@aztec/stdlib 0.0.1-commit.85d7d01 → 0.0.1-commit.8655d4a

package/src/messaging/l2_to_l1_membership.ts

@@ -1,8 +1,26 @@
-import { OUT_HASH_TREE_LEAF_COUNT } from '@aztec/constants';
+import { MAX_CHECKPOINTS_PER_EPOCH, OUT_HASH_TREE_LEAF_COUNT } from '@aztec/constants';
 import type { EpochNumber } from '@aztec/foundation/branded-types';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { SiblingPath, UnbalancedMerkleTreeCalculator, computeUnbalancedShaRoot } from '@aztec/foundation/trees';
 
+import type { AztecNode } from '../interfaces/aztec-node.js';
+import { TxHash } from '../tx/tx_hash.js';
+import { TxReceipt } from '../tx/tx_receipt.js';
+
+/**
+ * Provides access to the L1 Outbox's per-epoch roots so the witness helper can pick the smallest
+ * partial-proof root that covers a tx's checkpoint. Implemented by `OutboxContract` in the
+ * ethereum package.
+ */
+export interface OutboxRootsReader {
+  /**
+   * Returns the array of roots stored for `epoch`. Slot `i` holds the root inserted for
+   * `numCheckpointsInEpoch = i + 1`, or `Fr.ZERO` if no proof of that depth has landed yet. The
+   * returned array length is `MAX_CHECKPOINTS_PER_EPOCH`.
+   */
+  getRoots(epoch: EpochNumber): Promise<Fr[]>;
+}
+
 /**
  * # L2-to-L1 Message Tree Structure and Leaf IDs
  *
@@ -92,59 +110,151 @@ export function getL2ToL1MessageLeafId(
   return 2n ** BigInt(membershipWitness.siblingPath.pathSize) + membershipWitness.leafIndex;
 }
 
-export interface MessageRetrieval {
-  getL2ToL1Messages(epoch: EpochNumber): Promise<Fr[][][][]>;
-}
-
 export type L2ToL1MembershipWitness = {
+  epochNumber: EpochNumber;
+  /**
+   * The number of checkpoints covered by the partial-proof root this witness was built against
+   * (1-indexed; equal to `roots-array-index + 1` on the Outbox). Pass this through to
+   * `Outbox.consume` so the contract reads the matching root slot.
+   */
+  numCheckpointsInEpoch: number;
   root: Fr;
   leafIndex: bigint;
   siblingPath: SiblingPath<number>;
 };
 
+/**
+ * Computes the L2 to L1 membership witness for a given message in a transaction.
+ *
+ * Queries the L1 Outbox to find the smallest partial-proof root that covers the tx's checkpoint,
+ * then builds the witness against that root by including only the first `numCheckpointsInEpoch`
+ * checkpoints of the epoch in the tree (the remaining slots are zero-padded, matching the shape
+ * the rollup proved). Returns `undefined` if the tx is not yet in a block/epoch or if the Outbox
+ * holds no root yet that covers the tx's checkpoint.
+ *
+ * @param node - The Aztec node to query for block/tx/epoch data.
+ * @param outboxOrRoots - Either an `OutboxRootsReader` (the helper will fetch the per-epoch roots),
+ *   or an already-resolved roots array of length `MAX_CHECKPOINTS_PER_EPOCH`. Pass the array when
+ *   you already read the outbox (e.g. inside a tight loop that resolves witnesses for many
+ *   messages in the same epoch) to avoid redundant L1 reads.
+ * @param message - The L2 to L1 message hash to prove membership of.
+ * @param txHashOrReceipt - Either the tx hash, or the already-fetched `TxReceipt`. Passing the
+ *   receipt skips an internal `getTxReceipt` call.
+ * @param messageIndexInTx - Optional index of the message within the transaction's L2-to-L1 messages.
+ *   If not provided, the message is found by scanning the tx's messages (throws if duplicates exist).
+ */
 export async function computeL2ToL1MembershipWitness(
-  messageRetriever: MessageRetrieval,
-  epoch: EpochNumber,
+  node: Pick<AztecNode, 'getL2ToL1Messages' | 'getTxReceipt' | 'getTxEffect' | 'getBlock' | 'getCheckpointsData'>,
+  outboxOrRoots: OutboxRootsReader | Fr[],
   message: Fr,
+  txHashOrReceipt: TxHash | Pick<TxReceipt, 'txHash' | 'epochNumber' | 'blockNumber'>,
+  messageIndexInTx?: number,
 ): Promise<L2ToL1MembershipWitness | undefined> {
-  const messagesInEpoch = await messageRetriever.getL2ToL1Messages(epoch);
-  if (messagesInEpoch.length === 0) {
+  const receipt = 'txHash' in txHashOrReceipt ? txHashOrReceipt : await node.getTxReceipt(txHashOrReceipt);
+  const { txHash, epochNumber, blockNumber } = receipt;
+  if (epochNumber === undefined || blockNumber === undefined) {
     return undefined;
   }
 
