@aztec/p2p 5.0.0-rc.2 → 5.0.0

package/src/mem_pools/attestation_pool/attestation_pool_test_suite.ts

@@ -1,7 +1,9 @@
 import { IndexWithinCheckpoint, SlotNumber } from '@aztec/foundation/branded-types';
 import { Secp256k1Signer } from '@aztec/foundation/crypto/secp256k1-signer';
 import { Fr } from '@aztec/foundation/curves/bn254';
-import type { BlockProposal, CheckpointAttestation, CheckpointProposalCore } from '@aztec/stdlib/p2p';
+import { Signature } from '@aztec/foundation/eth-signature';
+import type { BlockProposal, CheckpointProposalCore } from '@aztec/stdlib/p2p';
+import { CheckpointAttestation } from '@aztec/stdlib/p2p';
 import { CheckpointHeader } from '@aztec/stdlib/rollup';
 import {
   makeBlockHeader,
@@ -62,7 +64,44 @@ export function describeAttestationPool(getAttestationPool: () => AttestationPoo
     expect(a1Buffer).toEqual(expect.arrayContaining(a2Buffer));
   };
 
+  /**
+   * Rewrites the attester signature into yParity form (27 -> 0, 28 -> 1), keeping (r, s). The recovery
+   * bit is unchanged so it still recovers to the same signer, mimicking a peer that gossips (or mutates
+   * in flight) a signature with a non-canonical recovery byte.
+   */
+  const toYParityForm = (attestation: CheckpointAttestation): CheckpointAttestation => {
+    const sig = attestation.signature;
+    const yParityV = sig.v === 27 ? 0 : sig.v === 28 ? 1 : sig.v;
+    return new CheckpointAttestation(
+      attestation.payload,
+      new Signature(sig.r, sig.s, yParityV),
+      attestation.proposerSignature,
+    );
+  };
+
   describe('CheckpointAttestation', () => {
+    it('normalizes yParity (v=0/v=1) attester signatures on ingress from both gossip and own keys', async () => {
+      const slotNumber = 421;
+      const canonical = createCheckpointAttestationsForSlot(slotNumber);
+      const payloadHash = canonical[0].getPayloadHash();
+      const expectedSenders = new Set([canonical[0].getSender()!.toString(), canonical[1].getSender()!.toString()]);
+
+      const gossiped = toYParityForm(canonical[0]);
+      expect([0, 1]).toContain(gossiped.signature.v);
+      await ap.tryAddCheckpointAttestation(gossiped);
+
+      const own = toYParityForm(canonical[1]);
+      expect([0, 1]).toContain(own.signature.v);
+      await ap.addOwnCheckpointAttestations([own]);
+
+      const retrieved = await ap.getCheckpointAttestationsForSlotAndProposal(SlotNumber(slotNumber), payloadHash);
+      expect(retrieved.length).toBe(2);
+      for (const attestation of retrieved) {
+        expect([27, 28]).toContain(attestation.signature.v);
+        expect(expectedSenders.has(attestation.getSender()!.toString())).toBe(true);
+      }
+    });
+
     it('should add attestations to pool', async () => {
       const slotNumber = 420;
       const archive = Fr.random();

package/src/mem_pools/instrumentation.ts

@@ -1,5 +1,4 @@
 import type { Gossipable } from '@aztec/stdlib/p2p';
-import type { Tx } from '@aztec/stdlib/tx';
 import {
   Attributes,
   type BatchObservableResult,
@@ -117,16 +116,6 @@ export class PoolInstrumentation<PoolObject extends Gossipable> {
     this.addObjectCounter.add(count);
   }
 
-  public transactionsAdded(transactions: Tx[]) {
-    transactions.forEach(tx => this.trackMempoolItemAdded(tx.txHash.toBigInt()));
-  }
-
-  public transactionsRemoved(hashes: Iterable<bigint> | Iterable<string>) {
-    for (const hash of hashes) {
-      this.trackMempoolItemRemoved(BigInt(hash));
-    }
-  }
-
   public trackMempoolItemAdded(key: bigint | string): void {
     this.mempoolItemAddedTimestamp.set(key, Date.now());
   }
@@ -142,6 +131,19 @@ export class PoolInstrumentation<PoolObject extends Gossipable> {
     }
   }
 
