feat(onchain): add BatchTooLarge guard to batch_create_packages#321
Open
ifygreg01-best wants to merge 1 commit into
Open
feat(onchain): add BatchTooLarge guard to batch_create_packages#321ifygreg01-best wants to merge 1 commit into
ifygreg01-best wants to merge 1 commit into
Conversation
Contributor
|
Hi 👋 Appreciate this PR! The CI is flagging a failing check — could you take a peek at the failed job and push a fix? Happy to help if you need a hand 🙏 |
Both branches claimed discriminant 19. Resolved by: - Keeping AllowlistExpired = 19 (from main) - Assigning BatchTooLarge = 20 (from feat/batch-too-large-guard) - Adding max_batch_size: u32 field to Config (0 = unlimited) - Initializing max_batch_size: 0 in initialize() - Adding batch size guard in batch_create_packages
ifygreg01-best
force-pushed
the
feat/batch-too-large-guard
branch
from
July 18, 2026 19:35
f367b54 to
eeb4570
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
batch_create_packageshad no upper bound on the number of packages per call. With gas profiling confirming calls up to N=200, an unbounded batch is a clear DoS vector on testnet.This PR adds a configurable cap and a new error variant that fires before any allocation.
Changes
src/lib.rsConfig.max_batch_size: u32— new field, defaults to100, admin-configurable up to1000viaset_configError::BatchTooLarge = 19— new error variantbatch_create_packages— guard added immediately after the mismatched-arrays check; returnsBatchTooLargebefore token validation, balance reads, or any storage writeset_config— validatesmax_batch_sizeis in range[1, 1000]; returnsError::InvalidAmountotherwiseinit/get_configfallback — both default tomax_batch_size: 100tests/batch.rstest_batch_too_large_returns_error_and_writes_zero_rows: raises cap to 1000, submits 1001 packages with sufficient balance, assertsBatchTooLargeis returned, and confirms no package was written to storage.All other test files
Config { ... }literal to includemax_batch_size: 100(aid_escrow_tests.rs,boundary_validation_tests.rs,gas_profiling.rs,integration.rs).Acceptance Criteria
Error::BatchTooLargereturned before any allocation when batch exceeds capCONTRACT_MAX_BATCH_SIZEdefaults to 100, configurable to 1000 via adminBatchTooLargeand writes zero rows