@aztec/p2p 0.0.1-commit.b655e406 → 0.0.1-commit.b9865e97

package/src/services/reqresp/protocols/tx.ts

@@ -1,5 +1,5 @@
 import { chunk } from '@aztec/foundation/collection';
-import type { P2PClientType } from '@aztec/stdlib/p2p';
+import { MAX_TX_SIZE_KB } from '@aztec/stdlib/p2p';
 import { TxArray, TxHash, TxHashArray } from '@aztec/stdlib/tx';
 
 import type { PeerId } from '@libp2p/interface';
@@ -16,7 +16,7 @@ import { ReqRespStatus, ReqRespStatusError } from '../status.js';
  * @param mempools - the mempools
  * @returns the Tx request handler
  */
-export function reqRespTxHandler<T extends P2PClientType>(mempools: MemPools<T>): ReqRespSubProtocolHandler {
+export function reqRespTxHandler(mempools: MemPools): ReqRespSubProtocolHandler {
   /**
    * Handler for tx requests
    * @param msg - the tx request message
@@ -51,8 +51,27 @@ export function reqRespTxHandler<T extends P2PClientType>(mempools: MemPools<T>)
  *  Per: https://github.com/AztecProtocol/aztec-packages/issues/15149#issuecomment-2999054485
  *  we define Q as max number of transactions per batch, the comment explains why we use 8.
  */
-//TODO: (mralj) chunk size should by default be 8, this is just temporary until the protocol is implemented correctly
-//more info:  https://github.com/AztecProtocol/aztec-packages/pull/15516#pullrequestreview-2995474321
-export function chunkTxHashesRequest(hashes: TxHash[], chunkSize = 1): Array<TxHashArray> {
+export function chunkTxHashesRequest(hashes: TxHash[], chunkSize = 8): Array<TxHashArray> {
   return chunk(hashes, chunkSize).map(chunk => new TxHashArray(...chunk));
 }
+
+/**
+ * Calculate the expected response size for a TX request.
+ * @param requestBuffer - The serialized request buffer containing TxHashArray
+ * @returns Expected response size in KB
+ */
+export function calculateTxResponseSize(requestBuffer: Buffer): number {
+  try {
+    const txHashes = TxHashArray.fromBuffer(requestBuffer);
+    // TxHashArray.fromBuffer returns empty array on parse failure, so check for that
+    if (txHashes.length === 0 && requestBuffer.length > 0) {
+      // If we got an empty array but had a non-empty buffer, parsing likely failed
+      // Fall back to allowing a single transaction response
+      return MAX_TX_SIZE_KB + 1;
+    }
+    return Math.max(txHashes.length, 1) * MAX_TX_SIZE_KB + 1; // +1 KB overhead, at least 1 tx
+  } catch {
+    // If we can't parse the request, fall back to allowing a single transaction response
+    return MAX_TX_SIZE_KB + 1;
+  }
+}

package/src/services/reqresp/rate-limiter/rate_limiter.ts

@@ -97,9 +97,10 @@ export function prettyPrintRateLimitStatus(status: RateLimitStatus) {
  * 2. Individual rate limits for each peer.
  *
  * How it works:
- * - When a request comes in, it first checks against the global rate limit.
- * - If the global limit allows, it then checks against the specific peer's rate limit.
- * - The request is only allowed if both the global and peer-specific limits allow it.
+ * - When a request comes in, it first checks against the peer's individual rate limit.
+ * - If the peer limit allows, it then checks against the global rate limit.
+ * - The request is only allowed if both the peer-specific and global limits allow it.
+ * - Checking peer limit first ensures a rate-limited peer cannot exhaust the global quota.
  * - It automatically creates and manages rate limiters for new peers as they make requests.
  * - It periodically cleans up rate limiters for inactive peers to conserve memory.
  *
@@ -119,10 +120,6 @@ export class SubProtocolRateLimiter {
   }
 
   allow(peerId: PeerId): RateLimitStatus {
-    if (!this.globalLimiter.allow()) {
-      return RateLimitStatus.DeniedGlobal;
-    }
-
     const peerIdStr = peerId.toString();
     let peerLimiter: PeerRateLimiter | undefined = this.peerLimiters.get(peerIdStr);
     if (!peerLimiter) {
@@ -135,10 +132,17 @@ export class SubProtocolRateLimiter {
     } else {
       peerLimiter.lastAccess = Date.now();
     }
-    const peerLimitAllowed = peerLimiter.limiter.allow();
-    if (!peerLimitAllowed) {
+
+    // Check peer limit first: a rate-limited peer must not consume global quota,
+    // otherwise one spamming peer can starve all others by exhausting the global bucket.
+    if (!peerLimiter.limiter.allow()) {
       return RateLimitStatus.DeniedPeer;
     }
+
+    if (!this.globalLimiter.allow()) {
+      return RateLimitStatus.DeniedGlobal;
+    }
+
     return RateLimitStatus.Allowed;
   }
 

