@anywalletkit/protocol-swap2-thorchain 0.3.4 → 0.4.0

package/README.md

@@ -28,12 +28,96 @@ nodes of different operators (Liquify's gateway and the IBS team's node, both ch
 operator; a local mock needs a second mock there). Node URLs must be `https:` (`allowInsecureNodeUrl` for local
 development).
 
+### How a second node confirms the vault
+
+THORChain keeps several asgard vaults active and its inbound address moves among them every few minutes, so a node a
+few blocks behind the quoting node often still names the previous one. A confirming node agrees when the quoted
+vault is:
+
+- its current inbound address for the source chain (`/thorchain/inbound_addresses`), or
+- that chain's address of a vault it lists with status `ActiveVault` (`/thorchain/vaults/asgard`, chain matched
+  exactly; EVM addresses compare case-insensitively, others exactly) that its mimir (`/thorchain/mimir`) does not
+  flag `CompromisedVault-<pubkey>` or `SolvencyHaltVault-<pubkey>-<chain>`. THORNode leaves such vaults out of inbound
+  election and does not credit an inbound to a compromised vault.
+
+A `RetiringVault` (or any other status) never confirms. The rest stays as strict: on EVM the router in the node's
+`inbound_addresses` must be the quote's; a halt or trading pause on the source or the destination chain refuses; the
+calldata must still pay exactly the quoted vault.
+
+A confirming node is skipped for the next one when it trails the quoting node's THORChain height
+(`/thorchain/lastblock`, the `thorchain` field) by more than `confirmMaxLagBlocks` (default 50 ≈ 5 minutes), does not
+answer within `confirmTimeoutMs` (default 2500 ms), redirects (also when the runtime followed the redirect itself, as
+React Native's fetch does: `res.url` must be the URL asked), or answers in another shape. When every node trails, the
+refusal says so ("no confirming node is within 50 blocks …"); when none answers, it is "no second node answered to
+confirm the inbound vault".
+
+**Another shape** includes a field of another type. The type of every field read is checked (THORNode's own types):
+in `inbound_addresses` each entry is an object with a string `chain`, `address`, `router` and `dust_threshold` are
+strings and `halted`, `global_trading_paused` and `chain_trading_paused` booleans when present; in `vaults/asgard`
+`status` is a string, `pub_key` a `thorpub1…` string, `addresses` a list of objects with string `chain` and `address`;
+every `mimir` value is a number or a string (int64), and a vault flag an int64; `lastblock`'s `thorchain` is a
+non-negative int64. One such field anywhere in an answer (another chain's entry or another vault included) skips
+the confirming node, and `verifyBuild` skips it the same way. The quoting node's `inbound_addresses` and `lastblock`
+are read the same way: another shape makes that node unavailable and the next `nodeUrl` host is asked, with the
+existing refusals when none is left ("inbound addresses unavailable from every node", "THORChain height
+(/thorchain/lastblock) unavailable from every node that answered the inbound addresses"; before broadcast "cannot
+refresh inbound addresses before broadcast").
+
+**Time.** The vault check has its own 8 s budget. It starts when the quoting node's quote is in hand (before
+broadcast: when a node is asked to refresh the inbound snapshot) and covers that node's `inbound_addresses` and
+`lastblock` reads and every confirming node, each getting `confirmTimeoutMs` or what is left; time a failed host took
+before does not count, and no confirming node is asked with less than 100 ms left. When the budget runs out before
+any confirming node was asked, the refusal is "the 8 s confirmation budget ran out before a second node could be asked to confirm the
+inbound vault — retry". `confirmTimeoutMs` bounds confirming nodes only: each read of the quoting node (the quote,
+`inbound_addresses`, `lastblock`) gets 8 s whatever it is. When a node answers `inbound_addresses` but not
+`lastblock`, the refusal names it: "THORChain height (/thorchain/lastblock) unavailable from every node that answered
+the inbound addresses" (before broadcast: "cannot read THORChain height (/thorchain/lastblock) before broadcast from
+any node that answered the inbound addresses"). Worst case without a caller signal: each `nodeUrl` host takes at most
+8 s for the quote (16 s when a quote without a slippage is retried with a wider tolerance) plus 8 s for its snapshot,
+and the host that quotes is confirmed within the 8 s that started when its quote was in hand: hosts × 16 s, or hosts ×
+24 s with the retry (32 s / 48 s with the two default hosts); `preflightDeposit` hosts × 8 s. A caller's AbortSignal
+(the router passes one: 8 s per provider, 25 s when it is the only one) replaces the 8 s bound of the quote request;
+when it aborts, the quote request, the quoting node's `lastblock` read and the confirming reads stop at once, and its
+`inbound_addresses` read keeps its own 8 s.
