fix(platform)!: decode external input with untrusted bincode decoders

[QuantumExplorer]

Issue being fixed or feature implemented

Builds on #4635, which advances GroveDB to 6.0.0 and moves the workspace to the published grovedb-bincode 2.1.0 and adapts to the GroveDB API changes. This PR is based on that branch until it merges and contains only the untrusted-decoding adoption.

Adopt GroveDB #938 and its explicit untrusted decoding APIs. A short input containing an inflated collection length must fail without first reserving memory for the claimed payload. Updating the dependency alone does not change ordinary Decode implementations, so Platform's external input paths must opt in throughout their type graphs.

What was done?

• Make PlatformDeserialize use untrusted decoding by default, including its no-limit entry point. Add native untrusted derives across DPP and preserve custom wire schemas, validation, depth limits, and configured budgets. Most changed files only add the derive, importing DecodeUntrusted next to Decode and Encode rather than path-qualifying it. The immutable-structure CI check now strips #[derive(...)] attributes from tagged blocks before diffing them, since a derive cannot change a structure's wire layout, so the tagged types derive DecodeUntrusted like everything else while their fields, variants and encoding attributes stay guarded. Local mock formats explicitly opt into ordinary decoding with platform_serialize(..., trusted).
• Use untrusted decoding for proof verification, SDK request cursors and address synchronization, WASM asset-lock proofs, FFI proof input, and wallet persistence. Audited Serde graphs opt in explicitly; wallet blob decoding requires BlobDecode. Custom Value collections grow only after decoding entries. Ordinary-only foreign FFI payload/BLS-key decoders receive explicit budgets.

How Has This Been Tested?

Local macOS Rust checks: full workspace compilation, nine untrusted-decoding regression tests, and 256 Drive proof-verification tests were rerun successfully. Implementation validation also includes:

• cargo check --workspace --all-targets --all-features and cargo fmt --all --check.
• Strict Clippy (--all-targets --all-features -- -D warnings) for platform-value, platform-serialization-derive, dpp, drive, drive-proof-verifier, dash-sdk, and platform-wallet-storage.
• cargo test -p platform-value -p platform-serialization --all-features: 1,702 passed; two ignored documentation tests.
• DPP serialization tests: 188 passed. New DPP/Value untrusted_decode integration suites: nine passed, covering malformed lengths, observed allocation sizes, owned/borrowed decoding, wire compatibility, custom validation, and trusted fixture opt-in.
• cargo test -p drive --lib --all-features verify::: 256 passed. Drive ABCI cursor tests: 12 passed.
• Wallet blob tests: six passed; persistence and reconstruction integration tests: 42 passed.
• New FFI payload rejection and backward-reference rendering tests, plus WASM element rendering regression test.

After merging v4.2-dev, the CI Rust test job's nextest package set (--all-features, same filter) was run locally in full: 14,864 tests passed. Native host compilation and targeted tests were run; device/browser execution and a live network upgrade were not exercised.

Breaking Changes

Custom PlatformDeserialize types need untrusted decoding implementations, and custom wallet blob types must explicitly implement BlobDecode after reviewing their deserialization graph.

Existing bincode encoding and the C ABI are unchanged. Ordinary Decode and the separate PlatformVersionedDecode APIs retain their existing contracts.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have added "!" to the title and described breaking changes in the corresponding section if my code contains any
• I have made corresponding changes to the documentation if needed

For repository code-owners and collaborators only

• I have assigned this pull request to a milestone

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 2594dbf6-51a5-41c1-bc1c-8f44cf20e280

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 50.14925% with 167 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.56%. Comparing base (6b18e24) to head (bdd3492).

Files with missing lines	Patch %	Lines
...etual_distribution/distribution_function/encode.rs	83.22%	25 Missing ⚠️
packages/rs-dpp/src/address_funds/witness.rs	66.66%	11 Missing ⚠️
packages/rs-dpp/src/block/epoch/mod.rs	42.85%	8 Missing ⚠️
...ontract/associated_token/token_distribution_key.rs	0.00%	7 Missing ⚠️
...pp/src/data_contract/document_type/property/mod.rs	0.00%	7 Missing ⚠️
...-dpp/src/data_contract/errors/json_schema_error.rs	0.00%	7 Missing ⚠️
...act/associated_token/token_configuration/v0/mod.rs	0.00%	6 Missing ⚠️
...ckages/rs-dpp/src/data_contract/errors/contract.rs	0.00%	6 Missing ⚠️
...act/storage_requirements/keys_for_document_type.rs	0.00%	6 Missing ⚠️
packages/rs-dpp/src/block/block_info/mod.rs	0.00%	5 Missing ⚠️
... and 44 more

Additional details and impacted files

@@                          Coverage Diff                          @@
##           build/grovedb-6-0-0-bincode-2-1-0    #4625      +/-   ##
=====================================================================
- Coverage                              84.67%   82.56%   -2.12%     
=====================================================================
  Files                                   2793     2767      -26     
  Lines                                 374859   379792    +4933     
=====================================================================
- Hits                                  317414   313574    -3840     
- Misses                                 57445    66218    +8773     

Components	Coverage Δ
dpp	77.26% <50.14%> (-6.87%)	⬇️
drive	84.39% <ø> (-0.30%)	⬇️
drive-abci	86.58% <ø> (-0.42%)	⬇️
sdk	∅ <ø> (∅)
dapi-client	∅ <ø> (∅)
platform-version	∅ <ø> (∅)
platform-value	88.11% <ø> (-4.81%)	⬇️
platform-wallet	∅ <ø> (∅)
drive-proof-verifier	40.64% <ø> (-0.80%)	⬇️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[thepastaclaw]

✅ Final review complete — no blockers (commit f0c41bc) · triage: critical · Phase 2 only (queue backlog)

[QuantumExplorer]

Reviewed commit 462faae and found one P1 regression, detailed inline. Before posting, I checked the new head, 5dd5d62: it aligns the cursor verification query with the page's direction and appears to address the finding. I have not rerun the four failing pagination tests against that fix, so this is a review comment rather than a request for changes on the new head.

