[Security] Unbounded deserialization allows DoS via OOM

[qj0r9j0vc2]

Problem

In crates/consensus/src/validator_set.rs:101, validator set deserialization does not check the size before allocation:

let len = u32::deserialize_reader(reader)? as usize;
let mut validators = Vec::with_capacity(len);  // NO SIZE CHECK

Risk

An attacker can send a malicious payload with len = u32::MAX, causing:

• Out of memory (OOM) crash
• Node denial of service

Solution

Add maximum size validation:

const MAX_VALIDATORS: usize = 10_000;  // or appropriate limit

let len = u32::deserialize_reader(reader)? as usize;
if len > MAX_VALIDATORS {
    return Err(Error::InvalidValidatorSetSize(len));
}
let mut validators = Vec::with_capacity(len);

Affected Files

• crates/consensus/src/validator_set.rs