+
+**Requests a confirming node gets** (`THORNODE_CONFIRM_PATHS`), all `GET`, no query string, no body, headers
+`accept` and `x-client-id` only. A proxy in front of a confirming node can pass exactly these four and refuse
+anything else:
+
+| Path | When |
+| --- | --- |
+| `/thorchain/lastblock` | every confirmation |
+| `/thorchain/inbound_addresses` | every confirmation |
+| `/thorchain/vaults/asgard` | when the node's current inbound is not the quoted vault |
+| `/thorchain/mimir` | when the node's current inbound is not the quoted vault |
+
+The quoting node (`nodeUrl`) gets `/thorchain/quote/swap?from_asset=…&to_asset=…&amount=…&destination=…` with
+`tolerance_bps` or `liquidity_tolerance_bps`, `streaming_quantity=1` and, when set, `refund_address`, `affiliate`,
+`affiliate_bps`; then `/thorchain/inbound_addresses` and `GET /thorchain/lastblock` (no query string, so a proxy in
+front of a `nodeUrl` must pass it too); `trackIntent` reads `/thorchain/tx/status/<HASH>` and `/thorchain/tx/<HASH>`.
+The quote's `inbound_addresses` read and the quote itself ask for `cache: "no-store"`, which React Native's fetch
+sends as an extra `?_=<time>` query; `lastblock` and the confirming reads set no cache option.
+
 Behind `remoteProvider`, the app checks the backend's build itself: `remoteProvider({name: "thorchain", baseUrl,
 ...thorchainPins()})` pins the routers and runs `verifyBuild` on the client — the vault in the router call confirmed
 by two nodes, the source asset and exact input, and the memo's destination, refund and limit against the app's own
 request (pass the backend's `affiliate` / `affiliateBps`). The pins open the stub to the Tron deposit route
 (`depositAddressRoutes`): its vault is the one `verifyBuild` confirms.
 
+`verifyBuild` confirms the vault by the same rule as the provider's confirming nodes, so an inbound rotation between
+the backend's quote and the device's check does not refuse: current inbound or a non-flagged `ActiveVault` (never
+`RetiringVault` or another status), both chains open, on EVM the node's router equal to the call's. It asks every
+`nodeUrl` node (default: the two public nodes) in parallel on the four `THORNODE_CONFIRM_PATHS` (the same GETs, so the
+same proxy rules), each within `confirmTimeoutMs` (default 2500 ms, so the check takes at most that); a node that
+fails, redirects, answers another shape (a field of another type included, as above), is slower, or trails the
+highest THORChain height the nodes report by more than `confirmMaxLagBlocks` (default 50) is skipped. In `nodeUrl`
+order a node's refusal refuses and two confirming nodes pass. Refusals: "a THORNode reports another inbound vault
+than `<vault>`", "a THORNode reports another router",
+"`<CHAIN>` is halted / paused" (now also the destination chain), "a THORNode lists the inbound vault as `<Status>`, not
+ActiveVault", "a THORNode's mimir flags the inbound vault as compromised" (or `insolvent`), "two THORNodes within 50
+blocks of the highest THORChain height they report could not confirm the inbound vault (behind or unreachable)", "two
+THORNodes could not confirm the inbound vault".
