@aztec/p2p 0.0.1-commit.993d240 → 0.0.1-commit.9a89641

package/src/services/peer-manager/peer_manager.ts

@@ -1,4 +1,5 @@
 import type { EpochCacheInterface } from '@aztec/epoch-cache';
+import { compactArray } from '@aztec/foundation/collection';
 import { makeEthSignDigest, tryRecoverAddress } from '@aztec/foundation/crypto/secp256k1-signer';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import type { EthAddress } from '@aztec/foundation/eth-address';
@@ -164,6 +165,7 @@ export class PeerManager implements PeerManagerInterface {
   public async heartbeat() {
     this.heartbeatCounter++;
     this.peerScoring.decayAllScores();
+    this.peerScoring.pruneExpiredBans();
     this.cleanupExpiredTimeouts();
 
     await this.setupDirectPeersIfValidator();
@@ -198,21 +200,27 @@ export class PeerManager implements PeerManagerInterface {
       .then(peerIds => peerIds.forEach(peerId => this.preferredPeers.add(peerId.toString())))
       .catch(e => this.logger.error('Error initializing preferred peers', e));
 
-    const directPeers = (
+    const directPeers = compactArray(
       await Promise.all(
         preferredPeersEnrs.map(async enr => {
-          const peerId = await enr.peerId();
-          const address = enr.getLocationMultiaddr('tcp');
-          if (address === undefined) {
-            throw new Error(`Direct peer ${peerId.toString()} has no TCP address, ENR: ${enr.encodeTxt()}`);
+          try {
+            const peerId = await enr.peerId();
+            const address = enr.getLocationMultiaddr('tcp');
+            if (address === undefined) {
+              throw new Error(`Direct peer ${peerId.toString()} has no TCP address, ENR: ${enr.encodeTxt()}`);
+            }
+            return {
+              id: peerId,
+              addrs: [address],
+            };
+          } catch (err) {
+            // A malformed configured ENR shouldn't abort preferred-peer setup — skip it and log.
+            this.logger.warn(`Skipping preferred peer with invalid ENR`, { err });
+            return undefined;
           }
-          return {
-            id: peerId,
-            addrs: [address],
-          };
         }),
-      )
-    ).filter(peer => peer !== undefined);
+      ),
+    );
 
     await Promise.all(
       directPeers.map(peer => {
@@ -494,15 +502,38 @@ export class PeerManager implements PeerManagerInterface {
    *
    * @returns: True if node is allowed to connect, otherwise false
    * */
-  public isNodeAllowedToConnect(id: string | PeerId): boolean {
-    const entry = this.failedAuthHandshakes.get(id.toString());
+  /**
+   * Whether a peer is allowed to connect, given its peer id. Rejects peers serving an active ban and
+   * peers that have exceeded the failed auth-handshake limit. Use this once the peer id is known —
+   * i.e. for the encrypted-inbound gater and when dialing.
+   */
+  public isPeerAllowedToConnect(peerId: string | PeerId): boolean {
+    const id = peerId.toString();
+    if (this.peerScoring.getScoreState(id) === PeerScoreState.Banned) {
+      return false;
+    }
+    return this.isWithinFailedAuthLimit(id);
+  }
+
+  /**
+   * Whether a connection from an address is allowed. Bans are keyed by peer id, which isn't known at
+   * the raw-inbound layer, so only the failed auth-handshake limit (also tracked per address) is
+   * enforced here; the ban is applied once the peer id is known via {@link isPeerAllowedToConnect}.
+   */
+  public isAddressAllowedToConnect(address: string): boolean {
+    return this.isWithinFailedAuthLimit(address);
+  }
+
+  /** Whether the failed auth-handshake count for a peer id or address is below the configured limit. */
+  private isWithinFailedAuthLimit(key: string): boolean {
+    const entry = this.failedAuthHandshakes.get(key);
     if (!entry) {
       return true;
     }
 
     // In case entry is too old, remove it and allow connection
     if (this.dateProvider.now() - entry.lastFailureTimestamp > FAILED_AUTH_HANDSHAKE_EXPIRY_MS) {
-      this.failedAuthHandshakes.delete(id.toString());
+      this.failedAuthHandshakes.delete(key);
       return true;
     }
 
