Skip to content

feat(onchain): add BatchTooLarge guard to batch_create_packages#321

Open
ifygreg01-best wants to merge 1 commit into
ChainForgee:mainfrom
ifygreg01-best:feat/batch-too-large-guard
Open

feat(onchain): add BatchTooLarge guard to batch_create_packages#321
ifygreg01-best wants to merge 1 commit into
ChainForgee:mainfrom
ifygreg01-best:feat/batch-too-large-guard

Conversation

@ifygreg01-best

Copy link
Copy Markdown

Summary

batch_create_packages had no upper bound on the number of packages per call. With gas profiling confirming calls up to N=200, an unbounded batch is a clear DoS vector on testnet.

This PR adds a configurable cap and a new error variant that fires before any allocation.

Changes

src/lib.rs

  • Config.max_batch_size: u32 — new field, defaults to 100, admin-configurable up to 1000 via set_config
  • Error::BatchTooLarge = 19 — new error variant
  • batch_create_packages — guard added immediately after the mismatched-arrays check; returns BatchTooLarge before token validation, balance reads, or any storage write
  • set_config — validates max_batch_size is in range [1, 1000]; returns Error::InvalidAmount otherwise
  • init / get_config fallback — both default to max_batch_size: 100

tests/batch.rs

  • Added test_batch_too_large_returns_error_and_writes_zero_rows: raises cap to 1000, submits 1001 packages with sufficient balance, asserts BatchTooLarge is returned, and confirms no package was written to storage.

All other test files

  • Updated every Config { ... } literal to include max_batch_size: 100 (aid_escrow_tests.rs, boundary_validation_tests.rs, gas_profiling.rs, integration.rs).

Acceptance Criteria

  • Error::BatchTooLarge returned before any allocation when batch exceeds cap
  • CONTRACT_MAX_BATCH_SIZE defaults to 100, configurable to 1000 via admin
  • Test asserts request for 1001 packages returns BatchTooLarge and writes zero rows
  • Existing batch tests unchanged

Copy link
Copy Markdown
Contributor

Hi 👋 Appreciate this PR! The CI is flagging a failing check — could you take a peek at the failed job and push a fix? Happy to help if you need a hand 🙏

Both branches claimed discriminant 19. Resolved by:
- Keeping AllowlistExpired = 19 (from main)
- Assigning BatchTooLarge = 20 (from feat/batch-too-large-guard)
- Adding max_batch_size: u32 field to Config (0 = unlimited)
- Initializing max_batch_size: 0 in initialize()
- Adding batch size guard in batch_create_packages
@ifygreg01-best
ifygreg01-best force-pushed the feat/batch-too-large-guard branch from f367b54 to eeb4570 Compare July 18, 2026 19:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants