Skip to content

discovery-index-contract.ts caps every request-side list but leaves the response candidate list unbounded #6774

Description

@JSONbored

Context

packages/loopover-engine/src/discovery-index-contract.ts:16-18 defines MAX_QUERY_ITEMS/MAX_PAGE_LIMIT = 200, both enforced on the request side (normalizeStringList, clampLimit). But normalizeDiscoveryIndexResponse:220-238, which parses the response from the "OPTIONAL hosted discovery-index service" this file's own header frames as an external, only-partially-trusted boundary ("no raw scores / rewards / wallet / hotkey data / source contents crossing the public boundary"), loops over rawCandidates with no length cap — a misbehaving or compromised discovery-index host can return an arbitrarily large candidates array and every entry gets processed.

Requirements

  • Cap the number of candidates normalizeDiscoveryIndexResponse will accept (reuse MAX_PAGE_LIMIT or add a dedicated MAX_RESPONSE_CANDIDATES), pushing a warning and dropping entries beyond the cap rather than processing an unbounded list.

Deliverables

  • Response-side candidate cap added
  • Regression test asserting an oversized response is truncated with a warning, and nextCursor still round-trips correctly for a truncated page

Test Coverage Requirements

99%+ Codecov patch coverage on every changed line and branch, plus a regression test that reproduces the exact failure mode described above and asserts it's fixed.

Expected Outcome

A misbehaving or compromised discovery-index host can no longer force unbounded processing on the client side.

Links & Resources

packages/loopover-engine/src/discovery-index-contract.ts:6-8,16-18,107-120,140-150,220-238.

Metadata

Metadata

Assignees

No one assigned

    Labels

    gittensor:bugGittensor-scored bug fix — scores a 0.05x multiplier.help wantedExtra attention is needed

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions