@aztec/validator-client 0.0.1-commit.7d4e6cd → 0.0.1-commit.86469d5

package/src/tx_validator/tx_validator_factory.ts

@@ -1,5 +1,6 @@
 import { BlockNumber } from '@aztec/foundation/branded-types';
 import { Fr } from '@aztec/foundation/curves/bn254';
+import type { LoggerBindings } from '@aztec/foundation/log';
 import { getVKTreeRoot } from '@aztec/noir-protocol-circuits-types/vk-tree';
 import {
   AggregateTxValidator,
@@ -10,6 +11,7 @@ import {
   GasTxValidator,
   MetadataTxValidator,
   PhasesTxValidator,
+  SizeTxValidator,
   TimestampTxValidator,
   TxPermittedValidator,
   TxProofValidator,
@@ -52,31 +54,41 @@ export function createValidatorForAcceptingTxs(
     blockNumber: BlockNumber;
     txsPermitted: boolean;
   },
+  bindings?: LoggerBindings,
 ): TxValidator<Tx> {
   const validators: TxValidator<Tx>[] = [
-    new TxPermittedValidator(txsPermitted),
-    new DataTxValidator(),
-    new MetadataTxValidator({
-      l1ChainId: new Fr(l1ChainId),
-      rollupVersion: new Fr(rollupVersion),
-      protocolContractsHash,
-      vkTreeRoot: getVKTreeRoot(),
-    }),
-    new TimestampTxValidator({
-      timestamp,
-      blockNumber,
-    }),
-    new DoubleSpendTxValidator(new NullifierCache(db)),
-    new PhasesTxValidator(contractDataSource, setupAllowList, timestamp),
-    new BlockHeaderTxValidator(new ArchiveCache(db)),
+    new TxPermittedValidator(txsPermitted, bindings),
+    new SizeTxValidator(bindings),
+    new DataTxValidator(bindings),
+    new MetadataTxValidator(
+      {
+        l1ChainId: new Fr(l1ChainId),
+        rollupVersion: new Fr(rollupVersion),
+        protocolContractsHash,
+        vkTreeRoot: getVKTreeRoot(),
+      },
+      bindings,
+    ),
+    new TimestampTxValidator(
+      {
+        timestamp,
+        blockNumber,
+      },
+      bindings,
+    ),
+    new DoubleSpendTxValidator(new NullifierCache(db), bindings),
+    new PhasesTxValidator(contractDataSource, setupAllowList, timestamp, bindings),
+    new BlockHeaderTxValidator(new ArchiveCache(db), bindings),
   ];
 
   if (!skipFeeEnforcement) {
-    validators.push(new GasTxValidator(new DatabasePublicStateSource(db), ProtocolContractAddress.FeeJuice, gasFees));
+    validators.push(
+      new GasTxValidator(new DatabasePublicStateSource(db), ProtocolContractAddress.FeeJuice, gasFees, bindings),
+    );
   }
 
   if (verifier) {
-    validators.push(new TxProofValidator(verifier));
+    validators.push(new TxProofValidator(verifier, bindings));
   }
 
