@aztec/p2p 0.0.1-commit.f2ce05ee → 0.0.1-commit.f5a9928

package/src/services/dummy_service.ts

@@ -1,6 +1,6 @@
 import type { EthAddress } from '@aztec/foundation/eth-address';
-import type { PeerInfo } from '@aztec/stdlib/interfaces/server';
-import type { Gossipable, PeerErrorSeverity } from '@aztec/stdlib/p2p';
+import type { P2PConnectivity, PeerInfo } from '@aztec/stdlib/interfaces/server';
+import type { Gossipable, PeerErrorSeverity, TopicType } from '@aztec/stdlib/p2p';
 import { Tx, TxHash } from '@aztec/stdlib/tx';
 
 import type { PeerId } from '@libp2p/interface';
@@ -18,15 +18,17 @@ import type {
   ReqRespSubProtocol,
   ReqRespSubProtocolHandler,
   ReqRespSubProtocolHandlers,
-  ReqRespSubProtocolValidators,
   SubProtocolMap,
 } from './reqresp/interface.js';
 import type { GoodByeReason } from './reqresp/protocols/goodbye.js';
 import { ReqRespStatus } from './reqresp/status.js';
 import {
   type P2PBlockReceivedCallback,
+  type P2PCheckpointAttestationCallback,
   type P2PCheckpointReceivedCallback,
+  type P2PDuplicateAttestationCallback,
   type P2PDuplicateProposalCallback,
+  type P2POversizedProposalCallback,
   type P2PService,
   type PeerDiscoveryService,
   PeerDiscoveryState,
@@ -36,6 +38,8 @@ import {
  * A dummy implementation of the P2P Service.
  */
 export class DummyP2PService implements P2PService {
+  private allNodesCheckpointReceivedCallback?: P2PCheckpointReceivedCallback;
+
   updateConfig(_config: Partial<P2PReqRespConfig>): void {}
 
   /** Returns an empty array for peers. */
@@ -43,6 +47,15 @@ export class DummyP2PService implements P2PService {
     return [];
   }
 
+  /** Reports p2p as disabled, since this service does not run a p2p stack. */
+  getP2PConnectivity(): P2PConnectivity {
+    return { enabled: false, connectedPeers: 0 };
+  }
+
+  getGossipMeshPeerCount(_topicType: TopicType): number {
+    return 0;
+  }
+
   /**
    * Starts the dummy implementation.
    * @returns A resolved promise.
@@ -81,13 +94,28 @@ export class DummyP2PService implements P2PService {
   /**
    * Register a callback into the validator client for when a checkpoint proposal is received
    */
-  public registerCheckpointReceivedCallback(_callback: P2PCheckpointReceivedCallback) {}
+  public registerValidatorCheckpointReceivedCallback(_callback: P2PCheckpointReceivedCallback) {}
+  public registerAllNodesCheckpointReceivedCallback(callback: P2PCheckpointReceivedCallback) {
+    this.allNodesCheckpointReceivedCallback = callback;
+  }
 
   /**
    * Register a callback for when a duplicate proposal is detected
    */
   public registerDuplicateProposalCallback(_callback: P2PDuplicateProposalCallback): void {}
 
+  /**
+   * Register a callback for when an oversized proposal is stored
+   */
+  public registerOversizedProposalCallback(_callback: P2POversizedProposalCallback): void {}
+
+  /**
+   * Register a callback for when a duplicate attestation is detected
+   */
+  public registerDuplicateAttestationCallback(_callback: P2PDuplicateAttestationCallback): void {}
+
+  public registerCheckpointAttestationCallback(_callback: P2PCheckpointAttestationCallback): void {}
+
   /**
    * Sends a request to a peer.
    * @param _protocol - The protocol to send the request on.
@@ -101,19 +129,6 @@ export class DummyP2PService implements P2PService {
     return Promise.resolve(undefined);
   }
 
-  /**
-   * Sends a batch request to a peer.
-   * @param _protocol - The protocol to send the request on.
-   * @param _requests - The requests to send.
-   * @returns The responses from the peer, otherwise undefined.
-   */
-  public sendBatchRequest<Protocol extends ReqRespSubProtocol>(
-    _protocol: Protocol,
-    _requests: InstanceType<SubProtocolMap[Protocol]['request']>[],
-  ): Promise<InstanceType<SubProtocolMap[Protocol]['response']>[]> {
-    return Promise.resolve([]);
-  }
-
   public sendRequestToPeer(
     _peerId: PeerId,
     _subProtocol: ReqRespSubProtocol,
@@ -131,19 +146,11 @@ export class DummyP2PService implements P2PService {
     return undefined;
   }
 