+  /**
+   * Records a pre-computed pending-to-mined delay directly, bypassing the
+   * `mempoolItemAddedTimestamp` map. Used by the tx pool, which derives the
+   * delay from the persisted `receivedAt` on tx metadata at the mined
+   * transition — more accurate than the add/remove map (which also fires on
+   * eviction) and resilient to the caller not having tracked the add.
+   */
+  public recordMinedDelay(delayMs: number): void {
+    if (delayMs > 0) {
+      this.minedDelay.record(delayMs);
+    }
+  }
+
   private observeStats = async (observer: BatchObservableResult) => {
     const { itemCount } = await this.poolStats();
     if (typeof itemCount === 'number') {

package/src/mem_pools/tx_pool_v2/interfaces.ts

@@ -49,6 +49,11 @@ export type TxPoolV2Config = {
   dropTransactionsProbability: number;
   /** Minimum percentage fee increase required to replace an existing tx via RPC (0 = no bump). */
   priceBumpPercentage: bigint;
+  /**
+   * Number of slots behind the finalized tip to keep finalized txs for before deleting them. 0 deletes
+   * at the finalized tip (default).
+   */
+  keepFinalizedTxsForSlots: number;
 };
 
 /**
@@ -61,6 +66,7 @@ export const DEFAULT_TX_POOL_V2_CONFIG: TxPoolV2Config = {
   evictedTxCacheSize: 10_000,
   dropTransactionsProbability: 0,
   priceBumpPercentage: 10n,
+  keepFinalizedTxsForSlots: 0,
 };
 
 /**
@@ -224,6 +230,13 @@ export interface TxPoolV2 extends TypedEventEmitter<TxPoolV2Events> {
   /** Gets the count of pending transactions */
   getPendingTxCount(): Promise<number>;
 
+  /**
+   * Returns whether at least `minCount` pending transactions are old enough per minTxPoolAgeMs to be eligible
+   * for block building. Stops scanning once the threshold is reached, so it is cheaper than counting all
+   * eligible txs when only a few are needed.
+   */
+  hasEligiblePendingTxs(minCount: number): Promise<boolean>;
+
   /** Gets mined transaction hashes with their block IDs */
   getMinedTxHashes(): Promise<[TxHash, L2BlockId][]>;
 

package/src/mem_pools/tx_pool_v2/tx_pool_indices.ts

@@ -228,6 +228,29 @@ export class TxPoolIndices {
     return this.#pendingByPriority.length;
   }
 
+  /**
+   * Returns whether at least `minCount` pending transactions were received at or before maxReceivedAt,
+   * i.e. are old enough to be eligible for block building. Stops as soon as the threshold is met, so it
+   * does not scan the whole pool when only a handful of eligible txs are needed. The total pending count
+   * is an upper bound on the eligible count, so a pool with fewer than `minCount` pending can never
+   * satisfy the threshold and short-circuits without scanning.
+   */
+  hasEligiblePendingTxs(maxReceivedAt: number, minCount: number): boolean {
+    if (minCount <= 0) {
+      return true;
+    }
+    if (this.#pendingByPriority.length < minCount) {
+      return false;
+    }
+    let count = 0;
+    for (const _ of this.iterateEligiblePendingByPriority('desc', maxReceivedAt)) {
+      if (++count >= minCount) {
+        return true;
+      }
+    }
+    return false;
+  }
+
   /** Gets the lowest priority pending transaction hashes (up to limit) */
   getLowestPriorityPending(limit: number): string[] {
     if (limit <= 0) {

package/src/mem_pools/tx_pool_v2/tx_pool_v2.ts

@@ -20,6 +20,7 @@ import type {
   TxPoolV2Events,
 } from './interfaces.js';
 import type { TxState } from './tx_metadata.js';
+import type { MinedTxInfo } from './tx_pool_v2_impl.js';
 import { TxPoolV2Impl } from './tx_pool_v2_impl.js';
 
