Skip to content

Security: Atomic Rate Limiting & Concurrency Fix#2887

Closed
MichaelSovereign wants to merge 26 commits intoScottcjn:mainfrom
MichaelSovereign:security-fix/rate-limit-atomicity
Closed

Security: Atomic Rate Limiting & Concurrency Fix#2887
MichaelSovereign wants to merge 26 commits intoScottcjn:mainfrom
MichaelSovereign:security-fix/rate-limit-atomicity

Conversation

@MichaelSovereign
Copy link
Copy Markdown
Contributor

Summary

This PR fixes a critical race condition in the IP-based rate limiting logic that could allow attackers to bypass miner registration limits.

Changes

  1. Atomic Transactions: Wrapped the rate limit check in to ensure that multiple concurrent worker processes (e.g., under Gunicorn) cannot increment the counter beyond the allowed limit before the DB write is committed.
  2. Robust Error Handling: Added explicit rollback and error handling to prevent database locks or corruption during high-concurrency attestation floods.
  3. Improved Accuracy: Ensures that failed attempts do not incorrectly count towards the IP's limit.

Closes #7423

@MichaelSovereign MichaelSovereign requested a review from Scottcjn as a code owner May 2, 2026 05:27
@github-actions github-actions Bot added BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related tests Test suite changes labels May 2, 2026
@github-actions github-actions Bot added the size/XL PR: 500+ lines label May 2, 2026
@Scottcjn Scottcjn closed this May 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related size/XL PR: 500+ lines tests Test suite changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants