Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[Backend] handleTokensWithdrawn increments withdrawnAmount before the dedup guard - replay/reset double-counts and corrupts claimable

Aperta
  • Qualcosa non va?
#802 8 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 7 giorni

@jadonamite ci sta già lavorando.

Dal 30/6/2026.

  • #968 di @jadonamite — aperta

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

backend bug critical database GrantFox OSS Maybe Rewarded Official Campaign | FWC26 Stellar Wave

Telegram (ask questions / claim the issue here first): https://t.me/+DOylgFv1jyJlNzM0

Labels: bug, backend, Stellar Wave, database, critical

The withdrawn-amount update runs before the dedup check, so replaying events under-pays recipients.

soroban-event-worker.ts:631-641 computes newWithdrawnAmount = BigInt(stream.withdrawnAmount) + BigInt(amount) and calls tx.stream.update unconditionally. The dedup check at line 643 only guards inserting the StreamEvent row, not the financial field. So when the admin POST /v1/admin/indexer/replay resets the cursor and re-polls the same ledgers, every replay adds amount again even though the StreamEvent row is skipped. withdrawnAmount inflates, claimable shrinks, and the recipient is short-changed. The replay endpoint's Swagger doc even claims it's idempotent.

What the fix has to hold to

  • The stream's withdrawnAmount only changes when the StreamEvent row is newly created, in the same transaction
  • Replay/reset is genuinely idempotent

Done when

  • withdrawnAmount update is idempotent (mutate only on a new StreamEvent insert, same tx)
  • Test processes the same tokens_withdrawn event twice and asserts withdrawnAmount changes once
  • handleStreamCancelled/handleStreamCompleted audited to confirm they stay idempotent
  • Tests + lint pass, CI green

Where to start
backend/src/workers/soroban-event-worker.ts for the ordering fix; indexerService.ts and admin.routes.ts are listed for the replay path and audit. On-chain event schema is out of scope. Medium.

Lingua principale
TypeScript
Stelle
18
Fork
250
Merge medio
5g 6h
PR unite (30g)
82

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di LabsCrypt/flowfi

Tutte le issue di LabsCrypt/flowfi

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.