Bound block reference parsing depth

[masih]

Limit nested EIP-1898 block references to 16 levels to prevent quadratic parsing time on deeply nested inputs. Add boundary coverage.

Fixes PLT-1083

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.34%. Comparing base (b117536) to head (b684c55).
⚠️ Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/frozen-rpc-router/router.go	80.48%	4 Missing and 4 partials ⚠️
cmd/frozen-rpc-router/main.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4030      +/-   ##
==========================================
- Coverage   61.34%   60.34%   -1.01%     
==========================================
  Files        2163     2064      -99     
  Lines      188757   177173   -11584     
==========================================
- Hits       115792   106912    -8880     
+ Misses      62256    60491    -1765     
+ Partials    10709     9770     -939     

Flag	Coverage Δ
sei-chain-pr	60.63% <80.00%> (?)
sei-db	69.80% <ø> (ø)
sei-db-state-db	?

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
cmd/frozen-rpc-router/config.go	80.95% <100.00%> (+1.46%)	⬆️
cmd/frozen-rpc-router/main.go	0.00% <0.00%> (ø)
cmd/frozen-rpc-router/router.go	64.21% <80.48%> (+0.44%)	⬆️

... and 99 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cursor]

PR Summary

Medium Risk
Changes request parsing on the RPC routing hot path; mis-tuning depth could alter routing for unusually nested block refs, but the change is primarily DoS hardening with a conservative default.

Overview
Adds a configurable cap on how deeply the router unwraps nested EIP-1898 {"blockNumber": ...} objects when parsing block parameters for routing (eth_getLogs, eth_feeHistory, and block-tagged methods).

parseBlockReference is now a router method that iterates with a maxBlockReferenceDepth limit (default 16, flag --max-block-reference-depth) instead of unbounded recursion. References deeper than the limit resolve to an empty reference, which affects upstream selection the same as an unparseable block. Config and newRouter validate that the depth is positive; tests cover flag parsing and the depth boundary.

^{Reviewed by Cursor Bugbot for commit b684c55. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Aug 27, 2026, 11:12 AM

[seidroid]

Converts the recursive EIP-1898 block-reference parser into a loop bounded at 16 nesting levels, removing the quadratic parse cost and stack-depth exposure while keeping over-depth inputs on the existing "unparseable reference routes live" path. The boundary is off-by-one correct and the new test pins both the accepted (16) and rejected (17) cases.

Findings: 0 blocking | 0 non-blocking | 0 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• None at the file/PR level.

[masih]

@seidroid review

[seidroid]

Bounds EIP-1898 block-reference parsing to a configurable nesting depth (default 16), replacing unbounded recursion with a loop; the boundary arithmetic, fallback routing, and validation at both the flag and router construction paths all check out, with test coverage on each. No findings.

Findings: 0 blocking | 0 non-blocking | 0 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• None at the file/PR level.

[seidroid]

Successfully created backport PR for release/v6.6:

• Backport release/v6.6: Bound block reference parsing depth #4034

[seidroid]

Successfully created backport PR for release/v6.7:

• Backport release/v6.7: Bound block reference parsing depth #4035