+
 ## Activity
 
 Routers and Asgard vaults rotate, so `describeActivity(tx, ctx)` matches no

package/dist/{chunk-LYJOENYE.js → chunk-AYP7O2NT.js}

@@ -10,6 +10,200 @@ import { decodeFunctionData, encodeFunctionData } from "viem";
 import { timeoutSignal } from "@anywalletkit/protocol-swap2-core/util";
 import { ccAsset, ccAssetByToken } from "@anywalletkit/swap2-assets";
 import { bigintToNumber } from "@anywalletkit/core";
+
+// src/confirm.ts
+var THORNODE_CONFIRM_PATHS = Object.freeze({
+  lastblock: "/thorchain/lastblock",
+  inboundAddresses: "/thorchain/inbound_addresses",
+  asgardVaults: "/thorchain/vaults/asgard",
+  mimir: "/thorchain/mimir"
+});
+var DEFAULT_CONFIRM_MAX_LAG_BLOCKS = 50;
+var DEFAULT_CONFIRM_TIMEOUT_MS = 2500;
+var MIN_CONFIRM_TIMEOUT_MS = 100;
+var MAX_CONFIRM_TIMEOUT_MS = 8e3;
+function confirmOptions(o) {
+  const maxLagBlocks = o.confirmMaxLagBlocks ?? DEFAULT_CONFIRM_MAX_LAG_BLOCKS;
+  if (!Number.isInteger(maxLagBlocks) || maxLagBlocks < 0 || maxLagBlocks > 1e5) {
+    throw new Error("thorchain: confirmMaxLagBlocks must be an integer between 0 and 100000");
+  }
+  const timeoutMs = o.confirmTimeoutMs ?? DEFAULT_CONFIRM_TIMEOUT_MS;
+  if (!Number.isInteger(timeoutMs) || timeoutMs < MIN_CONFIRM_TIMEOUT_MS || timeoutMs > MAX_CONFIRM_TIMEOUT_MS) {
+    throw new Error(`thorchain: confirmTimeoutMs must be an integer between ${MIN_CONFIRM_TIMEOUT_MS} and ${MAX_CONFIRM_TIMEOUT_MS}`);
+  }
+  return { maxLagBlocks, timeoutMs };
+}
+var HostUnavailable = class extends Error {
+  constructor(host, reason) {
+    super(`thorchain: ${host} unavailable (${reason})`);
+  }
+};
+function paused(entry) {
+  return !entry || entry.halted === true || entry.global_trading_paused === true || entry.chain_trading_paused === true;
+}
+function sameTarget(a, b) {
+  if (typeof a !== "string" || typeof b !== "string" || !a || !b) return false;
+  return a.startsWith("0x") || b.startsWith("0x") ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+function nodeDeadline(ms, outer) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), Math.max(0, ms));
+  const onAbort = () => ctrl.abort();
+  if (outer) {
+    if (outer.aborted) ctrl.abort();
+    else outer.addEventListener("abort", onAbort);
+  }
+  return {
+    signal: ctrl.signal,
+    clear() {
+      clearTimeout(timer);
+      outer?.removeEventListener("abort", onAbort);
+      if (!ctrl.signal.aborted) ctrl.abort();
+    }
+  };
+}
+function sameRequestUrl(actual, expected) {
+  if (actual === void 0 || actual === null || actual === "") return true;
+  if (typeof actual !== "string") return false;
+  try {
+    const a = new URL(actual);
+    const e = new URL(expected);
+    return a.origin === e.origin && a.pathname === e.pathname && a.search === "" && a.hash === "";
+  } catch {
+    return false;
+  }
+}
+async function nodeRead(host, path, clientId, signal, outer) {
+  const url = `${host}${path}`;
+  let res;
+  try {
+    res = await fetch(url, { method: "GET", headers: { accept: "application/json", "x-client-id": clientId }, redirect: "error", signal });
+  } catch (error) {
+    if (outer?.aborted) throw error;
+    throw new HostUnavailable(host, error instanceof Error ? error.message : "fetch failed");
+  }
+  if (res.redirected === true || !sameRequestUrl(res.url, url)) throw new HostUnavailable(host, `${path} redirected`);
+  if (!res.ok) throw new HostUnavailable(host, `${path} HTTP ${res.status}`);
