fix: bound DomainPort string deserialization and stop swallowing deser failures

[PastaPastaPasta]

Audit finding V048. Fixes an unauthenticated remote memory-amplification DoS in ExtNetInfo deserialization.

Issue

DomainPort::SERIALIZE_METHODS read m_addr as an unbounded std::string. An attacker could declare a multi-megabyte CompactSize length from a few bytes on the wire, forcing allocate-and-zero before any validation ran.

Worse, NetInfoEntry::Unserialize caught ios_base::failure on the Domain branch and merely called Clear(). Swallowing that left the stream position unmoved (or advanced only by the CompactSize) while the enclosing vector loop kept iterating — so a short body amplified a handful of attacker bytes into repeated allocations.

ValidateDomain already enforced the RFC 1035 253-byte ceiling, but only after decode, which is too late to prevent the allocation.

Fix

• Move DOMAIN_MAX_LEN (253) from netinfo.cpp to netinfo.h and apply it at the serialization layer via LIMITED_STRING, so an oversized claim is rejected before allocation. ValidateDomain still enforces the same ceiling after decode.
• Stop swallowing ios_base::failure on the Domain branch; let it propagate so the entire ProTx payload is rejected rather than the loop continuing over a desynchronized stream.

Test

test: prove DomainPort unbounded string deserialization DoS precedes the fix and fails without it.

Review notes

• Scope is confined to src/evo/netinfo.{cpp,h} plus its unit test.
• The removed catch is the behavioral change most worth a second look: callers now see a throw where they previously got a silently-cleared entry. Reviewed as correct — a truncated domain body is not a recoverable condition, and the sibling Service branch keeps its catch because a failed CService deser does not desynchronize the stream the same way.
• Based on dashpay/dash develop @ 6d04c60ef36. Not rebase-tested against any newer tip; full functional suite not run.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2a8125c9-1a85-49dc-8598-36e4e73f8941

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sec/v048

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}