fix(evmrpc): bound and validate storageKeys in eth_getProof#3556
Conversation
PR SummaryMedium Risk Overview Requests with more than
Reviewed by Cursor Bugbot for commit 6f79f2a. Bugbot is set up for automated code reviews on this repo. Configure here. |
|
The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3556 +/- ##
==========================================
- Coverage 59.16% 58.28% -0.89%
==========================================
Files 2226 2147 -79
Lines 183561 174604 -8957
==========================================
- Hits 108613 101767 -6846
+ Misses 65167 63773 -1394
+ Partials 9781 9064 -717
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit a5e0b44. Configure here.

Summary
eth_getProofhad two vulnerabilities in itsstorageKeyshandling:common.BytesToHash([]byte(key))instead of being decoded as hex-encoded storage slots. This differs fromGetStorageAt, which already usesdecodeHashto reject malformed input.Changes
MaxStorageKeysPerProof = 1000— requests exceeding this limit are rejected before any store I/O (matches geth's EIP-1186 implementation)common.BytesToHash([]byte(key))withdecodeHash(key)— rejects non-hex strings and correctly interprets hex slot addresses, consistent withGetStorageAtTestGetProofto use properly hex-encoded slot keys; add assertions that malformed keys and oversized key arrays are both rejected