package/src/services/reqresp/rate-limiter/rate_limits.ts

@@ -42,16 +42,6 @@ export const DEFAULT_RATE_LIMITS: ReqRespSubProtocolRateLimits = {
       quotaCount: 200,
     },
   },
-  [ReqRespSubProtocol.BLOCK]: {
-    peerLimit: {
-      quotaTimeMs: 1000,
-      quotaCount: 2,
-    },
-    globalLimit: {
-      quotaTimeMs: 1000,
-      quotaCount: 5,
-    },
-  },
   [ReqRespSubProtocol.GOODBYE]: {
     peerLimit: {
       quotaTimeMs: 1000,

package/src/services/reqresp/reqresp.ts

@@ -1,5 +1,4 @@
 // @attribution: lodestar impl for inspiration
-import { compactArray } from '@aztec/foundation/collection';
 import { AbortError, TimeoutError } from '@aztec/foundation/error';
 import { createLogger } from '@aztec/foundation/log';
 import { executeTimeout } from '@aztec/foundation/timer';
@@ -11,31 +10,25 @@ import type { Libp2p } from 'libp2p';
 import { pipeline } from 'node:stream/promises';
 import type { Uint8ArrayList } from 'uint8arraylist';
 
-import {
-  CollectiveReqRespTimeoutError,
-  IndividualReqRespTimeoutError,
-  InvalidResponseError,
-} from '../../errors/reqresp.error.js';
-import { SnappyTransform } from '../encoding.js';
+import { IndividualReqRespTimeoutError } from '../../errors/reqresp.error.js';
+import { OversizedSnappyResponseError, SnappyTransform } from '../encoding.js';
 import type { PeerScoring } from '../peer-manager/peer_scoring.js';
 import {
   DEFAULT_INDIVIDUAL_REQUEST_TIMEOUT_MS,
   DEFAULT_REQRESP_DIAL_TIMEOUT_MS,
   type P2PReqRespConfig,
 } from './config.js';
-import { BatchConnectionSampler } from './connection-sampler/batch_connection_sampler.js';
 import { ConnectionSampler, RandomSampler } from './connection-sampler/connection_sampler.js';
 import {
-  DEFAULT_SUB_PROTOCOL_VALIDATORS,
   type ReqRespInterface,
   type ReqRespResponse,
   ReqRespSubProtocol,
   type ReqRespSubProtocolHandler,
   type ReqRespSubProtocolHandlers,
   type ReqRespSubProtocolRateLimits,
-  type ReqRespSubProtocolValidators,
-  type SubProtocolMap,
-  responseFromBuffer,
+  type ShouldRejectPeer,
+  UNAUTHENTICATED_ALLOWED_PROTOCOLS,
+  subProtocolSizeCalculators,
 } from './interface.js';
 import { ReqRespMetrics } from './metrics.js';
 import {
@@ -43,13 +36,13 @@ import {
   RequestResponseRateLimiter,
   prettyPrintRateLimitStatus,
 } from './rate-limiter/rate_limiter.js';
-import { ReqRespStatus, ReqRespStatusError, parseStatusChunk, prettyPrintReqRespStatus } from './status.js';
+import { ReqRespStatus, ReqRespStatusError, parseStatusChunk } from './status.js';
 
 /**
  * The Request Response Service
  *
  * It allows nodes to request specific information from their peers, its use case covers recovering
- * information that was missed during a syncronisation or a gossip event.
+ * information that was missed during a synchronisation or a gossip event.
  *
  * This service implements the request response sub protocol, it is heavily inspired from
  * ethereum implementations of the same name.
@@ -64,13 +57,14 @@ export class ReqResp implements ReqRespInterface {
   private dialTimeoutMs: number = DEFAULT_REQRESP_DIAL_TIMEOUT_MS;
 
   private subProtocolHandlers: Partial<ReqRespSubProtocolHandlers> = {};
-  private subProtocolValidators: Partial<ReqRespSubProtocolValidators> = {};
 
   private connectionSampler: ConnectionSampler;
   private rateLimiter: RequestResponseRateLimiter;
 
   private snappyTransform: SnappyTransform;
 
