@aztec/validator-client 5.0.0-rc.1 → 5.0.0

package/dest/validator.js

@@ -19,40 +19,12 @@ import { ValidationService } from './duties/validation_service.js';
 import { HAKeyStore } from './key_store/ha_key_store.js';
 import { NodeKeystoreAdapter } from './key_store/node_keystore_adapter.js';
 import { ValidatorMetrics } from './metrics.js';
-import { ProposalHandler } from './proposal_handler.js';
+import { ProposalHandler, SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT, SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT } from './proposal_handler.js';
 // We maintain a set of proposers who have proposed invalid blocks.
 // Just cap the set to avoid unbounded growth.
 const MAX_PROPOSERS_OF_INVALID_BLOCKS = 1000;
-const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
 const MAX_TRACKED_INVALID_CHECKPOINT_PROPOSALS = 1000;
 const MAX_TRACKED_BAD_ATTESTATIONS = 10_000;
-// What errors from the block proposal handler result in slashing
-const SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT = [
-    'state_mismatch',
-    'failed_txs',
-    'global_variables_mismatch',
-    'invalid_proposal',
-    'parent_block_wrong_slot',
-    'in_hash_mismatch'
-];
-const SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT = {
-    // enabled
-    ['invalid_fee_asset_price_modifier']: true,
-    ['checkpoint_header_mismatch']: true,
-    // These late mismatches should normally be caught by earlier checks, but if reached after validating the local
-    // checkpoint inputs, the proposer-signed payload disagrees with deterministic recomputation.
-    ['archive_mismatch']: true,
-    ['out_hash_mismatch']: true,
-    ['no_blocks_for_slot']: true,
-    ['too_many_blocks_in_checkpoint']: true,
-    ['checkpoint_validation_failed']: true,
-    ['last_block_archive_mismatch']: true,
-    // disabled
-    ['invalid_signature']: false,
-    ['last_block_not_found']: false,
-    ['block_fetch_error']: false,
-    ['checkpoint_already_published']: false
-};
 /**
  * Validator Client
  */ export class ValidatorClient extends EventEmitter {
@@ -80,13 +52,12 @@ const SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT = {
     epochCacheUpdateLoop;
     /** Tracks the last epoch in which each attester successfully submitted at least one attestation. */ lastAttestedEpochByAttester;
     proposersOfInvalidBlocks;
-    slotsWithInvalidProposals;
     invalidCheckpointProposalOffenseKeys;
+    oversizedProposalOffenseKeys;
     badAttestationOffenseKeys;
-    slotsWithProposalEquivocation;
     /** Tracks the last checkpoint proposal we attested to, to prevent equivocation. */ lastAttestedProposal;
     constructor(keyStore, epochCache, p2pClient, proposalHandler, blockSource, checkpointsBuilder, worldState, l1ToL2MessageSource, config, blobClient, slashingProtectionSigner, dateProvider = new DateProvider(), telemetry = getTelemetryClient(), log = createLogger('validator')){
-        super(), this.keyStore = keyStore, this.epochCache = epochCache, this.p2pClient = p2pClient, this.proposalHandler = proposalHandler, this.blockSource = blockSource, this.checkpointsBuilder = checkpointsBuilder, this.worldState = worldState, this.l1ToL2MessageSource = l1ToL2MessageSource, this.config = config, this.blobClient = blobClient, this.slashingProtectionSigner = slashingProtectionSigner, this.dateProvider = dateProvider, this.hasRegisteredHandlers = false, this.lastAttestedEpochByAttester = new Map(), this.proposersOfInvalidBlocks = FifoSet.withLimit(MAX_PROPOSERS_OF_INVALID_BLOCKS), this.slotsWithInvalidProposals = FifoSet.withLimit(MAX_TRACKED_INVALID_PROPOSAL_SLOTS), this.invalidCheckpointProposalOffenseKeys = FifoSet.withLimit(MAX_TRACKED_INVALID_CHECKPOINT_PROPOSALS), this.badAttestationOffenseKeys = FifoSet.withLimit(MAX_TRACKED_BAD_ATTESTATIONS), this.slotsWithProposalEquivocation = FifoSet.withLimit(MAX_TRACKED_INVALID_PROPOSAL_SLOTS);
