@aztec/p2p 5.0.0-rc.1 → 5.0.0

package/src/mem_pools/tx_pool_v2/tx_pool_v2.ts

@@ -20,6 +20,7 @@ import type {
   TxPoolV2Events,
 } from './interfaces.js';
 import type { TxState } from './tx_metadata.js';
+import type { MinedTxInfo } from './tx_pool_v2_impl.js';
 import { TxPoolV2Impl } from './tx_pool_v2_impl.js';
 
 /**
@@ -56,17 +57,22 @@ export class AztecKVTxPoolV2 extends (EventEmitter as new () => TypedEventEmitte
     // Create callbacks that the impl uses to notify us about events and metrics
     const callbacks = {
       onTxsAdded: (txs: Tx[], opts: { source?: string }) => {
-        this.#metrics?.transactionsAdded(txs);
         this.emit('txs-added', { txs, ...opts });
       },
       onTxsRemoved: (txHashes: string[] | bigint[]) => {
-        this.#metrics?.transactionsRemoved(txHashes);
         // Convert to TxHash objects for the event
         const hashes = txHashes.map(h => (typeof h === 'string' ? TxHash.fromString(h) : TxHash.fromBigInt(h)));
         this.emit('txs-removed', { txHashes: hashes });
       },
-      onTxsMined: (txHashes: string[]) => {
-        this.#metrics?.transactionsRemoved(txHashes);
+      onTxsMined: (minedTxs: MinedTxInfo[]) => {
+        // Pending-to-mined delay is derived from the tx's persisted receivedAt at the mined
+        // transition (see TxPoolV2Impl.handleMinedBlock), not the add/remove timestamp map —
+        // so eviction no longer pollutes MEMPOOL_TX_MINED_DELAY.
+        for (const { minedDelayMs } of minedTxs) {
+          if (minedDelayMs !== undefined) {
+            this.#metrics?.recordMinedDelay(minedDelayMs);
+          }
+        }
       },
     };
 
@@ -156,6 +162,10 @@ export class AztecKVTxPoolV2 extends (EventEmitter as new () => TypedEventEmitte
     return this.#queue.put(() => Promise.resolve(this.#impl.getPendingTxCount()));
   }
 
+  hasEligiblePendingTxs(minCount: number): Promise<boolean> {
+    return this.#queue.put(() => Promise.resolve(this.#impl.hasEligiblePendingTxs(minCount)));
+  }
+
   getMinedTxHashes(): Promise<[TxHash, L2BlockId][]> {
     return this.#queue.put(() => Promise.resolve(this.#impl.getMinedTxHashes()));
   }

package/src/mem_pools/tx_pool_v2/tx_pool_v2_impl.ts

@@ -51,10 +51,18 @@ const FINALIZE_BLOCK_CHUNK_SIZE = 100;
 /**
  * Callbacks for the implementation to notify the outer class about events and metrics.
  */
+/** A tx that has just transitioned to mined, with the time it spent in the pool. */
+export interface MinedTxInfo {
+  txHash: string;
+  /** Wall-clock ms from receipt into the pool to being marked mined. Undefined when the
+   * receive time is unknown (e.g. a tx hydrated from the DB on restart, receivedAt === 0). */
+  minedDelayMs?: number;
+}
+
 export interface TxPoolV2Callbacks {
   onTxsAdded: (txs: Tx[], opts: { source?: string }) => void;
   onTxsRemoved: (txHashes: string[] | bigint[]) => void;
-  onTxsMined: (txHashes: string[]) => void;
+  onTxsMined: (minedTxs: MinedTxInfo[]) => void;
 }
 
 /**
@@ -560,7 +568,15 @@ export class TxPoolV2Impl {
     });
 
     if (found.length > 0) {
-      this.#callbacks.onTxsMined(found.map(m => m.txHash));
+      // receivedAt is 0 for txs hydrated from the DB on restart (true receive time lost) — leave
+      // their delay undefined so the metric isn't polluted by epoch-sized values.
+      const now = this.#dateProvider.now();
+      this.#callbacks.onTxsMined(
+        found.map(m => ({
+          txHash: m.txHash,
+          minedDelayMs: m.receivedAt > 0 ? now - m.receivedAt : undefined,
+        })),
+      );
     }
 
     this.#log.info(`Marked ${found.length} txs as mined in block ${blockId.number}`);
@@ -712,8 +728,12 @@ export class TxPoolV2Impl {
   async handleFinalizedBlock(block: BlockHeader): Promise<void> {
     const blockNumber = block.globalVariables.blockNumber;
 
