@aztec/validator-client 0.0.1-commit.993d52e → 0.0.1-commit.9a89641

package/src/duties/validation_service.ts

@@ -1,17 +1,9 @@
-import {
-  BlockNumber,
-  type CheckpointNumber,
-  IndexWithinCheckpoint,
-  type SlotNumber,
-} from '@aztec/foundation/branded-types';
-import { Buffer32 } from '@aztec/foundation/buffer';
-import { keccak256 } from '@aztec/foundation/crypto/keccak';
+import { type CheckpointNumber, IndexWithinCheckpoint, type SlotNumber } from '@aztec/foundation/branded-types';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 import type { Signature } from '@aztec/foundation/eth-signature';
 import { createLogger } from '@aztec/foundation/log';
-import type { CommitteeAttestationsAndSigners } from '@aztec/stdlib/block';
-import type { CreateCheckpointProposalLastBlockData } from '@aztec/stdlib/interfaces/server';
+import { CommitteeAttestationsAndSigners } from '@aztec/stdlib/block';
 import {
   BlockProposal,
   type BlockProposalOptions,
@@ -20,9 +12,10 @@ import {
   type CheckpointProposalCore,
   type CheckpointProposalOptions,
   ConsensusPayload,
-  SignatureDomainSeparator,
+  type CoordinationSignatureContext,
+  getCoordinationSignatureTypedData,
 } from '@aztec/stdlib/p2p';
-import type { CheckpointHeader } from '@aztec/stdlib/rollup';
+import { CheckpointHeader } from '@aztec/stdlib/rollup';
 import type { BlockHeader, Tx } from '@aztec/stdlib/tx';
 import { DutyAlreadySignedError, SlashingProtectionError } from '@aztec/validator-ha-signer/errors';
 import { DutyType, type SigningContext } from '@aztec/validator-ha-signer/types';
@@ -32,6 +25,7 @@ import type { ValidatorKeyStore } from '../key_store/interface.js';
 export class ValidationService {
   constructor(
     private keyStore: ValidatorKeyStore,
+    private signatureContext: CoordinationSignatureContext,
     private log = createLogger('validator:validation-service'),
   ) {}
 
@@ -52,6 +46,7 @@ export class ValidationService {
    */
   public createBlockProposal(
     blockHeader: BlockHeader,
+    checkpointNumber: CheckpointNumber,
     blockIndexWithinCheckpoint: IndexWithinCheckpoint,
     inHash: Fr,
     archive: Fr,
@@ -67,17 +62,26 @@ export class ValidationService {
 
     // Create a signer that uses the appropriate address
     const address = proposerAttesterAddress ?? this.keyStore.getAddress(0);
-    const payloadSigner = (payload: Buffer32, context: SigningContext) =>
-      this.keyStore.signMessageWithAddress(address, payload, context);
+    const payloadSigner = (
+      typedData: Parameters<ValidatorKeyStore['signTypedDataWithAddress']>[1],
+      context: SigningContext,
+    ) => this.keyStore.signTypedDataWithAddress(address, typedData, context);
+    const txsSigner = (
+      typedData: Parameters<ValidatorKeyStore['signTypedDataWithAddress']>[1],
+      context: SigningContext,
+    ) => this.keyStore.signTypedDataWithAddress(address, typedData, context);
 
     return BlockProposal.createProposalFromSigner(
       blockHeader,
+      checkpointNumber,
       blockIndexWithinCheckpoint,
       inHash,
       archive,
       txs.map(tx => tx.getTxHash()),
       options.publishFullTxs ? txs : undefined,
+      this.signatureContext,
       payloadSigner,
+      txsSigner,
     );
   }
 
