Constant MAX_INCOMING_CONTRACTS_BATCH 

pub(crate) const MAX_INCOMING_CONTRACTS_BATCH: usize = 1024;

Maximum number of incoming contracts a single await_incoming_contracts request may ask for. The endpoint is public and unauthenticated, so the batch size is untrusted input; without a cap it flows straight into Vec::with_capacity, letting one request trigger an arbitrarily large allocation and abort the guardian process. The legitimate client requests 128 at a time, so this leaves ample headroom.