-    // Step 1: Find mined txs at or before finalized block
-    const minedTxsToFinalize = this.#indices.findTxsMinedAtOrBefore(blockNumber);
+    // Hold finalized txs for a configurable margin behind the finalized tip so a prover still
+    // proving an epoch with already-finalized blocks isn't starved of its txs. 0 deletes at the finalized tip.
+    const cutoffBlock = await this.#finalizationCutoffBlock(block);
+
+    // Step 1: Find mined txs at or before the cutoff block
+    const minedTxsToFinalize = this.#indices.findTxsMinedAtOrBefore(cutoffBlock);
 
     // Step 2: Archive in chunks if archiving is enabled. Hydrating an entire epoch's worth of
     // mined txs at once would OOM under load. When archiving is disabled there is no need to hydrate the txs at all.
@@ -737,16 +757,52 @@ export class TxPoolV2Impl {
     // transaction. Only tx hashes are touched here, so memory is bounded and atomicity is preserved.
     await this.#store.transactionAsync(async () => {
       await this.#deleteTxsBatch(minedTxsToFinalize);
-      await this.#deletedPool.finalizeBlock(blockNumber);
+      await this.#deletedPool.finalizeBlock(cutoffBlock);
     });
 
     if (minedTxsToFinalize.length > 0) {
-      this.#log.info(`Finalized ${minedTxsToFinalize.length} mined txs from blocks up to ${blockNumber}`, {
+      this.#log.info(`Finalized ${minedTxsToFinalize.length} mined txs from blocks up to ${cutoffBlock}`, {
         txHashes: minedTxsToFinalize,
+        finalizedBlockNumber: blockNumber,
+        cutoffBlock,
       });
     }
   }
 
+  /**
+   * Resolves the block up to which finalized txs may be deleted, given `keepFinalizedTxsForSlots`.
+   * With a margin of 0 this is just the finalized block. Otherwise we keep txs whose block is within
+   * the margin (in slots) of the finalized tip: take the target slot `finalizedSlot - margin`, find the
+   * latest checkpoint at or before it with a single reverse range query (`limit: 1`), and use that
+   * checkpoint's last block as the cutoff. This rounds to a checkpoint boundary, so it can retain slightly
+   * more than the configured margin but never less, and never deletes past the finalized block.
+   */
+  async #finalizationCutoffBlock(block: BlockHeader): Promise<BlockNumber> {
+    const keepSlots = this.#config.keepFinalizedTxsForSlots;
+    if (keepSlots <= 0) {
+      return block.globalVariables.blockNumber;
+    }
+
+    // The goal here really is to ensure we keep transactions long enough for them to be proven.
+    // So we could be smart and calculate the number of slots until the end of the proof submission window.
+    // Our approach here is a lot simpler however and we just keep transactions for the configured number
+    // of slots past L1 finalisation. This means we may keep transactions in the mined pool for longer
+    // than strictly necessary.
+    const targetSlot = block.getSlot() - keepSlots;
+    if (targetSlot < 0) {
+      // The margin reaches past genesis: keep everything.
+      return BlockNumber(0);
+    }
+
+    const [checkpoint] = await this.#l2BlockSource.getCheckpointsData({
+      fromSlot: SlotNumber(targetSlot),
+      limit: 1,
+      reverse: true,
+    });
+    // No checkpoint at or before the target slot (e.g. early chain): keep everything.
+    return checkpoint ? BlockNumber(checkpoint.startBlock + checkpoint.blockCount - 1) : BlockNumber(0);
+  }
+
   // === Query Methods ===
 
   async getTxByHash(txHash: TxHash, opts: { includeProof?: boolean } = {}): Promise<Tx | undefined> {
@@ -814,6 +870,11 @@ export class TxPoolV2Impl {
     return this.#indices.getPendingTxCount();
   }
 
+  hasEligiblePendingTxs(minCount: number): boolean {
+    const maxReceivedAt = this.#dateProvider.now() - this.#config.minTxPoolAgeMs;
+    return this.#indices.hasEligiblePendingTxs(maxReceivedAt, minCount);
+  }
+
   getMinedTxHashes(): [TxHash, L2BlockId][] {
     return this.#indices.getMinedTxs().map(([hash, blockId]) => [TxHash.fromString(hash), blockId]);
   }
@@ -857,6 +918,9 @@ export class TxPoolV2Impl {
     if (config.minTxPoolAgeMs !== undefined) {
       this.#config.minTxPoolAgeMs = config.minTxPoolAgeMs;
     }
+    if (config.keepFinalizedTxsForSlots !== undefined) {
+      this.#config.keepFinalizedTxsForSlots = config.keepFinalizedTxsForSlots;
+    }
     // Update eviction rules with new config
     this.#evictionManager.updateConfig(config);
   }
@@ -1139,7 +1203,7 @@ export class TxPoolV2Impl {
         const publicStateSource = new DatabasePublicStateSource(db);
         const balance = await publicStateSource.storageRead(
           ProtocolContractAddress.FeeJuice,
-          await computeFeePayerBalanceStorageSlot(AztecAddress.fromString(feePayer)),
+          await computeFeePayerBalanceStorageSlot(AztecAddress.fromStringUnsafe(feePayer)),
         );
         return balance.toBigInt();
       },

package/src/msg_validators/proposal_validator/proposal_validator.ts

@@ -19,7 +19,6 @@ export class ProposalValidator {
   private logger: Logger;
   private txsPermitted: boolean;
   private maxTxsPerBlock?: number;
-  private maxBlocksPerCheckpoint?: number;
   private skipSlotValidation: boolean;
   private signatureContext: CoordinationSignatureContext;
   private clockDisparityMs: number;
@@ -41,7 +40,6 @@ export class ProposalValidator {
     this.timetable = timetable;
     this.txsPermitted = opts.txsPermitted;
     this.maxTxsPerBlock = opts.maxTxsPerBlock;
-    this.maxBlocksPerCheckpoint = opts.maxBlocksPerCheckpoint;
     this.skipSlotValidation = opts.skipSlotValidation ?? false;
     this.signatureContext = opts.signatureContext;
     this.clockDisparityMs = opts.clockDisparityMs;
@@ -99,7 +97,11 @@ export class ProposalValidator {
 
       // Proposer check
       const expectedProposer = await this.epochCache.getProposerAttesterAddressInSlot(slotNumber);
-      if (expectedProposer !== undefined && !proposer.equals(expectedProposer)) {
+      if (expectedProposer === undefined) {
+        this.logger.warn(`Penalizing peer for proposal with no expected proposer for current slot ${slotNumber}`);
+        return { result: 'reject', severity: PeerErrorSeverity.HighToleranceError };
+      }
+      if (!proposer.equals(expectedProposer)) {
         this.logger.warn(`Penalizing peer for invalid proposer for current slot ${slotNumber}`, {
           expectedProposer,
           proposer: proposer.toString(),
@@ -107,8 +109,12 @@ export class ProposalValidator {
         return { result: 'reject', severity: PeerErrorSeverity.MidToleranceError };
       }
 
-      // A block proposal whose index lands beyond the checkpoint block limit can never be part of a
-      // checkpoint we would attest to, so reject it immediately at ingress.
+      // A block proposal whose index lands at or beyond the hard attestable ceiling is structurally
+      // impossible garbage, so reject it immediately at ingress. Indices in
+      // `[maxBlocksPerCheckpoint, MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT)` are over the consensus limit
+      // but structurally valid proposer misbehavior; they pass gossip validation here so the offending
+      // proposal can be retained and re-broadcast as slashing evidence (handled downstream in the p2p
+      // service), rather than penalizing the relaying peer.
       if ('indexWithinCheckpoint' in proposal) {
         const indexResult = this.validateBlockIndexWithinCheckpoint(proposal);
         if (indexResult.result !== 'accept') {
@@ -126,20 +132,21 @@ export class ProposalValidator {
   }
 
