@aztec/p2p 0.55.0 → 0.56.0

package/src/service/libp2p_service.ts

@@ -1,55 +1,63 @@
 import {
   BlockAttestation,
   BlockProposal,
+  type ClientProtocolCircuitVerifier,
   type Gossipable,
+  type L2BlockSource,
+  MerkleTreeId,
   type RawGossipMessage,
   TopicType,
   TopicTypeMap,
   Tx,
   TxHash,
+  type WorldStateSynchronizer,
 } from '@aztec/circuit-types';
+import { Fr } from '@aztec/circuits.js';
 import { createDebugLogger } from '@aztec/foundation/log';
 import { SerialQueue } from '@aztec/foundation/queue';
 import { RunningPromise } from '@aztec/foundation/running-promise';
 import type { AztecKVStore } from '@aztec/kv-store';
 
 import { type ENR } from '@chainsafe/enr';
-import { type GossipsubEvents, gossipsub } from '@chainsafe/libp2p-gossipsub';
+import { type GossipSub, type GossipSubComponents, gossipsub } from '@chainsafe/libp2p-gossipsub';
+import { createPeerScoreParams, createTopicScoreParams } from '@chainsafe/libp2p-gossipsub/score';
 import { noise } from '@chainsafe/libp2p-noise';
 import { yamux } from '@chainsafe/libp2p-yamux';
 import { identify } from '@libp2p/identify';
-import type { PeerId, PubSub } from '@libp2p/interface';
+import type { PeerId } from '@libp2p/interface';
 import '@libp2p/kad-dht';
 import { mplex } from '@libp2p/mplex';
 import { createFromJSON, createSecp256k1PeerId } from '@libp2p/peer-id-factory';
 import { tcp } from '@libp2p/tcp';
-import { type Libp2p, createLibp2p } from 'libp2p';
+import { createLibp2p } from 'libp2p';
 
 import { type AttestationPool } from '../attestation_pool/attestation_pool.js';
 import { type P2PConfig } from '../config.js';
 import { type TxPool } from '../tx_pool/index.js';
-import { convertToMultiaddr } from '../util.js';
+import {
+  DataTxValidator,
+  DoubleSpendTxValidator,
+  MetadataTxValidator,
+  TxProofValidator,
+} from '../tx_validator/index.js';
+import { type PubSubLibp2p, convertToMultiaddr } from '../util.js';
 import { AztecDatastore } from './data_store.js';
 import { PeerManager } from './peer_manager.js';
+import { PeerErrorSeverity } from './peer_scoring.js';
 import { pingHandler, statusHandler } from './reqresp/handlers.js';
 import {
   DEFAULT_SUB_PROTOCOL_HANDLERS,
+  DEFAULT_SUB_PROTOCOL_VALIDATORS,
   PING_PROTOCOL,
   type ReqRespSubProtocol,
   type ReqRespSubProtocolHandlers,
   STATUS_PROTOCOL,
   type SubProtocolMap,
   TX_REQ_PROTOCOL,
-  subProtocolMap,
 } from './reqresp/interface.js';
 import { ReqResp } from './reqresp/reqresp.js';
 import type { P2PService, PeerDiscoveryService } from './service.js';
 
-export interface PubSubLibp2p extends Libp2p {
-  services: {
-    pubsub: PubSub<GossipsubEvents>;
-  };
-}
 /**
  * Create a libp2p peer ID from the private key if provided, otherwise creates a new random ID.
  * @param privateKey - Optional peer ID private key as hex string
@@ -90,11 +98,18 @@ export class LibP2PService implements P2PService {
     private peerDiscoveryService: PeerDiscoveryService,
     private txPool: TxPool,
     private attestationPool: AttestationPool,
+    private l2BlockSource: L2BlockSource,
+    private proofVerifier: ClientProtocolCircuitVerifier,
+    private worldStateSynchronizer: WorldStateSynchronizer,
     private requestResponseHandlers: ReqRespSubProtocolHandlers = DEFAULT_SUB_PROTOCOL_HANDLERS,
     private logger = createDebugLogger('aztec:libp2p_service'),
   ) {
     this.peerManager = new PeerManager(node, peerDiscoveryService, config, logger);
-    this.reqresp = new ReqResp(config, node);
+    this.node.services.pubsub.score.params.appSpecificScore = (peerId: string) => {
+      return this.peerManager.getPeerScore(peerId);
+    };
+    this.node.services.pubsub.score.params.appSpecificWeight = 10;
+    this.reqresp = new ReqResp(config, node, this.peerManager);
 
     this.blockReceivedCallback = (block: BlockProposal): Promise<BlockAttestation | undefined> => {
       this.logger.verbose(
@@ -136,18 +151,24 @@ export class LibP2PService implements P2PService {
 
