[Backend] handleTokensWithdrawn increments withdrawnAmount before the dedup guard - replay/reset double-counts and corrupts claimable
维护者通常 7 天内回复
评估
这个 Issue 还没有评估数据。
描述
Telegram (ask questions / claim the issue here first): https://t.me/+DOylgFv1jyJlNzM0
Labels: bug, backend, Stellar Wave, database, critical
The withdrawn-amount update runs before the dedup check, so replaying events under-pays recipients.
soroban-event-worker.ts:631-641 computes newWithdrawnAmount = BigInt(stream.withdrawnAmount) + BigInt(amount) and calls tx.stream.update unconditionally. The dedup check at line 643 only guards inserting the StreamEvent row, not the financial field. So when the admin POST /v1/admin/indexer/replay resets the cursor and re-polls the same ledgers, every replay adds amount again even though the StreamEvent row is skipped. withdrawnAmount inflates, claimable shrinks, and the recipient is short-changed. The replay endpoint's Swagger doc even claims it's idempotent.
What the fix has to hold to
- The stream's
withdrawnAmountonly changes when theStreamEventrow is newly created, in the same transaction - Replay/reset is genuinely idempotent
Done when
-
withdrawnAmountupdate is idempotent (mutate only on a newStreamEventinsert, same tx) - Test processes the same
tokens_withdrawnevent twice and assertswithdrawnAmountchanges once -
handleStreamCancelled/handleStreamCompletedaudited to confirm they stay idempotent - Tests + lint pass, CI green
Where to start
backend/src/workers/soroban-event-worker.ts for the ordering fix; indexerService.ts and admin.routes.ts are listed for the replay path and audit. On-chain event schema is out of scope. Medium.
- 主要语言
- TypeScript
- 星标
- 18
- 派生
- 250
- 平均合并
- 5 天 6 小时
- 30 天内合并 PR
- 82
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
LabsCrypt/flowfi 的其他 Issue
-
backend points: 150 testing
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 7 天内回复
-
backend points: 150 testing
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 7 天内回复
-
backend points: 150 testing
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 7 天内回复
-
backend points: 150 testing
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 7 天内回复
-
backend points: 150 testing
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 7 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 68/100
awesome-dsh-plugin/awesome-dsh-plugin#9184 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 85/100
farion1231/cc-switch#8829 ·
维护者通常 1 天内回复
-
[core-client] Remove unused hand-maintained transport helpers after the definition-table cutover未关闭doc-audit enhancement
难度 2/5 1-3 小时 新手友好度 88/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 85/100