 /**
@@ -56,17 +57,22 @@ export class AztecKVTxPoolV2 extends (EventEmitter as new () => TypedEventEmitte
     // Create callbacks that the impl uses to notify us about events and metrics
     const callbacks = {
       onTxsAdded: (txs: Tx[], opts: { source?: string }) => {
-        this.#metrics?.transactionsAdded(txs);
         this.emit('txs-added', { txs, ...opts });
       },
       onTxsRemoved: (txHashes: string[] | bigint[]) => {
-        this.#metrics?.transactionsRemoved(txHashes);
         // Convert to TxHash objects for the event
         const hashes = txHashes.map(h => (typeof h === 'string' ? TxHash.fromString(h) : TxHash.fromBigInt(h)));
         this.emit('txs-removed', { txHashes: hashes });
       },
-      onTxsMined: (txHashes: string[]) => {
-        this.#metrics?.transactionsRemoved(txHashes);
+      onTxsMined: (minedTxs: MinedTxInfo[]) => {
+        // Pending-to-mined delay is derived from the tx's persisted receivedAt at the mined
+        // transition (see TxPoolV2Impl.handleMinedBlock), not the add/remove timestamp map —
+        // so eviction no longer pollutes MEMPOOL_TX_MINED_DELAY.
+        for (const { minedDelayMs } of minedTxs) {
+          if (minedDelayMs !== undefined) {
+            this.#metrics?.recordMinedDelay(minedDelayMs);
+          }
+        }
       },
     };
 
@@ -156,6 +162,10 @@ export class AztecKVTxPoolV2 extends (EventEmitter as new () => TypedEventEmitte
     return this.#queue.put(() => Promise.resolve(this.#impl.getPendingTxCount()));
   }
 
+  hasEligiblePendingTxs(minCount: number): Promise<boolean> {
+    return this.#queue.put(() => Promise.resolve(this.#impl.hasEligiblePendingTxs(minCount)));
+  }
+
   getMinedTxHashes(): Promise<[TxHash, L2BlockId][]> {
     return this.#queue.put(() => Promise.resolve(this.#impl.getMinedTxHashes()));
   }

package/src/mem_pools/tx_pool_v2/tx_pool_v2_impl.ts

@@ -51,10 +51,18 @@ const FINALIZE_BLOCK_CHUNK_SIZE = 100;
 /**
  * Callbacks for the implementation to notify the outer class about events and metrics.
  */
+/** A tx that has just transitioned to mined, with the time it spent in the pool. */
+export interface MinedTxInfo {
+  txHash: string;
+  /** Wall-clock ms from receipt into the pool to being marked mined. Undefined when the
+   * receive time is unknown (e.g. a tx hydrated from the DB on restart, receivedAt === 0). */
+  minedDelayMs?: number;
+}
+
 export interface TxPoolV2Callbacks {
   onTxsAdded: (txs: Tx[], opts: { source?: string }) => void;
   onTxsRemoved: (txHashes: string[] | bigint[]) => void;
-  onTxsMined: (txHashes: string[]) => void;
+  onTxsMined: (minedTxs: MinedTxInfo[]) => void;
 }
 
 /**
@@ -560,7 +568,15 @@ export class TxPoolV2Impl {
     });
 
     if (found.length > 0) {
-      this.#callbacks.onTxsMined(found.map(m => m.txHash));
+      // receivedAt is 0 for txs hydrated from the DB on restart (true receive time lost) — leave
+      // their delay undefined so the metric isn't polluted by epoch-sized values.
+      const now = this.#dateProvider.now();
+      this.#callbacks.onTxsMined(
+        found.map(m => ({
+          txHash: m.txHash,
+          minedDelayMs: m.receivedAt > 0 ? now - m.receivedAt : undefined,
+        })),
+      );
     }
 
     this.#log.info(`Marked ${found.length} txs as mined in block ${blockId.number}`);
@@ -712,8 +728,12 @@ export class TxPoolV2Impl {
   async handleFinalizedBlock(block: BlockHeader): Promise<void> {
     const blockNumber = block.globalVariables.blockNumber;
 