+  try {
+    return await res.json();
+  } catch (error) {
+    if (outer?.aborted) throw error;
+    throw new HostUnavailable(host, `${path} is not JSON`);
+  }
+}
+function int64(v) {
+  if (typeof v === "number") return Number.isSafeInteger(v) ? v : null;
+  if (typeof v === "string" && /^-?\d{1,15}$/.test(v)) return Number(v);
+  return null;
+}
+var isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var INBOUND_STRINGS = ["address", "router", "dust_threshold"];
+var INBOUND_FLAGS = ["halted", "global_trading_paused", "chain_trading_paused"];
+function inboundAddresses(body) {
+  if (!Array.isArray(body)) return null;
+  const out = [];
+  for (const e of body) {
+    if (!isObject(e) || typeof e.chain !== "string") return null;
+    const entry = { chain: e.chain };
+    for (const k of INBOUND_STRINGS) {
+      const v = e[k];
+      if (v === void 0) continue;
+      if (typeof v !== "string") return null;
+      entry[k] = v;
+    }
+    for (const k of INBOUND_FLAGS) {
+      const v = e[k];
+      if (v === void 0) continue;
+      if (typeof v !== "boolean") return null;
+      entry[k] = v;
+    }
+    out.push(entry);
+  }
+  return out;
+}
+function lastblockHeight(body) {
+  if (!Array.isArray(body) || body.length === 0) return null;
+  let height = -1;
+  for (const entry of body) {
+    if (!isObject(entry)) return null;
+    const h = int64(entry.thorchain);
+    if (h === null || h < 0) return null;
+    if (h > height) height = h;
+  }
+  return height;
+}
+function asgardVaults(body) {
+  if (!Array.isArray(body)) return null;
+  const out = [];
+  for (const v of body) {
+    if (!isObject(v)) return null;
+    if (typeof v.status !== "string" || typeof v.pub_key !== "string" || !/^thorpub1[0-9a-z]{20,}$/.test(v.pub_key)) return null;
+    if (v.type !== void 0 && v.type !== "AsgardVault") return null;
+    if (!Array.isArray(v.addresses)) return null;
+    const addresses = [];
+    for (const a of v.addresses) {
+      if (!isObject(a) || typeof a.chain !== "string" || typeof a.address !== "string") return null;
+      addresses.push({ chain: a.chain, address: a.address });
+    }
+    out.push({ pubKey: v.pub_key, status: v.status, addresses });
+  }
+  return out;
+}
+function mimirFlags(body) {
+  if (!isObject(body) || Object.keys(body).length === 0) return null;
+  const keys = Object.keys(body).map((k) => [k.toUpperCase(), body[k]]);
+  if (keys.some(([, value]) => typeof value !== "number" && typeof value !== "string")) return null;
+  return (pubKey) => {
+    const pub = pubKey.toUpperCase();
+    const compromisedKey = `COMPROMISEDVAULT-${pub}`;
+    const insolventPrefix = `SOLVENCYHALTVAULT-${pub}-`;
+    let flag = null;
+    for (const [key, value] of keys) {
+      const kind = key === compromisedKey ? "compromised" : key.startsWith(insolventPrefix) ? "insolvent" : null;
+      if (!kind) continue;
+      const n = int64(value);
+      if (n === null) return "malformed";
+      if (n > 0 && flag !== "compromised") flag = kind;
+    }
+    return flag;
+  };
+}
+async function nodeHead(host, read) {
+  const [lastblock, inbound] = await Promise.all([read(THORNODE_CONFIRM_PATHS.lastblock), read(THORNODE_CONFIRM_PATHS.inboundAddresses)]);
+  const height = lastblockHeight(lastblock);
+  if (height === null) throw new HostUnavailable(host, "lastblock is not a THORNode lastblock list");
+  return { height, inbound };