+        super(), this.keyStore = keyStore, this.epochCache = epochCache, this.p2pClient = p2pClient, this.proposalHandler = proposalHandler, this.blockSource = blockSource, this.checkpointsBuilder = checkpointsBuilder, this.worldState = worldState, this.l1ToL2MessageSource = l1ToL2MessageSource, this.config = config, this.blobClient = blobClient, this.slashingProtectionSigner = slashingProtectionSigner, this.dateProvider = dateProvider, this.hasRegisteredHandlers = false, this.lastAttestedEpochByAttester = new Map(), this.proposersOfInvalidBlocks = FifoSet.withLimit(MAX_PROPOSERS_OF_INVALID_BLOCKS), this.invalidCheckpointProposalOffenseKeys = FifoSet.withLimit(MAX_TRACKED_INVALID_CHECKPOINT_PROPOSALS), this.oversizedProposalOffenseKeys = FifoSet.withLimit(MAX_TRACKED_INVALID_CHECKPOINT_PROPOSALS), this.badAttestationOffenseKeys = FifoSet.withLimit(MAX_TRACKED_BAD_ATTESTATIONS);
         // Create child logger with fisherman prefix if in fisherman mode
         this.log = config.fishermanMode ? log.createChild('[FISHERMAN]') : log;
         this.tracer = telemetry.getTracer('Validator');
@@ -216,10 +187,10 @@ const SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT = {
         return this.config;
     }
     hasProposalEquivocation(slotNumber) {
-        return this.slotsWithProposalEquivocation.has(slotNumber);
+        return this.proposalHandler.hasProposalEquivocation(slotNumber);
     }
     hasInvalidProposals(slotNumber) {
-        return this.slotsWithInvalidProposals.has(slotNumber);
+        return this.proposalHandler.hasInvalidProposals(slotNumber);
     }
     updateConfig(config) {
         this.config = {
@@ -269,6 +240,10 @@ const SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT = {
             this.p2pClient.registerDuplicateProposalCallback((info)=>{
                 this.handleDuplicateProposal(info);
             });
+            // Oversized proposal handler - triggers slashing for proposals beyond the per-checkpoint block limit
+            this.p2pClient.registerOversizedProposalCallback((info)=>{
+                this.handleOversizedProposal(info);
+            });
             // Duplicate attestation handler - triggers slashing for attestation equivocation
             this.p2pClient.registerDuplicateAttestationCallback((info)=>{
                 this.handleDuplicateAttestation(info);
@@ -529,7 +504,8 @@ const SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT = {
         if (!SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT[result.reason]) {
             return;
         }
-        this.markInvalidProposalSlot(proposal.slotNumber);
+        // The slot is already marked invalid by the all-nodes checkpoint handler that invokes this callback,
+        // so we only emit the proposer slash event here.
         if (this.slashInvalidCheckpointProposal(proposal)) {
             this.log.info(`Detected invalid checkpoint proposal offense`, {
                 ...proposalInfo,
@@ -564,11 +540,11 @@ const SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT = {
         return true;
     }
     markInvalidProposalSlot(slotNumber) {
-        this.slotsWithInvalidProposals.add(slotNumber);
+        this.proposalHandler.markInvalidProposalSlot(slotNumber);
     }
     handleCheckpointAttestation(attestation) {
         const slotNumber = attestation.slotNumber;
-        if (!this.slotsWithInvalidProposals.has(slotNumber) || this.slotsWithProposalEquivocation.has(slotNumber)) {
+        if (!this.proposalHandler.hasInvalidProposals(slotNumber) || this.proposalHandler.hasProposalEquivocation(slotNumber)) {
             return;
         }
         const attester = attestation.getSender();