@@ -86,7 +90,7 @@ export class ValidationService {
    *
    * @param checkpointHeader - The checkpoint header containing aggregated data
    * @param archive - The archive of the checkpoint
-   * @param lastBlockInfo - Info about the last block (header, index, txs) or undefined
+   * @param lastBlockProposal - Signed block proposal for the last block in the checkpoint, or undefined
    * @param proposerAttesterAddress - The address of the proposer
    * @param options - Checkpoint proposal options
    *
@@ -95,36 +99,41 @@ export class ValidationService {
   public createCheckpointProposal(
     checkpointHeader: CheckpointHeader,
     archive: Fr,
+    checkpointNumber: CheckpointNumber,
     feeAssetPriceModifier: bigint,
-    lastBlockInfo: CreateCheckpointProposalLastBlockData | undefined,
+    lastBlockProposal: BlockProposal | undefined,
     proposerAttesterAddress: EthAddress | undefined,
     options: CheckpointProposalOptions,
   ): Promise<CheckpointProposal> {
-    // For testing: change the archive to trigger state_mismatch validation failure
+    // For testing: corrupt the checkpoint so observers' checkpoint validation fails.
+    //
+    // Keep `archive` aligned with `lastBlockProposal.archiveRoot` so the archive-based lookup
+    // in `validateCheckpointProposal` (`getBlockData({ archive })`) still succeeds
     if (options.broadcastInvalidCheckpointProposal) {
-      archive = Fr.random();
+      archive = lastBlockProposal?.archiveRoot ?? Fr.random();
+      checkpointHeader = CheckpointHeader.from({
+        ...checkpointHeader,
+        epochOutHash: Fr.random(),
+      });
       this.log.warn(`Creating INVALID checkpoint proposal for slot ${checkpointHeader.slotNumber}`);
     }
 
     // Create a signer that takes payload and context, and uses the appropriate address
-    const payloadSigner = (payload: Buffer32, context: SigningContext) => {
+    const payloadSigner = (
+      typedData: Parameters<ValidatorKeyStore['signTypedDataWithAddress']>[1],
+      context: SigningContext,
+    ) => {
       const address = proposerAttesterAddress ?? this.keyStore.getAddress(0);
-      return this.keyStore.signMessageWithAddress(address, payload, context);
-    };
-
-    // Last block to include in the proposal
-    const lastBlock = lastBlockInfo && {
-      blockHeader: lastBlockInfo.blockHeader,
-      indexWithinCheckpoint: lastBlockInfo.indexWithinCheckpoint,
-      txHashes: lastBlockInfo.txs.map(tx => tx.getTxHash()),
-      txs: options.publishFullTxs ? lastBlockInfo.txs : undefined,
+      return this.keyStore.signTypedDataWithAddress(address, typedData, context);
     };
 
     return CheckpointProposal.createProposalFromSigner(
       checkpointHeader,
       archive,
+      checkpointNumber,
       feeAssetPriceModifier,
-      lastBlock,
+      lastBlockProposal,
+      this.signatureContext,
       payloadSigner,
     );
   }
@@ -142,35 +151,27 @@ export class ValidationService {
   async attestToCheckpointProposal(
     proposal: CheckpointProposalCore,
     attestors: EthAddress[],
+    checkpointNumber: CheckpointNumber,
   ): Promise<CheckpointAttestation[]> {
     // Create the attestation payload from the checkpoint proposal
-    const payload = new ConsensusPayload(proposal.checkpointHeader, proposal.archive, proposal.feeAssetPriceModifier);
-    const buf = Buffer32.fromBuffer(
-      keccak256(payload.getPayloadToSign(SignatureDomainSeparator.checkpointAttestation)),
+    const payload = new ConsensusPayload(
+      proposal.checkpointHeader,
+      proposal.archive,
+      proposal.feeAssetPriceModifier,
+      this.signatureContext,
     );
+    const typedData = getCoordinationSignatureTypedData(payload);
 
