make limit configurable

server/config/config.go

@@ -63,6 +63,12 @@ const (
 
 	// DefaultReturnDataLimit is maximum number of bytes returned from eth_call or similar invocations
 	DefaultReturnDataLimit = 100000
+
+	// DefaultBatchRequestLimit is maximum number of requests in a batch
+	DefaultBatchRequestLimit = 1000
+
+	// DefaultBatchResponseMaxSize maximum number of bytes returned from a batched call
+	DefaultBatchResponseMaxSize = 25 * 1000 * 1000
 )
 
 var evmTracers = []string{"json", "markdown", "struct", "access_list"}
@@ -126,6 +132,10 @@ type JSONRPCConfig struct {
 	MetricsAddress string `mapstructure:"metrics-address"`
 	// ReturnDataLimit defines maximum number of bytes returned from `eth_call` or similar invocations
 	ReturnDataLimit int64 `mapstructure:"return-data-limit"`
+	// BatchRequestLimit maximum number of requests in a batch
+	BatchRequestLimit int64 `mapstructure:"batch-request-limit"`
+	// BatchResponseMaxSize maximum number of bytes returned from a batched call
+	BatchResponseMaxSize int64 `mapstructure:"batch-response-max-size"`
 	// FixRevertGasRefundHeight defines the upgrade height for fix of revert gas refund logic when transaction reverted
 	FixRevertGasRefundHeight int64 `mapstructure:"fix-revert-gas-refund-height"`
 }
@@ -231,6 +241,8 @@ func DefaultJSONRPCConfig() *JSONRPCConfig {
 		EnableIndexer:            false,
 		MetricsAddress:           DefaultJSONRPCMetricsAddress,
 		ReturnDataLimit:          DefaultReturnDataLimit,
+		BatchRequestLimit:        DefaultBatchRequestLimit,
+		BatchResponseMaxSize:     DefaultBatchResponseMaxSize,
 		FixRevertGasRefundHeight: DefaultFixRevertGasRefundHeight,
 	}
 }
@@ -343,6 +355,8 @@ func GetConfig(v *viper.Viper) (Config, error) {
 			MetricsAddress:           v.GetString("json-rpc.metrics-address"),
 			ReturnDataLimit:          v.GetInt64("json-rpc.return-data-limit"),
 			FixRevertGasRefundHeight: v.GetInt64("json-rpc.fix-revert-gas-refund-height"),
+			BatchRequestLimit:        v.GetInt64("json-rpc.batch-request-limit"),
+			BatchResponseMaxSize:     v.GetInt64("json-rpc.batch-response-max-size"),
 		},
 		TLS: TLSConfig{
 			CertificatePath: v.GetString("tls.certificate-path"),

server/config/toml.go

@@ -80,6 +80,12 @@ metrics-address = "{{ .JSONRPC.MetricsAddress }}"
 # Maximum number of bytes returned from eth_call or similar invocations.
 return-data-limit = {{ .JSONRPC.ReturnDataLimit }}
 
+# Maximum number of requests in a batch.
+batch-request-limit = {{ .JSONRPC.BatchRequestLimit }}
+
+# Maximum number of bytes returned from a batched call.
+batch-response-max-size = {{ .JSONRPC.BatchResponseMaxSize }}
+
 # Upgrade height for fix of revert gas refund logic when transaction reverted.
 fix-revert-gas-refund-height = {{ .JSONRPC.FixRevertGasRefundHeight }}
 

server/flags/flags.go

@@ -55,6 +55,8 @@ const (
 	// https://github.com/ethereum/go-ethereum/blob/master/metrics/metrics.go#L35-L55
 	JSONRPCEnableMetrics            = "metrics"
 	JSONRPCReturnDataLimit          = "json-rpc.return-data-limit"
+	JSONRPCBatchRequestLimit        = "json-rpc.batch-request-limit"
+	JSONRPCBatchResponseMaxSize     = "json-rpc.batch-response-max-size"
 	JSONRPCFixRevertGasRefundHeight = "json-rpc.fix-revert-gas-refund-height"
 )
 

server/json_rpc.go

@@ -42,7 +42,7 @@ func StartJSONRPC(ctx *server.Context,
 	}))
 
 	rpcServer := ethrpc.NewServer()
-	rpcServer.SetBatchLimits(2, 1) // add 0x: (3594240 + 2) * 4
+	rpcServer.SetBatchLimits(int(config.JSONRPC.BatchRequestLimit), int(config.JSONRPC.BatchResponseMaxSize)) // add 0x: (3594240 + 2) * 4
 	allowUnprotectedTxs := config.JSONRPC.AllowUnprotectedTxs
 	rpcAPIArr := config.JSONRPC.API
 

tests/integration_tests/configs/exploit.jsonnet

@@ -5,6 +5,8 @@ config {
     'app-config'+: {
       'json-rpc'+: {
         'return-data-limit': 3594241,  // memory_byte_size + 1
+        'batch-request-limit': 2,
+        'batch-response-max-size': 10,
       },
     },
   },