   /**
-   * Rejects a block proposal whose index within its checkpoint lands at or beyond the per-checkpoint
-   * block limit. `MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT` is a hard ceiling applied even when
-   * `maxBlocksPerCheckpoint` is unset; a lower configured value tightens it further.
-   * `indexWithinCheckpoint` is 0-based, so a ceiling of 72 rejects the 73rd block. Applies to standalone
+   * Rejects a block proposal whose index within its checkpoint lands at or beyond the hard attestable
+   * ceiling `MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT` (a structurally impossible index that can never be
+   * part of any checkpoint we could attest to). `indexWithinCheckpoint` is 0-based, so a ceiling of 72
+   * rejects the 73rd block.
+   *
+   * Indices in `[maxBlocksPerCheckpoint, MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT)` are over the configured
+   * consensus limit but still structurally valid: they are proposer misbehavior, not relaying-peer
+   * fault, so they are *not* rejected here. The p2p service retains and re-broadcasts the first such
+   * proposal per (slot, proposer) as slashing evidence and skips processing it. Applies to standalone
    * block proposals and to the terminal block embedded in a checkpoint proposal.
    */
   public validateBlockIndexWithinCheckpoint(proposal: BlockProposal): ValidationResult {
-    const maxBlocksPerCheckpoint = Math.min(
-      this.maxBlocksPerCheckpoint ?? MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT,
-      MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT,
-    );
-    if (proposal.indexWithinCheckpoint >= maxBlocksPerCheckpoint) {
+    if (proposal.indexWithinCheckpoint >= MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT) {
       this.logger.warn(
-        `Penalizing peer for proposal with indexWithinCheckpoint ${proposal.indexWithinCheckpoint} >= max ${maxBlocksPerCheckpoint}`,
+        `Penalizing peer for proposal with indexWithinCheckpoint ${proposal.indexWithinCheckpoint} >= attestable ceiling ${MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT}`,
       );
       return { result: 'reject', severity: PeerErrorSeverity.MidToleranceError };
     }

package/src/msg_validators/tx_validator/phases_validator.ts

@@ -97,7 +97,7 @@ export class PhasesTxValidator implements TxValidator<Tx> {
           }
           if (
             entry.rejectNullMsgSender &&
-            publicCall.request.msgSender.equals(AztecAddress.fromBigInt(NULL_MSG_SENDER_CONTRACT_ADDRESS))
+            publicCall.request.msgSender.equals(AztecAddress.fromBigIntUnsafe(NULL_MSG_SENDER_CONTRACT_ADDRESS))
           ) {
             return TX_ERROR_SETUP_NULL_MSG_SENDER;
           }
@@ -130,7 +130,7 @@ export class PhasesTxValidator implements TxValidator<Tx> {
         }
         if (
           entry.rejectNullMsgSender &&
-          publicCall.request.msgSender.equals(AztecAddress.fromBigInt(NULL_MSG_SENDER_CONTRACT_ADDRESS))
+          publicCall.request.msgSender.equals(AztecAddress.fromBigIntUnsafe(NULL_MSG_SENDER_CONTRACT_ADDRESS))
         ) {
           return TX_ERROR_SETUP_NULL_MSG_SENDER;
         }

package/src/services/discv5/discV5_service.ts

@@ -1,5 +1,7 @@
 import { createLogger } from '@aztec/foundation/log';
 import { sleep } from '@aztec/foundation/sleep';
+import { DateProvider } from '@aztec/foundation/timer';
+import type { AztecAsyncKVStore } from '@aztec/kv-store';
 import { type ComponentsVersions, checkCompressedComponentVersion } from '@aztec/stdlib/versioning';
 import { OtelMetricsAdapter, type TelemetryClient, getTelemetryClient } from '@aztec/telemetry-client';
 