Validation on the originally reviewed commit: 1,708 local tests passed across platform-value, platform-serialization, and the DPP untrusted-decoding regression suite. FFI inspection found no additional actionable issue; the FFI tests could not run because a dependency build attempted a download that failed. No live network upgrade or browser/device execution was performed.

[thepastaclaw]

Final validation — Phase 2 only (queue backlog)

Verified the supplied finding against exact head bdd3492 and retained one non-blocking test-coverage suggestion directly tied to the PR's allocation-safety goal. No blocking findings were supplied or established during this verification. The scoped diff passes git diff --check; this verification did not rerun Rust tests.

Source: reviewer 1: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 2: gpt-6-astra (agent: phase2-reviewer, role: ffi-engineer); reviewer 3: gpt-6-astra (agent: phase2-reviewer, role: rust-quality); reviewer 4: gpt-6-astra (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

Review provenance

• Triage: critical by gpt-6-astra (effort low) — Changing default deserialization across consensus types, proof verification, SDK inputs, FFI boundaries, and wallet storage is a broad security-sensitive change whose mistakes could cause memory exhaustion, validation bypasses, wire incompatibility, or rejection of valid protocol and persisted data.
• Phase 1 reviewers: not run (skipped for throughput: 20 PRs queued, above the 10 limit)
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — ffi-engineer (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — security-auditor (completed, effort xhigh); agent phase2-reviewer

🟡 1 suggestion(s)

1 finding(s) omitted from inline comments because GitHub refused the PR diff as too large; listed below.

1 unmapped finding(s)

1. [suggestion] Add allocation-sensitive coverage for the wallet's Serde decoding path

packages/rs-platform-wallet-storage/src/sqlite/schema/blob.rs:83-85

This switches wallet blobs to untrusted Serde decoding, but the six blob tests only cover round trips, trailing bytes, physically oversized input, and malformed outpoints. None checks allocation behavior, so they would not detect a regression to ordinary Serde decoding that reserves collection capacity before returning an error. The allocation-observation tests in platform-value exercise native Value decoding rather than UntrustedBlob and its Serde visitors. Add an allocation-observation regression through blob::decode for a truncated collection, asserting both a decoding error and bounded allocation requests. This directly protects the allocation guarantee introduced by this PR without implying that the current implementation is defective.

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `packages/rs-platform-wallet-storage/src/sqlite/schema/blob.rs`:
- [SUGGESTION] packages/rs-platform-wallet-storage/src/sqlite/schema/blob.rs:83-85: Add allocation-sensitive coverage for the wallet's Serde decoding path
  This switches wallet blobs to untrusted Serde decoding, but the six blob tests only cover round trips, trailing bytes, physically oversized input, and malformed outpoints. None checks allocation behavior, so they would not detect a regression to ordinary Serde decoding that reserves collection capacity before returning an error. The allocation-observation tests in platform-value exercise native Value decoding rather than UntrustedBlob<T> and its Serde visitors. Add an allocation-observation regression through blob::decode for a truncated collection, asserting both a decoding error and bounded allocation requests. This directly protects the allocation guarantee introduced by this PR without implying that the current implementation is defective.

[QuantumExplorer]

Addressed the automated review's test-coverage suggestion in 0cd0e03: tests/sqlite_blob_untrusted_allocation.rs decodes Vec<u32> and Vec<u8> blobs whose length prefix claims megabytes but carries one element, under an observing global allocator. blob::decode must fail as truncated with every allocation under 16 KiB, and a control run of ordinary bincode-serde on the same bytes asserts it reserves at least that much, so the test demonstrably detects a regression to ordinary decoding.

🤖 Addressed by Claude Code

[thepastaclaw]

Final validation — Phase 2 only (queue backlog)

The reviewed head consistently adopts untrusted bincode decoding across the external-input paths covered by this PR. The previously identified wallet persistence allocation gap is fixed by the new allocation-sensitive regression test, and no additional in-scope correctness, security, consensus, or maintainability issues were identified.

Source: reviewer 1: gpt-6-astra (agent: phase2-reviewer, role: general); reviewer 2: gpt-6-astra (agent: phase2-reviewer, role: ffi-engineer); reviewer 3: gpt-6-astra (agent: phase2-reviewer, role: rust-quality); reviewer 4: gpt-6-astra (agent: phase2-reviewer, role: security-auditor); final verifier: gpt-6-astra (agent: astra-verifier, role: final-verifier)

Review provenance

• Triage: critical by gpt-6-astra (effort low) — This is a very large security-sensitive change spanning 537 files and broad external deserialization paths across consensus types, proofs, SDK/FFI/WASM interfaces, wallet persistence, and storage, where incomplete or incorrect untrusted decoding could cause memory exhaustion, acceptance/rejection regressions, or consensus and compatibility failures.
• Phase 1 reviewers: not run (skipped for throughput: 13 PRs queued, above the 10 limit)
• Fresh verifier: gpt-6-astra — final-verifier; agent astra-verifier
• Phase 2 reviewers: gpt-6-astra — general (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — ffi-engineer (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6-astra — security-auditor (completed, effort xhigh); agent phase2-reviewer