+}
+async function vaultVerdict(host, read, inbound, claim) {
+  if (!Array.isArray(inbound)) throw new HostUnavailable(host, "inbound_addresses is not a list");
+  const entries = inboundAddresses(inbound);
+  if (!entries) throw new HostUnavailable(host, "inbound_addresses is not a THORNode inbound address list");
+  const entry = entries.find((e) => e.chain === claim.chain);
+  if (paused(entry)) return { ok: false, why: "halted", chain: claim.chain };
+  if (claim.destChain !== void 0 && paused(entries.find((e) => e.chain === claim.destChain))) {
+    return { ok: false, why: "halted", chain: claim.destChain };
+  }
+  if (!sameTarget(entry?.address, claim.vault)) {
+    const [asgardBody, mimirBody] = await Promise.all([read(THORNODE_CONFIRM_PATHS.asgardVaults), read(THORNODE_CONFIRM_PATHS.mimir)]);
+    const vaults = asgardVaults(asgardBody);
+    if (!vaults) throw new HostUnavailable(host, "vaults/asgard is not a THORNode vault list");
+    const flags = mimirFlags(mimirBody);
+    if (!flags) throw new HostUnavailable(host, "mimir is not a THORNode mimir map");
+    const holders = vaults.filter((v) => v.addresses.some((a) => a.chain === claim.chain && sameTarget(a.address, claim.vault)));
+    const active = holders.find((v) => v.status === "ActiveVault");
+    if (!active) {
+      if (!holders.length) return { ok: false, why: "another-vault" };
+      return { ok: false, why: "not-active", status: /^[A-Za-z]{1,32}$/.test(holders[0].status) ? holders[0].status : "an unknown status" };
+    }
+    const flag = flags(active.pubKey);
+    if (flag === "malformed") throw new HostUnavailable(host, "mimir holds a non-integer vault flag");
+    if (flag) return { ok: false, why: "flagged", flag };
+  }
+  if (claim.router !== void 0 && !sameTarget(entry?.router, claim.router)) return { ok: false, why: "another-router" };
+  return { ok: true };
+}
+
+// src/provider.ts
 var HOSTS = [
   "https://gateway.liquify.com/chain/thorchain_api",
   "https://thorchain.ibs.team/api"
@@ -25,6 +219,9 @@ var NATIVE = "0x0000000000000000000000000000000000000000";
 var TOLERANCE_BPS = "300";
 var MAX_TOLERANCE_BPS = 500n;
 var QUOTE_VALIDITY_MS = 5 * 6e4;
+var NODE_READ_TIMEOUT_MS = 8e3;
+var CONFIRM_BUDGET_MS = 8e3;
+var LAGGING = /* @__PURE__ */ Symbol("lagging");
 var THOR_CHAIN = {
   "eip155:1": "ETH",
   "eip155:8453": "BASE",
@@ -105,18 +302,13 @@ function destAsset(destChain, destToken) {
   const asset = thorAsset(destChain, a.symbol);
   return asset ? { asset, decimals: a.decimals } : void 0;
 }
-var HostUnavailable = class extends Error {
-  constructor(host, reason) {
-    super(`thorchain: ${host} unavailable (${reason})`);
-  }
-};
 async function hostGet(host, path, clientId, signal) {
   let res;
   try {
     res = await fetch(`${host}${path}`, {
       headers: { accept: "application/json", "x-client-id": clientId },
       cache: "no-store",
-      signal: signal ?? timeoutSignal(8e3)
+      signal: signal ?? timeoutSignal(NODE_READ_TIMEOUT_MS)
     });
   } catch (error) {
     if (signal?.aborted) throw error;
@@ -151,14 +343,9 @@ function belowThorMinimums(amount1e8, inbound, quote) {
 async function inboundAddressesOn(host, clientId) {
   const res = await hostGet(host, "/thorchain/inbound_addresses", clientId);
   if (!res.ok || !Array.isArray(res.body)) throw new HostUnavailable(host, `inbound_addresses HTTP ${res.status}`);
-  return res.body;
