From 96abe9d1c72baac567020a20f4fdb3538bef32f5 Mon Sep 17 00:00:00 2001
From: Eric <45141191+zlacfzy@users.noreply.github.com>
Date: Thu, 25 Apr 2024 14:05:12 +0800
Subject: [PATCH] eth/gasprice: add query limit to defend DDOS attack (#2423)

---
 eth/gasprice/feehistory.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/eth/gasprice/feehistory.go b/eth/gasprice/feehistory.go
index d82c251cd..1dfd39792 100644
--- a/eth/gasprice/feehistory.go
+++ b/eth/gasprice/feehistory.go
@@ -42,6 +42,7 @@ const (
 	// maxBlockFetchers is the max number of goroutines to spin up to pull blocks
 	// for the fee history calculation (mostly relevant for LES).
 	maxBlockFetchers = 4
+	maxQueryLimit    = 100
 )
 
 // blockFees represents a single block for processing
@@ -199,6 +200,9 @@ func (oracle *Oracle) FeeHistory(ctx context.Context, blocks int, unresolvedLast
 	if len(rewardPercentiles) != 0 {
 		maxFeeHistory = oracle.maxBlockHistory
 	}
+	if len(rewardPercentiles) > maxQueryLimit {
+		return common.Big0, nil, nil, nil, fmt.Errorf("%w: over the query limit %d", errInvalidPercentile, maxQueryLimit)
+	}
 	if blocks > maxFeeHistory {
 		log.Warn("Sanitizing fee history length", "requested", blocks, "truncated", maxFeeHistory)
 		blocks = maxFeeHistory