@@ -14,9 +16,13 @@ import { createNodeENR } from '../../enr/generate-enr.js';
 import { AZTEC_ENR_KEY, Discv5Event, PeerEvent } from '../../types/index.js';
 import { convertToMultiaddr } from '../../util.js';
 import { type PeerDiscoveryService, PeerDiscoveryState } from '../service.js';
+import { PersistedEnrStore } from './persisted_enr_store.js';
 
 const delayBeforeStart = 2000; // 2sec
 
+/** Upper bound on persisted peer ENRs, to keep the store bounded as peers churn. */
+const MAX_PERSISTED_PEER_ENRS = 100;
+
 /**
  * Peer discovery service using Discv5.
  */
@@ -35,14 +41,19 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
   private bootstrapNodePeerIds: PeerId[] = [];
   public bootstrapNodeEnrs: ENR[] = [];
   private trustedPeerEnrs: ENR[] = [];
+  /** Node IDs of all config-provided peers (bootstrap, trusted, private); these are never persisted. */
+  private readonly configProvidedNodeIds: Set<string>;
 
   private startTime = 0;
 
   private currentIp: string | undefined;
 
+  /** Persistent store of discovered peer ENRs, used to re-seed discovery after a restart. */
+  private readonly persistedEnrs?: PersistedEnrStore;
+
   private handlers = {
     onMultiaddrUpdated: this.onMultiaddrUpdated.bind(this),
-    onDiscovered: this.onDiscovered.bind(this),
+    onPeerDiscovered: this.onPeerDiscovered.bind(this),
     onEnrAdded: this.onEnrAdded.bind(this),
   };
 
@@ -52,16 +63,27 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
     private readonly packageVersion: string,
     telemetry: TelemetryClient = getTelemetryClient(),
     private logger = createLogger('p2p:discv5_service'),
+    store?: AztecAsyncKVStore,
     configOverrides: Partial<IDiscv5CreateOptions> = {},
+    private readonly dateProvider: DateProvider = new DateProvider(),
   ) {
     super();
 
+    this.persistedEnrs = store
+      ? new PersistedEnrStore(store, MAX_PERSISTED_PEER_ENRS, createLogger(`${this.logger.module}:enr-store`))
+      : undefined;
+
     const { p2pIp, p2pPort, p2pBroadcastPort, bootstrapNodes, trustedPeers, privatePeers } = config;
 
     this.currentIp = p2pIp;
     this.bootstrapNodeEnrs = bootstrapNodes.map(x => ENR.decodeTxt(x));
     const privatePeerEnrs = new Set(privatePeers);
     this.trustedPeerEnrs = trustedPeers.filter(x => !privatePeerEnrs.has(x)).map(x => ENR.decodeTxt(x));
+    // Peers supplied via config are re-injected from config on every start, so they must never end up
+    // in the persisted (discovered-peer) store — private peers especially must not be written there.
+    this.configProvidedNodeIds = new Set(
+      [...bootstrapNodes, ...trustedPeers, ...privatePeers].map(x => ENR.decodeTxt(x).nodeId),
+    );
 
     // If no overridden broadcast port is provided, use the p2p port as the broadcast port
     if (!p2pBroadcastPort) {
@@ -126,7 +148,7 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
       }
     };
 
-    this.discv5.on(Discv5Event.DISCOVERED, this.handlers.onDiscovered);
+    this.discv5.on(Discv5Event.DISCOVERED, this.handlers.onPeerDiscovered);
     this.discv5.on(Discv5Event.ENR_ADDED, this.handlers.onEnrAdded);
     this.discv5.on(Discv5Event.MULTIADDR_UPDATED, this.handlers.onMultiaddrUpdated);
   }
@@ -168,7 +190,7 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
     }
     this.logger.debug('Starting DiscV5');
     await this.discv5.start();
-    this.startTime = Date.now();
+    this.startTime = this.dateProvider.now();
 