-}
-function paused(entry) {
-  return !entry || entry.halted === true || entry.global_trading_paused === true || entry.chain_trading_paused === true;
-}
-function sameTarget(a, b) {
-  if (!a || !b) return false;
-  return a.startsWith("0x") || b.startsWith("0x") ? a.toLowerCase() === b.toLowerCase() : a === b;
+  const entries = inboundAddresses(res.body);
+  if (!entries) throw new HostUnavailable(host, "inbound_addresses is not a THORNode inbound address list");
+  return entries;
 }
 function verifiedMemo(memo, expectedAsset, expectedDestination, expectedRefund, expectedAffiliate, expectedAffiliateBps) {
   if (memo.includes("|")) return null;
@@ -188,6 +375,25 @@ function thorchainPins(opts = {}) {
   const nodes = [...new Set((Array.isArray(opts.nodeUrl) ? opts.nodeUrl : opts.nodeUrl ? opts.nodeUrl.split(",") : HOSTS).map((h) => h.trim().replace(/\/$/, "")).filter(Boolean))];
   for (const n of nodes) if (!/^https:\/\//i.test(n)) throw new Error("thorchain: thorchainPins nodeUrl must use https");
   const clientId = opts.clientId?.trim() || DEFAULT_CLIENT_ID;
+  const { maxLagBlocks, timeoutMs } = confirmOptions(opts);
+  const askNode = async (host, claim) => {
+    const node = nodeDeadline(timeoutMs);
+    const read = (path) => nodeRead(host, path, clientId, node.signal);
+    try {
+      const head = await nodeHead(host, read);
+      try {
+        return { height: head.height, verdict: await vaultVerdict(host, read, head.inbound, claim) };
+      } catch (error) {
+        if (error instanceof HostUnavailable) return { height: head.height, verdict: null };
+        throw error;
+      }
+    } catch (error) {
+      if (error instanceof HostUnavailable) return null;
+      throw error;
+    } finally {
+      node.clear();
+    }
+  };
   const routersFor = (chain) => [...THORCHAIN_ROUTERS[chain] ?? [], ...opts.trustedRouters?.[chain] ?? []];
   return Object.freeze({
     callTargets: routersFor,
@@ -228,22 +434,36 @@ function thorchainPins(opts = {}) {
       if (!checked) return `the memo does not pay ${params.destAddress} in ${dst.asset} with this app's refund and affiliate`;
       if (memo !== checked.canonical) return `the memo is not the canonical ${checked.canonical}`;
       if (checked.limit * 10n ** BigInt(dst.decimals) / 100000000n < BigInt(quote.minDestAmount)) return `the memo's limit ${checked.limit} is below the quoted minimum`;
+      const sourceChain = THOR_CHAIN[params.sourceChain] ?? params.sourceChain;
+      const claim = { chain: sourceChain, destChain: THOR_CHAIN[params.destChain] ?? params.destChain, vault, ...router !== void 0 ? { router } : {} };
+      const views = await Promise.all(nodes.map((host) => askNode(host, claim)));
+      const top = views.reduce((max, v) => v && v.height > max ? v.height : max, -1);
       let agreeing = 0;
-      for (const host of nodes) {
-        let entries;
-        try {
-          entries = await inboundAddressesOn(host, clientId);
-        } catch (error) {
-          if (error instanceof HostUnavailable) continue;
-          throw error;
+      let lagging = false;
+      for (const view of views) {
+        if (!view?.verdict) continue;
+        if (top - view.height > maxLagBlocks) {
+          lagging = true;
+          continue;
+        }
+        const v = view.verdict;
+        if (!v.ok) {
+          switch (v.why) {
+            case "halted":