@@ -729,9 +760,9 @@ export class PeerManager implements PeerManagerInterface {
       return;
     }
 
-    // Don't dial peers that have exceeded the auth failure threshold
-    if (!this.isNodeAllowedToConnect(peerId)) {
-      this.logger.trace(`Skipping peer ${peerId} due to failed auth handshake attempts`);
+    // Don't dial banned peers or those that have exceeded the auth failure threshold
+    if (!this.isPeerAllowedToConnect(peerId)) {
+      this.logger.trace(`Skipping peer ${peerId} due to ban or failed auth handshake attempts`);
       return;
     }
 

package/src/services/peer-manager/peer_scoring.ts

@@ -57,6 +57,9 @@ const MIN_SCORE_BEFORE_BAN = -100;
 const MIN_SCORE_BEFORE_DISCONNECT = -50;
 const SCORE_CLEANUP_THRESHOLD = 0.1;
 
+/** An active ban: the score the peer held when banned, and the timestamp at which the ban lifts. */
+type BanRecord = { score: number; expiry: number };
+
 export class PeerScoring {
   private logger = createLogger('p2p:peer-scoring');
   private scores: Map<string, number> = new Map();
@@ -67,11 +70,21 @@ export class PeerScoring {
 
   private peerStateCounter: UpDownCounter;
 
+  /** Active bans, keyed by peer id. Held in memory only, so they are cleared on restart. */
+  private bannedPeers: Map<string, BanRecord> = new Map();
+  /**
+   * How long a peer remains banned once its score crosses MIN_SCORE_BEFORE_BAN. While banned, the
+   * peer's ban score is returned by getScore regardless of decay, so it cannot recover its way out
+   * of the ban early. After the ban expires the live (decayed) score takes over again.
+   */
+  private readonly banDurationMs: number;
+
   constructor(
     config: P2PConfig,
     telemetry: TelemetryClient = getTelemetryClient(),
     private readonly dateProvider: DateProvider = new DateProvider(),
   ) {
+    this.banDurationMs = config.peerBanDurationSeconds * 1000;
     const orderedValues = config.peerPenaltyValues?.sort((a, b) => a - b);
     this.peerPenalties = {
       [PeerErrorSeverity.HighToleranceError]:
@@ -113,9 +126,31 @@ export class PeerScoring {
 
     this.scores.set(peerId, currentScore);
     this.lastUpdateTime.set(peerId, currentTime);
+
+    this.maybeBanPeer(peerId, currentScore);
+
     return currentScore;
   }
 
+  /**
+   * Records a ban for a peer whose score has crossed the ban threshold, with an expiry banDurationMs
+   * in the future. No-op if the score is above the threshold or the peer is already serving an active
+   * ban (an existing ban is not extended; the original window stands). A previously expired ban does
+   * not block a fresh one — getActiveBanScore prunes it first.
+   */
+  private maybeBanPeer(peerId: string, score: number): void {
+    if (score >= MIN_SCORE_BEFORE_BAN || this.getActiveBanScore(peerId) !== undefined) {
+      return;
+    }
+    const record: BanRecord = { score, expiry: this.dateProvider.now() + this.banDurationMs };
+    this.bannedPeers.set(peerId, record);
+    this.logger.verbose(`Banning peer ${peerId} until ${new Date(record.expiry).toISOString()}`, {
+      peerId,
+      score,
+      expiry: record.expiry,
+    });
+  }
+
   decayAllScores(): void {
     const currentTime = this.dateProvider.now();
     for (const [peerId, lastUpdate] of this.lastUpdateTime.entries()) {
@@ -135,10 +170,24 @@ export class PeerScoring {
     }
   }
 