-  validate(_txs: Tx[]): Promise<void> {
+  validateTxsReceivedInBlockProposal(_txs: Tx[]): Promise<void> {
     return Promise.resolve();
   }
 
-  validatePropagatedTx(_tx: Tx, _peerId: PeerId): Promise<boolean> {
-    return Promise.resolve(true);
-  }
-
-  addReqRespSubProtocol(
-    _subProtocol: ReqRespSubProtocol,
-    _handler: ReqRespSubProtocolHandler,
-    _validator?: ReqRespSubProtocolValidators[ReqRespSubProtocol],
-  ): Promise<void> {
+  addReqRespSubProtocol(_subProtocol: ReqRespSubProtocol, _handler: ReqRespSubProtocolHandler): Promise<void> {
     return Promise.resolve();
   }
 
@@ -172,6 +179,7 @@ export class DummyP2PService implements P2PService {
       peerScoring: {
         penalizePeer: (_peerId, _penalty) => {},
       },
+      validateRequestedBlockTxsConsistency: () => Promise.resolve(true),
     };
   }
 }
@@ -276,10 +284,8 @@ export class DummyPeerManager implements PeerManagerInterface {
 
 export class DummyReqResp implements ReqRespInterface {
   updateConfig(_config: Partial<P2PReqRespConfig>): void {}
-  start(
-    _subProtocolHandlers: ReqRespSubProtocolHandlers,
-    _subProtocolValidators: ReqRespSubProtocolValidators,
-  ): Promise<void> {
+  setShouldRejectPeer(): void {}
+  start(_subProtocolHandlers: ReqRespSubProtocolHandlers): Promise<void> {
     return Promise.resolve();
   }
   stop(): Promise<void> {
@@ -291,16 +297,6 @@ export class DummyReqResp implements ReqRespInterface {
   ): Promise<InstanceType<SubProtocolMap[SubProtocol]['response']> | undefined> {
     return Promise.resolve(undefined);
   }
-  sendBatchRequest<SubProtocol extends ReqRespSubProtocol>(
-    _subProtocol: SubProtocol,
-    _requests: InstanceType<SubProtocolMap[SubProtocol]['request']>[],
-    _pinnedPeer: PeerId | undefined,
-    _timeoutMs?: number,
-    _maxPeers?: number,
-    _maxRetryAttempts?: number,
-  ): Promise<InstanceType<SubProtocolMap[SubProtocol]['response']>[]> {
-    return Promise.resolve([]);
-  }
   public sendRequestToPeer(
     _peerId: PeerId,
     _subProtocol: ReqRespSubProtocol,
@@ -319,11 +315,7 @@ export class DummyReqResp implements ReqRespInterface {
     };
   }
 
-  addSubProtocol(
-    _subProtocol: ReqRespSubProtocol,
-    _handler: ReqRespSubProtocolHandler,
-    _validator?: ReqRespSubProtocolValidators[ReqRespSubProtocol],
-  ): Promise<void> {
+  addSubProtocol(_subProtocol: ReqRespSubProtocol, _handler: ReqRespSubProtocolHandler): Promise<void> {
     return Promise.resolve();
   }
 }

package/src/services/encoding.ts

@@ -1,34 +1,41 @@
 // Taken from lodestar: https://github.com/ChainSafe/lodestar
-import { sha256 } from '@aztec/foundation/crypto/sha256';
 import { createLogger } from '@aztec/foundation/log';
 import { MAX_TX_SIZE_KB, TopicType, getTopicFromString } from '@aztec/stdlib/p2p';
 
-import type { RPC } from '@chainsafe/libp2p-gossipsub/message';
 import type { DataTransform } from '@chainsafe/libp2p-gossipsub/types';
 import type { Message } from '@libp2p/interface';
+import { webcrypto } from 'node:crypto';
 import { compressSync, uncompressSync } from 'snappy';
-import xxhashFactory from 'xxhash-wasm';
 
