValidator(epochCache, attestationValidatorOpts);
+      ? new FishermanAttestationValidator(
+          epochCache,
+          consensusTimetable,
+          mempools.attestationPool,
+          telemetry,
+          attestationValidatorOpts,
+        )
+      : new CheckpointAttestationValidator(epochCache, consensusTimetable, attestationValidatorOpts);
 
     this.gossipSubEventHandler = this.handleGossipSubEvent.bind(this);
 
@@ -333,6 +369,7 @@ export class LibP2PService extends WithTracer implements P2PService {
       packageVersion,
       telemetry,
       createLogger(`${logger.module}:discv5_service`, logger.getBindings()),
+      peerStore,
     );
 
     // Seed libp2p's bootstrap discovery with private and trusted peers
@@ -347,37 +384,49 @@ export class LibP2PService extends WithTracer implements P2PService {
     const protocolVersion = compressComponentVersions(versions);
 
     const preferredPeersEnrs: ENR[] = config.preferredPeers.map(enr => ENR.decodeTxt(enr));
-    const directPeers = (
+    const directPeers = compactArray(
       await Promise.all(
         preferredPeersEnrs.map(async enr => {
-          const peerId = await enr.peerId();
-          const address = enr.getLocationMultiaddr('tcp');
-          if (address === undefined) {
-            throw new Error(`Direct peer ${peerId.toString()} has no TCP address, ENR: ${enr.encodeTxt()}`);
+          try {
+            const peerId = await enr.peerId();
+            const address = enr.getLocationMultiaddr('tcp');
+            if (address === undefined) {
+              throw new Error(`Direct peer ${peerId.toString()} has no TCP address, ENR: ${enr.encodeTxt()}`);
+            }
+            return {
+              id: peerId,
+              addrs: [address],
+            };
+          } catch (err) {
+            // A malformed configured ENR shouldn't abort node setup — skip it and log.
+            logger.warn(`Skipping preferred peer with invalid ENR`, { err });
+            return undefined;
           }
-          return {
-            id: peerId,
-            addrs: [address],
-          };
         }),
-      )
-    ).filter(peer => peer !== undefined);
+      ),
+    );
 
     const announceTcpMultiaddr = config.p2pIp ? [convertToMultiaddr(config.p2pIp, p2pPort, 'tcp')] : [];
 
-    // Create dynamic topic score params based on network configuration
+    // Create dynamic topic score params based on network configuration. Scoring uses the network-wide
+    // max-blocks-per-checkpoint config value directly to size expected per-slot message rates; these are
+    // peer-rate thresholds, not consensus deadlines, so they need no proposer operational budgets.
     const l1Constants = epochCache.getL1Constants();
     const topicScoreParams = createAllTopicScoreParams(protocolVersion, {
       slotDurationMs: l1Constants.slotDuration * 1000,
-      ethereumSlotDuration: l1Constants.ethereumSlotDuration,
       heartbeatIntervalMs: config.gossipsubInterval,
       targetCommitteeSize: l1Constants.targetCommitteeSize,
-      blockDurationMs: config.blockDurationMs,
-      l1PublishingTime: config.l1PublishingTime,
-      p2pPropagationTime: config.attestationPropagationTime,
+      maxBlocksPerCheckpoint: config.maxBlocksPerCheckpoint ?? DEFAULT_MAX_BLOCKS_PER_CHECKPOINT,
       expectedBlockProposalsPerSlot: config.expectedBlockProposalsPerSlot,
     });
 