+  /**
+   * Removes bans whose window has elapsed. Expired bans are otherwise only pruned lazily when their
+   * peer's score is next queried, so a banned peer that disconnects and is never queried again would
+   * linger in the map. Called periodically (per heartbeat) to bound the ban map's size.
+   */
+  pruneExpiredBans(): void {
+    const now = this.dateProvider.now();
+    const expired = [...this.bannedPeers.entries()].filter(([, ban]) => ban.expiry <= now).map(([peerId]) => peerId);
+    for (const peerId of expired) {
+      this.bannedPeers.delete(peerId);
+    }
+  }
+
   /** Resets all peer scores. Useful for benchmarks to prevent cross-case contamination. */
   resetAllScores(): void {
     this.scores.clear();
     this.lastUpdateTime.clear();
+    this.bannedPeers.clear();
   }
 
   removePeer(peerId: string): void {
@@ -146,12 +195,33 @@ export class PeerScoring {
     this.lastUpdateTime.delete(peerId);
   }
 
+  /**
+   * The single source of truth for whether a peer is banned. Returns the ban score while the ban is
+   * active, or undefined if the peer is not banned. A ban that has expired is lazily lifted before
+   * returning undefined, so callers never see a stale ban.
+   */
+  private getActiveBanScore(peerId: string): number | undefined {
+    const ban = this.bannedPeers.get(peerId);
+    if (ban === undefined) {
+      return undefined;
+    }
+    if (ban.expiry > this.dateProvider.now()) {
+      return ban.score;
+    }
+    // Ban expired: lift it so the peer can recover.
+    this.bannedPeers.delete(peerId);
+    return undefined;
+  }
+
   getScore(peerId: string): number {
-    return this.scores.get(peerId) || 0;
+    // While a ban is active its ban score is returned regardless of how the live score has decayed,
+    // so the peer stays banned for the full duration.
+    return this.getActiveBanScore(peerId) ?? this.scores.get(peerId) ?? 0;
   }
 
   public getScoreState(peerId: string): PeerScoreState {
-    // TODO(#11329): permanently store banned peers?
+    // A banned peer stays banned for the full ban duration regardless of score decay (see getScore /
+    // maybeBanPeer), rather than silently recovering once its decayed score is cleaned up.
     const score = this.getScore(peerId);
     if (score < MIN_SCORE_BEFORE_BAN) {
       return PeerScoreState.Banned;
@@ -165,7 +235,9 @@ export class PeerScoring {
   getStats(): { medianScore: number; healthyCount: number; disconnectCount: number; bannedCount: number } {
     const stateCounts = { healthy: 0, disconnect: 0, banned: 0 };
 
-    for (const peerId of this.scores.keys()) {
+    // Include banned peers whose live score may have been decayed away but whose ban is still active.
+    const peerIds = new Set([...this.scores.keys(), ...this.bannedPeers.keys()]);
+    for (const peerId of peerIds) {
       const state = this.getScoreState(peerId);
       switch (state) {
         case PeerScoreState.Healthy:

package/src/services/reqresp/README.md

@@ -14,9 +14,8 @@ Applied before the protocol handler runs.
 | STATUS | 5/s | 10/s | same |
 | AUTH | 5/s | 10/s | same |
 | GOODBYE | 5/s | 10/s | same |
-| BLOCK | 2/s | 5/s | same |
 | BLOCK_TXS | 10/s | 200/s | same |
-| TX | (see rate limits file) | (see rate limits file) | same |
+| TX | 10/s | 200/s | same |
 
 - Per-peer limit exceeded: `HighToleranceError` penalty + `RATE_LIMIT_EXCEEDED` status. Penalty fires inside `RequestResponseRateLimiter.allow()`, not the stream handler.
 - Global limit exceeded: `RATE_LIMIT_EXCEEDED` status only (no peer penalty).
@@ -149,26 +148,6 @@ Protected peers (private/trusted/preferred) are always considered "authenticated
 