-// Load WASM
-const xxhash = await xxhashFactory();
-
-// Use salt to prevent msgId from being mined for collisions
-const h64Seed = BigInt(Math.floor(Math.random() * 1e9));
+/**
+ * Fallback maximum response size (in KB) applied when no explicit per-request bound is supplied.
+ * Used both as the `SnappyTransform` default and as the reception-side fallback in `readMessage`.
+ */
+export const DEFAULT_MAX_RESPONSE_SIZE_KB = 10 * 1024;
 
-// Shared buffer to convert msgId to string
-const sharedMsgIdBuf = Buffer.alloc(20);
+/** Thrown when a Snappy-compressed response exceeds the allowed decompressed size. */
+export class OversizedSnappyResponseError extends Error {
+  constructor(decompressedSize: number, maxSizeKb: number) {
+    super(`Decompressed size ${decompressedSize} exceeds maximum allowed size of ${maxSizeKb}kb`);
+    this.name = 'OversizedSnappyResponseError';
+  }
+}
 
 /**
- * The function used to generate a gossipsub message id
- * We use the first 8 bytes of SHA256(data) for content addressing
+ * Thrown when the compressed bytes accumulated while reading a response stream exceed the reception
+ * bound, before the full payload is buffered. Distinct from {@link OversizedSnappyResponseError},
+ * which guards the decompressed size after the stream has already been fully received.
  */
-export function fastMsgIdFn(rpcMsg: RPC.Message): string {
-  if (rpcMsg.data) {
-    return xxhash.h64Raw(rpcMsg.data, h64Seed).toString(16);
+export class ResponseSizeLimitExceededError extends Error {
+  constructor(accumulatedBytes: number, limitBytes: number) {
+    super(`Accumulated response size ${accumulatedBytes} bytes exceeds reception limit of ${limitBytes} bytes`);
+    this.name = 'ResponseSizeLimitExceededError';
   }
-  return '0000000000000000';
 }
 
+// Shared buffer to convert msgId to string
+const sharedMsgIdBuf = Buffer.alloc(20);
+
 export function msgIdToStrFn(msgId: Uint8Array): string {
   // This happens serially, no need to reallocate the buffer
   sharedMsgIdBuf.set(msgId);
@@ -41,14 +48,22 @@ export function msgIdToStrFn(msgId: Uint8Array): string {
  * Follows similarly to:
  * https://github.com/ethereum/consensus-specs/blob/v1.1.0-alpha.7/specs/altair/p2p-interface.md#topics-and-messages
  *
+ * The topic length is framed into the hash input (`uint32be(topicLen) || topic || data`) so the
+ * `(topic, data)` boundary is unambiguous. A raw `topic || data` concatenation is not injective —
+ * shifting bytes across the boundary (e.g. `(topic + data[0], data[1:])`) yields the same bytes and
+ * thus the same id, letting an unsubscribed-topic message pre-occupy a real message's seenCache slot
+ * and suppress it as a duplicate.
+ *
  * @param message - The libp2p message
  * @returns The message identifier
  */
-export function getMsgIdFn(message: Message) {
-  const { topic } = message;
-
-  const vec = [Buffer.from(topic), message.data];
-  return sha256(Buffer.concat(vec)).subarray(0, 20);
+export async function getMsgIdFn({ topic, data }: Pick<Message, 'topic' | 'data'>): Promise<Uint8Array> {
+  const topicBytes = Buffer.from(topic);
+  const framedTopicLength = Buffer.allocUnsafe(4);
+  framedTopicLength.writeUInt32BE(topicBytes.length);
+  const buffer = Buffer.concat([framedTopicLength, topicBytes, data]);
+  const hash = await webcrypto.subtle.digest('SHA-256', buffer);
+  return Buffer.from(hash.slice(0, 20));
 }
 
 const DefaultMaxSizesKb: Record<TopicType, number> = {
@@ -58,7 +73,8 @@ const DefaultMaxSizesKb: Record<TopicType, number> = {
   // Proposals may carry some tx objects, so we allow a larger size capped at 10mb
   // Note this may not be enough for carrying all tx objects in a block
   [TopicType.block_proposal]: 1024 * 10,
-  // TODO(palla/mbps): Check size for checkpoint proposal
+  // Checkpoint proposals carry almost the same data as a block proposal (see the lastBlockProposal)
+  // Only diff is an additional header, which is pretty small compared to the 10mb limit
   [TopicType.checkpoint_proposal]: 1024 * 10,
 };
 
