From c729a26dd3ab6996b157bbca751d238239dfa732 Mon Sep 17 00:00:00 2001
From: Denis Angell <dangell@transia.co>
Date: Fri, 20 Feb 2026 22:08:41 +0100
Subject: [PATCH] defensive check for nested Signers array size

---
 src/libxrpl/tx/transactors/Batch.cpp | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/libxrpl/tx/transactors/Batch.cpp b/src/libxrpl/tx/transactors/Batch.cpp
index 67bb1f26e4..4bff670d8c 100644
--- a/src/libxrpl/tx/transactors/Batch.cpp
+++ b/src/libxrpl/tx/transactors/Batch.cpp
@@ -107,7 +107,17 @@ Batch::calculateBaseFee(ReadView const& view, STTx const& tx)
             if (signer.isFieldPresent(sfTxnSignature))
                 signerCount += 1;
             else if (signer.isFieldPresent(sfSigners))
-                signerCount += signer.getFieldArray(sfSigners).size();
+            {
+                auto const& nestedSigners = signer.getFieldArray(sfSigners);
+                // LCOV_EXCL_START
+                if (nestedSigners.size() > STTx::maxMultiSigners)
+                {
+                    JLOG(debugLog().error()) << "BatchTrace: Nested Signers array exceeds max entries.";
+                    return XRPAmount{INITIAL_XRP};
+                }
+                // LCOV_EXCL_STOP
+                signerCount += nestedSigners.size();
+            }
         }
     }