 ## Block Data Protocols
 
-### BLOCK Protocol (`/aztec/req/block/1.0.0`)
-
-**Server side**:
-
-| Rule | Consequence | File |
-|------|-------------|------|
-| Request must parse as `Fr` | `BADLY_FORMED_REQUEST` + LowToleranceError | `protocols/block.ts` |
-| Block lookup throws | `INTERNAL_ERROR` status | same |
-| Block not found | SUCCESS + empty buffer (design choice; no `NOT_FOUND` status used) | same |
-
-**Requester side** (Snappy limit: 3 MB):
-
-| Rule | Consequence | File |
-|------|-------------|------|
-| Response block number must match requested | LowToleranceError; rejected | `libp2p_service.ts` (`validateRequestedBlock`) |
-| Local block must exist for hash verification | Rejected (no penalty) | same |
-| Response block hash must equal local block hash | MidToleranceError; rejected | same |
-
-**Limitation**: the local-block requirement means BLOCK req/resp is unusable for initial P2P-only sync (before L1 sync provides local copies for verification). A TODO in the code acknowledges this.
-
 ### BLOCK_TXS Protocol (`/aztec/req/block_txs/1.0.0`)
 
 **Server side**:
@@ -178,7 +157,7 @@ Protected peers (private/trusted/preferred) are always considered "authenticated
 | Request must parse as `BlockTxsRequest` (Fr + TxHashArray + BitVector) | `BADLY_FORMED_REQUEST` + LowToleranceError | `protocols/block_txs/block_txs_handler.ts` |
 | BitVector length: non-negative and <= `MAX_TXS_PER_BLOCK` (65536) | Deserialization throws -> `BADLY_FORMED_REQUEST` | `protocols/block_txs/bitvector.ts` |
 | Archive root not found and no explicit txHashes | `NOT_FOUND` status | handler |
-| Internal error during lookup | Unhandled exception -> stream abort (no `INTERNAL_ERROR` status, unlike BLOCK) | handler |
+| Internal error during lookup | Unhandled exception -> stream abort (no `INTERNAL_ERROR` status) | handler |
 
 Conditional registration: BLOCK_TXS handler only registered when `config.disableTransactions` is false. Otherwise peers get `ERR_UNSUPPORTED_PROTOCOL`.
 

package/src/services/reqresp/batch-tx-requester/batch_tx_requester.ts

@@ -7,6 +7,7 @@ import { PeerErrorSeverity } from '@aztec/stdlib/p2p';
 import { Tx, TxArray, TxHash, type TxValidator } from '@aztec/stdlib/tx';
 
 import type { PeerId } from '@libp2p/interface';
+import { strict as assert } from 'assert';
 
 import type { IRequestTracker } from '../../tx_collection/request_tracker.js';
 import { ReqRespSubProtocol } from '.././interface.js';
@@ -459,24 +460,19 @@ export class BatchTxRequester {
    *   this implies we will query these peers couple of more times and give them a chance to "redeem" themselves before completely ignoring them
    */
   private handleFailResponseFromPeer(peerId: PeerId, responseStatus: ReqRespStatus) {
-    if (responseStatus === ReqRespStatus.FAILURE || responseStatus === ReqRespStatus.UNKNOWN) {
-      this.peers.penalisePeer(peerId, PeerErrorSeverity.HighToleranceError);
-      this.peers.markPeerDumb(peerId);
-      this.txsMetadata.clearPeerData(peerId);
-      return;
-    }
-
-    // NOT_FOUND means the peer pruned its block proposal — it can no longer serve
-    // index-based requests, but this is a legitimate state so we don't penalize.
-    // We use INTERNAL_ERROR to cover cases where the request-response consistency validation fails.
-    if (responseStatus === ReqRespStatus.NOT_FOUND || responseStatus === ReqRespStatus.INTERNAL_ERROR) {
-      this.peers.markPeerDumb(peerId);
-      this.txsMetadata.clearPeerData(peerId);
-      return;
-    }
-
-    if (responseStatus === ReqRespStatus.RATE_LIMIT_EXCEEDED) {
-      this.peers.markPeerRateLimitExceeded(peerId);
+    switch (responseStatus) {
+      case ReqRespStatus.RATE_LIMIT_EXCEEDED:
+        this.peers.markPeerRateLimitExceeded(peerId);
+        return;
+      case ReqRespStatus.INTERNAL_ERROR:
+        this.peers.markPeerDumb(peerId);
+        this.txsMetadata.clearPeerData(peerId);
+        return;
+      default: // includes FAILURE, UNKNOWN
+        this.peers.penalisePeer(peerId, PeerErrorSeverity.HighToleranceError);
+        this.peers.markPeerDumb(peerId);
+        this.txsMetadata.clearPeerData(peerId);
+        return;
     }
   }
 