@@ -602,11 +578,37 @@ const SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT = {
         ]);
     }
     /**
+   * Handle detection of an oversized block proposal: one whose index within its checkpoint lands at or
+   * beyond the consensus per-checkpoint block limit. A single signed proposal at an illegal index is
+   * self-contained evidence, so emit an invalid-block-proposal slash event for the proposer, deduped per
+   * (proposer, slot) since the p2p layer reports every oversized proposal it stores.
+   */ handleOversizedProposal(info) {
+        const { slot, proposer } = info;
+        const offenseType = OffenseType.BROADCASTED_INVALID_BLOCK_PROPOSAL;
+        if (!this.oversizedProposalOffenseKeys.addIfAbsent(`${proposer.toString()}:${offenseType}:${slot}`)) {
+            return;
+        }
+        this.log.info(`Detected oversized block proposal offense from ${proposer.toString()} at slot ${slot}`, {
+            proposer: proposer.toString(),
+            slot,
+            amount: this.config.slashBroadcastedInvalidBlockPenalty,
+            offenseType: getOffenseTypeName(offenseType)
+        });
+        this.emit(WANT_TO_SLASH_EVENT, [
+            {
+                validator: proposer,
+                amount: this.config.slashBroadcastedInvalidBlockPenalty,
+                offenseType,
+                epochOrSlot: BigInt(slot)
+            }
+        ]);
+    }
+    /**
    * Handle detection of a duplicate proposal (equivocation).
    * Emits a slash event when a proposer sends multiple proposals for the same position.
    */ handleDuplicateProposal(info) {
         const { slot, proposer, type } = info;
-        this.slotsWithProposalEquivocation.add(slot);
+        this.proposalHandler.markProposalEquivocation(slot);
         this.log.info(`Detected duplicate ${type} proposal offense from ${proposer.toString()} at slot ${slot}`, {
             proposer: proposer.toString(),
             slot,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/validator-client",
-  "version": "5.0.0-rc.1",
+  "version": "5.0.0",
   "main": "dest/index.js",
   "type": "module",
   "exports": {
@@ -64,30 +64,30 @@
     ]
   },
   "dependencies": {
-    "@aztec/blob-client": "5.0.0-rc.1",
-    "@aztec/blob-lib": "5.0.0-rc.1",
-    "@aztec/constants": "5.0.0-rc.1",
-    "@aztec/epoch-cache": "5.0.0-rc.1",
-    "@aztec/ethereum": "5.0.0-rc.1",
-    "@aztec/foundation": "5.0.0-rc.1",
-    "@aztec/node-keystore": "5.0.0-rc.1",
-    "@aztec/noir-protocol-circuits-types": "5.0.0-rc.1",
-    "@aztec/p2p": "5.0.0-rc.1",
-    "@aztec/protocol-contracts": "5.0.0-rc.1",
-    "@aztec/prover-client": "5.0.0-rc.1",
-    "@aztec/simulator": "5.0.0-rc.1",
-    "@aztec/slasher": "5.0.0-rc.1",
-    "@aztec/stdlib": "5.0.0-rc.1",
-    "@aztec/telemetry-client": "5.0.0-rc.1",
-    "@aztec/validator-ha-signer": "5.0.0-rc.1",
+    "@aztec/blob-client": "5.0.0",
+    "@aztec/blob-lib": "5.0.0",
+    "@aztec/constants": "5.0.0",
+    "@aztec/epoch-cache": "5.0.0",
+    "@aztec/ethereum": "5.0.0",
+    "@aztec/foundation": "5.0.0",
+    "@aztec/node-keystore": "5.0.0",
+    "@aztec/noir-protocol-circuits-types": "5.0.0",
+    "@aztec/p2p": "5.0.0",
+    "@aztec/protocol-contracts": "5.0.0",
+    "@aztec/prover-client": "5.0.0",
+    "@aztec/simulator": "5.0.0",
+    "@aztec/slasher": "5.0.0",
+    "@aztec/stdlib": "5.0.0",
+    "@aztec/telemetry-client": "5.0.0",
+    "@aztec/validator-ha-signer": "5.0.0",
     "koa": "^2.16.1",
     "koa-router": "^13.1.1",
     "tslib": "^2.4.0",
     "viem": "npm:@aztec/viem@2.38.2"
   },
   "devDependencies": {
-    "@aztec/archiver": "5.0.0-rc.1",
-    "@aztec/world-state": "5.0.0-rc.1",
+    "@aztec/archiver": "5.0.0",
+    "@aztec/world-state": "5.0.0",
     "@electric-sql/pglite": "^0.3.14",
     "@jest/globals": "^30.0.0",
     "@types/jest": "^30.0.0",