-    // Step 1: Find mined txs at or before finalized block
-    const minedTxsToFinalize = this.#indices.findTxsMinedAtOrBefore(blockNumber);
+    // Hold finalized txs for a configurable margin behind the finalized tip so a prover still
+    // proving an epoch with already-finalized blocks isn't starved of its txs. 0 deletes at the finalized tip.
+    const cutoffBlock = await this.#finalizationCutoffBlock(block);
+
+    // Step 1: Find mined txs at or before the cutoff block
+    const minedTxsToFinalize = this.#indices.findTxsMinedAtOrBefore(cutoffBlock);
 
     // Step 2: Archive in chunks if archiving is enabled. Hydrating an entire epoch's worth of
     // mined txs at once would OOM under load. When archiving is disabled there is no need to hydrate the txs at all.
@@ -737,16 +757,52 @@ export class TxPoolV2Impl {
     // transaction. Only tx hashes are touched here, so memory is bounded and atomicity is preserved.
     await this.#store.transactionAsync(async () => {
       await this.#deleteTxsBatch(minedTxsToFinalize);
-      await this.#deletedPool.finalizeBlock(blockNumber);
+      await this.#deletedPool.finalizeBlock(cutoffBlock);
     });
 
     if (minedTxsToFinalize.length > 0) {
-      this.#log.info(`Finalized ${minedTxsToFinalize.length} mined txs from blocks up to ${blockNumber}`, {
+      this.#log.info(`Finalized ${minedTxsToFinalize.length} mined txs from blocks up to ${cutoffBlock}`, {
         txHashes: minedTxsToFinalize,
+        finalizedBlockNumber: blockNumber,
+        cutoffBlock,
       });
     }
   }
 
+  /**
+   * Resolves the block up to which finalized txs may be deleted, given `keepFinalizedTxsForSlots`.
+   * With a margin of 0 this is just the finalized block. Otherwise we keep txs whose block is within
+   * the margin (in slots) of the finalized tip: take the target slot `finalizedSlot - margin`, find the
+   * latest checkpoint at or before it with a single reverse range query (`limit: 1`), and use that
+   * checkpoint's last block as the cutoff. This rounds to a checkpoint boundary, so it can retain slightly
+   * more than the configured margin but never less, and never deletes past the finalized block.
+   */
+  async #finalizationCutoffBlock(block: BlockHeader): Promise<BlockNumber> {
+    const keepSlots = this.#config.keepFinalizedTxsForSlots;
+    if (keepSlots <= 0) {
+      return block.globalVariables.blockNumber;
+    }
+
+    // The goal here really is to ensure we keep transactions long enough for them to be proven.
+    // So we could be smart and calculate the number of slots until the end of the proof submission window.
+    // Our approach here is a lot simpler however and we just keep transactions for the configured number
+    // of slots past L1 finalisation. This means we may keep transactions in the mined pool for longer
+    // than strictly necessary.
+    const targetSlot = block.getSlot() - keepSlots;
+    if (targetSlot < 0) {
+      // The margin reaches past genesis: keep everything.
+      return BlockNumber(0);
+    }
+
+    const [checkpoint] = await this.#l2BlockSource.getCheckpointsData({
+      fromSlot: SlotNumber(targetSlot),
+      limit: 1,
+      reverse: true,
+    });
+    // No checkpoint at or before the target slot (e.g. early chain): keep everything.
+    return checkpoint ? BlockNumber(checkpoint.startBlock + checkpoint.blockCount - 1) : BlockNumber(0);
+  }
+
   // === Query Methods ===
 
   async getTxByHash(txHash: TxHash, opts: { includeProof?: boolean } = {}): Promise<Tx | undefined> {
@@ -814,6 +870,11 @@ export class TxPoolV2Impl {
     return this.#indices.getPendingTxCount();
   }
 
