fix: limit allowed thawing period range in the subgraph service (OZ M-01)

Signed-off-by: Tomás Migone <tomas@edgeandnode.com>

Author: tmigone

packages/subgraph-service/contracts/SubgraphService.sol

@@ -431,12 +431,14 @@ contract SubgraphService is
     // -- Data service parameter getters --
     /**
      * @notice Getter for the accepted thawing period range for provisions
+     * The accepted range is just the dispute period defined by {DisputeManager-getDisputePeriod}
      * @dev This override ensures {ProvisionManager} uses the thawing period from the {DisputeManager}
-     * @return The minimum thawing period which is defined by {DisputeManager-getDisputePeriod}
-     * @return The maximum is unbounded
+     * @return The minimum thawing period - the dispute period
+     * @return The maximum thawing period - the dispute period
      */
     function _getThawingPeriodRange() internal view override returns (uint64, uint64) {
-        return (_disputeManager().getDisputePeriod(), DEFAULT_MAX_THAWING_PERIOD);
+        uint64 disputePeriod = _disputeManager().getDisputePeriod();
+        return (disputePeriod, disputePeriod);
     }
 
     /**

packages/subgraph-service/test/subgraphService/provision/accept.t.sol

@@ -17,14 +17,19 @@ contract SubgraphServiceProvisionAcceptTest is SubgraphServiceTest {
         uint256 tokens,
         uint32 newVerifierCut,
         uint64 newDisputePeriod
-    ) public useIndexer {
+    ) public {
         tokens = bound(tokens, minimumProvisionTokens, MAX_TOKENS);
         vm.assume(newVerifierCut >= fishermanRewardPercentage);
         vm.assume(newVerifierCut <= MAX_PPM);
-        newDisputePeriod = uint64(bound(newDisputePeriod, disputePeriod, MAX_WAIT_PERIOD));
+        newDisputePeriod = uint64(bound(newDisputePeriod, 1, MAX_WAIT_PERIOD));
+
+        // Set the dispute period to the new value
+        resetPrank(users.governor);
+        disputeManager.setDisputePeriod(newDisputePeriod);
 
         // Setup indexer
-        _createProvision(users.indexer, tokens, fishermanRewardPercentage, disputePeriod);
+        resetPrank(users.indexer);
+        _createProvision(users.indexer, tokens, fishermanRewardPercentage, newDisputePeriod);
         _register(users.indexer, abi.encode("url", "geoHash", address(0)));
 
         // Update parameters with new values
@@ -38,14 +43,19 @@ contract SubgraphServiceProvisionAcceptTest is SubgraphServiceTest {
         uint256 tokens,
         uint32 newVerifierCut,
         uint64 newDisputePeriod
-    ) public useIndexer {
+    ) public {
         tokens = bound(tokens, minimumProvisionTokens, MAX_TOKENS);
         vm.assume(newVerifierCut >= fishermanRewardPercentage);
         vm.assume(newVerifierCut <= MAX_PPM);
-        newDisputePeriod = uint64(bound(newDisputePeriod, disputePeriod, MAX_WAIT_PERIOD));
+        newDisputePeriod = uint64(bound(newDisputePeriod, 1, MAX_WAIT_PERIOD));
+
+        // Set the dispute period to the new value
+        resetPrank(users.governor);
+        disputeManager.setDisputePeriod(newDisputePeriod);
 
         // Setup indexer but dont register
-        _createProvision(users.indexer, tokens, fishermanRewardPercentage, disputePeriod);
+        resetPrank(users.indexer);
+        _createProvision(users.indexer, tokens, fishermanRewardPercentage, newDisputePeriod);
 
         // Update parameters with new values
         _setProvisionParameters(users.indexer, address(subgraphService), newVerifierCut, newDisputePeriod);
@@ -114,7 +124,7 @@ contract SubgraphServiceProvisionAcceptTest is SubgraphServiceTest {
                 "thawingPeriod",
                 newDisputePeriod,
                 disputePeriod,
-                type(uint64).max
+                disputePeriod
             )
         );
         subgraphService.acceptProvisionPendingParameters(users.indexer, "");