feat: handle DoS node by sending block

[yiweichi]

Problem

Malicious peers can DoS the node by sending old blocks.

Solution

Two-layer defense:

1. Finalized Block Protection
   if block_number <= finalized_height { penalize(peer); // Immediately reject}
2. Duplicate Block Detection
   // Cache recent blocks per peerif peer_already_sent_this_block { penalize(peer); // DoS detected }

Challenge

Multi-Protocol Handling
Problem: Nodes use both scroll-wire and eth-wire protocols. Same peer may legitimately send same block via both protocols.
Solution: Track duplicates per protocol

struct PeerBlockState {
    scroll_wire_received: LruCache<B256>,  // scroll-wire duplicates
    eth_wire_received: LruCache<B256>,     // eth-wire duplicates
}

// Only penalize duplicates within SAME protocol
if peer_sent_via_scroll_wire && receives_again_via_scroll_wire {
    penalize();  // DoS attack
}

if peer_sent_via_scroll_wire && receives_via_eth_wire {
    accept();    // Different protocol, OK
}

Fixes #307

[codspeed-hq]

Merging this PR will not alter performance

✅ 2 untouched benchmarks

---

_{Comparing feat-penalize-peer-on-duplicate-block (9ccf17a) with main (2ae9352)}

[frisitano]

Looks good. Added a few comments inline. Can you add some test cases, please?

I'm also wondering if we can simplify the logic a bit. The idea would be that if we have a connection with a peer over scroll-wire, then we should only gossip on scroll-wire. If we don't have a scroll-wire connection, then we use eth-wire. I think this should allow us to consolidate the block cache per peer into a single cache.

[frisitano]

I'm wondering if we should change the logic below.

If we have a connection with a peer via scroll wire - only send via scroll wire. If we don't have a connection with a peer via scroll wire then send only via eth wire.

What do you think?

[frisitano]

Suggested change

	// Check if this peer has already received this block via scroll-wire, if so
	// penalize it.
	// Check if we have already received this block via scroll-wire from this peer, if so
	// penalize it.

[frisitano]

Don't we already do this above on line 274 above?

[frisitano]

Suggested change

	// Check if this peer has already sent this block to us via eth-wire, if so penalize it.
	// Check if we have already received this block from this peer via eth-wire, if so, penalize the peer.

[frisitano]

Don't we already do this above on line 396?

[frisitano]

I propose we rename this to peer_state and PeerBlockState to PeerState