-    // TODO(spy/ha): Use checkpointNumber instead of blockNumber once CheckpointHeader includes it.
-    // Currently using lastBlock.blockNumber as a proxy for checkpoint identification in HA signing.
-    // blockNumber is NOT used for the primary key so it's safe to use here.
-    // See CheckpointHeader TODO and SigningContext types documentation.
-    let blockNumber: BlockNumber;
-    try {
-      blockNumber = proposal.blockNumber;
-    } catch {
-      // Checkpoint proposal may not have lastBlock, use 0 as fallback
-      blockNumber = BlockNumber(0);
-    }
     const context: SigningContext = {
       slot: proposal.slotNumber,
-      blockNumber,
+      checkpointNumber,
       dutyType: DutyType.ATTESTATION,
     };
 
     // Sign each attestor in parallel, catching HA errors per-attestor
     const results = await Promise.allSettled(
       attestors.map(async attestor => {
-        const sig = await this.keyStore.signMessageWithAddress(attestor, buf, context);
-        // return new BlockAttestation(proposal.payload, sig, proposal.signature);
+        const sig = await this.keyStore.signTypedDataWithAddress(attestor, typedData, context);
         return new CheckpointAttestation(payload, sig, proposal.signature);
       }),
     );
@@ -183,7 +184,7 @@ export class ValidationService {
       } else {
         const error = result.reason;
         if (error instanceof DutyAlreadySignedError || error instanceof SlashingProtectionError) {
-          this.log.info(
+          this.log.verbose(
             `Attestation for slot ${proposal.slotNumber} by ${attestors[i]} already signed by another High-Availability node`,
           );
           // Continue with remaining attestors
@@ -201,7 +202,6 @@ export class ValidationService {
    * @param attestationsAndSigners - The attestations and signers to sign
    * @param proposer - The proposer address to sign with
    * @param slot - The slot number for HA signing context
-   * @param blockNumber - The block or checkpoint number for HA signing context
    * @returns signature
    * @throws DutyAlreadySignedError if already signed by another HA node
    * @throws SlashingProtectionError if attempting to sign different data for same slot
@@ -210,17 +210,15 @@ export class ValidationService {
     attestationsAndSigners: CommitteeAttestationsAndSigners,
     proposer: EthAddress,
     slot: SlotNumber,
-    blockNumber: BlockNumber | CheckpointNumber,
+    checkpointNumber: CheckpointNumber,
   ): Promise<Signature> {
     const context: SigningContext = {
       slot,
-      blockNumber,
+      checkpointNumber,
       dutyType: DutyType.ATTESTATIONS_AND_SIGNERS,
     };
 
-    const buf = Buffer32.fromBuffer(
-      keccak256(attestationsAndSigners.getPayloadToSign(SignatureDomainSeparator.attestationsAndSigners)),
-    );
-    return this.keyStore.signMessageWithAddress(proposer, buf, context);
+    const typedData = getCoordinationSignatureTypedData(attestationsAndSigners);
+    return this.keyStore.signTypedDataWithAddress(proposer, typedData, context);
   }
 }

package/src/factory.ts

@@ -4,16 +4,20 @@ import type { DateProvider } from '@aztec/foundation/timer';
 import type { KeystoreManager } from '@aztec/node-keystore';
 import { BlockProposalValidator, type P2PClient } from '@aztec/p2p';
 import type { L2BlockSink, L2BlockSource } from '@aztec/stdlib/block';
+import type { CheckpointReexecutionTracker } from '@aztec/stdlib/checkpoint';
 import type { ValidatorClientFullConfig, WorldStateSynchronizer } from '@aztec/stdlib/interfaces/server';
 import type { L1ToL2MessageSource } from '@aztec/stdlib/messaging';
+import { ConsensusTimetable } from '@aztec/stdlib/timetable';
 import type { TelemetryClient } from '@aztec/telemetry-client';
+import type { SlashingProtectionDatabase } from '@aztec/validator-ha-signer/types';
 
