security: cross-chain retry may mask permanent insufficient funds error

Open
#11 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
go
Domain
cli

Research direction

Start in pkg/crosschain/transfer.go:164-182 and inspect isRetryableImportError and its retryablePatterns. Determine how transient UTXO visibility errors can be separated from permanent insufficient-funds errors, then define the retry bounds and logging behavior; done means permanent balance errors fail without repeated retries while transient cases remain retryable.

Written by the indexing model from the issue text.

Description

Description

The isRetryableImportError function in pkg/crosschain/transfer.go uses string matching to classify errors as retryable. The pattern "insufficient funds" could match both transient UTXO propagation issues and permanent balance insufficiency.

Current behavior

retryablePatterns := []string{
    "not found",
    "no utxos",
    "insufficient funds", // May occur if UTXOs haven't propagated
    "missing utxo",
}

If a user truly has insufficient funds, the CLI retries multiple times before failing, wasting time.

Suggested improvements

  • Check for specific SDK error types instead of string matching
  • Add max retry duration in addition to max attempts
  • Log each retry attempt so users understand what's happening
  • Consider distinguishing between "no UTXOs at all" (permanent) vs "UTXOs not yet visible" (transient)

Files affected

  • pkg/crosschain/transfer.go:164-182

Severity

Minor - causes delayed error reporting, not incorrect behavior

Source

Production readiness audit (2026-02-09)

Dominant language
Go
Stars
1
Forks
5
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ava-labs/platform-cli

All issues in ava-labs/platform-cli

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.