-  return computeL2ToL1MembershipWitnessFromMessagesInEpoch(messagesInEpoch, message);
+  const [messagesInEpoch, block, txEffect, checkpointsData] = await Promise.all([
+    node.getL2ToL1Messages(epochNumber),
+    node.getBlock(blockNumber),
+    node.getTxEffect(txHash),
+    node.getCheckpointsData({ epoch: epochNumber }),
+  ]);
+
+  if (messagesInEpoch.length === 0 || !block || !txEffect) {
+    return undefined;
+  }
+
+  const checkpointIndex = checkpointsData.findIndex(c => c.checkpointNumber === block.checkpointNumber);
+  if (checkpointIndex === -1) {
+    return undefined;
+  }
+
+  const blockIndex = block.indexWithinCheckpoint;
+  const txIndex = txEffect.txIndexInBlock;
+
+  // Pick the smallest partial-proof root on the Outbox that covers checkpointIndex. The Outbox
+  // stores roots keyed by `numCheckpointsInEpoch - 1`, so to cover a tx in checkpoint at index
+  // `checkpointIndex` we need a non-zero entry at array index >= checkpointIndex.
+  const roots = Array.isArray(outboxOrRoots)
+    ? (outboxOrRoots as Fr[])
+    : await (outboxOrRoots as OutboxRootsReader).getRoots(epochNumber);
+  const numCheckpointsInEpoch = findSmallestCoveringRootCount(roots, checkpointIndex);
+  if (numCheckpointsInEpoch === undefined) {
+    return undefined;
+  }
+
+  // Build the witness against the first `numCheckpointsInEpoch` checkpoints. The inner builder
+  // pads to OUT_HASH_TREE_LEAF_COUNT internally, so slicing the outer array narrows the real-leaf
+  // prefix and grows the zero suffix — exactly the shape the rollup proved against.
+  const messagesInPartialEpoch = messagesInEpoch.slice(0, numCheckpointsInEpoch);
+
+  const { root, leafIndex, siblingPath } = computeL2ToL1MembershipWitnessFromMessagesInEpoch(
+    messagesInPartialEpoch,
+    message,
+    checkpointIndex,
+    blockIndex,
+    txIndex,
+    messageIndexInTx,
+  );
+
+  // Cross-check: the recomputed root must equal the root the Outbox is holding for this depth.
+  // A mismatch means the node and L1 disagree about the epoch's contents; fail loud rather than
+  // return a witness that will revert on chain.
+  const expected = roots[numCheckpointsInEpoch - 1];
+  if (!root.equals(expected)) {
+    throw new Error(
+      `Local epoch out-hash does not match Outbox at epoch ${epochNumber} numCheckpointsInEpoch ` +
+        `${numCheckpointsInEpoch}: local=${root.toString()} outbox=${expected.toString()}`,
+    );
+  }
+
+  return { epochNumber, numCheckpointsInEpoch, root, leafIndex, siblingPath };
+}
+
+/**
+ * Returns the smallest `numCheckpointsInEpoch` (1-indexed) for which the Outbox holds a root that
+ * covers the message at `checkpointIndex` (0-indexed). Returns `undefined` if no covering root has
+ * been inserted yet.
+ */
+function findSmallestCoveringRootCount(roots: Fr[], checkpointIndex: number): number | undefined {
+  for (let i = checkpointIndex; i < Math.min(roots.length, MAX_CHECKPOINTS_PER_EPOCH); i++) {
+    if (!roots[i].isZero()) {
+      return i + 1;
+    }
+  }
+  return undefined;
 }
 