+    // Restrict gossipsub to exactly the topics we subscribe to. Without this, an arbitrary-topic
+    // message is transformed, msg-id'd and inserted into the seenCache before the subscription check,
+    // so a crafted topic colliding on msg id can suppress a real message as a duplicate.
+    const allowedTopics = getTopicsForConfig(config.disableTransactions).map(topic =>
+      createTopicString(topic, protocolVersion),
+    );
+
     const node = await createLibp2p({
       start: false,
       peerId,
@@ -409,7 +458,8 @@ export class LibP2PService extends WithTracer implements P2PService {
       ],
       datastore,
       peerDiscovery,
-      streamMuxers: [yamux(), mplex()],
+      // Pin the yamux frame size: MAX_REQRESP_REQUEST_SIZE_BYTES relies on a reqresp request fitting in one frame.
+      streamMuxers: [yamux({ maxMessageSize: YAMUX_MAX_MESSAGE_SIZE_BYTES }), mplex()],
       connectionEncryption: [noise()],
       connectionManager: {
         minConnections: 0, // Disable libp2p peer dialing, we do it manually
@@ -423,7 +473,7 @@ export class LibP2PService extends WithTracer implements P2PService {
       },
       connectionGater: {
         denyInboundConnection: (maConn: MultiaddrConnection) => {
-          const allowed = peerManager.isNodeAllowedToConnect(maConn.remoteAddr.nodeAddress().address);
+          const allowed = peerManager.isAddressAllowedToConnect(maConn.remoteAddr.nodeAddress().address);
           if (allowed) {
             return false;
           }
@@ -434,7 +484,7 @@ export class LibP2PService extends WithTracer implements P2PService {
         denyInboundEncryptedConnection: (peerId: PeerId, _maConn: MultiaddrConnection) => {
           //NOTE: it is not necessary to check address here because this was already done by
           // denyInboundConnection
-          const allowed = peerManager.isNodeAllowedToConnect(peerId);
+          const allowed = peerManager.isPeerAllowedToConnect(peerId);
           if (allowed) {
             return false;
           }
@@ -462,9 +512,13 @@ export class LibP2PService extends WithTracer implements P2PService {
           mcacheLength: config.gossipsubMcacheLength,
           mcacheGossip: config.gossipsubMcacheGossip,
           seenTTL: config.gossipsubSeenTTL,
+          allowedTopics,
+          // No fastMsgIdFn: the fast-path dedup cache keys on a non-cryptographic 64-bit hash of the
+          // raw data only (no topic), so a collision — accidental or engineered via a weak seed — drops
+          // a different message with no fallback to the full id. Dedup instead rests solely on the
+          // cryptographic, topic-framed msgIdFn below.
           msgIdFn: getMsgIdFn,
           msgIdToStrFn: msgIdToStrFn,
-          fastMsgIdFn: fastMsgIdFn,
           dataTransform: new SnappyTransform(),
           metricsRegister: otelMetricsAdapter,
           metricsTopicStrToLabel: metricsTopicStrToLabels(protocolVersion),
@@ -732,6 +786,13 @@ export class LibP2PService extends WithTracer implements P2PService {
     this.duplicateProposalCallback = callback;
   }
 
+  /**
+   * Registers a callback to be invoked when an oversized block proposal is stored as slashing evidence.
+   */
+  public registerOversizedProposalCallback(callback: P2POversizedProposalCallback): void {
+    this.oversizedProposalCallback = callback;
+  }
+
   /**
    * Registers a callback to be invoked when a duplicate attestation is detected.
    * A validator signing attestations for different proposals at the same slot.
@@ -1213,16 +1274,17 @@ export class LibP2PService extends WithTracer implements P2PService {
     const {
       result,
       obj: block,
-      metadata: { isEquivocated } = {},
-    } = await this.validateReceivedMessage<BlockProposal, { isEquivocated: boolean }>(
+      metadata: { isEquivocated, isOversized } = {},
+    } = await this.validateReceivedMessage<BlockProposal, { isEquivocated: boolean; isOversized: boolean }>(
       () => this.validateAndStoreBlockProposal(source, BlockProposal.fromBuffer(payloadData)),
       msgId,
       source,
       TopicType.block_proposal,
     );
 
-    // If not accepted or equivocated, return
-    if (result !== TopicValidatorResult.Accept || !block || isEquivocated) {
+    // If not accepted, equivocated, or oversized, return. Oversized proposals are re-broadcast as
+    // slashing evidence but never attested or processed.
+    if (result !== TopicValidatorResult.Accept || !block || isEquivocated || isOversized) {
       return;
     }
 
