Extra labels: security, abuse
Tier: M (2-4 days) | Type: feature + security
Context. Nothing today prevents a single sender from spamming stealth-sender with thousands of announcements per ledger. That inflates event storage costs for indexers and lets a hostile sender bloat scan targets for a specific recipient.
Scope.
- Ledger-window rate limit per sender (e.g. max N announcements per K ledgers, configurable by admin).
- Reject with a dedicated error when exceeded.
- Configurable rate stored in
Config storage.
- Doc trade-off in
PERF.md (real senders unaffected; hostile sender kept in check).
Acceptance.
Files. stealth-sender/src/lib.rs, stealth-sender/src/rate_limit.rs (new), PERF.md.
Extra labels:
security,abuseTier: M (2-4 days) | Type: feature + security
Context. Nothing today prevents a single sender from spamming
stealth-senderwith thousands of announcements per ledger. That inflates event storage costs for indexers and lets a hostile sender bloat scan targets for a specific recipient.Scope.
Configstorage.PERF.md(real senders unaffected; hostile sender kept in check).Acceptance.
cargo test --workspaceset_rate_limit(behind timelock Security audit ofstealth-senderSoroban contract #3)PERF.mddocuments chosen defaults + rationaleFiles.
stealth-sender/src/lib.rs,stealth-sender/src/rate_limit.rs(new),PERF.md.