+  private shouldRejectPeer: ShouldRejectPeer | undefined;
+
   private metrics: ReqRespMetrics;
 
   constructor(
@@ -107,18 +101,29 @@ export class ReqResp implements ReqRespInterface {
     }
   }
 
+  public setShouldRejectPeer(checker: ShouldRejectPeer): void {
+    this.shouldRejectPeer = checker;
+  }
+
   get tracer() {
     return this.metrics.tracer;
   }
 
+  /**
+   * Get the connection sampler instance
+   */
+  getConnectionSampler(): Pick<ConnectionSampler, 'getPeerListSortedByConnectionCountAsc'> {
+    return this.connectionSampler;
+  }
+
   /**
    * Start the reqresp service
    */
-  async start(subProtocolHandlers: ReqRespSubProtocolHandlers, subProtocolValidators: ReqRespSubProtocolValidators) {
+  async start(subProtocolHandlers: ReqRespSubProtocolHandlers) {
     Object.assign(this.subProtocolHandlers, subProtocolHandlers);
-    Object.assign(this.subProtocolValidators, subProtocolValidators);
 
-    // Register all protocol handlers
+    // Register streamHandler with libp2p.
+    // The streamHandler is responsible for reading the incoming stream, determining the protocol, then triggering the appropriate handler.
     for (const subProtocol of Object.keys(subProtocolHandlers)) {
       this.logger.debug(`Registering handler for sub protocol ${subProtocol}`);
       await this.libp2p.handle(
@@ -132,13 +137,8 @@ export class ReqResp implements ReqRespInterface {
     this.rateLimiter.start();
   }
 
-  async addSubProtocol(
-    subProtocol: ReqRespSubProtocol,
-    handler: ReqRespSubProtocolHandler,
-    validator: ReqRespSubProtocolValidators[ReqRespSubProtocol] = DEFAULT_SUB_PROTOCOL_VALIDATORS[subProtocol],
-  ): Promise<void> {
+  async addSubProtocol(subProtocol: ReqRespSubProtocol, handler: ReqRespSubProtocolHandler): Promise<void> {
     this.subProtocolHandlers[subProtocol] = handler;
-    this.subProtocolValidators[subProtocol] = validator;
     this.logger.debug(`Registering handler for sub protocol ${subProtocol}`);
     await this.libp2p.handle(
       subProtocol,
@@ -172,186 +172,6 @@ export class ReqResp implements ReqRespInterface {
     // NOTE: We assume libp2p instance is managed by the caller
   }
 