@@ -564,9 +560,10 @@ export class BatchTxRequester {
       return;
     }
 
-    const hasArchiveRootMismatch = this.blockTxsSource.archive.toString() !== response.archiveRoot.toString();
-    if (hasArchiveRootMismatch) {
-      this.handleArchiveRootMismatch(peerId, response);
+    // If the peer doesn't have the block, we mark them as dumb.
+    if (!response.peerHasBlock()) {
+      this.peers.markPeerDumb(peerId);
+      this.txsMetadata.clearPeerData(peerId);
       return;
     }
 
@@ -584,21 +581,6 @@ export class BatchTxRequester {
     this.smartRequesterSemaphore.release();
   }
 
-  /**
-   * Handles an archive root mismatch between local state and peer response.
-   *
-   * - Response archive is Fr.ZERO (peer pruned proposal, legitimate): marks peer dumb.
-   * - Non-zero archive mismatch (malicious response): penalises + marks dumb.
-   */
-  private handleArchiveRootMismatch(peerId: PeerId, response: BlockTxsResponse): void {
-    if (!response.archiveRoot.isZero()) {
-      this.peers.penalisePeer(peerId, PeerErrorSeverity.LowToleranceError);
-    }
-
-    this.peers.markPeerDumb(peerId);
-    this.txsMetadata.clearPeerData(peerId);
-  }
-
   private peerHasSomeTxsWeAreMissing(_peerId: PeerId, response: BlockTxsResponse): boolean {
     if (response.txIndices.isEmpty()) {
       return false;
@@ -614,15 +596,9 @@ export class BatchTxRequester {
   }
 
   private extractHashesPeerHasFromResponse(response: BlockTxsResponse): Array<TxHash> {
-    const hashes: TxHash[] = [];
-    const indicesOfHashesPeerHas = new Set(response.txIndices.getTrueIndices());
-    this.blockTxsSource.txHashes.forEach((hash, idx) => {
-      if (indicesOfHashesPeerHas.has(idx)) {
-        hashes.push(hash);
-      }
-    });
-
-    return hashes;
+    // Should already have been validated, but just in case.
+    assert(response.txIndices.getLength() === this.blockTxsSource.txHashes.length);
+    return response.txIndices.getTrueIndices().map(idx => this.blockTxsSource.txHashes[idx]);
   }
 
   /*

package/src/services/reqresp/config.ts

@@ -5,6 +5,23 @@ export const DEFAULT_OVERALL_REQUEST_TIMEOUT_MS = 10_000; // Not currently used
 export const DEFAULT_REQRESP_DIAL_TIMEOUT_MS = 5_000;
 export const DEFAULT_OPTIMISTIC_NEGOTIATION = false;
 
+/**
+ * Max size of a yamux frame, header included. This is the library default, pinned explicitly when configuring the
+ * muxer in the libp2p service so a dependency upgrade cannot silently change it.
+ */
+export const YAMUX_MAX_MESSAGE_SIZE_BYTES = 64 * 1024;
+
+/** Size of a yamux data frame header. */
+const YAMUX_HEADER_LENGTH_BYTES = 12;
+
+/**
+ * Max size of a reqresp request payload. A request must fit in a single muxer frame: the responder never reassembles
+ * a request from multiple chunks (see `ReqResp.processStream`), and yamux splits writes larger than one frame into
+ * multiple frames, each of which arrives as a separate chunk. mplex only splits at 1 MiB, so yamux is the binding
+ * constraint.
+ */
+export const MAX_REQRESP_REQUEST_SIZE_BYTES = YAMUX_MAX_MESSAGE_SIZE_BYTES - YAMUX_HEADER_LENGTH_BYTES;
+
 // For use in tests.
 export const DEFAULT_P2P_REQRESP_CONFIG: P2PReqRespConfig = {
   overallRequestTimeoutMs: DEFAULT_OVERALL_REQUEST_TIMEOUT_MS,