     const enrUpdateEnabled = this.config.queryForIp || !this.config.p2pIp;
     this.logger.info(`DiscV5 service started`, {
@@ -220,6 +242,26 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
         this.discv5.addEnr(enr);
       }
     }
+
+    // Re-seed discovery from peers persisted on previous runs. This lets a node rejoin the network
+    // after a restart even when no bootstrap node is reachable: discv5 has no on-disk routing table,
+    // so without this its DHT would start empty and rediscovery would depend on inbound dials alone.
+    if (this.persistedEnrs) {
+      // Drop peers that are now config-provided (re-injected above) or fail version checks.
+      const enrs = await this.persistedEnrs.load(
+        enr => this.validateEnr(enr) && !this.configProvidedNodeIds.has(enr.nodeId),
+      );
+      for (const enr of enrs) {
+        try {
+          this.discv5.addEnr(enr);
+        } catch (err) {
+          this.logger.debug(`Error re-seeding persisted ENR ${enr.nodeId}`, err);
+        }
+      }
+      if (enrs.length > 0) {
+        this.logger.info(`Re-seeded discovery with ${enrs.length} persisted peer ENRs`);
+      }
+    }
   }
 
   public async runRandomNodesQuery(): Promise<void> {
@@ -229,8 +271,8 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
 
     // First, wait some time before starting the peer discovery
     // reference: https://github.com/ChainSafe/lodestar/issues/3423
-    const msSinceStart = Date.now() - this.startTime;
-    if (Date.now() - this.startTime <= delayBeforeStart) {
+    const msSinceStart = this.dateProvider.now() - this.startTime;
+    if (this.dateProvider.now() - this.startTime <= delayBeforeStart) {
       await sleep(delayBeforeStart - msSinceStart);
     }
 
@@ -265,7 +307,7 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
     if (this.currentState !== PeerDiscoveryState.RUNNING) {
       return;
     }
-    await this.discv5.off(Discv5Event.DISCOVERED, this.handlers.onDiscovered);
+    await this.discv5.off(Discv5Event.DISCOVERED, this.handlers.onPeerDiscovered);
     await this.discv5.off(Discv5Event.ENR_ADDED, this.handlers.onEnrAdded);
     await this.discv5.off(Discv5Event.MULTIADDR_UPDATED, this.handlers.onMultiaddrUpdated);
 
@@ -275,12 +317,38 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
   }
 
   private async onEnrAdded(enr: ENR) {
-    const multiAddrTcp = await enr.getFullMultiaddr('tcp');
-    const multiAddrUdp = await enr.getFullMultiaddr('udp');
-    this.logger.debug(`Added ENR ${enr.encodeTxt()}`, { multiAddrTcp, multiAddrUdp, nodeId: enr.nodeId });
+    try {
+      const multiAddrTcp = await enr.getFullMultiaddr('tcp');
+      const multiAddrUdp = await enr.getFullMultiaddr('udp');
+      this.logger.debug(`Added ENR ${enr.encodeTxt()}`, { multiAddrTcp, multiAddrUdp, nodeId: enr.nodeId });
+      // A peer just entered the routing table — persist it so we can re-seed discovery after a restart.
+      if (this.persistedEnrs && this.shouldPersist(enr)) {
+        await this.persistedEnrs.persist(enr);
+      }
+      this.onDiscovered(enr);
+    } catch (err) {
+      // A malformed ENR address field (e.g. a 3-byte TCP port) makes @nethermindeth/enr throw while
+      // parsing the multiaddr. This is an async event listener, so an unhandled rejection would crash
+      // the process — catch, log, and drop the ENR instead.
+      this.logger.warn(`Dropping ENR with unparseable address`, { nodeId: enr.nodeId, err });
+    }
+  }
+
+  private async onPeerDiscovered(enr: ENR) {
+    // discv5 updates an existing routing-table entry on an ENR sequence bump without emitting enrAdded,
+    // so DISCOVERED is our only signal that a peer we already track may have changed address. Refresh
+    // the persisted copy (a no-op for peers we don't already store) so we don't keep dialing a stale ENR.
+    if (this.persistedEnrs && this.shouldPersist(enr)) {
+      await this.persistedEnrs.refresh(enr);
+    }
     this.onDiscovered(enr);
   }
 
+  /** Whether an ENR belongs in the persisted store: a validated, non-config peer that isn't ourselves. */
+  private shouldPersist(enr: ENR): boolean {
+    return !this.configProvidedNodeIds.has(enr.nodeId) && enr.nodeId !== this.enr.nodeId && this.validateEnr(enr);
+  }
+
   private isOurBootnode(enr: ENR) {
     return this.bootstrapNodeEnrs.some(x => x.nodeId === enr.nodeId);
   }
@@ -314,6 +382,17 @@ export class DiscV5Service extends EventEmitter implements PeerDiscoveryService
       return false;
     }
 