@@ -68,7 +84,7 @@ const DefaultMaxSizesKb: Record<TopicType, number> = {
 export class SnappyTransform implements DataTransform {
   constructor(
     private maxSizesKb: Record<TopicType, number> = DefaultMaxSizesKb,
-    private defaultMaxSizeKb: number = 10 * 1024,
+    private defaultMaxSizeKb: number = DEFAULT_MAX_RESPONSE_SIZE_KB,
     private logger = createLogger('p2p:snappy-transform'),
   ) {}
 
@@ -78,15 +94,15 @@ export class SnappyTransform implements DataTransform {
     return this.inboundTransformData(Buffer.from(data), topic);
   }
 
-  public inboundTransformData(data: Buffer, topic?: TopicType): Buffer {
+  public inboundTransformData(data: Buffer, topic?: TopicType, maxSizeKbOverride?: number): Buffer {
     if (data.length === 0) {
       return data;
     }
-    const maxSizeKb = this.maxSizesKb[topic!] ?? this.defaultMaxSizeKb;
+    const maxSizeKb = maxSizeKbOverride ?? this.maxSizesKb[topic!] ?? this.defaultMaxSizeKb;
     const { decompressedSize } = readSnappyPreamble(data);
     if (decompressedSize > maxSizeKb * 1024) {
       this.logger.warn(`Decompressed size ${decompressedSize} exceeds maximum allowed size of ${maxSizeKb}kb`);
-      throw new Error(`Decompressed size ${decompressedSize} exceeds maximum allowed size of ${maxSizeKb}kb`);
+      throw new OversizedSnappyResponseError(decompressedSize, maxSizeKb);
     }
 
     return Buffer.from(uncompressSync(data, { asBuffer: true }));

package/src/services/gossipsub/README.md

@@ -40,7 +40,7 @@ We configure all parameters (P1-P4) with values calculated dynamically from netw
 | P3b: meshFailurePenalty | -34 per topic | Sticky penalty after pruning |
 | P4: invalidMessageDeliveries | -20 per message | Attack detection |
 
-**Important:** P1 and P2 are only enabled on topics with P3 enabled (block_proposal, checkpoint_proposal, checkpoint_attestation). The tx topic has all scoring disabled except P4, to prevent free positive score accumulation that would offset penalties from other topics.
+**Important:** P1 and P2 are only enabled on topics with P3 enabled. By default, P3 is enabled for checkpoint_proposal and checkpoint_attestation (2 topics). Block proposal scoring is controlled by `expectedBlockProposalsPerSlot` (current default: `0`, including when env var is unset, so disabled) - see [Block Proposals](#block-proposals-block_proposal) for details. The tx topic has all scoring disabled except P4, to prevent free positive score accumulation that would offset penalties from other topics.
 
 ## Exponential Decay
 
@@ -205,7 +205,7 @@ This ensures P3 max penalty (-34) exceeds P1 + P2 max (+33), causing mesh prunin
 | Topic | Expected/Slot | Decay Window | Notes |
 |-------|--------------|--------------|-------|
 | `tx` | Unpredictable | N/A | P3/P3b disabled |
-| `block_proposal` | N-1 | 3 slots | N = blocks per slot (MBPS mode) |
+| `block_proposal` | N-1 | 3 slots | N = blocks per slot |
 | `checkpoint_proposal` | 1 | 5 slots | One per slot |
 | `checkpoint_attestation` | C (~48) | 2 slots | C = committee size |
 
@@ -217,7 +217,21 @@ Transactions are submitted unpredictably by users, so we cannot set meaningful d
 
 ### Block Proposals (block_proposal)
 
-In Multi-Block-Per-Slot (MBPS) mode, N-1 block proposals are gossiped per slot (the last block is bundled with the checkpoint). In single-block mode, this is 0.
+Block proposal scoring is controlled by the `expectedBlockProposalsPerSlot` config (`SEQ_EXPECTED_BLOCK_PROPOSALS_PER_SLOT` env var):
+
+| Config Value | Behavior |
+|-------------|----------|
+| `0` (current default) | Block proposal P3 scoring is **disabled** |
+| Positive number | Uses the provided value as expected proposals per slot |
+| `undefined` | Falls back to `blocksPerSlot - 1` (N-1 when the slot fits multiple blocks, 0 when it fits one) |
+
+**Current behavior note:** In the current implementation, if `SEQ_EXPECTED_BLOCK_PROPOSALS_PER_SLOT` is not set, config mapping applies `0` by default (scoring disabled). The `undefined` fallback above is currently reachable only if the value is explicitly provided as `undefined` in code.
+
+**Future intent:** Once throughput is stable, we may change env parsing/defaults so an unset env var resolves to `undefined` again (re-enabling automatic fallback to `blocksPerSlot - 1`).
+
+**Why disabled by default?** Gossipsub expects N-1 block proposals per slot. When transaction throughput is low (as expected at launch), fewer blocks are actually built, causing peers to be incorrectly penalized for under-delivering block proposals. The default of 0 disables this scoring. Set to a positive value when throughput increases and block production is consistent.
+
+When a slot fits multiple blocks, N-1 block proposals are gossiped per slot (the last block is bundled with the checkpoint). When the slot fits exactly one block, this is 0.
 