package/src/services/reqresp/protocols/block_txs/bitvector.ts

@@ -58,8 +58,9 @@ export class BitVector {
   }
 
   /**
-   * Returns all indices which are set to true
-   * */
+   * Returns all indices which are set to true.
+   * Ordered by index. No duplicates.
+   */
   getTrueIndices(): number[] {
     return Array.from({ length: this.length }, (_, i) => i).filter(i => this.isSet(i));
   }

package/src/services/reqresp/protocols/block_txs/block_txs_handler.ts

@@ -1,6 +1,5 @@
-import { Fr } from '@aztec/foundation/curves/bn254';
 import type { L2BlockSource } from '@aztec/stdlib/block';
-import { TxArray } from '@aztec/stdlib/tx';
+import { TxArray, TxHash } from '@aztec/stdlib/tx';
 
 import type { PeerId } from '@libp2p/interface';
 
@@ -36,42 +35,45 @@ export function reqRespBlockTxsHandler(
     } catch (err: any) {
       throw new ReqRespStatusError(ReqRespStatus.BADLY_FORMED_REQUEST, { cause: err });
     }
-    // First try attestation pool, then fall back to archiver
-    let txHashes = (await attestationPool.getBlockProposalByArchive(request.archiveRoot.toString()))?.txHashes;
-    if (!txHashes) {
-      txHashes = (await archiver.getBlock({ archive: request.archiveRoot }))?.body.txEffects.map(
+
+    // In principle assume we haven't found the block. This is how that is signaled to the requester.
+    let availableIndicesBitVector: BitVector = BitVector.init(0, []);
+    // We always try to service the explicitly requested tx hashes, even if we don't have the block.
+    const requestedTxsHashes: Set<string> = new Set(request.txHashes.map(h => h.toString()));
+
+    // First try attestation pool, then fall back to archiver.
+    let blockTxHashes = (await attestationPool.getBlockProposalByArchive(request.archiveRoot.toString()))?.txHashes;
+    if (!blockTxHashes) {
+      blockTxHashes = (await archiver.getBlock({ archive: request.archiveRoot }))?.body.txEffects.map(
         effect => effect.txHash,
       );
     }
 
-    let requestedTxsHashes;
-    if (request.txHashes.length > 0) {
-      requestedTxsHashes = request.txHashes;
-    }
+    // If we have found the block,
+    if (blockTxHashes) {
+      // First confirm that we are talking about the same block (up to tx hashes and order).
+      // If we are not, then we can't:
+      // 1. Use the indices from the request to get the txs from the pool.
+      // 2. Respond to the peer with the txs we have using indices.
+      const blockTxHashesCommitment = BlockTxsRequest.computeBlockTxHashesCommitment(blockTxHashes);
+      if (blockTxHashesCommitment.equals(request.blockTxHashesCommitment)) {
+        // In that case, we can also get the available indices from the pool.
+        const txsAvailableInPool = await txPool.hasTxs(blockTxHashes);
+        // Map txs in the pool to their indices in the block
+        const availableIndices = txsAvailableInPool.map((hasTx, idx) => (hasTx ? idx : -1)).filter(idx => idx !== -1);
+        availableIndicesBitVector = BitVector.init(blockTxHashes.length, availableIndices);
 
-    // This is scenario in which we don't have this block the peer is requesting from us
-    // But peer has sent requested tx hashes, so we can send them the transactions
-    if (!txHashes && requestedTxsHashes !== undefined) {
-      const responseTxs = (await txPool.getTxsByHash(requestedTxsHashes)).filter(tx => !!tx);
-      const response = new BlockTxsResponse(Fr.zero(), new TxArray(...responseTxs), BitVector.init(0, []));
-      return response.toBuffer();
+        // We add the requested tx hashes (by index) to the list of tx hashes we are sending to the peer.
+        const requestedIndices = new Set(request.txIndices.getTrueIndices());
+        blockTxHashes.filter((_, idx) => requestedIndices.has(idx)).forEach(h => requestedTxsHashes.add(h.toString()));
+      }
     }
 
