From 96f785ad17b12542d1dbcea0621e4e4b0c049204 Mon Sep 17 00:00:00 2001
From: Stan Bondi <sdbondi@users.noreply.github.com>
Date: Tue, 11 Nov 2025 11:21:54 +0400
Subject: [PATCH] fix(engine)!: hard limit on template binary size

---
 .../src/transaction_executor.rs               |  6 +---
 applications/tari_indexer/src/bootstrap.rs    |  6 ++--
 .../tari_indexer/src/dry_run/processor.rs     | 30 +++++------------
 .../tari_validator_node/src/bootstrap.rs      |  3 --
 .../tari_walletd/src/handlers/transaction.rs  |  4 +++
 crates/consensus/src/consensus_constants.rs   |  3 --
 crates/consensus_tests/src/consensus.rs       |  8 ++---
 crates/consensus_tests/src/support/harness.rs |  1 -
 crates/engine/src/transaction/config.rs       | 24 --------------
 crates/engine/src/transaction/error.rs        |  2 --
 crates/engine/src/transaction/mod.rs          |  3 --
 crates/engine/src/transaction/processor.rs    | 32 +++++--------------
 crates/engine/tests/publish_template.rs       |  6 ++--
 crates/engine_types/src/limits.rs             |  4 ++-
 crates/p2p/src/conversions/transaction.rs     |  9 ++++--
 crates/template_lib_types/src/max_bytes.rs    | 12 +++++++
 .../src/implementation/service.rs             |  3 +-
 .../src/template_test.rs                      | 10 ++----
 crates/transaction/src/builder/mod.rs         |  3 +-
 crates/transaction/src/transaction.rs         |  3 +-
 crates/transaction/src/v1/instruction.rs      | 13 ++++++--
 21 files changed, 69 insertions(+), 116 deletions(-)
 delete mode 100644 crates/engine/src/transaction/config.rs

diff --git a/applications/tari_app_utilities/src/transaction_executor.rs b/applications/tari_app_utilities/src/transaction_executor.rs
index 33171e674b..6dea5a7080 100644
--- a/applications/tari_app_utilities/src/transaction_executor.rs
+++ b/applications/tari_app_utilities/src/transaction_executor.rs
@@ -11,7 +11,7 @@ use tari_engine::{
     state_store::{memory::ReadOnlyMemoryStateStore, StateStoreError},
     template::LoadedTemplate,
     traits::ClaimProofVerifier,
-    transaction::{TransactionError, TransactionProcessor, TransactionProcessorConfig},
+    transaction::{TransactionError, TransactionProcessor},
 };
 use tari_engine_types::{commit_result::ExecuteResult, substate::Substate, virtual_substate::VirtualSubstates};
 use tari_ootle_common_types::{
@@ -87,13 +87,11 @@ impl ExecutionOutput {
 pub struct TariTransactionProcessor<TTemplateProvider> {
     template_provider: Arc<TTemplateProvider>,
     fee_table: FeeTable,
-    config: TransactionProcessorConfig,
     claim_burn_proof_verifier: Arc<dyn ClaimProofVerifier + Send + Sync + 'static>,
 }
 
 impl<TTemplateProvider> TariTransactionProcessor<TTemplateProvider> {
     pub fn new(
-        config: TransactionProcessorConfig,
         template_provider: TTemplateProvider,
         fee_table: FeeTable,
         claim_burn_proof_verifier: Arc<dyn ClaimProofVerifier + Send + Sync + 'static>,
@@ -101,7 +99,6 @@ impl<TTemplateProvider> TariTransactionProcessor<TTemplateProvider> {
         Self {
             template_provider: Arc::new(template_provider),
             fee_table,
-            config,
             claim_burn_proof_verifier,
         }
     }
@@ -132,7 +129,6 @@ where TTemplateProvider: TemplateProvider<Template = LoadedTemplate>
         let modules: Vec<Arc<dyn RuntimeModule>> = vec![Arc::new(FeeModule::new(initial_cost, self.fee_table.clone()))];
 
