From faf777022002fe165bb72ef008b2ca83040439a0 Mon Sep 17 00:00:00 2001
From: root <root@vps-45cab3a8.vps.ovh.net>
Date: Sat, 30 May 2026 18:02:34 +0000
Subject: [PATCH] Cap SAL1 unsweep fanout

---
 README.md                       | 1 +
 config.sample.php               | 2 +-
 src/salvium_tipbot_commands.php | 8 ++++++++
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index e315042..efae697 100755
--- a/README.md
+++ b/README.md
@@ -34,6 +34,7 @@ A PHP-based Telegram tip bot for the Salvium (Monero fork) cryptocurrency.
 - `WITHDRAWAL_FEE` is charged in `SAL1` for `SAL1` withdrawals.
 - `TOKEN_WITHDRAWALS_CHARGE_SAL1_FEE=false` lets token withdrawals use wallet-paid `SAL1` network fees.
 - Set `TOKEN_WITHDRAWALS_CHARGE_SAL1_FEE=true` to require and reserve `WITHDRAWAL_FEE` `SAL1` from the user when withdrawing token assets.
+- `MAX_UNSWEEP_OUTPUTS` defaults to 4 because larger single-run SAL1 fan-outs fail in wallet RPC.
 - `MAX_TOKEN_UNSWEEP_OUTPUTS` limits token unsweep fan-out per run because token self-transfers also need SAL1 fee transactions.
 
 ## License
diff --git a/config.sample.php b/config.sample.php
index b1e3b0e..ca83fb0 100755
--- a/config.sample.php
+++ b/config.sample.php
@@ -20,7 +20,7 @@ return [
     'MIN_WITHDRAWAL_AMOUNT' => 0.4,
     'WITHDRAWAL_FEE' => 0.1,
     'TOKEN_WITHDRAWALS_CHARGE_SAL1_FEE' => false,
-    'MAX_UNSWEEP_OUTPUTS' => 100,
+    'MAX_UNSWEEP_OUTPUTS' => 4,
     'MAX_TOKEN_UNSWEEP_OUTPUTS' => 2,
     'UNSWEEP_SAL1_FEE_RESERVE' => 0.5,
     'UNSWEEP_TOKEN_SAL1_FEE_RESERVE' => 0.05,
diff --git a/src/salvium_tipbot_commands.php b/src/salvium_tipbot_commands.php
index bd7d958..519b7d6 100644
--- a/src/salvium_tipbot_commands.php
+++ b/src/salvium_tipbot_commands.php
@@ -272,7 +272,15 @@ class SalviumTipBotCommands {
         }
 
         $maxOutputs = max(2, (int)($this->config['MAX_UNSWEEP_OUTPUTS'] ?? 100));
+        if ($assetType === 'SAL1') {
+            $maxOutputs = min($maxOutputs, 4);
+        }
+
         if ($outputCount > $maxOutputs) {
+            if ($assetType === 'SAL1') {
+                return "SAL1 unsweep can safely create up to {$maxOutputs} outputs per run. Larger fan-outs fail in wallet RPC.";
+            }
+
             return "Too many outputs. Max is {$maxOutputs}.";
         }