-  /**
-   * Request multiple messages over the same sub protocol, balancing the requests across peers.
-   *
-   * @devnote
-   * - The function prioritizes sending requests to free peers using a batch sampling strategy.
-   * - If a peer fails to respond or returns an invalid response, it is removed from the sampling pool and replaced.
-   * - The function stops retrying once all requests are processed, no active peers remain, or the maximum retry attempts are reached.
-   * - Responses are validated using a custom validator for the sub-protocol.*
-   *
-   * Requests are sent in parallel to each peer, but multiple requests are sent to the same peer in series
-   * - If a peer fails to respond or returns an invalid response, it is removed from the sampling pool and replaced.
-   * - The function stops retrying once all requests are processed, no active peers remain, or the maximum retry attempts are reached.
-   * - Responses are validated using a custom validator for the sub-protocol.*
-   *
-   * @param subProtocol
-   * @param requests
-   * @param timeoutMs
-   * @param maxPeers
-   * @returns
-   *
-   * @throws {CollectiveReqRespTimeoutError} - If the request batch exceeds the specified timeout (`timeoutMs`).
-   */
-  @trackSpan(
-    'ReqResp.sendBatchRequest',
-    (subProtocol: ReqRespSubProtocol, requests: InstanceType<SubProtocolMap[ReqRespSubProtocol]['request']>[]) => ({
-      [Attributes.P2P_REQ_RESP_PROTOCOL]: subProtocol,
-      [Attributes.P2P_REQ_RESP_BATCH_REQUESTS_COUNT]: requests.length,
-    }),
-  )
-  async sendBatchRequest<SubProtocol extends ReqRespSubProtocol>(
-    subProtocol: SubProtocol,
-    requests: InstanceType<SubProtocolMap[SubProtocol]['request']>[],
-    pinnedPeer: PeerId | undefined,
-    timeoutMs = 10000,
-    maxPeers = Math.max(10, Math.ceil(requests.length / 3)),
-    maxRetryAttempts = 3,
-  ): Promise<InstanceType<SubProtocolMap[SubProtocol]['response']>[]> {
-    const responseValidator = this.subProtocolValidators[subProtocol] ?? DEFAULT_SUB_PROTOCOL_VALIDATORS[subProtocol];
-    const responses: InstanceType<SubProtocolMap[SubProtocol]['response']>[] = new Array(requests.length);
-    const requestBuffers = requests.map(req => req.toBuffer());
-
-    const requestFunction = async (signal: AbortSignal) => {
-      // Track which requests still need to be processed
-      const pendingRequestIndices = new Set(requestBuffers.map((_, i) => i));
-
-      // Create batch sampler with the total number of requests and max peers
-      const batchSampler = new BatchConnectionSampler(
-        this.connectionSampler,
-        requests.length,
-        maxPeers,
-        compactArray([pinnedPeer]), // Exclude pinned peer from sampling, we will forcefully send all requests to it
-        createLogger(`${this.logger.module}:batch-connection-sampler`),
-      );
-
-      if (batchSampler.activePeerCount === 0 && !pinnedPeer) {
-        this.logger.warn('No active peers to send requests to');
-        return [];
-      }
-
-      // This is where it gets fun
-      // The outer loop is the retry loop, we will continue to retry until we process all indices we have
-      // not received a response for, or we have reached the max retry attempts
-
-      // The inner loop is the batch loop, we will process all requests for each peer in parallel
-      // We will then process the results of the requests, and resample any peers that failed to respond
-      // We will continue to retry until we have processed all indices, or we have reached the max retry attempts
-
-      let retryAttempts = 0;
-      while (pendingRequestIndices.size > 0 && batchSampler.activePeerCount > 0 && retryAttempts < maxRetryAttempts) {
-        if (signal.aborted) {
-          throw new AbortError('Batch request aborted');
-        }
-        // Process requests in parallel for each available peer
-        type BatchEntry = { peerId: PeerId; indices: number[] };
-        const requestBatches = new Map<string, BatchEntry>();
-
-        // Group requests by peer
-        for (const requestIndex of pendingRequestIndices) {
-          const peer = batchSampler.getPeerForRequest(requestIndex);
-          if (!peer) {
-            break;
-          }
-          const peerAsString = peer.toString();
-          if (!requestBatches.has(peerAsString)) {
-            requestBatches.set(peerAsString, { peerId: peer, indices: [] });
-          }
-          requestBatches.get(peerAsString)!.indices.push(requestIndex);
-        }
-
-        // If there is a pinned peer, we will always send every request to that peer
-        // We use the default limits for the subprotocol to avoid hitting the rate limiter
-        if (pinnedPeer) {
-          const limit = this.rateLimiter.getRateLimits(subProtocol).peerLimit.quotaCount;
-          requestBatches.set(pinnedPeer.toString(), {
-            peerId: pinnedPeer,
-            indices: Array.from(pendingRequestIndices.values()).slice(0, limit),
-          });
-        }
-
-        // Make parallel requests for each peer's batch
-        // A batch entry will look something like this:
-        // PeerId0: [0, 1, 2, 3]
-        // PeerId1: [4, 5, 6, 7]
-
-        // Peer Id 0 will send requests 0, 1, 2, 3 in serial
-        // while simultaneously Peer Id 1 will send requests 4, 5, 6, 7 in serial
-
-        const batchResults = await Promise.all(
-          Array.from(requestBatches.entries()).map(async ([peerAsString, { peerId: peer, indices }]) => {
-            try {
-              // Requests all going to the same peer are sent synchronously
-              const peerResults: { index: number; response: InstanceType<SubProtocolMap[SubProtocol]['response']> }[] =
-                [];
-              for (const index of indices) {
-                this.logger.trace(`Sending request ${index} to peer ${peerAsString}`);
-                const response = await this.sendRequestToPeer(peer, subProtocol, requestBuffers[index]);
-
-                // Check the status of the response buffer
-                if (response.status !== ReqRespStatus.SUCCESS) {
-                  this.logger.debug(
-                    `Request to peer ${peerAsString} failed with status ${prettyPrintReqRespStatus(response.status)}`,
-                  );
-
-                  // If we hit a rate limit or some failure, we remove the peer and return the results,
-                  // they will be split among remaining peers and the new sampled peer
-                  batchSampler.removePeerAndReplace(peer);
-                  return { peer, results: peerResults };
-                }
-
-                if (response && response.data.length > 0) {
-                  const object = responseFromBuffer(subProtocol, response.data);
-                  const isValid = await responseValidator(requests[index], object, peer);
-
-                  if (isValid) {
-                    peerResults.push({ index, response: object });
-                  }
-                }
-              }
-
-              return { peer, results: peerResults };
-            } catch (error) {
-              this.logger.debug(`Failed batch request to peer ${peerAsString}:`, error);
-              batchSampler.removePeerAndReplace(peer);
-              return { peer, results: [] };
-            }
-          }),
-        );
-
-        // Process results
-        for (const { results } of batchResults) {
-          for (const { index, response } of results) {
-            if (response) {
-              responses[index] = response;
-              pendingRequestIndices.delete(index);
-            }
-          }
-        }
-
-        retryAttempts++;
-      }
-
-      if (retryAttempts >= maxRetryAttempts) {
-        this.logger.debug(`Max retry attempts ${maxRetryAttempts} reached for batch request`);
-      }
-
-      return responses;
-    };
-
-    try {
-      return await executeTimeout<InstanceType<SubProtocolMap[SubProtocol]['response']>[]>(
-        requestFunction,
-        timeoutMs,
-        () => new CollectiveReqRespTimeoutError(),
-      );
-    } catch (e: any) {
-      this.logger.debug(`${e.message} | subProtocol: ${subProtocol}`);
-      return [];
-    }
-  }
-
   /**
    * Sends a request to a specific peer
    *
@@ -391,6 +211,9 @@ export class ReqResp implements ReqRespInterface {
     try {
       this.metrics.recordRequestSent(subProtocol);
 