 ### Checkpoint Proposals (checkpoint_proposal)
 
@@ -240,7 +254,8 @@ The scoring parameters depend on:
 | `slotDuration` | L1RollupConstants | 72s |
 | `targetCommitteeSize` | L1RollupConstants | 48 |
 | `heartbeatInterval` | P2PConfig.gossipsubInterval | 700ms |
-| `blockDurationMs` | P2PConfig.blockDurationMs | undefined (single block) |
+| `blockDurationMs` | P2PConfig.blockDurationMs | 3000ms |
+| `expectedBlockProposalsPerSlot` | P2PConfig.expectedBlockProposalsPerSlot | 0 (disabled; current unset-env behavior) |
 
 ## Invalid Message Handling (P4)
 
@@ -320,9 +335,9 @@ Conversely, if topic scores are low, a peer slightly above the disconnect thresh
 
 Topic scores provide **burst response** to attacks, while app score provides **stable baseline**:
 
-- P1 (time in mesh): Max +8 per topic (+24 across 3 topics)
-- P2 (first deliveries): Max +25 per topic (+75 across 3 topics, but decays fast)
-- P3 (under-delivery): Max -34 per topic (-102 across 3 topics in MBPS; -68 in single-block mode)
+- P1 (time in mesh): Max +8 per topic (+16 default, +24 with block proposal scoring enabled)
+- P2 (first deliveries): Max +25 per topic (+50 default, +75 with block proposal scoring, but decays fast)
+- P3 (under-delivery): Max -34 per topic (-68 default with 2 topics, -102 with block proposal scoring enabled)
 - P4 (invalid messages): -20 per invalid message, can spike to -2000+ during attacks
 
 Example attack scenario:
@@ -373,21 +388,21 @@ When a peer is pruned from the mesh:
 3. **P3b captures the penalty**: The P3 deficit at prune time becomes P3b, which decays slowly
 
 After pruning, the peer's score consists mainly of P3b:
-- **Total P3b across 3 topics: -102** (max)
+- **Total P3b: -68** (default, 2 topics) or **-102** (with block proposal scoring enabled, 3 topics)
 - **Recovery time**: P3b decays to ~1% over one decay window (2-5 slots = 2-6 minutes)
 - **Grafting eligibility**: Peer can be grafted when score ≥ 0, but asymptotic decay means recovery is slow
 
 ### Why Non-Contributors Aren't Disconnected
 
-With P3b capped at -102 total after pruning (MBPS mode). In single-block mode, the cap is -68:
+With P3b capped at -68 (default, 2 topics) or -102 (with block proposal scoring, 3 topics) after pruning:
 
 | Threshold | Value | P3b Score | Triggered? |
 |-----------|-------|-----------|------------|
-| gossipThreshold | -500 | -102 (MBPS) / -68 (single) | No |
-| publishThreshold | -1000 | -102 (MBPS) / -68 (single) | No |
-| graylistThreshold | -2000 | -102 (MBPS) / -68 (single) | No |
+| gossipThreshold | -500 | -68 (default) / -102 (block scoring on) | No |
+| publishThreshold | -1000 | -68 (default) / -102 (block scoring on) | No |
+| graylistThreshold | -2000 | -68 (default) / -102 (block scoring on) | No |
 
-**A score of -102 (MBPS) or -68 (single-block) is well above -500**, so non-contributing peers:
+**A score of -68 or -102 is well above -500**, so non-contributing peers:
 - Are pruned from mesh (good - stops them slowing propagation)
 - Still receive gossip (can recover by reconnecting/restarting)
 - Are NOT disconnected unless they also have application-level penalties
@@ -455,7 +470,22 @@ Application scores decay by 10% per minute (`decayFactor = 0.9`):
 - Score -100 → -35 after 10 minutes
 - Score -100 → -12 after 20 minutes
 
