Skip to content

fix: enforce max 100 active tournament escrows per player - #927

Open
Davichi-1 wants to merge 1 commit into
OpenKnight-Foundation:mainfrom
Davichi-1:fix/SC-20-max-escrows-per-player
Open

fix: enforce max 100 active tournament escrows per player#927
Davichi-1 wants to merge 1 commit into
OpenKnight-Foundation:mainfrom
Davichi-1:fix/SC-20-max-escrows-per-player

Conversation

@Davichi-1

Copy link
Copy Markdown
Contributor

Overview

This PR adds a maximum cap on active tournament escrows per player to prevent storage bloat attacks. A malicious user could otherwise spam create_tournament_escrow to bloat contract storage and increase fees for everyone.

Related Issue

Closes #864

Changes

📈 Active Escrow Cap Enforcement

  • [ADD] PLAYER_ACTIVE_ESCROWS storage key – a Map<Address, u32> tracking per-player active escrow count
  • [ADD] MAX_ACTIVE_ESCROWS = 100 constant – maximum allowed active escrows per unique user address
  • [ADD] player: Address field to TournamentEscrow struct to associate each escrow with its creator
  • [ADD] MaxActiveEscrowsExceeded = 39 error variant
  • [MODIFY] create_tournament_escrow – checks the per-player cap before creating, increments count on success
  • [MODIFY] release_tournament_escrow – decrements the player's count upon release

Verification Results

cargo build -p game_contract
✅ Compiled successfully

cargo test -p game_contract
✅ 65/65 tests passed

Acceptance Criteria

Criterion Status
Enforce a maximum cap (e.g., 100) on active escrows per unique user address ✅ Implemented with MAX_ACTIVE_ESCROWS = 100
Prevent storage bloat from create_tournament_escrow spam ✅ Per-player counter checked before each escrow creation
Active count decremented when escrow is released ✅ Count updated in release_tournament_escrow

Add a MAX_ACTIVE_ESCROWS cap (100) to prevent storage bloat attacks
via create_tournament_escrow spam. Tracks per-player active escrow
count in a separate Map<Address, u32>, incrementing on creation and
decrementing on release. Adds the player Address field to the
TournamentEscrow struct to facilitate count management on release.

Closes OpenKnight-Foundation#864
@drips-wave

drips-wave Bot commented Jul 30, 2026

Copy link
Copy Markdown

@Davichi-1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@chinweobtagaz

Copy link
Copy Markdown
Contributor

@Davichi-1 conflicts

@chinweobtagaz

Copy link
Copy Markdown
Contributor

@Davichi-1 please resolve conflicts

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SC-20: Validate maximum active escrows per player to prevent storage bloat attacks

2 participants