-// TODO: Allow to specify the message to consume by its index or by an offset, in case there are multiple messages with
-// the same value.
+/**
+ * Computes a membership witness for a message in the epoch's L2-to-L1 message tree, given explicit position indices.
+ *
+ * @param messagesInEpoch - All L2-to-L1 messages in the epoch, organized as checkpoints → blocks → txs → messages.
+ * @param message - The message hash to prove membership of.
+ * @param checkpointIndex - Index of the checkpoint within the epoch's message array.
+ * @param blockIndex - Index of the block within the checkpoint.
+ * @param txIndex - Index of the transaction within the block.
+ * @param messageIndexInTx - Optional index of the message within the transaction's messages.
+ *   If not provided, the message is found by scanning (throws if duplicates exist within the tx).
+ */
+/** @internal Exported for testing only. */
 export function computeL2ToL1MembershipWitnessFromMessagesInEpoch(
   messagesInEpoch: Fr[][][][],
   message: Fr,
-): L2ToL1MembershipWitness {
-  // Find the index of the message in the tx, index of the tx in the block, and index of the block in the epoch.
-  let messageIndexInTx = -1;
-  let txIndex = -1;
-  let blockIndex = -1;
-  const checkpointIndex = messagesInEpoch.findIndex(messagesInCheckpoint => {
-    blockIndex = messagesInCheckpoint.findIndex(messagesInBlock => {
-      txIndex = messagesInBlock.findIndex(messagesInTx => {
-        messageIndexInTx = messagesInTx.findIndex(msg => msg.equals(message));
-        return messageIndexInTx !== -1;
-      });
-      return txIndex !== -1;
-    });
-    return blockIndex !== -1;
-  });
-
-  if (checkpointIndex === -1) {
-    throw new Error('The L2ToL1Message you are trying to prove inclusion of does not exist');
-  }
+  checkpointIndex: number,
+  blockIndex: number,
+  txIndex: number,
+  messageIndexInTx?: number,
+): { root: Fr; leafIndex: bigint; siblingPath: SiblingPath<number> } {
+  const messagesInTx = messagesInEpoch[checkpointIndex][blockIndex][txIndex];
+  const resolvedMessageIndex = resolveMessageIndex(messagesInTx, message, messageIndexInTx);
 
   // Build the tx tree.
-  const messagesInTx = messagesInEpoch[checkpointIndex][blockIndex][txIndex];
   const txTree = UnbalancedMerkleTreeCalculator.create(messagesInTx.map(msg => msg.toBuffer()));
   // Get the sibling path of the target message in the tx tree.
-  const pathToMessageInTxSubtree = txTree.getSiblingPathByLeafIndex(messageIndexInTx);
+  const pathToMessageInTxSubtree = txTree.getSiblingPathByLeafIndex(resolvedMessageIndex);
 
