[Audit H-02] Requests have no maximum-fee/slippage bound

[hmzakhalid]

Finding

Severity: High

Confirmed against baseline commit d4277510d. A requester could obtain a quote and later pay a higher owner-updated price because the request did not bind maximum cost, quote version, or expiry.

Full audit report

Required remediation

Bind each request to requester-controlled maximum fee and quote validity/version constraints and reject stale or excessive quotes.

The dedicated fixing commit and remediation PR will be linked in a follow-up comment.

[hmzakhalid]

Fixed by commit 0d5f8fc10ef27d451f39f2824a9551d349402bbe in PR #1727.

[hmzakhalid]

Supersedes the earlier remediation reference after the cleanup of PR #1727. Fixed by commit 2fc6055 (H-02): E3 requests bind execution to requester-supplied maximum fee and deadline consent.

[hmzakhalid]

Protocol decision update: the maxFee and requestDeadline remediation from 2fc6055b6bae91ed33bb5b0f2eb327be252269a6 has been removed by 5debac40fb25566df789291fd38c5863b899467f.

The accepted request semantics are:

• Applications may call getE3Quote immediately before submitting request.
• request charges the live quote when the transaction executes.
• The existing inputWindow[0] >= block.timestamp validation already bounds how late the request can execute, so a second request deadline duplicates that timing constraint.
• A per-request fee-slippage field is not required by the protocol. A caller that approves only the quoted token amount also naturally reverts if the live fee rises above that allowance.

The removal covers the Solidity request struct and validation library, generated ABI, Rust EVM caller, SDK, CLI task, tests, and flow documentation. This issue should therefore be treated as an accepted protocol/economic decision rather than a code defect.