package/src/key_store/web3signer_key_store.ts

@@ -8,6 +8,9 @@ import type { TypedDataDefinition } from 'viem';
 
 import type { ValidatorKeyStore } from './interface.js';
 
+/** Default hard timeout (ms) applied to each Web3Signer HTTP request. */
+const DEFAULT_WEB3SIGNER_REQUEST_TIMEOUT_MS = 30_000;
+
 /**
  * Web3Signer Key Store
  *
@@ -15,10 +18,15 @@ import type { ValidatorKeyStore } from './interface.js';
  * This implementation uses the Web3Signer JSON-RPC API for secp256k1 signatures.
  */
 export class Web3SignerKeyStore implements ValidatorKeyStore {
+  private readonly requestTimeoutMs: number;
+
   constructor(
     private addresses: EthAddress[],
     private baseUrl: string,
-  ) {}
+    requestTimeoutMs: number = DEFAULT_WEB3SIGNER_REQUEST_TIMEOUT_MS,
+  ) {
+    this.requestTimeoutMs = requestTimeoutMs;
+  }
 
   /**
    * Get the address of a signer by index
@@ -108,75 +116,50 @@ export class Web3SignerKeyStore implements ValidatorKeyStore {
    * @param data - The data to sign
    * @returns The signature
    */
-  private async makeJsonRpcSignRequest(address: EthAddress, data: Buffer32): Promise<Signature> {
-    const url = this.baseUrl;
-
-    // Use JSON-RPC eth_sign method which automatically applies Ethereum message prefixing
-    const body = {
+  private makeJsonRpcSignRequest(address: EthAddress, data: Buffer32): Promise<Signature> {
+    // eth_sign automatically applies Ethereum message prefixing to the raw data.
+    return this.sendSignRequest({
       jsonrpc: '2.0',
       method: 'eth_sign',
-      params: [
-        address.toString(), // Ethereum address as identifier
-        data.toString(), // Raw data to sign (eth_sign will apply Ethereum message prefix)
-      ],
+      params: [address.toString(), data.toString()],
       id: 1,
-    };
-
-    const response = await fetch(url, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify(body),
     });
-
-    if (!response.ok) {
-      const errorText = await response.text();
-      throw new Error(`Web3Signer request failed: ${response.status} ${response.statusText} - ${errorText}`);
-    }
-
-    const result = await response.json();
-
-    // Handle JSON-RPC response format
-    if (result.error) {
-      throw new Error(`Web3Signer JSON-RPC error: ${result.error.code} - ${result.error.message}`);
-    }
-
-    if (!result.result) {
-      throw new Error('Invalid response from Web3Signer: no result found');
-    }
-
-    let signatureHex = result.result;
-
-    // Ensure the signature has the 0x prefix
-    if (!signatureHex.startsWith('0x')) {
-      signatureHex = '0x' + signatureHex;
-    }
-
-    // Parse the signature from the hex string
-    return normalizeSignature(Signature.fromString(signatureHex as `0x${string}`));
   }
 
-  private async makeJsonRpcSignTypedDataRequest(
-    address: EthAddress,
-    typedData: TypedDataDefinition,
-  ): Promise<Signature> {
-    const url = this.baseUrl;
-
-    const body = {
+  private makeJsonRpcSignTypedDataRequest(address: EthAddress, typedData: TypedDataDefinition): Promise<Signature> {
+    return this.sendSignRequest({
       jsonrpc: '2.0',
       method: 'eth_signTypedData',
       params: [address.toString(), JSON.stringify(typedData)],
       id: 1,
-    };
-
-    const response = await fetch(url, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify(body),
     });
+  }
+
+  /**
+   * Send a JSON-RPC request to Web3Signer under a hard request timeout and parse the signature.
+   * A timed-out or aborted request is surfaced as a clear timeout error rather than hanging, so a
+   * slow or unreachable signer cannot stall an HA signing operation past its own timeout budget.
+   */
+  private async sendSignRequest(body: object): Promise<Signature> {
+    let response: Response;
+    try {
+      response = await fetch(this.baseUrl, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(this.requestTimeoutMs),
+      });
+    } catch (err) {
+      if (
+        (err instanceof Error || err instanceof DOMException) &&
+        (err.name === 'TimeoutError' || err.name === 'AbortError')
+      ) {
+        throw new Error(`Web3Signer request timed out after ${this.requestTimeoutMs}ms`);
+      }
+      throw err;
+    }
 
     if (!response.ok) {
       const errorText = await response.text();
@@ -185,6 +168,7 @@ export class Web3SignerKeyStore implements ValidatorKeyStore {
 
     const result = await response.json();
 
