From 5b56e97be7e0df1a120e425fa266c9c7455f2812 Mon Sep 17 00:00:00 2001
From: Daniel Liu <139250065@qq.com>
Date: Sat, 15 Nov 2025 19:13:01 +0800
Subject: [PATCH] eth: fix potential rpc.BlockNumber overflow, close XFN-69
 (#1736)

---
 eth/api_tracer.go | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/eth/api_tracer.go b/eth/api_tracer.go
index 18e5900756..a65d3d39c4 100644
--- a/eth/api_tracer.go
+++ b/eth/api_tracer.go
@@ -141,6 +141,9 @@ func (api *PrivateDebugAPI) TraceChain(ctx context.Context, start, end rpc.Block
 	case rpc.LatestBlockNumber:
 		from = api.eth.blockchain.CurrentBlock()
 	default:
+		if start.Int64() < 0 {
+			return nil, fmt.Errorf("invalid start block number %d", start.Int64())
+		}
 		from = api.eth.blockchain.GetBlockByNumber(uint64(start))
 	}
 	switch end {
@@ -149,17 +152,20 @@ func (api *PrivateDebugAPI) TraceChain(ctx context.Context, start, end rpc.Block
 	case rpc.LatestBlockNumber:
 		to = api.eth.blockchain.CurrentBlock()
 	default:
+		if end.Int64() < 0 {
+			return nil, fmt.Errorf("invalid end block number %d", end.Int64())
+		}
 		to = api.eth.blockchain.GetBlockByNumber(uint64(end))
 	}
 	// Trace the chain if we've found all our blocks
 	if from == nil {
-		return nil, fmt.Errorf("starting block #%d not found", start)
+		return nil, fmt.Errorf("not find start block %d", start.Int64())
 	}
 	if to == nil {
-		return nil, fmt.Errorf("end block #%d not found", end)
+		return nil, fmt.Errorf("not find end block %d", end.Int64())
 	}
 	if from.Number().Cmp(to.Number()) >= 0 {
-		return nil, fmt.Errorf("end block (#%d) needs to come after start block (#%d)", end, start)
+		return nil, fmt.Errorf("wrong parameter order: start(%d) >= end(%d)", start.Int64(), end.Int64())
 	}
 	return api.traceChain(ctx, from, to, config)
 }
@@ -403,6 +409,9 @@ func (api *PrivateDebugAPI) TraceBlockByNumber(ctx context.Context, number rpc.B
 	case rpc.LatestBlockNumber:
 		block = api.eth.blockchain.CurrentBlock()
 	default:
+		if number.Int64() < 0 {
+			return nil, fmt.Errorf("invalid block number %d", number.Int64())
+		}
 		block = api.eth.blockchain.GetBlockByNumber(uint64(number))
 	}
 	// Trace the block if it was found