fix(ws): cap subscribeFiatRates tokens array length#1623
Merged
Conversation
The subscribeFiatRates handler stored the request's tokens slice whole for the connection lifetime and re-iterated it on every fiat-rate broadcast (per subscribed currency) while holding the global fiatRatesSubscriptionsLock. It was the only WebSocket list parameter without a length cap: a single message up to the 4 MiB read limit could carry ~10^6 token strings, enabling amplified heap retention and periodic global-lock contention that stalls fiat-rate subscription handling. Reject requests whose tokens array exceeds maxWebsocketSubscribeFiatRatesTokens (1000) with a public API error, matching the existing caps on addresses, currencies, timestamps, and estimateFee blocks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
pragmaxim
approved these changes
Jul 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
subscribeFiatRatesWebSocket handler accepted atokensarray of any length. It was the only list parameter in the WebSocket API without a bound — addresses (≤1000/100), currencies (≤128), timestamps (≤1000), andestimateFeeblocks (≤32) are all capped.The subscribed token list is retained for the lifetime of the connection and re-iterated on every fiat-rate broadcast (per subscribed currency) while the fiat-rates subscription lock is held, so leaving it unbounded lets a single request pin a large amount of memory and add avoidable work to each broadcast.
Change
maxWebsocketSubscribeFiatRatesTokens = 1000and reject requests exceeding it with a publictokens max 1000API error, before the list is stored — consistent with the existing caps on the other list parameters.Testing
go test -tags unittest ./server/ -run Test_WebsocketFiatRates— passes.🤖 Generated with Claude Code