+    // Handle JSON-RPC response format
     if (result.error) {
       throw new Error(`Web3Signer JSON-RPC error: ${result.error.code} - ${result.error.message}`);
     }

package/src/proposal_handler.ts

@@ -13,6 +13,7 @@ import {
 import { pick } from '@aztec/foundation/collection';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { TimeoutError } from '@aztec/foundation/error';
+import { FifoSet } from '@aztec/foundation/fifo-set';
 import type { LogData } from '@aztec/foundation/log';
 import { createLogger } from '@aztec/foundation/log';
 import { retryUntil } from '@aztec/foundation/retry';
@@ -152,7 +153,49 @@ type BlockProposalSlotValidationResult =
   | { isValid: true }
   | { isValid: false; reason: 'block_proposal_beyond_checkpoint' | 'checkpoint_proposal_equivocation' };
 
-/** Handles block and checkpoint proposals for both validator and non-validator nodes. */
+const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
+
+/** Block-proposal validation failures that constitute a slashable invalid-block offense. */
+export const SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT: BlockProposalValidationFailureReason[] = [
+  'state_mismatch',
+  'failed_txs',
+  'global_variables_mismatch',
+  'invalid_proposal',
+  'parent_block_wrong_slot',
+  'in_hash_mismatch',
+];
+
+/** Checkpoint-proposal validation failures that constitute a slashable invalid-checkpoint offense. */
+export const SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT: Record<
+  CheckpointProposalValidationFailureReason,
+  boolean
+> = {
+  // enabled
+  ['invalid_fee_asset_price_modifier']: true,
+  ['checkpoint_header_mismatch']: true,
+  // These late mismatches should normally be caught by earlier checks, but if reached after validating the local
+  // checkpoint inputs, the proposer-signed payload disagrees with deterministic recomputation.
+  ['archive_mismatch']: true,
+  ['out_hash_mismatch']: true,
+  ['no_blocks_for_slot']: true,
+  ['too_many_blocks_in_checkpoint']: true,
+  ['checkpoint_validation_failed']: true,
+  ['last_block_archive_mismatch']: true,
+
+  // disabled
+  ['invalid_signature']: false,
+  ['last_block_not_found']: false,
+  ['block_fetch_error']: false,
+  ['checkpoint_already_published']: false,
+};
+
+/**
+ * Handles block and checkpoint proposals for both validator and non-validator nodes. Also tracks which slots
+ * had a slashable invalid proposal or a proposal equivocation, exposing them via the
+ * `InvalidProposalSlotSource` interface consumed by the attested-invalid-proposal slashing watcher. The
+ * tracking is populated as a side effect of validating/re-executing proposals, so any node that re-executes
+ * proposals (the default) can serve it — not only validators.
+ */
 export class ProposalHandler {
   public readonly tracer: Tracer;
 
@@ -175,6 +218,12 @@ export class ProposalHandler {
 
   private checkpointProposalValidationFailureCallback?: CheckpointProposalValidationFailureCallback;
 
+  /** Slots at which a slashable invalid block or checkpoint proposal was observed. */
+  private readonly slotsWithInvalidProposals = FifoSet.withLimit<SlotNumber>(MAX_TRACKED_INVALID_PROPOSAL_SLOTS);
+
+  /** Slots at which a proposal equivocation was observed; suppresses attested-to-invalid-proposal slashing. */
+  private readonly slotsWithProposalEquivocation = FifoSet.withLimit<SlotNumber>(MAX_TRACKED_INVALID_PROPOSAL_SLOTS);
+
   constructor(
     private checkpointsBuilder: FullNodeCheckpointsBuilder,
     private worldState: WorldStateSynchronizer,
@@ -221,6 +270,26 @@ export class ProposalHandler {
     this.reexecutionTracker.recordOutcome(slot, archive, 'valid', checkpointNumber);
   }
 