   // Build the tree of the block containing the target message.
   const blockTree = buildBlockTree(messagesInEpoch[checkpointIndex][blockIndex]);
@@ -189,7 +299,7 @@ export function computeL2ToL1MembershipWitnessFromMessagesInEpoch(
   // Compute the combined index.
   // It is the index of the message in the balanced tree (by filling up the wonky tree with empty nodes) at its current
   // height. It's used to validate the membership proof.
-  const messageLeafPosition = txTree.getLeafLocation(messageIndexInTx);
+  const messageLeafPosition = txTree.getLeafLocation(resolvedMessageIndex);
   const txLeafPosition = blockTree.getLeafLocation(txIndex);
   const blockLeafPosition = checkpointTree.getLeafLocation(blockIndex);
   const checkpointLeafPosition = epochTree.getLeafLocation(checkpointIndex);
@@ -207,6 +317,33 @@ export function computeL2ToL1MembershipWitnessFromMessagesInEpoch(
   };
 }
 
+function resolveMessageIndex(messagesInTx: Fr[], message: Fr, messageIndexInTx?: number): number {
+  if (messageIndexInTx !== undefined) {
+    if (!messagesInTx[messageIndexInTx]?.equals(message)) {
+      throw new Error(`Message at index ${messageIndexInTx} in tx does not match the expected message ${message}`);
+    }
+    return messageIndexInTx;
+  }
+
+  const indices = messagesInTx.reduce<number[]>((acc, msg, i) => {
+    if (msg.equals(message)) {
+      acc.push(i);
+    }
+    return acc;
+  }, []);
+
+  if (indices.length === 0) {
+    throw new Error('The L2ToL1Message you are trying to prove inclusion of does not exist');
+  }
+  if (indices.length > 1) {
+    throw new Error(
+      `Multiple messages with the same value ${message} found in tx (indices: ${indices.join(', ')}). ` +
+        `Provide messageIndexInTx to disambiguate.`,
+    );
+  }
+  return indices[0];
+}
+
 function buildCheckpointTree(messagesInCheckpoint: Fr[][][]) {
   const blockOutHashes = messagesInCheckpoint.map(messagesInBlock => buildBlockTree(messagesInBlock).getRoot());
   return buildCompressedTree(blockOutHashes);

package/src/messaging/l2_to_l1_message.ts

@@ -1,7 +1,7 @@
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { EthAddress } from '@aztec/foundation/eth-address';
 import { schemas } from '@aztec/foundation/schemas';
-import { BufferReader, FieldReader, serializeToBuffer, serializeToFields } from '@aztec/foundation/serialize';
+import { BufferReader, BufferSink, FieldReader, serializeToFields, serializeToSink } from '@aztec/foundation/serialize';
 
 import { z } from 'zod';
 
@@ -54,8 +54,13 @@ export class L2ToL1Message {
    * Serialize this as a buffer.
    * @returns The buffer.
    */
-  toBuffer(): Buffer {
-    return serializeToBuffer(this.recipient, this.content);
+  toBuffer(): Buffer;
+  toBuffer(sink: BufferSink): void;
+  toBuffer(sink?: BufferSink): Buffer | void {
+    if (!sink) {
+      return BufferSink.serialize(this);
+    }
+    serializeToSink(sink, this.recipient, this.content);
   }
 
   /**
@@ -127,8 +132,13 @@ export class CountedL2ToL1Message {
     return new CountedL2ToL1Message(reader.readObject(L2ToL1Message), reader.readNumber());
   }
 
-  toBuffer(): Buffer {
-    return serializeToBuffer(this.message, this.counter);
+  toBuffer(): Buffer;
+  toBuffer(sink: BufferSink): void;
+  toBuffer(sink?: BufferSink): Buffer | void {
+    if (!sink) {
+      return BufferSink.serialize(this);
+    }
+    serializeToSink(sink, this.message, this.counter);
   }
 
   static fromFields(fields: Fr[] | FieldReader) {
@@ -187,8 +197,13 @@ export class ScopedL2ToL1Message {
     return new ScopedL2ToL1Message(reader.readObject(L2ToL1Message), reader.readObject(AztecAddress));
   }
 