-This allows honest peers to recover from temporary issues.
+This allows honest peers to recover from temporary issues — but only up to the ban threshold. Once a peer
+crosses into the **Banned** state, decay no longer applies until the ban expires (see Ban Duration below).
+
+### Ban Duration
+
+Once a peer's score drops below the ban threshold (`MIN_SCORE_BEFORE_BAN = -100`) the ban is held for a configurable
+duration:
+
+- The score the peer held when banned is recorded in memory alongside an expiry timestamp.
+- While the ban is active, `getScore` returns the **ban score** regardless of decay, so the peer stays in the
+  `Banned` state for the full window and cannot decay its way out early.
+- When the ban expires it is removed and the live (decayed) score takes over again, letting the peer recover.
+
+The ban duration is controlled by `P2P_PEER_BAN_DURATION_SECONDS` (config field `peerBanDurationSeconds`), defaulting
+to 24 hours. Bans are held in memory only (cleared on restart). This is independent of the gossipsub topic-score
+decay (P4, P3b), which continues to decay as described above; only the application-level ban score is pinned.
 
 ## Score Calculation Examples
 
@@ -529,15 +559,22 @@ Initial state: Total score -3003
 
 After 4 slots (~5 min):
   P4 decays to 1%: -2000 → -20
-  App score unchanged: -1000
+  App score pinned at ban floor: -1000
   Total: -1023 → Still banned, but no longer graylisted
 