+  /** Whether a slashable invalid block or checkpoint proposal was observed at the given slot (InvalidProposalSlotSource). */
+  public hasInvalidProposals(slotNumber: SlotNumber): boolean {
+    return this.slotsWithInvalidProposals.has(slotNumber);
+  }
+
+  /** Whether a proposal equivocation was observed at the given slot (InvalidProposalSlotSource). */
+  public hasProposalEquivocation(slotNumber: SlotNumber): boolean {
+    return this.slotsWithProposalEquivocation.has(slotNumber);
+  }
+
+  /** Records a slot as having a slashable invalid proposal, for offense observers (sentinel/slasher watchers). */
+  public markInvalidProposalSlot(slotNumber: SlotNumber): void {
+    this.slotsWithInvalidProposals.add(slotNumber);
+  }
+
+  /** Records a slot as having a proposal equivocation, which suppresses attested-to-invalid-proposal slashing. */
+  public markProposalEquivocation(slotNumber: SlotNumber): void {
+    this.slotsWithProposalEquivocation.add(slotNumber);
+  }
+
   /**
    * Registers handlers for block and checkpoint proposals on the p2p client.
    * Records the p2p client so validation can inspect retained proposals.
@@ -256,6 +325,18 @@ export class ProposalHandler {
           });
           return true;
         } else {
+          // Track invalid proposals / equivocations so offense observers (the attested-invalid-proposal
+          // watcher) work on non-validator nodes too. Validators populate these via their own handlers.
+          // Skip invalid-proposal marking while the escape hatch is open, matching the validator path,
+          // which intentionally disables invalid-block slashing then.
+          if (result.reason === 'checkpoint_proposal_equivocation') {
+            this.markProposalEquivocation(slotNumber);
+          } else if (
+            SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT.includes(result.reason) &&
+            !(await this.epochCache.isEscapeHatchOpenAtSlot(slotNumber))
+          ) {
+            this.markInvalidProposalSlot(slotNumber);
+          }
           this.log.warn(
             `Non-validator block proposal ${blockNumber} at slot ${slotNumber} failed processing with ${result.reason}`,
             { blockNumber: result.blockNumber, slotNumber, reason: result.reason },
@@ -270,6 +351,11 @@ export class ProposalHandler {
 
     p2pClient.registerBlockProposalHandler(blockHandler);
 
+    // p2p detects duplicate (equivocated) proposals without routing them through the handlers above, so mark
+    // the slot as equivocated here. This suppresses false-positive attested-to-invalid-proposal slashing on
+    // non-validator offense collectors. Validators overwrite this with their own richer handler.
+    p2pClient.registerDuplicateProposalCallback(info => this.markProposalEquivocation(info.slot));
+
     // All-nodes checkpoint proposal handler: validates, caches, and sets proposed checkpoint for pipelining.
     // Runs for all nodes (validators and non-validators). Validators get the cached result in the
     // validator-specific callback (attestToCheckpointProposal) which runs after this one.
@@ -318,6 +404,12 @@ export class ProposalHandler {
 
         const result = await this.handleCheckpointProposal(proposal, proposalInfo);
         if (!result.isValid) {
+          // Track invalid checkpoint proposals so offense observers (the attested-invalid-proposal watcher)
+          // work on non-validator nodes too. This handler runs for all nodes; validators also mark via the
+          // failure callback below (idempotent).
+          if (SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT[result.reason]) {
+            this.markInvalidProposalSlot(proposal.slotNumber);
+          }
           await this.checkpointProposalValidationFailureCallback?.(proposal, result, proposalInfo);
         } else if (this.archiver) {
           const set = await this.setProposedCheckpoint(proposal);
@@ -410,8 +502,12 @@ export class ProposalHandler {
         : BlockNumber(parentBlock.header.getBlockNumber() + 1);
     proposalInfo.blockNumber = blockNumber;
 