   return new AggregateTxValidator(...validators);
@@ -87,6 +99,7 @@ export function createValidatorForBlockBuilding(
   contractDataSource: ContractDataSource,
   globalVariables: GlobalVariables,
   setupAllowList: AllowedElement[],
+  bindings?: LoggerBindings,
 ): PublicProcessorValidator {
   const nullifierCache = new NullifierCache(db);
   const archiveCache = new ArchiveCache(db);
@@ -100,6 +113,7 @@ export function createValidatorForBlockBuilding(
       contractDataSource,
       globalVariables,
       setupAllowList,
+      bindings,
     ),
     nullifierCache,
   };
@@ -112,22 +126,29 @@ function preprocessValidator(
   contractDataSource: ContractDataSource,
   globalVariables: GlobalVariables,
   setupAllowList: AllowedElement[],
+  bindings?: LoggerBindings,
 ): TxValidator<Tx> {
   // We don't include the TxProofValidator nor the DataTxValidator here because they are already checked by the time we get to block building.
   return new AggregateTxValidator(
-    new MetadataTxValidator({
-      l1ChainId: globalVariables.chainId,
-      rollupVersion: globalVariables.version,
-      protocolContractsHash,
-      vkTreeRoot: getVKTreeRoot(),
-    }),
-    new TimestampTxValidator({
-      timestamp: globalVariables.timestamp,
-      blockNumber: globalVariables.blockNumber,
-    }),
-    new DoubleSpendTxValidator(nullifierCache),
-    new PhasesTxValidator(contractDataSource, setupAllowList, globalVariables.timestamp),
-    new GasTxValidator(publicStateSource, ProtocolContractAddress.FeeJuice, globalVariables.gasFees),
-    new BlockHeaderTxValidator(archiveCache),
+    new MetadataTxValidator(
+      {
+        l1ChainId: globalVariables.chainId,
+        rollupVersion: globalVariables.version,
+        protocolContractsHash,
+        vkTreeRoot: getVKTreeRoot(),
+      },
+      bindings,
+    ),
+    new TimestampTxValidator(
+      {
+        timestamp: globalVariables.timestamp,
+        blockNumber: globalVariables.blockNumber,
+      },
+      bindings,
+    ),
+    new DoubleSpendTxValidator(nullifierCache, bindings),
+    new PhasesTxValidator(contractDataSource, setupAllowList, globalVariables.timestamp, bindings),
+    new GasTxValidator(publicStateSource, ProtocolContractAddress.FeeJuice, globalVariables.gasFees, bindings),
+    new BlockHeaderTxValidator(archiveCache, bindings),
   );
 }

package/src/validator.ts

@@ -1,7 +1,13 @@
 import type { BlobClientInterface } from '@aztec/blob-client/client';
 import { type Blob, getBlobsPerL1Block } from '@aztec/blob-lib';
 import type { EpochCache } from '@aztec/epoch-cache';
-import { BlockNumber, CheckpointNumber, EpochNumber, SlotNumber } from '@aztec/foundation/branded-types';
+import {
+  BlockNumber,
+  CheckpointNumber,
+  EpochNumber,
+  IndexWithinCheckpoint,
+  SlotNumber,
+} from '@aztec/foundation/branded-types';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { TimeoutError } from '@aztec/foundation/error';
 import type { EthAddress } from '@aztec/foundation/eth-address';
@@ -12,18 +18,20 @@ import { RunningPromise } from '@aztec/foundation/running-promise';
 import { sleep } from '@aztec/foundation/sleep';
 import { DateProvider } from '@aztec/foundation/timer';
 import type { KeystoreManager } from '@aztec/node-keystore';
-import type { P2P, PeerId, TxProvider } from '@aztec/p2p';
+import type { P2P, PeerId } from '@aztec/p2p';
 import { AuthRequest, AuthResponse, BlockProposalValidator, ReqRespSubProtocol } from '@aztec/p2p';
 import { OffenseType, WANT_TO_SLASH_EVENT, type Watcher, type WatcherEmitter } from '@aztec/slasher';
 import type { AztecAddress } from '@aztec/stdlib/aztec-address';
-import type { CommitteeAttestationsAndSigners, L2BlockNew, L2BlockSink, L2BlockSource } from '@aztec/stdlib/block';
+import type { CommitteeAttestationsAndSigners, L2Block, L2BlockSink, L2BlockSource } from '@aztec/stdlib/block';
+import { getEpochAtSlot } from '@aztec/stdlib/epoch-helpers';
 import type {
   CreateCheckpointProposalLastBlockData,
+  ITxProvider,
   Validator,
   ValidatorClientFullConfig,
   WorldStateSynchronizer,
 } from '@aztec/stdlib/interfaces/server';
-import type { L1ToL2MessageSource } from '@aztec/stdlib/messaging';
+import { type L1ToL2MessageSource, accumulateCheckpointOutHashes } from '@aztec/stdlib/messaging';
 import type {
   BlockProposal,
   BlockProposalOptions,
@@ -36,6 +44,8 @@ import type { CheckpointHeader } from '@aztec/stdlib/rollup';
 import type { BlockHeader, CheckpointGlobalVariables, Tx } from '@aztec/stdlib/tx';
 import { AttestationTimeoutError } from '@aztec/stdlib/validators';
 import { type TelemetryClient, type Tracer, getTelemetryClient } from '@aztec/telemetry-client';
+import { createHASigner } from '@aztec/validator-ha-signer/factory';
+import { DutyType, type SigningContext } from '@aztec/validator-ha-signer/types';
 
