[mortezashojaei]

Summary

A CCIP-Read gateway fetch is the other HTTP call the client makes, and the contract chooses the URL. Viem keeps the limits it already uses for its own HTTP transport, and the lookup depth EIP-3668 requires.

What belongs in the library:

• 10 second timeout, including the body. Same default, and the same timeout override, as the HTTP transport. A gateway that never finishes would hang the call the same way a stalled RPC would.
• 10 MiB body cap. That is the HTTP transport's ceiling (10_485_760).
• http and https only. EIP-3668 defines the gateway call as an HTTP GET or POST, and it only specifies HTTPS URLs.
• 4 nested callbacks. The client lookup protocol requires a limit on lookups for one call, and that limit should be at least 4. The spec's own example stops at 4. A local batch that names x-batch-gateway:true again shares that depth. A query past it comes back as a failure, so the batch result stays the same length as the request list.

How many URLs to try, how many batch queries to run, and whether to follow a redirect stay with the caller, through ccipRead.request. ccipRead: false skips contract-chosen fetches entirely.

There is no address blocklist. A literal private address is one way to spell a URL the contract is allowed to choose. A public hostname can resolve to that same address, and blocking 10/8 or 192.168/16 also breaks a gateway on a LAN. A caller who wants a resolver check supplies ccipRead.request.

Related: #5024. The scheme check overlaps with that issue. The host parser and the redirect refusal stay out.

Test plan

• SKIP_GLOBAL_SETUP=true pnpm exec vitest run -c ./test/vitest.config.ts --project core src/utils/ccip.test.ts src/utils/ens/localBatchGatewayRequest.test.ts
  Gateway unit tests passed. The three offchainLookup cases need a local Anvil (ECONNREFUSED 127.0.0.1:8545 here).
• Anvil offchainLookup cases

[vercel]

@mortezashojaei is attempting to deploy a commit to the Wevm Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

Deployment failed for project viem with the following error:

The provided GitHub repository does not contain the requested branch or commit reference. Please ensure the repository is not empty.

[changeset-bot]

🦋 Changeset detected

Latest commit: 1b9c306

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
viem	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[jxom]

Thanks @mortezashojaei! Superseded by #5364, which keeps your gateway timeout, response cap and scheme check, and adds a shared query/concurrency budget per lookup with explicit callback depth tracking.