     // add GossipSub listener
     this.node.services.pubsub.addEventListener('gossipsub:message', async e => {
-      const { msg } = e.detail;
+      const { msg, propagationSource: peerId } = e.detail;
       this.logger.debug(`Received PUBSUB message.`);
 
-      await this.jobQueue.put(() => this.handleNewGossipMessage(msg));
+      await this.jobQueue.put(() => this.handleNewGossipMessage(msg, peerId));
     });
 
     // Start running promise for peer discovery
     this.discoveryRunningPromise = new RunningPromise(() => {
-      this.peerManager.discover();
+      this.peerManager.heartbeat();
     }, this.config.peerCheckIntervalMS);
     this.discoveryRunningPromise.start();
-    await this.reqresp.start(this.requestResponseHandlers);
+
+    // Define the sub protocol validators - This is done within this start() method to gain a callback to the existing validateTx function
+    const reqrespSubProtocolValidators = {
+      ...DEFAULT_SUB_PROTOCOL_VALIDATORS,
+      [TX_REQ_PROTOCOL]: this.validateRequestedTx.bind(this),
+    };
+    await this.reqresp.start(this.requestResponseHandlers, reqrespSubProtocolValidators);
   }
 
   /**
@@ -181,6 +202,9 @@ export class LibP2PService implements P2PService {
     peerId: PeerId,
     txPool: TxPool,
     attestationPool: AttestationPool,
+    l2BlockSource: L2BlockSource,
+    proofVerifier: ClientProtocolCircuitVerifier,
+    worldStateSynchronizer: WorldStateSynchronizer,
     store: AztecKVStore,
   ) {
     const { tcpListenAddress, tcpAnnounceAddress, minPeerCount, maxPeerCount } = config;
@@ -223,13 +247,22 @@ export class LibP2PService implements P2PService {
         }),
         pubsub: gossipsub({
           allowPublishToZeroTopicPeers: true,
-          D: 6,
-          Dlo: 4,
-          Dhi: 12,
-          heartbeatInterval: 1_000,
-          mcacheLength: 5,
-          mcacheGossip: 3,
-        }),
+          D: config.gossipsubD,
+          Dlo: config.gossipsubDlo,
+          Dhi: config.gossipsubDhi,
+          heartbeatInterval: config.gossipsubInterval,
+          mcacheLength: config.gossipsubMcacheLength,
+          mcacheGossip: config.gossipsubMcacheGossip,
+          scoreParams: createPeerScoreParams({
+            topics: {
+              [Tx.p2pTopic]: createTopicScoreParams({
+                topicWeight: 1,
+                invalidMessageDeliveriesWeight: -20,
+                invalidMessageDeliveriesDecay: 0.5,
+              }),
+            },
+          }),
+        }) as (components: GossipSubComponents) => GossipSub,
       },
     });
 
@@ -252,7 +285,17 @@ export class LibP2PService implements P2PService {
       [TX_REQ_PROTOCOL]: txHandler,
     };
 
-    return new LibP2PService(config, node, peerDiscoveryService, txPool, attestationPool, requestResponseHandlers);
+    return new LibP2PService(
+      config,
+      node,
+      peerDiscoveryService,
+      txPool,
+      attestationPool,
+      l2BlockSource,
+      proofVerifier,
+      worldStateSynchronizer,
+      requestResponseHandlers,
+    );
   }
 
   /**
@@ -265,18 +308,11 @@ export class LibP2PService implements P2PService {
    * @param request The request type to send
    * @returns
    */
-  async sendRequest<SubProtocol extends ReqRespSubProtocol>(
+  sendRequest<SubProtocol extends ReqRespSubProtocol>(
     protocol: SubProtocol,
     request: InstanceType<SubProtocolMap[SubProtocol]['request']>,
   ): Promise<InstanceType<SubProtocolMap[SubProtocol]['response']> | undefined> {
-    const pair = subProtocolMap[protocol];
-
-    const res = await this.reqresp.sendRequest(protocol, request.toBuffer());
-    if (!res) {
-      return undefined;
-    }
-
-    return pair.response.fromBuffer(res!);
+    return this.reqresp.sendRequest(protocol, request);
   }
 