-    // If we don't have this block and peer has not sent requested tx hashes
-    if (!txHashes) {
-      throw new ReqRespStatusError(ReqRespStatus.NOT_FOUND);
-    }
-
-    const txsAvailableInPool = await txPool.hasTxs(txHashes);
-    // Map txs in the pool to their indices in the block
-    const availableIndices = txsAvailableInPool.map((hasTx, idx) => (hasTx ? idx : -1)).filter(idx => idx !== -1);
-    const responseBitVector = BitVector.init(txHashes.length, availableIndices);
-
-    const requestedIndices = new Set(request.txIndices.getTrueIndices());
-    requestedTxsHashes = txHashes.filter((_, idx) => requestedIndices.has(idx));
-
-    const responseTxs = (await txPool.getTxsByHash(requestedTxsHashes)).filter(tx => !!tx);
-    const response = new BlockTxsResponse(request.archiveRoot, new TxArray(...responseTxs), responseBitVector);
+    // Finally, get the txs from the pool and create the response.
+    const responseTxs = (
+      await txPool.getTxsByHash(Array.from(requestedTxsHashes).map(h => TxHash.fromString(h)))
+    ).filter(tx => !!tx);
+    const response = new BlockTxsResponse(new TxArray(...responseTxs), availableIndicesBitVector);
 
     return response.toBuffer();
   };

package/src/services/reqresp/protocols/block_txs/block_txs_reqresp.ts

@@ -1,8 +1,11 @@
+import { Buffer32 } from '@aztec/foundation/buffer';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 import { MAX_TX_SIZE_KB } from '@aztec/stdlib/p2p';
 import { TxArray, type TxHash, TxHashArray } from '@aztec/stdlib/tx';
 
+import { createHash } from 'node:crypto';
+
 import { BitVector } from './bitvector.js';
 
 /** Minimal interface for a block source that provides tx hashes and an archive root. */
@@ -16,17 +19,27 @@ export interface BlockTxsSource {
  */
 export class BlockTxsRequest {
   constructor(
-    // Archive root after the proposed block is applied (proposal identifier)
+    // Archive root after the proposed block is applied (proposal identifier).
     readonly archiveRoot: Fr,
-    // Hashes of txs we are requesting
-    readonly txHashes: TxHashArray,
-    // BitVector indicating which txs from the proposal we are requesting
-    // 1 means we want the tx, 0 means we don't
-    // If we know peer has the Block Proposal then we can use this BitVector
-    // Otherwise we can use this optimization
+    // BitVector indicating which txs from the block (proposal) we are requesting
+    // 1 means we want the tx, 0 means we don't.
+    // This will only return txs in the response if the peer has the block (proposal).
     readonly txIndices: BitVector,
+    // If we ask for txs via indices, the responder needs to be sure that we are talking about the same block.
+    // Unfortunately, the archive root is not enough, since it's possible for the peer to have seen a different
+    // block (proposal) with the same archive root but different txs. We include a commitment to the tx hashes
+    // so that the responder can verify this (for its own sake, and not be penalized).
+    readonly blockTxHashesCommitment: Buffer32,
+    // Explicit hashes of txs we are requesting (optional). The peer will try to serve these txs even if
+    // it doesn't have the block. If the requester lists txs from the block here, this serves as a fallback.
+    // Note: if a hash here is NOT part of the block (proposal), the peer can decide to return it or not.
+    readonly txHashes: TxHashArray,
   ) {}
 
+  static computeBlockTxHashesCommitment(blockTxHashes: TxHash[]): Buffer32 {
+    return Buffer32.fromBuffer(createHash('sha256').update(serializeToBuffer(blockTxHashes)).digest());
+  }
+
   /**
    * Creates new BlockTxsRequest given a block txs source and missing tx hashes.
    *
@@ -59,8 +72,9 @@ export class BlockTxsRequest {
 
     const requestBitVector = BitVector.init(blockTxsSource.txHashes.length, missingIndices);
     const hashes = includeFullTxHashes ? new TxHashArray(...missingTxHashes) : new TxHashArray();
+    const commitment = BlockTxsRequest.computeBlockTxHashesCommitment(blockTxsSource.txHashes);
 
