Expensive runtime api: attack vector?

Question

If i have a very expensive runtime api, that can be called via an rpc, is this a vector for a dos attack?

I understand that this is an offchain query to storage and therefore should not interfere with the runtime at all but what is the worst case if such a runtime api exists?

Please correct me if im misunderstood.

Thanks

Answer 1

The worst case with such an api is that the RPC node could be brought down. However, the API could also be called via light clients, so you should try to not have some runtime API that iterates the entire storage or other expensive operations.