   /**
@@ -323,10 +359,10 @@ export class LibP2PService implements P2PService {
    * @param topic - The message's topic.
    * @param data - The message data
    */
-  private async handleNewGossipMessage(message: RawGossipMessage) {
+  private async handleNewGossipMessage(message: RawGossipMessage, peerId: PeerId) {
     if (message.topic === Tx.p2pTopic) {
       const tx = Tx.fromBuffer(Buffer.from(message.data));
-      await this.processTxFromPeer(tx);
+      await this.processTxFromPeer(tx, peerId);
     }
     if (message.topic === BlockAttestation.p2pTopic) {
       const attestation = BlockAttestation.fromBuffer(Buffer.from(message.data));
@@ -376,11 +412,121 @@ export class LibP2PService implements P2PService {
     void this.jobQueue.put(() => Promise.resolve(this.sendToPeers(message)));
   }
 
-  private async processTxFromPeer(tx: Tx): Promise<void> {
+  private async processTxFromPeer(tx: Tx, peerId: PeerId): Promise<void> {
     const txHash = tx.getTxHash();
     const txHashString = txHash.toString();
     this.logger.verbose(`Received tx ${txHashString} from external peer.`);
-    await this.txPool.addTxs([tx]);
+
+    const isValidTx = await this.validatePropagatedTx(tx, peerId);
+
+    if (isValidTx) {
+      await this.txPool.addTxs([tx]);
+    }
+  }
+
+  /**
+   * Validate a tx that has been requested from a peer.
+   *
+   * The core component of this validator is that the tx hash MUST match the requested tx hash,
+   * In order to perform this check, the tx proof must be verified.
+   *
+   * Note: This function is called from within `ReqResp.sendRequest` as part of the
+   * TX_REQ_PROTOCOL subprotocol validation.
+   *
+   * @param requestedTxHash - The hash of the tx that was requested.
+   * @param responseTx - The tx that was received as a response to the request.
+   * @param peerId - The peer ID of the peer that sent the tx.
+   * @returns True if the tx is valid, false otherwise.
+   */
+  private async validateRequestedTx(requestedTxHash: TxHash, responseTx: Tx, peerId: PeerId): Promise<boolean> {
+    const proofValidator = new TxProofValidator(this.proofVerifier);
+    const validProof = await proofValidator.validateTx(responseTx);
+
+    // If the node returns the wrong data, we penalize it
+    if (!requestedTxHash.equals(responseTx.getTxHash())) {
+      // Returning the wrong data is a low tolerance error
+      this.peerManager.penalizePeer(peerId, PeerErrorSeverity.MidToleranceError);
+      return false;
+    }
+
+    if (!validProof) {
+      // If the proof is invalid, but the txHash is correct, then this is an active attack and we severly punish
+      this.peerManager.penalizePeer(peerId, PeerErrorSeverity.LowToleranceError);
+      return false;
+    }
+
+    return true;
+  }
+
+  private async validatePropagatedTx(tx: Tx, peerId: PeerId): Promise<boolean> {
+    const blockNumber = (await this.l2BlockSource.getBlockNumber()) + 1;
+    // basic data validation
+    const dataValidator = new DataTxValidator();
+    const validData = await dataValidator.validateTx(tx);
+    if (!validData) {
+      // penalize
+      this.node.services.pubsub.score.markInvalidMessageDelivery(peerId.toString(), Tx.p2pTopic);
+      return false;
+    }
+
+    // metadata validation
+    const metadataValidator = new MetadataTxValidator(new Fr(this.config.l1ChainId), new Fr(blockNumber));
+    const validMetadata = await metadataValidator.validateTx(tx);
+    if (!validMetadata) {
+      // penalize
+      this.node.services.pubsub.score.markInvalidMessageDelivery(peerId.toString(), Tx.p2pTopic);
+      return false;
+    }
+
+    // double spend validation
+    const doubleSpendValidator = new DoubleSpendTxValidator({
+      getNullifierIndex: async (nullifier: Fr) => {
+        const merkleTree = this.worldStateSynchronizer.getLatest();
+        const index = await merkleTree.findLeafIndex(MerkleTreeId.NULLIFIER_TREE, nullifier.toBuffer());
+        return index;
+      },
+    });
+    const validDoubleSpend = await doubleSpendValidator.validateTx(tx);
+    if (!validDoubleSpend) {
+      // check if nullifier is older than 20 blocks
+      if (blockNumber - this.config.severePeerPenaltyBlockLength > 0) {
+        const snapshotValidator = new DoubleSpendTxValidator({
+          getNullifierIndex: async (nullifier: Fr) => {
+            const merkleTree = this.worldStateSynchronizer.getSnapshot(
+              blockNumber - this.config.severePeerPenaltyBlockLength,
+            );
+            const index = await merkleTree.findLeafIndex(MerkleTreeId.NULLIFIER_TREE, nullifier.toBuffer());
+            return index;
+          },
+        });
+
+        const validSnapshot = await snapshotValidator.validateTx(tx);
+        // High penalty if nullifier is older than 20 blocks
+        if (!validSnapshot) {
+          // penalize
+          this.peerManager.penalizePeer(peerId, PeerErrorSeverity.LowToleranceError);
+          return false;
+        }
+      }
+      // penalize
+      this.peerManager.penalizePeer(peerId, PeerErrorSeverity.HighToleranceError);
+      return false;
+    }
+
+    // proof validation
+    const proofValidator = new TxProofValidator(this.proofVerifier);
+    const validProof = await proofValidator.validateTx(tx);
+    if (!validProof) {
+      // penalize
+      this.peerManager.penalizePeer(peerId, PeerErrorSeverity.MidToleranceError);
+      return false;
+    }
+
+    return true;
+  }
+
+  public getPeerScore(peerId: PeerId): number {
+    return this.node.services.pubsub.score.score(peerId.toString());
   }
 
