Skip to content

fix(#83): deprecate get_pending_verifications - #87

Open
Jerry-Tekh wants to merge 3 commits into
ecotask-network:mainfrom
Jerry-Tekh:main
Open

fix(#83): deprecate get_pending_verifications#87
Jerry-Tekh wants to merge 3 commits into
ecotask-network:mainfrom
Jerry-Tekh:main

Conversation

@Jerry-Tekh

@Jerry-Tekh Jerry-Tekh commented Aug 26, 2026

Copy link
Copy Markdown

closes #83. get_pending_verifications now panics immediately with engine: use get_pending_verifications_paged. All internal tests migrated to the paged variant.

Jerry-Tekh and others added 3 commits August 26, 2026 15:54
- get_pending_verifications now panics immediately with 'engine: use get_pending_verifications_paged'
- Added deprecation doc comment pointing to paged variant
- Migrated all test references to get_pending_verifications_paged
- Updated CHANGELOG.md and README.md
- Add MAX_PAGE_SIZE constant (50) to task-registry and reward-engine storage
- list_tasks rejects limit > 50 with descriptive panic
- get_tasks_by_creator_paged rejects limit > 50 with descriptive panic
- get_pending_verifications_paged rejects limit > 50 with descriptive panic
- get_verifications_by_user rejects limit > 50 with descriptive panic
- get_pending_verifications now iterates the pending list directly
  instead of delegating to collect_pending, so the unbounded getter
  still returns every pending entry
- Update existing tests to use valid limit values
- Add should_panic tests confirming the cap is enforced

Fixes denial-of-service / budget-exhaustion vector where u32::MAX
would iterate every task/verification in one transaction.
- reward-engine: change get_pending_verifications_paged limits from 1000 to 50
- integration test: change get_pending_verifications_paged limit from 1000 to 50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

get_pending_verifications() is an unbounded public function — no deprecation notice, no guard, unlimited reads

1 participant