@@ -1237,7 +1299,7 @@ export class LibP2PService extends WithTracer implements P2PService {
   protected async validateAndStoreBlockProposal(
     peerId: PeerId,
     block: BlockProposal,
-  ): Promise<ReceivedMessageValidationResult<BlockProposal, { isEquivocated: boolean }>> {
+  ): Promise<ReceivedMessageValidationResult<BlockProposal, { isEquivocated: boolean; isOversized: boolean }>> {
     const validationResult = await this.blockProposalValidator.validate(block);
 
     if (validationResult.result === 'reject') {
@@ -1252,6 +1314,12 @@ export class LibP2PService extends WithTracer implements P2PService {
     // Try to add the proposal: this handles existence check, cap check, and adding in one call
     const { added, alreadyExists, count } = await this.mempools.attestationPool.tryAddBlockProposal(block);
     const isEquivocated = count !== undefined && count > 1;
+    // An oversized proposal (index at or beyond the consensus per-checkpoint limit) is structurally valid
+    // proposer misbehavior: it is stored and re-broadcast as slashing evidence but never processed or
+    // attested to. No-ops when maxBlocksPerCheckpoint is unset (local/test).
+    const isOversized =
+      this.config.maxBlocksPerCheckpoint !== undefined &&
+      block.indexWithinCheckpoint >= this.config.maxBlocksPerCheckpoint;
 
     // Duplicate proposal received, no need to re-broadcast
     if (alreadyExists) {
@@ -1261,7 +1329,7 @@ export class LibP2PService extends WithTracer implements P2PService {
         proposer: block.getSender()?.toString(),
         source: peerId.toString(),
       });
-      return { result: TopicValidatorResult.Ignore, obj: block, metadata: { isEquivocated } };
+      return { result: TopicValidatorResult.Ignore, obj: block, metadata: { isEquivocated, isOversized } };
     }
 
     // Too many blocks received for this slot and index, penalize peer and do not re-broadcast
@@ -1275,11 +1343,27 @@ export class LibP2PService extends WithTracer implements P2PService {
       });
       return {
         result: TopicValidatorResult.Reject,
-        metadata: { isEquivocated },
+        metadata: { isEquivocated, isOversized },
         severity: PeerErrorSeverity.HighToleranceError,
       };
     }
 
+    // The proposal was stored: if oversized, invoke the oversized callback so the proposer can be
+    // slashed. Fired alongside (not instead of) equivocation detection below.
+    if (isOversized) {
+      const proposer = block.getSender();
+      if (proposer) {
+        this.logger.warn(`Detected oversized block proposal at slot ${block.slotNumber}`, {
+          ...block.toBlockInfo(),
+          indexWithinCheckpoint: block.indexWithinCheckpoint,
+          maxBlocksPerCheckpoint: this.config.maxBlocksPerCheckpoint,
+          source: peerId.toString(),
+          proposer: proposer.toString(),
+        });
+        this.oversizedProposalCallback?.({ slot: block.slotNumber, proposer });
+      }
+    }
+
     // If this was a duplicate proposal, do not process it, but do invoke the duplicate callback,
     // and do re-broadcast it so other nodes in the network know to slash the proposer
     if (isEquivocated) {
@@ -1293,11 +1377,11 @@ export class LibP2PService extends WithTracer implements P2PService {
       if (proposer && count === 2) {
         this.duplicateProposalCallback?.({ slot: block.slotNumber, proposer, type: 'block' });
       }
-      return { result: TopicValidatorResult.Accept, obj: block, metadata: { isEquivocated } };
+      return { result: TopicValidatorResult.Accept, obj: block, metadata: { isEquivocated, isOversized } };
     }
 
     // Otherwise, we're good to go!
-    return { result: TopicValidatorResult.Accept, obj: block };
+    return { result: TopicValidatorResult.Accept, obj: block, metadata: { isEquivocated: false, isOversized } };
   }
 
   // REFACTOR(palla): This method should be moved to the p2p_client or to a separate component,
@@ -1318,11 +1402,29 @@ export class LibP2PService extends WithTracer implements P2PService {
     // Mark the txs in this proposal as protected
     await this.mempools.txPool.protectTxs(block.txHashes, block.blockHeader);
 