+  hasEligiblePendingTxs(minCount: number): boolean {
+    const maxReceivedAt = this.#dateProvider.now() - this.#config.minTxPoolAgeMs;
+    return this.#indices.hasEligiblePendingTxs(maxReceivedAt, minCount);
+  }
+
   getMinedTxHashes(): [TxHash, L2BlockId][] {
     return this.#indices.getMinedTxs().map(([hash, blockId]) => [TxHash.fromString(hash), blockId]);
   }
@@ -857,6 +918,9 @@ export class TxPoolV2Impl {
     if (config.minTxPoolAgeMs !== undefined) {
       this.#config.minTxPoolAgeMs = config.minTxPoolAgeMs;
     }
+    if (config.keepFinalizedTxsForSlots !== undefined) {
+      this.#config.keepFinalizedTxsForSlots = config.keepFinalizedTxsForSlots;
+    }
     // Update eviction rules with new config
     this.#evictionManager.updateConfig(config);
   }

package/src/msg_validators/proposal_validator/proposal_validator.ts

@@ -97,7 +97,11 @@ export class ProposalValidator {
 
       // Proposer check
       const expectedProposer = await this.epochCache.getProposerAttesterAddressInSlot(slotNumber);
-      if (expectedProposer !== undefined && !proposer.equals(expectedProposer)) {
+      if (expectedProposer === undefined) {
+        this.logger.warn(`Penalizing peer for proposal with no expected proposer for current slot ${slotNumber}`);
+        return { result: 'reject', severity: PeerErrorSeverity.HighToleranceError };
+      }
+      if (!proposer.equals(expectedProposer)) {
         this.logger.warn(`Penalizing peer for invalid proposer for current slot ${slotNumber}`, {
           expectedProposer,
           proposer: proposer.toString(),

package/src/services/encoding.ts

@@ -7,6 +7,12 @@ import type { Message } from '@libp2p/interface';
 import { webcrypto } from 'node:crypto';
 import { compressSync, uncompressSync } from 'snappy';
 
+/**
+ * Fallback maximum response size (in KB) applied when no explicit per-request bound is supplied.
+ * Used both as the `SnappyTransform` default and as the reception-side fallback in `readMessage`.
+ */
+export const DEFAULT_MAX_RESPONSE_SIZE_KB = 10 * 1024;
+
 /** Thrown when a Snappy-compressed response exceeds the allowed decompressed size. */
 export class OversizedSnappyResponseError extends Error {
   constructor(decompressedSize: number, maxSizeKb: number) {
@@ -15,6 +21,18 @@ export class OversizedSnappyResponseError extends Error {
   }
 }
 
+/**
+ * Thrown when the compressed bytes accumulated while reading a response stream exceed the reception
+ * bound, before the full payload is buffered. Distinct from {@link OversizedSnappyResponseError},
+ * which guards the decompressed size after the stream has already been fully received.
+ */
+export class ResponseSizeLimitExceededError extends Error {
+  constructor(accumulatedBytes: number, limitBytes: number) {
+    super(`Accumulated response size ${accumulatedBytes} bytes exceeds reception limit of ${limitBytes} bytes`);
+    this.name = 'ResponseSizeLimitExceededError';
+  }
+}
+
 // Shared buffer to convert msgId to string
 const sharedMsgIdBuf = Buffer.alloc(20);
 
@@ -66,7 +84,7 @@ const DefaultMaxSizesKb: Record<TopicType, number> = {
 export class SnappyTransform implements DataTransform {
   constructor(
     private maxSizesKb: Record<TopicType, number> = DefaultMaxSizesKb,
-    private defaultMaxSizeKb: number = 10 * 1024,
+    private defaultMaxSizeKb: number = DEFAULT_MAX_RESPONSE_SIZE_KB,
     private logger = createLogger('p2p:snappy-transform'),
   ) {}
 