-import { BlockProposalHandler } from './block_proposal_handler.js';
 import type { FullNodeCheckpointsBuilder } from './checkpoint_builder.js';
+import { DEFAULT_MAX_GOSSIP_CLOCK_DISPARITY_MS } from './config.js';
 import { ValidatorMetrics } from './metrics.js';
+import { ProposalHandler } from './proposal_handler.js';
 import { ValidatorClient } from './validator.js';
 
-export function createBlockProposalHandler(
+export function createProposalHandler(
   config: ValidatorClientFullConfig,
   deps: {
     checkpointsBuilder: FullNodeCheckpointsBuilder;
@@ -22,16 +26,28 @@ export function createBlockProposalHandler(
     l1ToL2MessageSource: L1ToL2MessageSource;
     p2pClient: P2PClient;
     epochCache: EpochCache;
+    blobClient: BlobClientInterface;
     dateProvider: DateProvider;
     telemetry: TelemetryClient;
+    reexecutionTracker: CheckpointReexecutionTracker;
   },
 ) {
   const metrics = new ValidatorMetrics(deps.telemetry);
-  const blockProposalValidator = new BlockProposalValidator(deps.epochCache, {
+  const consensusTimetable = new ConsensusTimetable({
+    l1Constants: deps.epochCache.getL1Constants(),
+    blockDuration: config.blockDurationMs / 1000,
+  });
+  const blockProposalValidator = new BlockProposalValidator(deps.epochCache, consensusTimetable, {
     txsPermitted: !config.disableTransactions,
-    maxTxsPerBlock: config.maxTxsPerBlock,
+    maxTxsPerBlock: config.validateMaxTxsPerBlock ?? config.validateMaxTxsPerCheckpoint,
+    maxBlocksPerCheckpoint: config.maxBlocksPerCheckpoint,
+    signatureContext: {
+      chainId: config.l1ChainId,
+      rollupAddress: config.rollupAddress,
+    },
+    clockDisparityMs: config.maxGossipClockDisparityMs ?? DEFAULT_MAX_GOSSIP_CLOCK_DISPARITY_MS,
   });
-  return new BlockProposalHandler(
+  return new ProposalHandler(
     deps.checkpointsBuilder,
     deps.worldState,
     deps.blockSource,
@@ -39,10 +55,14 @@ export function createBlockProposalHandler(
     deps.p2pClient.getTxProvider(),
     blockProposalValidator,
     deps.epochCache,
+    consensusTimetable,
     config,
+    deps.blobClient,
+    deps.reexecutionTracker,
     metrics,
     deps.dateProvider,
     deps.telemetry,
+    undefined,
   );
 }
 
@@ -59,6 +79,8 @@ export function createValidatorClient(
     epochCache: EpochCache;
     keyStoreManager: KeystoreManager | undefined;
     blobClient: BlobClientInterface;
+    reexecutionTracker: CheckpointReexecutionTracker;
+    slashingProtectionDb?: SlashingProtectionDatabase;
   },
 ) {
   if (config.disableValidator || !deps.keyStoreManager) {
@@ -77,7 +99,9 @@ export function createValidatorClient(
     txProvider,
     deps.keyStoreManager,
     deps.blobClient,
+    deps.reexecutionTracker,
     deps.dateProvider,
     deps.telemetry,
+    deps.slashingProtectionDb,
   );
 }

package/src/index.ts

@@ -1,4 +1,4 @@
-export * from './block_proposal_handler.js';
+export * from './proposal_handler.js';
 export * from './checkpoint_builder.js';
 export * from './config.js';
 export * from './factory.js';

package/src/key_store/ha_key_store.ts

@@ -240,7 +240,7 @@ export class HAKeyStore implements ExtendedValidatorKeyStore {
     }
 
     if (error instanceof SlashingProtectionError) {
-      this.log.warn(`Duty already signed by another node with different payload`, {
+      this.log.info(`Duty already signed by another node with different payload`, {
         dutyType: context.dutyType,
         slot: context.slot,
         existingMessageHash: error.existingMessageHash,

package/src/key_store/web3signer_key_store.ts

@@ -8,6 +8,9 @@ import type { TypedDataDefinition } from 'viem';
 
 import type { ValidatorKeyStore } from './interface.js';
 