-  toBuffer(): Buffer {
-    return serializeToBuffer(this.message, this.contractAddress);
+  toBuffer(): Buffer;
+  toBuffer(sink: BufferSink): void;
+  toBuffer(sink?: BufferSink): Buffer | void {
+    if (!sink) {
+      return BufferSink.serialize(this);
+    }
+    serializeToSink(sink, this.message, this.contractAddress);
   }
 
   static fromFields(fields: Fr[] | FieldReader) {
@@ -229,8 +244,13 @@ export class ScopedCountedL2ToL1Message {
     return new ScopedCountedL2ToL1Message(reader.readObject(CountedL2ToL1Message), reader.readObject(AztecAddress));
   }
 
-  toBuffer(): Buffer {
-    return serializeToBuffer(this.inner, this.contractAddress);
+  toBuffer(): Buffer;
+  toBuffer(sink: BufferSink): void;
+  toBuffer(sink?: BufferSink): Buffer | void {
+    if (!sink) {
+      return BufferSink.serialize(this);
+    }
+    serializeToSink(sink, this.inner, this.contractAddress);
   }
 
   static fromFields(fields: Fr[] | FieldReader) {

package/src/noir/index.ts

@@ -19,7 +19,7 @@ export const AZTEC_VIEW_ATTRIBUTE = 'abi_view';
 export interface NoirFunctionAbi {
   /** The parameters of the function. */
   parameters: ABIParameter[];
-  /** The return type of the function. */
+  /** The return type of the function, or null for void functions. */
   return_type: {
     /**
      * The type of the return value.
@@ -29,7 +29,7 @@ export interface NoirFunctionAbi {
      * The visibility of the return value.
      */
     visibility: ABIParameterVisibility;
-  };
+  } | null;
   /** Mapping of error selector => error type */
   error_types: Partial<Record<string, AbiErrorType>>;
 }
@@ -64,6 +64,8 @@ interface NoirFunctionEntry {
 export interface NoirCompiledContract {
   /** The name of the contract. */
   name: string;
+  /** The version of the Aztec stack that compiled this contract. */
+  aztec_version: string;
   /** Is the contract's public bytecode transpiled? */
   transpiled?: boolean;
   /** The functions of the contract. */

package/src/note/note_dao.ts

@@ -1,6 +1,5 @@
 import { BlockNumber } from '@aztec/foundation/branded-types';
 import { Fr } from '@aztec/foundation/curves/bn254';
-import { Point } from '@aztec/foundation/curves/grumpkin';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
 import { Note } from '@aztec/stdlib/note';
@@ -148,9 +147,7 @@ export class NoteDao {
    * @returns - Its size in bytes.
    */
   public getSize() {
-    const noteSize = 4 + this.note.items.length * Fr.SIZE_IN_BYTES;
-    // 2 numbers for txIndexInBlock and noteIndexInTx (4 bytes each)
-    return noteSize + AztecAddress.SIZE_IN_BYTES * 2 + Fr.SIZE_IN_BYTES * 4 + TxHash.SIZE + Point.SIZE_IN_BYTES + 8;
+    return this.toBuffer().length;
   }
 
