fix(evmrpc): don't charge an innocent client's per-IP bucket on mid-read budget exhaustion

evmrpc/rate_limit_middleware.go

@@ -37,6 +37,13 @@ func (m *rateLimitMiddleware) ServeHTTP(w http.ResponseWriter, r *http.Request)
 			m.rejectAdmission(r.Context(), w, ip, rejectReasonOversize, http.StatusRequestEntityTooLarge, "request body too large")
 			return
 		}
+		if errors.Is(err, errBudgetExhausted) || isReadIdleTimeout(err) {
+			// The outer requestSizeLimiter already recorded the rejection reason
+			// (budget_midread/slow_body) and owns the response for this failure;
+			// charging admission here would debit an innocent client's per-IP
+			// bucket for a server-side capacity event and double-count the metric.
+			return
+		}
 		m.rejectAdmission(r.Context(), w, ip, rejectReasonReadError, http.StatusBadRequest, "bad request")
 		return
 	}

evmrpc/rate_limit_middleware_test.go

@@ -544,3 +544,66 @@ func TestReadBoundedBody_RejectsOversize(t *testing.T) {
 		require.Equal(t, int64(len(body)), tracked.drained)
 	})
 }
+
+// TestComposedStack_BudgetMidreadDoesNotChargeInnocentIP guards against the
+// mid-read global-budget exhaustion of one client charging a different,
+// well-behaved client's per-IP bucket.
+func TestComposedStack_BudgetMidreadDoesNotChargeInnocentIP(t *testing.T) {
+	const maxBody = 1000
+	const budget = 1500 // room for exactly one max-size body at a time
+
+	release := make(chan struct{})
+	admitted := make(chan struct{}, 1)
+
+	reg := mustRateLimitRegistry(t, 0.001, 1) // burst=1: any charge exhausts the bucket
+	gate := NewRateLimitGate(reg, maxBody, true, "evm")
+	inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		admitted <- struct{}{}
+		<-release
+		w.WriteHeader(http.StatusOK)
+	})
+	stack := newRequestSizeLimiter(newRateLimitMiddleware(inner, gate), maxBody, budget, 0)
+
+	// A well-formed JSON-RPC body padded to exactly maxBody bytes: it must parse
+	// cleanly so the request reaches the byte-budget accounting inside
+	// readBoundedBody rather than getting rejected earlier as unparseable.
+	const prefix = `{"jsonrpc":"2.0","id":1,"method":"eth_call","params":["`
+	const suffix = `"]}`
+	fullSizeBody := prefix + strings.Repeat("x", maxBody-len(prefix)-len(suffix)) + suffix
+	require.Len(t, fullSizeBody, maxBody)
+
+	holderIP := "203.0.113.10:1"
+	victimIP := "203.0.113.20:1"
+
+	// The holder's request is admitted and reserves the whole budget, then blocks
+	// with its handler in flight so the reservation is not released yet.
+	firstDone := make(chan int, 1)
+	go func() {
+		rec := httptest.NewRecorder()
+		holderReq := newSizedRequest(fullSizeBody, maxBody)
+		holderReq.RemoteAddr = holderIP
+		stack.ServeHTTP(rec, holderReq)
+		firstDone <- rec.Code
+	}()
+	<-admitted
+
+	// The victim is a distinct, well-behaved client whose own request fails
+	// mid-read purely because the shared budget the holder reserved is gone.
+	rec := httptest.NewRecorder()
+	req := newSizedRequest(fullSizeBody, maxBody)
+	req.RemoteAddr = victimIP
+	stack.ServeHTTP(rec, req)
+	require.Equal(t, http.StatusTooManyRequests, rec.Code)
+	require.Contains(t, rec.Body.String(), "server busy")
+
+	close(release)
+	require.Equal(t, http.StatusOK, <-firstDone)
+
+	// The victim's own per-IP bucket must still be untouched: with burst=1, a
+	// request from that IP with room in the (now-released) budget still succeeds.
+	rec3 := httptest.NewRecorder()
+	req3 := newSizedRequest(`{"jsonrpc":"2.0","id":1,"method":"eth_call","params":[]}`, -1)
+	req3.RemoteAddr = victimIP
+	stack.ServeHTTP(rec3, req3)
+	require.Equal(t, http.StatusOK, rec3.Code)
+}