fix(net): bound governance vote signature deserialization

[thepastaclaw]

Uses the shared bounded-vector deserialization primitive merged in #7439.

Motivation

Governance vote signatures were deserialized through the generic byte-vector path. A peer could declare a very large signature length, causing allocation before the stream reported truncation. The outer message-processing catch did not score or disconnect the peer, allowing repeated malformed messages.

Changes

• bound network governance-vote signature reads to 96 bytes before allocation
• require one of the two structurally valid encodings: 65-byte compact ECDSA or 96-byte BLS
• score malformed or truncated governance vote messages with 100 misbehavior points
• preserve disk, hash, and outbound serialization behavior
• add focused unit coverage

Testing

• ./src/test/test_dash --run_test=governance_vote_wire_tests (4/4 tests)
• ./src/test/test_dash --run_test=serialize_tests (10/10 tests)
• test/lint/lint-python.py
• git diff --check upstream/develop...HEAD

[thepastaclaw]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Walkthrough

Governance vote network deserialization now caps signature payloads at the BLS signature size and accepts only compact or BLS signature lengths. Malformed or truncated network votes raise std::ios_base::failure; the message handler catches this and marks the peer misbehaving. Compile-time checks tie vote constants to cryptographic signature sizes. New wire tests cover invalid, truncated, valid, and disk deserialization paths, and are included in the test build.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• dashpay/dash#7397: Also hardens malformed governance network message handling in NetGovernance::ProcessMessage.

Suggested reviewers: knst, UdjinM6

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 35.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: bounding governance vote signature deserialization.
Description check	✅ Passed	The description matches the changeset and accurately describes the motivation, implementation, testing, and behavior preserved.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

This pull request has conflicts, please rebase.

[thepastaclaw]

✅ Review complete (commit 8f0b813)

[knst]

utACK 8f0b813

[thepastaclaw]

Code Review

PR #7440 correctly bounds governance-vote signature deserialization to the two legitimate wire encodings (65-byte compact ECDSA, 96-byte BLS) via LIMITED_VECTOR, throwing before allocation on oversized counts, and routes malformed/truncated votes to 100-point misbehavior scoring instead of the outer log-only handler. Disk, hash, and write serialization paths remain unbounded as intended, and static_asserts keep the size constants tied to CPubKey/CBLSSignature. The one gap is test coverage: new tests exercise only the raw stream deserialization boundary, not the handler-level peer-scoring behavior this PR introduces.

Source (experiment sonnet-primary-opus-quarter-sample-20260710, cohort sonnet_primary, bucket 2): reviewers codex/general=gpt-5.6-sol(completed); sonnet5/general=claude-sonnet-5(completed); codex/dash-core-commit-history=gpt-5.6-sol(completed); sonnet5/dash-core-commit-history=claude-sonnet-5(completed); verifier=verifier-sonnet5-7440-1783711121=claude-sonnet-5; orchestrator=openai/gpt-5.6-sol reasoning=high (orchestration-only, not a reviewer/verifier).

🟡 1 suggestion(s)

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `src/test/governance_vote_wire_tests.cpp`:
- [SUGGESTION] src/test/governance_vote_wire_tests.cpp:1-96: No test exercises the peer-misbehavior-scoring path this PR adds
  All four new tests call `ss >> vote` directly and assert on `std::ios_base::failure`. None of them go through `NetGovernance::ProcessMessage`, which is where this PR's actual security behavior lives: catching that exception and calling `PeerMisbehaving(peer.GetId(), 100, "malformed governance vote")` (net_governance.cpp:199-204). As written, a regression that removes the catch, changes the penalty, or forgets the `return` after scoring would leave every test in this file green while silently breaking peer-scoring. Add a handler-level test that feeds an oversized or truncated `govobjvote` payload through `NetGovernance::ProcessMessage` and asserts the peer accumulates 100 misbehavior points.

[thepastaclaw]

🟡 Suggestion: No test exercises the peer-misbehavior-scoring path this PR adds

All four new tests call ss >> vote directly and assert on std::ios_base::failure. None of them go through NetGovernance::ProcessMessage, which is where this PR's actual security behavior lives: catching that exception and calling PeerMisbehaving(peer.GetId(), 100, "malformed governance vote") (net_governance.cpp:199-204). As written, a regression that removes the catch, changes the penalty, or forgets the return after scoring would leave every test in this file green while silently breaking peer-scoring. Add a handler-level test that feeds an oversized or truncated govobjvote payload through NetGovernance::ProcessMessage and asserts the peer accumulates 100 misbehavior points.

_{source: ['codex']}