 import { EventEmitter } from 'events';
 import type { TypedDataDefinition } from 'viem';
@@ -43,6 +53,8 @@ import type { TypedDataDefinition } from 'viem';
 import { BlockProposalHandler, type BlockProposalValidationFailureReason } from './block_proposal_handler.js';
 import type { FullNodeCheckpointsBuilder } from './checkpoint_builder.js';
 import { ValidationService } from './duties/validation_service.js';
+import { HAKeyStore } from './key_store/ha_key_store.js';
+import type { ExtendedValidatorKeyStore } from './key_store/interface.js';
 import { NodeKeystoreAdapter } from './key_store/node_keystore_adapter.js';
 import { ValidatorMetrics } from './metrics.js';
 
@@ -76,13 +88,8 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
 
   private proposersOfInvalidBlocks: Set<string> = new Set();
 
-  // TODO(palla/mbps): Remove this once checkpoint validation is stable and we can validate all blocks properly.
-  // Tracks slots for which we have successfully validated a block proposal, so we can attest to checkpoint proposals for those slots.
-  // eslint-disable-next-line aztec-custom/no-non-primitive-in-collections
-  private validatedBlockSlots: Set<SlotNumber> = new Set();
-
   protected constructor(
-    private keyStore: NodeKeystoreAdapter,
+    private keyStore: ExtendedValidatorKeyStore,
     private epochCache: EpochCache,
     private p2pClient: P2P,
     private blockProposalHandler: BlockProposalHandler,
@@ -165,7 +172,7 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
     }
   }
 
-  static new(
+  static async new(
     config: ValidatorClientFullConfig,
     checkpointsBuilder: FullNodeCheckpointsBuilder,
     worldState: WorldStateSynchronizer,
@@ -173,7 +180,7 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
     p2pClient: P2P,
     blockSource: L2BlockSource & L2BlockSink,
     l1ToL2MessageSource: L1ToL2MessageSource,
-    txProvider: TxProvider,
+    txProvider: ITxProvider,
     keyStoreManager: KeystoreManager,
     blobClient: BlobClientInterface,
     dateProvider: DateProvider = new DateProvider(),
@@ -190,14 +197,26 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
       l1ToL2MessageSource,
       txProvider,
       blockProposalValidator,
+      epochCache,
       config,
       metrics,
       dateProvider,
       telemetry,
     );
 
+    let validatorKeyStore: ExtendedValidatorKeyStore = NodeKeystoreAdapter.fromKeyStoreManager(keyStoreManager);
+    if (config.haSigningEnabled) {
+      // If maxStuckDutiesAgeMs is not explicitly set, compute it from Aztec slot duration
+      const haConfig = {
+        ...config,
+        maxStuckDutiesAgeMs: config.maxStuckDutiesAgeMs ?? epochCache.getL1Constants().slotDuration * 2 * 1000,
+      };
+      const { signer } = await createHASigner(haConfig);
+      validatorKeyStore = new HAKeyStore(validatorKeyStore, signer);
+    }
+
     const validator = new ValidatorClient(
-      NodeKeystoreAdapter.fromKeyStoreManager(keyStoreManager),
+      validatorKeyStore,
       epochCache,
       p2pClient,
       blockProposalHandler,
@@ -224,8 +243,8 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
     return this.blockProposalHandler;
   }
 
-  public signWithAddress(addr: EthAddress, msg: TypedDataDefinition) {
-    return this.keyStore.signTypedDataWithAddress(addr, msg);
+  public signWithAddress(addr: EthAddress, msg: TypedDataDefinition, context: SigningContext) {
+    return this.keyStore.signTypedDataWithAddress(addr, msg, context);
   }
 
   public getCoinbaseForAttestor(attestor: EthAddress): EthAddress {
@@ -250,6 +269,8 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
       return;
     }
 
+    await this.keyStore.start();
+
     await this.registerHandlers();
 
     const myAddresses = this.getValidatorAddresses();
@@ -265,6 +286,7 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
 
   public async stop() {
     await this.epochCacheUpdateLoop.stop();
+    await this.keyStore.stop();
   }
 
   /** Register handlers on the p2p client */
@@ -301,6 +323,11 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
    */
   async validateBlockProposal(proposal: BlockProposal, proposalSender: PeerId): Promise<boolean> {
     const slotNumber = proposal.slotNumber;
+
+    // Note: During escape hatch, we still want to "validate" proposals for observability,
+    // but we intentionally reject them and disable slashing invalid block and attestation flow.
+    const escapeHatchOpen = await this.epochCache.isEscapeHatchOpenAtSlot(slotNumber);
+
     const proposer = proposal.getSender();
 
     // Reject proposals with invalid signatures
@@ -334,7 +361,7 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
     const validationResult = await this.blockProposalHandler.handleBlockProposal(
       proposal,
       proposalSender,
-      !!shouldReexecute,
+      !!shouldReexecute && !escapeHatchOpen,
     );
 
     if (!validationResult.isValid) {
@@ -359,6 +386,7 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
 
       // Slash invalid block proposals (can happen even when not in committee)
       if (
+        !escapeHatchOpen &&
         validationResult.reason &&
         SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT.includes(validationResult.reason) &&
         slashBroadcastedInvalidBlockPenalty > 0n
@@ -373,11 +401,13 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
       ...proposalInfo,
       inCommittee: partOfCommittee,
       fishermanMode: this.config.fishermanMode || false,
+      escapeHatchOpen,
     });
 
-    // TODO(palla/mbps): Remove this once checkpoint validation is stable.
-    // Track that we successfully validated a block for this slot, so we can attest to checkpoint proposals for it.
-    this.validatedBlockSlots.add(slotNumber);
+    if (escapeHatchOpen) {
+      this.log.warn(`Escape hatch open for slot ${slotNumber}, rejecting block proposal`, proposalInfo);
+      return false;
+    }
 
     return true;
   }
@@ -395,6 +425,12 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
     const slotNumber = proposal.slotNumber;
     const proposer = proposal.getSender();
 
+    // If escape hatch is open for this slot's epoch, do not attest.
+    if (await this.epochCache.isEscapeHatchOpenAtSlot(slotNumber)) {
+      this.log.warn(`Escape hatch open for slot ${slotNumber}, skipping checkpoint attestation handling`);
+      return undefined;
+    }
+
     // Reject proposals with invalid signatures
     if (!proposer) {
       this.log.warn(`Received checkpoint proposal with invalid signature for slot ${slotNumber}`);
@@ -417,17 +453,9 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
       fishermanMode: this.config.fishermanMode || false,
     });
 
-    // TODO(palla/mbps): Remove this once checkpoint validation is stable.
-    // Check that we have successfully validated a block for this slot before attesting to the checkpoint.
-    if (!this.validatedBlockSlots.has(slotNumber)) {
-      this.log.warn(`No validated block found for slot ${slotNumber}, refusing to attest to checkpoint`, proposalInfo);
-      return undefined;
-    }
-
     // Validate the checkpoint proposal before attesting (unless skipCheckpointProposalValidation is set)
-    // TODO(palla/mbps): Change default to false once checkpoint validation is stable.
-    if (this.config.skipCheckpointProposalValidation !== false) {
-      this.log.verbose(`Skipping checkpoint proposal validation for slot ${slotNumber}`, proposalInfo);
+    if (this.config.skipCheckpointProposalValidation) {
+      this.log.warn(`Skipping checkpoint proposal validation for slot ${slotNumber}`, proposalInfo);
     } else {
       const validationResult = await this.validateCheckpointProposal(proposal, proposalInfo);
       if (!validationResult.isValid) {
@@ -503,7 +531,7 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
     proposalInfo: LogData,
   ): Promise<{ isValid: true } | { isValid: false; reason: string }> {
     const slot = proposal.slotNumber;
-    const timeoutSeconds = 10;
+    const timeoutSeconds = 10; // TODO(palla/mbps): This should map to the timetable settings
 
     // Wait for last block to sync by archive
     let lastBlockHeader: BlockHeader | undefined;
@@ -531,16 +559,8 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
       return { isValid: false, reason: 'last_block_not_found' };
     }
 