+/** Default hard timeout (ms) applied to each Web3Signer HTTP request. */
+const DEFAULT_WEB3SIGNER_REQUEST_TIMEOUT_MS = 30_000;
+
 /**
  * Web3Signer Key Store
  *
@@ -15,10 +18,15 @@ import type { ValidatorKeyStore } from './interface.js';
  * This implementation uses the Web3Signer JSON-RPC API for secp256k1 signatures.
  */
 export class Web3SignerKeyStore implements ValidatorKeyStore {
+  private readonly requestTimeoutMs: number;
+
   constructor(
     private addresses: EthAddress[],
     private baseUrl: string,
-  ) {}
+    requestTimeoutMs: number = DEFAULT_WEB3SIGNER_REQUEST_TIMEOUT_MS,
+  ) {
+    this.requestTimeoutMs = requestTimeoutMs;
+  }
 
   /**
    * Get the address of a signer by index
@@ -108,75 +116,50 @@ export class Web3SignerKeyStore implements ValidatorKeyStore {
    * @param data - The data to sign
    * @returns The signature
    */
-  private async makeJsonRpcSignRequest(address: EthAddress, data: Buffer32): Promise<Signature> {
-    const url = this.baseUrl;
-
-    // Use JSON-RPC eth_sign method which automatically applies Ethereum message prefixing
-    const body = {
+  private makeJsonRpcSignRequest(address: EthAddress, data: Buffer32): Promise<Signature> {
+    // eth_sign automatically applies Ethereum message prefixing to the raw data.
+    return this.sendSignRequest({
       jsonrpc: '2.0',
       method: 'eth_sign',
-      params: [
-        address.toString(), // Ethereum address as identifier
-        data.toString(), // Raw data to sign (eth_sign will apply Ethereum message prefix)
-      ],
+      params: [address.toString(), data.toString()],
       id: 1,
-    };
-
-    const response = await fetch(url, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify(body),
     });
-
-    if (!response.ok) {
-      const errorText = await response.text();
-      throw new Error(`Web3Signer request failed: ${response.status} ${response.statusText} - ${errorText}`);
-    }
-
-    const result = await response.json();
-
-    // Handle JSON-RPC response format
-    if (result.error) {
-      throw new Error(`Web3Signer JSON-RPC error: ${result.error.code} - ${result.error.message}`);
-    }
-
-    if (!result.result) {
-      throw new Error('Invalid response from Web3Signer: no result found');
-    }
-
-    let signatureHex = result.result;
-
-    // Ensure the signature has the 0x prefix
-    if (!signatureHex.startsWith('0x')) {
-      signatureHex = '0x' + signatureHex;
-    }
-
-    // Parse the signature from the hex string
-    return normalizeSignature(Signature.fromString(signatureHex as `0x${string}`));
   }
 
-  private async makeJsonRpcSignTypedDataRequest(
-    address: EthAddress,
-    typedData: TypedDataDefinition,
-  ): Promise<Signature> {
-    const url = this.baseUrl;
-
-    const body = {
+  private makeJsonRpcSignTypedDataRequest(address: EthAddress, typedData: TypedDataDefinition): Promise<Signature> {
+    return this.sendSignRequest({
       jsonrpc: '2.0',
       method: 'eth_signTypedData',
       params: [address.toString(), JSON.stringify(typedData)],
       id: 1,
-    };
-
-    const response = await fetch(url, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify(body),
     });
+  }
+
+  /**
+   * Send a JSON-RPC request to Web3Signer under a hard request timeout and parse the signature.
+   * A timed-out or aborted request is surfaced as a clear timeout error rather than hanging, so a
+   * slow or unreachable signer cannot stall an HA signing operation past its own timeout budget.
+   */
+  private async sendSignRequest(body: object): Promise<Signature> {
+    let response: Response;
+    try {
+      response = await fetch(this.baseUrl, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(this.requestTimeoutMs),
+      });
+    } catch (err) {
+      if (
+        (err instanceof Error || err instanceof DOMException) &&
+        (err.name === 'TimeoutError' || err.name === 'AbortError')
+      ) {
+        throw new Error(`Web3Signer request timed out after ${this.requestTimeoutMs}ms`);
+      }
+      throw err;
+    }
 