   static async random({

package/src/p2p/block_proposal.ts

@@ -1,12 +1,19 @@
-import { BlockNumber, IndexWithinCheckpoint, SlotNumber } from '@aztec/foundation/branded-types';
-import { Buffer32 } from '@aztec/foundation/buffer';
+import {
+  BlockNumber,
+  BlockProposalHash,
+  type CheckpointNumber,
+  IndexWithinCheckpoint,
+  SlotNumber,
+} from '@aztec/foundation/branded-types';
+import { type BaseBuffer32, Buffer32 } from '@aztec/foundation/buffer';
 import { keccak256 } from '@aztec/foundation/crypto/keccak';
-import { tryRecoverAddress } from '@aztec/foundation/crypto/secp256k1-signer';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 import { Signature } from '@aztec/foundation/eth-signature';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 
+import type { TypedDataDefinition } from 'viem';
+
 import type { L2Block } from '../block/l2_block.js';
 import type { L2BlockInfo } from '../block/l2_block_info.js';
 import { MAX_TXS_PER_BLOCK } from '../deserialization/index.js';
@@ -16,18 +23,20 @@ import { TxHash } from '../tx/index.js';
 import type { Tx } from '../tx/tx.js';
 import { Gossipable } from './gossipable.js';
 import {
-  SignatureDomainSeparator,
-  getHashedSignaturePayload,
-  getHashedSignaturePayloadEthSignedMessage,
+  type CoordinationSignatureContext,
+  type CoordinationSignatureType,
+  EMPTY_COORDINATION_SIGNATURE_CONTEXT,
+  type Signable,
+  coordinationSignatureContextEquals,
+  getCoordinationSignatureTypedData,
+  readCoordinationSignatureContext,
+  recoverCoordinationSigner,
+  serializeCoordinationSignatureContext,
 } from './signature_utils.js';
 import { SignedTxs } from './signed_txs.js';
 import { TopicType } from './topic_type.js';
 
-export class BlockProposalHash extends Buffer32 {
-  constructor(hash: Buffer) {
-    super(hash);
-  }
-}
+export type { BlockProposalHash } from '@aztec/foundation/branded-types';
 
 export type BlockProposalOptions = {
   /**
@@ -47,10 +56,12 @@ export type BlockProposalOptions = {
  * to be included in a block within a checkpoint. This is used for non-last blocks in a slot.
  * The last block is sent as part of a CheckpointProposal.
  */
-export class BlockProposal extends Gossipable {
+export class BlockProposal extends Gossipable implements Signable {
   static override p2pTopic = TopicType.block_proposal;
 
-  private sender: EthAddress | undefined;
+  readonly primaryType: CoordinationSignatureType = 'BlockProposal';
+
+  private cachedSender: EthAddress | undefined | null = undefined;
 
   constructor(
     /** The per-block header containing block state and global variables */
@@ -71,14 +82,17 @@ export class BlockProposal extends Gossipable {
     /** The proposer's signature over the block data */
     public readonly signature: Signature,
 
+    /** The signing domain (chainId + rollupAddress) the signature is bound to */
+    public readonly signatureContext: CoordinationSignatureContext,
+
     /** The signed transactions in the block (optional, for DA guarantees) */
     public readonly signedTxs?: SignedTxs,
   ) {
     super();
   }
 
-  override generateP2PMessageIdentifier(): Promise<Buffer32> {
-    return Promise.resolve(new BlockProposalHash(keccak256(this.signature.toBuffer())));
+  override generateP2PMessageIdentifier(): Promise<BaseBuffer32> {
+    return Promise.resolve(new Buffer32(this.getPayloadHashBuffer()));
   }
 
   get archive(): Fr {
@@ -112,9 +126,8 @@ export class BlockProposal extends Gossipable {
    * Get the payload to sign for this block proposal.
    * The signature is over: blockHeader + indexWithinCheckpoint + inHash + archiveRoot + txHashes
    */
-  getPayloadToSign(domainSeparator: SignatureDomainSeparator): Buffer {
+  getPayloadToSign(): Buffer {
     return serializeToBuffer([
-      domainSeparator,
       this.blockHeader,
       this.indexWithinCheckpoint,
       this.inHash,
@@ -124,14 +137,32 @@ export class BlockProposal extends Gossipable {
     ]);
   }
 