         let processor = TransactionProcessor::new(
-            self.config.clone(),
             self.template_provider.clone(),
             state_store,
             auth_params,
diff --git a/applications/tari_indexer/src/bootstrap.rs b/applications/tari_indexer/src/bootstrap.rs
index b65d7cd73e..378026e556 100644
--- a/applications/tari_indexer/src/bootstrap.rs
+++ b/applications/tari_indexer/src/bootstrap.rs
@@ -30,7 +30,6 @@ use tari_base_node_client::grpc::GrpcBaseNodeClient;
 use tari_common::configuration::bootstrap::{grpc_default_port, ApplicationType};
 use tari_consensus::consensus_constants::ConsensusConstants;
 use tari_crypto::tari_utilities::ByteArray;
-use tari_engine::transaction::TransactionProcessorConfig;
 use tari_engine_types::ToByteType;
 use tari_epoch_manager::service::{EpochManagerConfig, EpochManagerHandle};
 use tari_epoch_oracles::{
@@ -47,6 +46,7 @@ use tari_ootle_app_utilities::{
     common::verify_correct_network,
     configuration::convert_network_to_l1_network,
     epoch_oracle_config::EpochOracleType,
+    fee_tables::get_fee_table_by_network,
     keypair::RistrettoKeypair,
     seed_peer::SeedPeer,
     shared_consts::TXTR_FAUCET_INITIAL_SUPPLY,
@@ -237,9 +237,9 @@ pub async fn spawn_services(
     let transaction_manager = TransactionManager::new(network_client.clone(), store.clone());
 
     // dry run
+    let fee_table = get_fee_table_by_network(config.network);
     let dry_run_transaction_processor = DryRunTransactionProcessor::new(
-        TransactionProcessorConfig::new(config.network)
-            .with_template_binary_max_size_bytes(consensus_constants.template_binary_max_size_bytes),
+        fee_table.clone(),
         epoch_manager.clone(),
         validator_node_client_factory.clone(),
         template_manager.clone(),
diff --git a/applications/tari_indexer/src/dry_run/processor.rs b/applications/tari_indexer/src/dry_run/processor.rs
index 0db44010bc..e57876b705 100644
--- a/applications/tari_indexer/src/dry_run/processor.rs
+++ b/applications/tari_indexer/src/dry_run/processor.rs
@@ -23,17 +23,14 @@
 use std::{collections::HashMap, sync::Arc};
 
 use log::{debug, info};
-use tari_engine::{state_store::new_memory_store, traits::ClaimProofVerifier, transaction::TransactionProcessorConfig};
+use tari_engine::{fees::FeeTable, state_store::new_memory_store, traits::ClaimProofVerifier};
 use tari_engine_types::{
     commit_result::ExecuteResult,
     substate::{Substate, SubstateId},
     virtual_substate::{VirtualSubstate, VirtualSubstateId, VirtualSubstates},
 };
 use tari_epoch_manager::{service::EpochManagerHandle, EpochManagerReader};
-use tari_ootle_app_utilities::{
-    fee_tables::get_fee_table_by_network,
-    transaction_executor::{TariTransactionProcessor, TransactionExecutor as _},
-};
+use tari_ootle_app_utilities::transaction_executor::{TariTransactionProcessor, TransactionExecutor as _};
 use tari_ootle_common_types::{Epoch, PeerAddress, SubstateRequirement};
 use tari_template_manager::implementation::TemplateManager;
 use tari_transaction::Transaction;
@@ -51,27 +48,24 @@ const LOG_TARGET: &str = "tari::indexer::dry_run_transaction_processor";
 
 #[derive(Clone)]
 pub struct DryRunTransactionProcessor {
-    config: TransactionProcessorConfig,
+    processor: TariTransactionProcessor<TemplateManager<PeerAddress>>,
     epoch_manager: EpochManagerHandle<PeerAddress>,
     client_provider: TariValidatorNodeRpcClientFactory,
-    template_manager: TemplateManager<PeerAddress>,
-    claim_burn_proof_verifier: Arc<dyn ClaimProofVerifier + Send + Sync + 'static>,
 }
 
 impl DryRunTransactionProcessor {
     pub fn new(
-        config: TransactionProcessorConfig,
+        fee_table: FeeTable,
         epoch_manager: EpochManagerHandle<PeerAddress>,
         client_provider: TariValidatorNodeRpcClientFactory,
         template_manager: TemplateManager<PeerAddress>,
         claim_burn_proof_verifier: impl ClaimProofVerifier + Send + Sync + 'static,
     ) -> Self {
+        let processor = TariTransactionProcessor::new(template_manager, fee_table, Arc::new(claim_burn_proof_verifier));
         Self {
-            config,
+            processor,
             epoch_manager,
             client_provider,
-            template_manager,
-            claim_burn_proof_verifier: Arc::new(claim_burn_proof_verifier),
         }
     }
 
