pds: child-account creation multiplies per-account quotas against shared caps #177

Open

permadeath.com 1mo ago

Open opened by

permadeath.com 1mo ago

(2026-10-02 release-readiness audit, agent-filed)

Each child gets a fresh 64 MiB blob quota (crates/didbot-pds/src/blobs.rs:73) and a slot against max_accounts (default 1000); tree defaults allow 100 creates/hour and 10,000 children (crates/didbot-config/src/sections.rs:570-584). A compromised creator holding a descendants allowance can consume the deployment-wide blob total in about two hours of child quotas (507-ing everyone's uploads) and squat all account slots in ~10 hours.

A creator's subtree should draw against the creator's own ceiling (blob bytes and account slots), not multiply it.

permadeath.com 4w ago

Design for this and its sibling issue is in https://tangled.org/did:plc:swttlkbjvcoln67iievud7b3/pulls/1196 (plan/tree-quotas.md). It recommends charging each account tree's root, the one the proxy's in_flight_per_tree already counts, for writes, blob bytes and account slots, with no new stored state. Each share defaults to half its deployment total.

permadeath.com 2w ago

Still real on main at 1351e8b33. The fix is the design in #1196, which now waits on the owner's decisions. An upload sums its tree's bytes from BlobIndex, and a create counts the rows beneath its root. That adds [blobs] tree_quota_bytes and [tree] max_tree_accounts, and no stored state. The open question is the default: the plan recommends half of each total, which refuses a single-tree deployment at 500 accounts.