feat(fast-inbox): reject over-cap block counts at attestation time (A-1539)

The checkpoint root circuit caps how many blocks a checkpoint may contain, but L1 cannot enforce that cap when the
checkpoint is proposed: `ProposedHeader` carries no block count, only `blockHeadersHash`. An over-cap checkpoint would
therefore be accepted on L1 and then be unprovable, forcing an epoch reorg — so validators have to reject it before
attesting, the same enforcement pattern the streaming Inbox uses for `MAX_L1_TO_L2_MSGS_PER_CHECKPOINT`.

The checkpoint-proposal check already existed but only fired for an operator-configured `maxBlocksPerCheckpoint`. It
now always applies the protocol cap, with the operator limit only able to tighten it.

Test: an over-cap checkpoint proposal is rejected with no operator limit configured.

Author: spalladino

yarn-project/validator-client/src/proposal_handler.test.ts

@@ -1,6 +1,6 @@
 import type { Archiver } from '@aztec/archiver';
 import type { BlobClientInterface } from '@aztec/blob-client/client';
-import { INITIAL_L2_BLOCK_NUM } from '@aztec/constants';
+import { INITIAL_L2_BLOCK_NUM, MAX_BLOCKS_PER_CHECKPOINT } from '@aztec/constants';
 import type { EpochCache } from '@aztec/epoch-cache';
 import { MAX_FEE_ASSET_PRICE_MODIFIER_BPS } from '@aztec/ethereum/contracts';
 import { BlockNumber, CheckpointNumber, SlotNumber } from '@aztec/foundation/branded-types';
@@ -196,6 +196,25 @@ describe('ProposalHandler checkpoint validation', () => {
       expect(result).toEqual({ isValid: false, reason: 'too_many_blocks_in_checkpoint' });
     });
 
+    it('returns too_many_blocks_in_checkpoint when blocks exceed the protocol cap without an operator limit', async () => {
+      // The checkpoint root circuit caps the blocks a checkpoint may contain; an over-cap checkpoint is unprovable,
+      // and L1 cannot reject it at propose time, so the validator must not attest to it.
+      expect(config.maxBlocksPerCheckpoint).toBeUndefined();
+
+      const archiveRoot = Fr.random();
+      blockSource.getBlockData.mockResolvedValue({ header: makeBlockHeader() } as BlockData);
+      const overCap = MAX_BLOCKS_PER_CHECKPOINT + 1;
+      const blocks = Array.from({ length: overCap }, (_, i) => ({
+        archive: new AppendOnlyTreeSnapshot(i === overCap - 1 ? archiveRoot : Fr.random(), i + 1),
+        number: i + 1,
+      })) as unknown as L2Block[];
+      blockSource.getBlocksForSlot.mockResolvedValue(blocks);
+
+      const proposal = await makeProposal({ archiveRoot });
+      const result = await handler.handleCheckpointProposal(proposal, proposalInfo);
+      expect(result).toEqual({ isValid: false, reason: 'too_many_blocks_in_checkpoint' });
+    });
+
     it('caches validation result and returns it on second call', async () => {
       blockSource.getBlockData.mockResolvedValue(undefined);
       const proposal = await makeProposal();

yarn-project/validator-client/src/proposal_handler.ts

@@ -4,6 +4,7 @@ import { type Blob, encodeCheckpointBlobDataFromBlocks, getBlobsPerL1Block } fro
 import {
   INBOX_LAG_SECONDS,
   INITIAL_L2_BLOCK_NUM,
+  MAX_BLOCKS_PER_CHECKPOINT,
   MAX_L1_TO_L2_MSGS_PER_BLOCK,
   MAX_L1_TO_L2_MSGS_PER_CHECKPOINT,
 } from '@aztec/constants';
@@ -1282,9 +1283,15 @@ export class ProposalHandler {
       };
     }
 
-    // Note this condition should never trigger, since we dont process block proposals that exceed indexWithinCheckpoint
-    const maxBlocksPerCheckpoint = this.config.maxBlocksPerCheckpoint;
-    if (maxBlocksPerCheckpoint !== undefined && blocks.length > maxBlocksPerCheckpoint) {
+    // The checkpoint root circuit caps how many blocks a checkpoint may contain, and L1 cannot check it when the
+    // checkpoint is proposed (`ProposedHeader` carries no block count, only `blockHeadersHash`). An over-cap
+    // checkpoint would therefore be accepted on L1 and then be unprovable, forcing an epoch reorg, so validators
+    // reject it before attesting. An operator-configured limit may only tighten the protocol cap, never relax it.
+    const maxBlocksPerCheckpoint = Math.min(
+      this.config.maxBlocksPerCheckpoint ?? MAX_BLOCKS_PER_CHECKPOINT,
+      MAX_BLOCKS_PER_CHECKPOINT,
+    );
+    if (blocks.length > maxBlocksPerCheckpoint) {
       this.log.warn(`Checkpoint proposal exceeds maxBlocksPerCheckpoint`, {
         ...proposalInfo,
         blocksInProposal: blocks.length,