Native scripts nested past about 660 levels break getUtxos

未关闭
  • 哪里不对？
#684 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
5/5
预计耗时
一周以上
新手友好度
35/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
typescript
领域
api, backend

调研方向

Start with NativeScripts.ts:335-359 and NativeScripts.ts:368,423,432,441 to trace recursive validation and decoding; compare the cold and warmed depth measurements in the issue. Then inspect the listed provider call sites and error handlers in BlockfrostEffect.ts, Koios.ts, KoiosEffect.ts, Maestro.ts, and KupmiosEffects.ts. Done means ledger sized scripts decode in linear time and provider read failures surface as ProviderError; the issue names no test file.

由索引模型根据 Issue 内容生成。

描述

bug

NativeScripts.fromCBORHex("820181".repeat(670) + "820400"), an all script nested 670 levels deep in 2,013 bytes, throws RangeError: Maximum call stack size exceeded on a first call in a fresh process. At 660 levels it decodes. Once the code is warm, 1,200 levels decode and 2,500 fail. Decoding time grows with the square of the depth: 0.2 s at 100 levels, 0.9 s at 200, 2.7 s at 400 and 6.3 s at 600, all wall clock. The limits are the same before and after #677.

With fetch stubbed to return a UTxO whose reference script is such a script nested 2,000 levels, getUtxos fails on Blockfrost, Koios, Maestro and Kupmios. In each case the exit holds the RangeError as a defect, an untyped failure, not a ProviderError, so catchAll handlers never see it.

NativeScripts.FromCDDL (NativeScripts.ts:368) type-checks its input against the recursive CDDLSchema union (NativeScripts.ts:335-359) and its output against NativeScript. It decodes each nested script with a fresh ParseResult.decode(FromCDDL) (NativeScripts.ts:423, 432, 441), which type-checks that subtree again. Each level adds call frames to one recursion and repeats the checks for everything below it. The providers call the decoder inside Effect.map or Effect.gen bodies, where a thrown error becomes a defect that Effect.catchAll does not catch:

  • Blockfrost: BlockfrostEffect.ts:190-195, past the handlers at BlockfrostEffect.ts:306 and BlockfrostEffect.ts:345
  • Koios: Koios.ts:215, called from Koios.ts:257, past KoiosEffect.ts:94
  • Maestro: Maestro.ts:307, called from MaestroEffect.ts:104
  • Kupmios: KupmiosEffects.ts:131-139, past KupmiosEffects.ts:156

The ledger decodes native scripts with no depth limit (cardano-ledger d0e20888, Allegra/Scripts.hs:226-236; Conway uses the same Timelock type, Conway/Scripts.hs:74). A nested all costs 3 bytes, so one 16,384-byte transaction can create a reference script about 5,400 levels deep. Anyone can put such a script in a UTxO at any address, and getUtxos() then fails for the whole address. #662 describes the same failure for inline datums.

NativeScripts.fromCBORHex should decode any native script the ledger accepts in time linear in its size, and a provider that cannot read a UTxO should fail with a ProviderError.

主要语言
TypeScript
星标
22
派生
33
平均合并
21 小时 38 分钟
30 天内合并 PR
55

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

IntersectMBO/evolution-sdk 的其他 Issue

查看 IntersectMBO/evolution-sdk 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。