   private async sendToPeers<T extends Gossipable>(message: T) {

package/src/service/peer_manager.ts

@@ -3,9 +3,10 @@ import { createDebugLogger } from '@aztec/foundation/log';
 import { type ENR } from '@chainsafe/enr';
 import { type PeerId } from '@libp2p/interface';
 import { type Multiaddr } from '@multiformats/multiaddr';
-import { type Libp2p } from 'libp2p';
 
 import { type P2PConfig } from '../config.js';
+import { type PubSubLibp2p } from '../util.js';
+import { type PeerErrorSeverity, PeerScoring } from './peer_scoring.js';
 import { type PeerDiscoveryService } from './service.js';
 
 const MAX_DIAL_ATTEMPTS = 3;
@@ -20,12 +21,15 @@ type CachedPeer = {
 
 export class PeerManager {
   private cachedPeers: Map<string, CachedPeer> = new Map();
+  private peerScoring: PeerScoring;
+
   constructor(
-    private libP2PNode: Libp2p,
+    private libP2PNode: PubSubLibp2p,
     private peerDiscoveryService: PeerDiscoveryService,
     private config: P2PConfig,
     private logger = createDebugLogger('aztec:p2p:peer_manager'),
   ) {
+    this.peerScoring = new PeerScoring(config);
     // Handle new established connections
     this.libP2PNode.addEventListener('peer:connect', evt => {
       const peerId = evt.detail;
@@ -52,10 +56,25 @@ export class PeerManager {
     });
   }
 
+  public heartbeat() {
+    this.discover();
+    this.peerScoring.decayAllScores();
+  }
+
+  public penalizePeer(peerId: PeerId, penalty: PeerErrorSeverity) {
+    const id = peerId.toString();
+    const penaltyValue = this.peerScoring.peerPenalties[penalty];
+    this.peerScoring.updateScore(id, -penaltyValue);
+  }
+
+  public getPeerScore(peerId: string): number {
+    return this.peerScoring.getScore(peerId);
+  }
+
   /**
    * Discovers peers.
    */
-  public discover() {
+  private discover() {
     // Get current connections
     const connections = this.libP2PNode.getConnections();
 
@@ -155,7 +174,7 @@ export class PeerManager {
     }
   }
 
-  async dialPeer(peer: CachedPeer) {
+  private async dialPeer(peer: CachedPeer) {
     const id = peer.peerId.toString();
     await this.libP2PNode.peerStore.merge(peer.peerId, { multiaddrs: [peer.multiaddrTcp] });
 

package/src/service/peer_scoring.ts

@@ -0,0 +1,81 @@
+import { type P2PConfig } from '../config.js';
+
+export enum PeerErrorSeverity {
+  /**
+   * Not malicious action, but it must not be tolerated
+   * ~2 occurrences will get the peer banned
+   */
+  LowToleranceError = 'LowToleranceError',
+  /**
+   * Negative action that can be tolerated only sometimes
+   * ~10 occurrences will get the peer banned
+   */
+  MidToleranceError = 'MidToleranceError',
+  /**
+   * Some error that can be tolerated multiple times
+   * ~50 occurrences will get the peer banned
+   */
+  HighToleranceError = 'HighToleranceError',
+}
+
+const DefaultPeerPenalties = {
+  [PeerErrorSeverity.LowToleranceError]: 2,
+  [PeerErrorSeverity.MidToleranceError]: 10,
+  [PeerErrorSeverity.HighToleranceError]: 50,
+};
+
+export class PeerScoring {
+  private scores: Map<string, number> = new Map();
+  private lastUpdateTime: Map<string, number> = new Map();
+  private decayInterval = 1000 * 60; // 1 minute
+  private decayFactor = 0.9;
+  peerPenalties: { [key in PeerErrorSeverity]: number };
+
+  constructor(config: P2PConfig) {
+    const orderedValues = config.peerPenaltyValues.sort((a, b) => a - b);
+    this.peerPenalties = {
+      [PeerErrorSeverity.HighToleranceError]:
+        orderedValues[0] ?? DefaultPeerPenalties[PeerErrorSeverity.LowToleranceError],
+      [PeerErrorSeverity.MidToleranceError]:
+        orderedValues[1] ?? DefaultPeerPenalties[PeerErrorSeverity.MidToleranceError],
+      [PeerErrorSeverity.LowToleranceError]:
+        orderedValues[2] ?? DefaultPeerPenalties[PeerErrorSeverity.HighToleranceError],
+    };
+  }
+
+  updateScore(peerId: string, scoreDelta: number): void {
+    const currentTime = Date.now();
+    const lastUpdate = this.lastUpdateTime.get(peerId) || currentTime;
+    const timePassed = currentTime - lastUpdate;
+    const decayPeriods = Math.floor(timePassed / this.decayInterval);
+
+    let currentScore = this.scores.get(peerId) || 0;
+
+    // Apply decay
+    currentScore *= Math.pow(this.decayFactor, decayPeriods);
+
+    // Apply new score delta
+    currentScore += scoreDelta;
+
+    this.scores.set(peerId, currentScore);
+    this.lastUpdateTime.set(peerId, currentTime);
+  }
+
+  decayAllScores(): void {
+    const currentTime = Date.now();
+    for (const [peerId, lastUpdate] of this.lastUpdateTime.entries()) {
+      const timePassed = currentTime - lastUpdate;
+      const decayPeriods = Math.floor(timePassed / this.decayInterval);
+      if (decayPeriods > 0) {
+        let score = this.scores.get(peerId) || 0;
+        score *= Math.pow(this.decayFactor, decayPeriods);
+        this.scores.set(peerId, score);
+        this.lastUpdateTime.set(peerId, currentTime);
+      }
+    }
+  }
+
+  getScore(peerId: string): number {
+    return this.scores.get(peerId) || 0;
+  }
+}

package/src/service/reqresp/interface.ts

@@ -1,5 +1,7 @@
 import { Tx, TxHash } from '@aztec/circuit-types';
 
+import { type PeerId } from '@libp2p/interface';
+
 /*
  * Request Response Sub Protocols
  */
@@ -46,11 +48,29 @@ export interface ProtocolRateLimitQuota {
   globalLimit: RateLimitQuota;
 }
 
+export const noopValidator = () => Promise.resolve(true);
+
 /**
  * A type mapping from supprotocol to it's handling funciton
  */
 export type ReqRespSubProtocolHandlers = Record<ReqRespSubProtocol, ReqRespSubProtocolHandler>;
 
+type ResponseValidator<RequestIdentifier, Response> = (
+  request: RequestIdentifier,
+  response: Response,
+  peerId: PeerId,
+) => Promise<boolean>;
+
+export type ReqRespSubProtocolValidators = {
+  [S in ReqRespSubProtocol]: ResponseValidator<any, any>;
+};
+
+export const DEFAULT_SUB_PROTOCOL_VALIDATORS: ReqRespSubProtocolValidators = {
+  [PING_PROTOCOL]: noopValidator,
+  [STATUS_PROTOCOL]: noopValidator,
+  [TX_REQ_PROTOCOL]: noopValidator,
+};
+
 /**
  * Sub protocol map determines the request and response types for each
  * Req Resp protocol

package/src/service/reqresp/rate_limiter/rate_limiter.ts

@@ -5,6 +5,8 @@
  */
 import { type PeerId } from '@libp2p/interface';
 