package/src/services/libp2p/libp2p_service.ts

@@ -90,7 +90,7 @@ import type { PeerManagerInterface } from '../peer-manager/interface.js';
 import { PeerManager } from '../peer-manager/peer_manager.js';
 import { PeerScoring } from '../peer-manager/peer_scoring.js';
 import type { BatchTxRequesterLibP2PService } from '../reqresp/batch-tx-requester/interface.js';
-import type { P2PReqRespConfig } from '../reqresp/config.js';
+import { type P2PReqRespConfig, YAMUX_MAX_MESSAGE_SIZE_BYTES } from '../reqresp/config.js';
 import {
   AuthRequest,
   BlockTxsRequest,
@@ -457,7 +457,8 @@ export class LibP2PService extends WithTracer implements P2PService {
       ],
       datastore,
       peerDiscovery,
-      streamMuxers: [yamux(), mplex()],
+      // Pin the yamux frame size: MAX_REQRESP_REQUEST_SIZE_BYTES relies on a reqresp request fitting in one frame.
+      streamMuxers: [yamux({ maxMessageSize: YAMUX_MAX_MESSAGE_SIZE_BYTES }), mplex()],
       connectionEncryption: [noise()],
       connectionManager: {
         minConnections: 0, // Disable libp2p peer dialing, we do it manually

package/src/services/reqresp/README.md

@@ -14,9 +14,8 @@ Applied before the protocol handler runs.
 | STATUS | 5/s | 10/s | same |
 | AUTH | 5/s | 10/s | same |
 | GOODBYE | 5/s | 10/s | same |
-| BLOCK | 2/s | 5/s | same |
 | BLOCK_TXS | 10/s | 200/s | same |
-| TX | (see rate limits file) | (see rate limits file) | same |
+| TX | 10/s | 200/s | same |
 
 - Per-peer limit exceeded: `HighToleranceError` penalty + `RATE_LIMIT_EXCEEDED` status. Penalty fires inside `RequestResponseRateLimiter.allow()`, not the stream handler.
 - Global limit exceeded: `RATE_LIMIT_EXCEEDED` status only (no peer penalty).
@@ -149,26 +148,6 @@ Protected peers (private/trusted/preferred) are always considered "authenticated
 
 ## Block Data Protocols
 
-### BLOCK Protocol (`/aztec/req/block/1.0.0`)
-
-**Server side**:
-
-| Rule | Consequence | File |
-|------|-------------|------|
-| Request must parse as `Fr` | `BADLY_FORMED_REQUEST` + LowToleranceError | `protocols/block.ts` |
-| Block lookup throws | `INTERNAL_ERROR` status | same |
-| Block not found | SUCCESS + empty buffer (design choice; no `NOT_FOUND` status used) | same |
-
-**Requester side** (Snappy limit: 3 MB):
-
-| Rule | Consequence | File |
-|------|-------------|------|
-| Response block number must match requested | LowToleranceError; rejected | `libp2p_service.ts` (`validateRequestedBlock`) |
-| Local block must exist for hash verification | Rejected (no penalty) | same |
-| Response block hash must equal local block hash | MidToleranceError; rejected | same |
-
-**Limitation**: the local-block requirement means BLOCK req/resp is unusable for initial P2P-only sync (before L1 sync provides local copies for verification). A TODO in the code acknowledges this.
-
 ### BLOCK_TXS Protocol (`/aztec/req/block_txs/1.0.0`)
 
 **Server side**:
@@ -178,7 +157,7 @@ Protected peers (private/trusted/preferred) are always considered "authenticated
 | Request must parse as `BlockTxsRequest` (Fr + TxHashArray + BitVector) | `BADLY_FORMED_REQUEST` + LowToleranceError | `protocols/block_txs/block_txs_handler.ts` |
 | BitVector length: non-negative and <= `MAX_TXS_PER_BLOCK` (65536) | Deserialization throws -> `BADLY_FORMED_REQUEST` | `protocols/block_txs/bitvector.ts` |
 | Archive root not found and no explicit txHashes | `NOT_FOUND` status | handler |
-| Internal error during lookup | Unhandled exception -> stream abort (no `INTERNAL_ERROR` status, unlike BLOCK) | handler |
+| Internal error during lookup | Unhandled exception -> stream abort (no `INTERNAL_ERROR` status) | handler |
 
 Conditional registration: BLOCK_TXS handler only registered when `config.disableTransactions` is false. Otherwise peers get `ERR_UNSUPPORTED_PROTOCOL`.
 

package/src/services/reqresp/config.ts

@@ -5,6 +5,23 @@ export const DEFAULT_OVERALL_REQUEST_TIMEOUT_MS = 10_000; // Not currently used
 export const DEFAULT_REQRESP_DIAL_TIMEOUT_MS = 5_000;
 export const DEFAULT_OPTIMISTIC_NEGOTIATION = false;
 