+    // A malformed TCP field (e.g. a non-2-byte port) makes @nethermindeth/enr throw while building the
+    // multiaddr. Reject such an ENR here so it's never emitted as a full peer or re-parsed by an
+    // unguarded listener (which would crash the process). A missing TCP addr is allowed — those peers
+    // are simply skipped at dial time.
+    try {
+      enr.getLocationMultiaddr('tcp');
+    } catch (err) {
+      this.logger.debug(`Peer node ${enr.nodeId} has an unparseable TCP address`, { err });
+      return false;
+    }
+
     // And check it has the correct version
     let compressedVersion;
     try {

package/src/services/discv5/persisted_enr_store.ts

@@ -0,0 +1,158 @@
+import { type Logger, createLogger } from '@aztec/foundation/log';
+import type { AztecAsyncKVStore, AztecAsyncMap } from '@aztec/kv-store';
+
+import { ENR } from '@nethermindeth/enr';
+
+/** Map name under which discovered peer ENRs are persisted so discovery can be re-seeded after a restart. */
+const PERSISTED_ENRS_MAP_NAME = 'discovered_peer_enrs';
+
+/**
+ * A persisted peer entry: the ENR text plus a monotonic sequence number recording when the peer was
+ * last seen. The sequence orders the store as a FIFO so eviction drops the oldest-seen peers first.
+ */
+interface PersistedEnr {
+  enr: string;
+  seq: number;
+}
+
+function parsePersistedEnr(value: string): PersistedEnr | undefined {
+  try {
+    const parsed = JSON.parse(value);
+    if (typeof parsed?.enr === 'string' && typeof parsed?.seq === 'number') {
+      return parsed;
+    }
+  } catch {
+    // Unparseable entry; caller treats it as stale.
+  }
+  return undefined;
+}
+
+/**
+ * A bounded, transactional store of discovered peer ENRs used to re-seed discovery after a restart.
+ *
+ * Entries are keyed by nodeId (so re-seeing a peer dedups in place) and carry a monotonic sequence so
+ * the store behaves as a FIFO: when it exceeds its cap, the oldest-seen peers are evicted first. All
+ * writes run in a transaction so concurrent discovery events can't race the size check.
+ */
+export class PersistedEnrStore {
+  private readonly enrs: AztecAsyncMap<string, string>;
+  /** Monotonic sequence stamped on each entry; seeded from the store's max in {@link load}. */
+  private seq = 0;
+
+  constructor(
+    private readonly store: AztecAsyncKVStore,
+    private readonly maxEntries: number,
+    private readonly logger: Logger = createLogger('p2p:discv5:enr-store'),
+  ) {
+    this.enrs = store.openMap(PERSISTED_ENRS_MAP_NAME);
+  }
+
+  /** Adds or replaces a peer's ENR, stamping it as most-recently-seen and evicting the oldest if over cap. */
+  public async persist(enr: ENR): Promise<void> {
+    const nodeId = enr.nodeId;
+    const enrTxt = enr.encodeTxt();
+    try {
+      await this.store.transactionAsync(async () => {
+        const seq = ++this.seq;
+        const others: { nodeId: string; seq: number }[] = [];
+        for await (const [id, value] of this.enrs.entriesAsync()) {
+          if (id !== nodeId) {
+            others.push({ nodeId: id, seq: parsePersistedEnr(value)?.seq ?? 0 });
+          }
+        }
+        const overflow = others.length + 1 - this.maxEntries;
+        if (overflow > 0) {
+          others.sort((a, b) => a.seq - b.seq); // oldest-seen (lowest sequence) first
+          for (let i = 0; i < overflow; i++) {
+            await this.enrs.delete(others[i].nodeId);
+          }
+        }
+        await this.enrs.set(nodeId, JSON.stringify({ enr: enrTxt, seq }));
+      });
+    } catch (err) {
+      this.logger.warn(`Failed to persist discovered ENR ${nodeId}`, err);
+    }
+  }
+
+  /**
+   * Refreshes an already-persisted peer's stored ENR when a newer one (higher ENR sequence) is seen.