+import { type PeerManager } from '../../peer_manager.js';
+import { PeerErrorSeverity } from '../../peer_scoring.js';
 import { type ReqRespSubProtocol, type ReqRespSubProtocolRateLimits } from '../interface.js';
 import { DEFAULT_RATE_LIMITS } from './rate_limits.js';
 
@@ -69,6 +71,12 @@ interface PeerRateLimiter {
   lastAccess: number;
 }
 
+enum RateLimitStatus {
+  Allowed,
+  DeniedGlobal,
+  DeniedPeer,
+}
+
 /**
  * SubProtocolRateLimiter: A rate limiter for managing request rates on a per-peer and global basis for a specific subprotocol.
  *
@@ -98,9 +106,9 @@ export class SubProtocolRateLimiter {
     this.peerQuotaTimeMs = peerQuotaTimeMs;
   }
 
-  allow(peerId: PeerId): boolean {
+  allow(peerId: PeerId): RateLimitStatus {
     if (!this.globalLimiter.allow()) {
-      return false;
+      return RateLimitStatus.DeniedGlobal;
     }
 
     const peerIdStr = peerId.toString();
@@ -115,7 +123,11 @@ export class SubProtocolRateLimiter {
     } else {
       peerLimiter.lastAccess = Date.now();
     }
-    return peerLimiter.limiter.allow();
+    const peerLimitAllowed = peerLimiter.limiter.allow();
+    if (!peerLimitAllowed) {
+      return RateLimitStatus.DeniedPeer;
+    }
+    return RateLimitStatus.Allowed;
   }
 
   cleanupInactivePeers() {
@@ -138,14 +150,16 @@ export class SubProtocolRateLimiter {
  * - Initializes with a set of rate limit configurations for different subprotocols.
  * - Creates a separate SubProtocolRateLimiter for each configured subprotocol.
  * - When a request comes in, it routes the rate limiting decision to the appropriate subprotocol limiter.
+ * - Peers who exceed their peer rate limits will be penalised by the peer manager.
  *
  * Usage:
  * ```
+ * const peerManager = new PeerManager(...);
  * const rateLimits = {
  *   subprotocol1: { peerLimit: { quotaCount: 10, quotaTimeMs: 1000 }, globalLimit: { quotaCount: 100, quotaTimeMs: 1000 } },
  *   subprotocol2: { peerLimit: { quotaCount: 5, quotaTimeMs: 1000 }, globalLimit: { quotaCount: 50, quotaTimeMs: 1000 } }
  * };
- * const limiter = new RequestResponseRateLimiter(rateLimits);
+ * const limiter = new RequestResponseRateLimiter(peerManager, rateLimits);
  *
  * Note: Ensure to call `stop()` when shutting down to properly clean up all subprotocol limiters.
  */
@@ -154,7 +168,7 @@ export class RequestResponseRateLimiter {
 
   private cleanupInterval: NodeJS.Timeout | undefined = undefined;
 
-  constructor(rateLimits: ReqRespSubProtocolRateLimits = DEFAULT_RATE_LIMITS) {
+  constructor(private peerManager: PeerManager, rateLimits: ReqRespSubProtocolRateLimits = DEFAULT_RATE_LIMITS) {
     this.subProtocolRateLimiters = new Map();
 
     for (const [subProtocol, protocolLimits] of Object.entries(rateLimits)) {
@@ -179,10 +193,19 @@ export class RequestResponseRateLimiter {
   allow(subProtocol: ReqRespSubProtocol, peerId: PeerId): boolean {
     const limiter = this.subProtocolRateLimiters.get(subProtocol);
     if (!limiter) {
-      // TODO: maybe throw an error here if no rate limiter is configured?
       return true;
     }
-    return limiter.allow(peerId);
+    const rateLimitStatus = limiter.allow(peerId);
+
+    switch (rateLimitStatus) {
+      case RateLimitStatus.DeniedPeer:
+        this.peerManager.penalizePeer(peerId, PeerErrorSeverity.MidToleranceError);
+        return false;
+      case RateLimitStatus.DeniedGlobal:
+        return false;
+      default:
+        return true;
+    }
   }
 
   cleanupInactivePeers() {