+/**
+ * Max size of a yamux frame, header included. This is the library default, pinned explicitly when configuring the
+ * muxer in the libp2p service so a dependency upgrade cannot silently change it.
+ */
+export const YAMUX_MAX_MESSAGE_SIZE_BYTES = 64 * 1024;
+
+/** Size of a yamux data frame header. */
+const YAMUX_HEADER_LENGTH_BYTES = 12;
+
+/**
+ * Max size of a reqresp request payload. A request must fit in a single muxer frame: the responder never reassembles
+ * a request from multiple chunks (see `ReqResp.processStream`), and yamux splits writes larger than one frame into
+ * multiple frames, each of which arrives as a separate chunk. mplex only splits at 1 MiB, so yamux is the binding
+ * constraint.
+ */
+export const MAX_REQRESP_REQUEST_SIZE_BYTES = YAMUX_MAX_MESSAGE_SIZE_BYTES - YAMUX_HEADER_LENGTH_BYTES;
+
 // For use in tests.
 export const DEFAULT_P2P_REQRESP_CONFIG: P2PReqRespConfig = {
   overallRequestTimeoutMs: DEFAULT_OVERALL_REQUEST_TIMEOUT_MS,

package/src/services/reqresp/rate-limiter/rate_limits.ts

@@ -9,7 +9,7 @@ export const DEFAULT_RATE_LIMITS: ReqRespSubProtocolRateLimits = {
     },
     globalLimit: {
       quotaTimeMs: 1000,
-      quotaCount: 10,
+      quotaCount: 50,
     },
   },
   [ReqRespSubProtocol.STATUS]: {
@@ -19,7 +19,7 @@ export const DEFAULT_RATE_LIMITS: ReqRespSubProtocolRateLimits = {
     },
     globalLimit: {
       quotaTimeMs: 1000,
-      quotaCount: 10,
+      quotaCount: 50,
     },
   },
   [ReqRespSubProtocol.AUTH]: {
@@ -49,7 +49,7 @@ export const DEFAULT_RATE_LIMITS: ReqRespSubProtocolRateLimits = {
     },
     globalLimit: {
       quotaTimeMs: 1000,
-      quotaCount: 10,
+      quotaCount: 50,
     },
   },
   [ReqRespSubProtocol.BLOCK_TXS]: {

package/src/services/reqresp/reqresp.ts

@@ -10,12 +10,18 @@ import type { Libp2p } from 'libp2p';
 import { pipeline } from 'node:stream/promises';
 import type { Uint8ArrayList } from 'uint8arraylist';
 
-import { IndividualReqRespTimeoutError } from '../../errors/reqresp.error.js';
-import { OversizedSnappyResponseError, SnappyTransform } from '../encoding.js';
+import { IndividualReqRespTimeoutError, OversizedReqRespRequestError } from '../../errors/reqresp.error.js';
+import {
+  DEFAULT_MAX_RESPONSE_SIZE_KB,
+  OversizedSnappyResponseError,
+  ResponseSizeLimitExceededError,
+  SnappyTransform,
+} from '../encoding.js';
 import type { PeerScoring } from '../peer-manager/peer_scoring.js';
 import {
   DEFAULT_INDIVIDUAL_REQUEST_TIMEOUT_MS,
   DEFAULT_REQRESP_DIAL_TIMEOUT_MS,
+  MAX_REQRESP_REQUEST_SIZE_BYTES,
   type P2PReqRespConfig,
 } from './config.js';
 import { ConnectionSampler, RandomSampler } from './connection-sampler/connection_sampler.js';
@@ -207,6 +213,11 @@ export class ReqResp implements ReqRespInterface {
     payload: Buffer,
     dialTimeout: number = this.dialTimeoutMs,
   ): Promise<ReqRespResponse> {
+    // Thrown before the try block so the generic error handling below does not penalize the peer for our own bug.
+    if (payload.length > MAX_REQRESP_REQUEST_SIZE_BYTES) {
+      throw new OversizedReqRespRequestError(subProtocol, payload.length, MAX_REQRESP_REQUEST_SIZE_BYTES);
+    }
+
     let stream: Stream | undefined;
     try {
       this.metrics.recordRequestSent(subProtocol);
@@ -291,6 +302,14 @@ export class ReqResp implements ReqRespInterface {
    * - The first chunk should contain a control byte, indicating the status of the response see `ReqRespStatus`
    * - The second chunk should contain the response data
    *
+   * To bound memory usage we abort reception as soon as the accumulated compressed bytes exceed a
+   * bound derived from `maxSizeKb`, before the full stream has been buffered. Without this a peer we
+   * dialed could stream data up to the request timeout, forcing us to buffer arbitrarily much (the
+   * `maxSizeKb` guard in `inboundTransformData` only runs after the whole compressed payload is
+   * concatenated, so it does nothing to cap reception memory). Snappy can expand incompressible input
+   * to ~1.17x its size, so we allow 2x `maxSizeKb`: comfortably above the worst-case expansion of a
+   * legitimate max-size response, while still capping buffered memory at twice the permitted size.
+   *
    * @param source - The async iterable source of data chunks
    * @param maxSizeKb - Optional maximum expected size in KB for the decompressed response
    */
@@ -298,10 +317,20 @@ export class ReqResp implements ReqRespInterface {
     let status: ReqRespStatus | undefined;
     const chunks: Uint8Array[] = [];
 
