From 076a330416da7086248c1fca865159014b88e1d1 Mon Sep 17 00:00:00 2001 From: spencer-tb Date: Fri, 27 Mar 2026 12:05:08 +0000 Subject: [PATCH] core/types/bal: fix off-by-one in balance change index bounds check The balance change index validation used > blockTxCount+2 which allowed index blockTxCount+2 (out of bounds). Changed to >= to match the nonce, code, and storage change checks. Valid BAL indices are 0..blockTxCount+1. Index blockTxCount+2 is beyond the system transaction index and must be rejected. Found by test_bal_invalid_extraneous_entries[out_of_bounds-extra_balance] in bal@v5.5.1 fixtures. --- core/types/bal/bal_encoding.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/types/bal/bal_encoding.go b/core/types/bal/bal_encoding.go index 0029d5d668..6f1c6187ed 100644 --- a/core/types/bal/bal_encoding.go +++ b/core/types/bal/bal_encoding.go @@ -367,7 +367,7 @@ func (e *AccountAccess) validate(blockTxCount int) error { return errors.New("balance changes not in ascending order by tx index") } - if len(e.BalanceChanges) > 0 && int(e.BalanceChanges[len(e.BalanceChanges)-1].TxIdx) > blockTxCount+2 { + if len(e.BalanceChanges) > 0 && int(e.BalanceChanges[len(e.BalanceChanges)-1].TxIdx) >= blockTxCount+2 { return errors.New("highest balance change index beyond what is allowed") } // check that the balance values are set and there are no duplicate index entries