-    // Call the block received callback to validate the proposal.
-    // Note: Validators do NOT attest to individual blocks, only to checkpoint proposals.
-    const isValid = await this.blockReceivedCallback(block, sender);
-    if (!isValid) {
-      this.logger.info(`Block proposal validation failed for block ${block.blockNumber}`, block.toBlockInfo());
+    if (!(await this.tryBlockReceivedCallback(block, sender))) {
+      // Release the protections this proposal created so its txs return to pending. Only entries still
+      // keyed to this slot are cleared, so a tx referenced by a live proposal at another slot stays protected.
+      await this.mempools.txPool.unprotectTxs(block.txHashes, slot);
+    }
+  }
+
+  /**
+   * Runs the block received callback to validate a proposal, and returns whether it was accepted.
+   * A callback that throws is reported as a rejection: the proposal is no more usable than one explicitly
+   * rejected, and letting the error escape would leave the proposal's tx protections in place.
+   * Note: Validators do NOT attest to individual blocks, only to checkpoint proposals.
+   */
+  private async tryBlockReceivedCallback(block: BlockProposal, sender: PeerId): Promise<boolean> {
+    try {
+      const isValid = await this.blockReceivedCallback(block, sender);
+      if (!isValid) {
+        this.logger.info(`Block proposal validation failed for block ${block.blockNumber}`, block.toBlockInfo());
+      }
+      return isValid;
+    } catch (err) {
+      this.logger.error(`Error validating block proposal for block ${block.blockNumber}`, err, block.toBlockInfo());
+      return false;
     }
   }
 
@@ -1334,17 +1436,21 @@ export class LibP2PService extends WithTracer implements P2PService {
     const {
       result,
       obj: checkpoint,
-      metadata: { isEquivocated, processBlock } = {},
-    } = await this.validateReceivedMessage<CheckpointProposal, { isEquivocated: boolean; processBlock: boolean }>(
+      metadata: { isEquivocated, processBlock, isOversized } = {},
+    } = await this.validateReceivedMessage<
+      CheckpointProposal,
+      { isEquivocated: boolean; processBlock: boolean; isOversized: boolean }
+    >(
       () => this.validateAndStoreCheckpointProposal(source, CheckpointProposal.fromBuffer(payloadData)),
       msgId,
       source,
       TopicType.checkpoint_proposal,
     );
 
-    // Process checkpoint proposal if valid and not equivocated.
+    // An oversized checkpoint is re-broadcast as slashing evidence but never attested or processed.
+    // Process checkpoint proposal if valid and neither equivocated nor oversized.
     const processCheckpointFn = () =>
-      result === TopicValidatorResult.Accept && checkpoint && !isEquivocated
+      result === TopicValidatorResult.Accept && checkpoint && !isEquivocated && !isOversized
         ? this.processValidCheckpointProposal(checkpoint.toCore(), source)
         : Promise.resolve();
 
@@ -1381,7 +1487,12 @@ export class LibP2PService extends WithTracer implements P2PService {
   protected async validateAndStoreCheckpointProposal(
     peerId: PeerId,
     checkpoint: CheckpointProposal,
-  ): Promise<ReceivedMessageValidationResult<CheckpointProposal, { isEquivocated: boolean; processBlock: boolean }>> {
+  ): Promise<
+    ReceivedMessageValidationResult<
+      CheckpointProposal,
+      { isEquivocated: boolean; processBlock: boolean; isOversized: boolean }
+    >
+  > {
     const validationResult = await this.checkpointProposalValidator.validate(checkpoint);
 