-    // Get the last full block to determine checkpoint number
-    const lastBlock = await this.blockSource.getL2BlockNew(lastBlockHeader.getBlockNumber());
-    if (!lastBlock) {
-      this.log.warn(`Last block ${lastBlockHeader.getBlockNumber()} not found`, proposalInfo);
-      return { isValid: false, reason: 'last_block_not_found' };
-    }
-    const checkpointNumber = lastBlock.checkpointNumber;
-
     // Get all full blocks for the slot and checkpoint
-    const blocks = await this.getBlocksForSlot(slot, lastBlockHeader, checkpointNumber);
+    const blocks = await this.blockSource.getBlocksForSlot(slot);
     if (blocks.length === 0) {
       this.log.warn(`No blocks found for slot ${slot}`, proposalInfo);
       return { isValid: false, reason: 'no_blocks_for_slot' };
@@ -554,10 +574,20 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
     // Get checkpoint constants from first block
     const firstBlock = blocks[0];
     const constants = this.extractCheckpointConstants(firstBlock);
+    const checkpointNumber = firstBlock.checkpointNumber;
 
     // Get L1-to-L2 messages for this checkpoint
     const l1ToL2Messages = await this.l1ToL2MessageSource.getL1ToL2Messages(checkpointNumber);
 
+    // Compute the previous checkpoint out hashes for the epoch.
+    // TODO: There can be a more efficient way to get the previous checkpoint out hashes without having to fetch the
+    // actual checkpoints and the blocks/txs in them.
+    const epoch = getEpochAtSlot(slot, this.epochCache.getL1Constants());
+    const previousCheckpoints = (await this.blockSource.getCheckpointsForEpoch(epoch))
+      .filter(b => b.number < checkpointNumber)
+      .sort((a, b) => a.number - b.number);
+    const previousCheckpointOutHashes = previousCheckpoints.map(c => c.getCheckpointOutHash());
+
     // Fork world state at the block before the first block
     const parentBlockNumber = BlockNumber(firstBlock.number - 1);
     const fork = await this.worldState.fork(parentBlockNumber);
@@ -568,8 +598,10 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
         checkpointNumber,
         constants,
         l1ToL2Messages,
+        previousCheckpointOutHashes,
         fork,
         blocks,
+        this.log.getBindings(),
       );
 
       // Complete the checkpoint to get computed values
@@ -595,6 +627,22 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
         return { isValid: false, reason: 'archive_mismatch' };
       }
 
+      // Check that the accumulated epoch out hash matches the value in the proposal.
+      // The epoch out hash is the accumulated hash of all checkpoint out hashes in the epoch.
+      const checkpointOutHash = computedCheckpoint.getCheckpointOutHash();
+      const computedEpochOutHash = accumulateCheckpointOutHashes([...previousCheckpointOutHashes, checkpointOutHash]);
+      const proposalEpochOutHash = proposal.checkpointHeader.epochOutHash;
+      if (!computedEpochOutHash.equals(proposalEpochOutHash)) {
+        this.log.warn(`Epoch out hash mismatch`, {
+          proposalEpochOutHash: proposalEpochOutHash.toString(),
+          computedEpochOutHash: computedEpochOutHash.toString(),
+          checkpointOutHash: checkpointOutHash.toString(),
+          previousCheckpointOutHashes: previousCheckpointOutHashes.map(h => h.toString()),
+          ...proposalInfo,
+        });
+        return { isValid: false, reason: 'out_hash_mismatch' };
+      }
+
       this.log.verbose(`Checkpoint proposal validation successful for slot ${slot}`, proposalInfo);
       return { isValid: true };
     } finally {
@@ -602,50 +650,10 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
     }
   }
 