-    return new BlockTxsRequest(blockTxsSource.archive, hashes, requestBitVector);
+    return new BlockTxsRequest(blockTxsSource.archive, requestBitVector, commitment, hashes);
   }
 
   /**
@@ -71,10 +85,11 @@ export class BlockTxsRequest {
   static fromBuffer(buffer: Buffer | BufferReader): BlockTxsRequest {
     const reader = BufferReader.asReader(buffer);
     const archiveRoot = Fr.fromBuffer(reader);
-    const txHashes = TxHashArray.fromBuffer(reader);
     const txIndices = BitVector.fromBuffer(reader);
+    const commitment = Buffer32.fromBuffer(reader);
+    const txHashes = TxHashArray.fromBuffer(reader);
 
-    return new BlockTxsRequest(archiveRoot, txHashes, txIndices);
+    return new BlockTxsRequest(archiveRoot, txIndices, commitment, txHashes);
   }
 
   /**
@@ -82,7 +97,12 @@ export class BlockTxsRequest {
    * @returns Buffer representation of the BlockTxRequest object
    */
   toBuffer(): Buffer {
-    return serializeToBuffer([this.archiveRoot, this.txHashes.toBuffer(), this.txIndices.toBuffer()]);
+    return serializeToBuffer([
+      this.archiveRoot,
+      this.txIndices.toBuffer(),
+      this.blockTxHashesCommitment.toBuffer(),
+      this.txHashes.toBuffer(),
+    ]);
   }
 }
 
@@ -91,13 +111,23 @@ export class BlockTxsRequest {
  */
 export class BlockTxsResponse {
   constructor(
-    readonly archiveRoot: Fr,
-    readonly txs: TxArray, // List of transactions we requested and peer has
+    // List of transactions we requested and peer has.
+    readonly txs: TxArray,
     // BitVector indicating which txs from the proposal are available at the peer
-    // 1 means the tx is available, 0 means it is not
+    // 1 means the tx is available, 0 means it is not.
+    // The vector should be empty to signal that the peer doesn't have the block.
+    // Otherwise, it should be a subset of the indices of the block tx hashes.
     readonly txIndices: BitVector,
   ) {}
 
+  /**
+   * Whether the response indicates that the peer has the block.
+   * @returns True if the peer has the block, false otherwise.
+   */
+  peerHasBlock(): boolean {
+    return this.txIndices.getLength() > 0;
+  }
+
   /**
    * Deserializes the BlockTxResponse object from a Buffer
    * @param buffer - Buffer or BufferReader object to deserialize
@@ -105,25 +135,22 @@ export class BlockTxsResponse {
    */
   static fromBuffer(buffer: Buffer | BufferReader): BlockTxsResponse {
     const reader = BufferReader.asReader(buffer);
-    const archiveRoot = Fr.fromBuffer(reader);
     const txs = TxArray.fromBuffer(reader);
     const txIndices = BitVector.fromBuffer(reader);
 
-    return new BlockTxsResponse(archiveRoot, txs, txIndices);
+    return new BlockTxsResponse(txs, txIndices);
   }
 
   /**
    * Serializes the BlockTxResponse object into a Buffer
-   * @dev: In current implementation, txIndices is serialized as Buffer of unknown length,
-   * thus we serialize it last
    * @returns Buffer representation of the BlockTxResponse object
    */
   toBuffer(): Buffer {
-    return serializeToBuffer([this.archiveRoot, this.txs.toBuffer(), this.txIndices.toBuffer()]);
+    return serializeToBuffer([this.txs.toBuffer(), this.txIndices.toBuffer()]);
   }
 
   static empty(): BlockTxsResponse {
-    return new BlockTxsResponse(Fr.ZERO, new TxArray(), BitVector.init(0, []));
+    return new BlockTxsResponse(new TxArray(), BitVector.init(0, []));
   }
 }