Malformed Peer Hardening
Remote HTTP peers are untrusted inputs. NOOSChain sync only trusts ordered blocks and transactions after local validation and deterministic execution. Materialized remote tables, remote SMT storage, and remote domain rows are never copied.
The HTTP sync boundary validates remote /chain/head and /chain/blocks responses before canonical chain tables are mutated. Validation covers response shape, safe height ranges, block continuity, transaction ordering, transaction hashes, Merkle roots, protocol version support, required state roots, and block hashes. If insertion begins, it happens inside a PostgreSQL transaction and any execution or verification error rolls the whole block back.
The local serving boundary also validates public /chain/blocks and /chain/headers query ranges. Malformed heights, negative heights, and unsafe huge heights are rejected with INVALID_BLOCK_RANGE. NOOS_SYNC_MAX_BLOCK_RANGE is the authoritative response cap, so broad from/to inputs are clamped before the database query is built.
Malformed payload backfill responses are also treated as availability-layer failures. A bad /records/:recordId/payload response may increment local backfill failure diagnostics, but it must not change blocks, transactions, state roots, SMT storage, or consensus metadata.
The batched payload endpoint POST /records/payloads is also bounded. It accepts at most 100 record ids per request and returns 400 INVALID_PAYLOAD_BATCH for oversized or malformed batches. This is an API boundary failure, not a consensus transaction failure. Backfill clients chunk larger work sets before calling the endpoint, so a large sync cannot accidentally turn payload retrieval into a single oversized request or a generic 500 response.
Allowed metadata mutation during failed sync is limited to peer diagnostics such as peer_sync_state.last_error. This table is local operational metadata, not consensus state.
npm run test:malformed-sync exercises malformed heads, malformed blocks, HTTP failures, timeout behavior, connection refusal, and malformed ciphertext backfill responses. The test snapshots canonical table counts and chain head before each failure and asserts they are unchanged afterwards.
Future hardening work can add property-based fuzzing, response-size streaming limits, and long-running adversarial sync tests. Peer scoring, quarantine, and manual banning already exist as local operational defenses.