-  /**
-   * Get all full blocks for a given slot and checkpoint by walking backwards from the last block.
-   * Returns blocks in ascending order (earliest to latest).
-   * TODO(palla/mbps): Add getL2BlocksForSlot() to L2BlockSource interface for efficiency.
-   */
-  private async getBlocksForSlot(
-    slot: SlotNumber,
-    lastBlockHeader: BlockHeader,
-    checkpointNumber: CheckpointNumber,
-  ): Promise<L2BlockNew[]> {
-    const blocks: L2BlockNew[] = [];
-    let currentHeader = lastBlockHeader;
-    const { genesisArchiveRoot } = await this.blockSource.getGenesisValues();
-
-    while (currentHeader.getSlot() === slot) {
-      const block = await this.blockSource.getL2BlockNew(currentHeader.getBlockNumber());
-      if (!block) {
-        this.log.warn(`Block ${currentHeader.getBlockNumber()} not found while getting blocks for slot ${slot}`);
-        break;
-      }
-      if (block.checkpointNumber !== checkpointNumber) {
-        break;
-      }
-      blocks.unshift(block);
-
-      const prevArchive = currentHeader.lastArchive.root;
-      if (prevArchive.equals(genesisArchiveRoot)) {
-        break;
-      }
-
-      const prevHeader = await this.blockSource.getBlockHeaderByArchive(prevArchive);
-      if (!prevHeader || prevHeader.getSlot() !== slot) {
-        break;
-      }
-      currentHeader = prevHeader;
-    }
-
-    return blocks;
-  }
-
   /**
    * Extract checkpoint global variables from a block.
    */
-  private extractCheckpointConstants(block: L2BlockNew): CheckpointGlobalVariables {
+  private extractCheckpointConstants(block: L2Block): CheckpointGlobalVariables {
     const gv = block.header.globalVariables;
     return {
       chainId: gv.chainId,
@@ -668,14 +676,7 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
         return;
       }
 
-      // Get the last full block to determine checkpoint number
-      const lastBlock = await this.blockSource.getL2BlockNew(lastBlockHeader.getBlockNumber());
-      if (!lastBlock) {
-        this.log.warn(`Failed to get last block for blob upload`, proposalInfo);
-        return;
-      }
-
-      const blocks = await this.getBlocksForSlot(proposal.slotNumber, lastBlockHeader, lastBlock.checkpointNumber);
+      const blocks = await this.blockSource.getBlocksForSlot(proposal.slotNumber);
       if (blocks.length === 0) {
         this.log.warn(`No blocks found for blob upload`, proposalInfo);
         return;
@@ -722,12 +723,12 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
 
   async createBlockProposal(
     blockHeader: BlockHeader,
-    indexWithinCheckpoint: number,
+    indexWithinCheckpoint: IndexWithinCheckpoint,
     inHash: Fr,
     archive: Fr,
     txs: Tx[],
     proposerAddress: EthAddress | undefined,
-    options: BlockProposalOptions,
+    options: BlockProposalOptions = {},
   ): Promise<BlockProposal> {
     // TODO(palla/mbps): Prevent double proposals properly
     // if (this.previousProposal?.slotNumber === blockHeader.globalVariables.slotNumber) {
@@ -759,7 +760,7 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
     archive: Fr,
     lastBlockInfo: CreateCheckpointProposalLastBlockData | undefined,
     proposerAddress: EthAddress | undefined,
-    options: CheckpointProposalOptions,
+    options: CheckpointProposalOptions = {},
   ): Promise<CheckpointProposal> {
     this.log.info(`Assembling checkpoint proposal for slot ${checkpointHeader.slotNumber}`);
     return await this.validationService.createCheckpointProposal(
@@ -778,8 +779,10 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
   async signAttestationsAndSigners(
     attestationsAndSigners: CommitteeAttestationsAndSigners,
     proposer: EthAddress,
+    slot: SlotNumber,
+    blockNumber: BlockNumber | CheckpointNumber,
   ): Promise<Signature> {
-    return await this.validationService.signAttestationsAndSigners(attestationsAndSigners, proposer);
+    return await this.validationService.signAttestationsAndSigners(attestationsAndSigners, proposer, slot, blockNumber);
   }
 
   async collectOwnAttestations(proposal: CheckpointProposal): Promise<CheckpointAttestation[]> {
@@ -886,7 +889,9 @@ export class ValidatorClient extends (EventEmitter as new () => WatcherEmitter)
     }
 
     const payloadToSign = authRequest.getPayloadToSign();
-    const signature = await this.keyStore.signMessageWithAddress(addressToUse, payloadToSign);
+    // AUTH_REQUEST doesn't require HA protection - multiple signatures are safe
+    const context: SigningContext = { dutyType: DutyType.AUTH_REQUEST };
+    const signature = await this.keyStore.signMessageWithAddress(addressToUse, payloadToSign, context);
     const authResponse = new AuthResponse(statusMessage, signature);
     return authResponse.toBuffer();
   }