-After 10 min:
-  App score decays: -100 → -35 → -350 contribution
-  P4 further decayed: ~-5
-  Total: -358 → Above gossipThreshold, starting to recover
+For the rest of the ban window (default 24h):
+  Topic scores (P4, P3b) keep decaying toward 0
+  App score stays pinned at the ban floor: -1000 contribution
+  Total: ~-1000 → Remains banned (cannot publish)
+
+After the ban expires:
+  The ban is lifted; the live app score (now decayed toward 0) takes over
+  Total: recovers, peer can participate again
 ```
 
+Unlike topic scores, the application ban score does **not** decay-recover during the ban window — that is the
+point of the ban duration (see above). A banned peer is held for the full `P2P_PEER_BAN_DURATION_SECONDS`.
+
 ## Network Outage Analysis
 
 What happens when a peer experiences a network outage and stops delivering messages?
@@ -547,7 +584,7 @@ What happens when a peer experiences a network outage and stops delivering messa
 While the peer is disconnected:
 
 1. **P3 penalty accumulates**: The message delivery counter decays toward 0, causing increasing P3 penalty
-2. **Max P3 penalty reached**: Once counter drops below threshold, penalty hits -34 per topic (-102 total in MBPS; -68 single-block)
+2. **Max P3 penalty reached**: Once counter drops below threshold, penalty hits -34 per topic (-68 default, -102 with block proposal scoring)
 3. **Mesh pruning**: Topic score goes negative → peer is pruned from mesh
 4. **P3b captures penalty**: The P3 deficit at prune time becomes P3b (sticky penalty)
 
@@ -569,13 +606,13 @@ Note: If the peer just joined the mesh, P3 penalties only start after
 During a network outage, the peer:
 - **Does NOT send invalid messages** → No P4 penalty
 - **Does NOT violate protocols** → No application-level penalty
-- **Only accumulates topic-level penalties** → Max -102 (P3b, MBPS) or -68 (single-block)
+- **Only accumulates topic-level penalties** → Max -68 (default) or -102 (with block proposal scoring)
 
 This is the crucial difference from malicious behavior:
 
 | Scenario | App Score | Topic Score | Total | Threshold Hit |
 |----------|-----------|-------------|-------|---------------|
-| Network outage | 0 | -102 (MBPS) / -68 (single) | -102 / -68 | None |
+| Network outage | 0 | -68 (default) / -102 (block scoring on) | -68 / -102 | None |
 | Validation failure | -50 | -20 | -520 | gossipThreshold |
 | Malicious peer | -100 | -2000+ | -2100+ | graylistThreshold |
 

package/src/services/gossipsub/topic_score_params.ts

@@ -1,5 +1,4 @@
 import { TopicType, createTopicString } from '@aztec/stdlib/p2p';
-import { calculateMaxBlocksPerSlot } from '@aztec/stdlib/timetable';
 
 import { createTopicScoreParams } from '@chainsafe/libp2p-gossipsub/score';
 
@@ -13,22 +12,15 @@ export type TopicScoringNetworkParams = {
   heartbeatIntervalMs: number;
   /** Target committee size (number of validators expected to attest per slot) */
   targetCommitteeSize: number;
-  /** Duration per block in milliseconds when building multiple blocks per slot. If undefined, single block mode. */
-  blockDurationMs?: number;
+  /**
+   * Max blocks per checkpoint, the network-wide config value. Used to derive expected per-slot message rates
+   * for scoring; it is a peer-rate threshold input, not a consensus deadline.
+   */
+  maxBlocksPerCheckpoint: number;
+  /** Expected number of block proposals per slot for scoring override. 0 disables scoring, undefined falls back to blocksPerSlot - 1. */
+  expectedBlockProposalsPerSlot?: number;
 };
 
-/**
- * Calculates the number of blocks per slot based on timing parameters.
- * Uses the shared calculation from @aztec/stdlib/timetable.
- *
- * @param slotDurationMs - L2 slot duration in milliseconds
- * @param blockDurationMs - Duration per block in milliseconds (undefined = single block mode)
- * @returns Number of blocks per slot
- */
-export function calculateBlocksPerSlot(slotDurationMs: number, blockDurationMs: number | undefined): number {
-  return calculateMaxBlocksPerSlot(slotDurationMs / 1000, blockDurationMs ? blockDurationMs / 1000 : undefined);
-}
-
 /**
  * Determines the decay window in slots based on expected message frequency.
  * Low-frequency topics need longer decay windows to accumulate meaningful counter values.
@@ -89,18 +81,41 @@ export function computeThreshold(convergence: number, conservativeFactor: number
   return convergence * conservativeFactor;
 }
 
+/**
+ * Determines the effective expected block proposals per slot for scoring.
+ * Returns undefined if scoring should be disabled, or a positive number if enabled.
+ *
+ * @param blocksPerSlot - Number of blocks per slot from timetable
+ * @param expectedBlockProposalsPerSlot - Config override. 0 disables scoring, undefined falls back to blocksPerSlot - 1.
+ * @returns Positive number of expected block proposals, or undefined if scoring is disabled
+ */
+export function getEffectiveBlockProposalsPerSlot(
+  blocksPerSlot: number,
+  expectedBlockProposalsPerSlot?: number,
+): number | undefined {
+  if (expectedBlockProposalsPerSlot !== undefined) {
+    return expectedBlockProposalsPerSlot > 0 ? expectedBlockProposalsPerSlot : undefined;
+  }
+  // Fallback: In MBPS mode, N-1 block proposals per slot (last one bundled with checkpoint)