+      // Calculate expected response size based on the request payload
+      const expectedSizeKb = subProtocolSizeCalculators[subProtocol](payload);
+
       this.logger.trace(`Sending request to peer ${peerId.toString()} on sub protocol ${subProtocol}`);
       stream = await this.connectionSampler.dialProtocol(peerId, subProtocol, dialTimeout);
       this.logger.trace(
@@ -398,17 +221,21 @@ export class ReqResp implements ReqRespInterface {
       );
 
       const timeoutErr = new IndividualReqRespTimeoutError();
+      // Create a wrapper to pass the expected size to readMessage
+      const readMessageWithSizeLimit = (source: AsyncIterable<Uint8ArrayList>) =>
+        this.readMessage(source, expectedSizeKb);
       const [_, resp] = await executeTimeout(
         signal =>
           Promise.all([
             pipeline([payload], stream!.sink, { signal }),
-            pipeline(stream!.source, this.readMessage.bind(this), { signal }),
+            pipeline(stream!.source, readMessageWithSizeLimit, { signal }),
           ]),
         this.individualRequestTimeoutMs,
         () => timeoutErr,
       );
       return resp;
     } catch (e: any) {
+      this.logger.debug(`SUBPROTOCOL: ${subProtocol}\n`, e);
       // On error we immediately abort the stream, this is preferred way,
       // because it signals to the sender that error happened, whereas
       // closing the stream only closes our side and is much slower
@@ -463,8 +290,11 @@ export class ReqResp implements ReqRespInterface {
    * The message is split into two components
    * - The first chunk should contain a control byte, indicating the status of the response see `ReqRespStatus`
    * - The second chunk should contain the response data
+   *
+   * @param source - The async iterable source of data chunks
+   * @param maxSizeKb - Optional maximum expected size in KB for the decompressed response
    */
-  private async readMessage(source: AsyncIterable<Uint8ArrayList>): Promise<ReqRespResponse> {
+  private async readMessage(source: AsyncIterable<Uint8ArrayList>, maxSizeKb?: number): Promise<ReqRespResponse> {
     let status: ReqRespStatus | undefined;
     const chunks: Uint8Array[] = [];
 