@@ -88,15 +82,6 @@ impl DryRunTransactionProcessor {
         let epoch = self.epoch_manager.current_epoch().await?;
         let found_substates = self.fetch_input_substates(&transaction, epoch).await?;
 
-        let fee_table = get_fee_table_by_network(self.config.network);
-
-        let payload_processor = TariTransactionProcessor::new(
-            self.config.clone(),
-            self.template_manager.clone(),
-            fee_table.clone(),
-            self.claim_burn_proof_verifier.clone(),
-        );
-
         let virtual_substates = self.get_virtual_substates(&transaction, epoch).await?;
 
         let mut state_store = new_memory_store();
@@ -104,7 +89,8 @@ impl DryRunTransactionProcessor {
 
         // execute the payload in the WASM engine and return the result
         let exec_output = task::block_in_place(|| {
-            payload_processor.execute(&transaction, state_store.into_read_only(), virtual_substates)
+            self.processor
+                .execute(&transaction, state_store.into_read_only(), virtual_substates)
         })?;
 
         Ok(exec_output.result)
diff --git a/applications/tari_validator_node/src/bootstrap.rs b/applications/tari_validator_node/src/bootstrap.rs
index fb9fbab3dc..52162c7251 100644
--- a/applications/tari_validator_node/src/bootstrap.rs
+++ b/applications/tari_validator_node/src/bootstrap.rs
@@ -36,7 +36,6 @@ use tari_consensus::consensus_constants::ConsensusConstants;
 #[cfg(not(feature = "metrics"))]
 use tari_consensus::traits::hooks::NoopHooks;
 use tari_crypto::tari_utilities::ByteArray;
-use tari_engine::transaction::TransactionProcessorConfig;
 use tari_engine_types::ToByteType;
 use tari_epoch_manager::{
     service::{EpochManagerConfig, EpochManagerHandle},
@@ -301,8 +300,6 @@ pub async fn spawn_services(
     // Transaction executor
     let fee_table = get_fee_table_by_network(config.network);
     let payload_processor = TariTransactionProcessor::new(
-        TransactionProcessorConfig::new(config.network)
-            .with_template_binary_max_size_bytes(consensus_constants.template_binary_max_size_bytes),
         template_manager.clone(),
         fee_table.clone(),
         Arc::new(TariClaimBurnProofVerifier::new(config.network, global_db.clone())),
diff --git a/applications/tari_walletd/src/handlers/transaction.rs b/applications/tari_walletd/src/handlers/transaction.rs
index d2c50bace0..1f45006200 100644
--- a/applications/tari_walletd/src/handlers/transaction.rs
+++ b/applications/tari_walletd/src/handlers/transaction.rs
@@ -546,6 +546,10 @@ pub async fn handle_publish_template(
         },
     };
 
+    let wasm_binary = wasm_binary
+        .try_into()
+        .map_err(|_| invalid_params("binary", Some("WASM binary too large".to_string())))?;
+
     let transaction = context
         .transaction_builder()
         .fee_transaction_pay_from_component(*fee_account.component_address(), req.max_fee)
diff --git a/crates/consensus/src/consensus_constants.rs b/crates/consensus/src/consensus_constants.rs
index 3cf723136d..fe2483d54b 100644
--- a/crates/consensus/src/consensus_constants.rs
+++ b/crates/consensus/src/consensus_constants.rs
@@ -45,8 +45,6 @@ pub struct ConsensusConstants {
     /// The value that fees are divided by to determine the amount of fees to burn. 0 means no fees are burned.
     pub fee_exhaust_divisor: u64,
     pub epochs_per_era: Epoch,
-    /// Maximum size in bytes for a template WASM binary.
-    pub template_binary_max_size_bytes: usize,
 }
 