     if (validationResult.result === 'reject') {
@@ -1396,13 +1507,16 @@ export class LibP2PService extends WithTracer implements P2PService {
     // Extract and try to add the block proposal first if present
     const blockProposal = checkpoint.getBlockProposal();
     let processBlock = false;
+    let isOversized = false;
     if (blockProposal) {
       this.logger.debug(`Validating block proposal from propagated checkpoint`, {
         [Attributes.SLOT_NUMBER]: checkpoint.slotNumber.toString(),
         [Attributes.P2P_ID]: peerId.toString(),
       });
       const blockProposalResult = await this.validateAndStoreBlockProposal(peerId, blockProposal);
-      const { obj, metadata: { isEquivocated } = {} } = blockProposalResult;
+      const { obj, metadata: { isEquivocated, isOversized: blockIsOversized } = {} } = blockProposalResult;
+      isOversized = blockIsOversized ?? false;
+
       if (blockProposalResult.result === TopicValidatorResult.Reject || !obj || isEquivocated) {
         this.logger.debug(`Rejecting checkpoint due to invalid last block proposal`, {
           [Attributes.SLOT_NUMBER]: checkpoint.slotNumber.toString(),
@@ -1415,7 +1529,8 @@ export class LibP2PService extends WithTracer implements P2PService {
           severity:
             'severity' in blockProposalResult ? blockProposalResult.severity : PeerErrorSeverity.MidToleranceError,
         };
-      } else if (blockProposalResult.result === TopicValidatorResult.Accept && obj && !isEquivocated) {
+      } else if (blockProposalResult.result === TopicValidatorResult.Accept && obj && !isEquivocated && !isOversized) {
+        // An oversized terminal block is re-broadcast as slashing evidence but never processed.
         processBlock = true;
       }
     }
@@ -1435,11 +1550,11 @@ export class LibP2PService extends WithTracer implements P2PService {
       return {
         result: TopicValidatorResult.Ignore,
         obj: checkpoint,
-        metadata: { isEquivocated, processBlock },
+        metadata: { isEquivocated, processBlock, isOversized },
       };
     }
 
-    // Too many checkpoint proposals received for this slot, penalize peer and do not re-broadcast
+    // Too many checkpoint proposals received for this slot, penalize peer and do not re-broadcast.
     // Note: We still return the checkpoint obj so the lastBlock can be processed if valid
     if (!added) {
       this.logger.warn(`Penalizing peer for checkpoint proposal exceeding per-slot cap`, {
@@ -1450,7 +1565,7 @@ export class LibP2PService extends WithTracer implements P2PService {
       return {
         result: TopicValidatorResult.Reject,
         obj: checkpoint,
-        metadata: { isEquivocated, processBlock },
+        metadata: { isEquivocated, processBlock, isOversized },
         severity: PeerErrorSeverity.HighToleranceError,
       };
     }
@@ -1471,12 +1586,16 @@ export class LibP2PService extends WithTracer implements P2PService {
       return {
         result: TopicValidatorResult.Accept,
         obj: checkpoint,
-        metadata: { isEquivocated, processBlock },
+        metadata: { isEquivocated, processBlock, isOversized },
       };
     }
 
     // Otherwise, we're good to go!
-    return { result: TopicValidatorResult.Accept, obj: checkpoint, metadata: { processBlock, isEquivocated } };
+    return {
+      result: TopicValidatorResult.Accept,
+      obj: checkpoint,
+      metadata: { processBlock, isEquivocated, isOversized },
+    };
   }
 