+  // In single block mode (blocksPerSlot=1), this is 0 → disabled
+  const fallback = Math.max(0, blocksPerSlot - 1);
+  return fallback > 0 ? fallback : undefined;
+}
+
 /**
  * Gets the expected messages per slot for a given topic type.
  *
  * @param topicType - The topic type
  * @param targetCommitteeSize - Target committee size
  * @param blocksPerSlot - Number of blocks per slot
+ * @param expectedBlockProposalsPerSlot - Override for block proposals. 0 disables scoring, undefined falls back to blocksPerSlot - 1.
  * @returns Expected messages per slot, or undefined if unpredictable
  */
 export function getExpectedMessagesPerSlot(
   topicType: TopicType,
   targetCommitteeSize: number,
   blocksPerSlot: number,
+  expectedBlockProposalsPerSlot?: number,
 ): number | undefined {
   switch (topicType) {
     case TopicType.tx:
@@ -108,9 +123,7 @@ export function getExpectedMessagesPerSlot(
       return undefined;
 
     case TopicType.block_proposal:
-      // In MBPS mode, N-1 block proposals per slot (last one bundled with checkpoint)
-      // In single block mode (blocksPerSlot=1), this is 0
-      return Math.max(0, blocksPerSlot - 1);
+      return getEffectiveBlockProposalsPerSlot(blocksPerSlot, expectedBlockProposalsPerSlot);
 
     case TopicType.checkpoint_proposal:
       // Exactly 1 checkpoint proposal per slot
@@ -190,10 +203,12 @@ const P2_DECAY_WINDOW_SLOTS = 2;
 //   |P3| > 8 + 25 = 33
 //
 // We set P3 max = -34 per topic (slightly more than P1+P2) to ensure pruning.
-// With 3 topics having P3 enabled, total P3b after pruning = -102.
+// The number of P3-enabled topics depends on config: by default 2 (checkpoint_proposal +
+// checkpoint_attestation), or 3 if block proposal scoring is enabled via
+// expectedBlockProposalsPerSlot. Total P3b after pruning = -68 (2 topics) or -102 (3 topics).
 //
-// With appSpecificWeight=10, ~20 HighTolerance errors (-40 app score) plus max P3b (-102)
-// would cross gossipThreshold (-500). This keeps non-contributors from being disconnected
+// With appSpecificWeight=10, ~20 HighTolerance errors (-40 app score) plus max P3b (-68 or -102)
+// would not cross gossipThreshold (-500). This keeps non-contributors from being disconnected
 // unless they also accrue app-level penalties.
 //
 // The weight formula ensures max penalty equals MAX_P3_PENALTY_PER_TOPIC:
@@ -203,12 +218,6 @@ const P2_DECAY_WINDOW_SLOTS = 2;
 /** Maximum P3 penalty per topic (must exceed P1 + P2 to cause pruning) */
 export const MAX_P3_PENALTY_PER_TOPIC = -(MAX_P1_SCORE + MAX_P2_SCORE + 1); // -34
 
-/** Number of topics with P3 enabled in MBPS mode (block_proposal + checkpoint_proposal + checkpoint_attestation) */
-export const NUM_P3_ENABLED_TOPICS = 3;
-
-/** Total maximum P3b penalty across all topics after pruning in MBPS mode */
-export const TOTAL_MAX_P3B_PENALTY = MAX_P3_PENALTY_PER_TOPIC * NUM_P3_ENABLED_TOPICS; // -102
-
 /**
  * Factory class for creating gossipsub topic scoring parameters.
  * Computes shared values once and reuses them across all topics.
@@ -257,10 +266,11 @@ export class TopicScoreParamsFactory {
   };
 
   constructor(private readonly params: TopicScoringNetworkParams) {
-    const { slotDurationMs, heartbeatIntervalMs, blockDurationMs } = params;
+    const { slotDurationMs, heartbeatIntervalMs } = params;
 
-    // Compute values that are the same for all topics
-    this.blocksPerSlot = calculateBlocksPerSlot(slotDurationMs, blockDurationMs);
+    // Compute values that are the same for all topics. The block count comes straight from the network-wide
+    // max-blocks-per-checkpoint config value.
+    this.blocksPerSlot = params.maxBlocksPerCheckpoint;
     this.heartbeatsPerSlot = slotDurationMs / heartbeatIntervalMs;
     this.invalidDecay = computeDecay(heartbeatIntervalMs, slotDurationMs, INVALID_DECAY_WINDOW_SLOTS);
 
@@ -384,6 +394,18 @@ export class TopicScoreParamsFactory {
     });
   }
 
+  /** Number of topics with P3 enabled, computed from config. Always 2 (checkpoint_proposal + checkpoint_attestation) plus optionally block_proposal. */
+  get numP3EnabledTopics(): number {
+    const blockProposalP3Enabled =
+      getEffectiveBlockProposalsPerSlot(this.blocksPerSlot, this.params.expectedBlockProposalsPerSlot) !== undefined;
+    return blockProposalP3Enabled ? 3 : 2;
+  }
+
+  /** Total maximum P3b penalty across all topics after pruning, computed from config */
+  get totalMaxP3bPenalty(): number {
+    return MAX_P3_PENALTY_PER_TOPIC * this.numP3EnabledTopics;
+  }
+
   /**
    * Creates topic score parameters for a specific topic type.
    *
@@ -391,7 +413,12 @@ export class TopicScoreParamsFactory {
    * @returns TopicScoreParams for the topic
    */
   createForTopic(topicType: TopicType): ReturnType<typeof createTopicScoreParams> {
-    const expectedPerSlot = getExpectedMessagesPerSlot(topicType, this.params.targetCommitteeSize, this.blocksPerSlot);
+    const expectedPerSlot = getExpectedMessagesPerSlot(
+      topicType,
+      this.params.targetCommitteeSize,
+      this.blocksPerSlot,
+      this.params.expectedBlockProposalsPerSlot,
+    );
 
     // For unpredictable topics (tx) or topics with 0 expected messages, disable P3/P3b
     if (expectedPerSlot === undefined || expectedPerSlot === 0) {