 impl ConsensusConstants {
@@ -64,7 +62,6 @@ impl ConsensusConstants {
             max_number_commands_in_block: 500,
             fee_exhaust_divisor: 20, // 5%
             epochs_per_era: Epoch(10),
-            template_binary_max_size_bytes: 1000 * 1000 * 5, // 5 MB
         }
     }
 }
diff --git a/crates/consensus_tests/src/consensus.rs b/crates/consensus_tests/src/consensus.rs
index 3f896faf92..dbfa202460 100644
--- a/crates/consensus_tests/src/consensus.rs
+++ b/crates/consensus_tests/src/consensus.rs
@@ -1359,8 +1359,9 @@ async fn multishard_publish_template() {
     let inputs = test.create_substates_on_vns(TestVnDestination::All, 1);
     let (sk, pk) = create_key_pair();
     let wasm = load_binary_fixture("state.wasm");
+    let expected_binary_hash = hash_template_code(&wasm);
     let tx = Transaction::builder()
-        .publish_template(wasm.clone())
+        .publish_template(wasm.try_into().unwrap())
         .with_inputs(inputs.iter().cloned().map(Into::into))
         .build_and_seal(&sk);
     let tx = TransactionRecord::new(tx);
@@ -1368,8 +1369,7 @@ async fn multishard_publish_template() {
     test.send_transaction_to_destination(TestVnDestination::All, tx.clone())
         .await;
 
-    let binary_hash = hash_template_code(&wasm);
-    let template_id = PublishedTemplateAddress::from_author_and_binary_hash(&pk.to_byte_type(), &binary_hash);
+    let template_id = PublishedTemplateAddress::from_author_and_binary_hash(&pk.to_byte_type(), &expected_binary_hash);
     test.add_execution_at_destination(TestVnDestination::All, ExecuteSpec {
         transaction: tx.transaction().clone(),
         decision: Decision::Commit,
@@ -1412,7 +1412,7 @@ async fn multishard_publish_template() {
             .into_template()
             .expect("Expected template substate")
             .binary_hash;
-        assert_eq!(binary_hash, hash_template_code(&wasm), "Template binary does not match");
+        assert_eq!(binary_hash, expected_binary_hash, "Template binary does not match");
     }
 
     test.assert_clean_shutdown().await;
diff --git a/crates/consensus_tests/src/support/harness.rs b/crates/consensus_tests/src/support/harness.rs
index 208fce03a9..5fdf5b0780 100644
--- a/crates/consensus_tests/src/support/harness.rs
+++ b/crates/consensus_tests/src/support/harness.rs
@@ -649,7 +649,6 @@ impl TestBuilder {
                     max_number_commands_in_block: 500,
                     fee_exhaust_divisor: 20,
                     epochs_per_era: Epoch(10),
-                    template_binary_max_size_bytes: 1000 * 1000 * 5,
                 },
                 state_tree_cleanup_interval: Duration::from_secs(60),
                 epoch_gc_interval: Duration::from_secs(60),
diff --git a/crates/engine/src/transaction/config.rs b/crates/engine/src/transaction/config.rs
deleted file mode 100644
index 6c8c44bf9d..0000000000
--- a/crates/engine/src/transaction/config.rs
+++ /dev/null
@@ -1,24 +0,0 @@
-//    Copyright 2025 The Tari Project
-//    SPDX-License-Identifier: BSD-3-Clause
-
-use tari_ootle_common_types::Network;
-
-#[derive(Clone, Debug)]
-pub struct TransactionProcessorConfig {
-    pub network: Network,
-    pub template_binary_max_size_bytes: usize,
-}
-
-impl TransactionProcessorConfig {
-    pub const fn new(network: Network) -> Self {
-        Self {
-            network,
-            template_binary_max_size_bytes: 1000 * 1000 * 5, // 5MB
-        }
-    }
-
-    pub const fn with_template_binary_max_size_bytes(mut self, max_size: usize) -> Self {
-        self.template_binary_max_size_bytes = max_size;
-        self
-    }
-}
diff --git a/crates/engine/src/transaction/error.rs b/crates/engine/src/transaction/error.rs
index 0fc4652a5a..e524dfcbd6 100644
--- a/crates/engine/src/transaction/error.rs
+++ b/crates/engine/src/transaction/error.rs
@@ -45,8 +45,6 @@ pub enum TransactionError {
     InvariantError { details: String },
     #[error("Load template error: {0}")]
     LoadTemplate(#[from] TemplateLoaderError),
-    #[error("WASM binary too big! {0} bytes are greater than allowed maximum {1} bytes.")]
-    WasmBinaryTooBig(usize, usize),
     #[error("Template provider error: {0}")]
     TemplateProvider(String),
     #[error("Converting to hash error: {0}")]
diff --git a/crates/engine/src/transaction/mod.rs b/crates/engine/src/transaction/mod.rs
index 8473bf2db5..e66d921546 100644
--- a/crates/engine/src/transaction/mod.rs
+++ b/crates/engine/src/transaction/mod.rs
@@ -23,9 +23,6 @@
 mod error;
 pub use error::TransactionError;
 
