Security context

Highlights

Denial of Service: 147 prior fixes. Scrutinize any change in this area.

chia/full_node/full_node_api.py: most-fixed (17 issues). Treat as high-risk during review.

146 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Denial of Service: Deserialization of peer-supplied streams is a major historical denial of service vector, with issues ranging from unbounded memory allocation during list parsing to lack of strict deserialization bounds checking. Failure to enforce trailing-byte validation and dynamic item limits allows malicious peers to craft payload structures (like zip bombs or oversized structures) that trigger memory exhaustion.

Auth Bypass: Consensus rules are highly sensitive to validation logic errors. Historically, bugs such as incorrect genesis hash comparisons, missing Infused Challenge Chain VDF checks, and mismatched plot filter validation outputs allowed malicious blocks to bypass validation. Ensuring rigorous, consistent signature and VDF verification across all header paths is paramount.

Denial of Service: Unbounded inbound network traffic and unsolicited block/transaction responses regularly threatened to exhaust node socket resources and event loop capacity. Implementing sliding-window rate limiting, peer subscription limits, and disconnecting non-compliant nodes are vital safeguards against network-level exhaustion.