   /**
@@ -1540,83 +1659,71 @@ export class LibP2PService extends WithTracer implements P2PService {
     peerId: PeerId,
   ): Promise<boolean> {
     try {
-      // A response with archiveRoot=Fr.zero is the documented "I don't have the block" signal from
-      // reqRespBlockTxsHandler (block_txs_handler.ts:54-58): the peer lacked the block in its
-      // attestation pool and archiver, but matched the requested hashes against its tx pool and
-      // shipped what it found. This is legitimate behaviour, not misbehaviour — we just can't verify
-      // membership/order without the block, so we drop the response without penalising the peer.
-      if (response.archiveRoot.isZero()) {
-        this.logger.debug(`Peer ${peerId.toString()} signalled missing block with Fr.zero archive root`);
-        return false;
-      }
-
-      if (!response.archiveRoot.equals(request.archiveRoot)) {
-        this.peerManager.penalizePeer(peerId, PeerErrorSeverity.MidToleranceError);
-        throw new ValidationError(
-          `Received block txs for unexpected archive root: expected ${request.archiveRoot.toString()}, got ${response.archiveRoot.toString()}`,
-        );
-      }
-
-      if (response.txIndices.getLength() !== request.txIndices.getLength()) {
-        this.peerManager.penalizePeer(peerId, PeerErrorSeverity.MidToleranceError);
-        throw new ValidationError(
-          `Received block txs with mismatched bitvector length: expected ${request.txIndices.getLength()}, got ${response.txIndices.getLength()}`,
-        );
-      }
-
-      // Check no duplicates and not exceeding returnable count
-      const requestedIndices = new Set(request.txIndices.getTrueIndices());
-      const availableIndices = new Set(response.txIndices.getTrueIndices());
-      const maxReturnable = [...requestedIndices].filter(i => availableIndices.has(i)).length;
-
-      const returnedHashes = await Promise.all(response.txs.map(tx => tx.getTxHash().toString()));
+      // Check for duplicates txs (or hashes) in the response.
+      const returnedHashes = response.txs.map(tx => tx.getTxHash().toString());
       const uniqueReturned = new Set(returnedHashes.map(h => h.toString()));
       if (uniqueReturned.size !== returnedHashes.length) {
         this.peerManager.penalizePeer(peerId, PeerErrorSeverity.MidToleranceError);
         throw new ValidationError(`Received duplicate txs in block txs response`);
       }
-      if (response.txs.length > maxReturnable) {
-        this.peerManager.penalizePeer(peerId, PeerErrorSeverity.MidToleranceError);
-        throw new ValidationError(
-          `Received more txs (${response.txs.length}) than requested-and-available (${maxReturnable})`,
-        );
-      }
 
-      // To verify membership/order of the returned txs we need the canonical tx hash list for the
-      // block. Prefer the block proposal (held while a block is in flight), but fall back to the
-      // archiver for blocks we only know as mined — e.g. a prover collecting txs to prove a block it
-      // never received a proposal for. This mirrors the responder side (reqRespBlockTxsHandler),
-      // which serves from proposal-or-archiver.
+      // We get the block tx hashes from the proposal or the archiver.
       const proposal = await this.mempools.attestationPool.getBlockProposalByArchive(request.archiveRoot.toString());
       const blockTxHashes =
         proposal?.txHashes ??
         (await this.archiver.getBlock({ archive: request.archiveRoot }))?.body.txEffects.map(e => e.txHash);
 
-      if (blockTxHashes) {
-        // Build intersected indices
-        const intersectIdx = request.txIndices.getTrueIndices().filter(i => response.txIndices.isSet(i));
-
-        // Enforce subset membership and preserve increasing order by index.
-        const hashToIndexInBlock = new Map<string, number>(
-          blockTxHashes.map((h, i) => [h.toString(), i] as [string, number]),
-        );
-        const allowedIndexSet = new Set(intersectIdx);
-        const indices = returnedHashes.map(h => hashToIndexInBlock.get(h));
-        const allAllowed = indices.every(idx => idx !== undefined && allowedIndexSet.has(idx));
-        const strictlyIncreasing = indices.every((idx, i) => (i === 0 ? idx !== undefined : idx! > indices[i - 1]!));
-        if (!allAllowed || !strictlyIncreasing) {
-          this.peerManager.penalizePeer(peerId, PeerErrorSeverity.LowToleranceError);
-          throw new ValidationError('Returned txs do not match expected subset/order for requested indices');
-        }
-      } else {
+      // If we don't have the block, we can't verify membership/order of the returned txs.
+      if (!blockTxHashes) {
+        // This shouldn't happen, since we asked for the block (proposal).
         // Neither a local proposal nor an archived block: we cannot verify membership/order of the
         // returned txs. This is a local-state gap, not a peer fault, so we do not penalize.
         this.logger.warn(
           `Block ${request.archiveRoot.toString()} not found in attestation pool or archiver; cannot validate membership/order of returned txs`,
         );
+        // NOTE: We mark the response as invalid, given the limitations of a true/false return value.
         return false;
       }
 