     if (!response.ok) {
       const errorText = await response.text();
@@ -185,6 +168,7 @@ export class Web3SignerKeyStore implements ValidatorKeyStore {
 
     const result = await response.json();
 
+    // Handle JSON-RPC response format
     if (result.error) {
       throw new Error(`Web3Signer JSON-RPC error: ${result.error.code} - ${result.error.message}`);
     }

package/src/metrics.ts

@@ -11,7 +11,7 @@ import {
   createUpDownCounterWithDefault,
 } from '@aztec/telemetry-client';
 
-import type { BlockProposalValidationFailureReason } from './block_proposal_handler.js';
+import type { BlockProposalValidationFailureReason } from './proposal_handler.js';
 
 export class ValidatorMetrics {
   private failedReexecutionCounter: UpDownCounter;
@@ -24,6 +24,8 @@ export class ValidatorMetrics {
   private reexMana: Histogram;
   private reexTx: Histogram;
   private reexDuration: Gauge;
+  private checkpointProposalToPipelinedStateDuration: Histogram;
+  private checkpointProposalReceiveOffsetFromNextSlotBoundary: Histogram;
 
   constructor(telemetryClient: TelemetryClient) {
     const meter = telemetryClient.getMeter('Validator');
@@ -47,6 +49,8 @@ export class ValidatorMetrics {
           'failed_txs',
           'in_hash_mismatch',
           'parent_block_wrong_slot',
+          'duplicate_txs',
+          'invalid_embedded_txs',
         ],
         [Attributes.IS_COMMITTEE_MEMBER]: [true, false],
       },
@@ -77,6 +81,12 @@ export class ValidatorMetrics {
     this.reexTx = meter.createHistogram(Metrics.VALIDATOR_RE_EXECUTION_TX_COUNT);
 
     this.reexDuration = meter.createGauge(Metrics.VALIDATOR_RE_EXECUTION_TIME);
+    this.checkpointProposalToPipelinedStateDuration = meter.createHistogram(
+      Metrics.VALIDATOR_CHECKPOINT_PROPOSAL_TO_PIPELINED_STATE_DURATION,
+    );
+    this.checkpointProposalReceiveOffsetFromNextSlotBoundary = meter.createHistogram(
+      Metrics.VALIDATOR_CHECKPOINT_PROPOSAL_RECEIVE_OFFSET_FROM_NEXT_SLOT_BOUNDARY,
+    );
   }
 
   public recordReex(time: number, txs: number, mManaTotal: number) {
@@ -85,6 +95,16 @@ export class ValidatorMetrics {
     this.reexMana.record(mManaTotal);
   }
 
+  public recordCheckpointProposalToPipelinedStateDuration(durationMs: number) {
+    this.checkpointProposalToPipelinedStateDuration.record(Math.ceil(durationMs));
+  }
+
+  public recordCheckpointProposalReceiveOffsetFromNextSlotBoundary(offsetMs: number) {
+    this.checkpointProposalReceiveOffsetFromNextSlotBoundary.record(Math.ceil(Math.abs(offsetMs)), {
+      [Attributes.SLOT_BOUNDARY_SIDE]: offsetMs < 0 ? 'before' : 'after',
+    });
+  }
+
   public recordFailedReexecution(proposal: BlockProposal) {
     const proposer = proposal.getSender();
     this.failedReexecutionCounter.add(1, {