fix: cap prevout lookup fan-out (#10)

Author: NateIsern

server/index.ts

@@ -111,9 +111,12 @@ app.use(express.json({ limit: '64kb' }))
 // Apply the global rate limit to the API surface only (static assets are exempt).
 app.use('/api', globalLimiter)
 
-// Stricter limits on the expensive search path, broadcast write path, and
-// public MCP endpoint, which can invoke daemon-backed wallet tools.
+// Stricter limits on the expensive RPC fan-out paths (search, transaction and
+// address lookups), the broadcast write path, and the public MCP endpoint, which
+// can invoke daemon-backed wallet tools.
 app.use('/api/search', strictLimiter)
+app.use('/api/transaction', strictLimiter)
+app.use('/api/address', strictLimiter)
 app.use('/api/tx/broadcast', strictLimiter)
 
 // ---- API Routes ----

server/lib/cache.ts

@@ -279,7 +279,16 @@ export interface ResolvedPrevout {
  * Inputs beyond the cap are returned without a `prevout` and the frontend
  * degrades gracefully (it falls back to the unenriched display).
  */
-const MAX_PREVOUT_LOOKUPS = 60
+const MAX_PREVOUT_LOOKUPS = 12
+const MAX_PREVOUT_LOOKUPS_PER_ADDRESS_PAGE = 40
+
+interface PrevoutLookupBudget {
+  remaining: number
+}
+
+interface TransactionLookupOptions {
+  prevoutLookupBudget?: PrevoutLookupBudget
+}
 
 // Block-specific caching with different TTLs
 export class BlockCache extends BlockchainCache {
@@ -318,7 +327,14 @@ export class BlockCache extends BlockchainCache {
    * The cache is read/written directly here (rather than via {@link get}) because
    * the TTL must be chosen AFTER fetching, based on whether the tx is confirmed.
    */
-  async getTransaction(txid: string, network: NetworkType, verbose: boolean = true) {
+  readonly maxPrevoutLookupsPerAddressPage = MAX_PREVOUT_LOOKUPS_PER_ADDRESS_PAGE
+
+  async getTransaction(
+    txid: string,
+    network: NetworkType,
+    verbose: boolean = true,
+    options: TransactionLookupOptions = {},
+  ) {
     assertValidNetwork(network)
 
     // Non-verbose callers just want the raw hex string; it never carries
@@ -384,7 +400,7 @@ export class BlockCache extends BlockchainCache {
     }
 
     const withConfirmations = await this.withLiveConfirmations(tx, network)
-    return await this.enrichInputPrevouts(withConfirmations, network)
+    return await this.enrichInputPrevouts(withConfirmations, network, options.prevoutLookupBudget)
   }
 
   /**
@@ -410,6 +426,7 @@ export class BlockCache extends BlockchainCache {
   private async enrichInputPrevouts(
     tx: Record<string, unknown> | null,
     network: NetworkType,
+    budget?: PrevoutLookupBudget,
   ): Promise<Record<string, unknown> | null> {
     if (!tx || !Array.isArray(tx.vin)) {
       return tx
@@ -427,14 +444,19 @@ export class BlockCache extends BlockchainCache {
       const parentTxid = input.txid
       if (!parentTxid || parentTxid === ZERO_HASH || seen.has(parentTxid)) continue
       seen.add(parentTxid)
-      if (parentTxids.length >= MAX_PREVOUT_LOOKUPS) break
+      const aggregateRemaining = budget?.remaining ?? MAX_PREVOUT_LOOKUPS
+      if (parentTxids.length >= MAX_PREVOUT_LOOKUPS || parentTxids.length >= aggregateRemaining) break
       parentTxids.push(parentTxid)
     }
 
     if (parentTxids.length === 0) {
       return tx
     }
 
+    if (budget) {
+      budget.remaining = Math.max(0, budget.remaining - parentTxids.length)
+    }
+
     // Fetch every needed parent transaction once, in parallel. A failed lookup
     // resolves to null and simply yields no prevout for the affected inputs.
     const parents = new Map<string, RawVout[] | null>()

server/routes/address.ts

@@ -209,10 +209,13 @@ router.get("/:address/txs", async (req: Request, res: Response) => {
     interface TxVin { coinbase?: string; prevout?: { value?: number; addresses?: string[] } }
 
     // Fetch transaction details and compute the address-relative net amount.
+    // Share one prevout lookup budget across the page so a high `limit` cannot
+    // multiply parent-transaction RPC/cache lookups without bound.
+    const prevoutLookupBudget = { remaining: blockCache.maxPrevoutLookupsPerAddressPage };
     const transactions = [];
     for (const txid of pageTxids) {
       try {
-        const tx = await blockCache.getTransaction(txid, network, true);
+        const tx = await blockCache.getTransaction(txid, network, true, { prevoutLookupBudget });
         const vouts = (tx.vout ?? []) as TxVout[];
         const vins = (tx.vin ?? []) as TxVin[];