+      // Verify that the returned tx hashes are a subset of (tx hashes by index) U (explicitly requested tx hashes).
+      const uniqueRequestedHashes = new Set([
+        // tx hashes requested by index.
+        ...request.txIndices.getTrueIndices().map(i => blockTxHashes[i].toString()),
+        // explicitly requested tx hashes.
+        ...request.txHashes.map(h => h.toString()),
+      ]);
+      if (!returnedHashes.every(h => uniqueRequestedHashes.has(h))) {
+        this.peerManager.penalizePeer(peerId, PeerErrorSeverity.LowToleranceError);
+        throw new ValidationError(
+          'Returned txs should be a subset of (tx hashes by index) U (explicitly requested tx hashes)',
+        );
+      }
+
+      // Tx indices information is optional, but if present, we need to verify a few things.
+      if (!response.peerHasBlock()) {
+        this.logger.debug(`Peer ${peerId.toString()} signalled missing block`);
+        return true;
+      }
+
+      // If the response has a non-empty bitvector, it needs to be consistent with the number of txs in the block.
+      if (response.txIndices.getLength() !== blockTxHashes.length) {
+        this.peerManager.penalizePeer(peerId, PeerErrorSeverity.MidToleranceError);
+        throw new ValidationError(
+          `Received block txs with mismatched bitvector length: expected ${blockTxHashes.length}, got ${response.txIndices.getLength()}`,
+        );
+      }
+
+      // For every index we requested that the peer claims to have (per its bitvector), the
+      // corresponding tx must be present in the response. A peer advertising availability but
+      // withholding the tx is inconsistent.
+      const returnedHashSet = new Set(returnedHashes);
+      const expectedIndices = request.txIndices.getTrueIndices().filter(i => response.txIndices.isSet(i));
+      const missingExpected = expectedIndices.some(i => !returnedHashSet.has(blockTxHashes[i].toString()));
+      if (missingExpected) {
+        this.peerManager.penalizePeer(peerId, PeerErrorSeverity.LowToleranceError);
+        throw new ValidationError('Peer advertised requested txs via indices but did not return them');
+      }
+
       return true;
     } catch (e: any) {
       if (e instanceof ValidationError) {
@@ -1660,13 +1767,15 @@ export class LibP2PService extends WithTracer implements P2PService {
     );
 
     const results = await Promise.all(
-      txs.map(async tx => {
-        const result = await validator.validateTx(tx);
-        return result.result !== 'invalid';
-      }),
+      txs.map(async tx => ({ txHash: tx.getTxHash(), result: await validator.validateTx(tx) })),
+    );
+
+    const invalidTxs = results.flatMap(({ txHash, result }) =>
+      result.result === 'invalid' ? [{ txHash, reasons: result.reason }] : [],
     );
-    if (results.some(value => value === false)) {
-      throw new Error('Invalid tx detected');
+
+    if (invalidTxs.length > 0) {
+      throw new InvalidBlockProposalTxsError(invalidTxs);
     }
   }
 
@@ -1682,6 +1791,7 @@ export class LibP2PService extends WithTracer implements P2PService {
     ];
     const blockNumber = BlockNumber(currentBlockNumber + 1);
     const l1Constants = await this.archiver.getL1Constants();
+    const networkTxGasLimits = getNetworkTxGasLimits(this.config, l1Constants);
 
     return createFirstStageTxValidationsForGossipedTransactions(
       nextSlotTimestamp,
@@ -1696,9 +1806,8 @@ export class LibP2PService extends WithTracer implements P2PService {
       allowedInSetup,
       this.logger.getBindings(),
       {
-        rollupManaLimit: l1Constants.rollupManaLimit,
-        maxBlockL2Gas: this.config.validateMaxL2BlockGas,
-        maxBlockDAGas: this.config.validateMaxDABlockGas,
+        maxTxL2Gas: networkTxGasLimits.l2Gas,
+        maxTxDAGas: networkTxGasLimits.daGas,
       },
     );
   }