From 4d4883731eeacc8247f1261cfc851c30ad8cae49 Mon Sep 17 00:00:00 2001
From: sashass1315 <sashass1315@gmail.com>
Date: Tue, 10 Feb 2026 16:05:39 +0200
Subject: [PATCH] trie: fix embedded node size validation (#33803)

The `decodeRef` function used `size > hashLen` to reject oversized
embedded nodes, but this incorrectly allowed nodes of exactly 32 bytes
through. The encoding side (hasher.go, stacktrie.go) consistently uses
`len(enc) < 32` to decide whether to embed a node inline, meaning nodes
of 32+ bytes are always hash-referenced. The error message itself
already stated `want size < 32`, confirming the intended threshold.
Changed `size > hashLen` to `size >= hashLen` in `decodeRef` to align
the decoding validation with the encoding logic, the Yellow Paper spec,
and the surrounding comments.
---
 trie/node.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/trie/node.go b/trie/node.go
index 3f14f07d63..bff2d0516a 100644
--- a/trie/node.go
+++ b/trie/node.go
@@ -225,7 +225,7 @@ func decodeRef(buf []byte) (node, []byte, error) {
 	case kind == rlp.List:
 		// 'embedded' node reference. The encoding must be smaller
 		// than a hash in order to be valid.
-		if size := len(buf) - len(rest); size > hashLen {
+		if size := len(buf) - len(rest); size >= hashLen {
 			err := fmt.Errorf("oversized embedded node (size is %d bytes, want size < %d)", size, hashLen)
 			return nil, buf, err
 		}