@@ -489,23 +319,17 @@ export class ReqResp implements ReqRespInterface {
       }
 
       const messageData = Buffer.concat(chunks);
-      const message: Buffer = this.snappyTransform.inboundTransformData(messageData);
+      const message: Buffer = this.snappyTransform.inboundTransformData(messageData, undefined, maxSizeKb);
 
       return {
         status: status ?? ReqRespStatus.UNKNOWN,
         data: message,
       };
     } catch (e: any) {
+      // All errors (invalid status bytes, oversized snappy responses, corrupt data, etc.)
+      // are re-thrown so the caller can penalize the peer via handleResponseError.
       this.logger.debug(`Reading message failed: ${e.message}`);
-
-      let status = ReqRespStatus.UNKNOWN;
-      if (e instanceof ReqRespStatusError) {
-        status = e.status;
-      }
-
-      return {
-        status,
-      };
+      throw e;
     }
   }
 
@@ -545,6 +369,15 @@ export class ReqResp implements ReqRespInterface {
         throw new ReqRespStatusError(ReqRespStatus.RATE_LIMIT_EXCEEDED);
       }
 
+      // When p2pAllowOnlyValidators is enabled, reject unauthenticated peers on data protocols
+      if (
+        !UNAUTHENTICATED_ALLOWED_PROTOCOLS.has(protocol) &&
+        (this.shouldRejectPeer?.(connection.remotePeer.toString()) ?? false)
+      ) {
+        this.logger.debug(`Rejecting unauthenticated peer ${connection.remotePeer} on gated protocol ${protocol}`);
+        throw new ReqRespStatusError(ReqRespStatus.FAILURE);
+      }
+
       await this.processStream(protocol, incomingStream);
     } catch (err: any) {
       this.metrics.recordResponseError(protocol);
@@ -570,7 +403,9 @@ export class ReqResp implements ReqRespInterface {
         // and that this stream should be dropped
         const isMessageToNotWarn =
           err instanceof Error &&
-          ['stream reset', 'Cannot push value onto an ended pushable'].some(msg => err.message.includes(msg));
+          ['stream reset', 'Cannot push value onto an ended pushable', 'read ECONNRESET'].some(msg =>
+            err.message.includes(msg),
+          );
         const level = isMessageToNotWarn ? 'debug' : 'warn';
         this.logger[level]('Unknown stream error while handling the stream, aborting', {
           protocol,
@@ -687,13 +522,13 @@ export class ReqResp implements ReqRespInterface {
   ): PeerErrorSeverity | undefined {
     const logTags = { peerId: peerId.toString(), subProtocol };
 
-    //Punishable error - peer should never send badly formed request
+    // Punishable error - peer should never send badly formed request
     if (e instanceof ReqRespStatusError && e.status === ReqRespStatus.BADLY_FORMED_REQUEST) {
       this.logger.debug(`Punishable error in ${subProtocol}: ${e.cause}`, logTags);
       return PeerErrorSeverity.LowToleranceError;
     }
 
-    //TODO: (mralj): think if we should penalize peer here based on connection errors
+    // TODO: (mralj): think if we should penalize peer here based on connection errors
     return undefined;
   }
 
@@ -715,10 +550,18 @@ export class ReqResp implements ReqRespInterface {
       return undefined;
     }
 
-    // We do not punish a collective timeout, as the node triggers this interupt, independent of the peer's behaviour
-    if (e instanceof CollectiveReqRespTimeoutError || e instanceof InvalidResponseError) {
-      this.logger.debug(`Non-punishable error in ${subProtocol}: ${e.message}`, logTags);
-      return undefined;
+    // Invalid status byte: the peer sent a status byte that doesn't match any known status code.
+    // This is a protocol violation, penalize harshly.
+    if (e instanceof ReqRespStatusError) {
+      this.logger.warn(`Invalid status byte from peer ${peerId.toString()} in ${subProtocol}: ${e.message}`, logTags);
+      return PeerErrorSeverity.LowToleranceError;
+    }
+
+    // Oversized snappy response: the peer is sending data that exceeds the allowed size.
+    // This is a protocol violation that wastes bandwidth, so penalize harshly.
+    if (e instanceof OversizedSnappyResponseError) {
+      this.logger.warn(`Oversized response from peer ${peerId.toString()} in ${subProtocol}: ${e.message}`, logTags);
+      return PeerErrorSeverity.LowToleranceError;
     }
 
     return this.categorizeConnectionErrors(e, peerId, subProtocol);
@@ -726,7 +569,8 @@ export class ReqResp implements ReqRespInterface {
 
   /*
    * Errors specific to connection  handling
-   * These can happen  both when sending request and response*/
+   * These can happen  both when sending request and response.
+   */
   private categorizeConnectionErrors(
     e: any,
     peerId: PeerId,