fix(derivation): reject invalid blockCount to prevent batch-parse DoS

[curryxbo]

What

Fixes two DoS panics in node/derivation/batch_info.go::ParseBatch that let a malformed L1 commitBatch crash any node in layer1 verify mode (the derivation goroutine has no recover()). Both originate from an unvalidated blockCount, where LastBlockNumber is attacker-controlled L1 calldata.

• blockCount == 0 (lastBlockNumber == parent): the underflow guard rejected < but not ==, producing empty blockContexts; derive() then returned a nil header that derivation.go dereferenced → nil-pointer panic. Zero-block batches are not supported, so this is rejected at parse.
• overflowing blockCount: blockCount * 60 wrapped uint64 to a small value, bypassing the length guard, then make([]*BlockContext, int(blockCount)) attempted an out-of-range allocation → makeslice panic / OOM.

Fix (targeted, one file)

In ParseBatch:

1. Bound blockCount by payload length via division (blockCount > len(batchBytes)/60) before the multiply — overflow-safe, and make is bounded by real payload size.
2. Reject blockCount == 0 once after both branches — covers every path (parent-equal, zero prefix, v0-nil).

Both become clean parse errors instead of process-killing panics. derivation.go is unchanged.

Note: single-block batches are unaffected

The guard rejects only blockCount == 0. A single-block batch is blockCount == 1 and passes untouched — including the fork-boundary case (e.g. the zk→MPT / Morph203 transition block committed in its own batch). The V0→V1 transition path independently computes lastBlockNumber - startBlock + 1, so it is structurally ≥ 1 and can never be zero.

Test

TestParseBatchBlockCountBounds: zero count → ParseBatch returns an error; overflowing count → error (no panic). Existing ParseBatch tests and the full derivation package test suite pass.

Follow-up (out of scope)

Root cause is contract-side: Rollup.sol::_commitBatch does not constrain lastBlockNumber vs. parent and _getBLSMsgHash is still a return bytes32(0) stub, so the field isn't signature-bound. A span cap (and tighter signing) is recommended separately (see #994).

Closes #994

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4cfdc842-54a8-46d9-b0be-daa0ce1e8e58

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/derivation-blockcount-panic

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}