diff --git a/.nancy-ignore b/.nancy-ignore index 8f27163abe..e431d86f94 100644 --- a/.nancy-ignore +++ b/.nancy-ignore @@ -1,3 +1,4 @@ CVE-2024-34478 # "CWE-754: Improper Check for Unusual or Exceptional Conditions." This vulnerability is BTC only, BSC does not have the issue. CVE-2021-43668 # "CWE-476: NULL Pointer Dereference", the repo: syndtr/goleveldb is not actively maintained, seems there is no fix for this crash yet, BSC used pebbleDB to replaced levelDB, so ignore this vulnerability. CVE-2025-47908 # "CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')", This vulnerability is only for RPC nodes which have specifically enabled malicous Cors options, which is unlikely to happen. +CVE-2025-64702 # "CWE-770: Allocation of Resources Without Limits or Throttling". Attack vector is unreachable as QUIC/HTTP3 is not enabled in BSC's P2P configuration. \ No newline at end of file diff --git a/miner/minerconfig/config.go b/miner/minerconfig/config.go index 848e578def..4c021d5fd3 100644 --- a/miner/minerconfig/config.go +++ b/miner/minerconfig/config.go @@ -32,14 +32,21 @@ var ( defaultRecommit = 10 * time.Second defaultMaxWaitProposalInSecs = uint64(45) + defaultGasCeil = uint64(55_000_000) // Extra time for finalizing and committing blocks (excludes writing to disk). - defaultDelayLeftOver = 25 * time.Millisecond - defaultBidSimulationLeftOver = 30 * time.Millisecond - // For estimation, assume 500 Mgas/s: - // (100M gas / 500 Mgas/s) * 1000 ms + 10 ms buffer + defaultDelayLeftOver ≈ 235 ms. - defaultNoInterruptLeftOver = 235 * time.Millisecond + defaultDelayLeftOver = 15 * time.Millisecond + defaultBidSimulationLeftOver = 20 * time.Millisecond ) +func getDefaultNoInterruptLeftOver() *time.Duration { + expectedProcessingSpeed := 500_000_000 // For estimation, assume 500 Mgas/s + bidProcessing := float64(defaultGasCeil) / float64(expectedProcessingSpeed) + buffer := 10 * time.Millisecond + noInterruptLeftOver := time.Duration(bidProcessing*float64(time.Second)) + buffer + defaultDelayLeftOver + + return &noInterruptLeftOver +} + // Other default MEV-related configurations var ( defaultMevEnabled = false @@ -68,7 +75,7 @@ type Config struct { // DefaultConfig contains default settings for miner. var DefaultConfig = Config{ - GasCeil: 100000000, + GasCeil: defaultGasCeil, GasPrice: big.NewInt(params.GWei), // The default recommit time is chosen as two seconds since // consensus-layer usually will wait a half slot of time(6s) @@ -109,7 +116,7 @@ var DefaultMevConfig = MevConfig{ Builders: nil, ValidatorCommission: &defaultValidatorCommission, BidSimulationLeftOver: &defaultBidSimulationLeftOver, - NoInterruptLeftOver: &defaultNoInterruptLeftOver, + NoInterruptLeftOver: getDefaultNoInterruptLeftOver(), MaxBidsPerBuilder: &defaultMaxBidsPerBuilder, } @@ -155,7 +162,7 @@ func ApplyDefaultMinerConfig(cfg *Config) { log.Info("ApplyDefaultMinerConfig", "Mev.BidSimulationLeftOver", *cfg.Mev.BidSimulationLeftOver) } if cfg.Mev.NoInterruptLeftOver == nil { - cfg.Mev.NoInterruptLeftOver = &defaultNoInterruptLeftOver + cfg.Mev.NoInterruptLeftOver = getDefaultNoInterruptLeftOver() log.Info("ApplyDefaultMinerConfig", "Mev.NoInterruptLeftOver", *cfg.Mev.NoInterruptLeftOver) } if cfg.Mev.MaxBidsPerBuilder == nil {