frontend: deduplicate client-supplied address lists

[LarryRuane]

The transparent-address methods pass the client's address list to the backend unchanged, and the two backends treat repeats differently.

getaddressbalance — a wrong number, not just a slow one

zcashd sums over the list entries, so a repeated address is counted repeatedly. Verified against zcashd master: the same address listed twice returned 100365254620 zats against 50182627310 listed once — exactly double.

zebrad parses the list into a HashSet<Address> before querying (methods.rs:3798), so duplicates collapse and it reports the balance of the distinct addresses.

So the same request returned different balances depending on which backend lightwalletd was configured with, and the zcashd answer was wrong. This is a correctness fix, and it changes returned balances against a zcashd backend.

It is not a security issue: a client can only mislead itself this way, not inflate anyone else's balance.

getaddressutxos — a resource multiplier

Same split. zcashd looks up each entry independently and returned 250 UTXOs for an address listed twice that yields 125 listed once; zebrad returns the same set either way. Repeating an address costs the caller nothing — addresses are public, and neither a key nor any funds are needed to name one — so against a zcashd backend a single request could multiply the busiest address on the chain by maxTaddrsPerRequest (10,000).

zebrad was never exposed to this. The point of fixing it in lightwalletd is that lightwalletd shouldn't depend on backend behavior to bound work it can bound itself — the same layering argument as validating input locally.

Details

• Both lists are deduplicated before the backend call, keeping first occurrence, so the order the backend sees is unchanged.
• For UTXOs the cap is applied to the raw list first, then dedupe, so the 10,000 limit remains a bound on input size and can't be slipped past with duplicates.
• The dup check runs before checkTaddress, so validation happens once per distinct address rather than once per entry. An invalid address is still rejected, since its first occurrence reaches the check.
• GetTaddressTransactions and GetTaddressTxids carry a single address field, so they can't receive duplicates and are unaffected.

Scope

The UTXO change narrows the worst case; it does not close it. StartHeight and MaxEntries are still response filters applied after the entire backend result has been fetched and unmarshalled, so a single named address with a large UTXO set is bounded by nothing here — and that case is unaffected by deduplication. That residual is the unremediated part of GHSA-x4m7-3gpp-xc36 and needs range/limit arguments pushed down into the backend RPC to close.

Testing

TestGetTaddressBalanceDeduplicates uses a stub that returns 1000 zats per list entry it receives — modelling zcashd — and asserts that four entries naming two distinct addresses yield 2000, not 4000.

TestGetAddressUtxosDeduplicates asserts the backend receives exactly the distinct addresses in first-occurrence order, and that an invalid address following duplicates still yields InvalidArgument.

Mutation-tested: bypassing either dedupe fails its test, and a variant that deduplicates without preserving order fails 8/8 runs (six addresses are used specifically so map iteration can't match by chance).

[Copilot]

Pull request overview

This PR mitigates a DoS amplification vector in the GetAddressUtxos frontend by deduplicating repeated transparent addresses before calling the backend getaddressutxos RPC, keeping backend work proportional to the number of distinct addresses provided.

Changes:

• Deduplicate GetAddressUtxos request addresses (preserving first-occurrence order) before validating and forwarding to the backend.
• Add a unit test asserting distinct-address forwarding order and that invalid addresses are still rejected without contacting the backend.
• Document the behavioral change and remaining limitation in CHANGELOG.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
frontend/service.go	Deduplicates address list before backend RPC call, preserving order and avoiding repeated backend work.
frontend/frontend_test.go	Adds test coverage for deduplication behavior and invalid-address rejection.
CHANGELOG.md	Notes the fix in Unreleased changelog entry.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[LarryRuane]

@emersonian - please review

[LarryRuane]

Reviewed (though I am ostensibly the author, Claude wrote most of this); LGTM. I stepped through the new test, TestGetTaddressBalanceDeduplicates, in the debugger, and both the production and test code are working as expected.

[pacu]

utACK modulo the comment resolution

[pacu]

@LarryRuane is it possible to send a GetAddressUtxosArg with no addresses? I don't think the code is guarding from that directly, it does so indirectly when the dedup work is done. I think if that can happen we shall return an "invalid argument" reply of some sort