+   * A no-op for peers we don't already track — we never add new peers via this path, only update.
+   *
+   * This exists because discv5 updates an existing routing-table entry on an ENR sequence bump without
+   * emitting an `enrAdded` event, so a peer that changes address would otherwise keep its stale ENR
+   * persisted until evicted.
+   */
+  public async refresh(enr: ENR): Promise<void> {
+    const nodeId = enr.nodeId;
+    try {
+      await this.store.transactionAsync(async () => {
+        const existing = await this.enrs.getAsync(nodeId);
+        if (!existing) {
+          return;
+        }
+        // Two unrelated sequence numbers are in play:
+        //  - the ENR sequence (`enr.seq` / `storedEnrSeq`) is set by the *peer* and bumped whenever it
+        //    revises its record (e.g. changes address); we compare these to decide whether the incoming
+        //    ENR is genuinely newer and worth keeping.
+        //  - our storage sequence (`this.seq`) is an internal counter used only for FIFO eviction; we
+        //    stamp a fresh one so this entry counts as most-recently-seen.
+        const storedEnrSeq = this.decodeStoredEnr(existing)?.seq;
+        if (storedEnrSeq !== undefined && enr.seq <= storedEnrSeq) {
+          return;
+        }
+        await this.enrs.set(nodeId, JSON.stringify({ enr: enr.encodeTxt(), seq: ++this.seq }));
+      });
+    } catch (err) {
+      this.logger.warn(`Failed to refresh persisted ENR ${nodeId}`, err);
+    }
+  }
+
+  /**
+   * Loads all persisted ENRs, decoding each and keeping those the `accept` predicate allows. Entries
+   * that fail to decode or are rejected are removed from the store. The FIFO sequence resumes from the
+   * highest persisted value so eviction order survives restarts.
+   */
+  public async load(accept: (enr: ENR) => boolean): Promise<ENR[]> {
+    const valid: ENR[] = [];
+    const stale: string[] = [];
+    let maxSeq = 0;
+    for await (const [nodeId, value] of this.enrs.entriesAsync()) {
+      const parsed = parsePersistedEnr(value);
+      let enr: ENR | undefined;
+      if (parsed) {
+        try {
+          enr = ENR.decodeTxt(parsed.enr);
+        } catch (err) {
+          this.logger.debug(`Dropping undecodable persisted ENR ${nodeId}`, err);
+        }
+      }
+      if (!parsed || !enr || !accept(enr)) {
+        stale.push(nodeId);
+        continue;
+      }
+      maxSeq = Math.max(maxSeq, parsed.seq);
+      valid.push(enr);
+    }
+    this.seq = maxSeq;
+    if (stale.length > 0) {
+      await this.store.transactionAsync(async () => {
+        for (const nodeId of stale) {
+          await this.enrs.delete(nodeId);
+        }
+      });
+    }
+    return valid;
+  }
+
+  private decodeStoredEnr(value: string): ENR | undefined {
+    const parsed = parsePersistedEnr(value);
+    if (!parsed) {
+      return undefined;
+    }
+    try {
+      return ENR.decodeTxt(parsed.enr);
+    } catch {
+      return undefined;
+    }
+  }
+}

package/src/services/dummy_service.ts

@@ -28,6 +28,7 @@ import {
   type P2PCheckpointReceivedCallback,
   type P2PDuplicateAttestationCallback,
   type P2PDuplicateProposalCallback,
+  type P2POversizedProposalCallback,
   type P2PService,
   type PeerDiscoveryService,
   PeerDiscoveryState,
@@ -98,6 +99,11 @@ export class DummyP2PService implements P2PService {
    */
   public registerDuplicateProposalCallback(_callback: P2PDuplicateProposalCallback): void {}
 
+  /**
+   * Register a callback for when an oversized proposal is stored
+   */
+  public registerOversizedProposalCallback(_callback: P2POversizedProposalCallback): void {}
+
   /**
    * Register a callback for when a duplicate attestation is detected
    */