+    const maxAccumulatedBytes = (maxSizeKb ?? DEFAULT_MAX_RESPONSE_SIZE_KB) * 1024 * 2;
+    let accumulatedBytes = 0;
+
     try {
       for await (const chunk of source) {
         const statusParsed = status !== undefined;
         if (statusParsed) {
+          // Use `byteLength` (the logical length) rather than `chunk.subarray().length`: calling
+          // `subarray()` on a `Uint8ArrayList` consolidates its backing buffers into a single copy,
+          // which would materialize the very chunk we are trying to reject.
+          accumulatedBytes += chunk.byteLength;
+          if (accumulatedBytes > maxAccumulatedBytes) {
+            throw new ResponseSizeLimitExceededError(accumulatedBytes, maxAccumulatedBytes);
+          }
           chunks.push(chunk.subarray());
           continue;
         }
@@ -440,6 +469,9 @@ export class ReqResp implements ReqRespInterface {
     await pipeline(
       stream.source,
       async function* (source: any) {
+        // Req/resp is one-request-one-response: an honest sender writes a single payload and half-closes.
+        // Process only the first chunk and return, so extra frames a peer queues on the same stream cannot
+        // drive further handler invocations that bypass the per-stream rate-limit check in streamHandler.
         for await (const chunk of source) {
           const response = await handler(connection.remotePeer, chunk.subarray());
 
@@ -454,6 +486,7 @@ export class ReqResp implements ReqRespInterface {
 
           yield SUCCESS;
           yield snappy.outboundTransformData(response);
+          return;
         }
       },
       stream.sink,
@@ -564,6 +597,13 @@ export class ReqResp implements ReqRespInterface {
       return PeerErrorSeverity.LowToleranceError;
     }
 
+    // Response exceeded the reception buffer bound: the peer streamed more compressed data than the
+    // per-request size limit allows. Same protocol violation as above, penalize harshly.
+    if (e instanceof ResponseSizeLimitExceededError) {
+      this.logger.warn(`Oversized response from peer ${peerId.toString()} in ${subProtocol}: ${e.message}`, logTags);
+      return PeerErrorSeverity.LowToleranceError;
+    }
+
     return this.categorizeConnectionErrors(e, peerId, subProtocol);
   }
 

package/src/test-helpers/testbench-utils.ts

@@ -171,6 +171,10 @@ export class InMemoryTxPool extends EventEmitter implements TxPoolV2 {
     return Promise.resolve(this.txsByHash.size);
   }
 
+  async hasEligiblePendingTxs(minCount: number): Promise<boolean> {
+    return (await this.getPendingTxCount()) >= minCount;
+  }
+
   getMinedTxHashes(): Promise<[TxHash, L2BlockId][]> {
     return Promise.resolve([]);
   }