Problem
/v1/chain/get_accounts_by_authorizers currently returns every matching account permission authority for the supplied accounts or public keys. Unlike other collection endpoints, the request does not accept a result limit or pagination cursor.
A public key with an unusually large authority set can therefore cause the endpoint to perform substantial work, allocate and serialize a very large response, and remain pending for a long time. Clients cannot bound the result set at the nodeos API boundary.
WAX example
The following public key is associated with tens of thousands of accounts on the WAX blockchain:
PUB_K1_5E84rb8xKvRks4iUpQvChnG7F35CJvF3SaGXpEHiEkHTeWkGg9
Example request:
curl -X POST https://<wax-node>/v1/chain/get_accounts_by_authorizers \
-H 'content-type: application/json' \
-d '{
"accounts": [],
"keys": [
"PUB_K1_5E84rb8xKvRks4iUpQvChnG7F35CJvF3SaGXpEHiEkHTeWkGg9"
]
}'Many associated names appear to be small variations or transpositions of other account names. One possible explanation is typo-squatting in the hope that a sender mistypes a recipient. That motivation has not been proven and is not necessary to reproduce the endpoint problem. Regardless of why these accounts exist, one shared key creates a pathological, attacker-influenceable result set.
A downstream client limit does not solve this because nodeos has already traversed, allocated, and serialized the complete result before the client can discard excess rows.
Impact
- A single public key can trigger an unbounded response.
- Public API consumers cannot specify how much work or data they are willing to accept.
- Large authority sets can consume HTTP worker time, CPU, memory, and bandwidth.
- Client disconnection or proxy timeouts may not immediately stop server-side work.
- This creates an availability and resource-amplification concern for public API nodes.
Proposed behavior
Add bounded, server-enforced result handling to get_accounts_by_authorizers:
- Accept an optional caller-supplied
limit.
- Enforce a node-side maximum even when the caller requests a larger value or omits
limit.
- Stop traversing the authority index as soon as the effective limit is reached.
- Return metadata such as
more when results were truncated.
- Consider continuation-cursor pagination and cancellation-aware deadlines as follow-up improvements.
Expected result
Node operators should have a hard upper bound on the work and response size caused by one get_accounts_by_authorizers request. Callers that need fewer results should be able to request a smaller limit.
This supersedes the report filed against the unsupported Leap codebase: AntelopeIO/leap#2417.
Problem
/v1/chain/get_accounts_by_authorizerscurrently returns every matching account permission authority for the supplied accounts or public keys. Unlike other collection endpoints, the request does not accept a result limit or pagination cursor.A public key with an unusually large authority set can therefore cause the endpoint to perform substantial work, allocate and serialize a very large response, and remain pending for a long time. Clients cannot bound the result set at the nodeos API boundary.
WAX example
The following public key is associated with tens of thousands of accounts on the WAX blockchain:
Example request:
Many associated names appear to be small variations or transpositions of other account names. One possible explanation is typo-squatting in the hope that a sender mistypes a recipient. That motivation has not been proven and is not necessary to reproduce the endpoint problem. Regardless of why these accounts exist, one shared key creates a pathological, attacker-influenceable result set.
A downstream client limit does not solve this because nodeos has already traversed, allocated, and serialized the complete result before the client can discard excess rows.
Impact
Proposed behavior
Add bounded, server-enforced result handling to
get_accounts_by_authorizers:limit.limit.morewhen results were truncated.Expected result
Node operators should have a hard upper bound on the work and response size caused by one
get_accounts_by_authorizersrequest. Callers that need fewer results should be able to request a smaller limit.This supersedes the report filed against the unsupported Leap codebase: AntelopeIO/leap#2417.