graphprotocol / indexer-rs / 21151146192

68%

Build Type

push

github

Committed by web-flow

Commit Message

Fix some audit medium severity issues (#904)

* fix(service): address issue TRST-M-1

This is about changing a constant name which was confusing
the backend rate limits at 10req per second

* fix(service): add configurable batch size limit for /cost endpoint (TRST-M-7)

Prevents DoS attacks via unbounded input in the costModels GraphQL resolver.

- Add `max_cost_model_batch_size` config option (default: 200)
- Reject requests exceeding the limit with a clear error message
- Add `indexer_cost_model_batch_limit_exceeded_total` metric for observability

Operators can adjust via TOML or env var if serving many subgraphs.

* fix(service): require Horizon mode when DIPS is enabled (TRST-M-8)

DIPS uses V2 escrow accounts from the network subgraph, which requires
Horizon contracts to be deployed. Previously, DIPS would unconditionally
use V2 escrow even in legacy mode, potentially causing silent failures.

- Add startup validation: error if [dips] configured without [horizon].enabled
- Remove unreachable V1 fallback code for DIPS (~30 lines)
- Document the requirement in maximal-config-example.toml

Run Details

12 of 50 new or added lines in 4 files covered. (24.0%)

1 existing line in 1 file now uncovered.

10173 of 14931 relevant lines covered (68.13%)

82.48 hits per line