-    // Check that this block number does not exist already
-    const existingBlock = await this.blockSource.getBlockData({ number: blockNumber });
+    // Check that this block number does not exist already. During a reorg the archiver can still hold a
+    // stale block at this number (a different archive, about to be pruned) while the proposal carries the
+    // rebuilt replacement; resolveExistingBlockAtNumber waits for the local prune in that case so the
+    // rebuilt block is processed in time to attest, rather than being permanently dropped on a bare
+    // number collision.
+    const existingBlock = await this.resolveExistingBlockAtNumber(blockNumber, proposal.archive, slotNumber);
     if (existingBlock) {
       this.log.warn(`Block number ${blockNumber} already exists, skipping processing`, proposalInfo);
       return { isValid: false, blockNumber, reason: 'block_number_already_exists' };
@@ -495,7 +591,7 @@ export class ProposalHandler {
     }
 
     // If we succeeded, push this block into the archiver (unless disabled)
-    if (reexecutionResult?.block && this.config.skipPushProposedBlocksToArchiver === false) {
+    if (reexecutionResult?.block && !this.config.skipPushProposedBlocksToArchiver) {
       await this.blockSource.addBlock(reexecutionResult.block);
     }
 
@@ -561,6 +657,63 @@ export class ProposalHandler {
     }
   }
 
+  /**
+   * Resolves whether a block genuinely already exists at `blockNumber`. Returns the existing block only if
+   * it is a true duplicate of the proposal (matching archive). During a reorg the archiver can still hold a
+   * stale fork at this number (different archive) that is about to be pruned; in that case this forces L1
+   * sync and waits, bounded by the re-execution deadline, for the prune to land, then returns `undefined` so
+   * the rebuilt block proposal can be processed in time to attest. If the prune does not complete before the
+   * deadline it returns the stale block, so the caller falls back to the safe `block_number_already_exists`
+   * rejection.
+   */
+  private async resolveExistingBlockAtNumber(
+    blockNumber: BlockNumber,
+    proposalArchive: Fr,
+    slotNumber: SlotNumber,
+  ): Promise<BlockData | undefined> {
+    const existingBlock = await this.blockSource.getBlockData({ number: blockNumber });
+    if (!existingBlock || existingBlock.archive.root.equals(proposalArchive)) {
+      return existingBlock;
+    }
+
+    // A different block already occupies this number: it may be a stale fork being pruned during a reorg, not a
+    // genuine duplicate. Wait for the local prune rather than permanently rejecting the proposal.
+    const deadline = this.getReexecutionDeadline(slotNumber);
+    if (deadline.getTime() - this.dateProvider.now() <= 0) {
+      return existingBlock;
+    }
+
+    this.log.warn(`Block number ${blockNumber} already exists, awaiting potential prune`, {
+      blockNumber,
+      existingArchive: existingBlock.archive.root.toString(),
+      proposalArchive: proposalArchive.toString(),
+    });
+
+    try {
+      const { block } = await retryUntil(
+        async () => {
+          await this.blockSource.syncImmediate();
+          const block = await this.blockSource.getBlockData({ number: blockNumber });
+          // Resolve once the existing block is gone (pruned) or has been replaced by one matching the
+          // proposal — the same condition as the early return above. A matching block is returned so the
+          // caller still treats it as a genuine duplicate; an `undefined` (pruned) block lets the proposal
+          // be processed. Wrap in an object so the `undefined` case is still a truthy retry result.
+          return block === undefined || block.archive.root.equals(proposalArchive) ? { block } : undefined;
+        },
+        `prune of stale block ${blockNumber}`,
+        { deadline, dateProvider: this.dateProvider },
+        0.5,
+      );
+      return block;
+    } catch (err) {
+      if (err instanceof TimeoutError) {
+        this.log.warn(`Timed out waiting for stale block ${blockNumber} to be pruned`, { blockNumber });
+        return existingBlock;
+      }
+      throw err;
+    }
+  }
+
   private computeCheckpointNumber(
     proposal: BlockProposal,
     parentBlock: 'genesis' | BlockData,
@@ -968,6 +1121,7 @@ export class ProposalHandler {
       };
     }
 
+    // Note this condition should never trigger, since we dont process block proposals that exceed indexWithinCheckpoint
     const maxBlocksPerCheckpoint = this.config.maxBlocksPerCheckpoint;
     if (maxBlocksPerCheckpoint !== undefined && blocks.length > maxBlocksPerCheckpoint) {
       this.log.warn(`Checkpoint proposal exceeds maxBlocksPerCheckpoint`, {