-mod config;
-pub use config::*;
-
 mod processor;
 
 pub use processor::*;
diff --git a/crates/engine/src/transaction/processor.rs b/crates/engine/src/transaction/processor.rs
index 4d6198241a..ea3e7667e6 100644
--- a/crates/engine/src/transaction/processor.rs
+++ b/crates/engine/src/transaction/processor.rs
@@ -52,6 +52,7 @@ use tari_transaction::{
     ComponentCall,
     Instruction,
     ResourceAddressRef,
+    TemplateBlob,
 };
 
 use crate::{
@@ -69,7 +70,7 @@ use crate::{
     state_store::memory::ReadOnlyMemoryStateStore,
     template::LoadedTemplate,
     traits::{ClaimProofVerifier, Invokable},
-    transaction::{TransactionError, TransactionProcessorConfig},
+    transaction::TransactionError,
     wasm::{WasmModule, WasmProcess},
 };
 
@@ -78,7 +79,6 @@ pub const MAX_CALL_DEPTH: usize = 10;
 const ACCOUNT_CONSTRUCTOR_FUNCTION: &str = "create";
 
 pub struct TransactionProcessor<TTemplateProvider> {
-    config: TransactionProcessorConfig,
     template_provider: Arc<TTemplateProvider>,
     state_db: ReadOnlyMemoryStateStore,
     auth_params: AuthParams,
@@ -89,7 +89,6 @@ pub struct TransactionProcessor<TTemplateProvider> {
 
 impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> TransactionProcessor<TTemplateProvider> {
     pub fn new(
-        config: TransactionProcessorConfig,
         template_provider: Arc<TTemplateProvider>,
         state_db: ReadOnlyMemoryStateStore,
         auth_params: AuthParams,
@@ -98,7 +97,6 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
         claim_burn_proof_verifier: Arc<dyn ClaimProofVerifier + Send + Sync + 'static>,
     ) -> Self {
         Self {
-            config,
             template_provider,
             state_db,
             auth_params,
@@ -114,7 +112,6 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
         let timer = Instant::now();
         let entity_id_provider = EntityIdProvider::new(id.as_hash(), 1000);
         let Self {
-            config,
             template_provider,
             state_db,
             auth_params,
@@ -169,7 +166,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
 
         let instructions = executable.into_instructions();
 
-        let fee_exec_results = Self::process_instructions(&config, &template_provider, &runtime, instructions.fee);
+        let fee_exec_results = Self::process_instructions(&template_provider, &runtime, instructions.fee);
 
         let fee_exec_result = match fee_exec_results {
             Ok(execution_results) => {
@@ -196,7 +193,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
             },
         };
 
-        let instruction_result = Self::process_instructions(&config, &*template_provider, &runtime, instructions.main);
+        let instruction_result = Self::process_instructions(&*template_provider, &runtime, instructions.main);
 
         match instruction_result {
             Ok(execution_results) => {
@@ -236,14 +233,13 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
     }
 
     fn process_instructions(
-        config: &TransactionProcessorConfig,
         template_provider: &TTemplateProvider,
         runtime: &Runtime,
         instructions: Vec<Instruction>,
     ) -> Result<Vec<InstructionResult>, TransactionError> {
         let result: Result<_, _> = instructions
             .into_iter()
-            .map(|instruction| Self::process_instruction(config, template_provider, runtime, instruction))
+            .map(|instruction| Self::process_instruction(template_provider, runtime, instruction))
             .collect();
 
         // check that the finalized state is valid
@@ -255,7 +251,6 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
     }
 
     fn process_instruction(
-        config: &TransactionProcessorConfig,
         template_provider: &TTemplateProvider,
         runtime: &Runtime,
         instruction: Instruction,
@@ -350,7 +345,7 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
                     .put_on_workspace(output_bucket, IndexedValue::from_value(bucket.into_value()?)?)?;
                 Ok(InstructionResult::empty())
             },
-            Instruction::PublishTemplate { binary } => Self::publish_template(config, runtime, binary),
+            Instruction::PublishTemplate { binary } => Self::publish_template(runtime, binary),
             Instruction::AllocateAddress {
                 allocatable_type: substate_type,
                 workspace_id,
@@ -453,22 +448,11 @@ impl<TTemplateProvider: TemplateProvider<Template = LoadedTemplate> + 'static> T
     }
 
