Skip to content

fix(jsonrpc): enforce maxBlockRange on eth_getFilterLogs#6842

Merged
kuny0707 merged 2 commits into
tronprotocol:release_v4.8.2from
0xbigapple:fix/getfilterlogs-block-range-bypass
Jun 17, 2026
Merged

fix(jsonrpc): enforce maxBlockRange on eth_getFilterLogs#6842
kuny0707 merged 2 commits into
tronprotocol:release_v4.8.2from
0xbigapple:fix/getfilterlogs-block-range-bypass

Conversation

@0xbigapple

@0xbigapple 0xbigapple commented Jun 15, 2026

Copy link
Copy Markdown
Collaborator

What does this PR do?

Applies the jsonRpcMaxBlockRange cap to eth_getFilterLogs, closing a gap where the block-range limit could be bypassed via the filter path.

eth_getLogs builds its LogFilterWrapper with checkBlockRange=true, so the cap is enforced. But eth_newFilter builds the wrapper with checkBlockRange=false, and eth_getFilterLogs reuses that stored wrapper without re-checking — so the cap was never applied when querying logs through a filter. A client could create a filter with a wide range (e.g. fromBlock=0x0, toBlock far ahead) and call eth_getFilterLogs to trigger an unbounded historical scan (CPU/IO pressure, potential OOM).

Changes:

  • Extract the range check from the LogFilterWrapper constructor into a reusable validateBlockRange(currentMaxBlockNum) method (logic and error message unchanged).
  • eth_getFilterLogs now calls validateBlockRange against the current head before scanning, mirroring eth_getLogs.
  • Declare JsonRpcInvalidParamsException on the getFilterLogs impl (the interface and its @JsonRpcError(code=-32602) mapping already declared it).

Creation-time behavior is intentionally left unchanged: eth_newFilter still accepts wide ranges (no creation-time gate), matching geth's "creation accepts, query enforces" model and preserving forward polling via eth_getFilterChanges (which does not scan a range).

Why are these changes required?

Without this, jsonRpcMaxBlockRange only protects eth_getLogs; the eth_newFilter + eth_getFilterLogs path silently bypasses it, leaving a DoS vector on full nodes with JSON-RPC enabled.

This PR has been tested by:

  • Unit Tests
  • Manual Testing

Follow up

Extra details

@github-actions github-actions Bot requested a review from bladehan1 June 15, 2026 07:56
@halibobo1205 halibobo1205 added this to the GreatVoyage-v4.8.2 milestone Jun 15, 2026
@0xbigapple 0xbigapple changed the title fix(jsonrpc): enforce maxBlockRange on eth_getFilterLogs fix(jsonrpc): enforce maxBlockRange and fix reorg receipt consistency Jun 16, 2026
@0xbigapple 0xbigapple force-pushed the fix/getfilterlogs-block-range-bypass branch from 7091ccd to 8b92075 Compare June 17, 2026 05:36
@0xbigapple 0xbigapple changed the title fix(jsonrpc): enforce maxBlockRange and fix reorg receipt consistency fix(jsonrpc): enforce maxBlockRange on eth_getFilterLogs Jun 17, 2026
@0xbigapple 0xbigapple requested a review from bladehan1 June 17, 2026 05:52
@kuny0707 kuny0707 merged commit f40f188 into tronprotocol:release_v4.8.2 Jun 17, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants