From 4408ba2d7e4098de41e8c2a9725eeb2b37702ece Mon Sep 17 00:00:00 2001
From: Eric <45141191+zlacfzy@users.noreply.github.com>
Date: Thu, 25 Apr 2024 14:05:12 +0800
Subject: [PATCH] eth/gasprice: add query limit for FeeHistory to defend DDOS
 attack

---
 eth/gasprice/feehistory.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/eth/gasprice/feehistory.go b/eth/gasprice/feehistory.go
index 0410ae6b2d..70586bfa67 100644
--- a/eth/gasprice/feehistory.go
+++ b/eth/gasprice/feehistory.go
@@ -44,6 +44,7 @@ const (
 	// maxBlockFetchers is the max number of goroutines to spin up to pull blocks
 	// for the fee history calculation (mostly relevant for LES).
 	maxBlockFetchers = 4
+	maxQueryLimit    = 100
 )
 
 // blockFees represents a single block for processing
@@ -240,6 +241,9 @@ func (oracle *Oracle) FeeHistory(ctx context.Context, blocks uint64, unresolvedL
 	if len(rewardPercentiles) != 0 {
 		maxFeeHistory = oracle.maxBlockHistory
 	}
+	if len(rewardPercentiles) > maxQueryLimit {
+		return common.Big0, nil, nil, nil, fmt.Errorf("%w: over the query limit %d", errInvalidPercentile, maxQueryLimit)
+	}
 	if blocks > maxFeeHistory {
 		log.Warn("Sanitizing fee history length", "requested", blocks, "truncated", maxFeeHistory)
 		blocks = maxFeeHistory