Pls check the Bitcoin PR#14897 and its updates about the potential DoS attack on the Bitcoin/Zen nodes. We just checked the Horizen source code and found the same vulnerable void CNode::AskFor(const CInv& inv) function implementation in the path of src/net.cpp. Just from my opinion, the changes of PR#14897 should be backported.