     /// Load, validate template binary and adds it to TemplateProvider.
-    fn publish_template(
-        config: &TransactionProcessorConfig,
-        runtime: &Runtime,
-        binary: Vec<u8>,
-    ) -> Result<InstructionResult, TransactionError> {
-        if binary.len() > config.template_binary_max_size_bytes {
-            return Err(TransactionError::WasmBinaryTooBig(
-                binary.len(),
-                config.template_binary_max_size_bytes,
-            ));
-        }
-
+    fn publish_template(runtime: &Runtime, binary: TemplateBlob) -> Result<InstructionResult, TransactionError> {
         // validate binary
         WasmModule::load_template_from_code(&binary)?;
         // creating new substate
-        runtime.interface().publish_template(binary)?;
+        runtime.interface().publish_template(binary.into_vec())?;
 
         Ok(InstructionResult::empty())
     }
diff --git a/crates/engine/tests/publish_template.rs b/crates/engine/tests/publish_template.rs
index 0a5a911e65..9bf018f789 100644
--- a/crates/engine/tests/publish_template.rs
+++ b/crates/engine/tests/publish_template.rs
@@ -30,7 +30,7 @@ fn publish_template_success() {
     let result = test.execute_expect_success(
         Transaction::builder()
             .fee_transaction_pay_from_component(account_address, 200_000)
-            .publish_template(template.code().to_vec())
+            .publish_template(template.into_code().try_into().unwrap())
             .build_and_seal(&account_key),
         vec![owner_proof],
     );
@@ -62,7 +62,7 @@ fn publish_template_invalid_binary() {
     let result = test.execute_expect_failure(
         Transaction::builder()
             .fee_transaction_pay_from_component(account_address, 200_000)
-            .publish_template(vec![1, 2, 3])
+            .publish_template(vec![1, 2, 3].try_into().unwrap())
             .build_and_seal(&account_key),
         vec![owner_proof],
     );
@@ -83,7 +83,7 @@ fn publish_template_too_big_binary() {
     let result = test.execute_expect_failure(
         Transaction::builder()
             .fee_transaction_pay_from_component(account_address, 200_000)
-            .publish_template(random_wasm_binary)
+            .publish_template(random_wasm_binary.try_into().unwrap())
             .build_and_seal(&account_key),
         vec![owner_proof],
     );
diff --git a/crates/engine_types/src/limits.rs b/crates/engine_types/src/limits.rs
index 8d0bf18427..bbb1ba8a65 100644
--- a/crates/engine_types/src/limits.rs
+++ b/crates/engine_types/src/limits.rs
@@ -28,6 +28,7 @@ pub struct EngineLimits {
     pub max_log_size_bytes: usize,
     pub max_events: usize,
     pub max_panic_message_size: usize,
+    pub max_template_binary_size_bytes: usize,
 }
 
 pub const ENGINE_LIMITS: EngineLimits = EngineLimits {
@@ -38,7 +39,8 @@ pub const ENGINE_LIMITS: EngineLimits = EngineLimits {
     max_logs: 256,
     max_log_size_bytes: 32 * 1024, // 32 KiB
     max_events: 256,
-    max_panic_message_size: 32 * 1024, // 32 KiB
+    max_panic_message_size: 32 * 1024,               // 32 KiB
+    max_template_binary_size_bytes: 2 * 1024 * 1024, // 2 MiB
 };
 
 pub const MAX_DIVISIBILITY: u8 = 18;
diff --git a/crates/p2p/src/conversions/transaction.rs b/crates/p2p/src/conversions/transaction.rs
index c6cfb92235..985963547c 100644
--- a/crates/p2p/src/conversions/transaction.rs
+++ b/crates/p2p/src/conversions/transaction.rs
@@ -246,7 +246,10 @@ impl TryFrom<proto::transaction::Instruction> for Instruction {
                     .context("take_from_bucket_output_bucket overflowed")?,
             }),
             Some(PublishTemplate(publish_template)) => Ok(Instruction::PublishTemplate {
-                binary: publish_template.binary,
+                binary: publish_template
+                    .binary
+                    .try_into()
+                    .map_err(|_| anyhow!("publish_template_binary: binary size too large"))?,
             }),
             Some(AllocateAddress(allocate_addr)) => {
                 let address_type = allocate_addr.address_type();
@@ -403,7 +406,9 @@ impl From<Instruction> for proto::transaction::Instruction {
             },
             Instruction::PublishTemplate { binary } => proto::transaction::Instruction {
                 instruction: Some(proto::transaction::instruction::Instruction::PublishTemplate(
-                    proto::transaction::PublishTemplate { binary },
+                    proto::transaction::PublishTemplate {
+                        binary: binary.into_vec(),
+                    },
                 )),
             },
             Instruction::AllocateAddress {
diff --git a/crates/template_lib_types/src/max_bytes.rs b/crates/template_lib_types/src/max_bytes.rs
index 7c6d738635..8e626c85a2 100644
--- a/crates/template_lib_types/src/max_bytes.rs
+++ b/crates/template_lib_types/src/max_bytes.rs
@@ -39,6 +39,10 @@ impl<const N: usize> MaxBytes<N> {
     pub fn empty() -> Self {
         Self { bytes: Box::new([]) }
     }
+
+    pub fn as_slice(&self) -> &[u8] {
+        &self.bytes
+    }
 }
 
 impl<const N: usize> AsRef<[u8]> for MaxBytes<N> {
@@ -68,6 +72,14 @@ impl<const N: usize> TryFrom<Vec<u8>> for MaxBytes<N> {
     }
 }
 
+impl<const N: usize> TryFrom<Box<[u8]>> for MaxBytes<N> {
+    type Error = ();
+
+    fn try_from(value: Box<[u8]>) -> Result<Self, Self::Error> {
+        Self::new_checked(value).ok_or(())
+    }
+}
+
 impl<const N: usize> From<MaxBytes<N>> for Vec<u8> {
     fn from(value: MaxBytes<N>) -> Self {
         value.into_vec()
diff --git a/crates/template_manager/src/implementation/service.rs b/crates/template_manager/src/implementation/service.rs
index 5e068ddb2b..f3c6ec44ef 100644
--- a/crates/template_manager/src/implementation/service.rs
+++ b/crates/template_manager/src/implementation/service.rs
@@ -399,8 +399,7 @@ where
                     }
 
                     self.manager.add_pending_template(
-                        // Once we download the template we'll extract the name. This saves us from having to store the
-                        // name in the substate
+                        // Once we download the template we'll extract the name.
                         "<unknown>".to_string(),
                         template_address.as_hash(),
                         author_public_key,
diff --git a/crates/template_test_tooling/src/template_test.rs b/crates/template_test_tooling/src/template_test.rs
index ab8c1b1c5c..3f6efbdb6a 100644
--- a/crates/template_test_tooling/src/template_test.rs
+++ b/crates/template_test_tooling/src/template_test.rs
@@ -22,7 +22,7 @@ use tari_engine::{
     runtime::{AuthParams, RuntimeModule},
     state_store::{memory::MemoryStateStore, StateWriter},
     template::LoadedTemplate,
-    transaction::{TransactionError, TransactionProcessor, TransactionProcessorConfig},
+    transaction::{TransactionError, TransactionProcessor},
     wasm::LoadedWasmTemplate,
 };
 use tari_engine_types::{
@@ -32,12 +32,7 @@ use tari_engine_types::{
     virtual_substate::{VirtualSubstate, VirtualSubstateId, VirtualSubstates},
     ToByteType,
 };
-use tari_ootle_common_types::{
-    crypto::create_key_pair_from_seed,
-    substate_type::SubstateType,
-    Network,
-    SubstateRequirement,
-};
+use tari_ootle_common_types::{crypto::create_key_pair_from_seed, substate_type::SubstateType, SubstateRequirement};
 use tari_template_builtin::all_builtin_templates;
 use tari_template_lib::{
     constants::{NFT_FAUCET_COMPONENT_ADDRESS, XTR_FAUCET_COMPONENT_ADDRESS},
@@ -597,7 +592,6 @@ impl TemplateTest {
         };
 
         let processor = TransactionProcessor::new(
-            TransactionProcessorConfig::new(Network::LocalNet),
             Arc::new(self.package.clone()),
             self.state_store.clone().into_read_only(),
             auth_params,
diff --git a/crates/transaction/src/builder/mod.rs b/crates/transaction/src/builder/mod.rs
index 15d19f84c3..7f474b41b4 100644
--- a/crates/transaction/src/builder/mod.rs
+++ b/crates/transaction/src/builder/mod.rs
@@ -37,6 +37,7 @@ use crate::{
     ComponentCall,
     Instruction,
     ResourceAddressRef,
+    TemplateBlob,
     Transaction,
     TransactionSignature,
     UnsealedTransactionV1,
@@ -286,7 +287,7 @@ impl TransactionBuilder {
     }
 