+  private getPayloadHashBuffer(): Buffer {
+    return keccak256(this.getPayloadToSign());
+  }
+
+  /**
+   * Returns a keccak256 hash of the signed payload.
+   * Used by the attestation pool to dedup distinct signed payloads at the same
+   * (slot, indexWithinCheckpoint) regardless of archive collisions.
+   * The hash deliberately excludes the signature so non-deterministic ECDSA
+   * re-signs of the same payload do not look like equivocation.
+   */
+  getPayloadHash(): BlockProposalHash {
+    return BlockProposalHash.fromBuffer(this.getPayloadHashBuffer());
+  }
+
   static async createProposalFromSigner(
     blockHeader: BlockHeader,
+    checkpointNumber: CheckpointNumber,
     indexWithinCheckpoint: IndexWithinCheckpoint,
     inHash: Fr,
     archiveRoot: Fr,
     txHashes: TxHash[],
     txs: Tx[] | undefined,
-    payloadSigner: (payload: Buffer32, context: SigningContext) => Promise<Signature>,
+    signatureContext: CoordinationSignatureContext,
+    proposalSigner: (typedData: TypedDataDefinition, context: SigningContext) => Promise<Signature>,
+    txsSigner?: (typedData: TypedDataDefinition, context: SigningContext) => Promise<Signature>,
   ): Promise<BlockProposal> {
     // Create a temporary proposal to get the payload to sign
     const tempProposal = new BlockProposal(
@@ -141,57 +172,76 @@ export class BlockProposal extends Gossipable {
       archiveRoot,
       txHashes,
       Signature.empty(),
+      signatureContext,
     );
 
     // Create the block signing context
     const blockContext: SigningContext = {
       slot: blockHeader.globalVariables.slotNumber,
       blockNumber: blockHeader.globalVariables.blockNumber,
+      checkpointNumber,
       blockIndexWithinCheckpoint: indexWithinCheckpoint,
       dutyType: DutyType.BLOCK_PROPOSAL,
     };
 
-    const hashed = getHashedSignaturePayload(tempProposal, SignatureDomainSeparator.blockProposal);
-    const sig = await payloadSigner(hashed, blockContext);
+    const typedData = getCoordinationSignatureTypedData(tempProposal);
+    const sig = await proposalSigner(typedData, blockContext);
 
     // If txs are provided, sign them as well
     let signedTxs: SignedTxs | undefined;
     if (txs) {
       const txsSigningContext: SigningContext = { dutyType: DutyType.TXS };
-      const txsSigner = (payload: Buffer32) => payloadSigner(payload, txsSigningContext);
-      signedTxs = await SignedTxs.createFromSigner(txs, txsSigner);
+      if (!txsSigner) {
+        throw new Error('signed_txs requires a typed-data signer');
+      }
+      signedTxs = await SignedTxs.createFromSigner(txs, signatureContext, typedData =>
+        txsSigner(typedData, txsSigningContext),
+      );
     }
 
-    return new BlockProposal(blockHeader, indexWithinCheckpoint, inHash, archiveRoot, txHashes, sig, signedTxs);
+    return new BlockProposal(
+      blockHeader,
+      indexWithinCheckpoint,
+      inHash,
+      archiveRoot,
+      txHashes,
+      sig,
+      signatureContext,
+      signedTxs,
+    );
   }
 
   /**
    * Lazily evaluate the sender of the proposal; result is cached.
-   * If there's signedTxs, also verifies the signedTxs sender matches the block proposal sender.
-   * @returns The sender address, or undefined if signature recovery fails or senders don't match
+   * If there's signedTxs, also verifies that its signing domain matches this proposal's and
+   * that the signedTxs sender matches the block proposal sender. This prevents a proposer
+   * from wrapping a foreign-chain SignedTxs bundle inside a local-chain proposal.
+   * @returns The sender address, or undefined if signature recovery fails or inner/outer mismatch
    */
   getSender(): EthAddress | undefined {
-    if (!this.sender) {
-      const hashed = getHashedSignaturePayloadEthSignedMessage(this, SignatureDomainSeparator.blockProposal);
-      const blockSender = tryRecoverAddress(hashed, this.signature);
+    if (this.cachedSender === undefined) {
+      const blockSender = recoverCoordinationSigner(this, this.signature);
 
