const MaxResources, MaxResourcesPerAdmin, MaxPermissionsPerResource, MaxHoldersPerPermission, MaxNameLen, ReservationPeriod, MaxRenderResources, MaxRenderPermissions, MaxRenderHolders
1const (
2 // MaxResources bounds total registry state. Raised from the upstream
3 // 200 as part of the R1 remediation: with a per-admin quota now
4 // carrying the anti-monopoly duty, the global cap is a pure state
5 // bound rather than the sole defense against namespace exhaustion.
6 MaxResources = 1000
7
8 // MaxResourcesPerAdmin bounds how many resources one address may hold
9 // at once. R1 (audit 2026-09-21): the upstream design had only a
10 // global cap on a permissionless shared registry, so one unprivileged
11 // key could occupy every slot for ~200 cheap transactions and
12 // permanently deny the registry to every other tenant. DeleteResource
13 // is admin-only, so the squat was irreversible.
14 MaxResourcesPerAdmin = 20
15
16 MaxPermissionsPerResource = 50
17 MaxHoldersPerPermission = 200
18 MaxNameLen = 64
19
20 // ReservationPeriod is how long a deleted resource name stays
21 // reserved. Finite (re-audit 2026-09-02): eternal tombstones let an
22 // attacker cycle create/delete to lock the namespace forever.
23 ReservationPeriod = int64(90 * 24 * 3600) // 90 days
24
25 // Render bounds (Y3, audit 2026-09-21). Render walks the whole
26 // registry and is reachable by any viewer through gnoweb and
27 // vm/qrender, so its cost is borne by third parties rather than by
28 // whoever grew the state. Uncapped, the declared limits allowed
29 // 1000*50*200 rendered holder entries. The full data stays available
30 // through ListResources / GetPermissions / Has, which are bounded per
31 // call by construction.
32 MaxRenderResources = 20
33 MaxRenderPermissions = 8
34 MaxRenderHolders = 10
35)