     /// Publishing a WASM template.
-    pub fn publish_template(self, binary: Vec<u8>) -> Self {
+    pub fn publish_template(self, binary: TemplateBlob) -> Self {
         self.add_instruction(Instruction::PublishTemplate { binary })
     }
 
diff --git a/crates/transaction/src/transaction.rs b/crates/transaction/src/transaction.rs
index 1fdca1b33d..3e82756f78 100644
--- a/crates/transaction/src/transaction.rs
+++ b/crates/transaction/src/transaction.rs
@@ -301,7 +301,6 @@ mod tests {
     use tari_crypto::{
         keys::{PublicKey as _, SecretKey},
         ristretto::{RistrettoPublicKey, RistrettoSecretKey},
-        tari_utilities::ByteArray,
     };
     use tari_engine_types::ToByteType;
     use tari_ootle_common_types::crypto::create_key_pair;
@@ -329,7 +328,7 @@ mod tests {
                 ComponentAddress::from_array([1; 32])
             ])
             .put_last_instruction_output_on_workspace("workspace")
-            .publish_template(b"template".to_vec())
+            .publish_template(b"template".to_vec().try_into().unwrap())
             .add_input(SubstateRequirement::versioned(
                 SubstateId::Component(ComponentAddress::from_array([1; 32])),
                 1,
diff --git a/crates/transaction/src/v1/instruction.rs b/crates/transaction/src/v1/instruction.rs
index 1290f591f5..f24c2fd060 100644
--- a/crates/transaction/src/v1/instruction.rs
+++ b/crates/transaction/src/v1/instruction.rs
@@ -7,6 +7,7 @@ use serde::{Deserialize, Serialize};
 use tari_engine_types::{
     confidential::{ClaimBurnOutputData, MinotariBurnClaimProof},
     limits,
+    serde_with,
     ValidatorFeePoolAddress,
 };
 use tari_template_lib::{
@@ -14,7 +15,7 @@ use tari_template_lib::{
     auth::OwnerRule,
     models::{ResourceAddress, StealthTransferStatement},
     prelude::{AccessRules, Amount},
-    types::{crypto::RistrettoPublicKeyBytes, MaxString, TemplateAddress},
+    types::{crypto::RistrettoPublicKeyBytes, MaxBytes, MaxString, TemplateAddress},
 };
 
 use crate::{
@@ -24,6 +25,8 @@ use crate::{
     ResourceAddressRef,
 };
 
+pub type TemplateBlob = MaxBytes<{ limits::ENGINE_LIMITS.max_template_binary_size_bytes }>;
+
 #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, borsh::BorshSerialize)]
 #[cfg_attr(feature = "ts", derive(ts_rs::TS), ts(export))]
 pub enum Instruction {
@@ -77,7 +80,9 @@ pub enum Instruction {
         output_bucket: WorkspaceId,
     },
     PublishTemplate {
-        binary: Vec<u8>,
+        #[cfg_attr(feature = "ts", ts(type = "string"))]
+        #[serde(with = "serde_with::base64")]
+        binary: TemplateBlob,
     },
     AllocateAddress {
         allocatable_type: AllocatableAddressType,
@@ -262,7 +267,9 @@ mod tests {
         let decoded: Instruction = serde_json::from_str(&json).unwrap();
         assert_eq!(instruction, decoded);
 
-        let instruction = Instruction::PublishTemplate { binary: vec![1, 2, 3] };
+        let instruction = Instruction::PublishTemplate {
+            binary: vec![1, 2, 3].try_into().unwrap(),
+        };
         let json = serde_json::to_string(&instruction).unwrap();
         let decoded: Instruction = serde_json::from_str(&json).unwrap();
         assert_eq!(instruction, decoded);