-      // If there's signedTxs, verify the sender matches
       if (blockSender && this.signedTxs) {
+        if (!coordinationSignatureContextEquals(this.signedTxs.signatureContext, this.signatureContext)) {
+          this.cachedSender = null;
+          return undefined;
+        }
         const txsSender = this.signedTxs.getSender();
         if (!txsSender || !txsSender.equals(blockSender)) {
-          return undefined; // Sender mismatch - fail
+          this.cachedSender = null;
+          return undefined;
         }
       }
 
-      // Cache the sender for later use
-      this.sender = blockSender;
+      this.cachedSender = blockSender ?? null;
     }
 
-    return this.sender;
+    return this.cachedSender ?? undefined;
   }
 
   getPayload() {
-    return this.getPayloadToSign(SignatureDomainSeparator.blockProposal);
+    return this.getPayloadToSign();
   }
 
   toBuffer(): Buffer {
@@ -201,6 +251,7 @@ export class BlockProposal extends Gossipable {
       this.inHash,
       this.archiveRoot,
       this.signature,
+      serializeCoordinationSignatureContext(this.signatureContext),
       this.txHashes.length,
       this.txHashes,
     ];
@@ -221,6 +272,7 @@ export class BlockProposal extends Gossipable {
     const inHash = reader.readObject(Fr);
     const archiveRoot = reader.readObject(Fr);
     const signature = reader.readObject(Signature);
+    const signatureContext = readCoordinationSignatureContext(reader);
     const txHashCount = reader.readNumber();
     if (txHashCount > MAX_TXS_PER_BLOCK) {
       throw new Error(`txHashes count ${txHashCount} exceeds maximum ${MAX_TXS_PER_BLOCK}`);
@@ -238,12 +290,21 @@ export class BlockProposal extends Gossipable {
           archiveRoot,
           txHashes,
           signature,
+          signatureContext,
           signedTxs,
         );
       }
     }
 
-    return new BlockProposal(blockHeader, indexWithinCheckpoint, inHash, archiveRoot, txHashes, signature);
+    return new BlockProposal(
+      blockHeader,
+      indexWithinCheckpoint,
+      inHash,
+      archiveRoot,
+      txHashes,
+      signature,
+      signatureContext,
+    );
   }
 
   getSize(): number {
@@ -253,6 +314,8 @@ export class BlockProposal extends Gossipable {
       this.inHash.size +
       this.archiveRoot.size +
       this.signature.getSize() +
+      4 /* chainId */ +
+      20 /* rollupAddress */ +
       4 /* txHashes.length */ +
       this.txHashes.length * TxHash.SIZE +
       4 /* hasSignedTxs flag */ +
@@ -261,7 +324,15 @@ export class BlockProposal extends Gossipable {
   }
 
   static empty(): BlockProposal {
-    return new BlockProposal(BlockHeader.empty(), IndexWithinCheckpoint(0), Fr.ZERO, Fr.ZERO, [], Signature.empty());
+    return new BlockProposal(
+      BlockHeader.empty(),
+      IndexWithinCheckpoint(0),
+      Fr.ZERO,
+      Fr.ZERO,
+      [],
+      Signature.empty(),
+      EMPTY_COORDINATION_SIGNATURE_CONTEXT,
+    );
   }
 
   static random(): BlockProposal {
@@ -272,6 +343,7 @@ export class BlockProposal extends Gossipable {
       Fr.random(),
       [TxHash.random(), TxHash.random()],
       Signature.random(),
+      EMPTY_COORDINATION_SIGNATURE_CONTEXT,
     );
   }
 
@@ -283,6 +355,8 @@ export class BlockProposal extends Gossipable {
       archiveRoot: this.archiveRoot.toString(),
       signature: this.signature.toString(),
       txHashes: this.txHashes.map(h => h.toString()),
+      chainId: this.signatureContext.chainId,
+      rollupAddress: this.signatureContext.rollupAddress.toString(),
     };
   }
 
@@ -308,6 +382,7 @@ export class BlockProposal extends Gossipable {
       this.archiveRoot,
       this.txHashes,
       this.signature,
+      this.signatureContext,
     );
   }
 }