+              return `${v.chain} is halted / paused`;
+            case "another-vault":
+              return `a THORNode reports another inbound vault than ${vault}`;
+            case "not-active":
+              return `a THORNode lists the inbound vault as ${v.status}, not ActiveVault`;
+            case "flagged":
+              return `a THORNode's mimir flags the inbound vault as ${v.flag}`;
+            case "another-router":
+              return "a THORNode reports another router";
+          }
         }
-        const entry = entries.find((e) => e.chain === THOR_CHAIN[params.sourceChain]);
-        if (paused(entry)) return `${THOR_CHAIN[params.sourceChain]} is halted / paused`;
-        if (!sameTarget(entry?.address, vault)) return `a THORNode reports another inbound vault than ${vault}`;
-        if (router !== void 0 && !sameTarget(entry?.router, router)) return "a THORNode reports another router";
         if (++agreeing >= 2) return null;
       }
-      return "two THORNodes could not confirm the inbound vault";
+      return lagging ? `two THORNodes within ${maxLagBlocks} blocks of the highest THORChain height they report could not confirm the inbound vault (behind or unreachable)` : "two THORNodes could not confirm the inbound vault";
     }
   });
 }
@@ -283,21 +503,100 @@ function thorchainProvider(config = {}) {
     routers.set(chain, set);
   }
   const pinnedRouter = (chain, router) => !!router && routers.get(chain)?.has(router.toLowerCase()) === true;
-  const confirmedElsewhere = async (quoteHost, chain, vault, router) => {
+  const { maxLagBlocks: confirmMaxLagBlocks, timeoutMs: confirmTimeoutMs } = confirmOptions(config);
+  const nodeSnapshot = (host, outer) => new Promise((resolve, reject) => {
+    let inbounds;
+    let height;
+    let heightError;
+    let done = false;
+    const tip = nodeDeadline(NODE_READ_TIMEOUT_MS, outer);
+    const settle = () => {
+      if (done || inbounds === void 0 || height === void 0 && heightError === void 0) return;
+      done = true;
+      resolve(heightError ? { inbounds, heightError } : { inbounds, height });
+    };
+    const fail = (error) => {
+      if (done) return;
+      done = true;
+      tip.clear();
+      reject(error);
+    };
+    inboundAddressesOn(host, clientId).then((v) => {
+      inbounds = v;
+      settle();
+    }, fail);
+    nodeRead(host, THORNODE_CONFIRM_PATHS.lastblock, clientId, tip.signal, outer).then(
+      (body) => {
+        tip.clear();
+        const h = lastblockHeight(body);
+        if (h === null) heightError = new HostUnavailable(host, "lastblock is not a THORNode lastblock list");
+        else height = h;
+        settle();
+      },
+      (error) => {
+        tip.clear();
+        if (!(error instanceof HostUnavailable)) return fail(error);
+        heightError = error;
+        settle();
+      }
+    );
+  });
+  const confirmText = (v) => {
+    switch (v.why) {
+      case "halted":
+        return `${v.chain} is halted / paused on the confirming node`;
+      case "another-vault":
+        return "a second node reports another inbound vault \u2014 refused until they agree";
+      case "not-active":
+        return `a second node lists the inbound vault as ${v.status}, not ActiveVault \u2014 refused`;
+      case "flagged":
+        return `a second node's mimir flags the inbound vault as ${v.flag} \u2014 refused`;
+      case "another-router":
+        return "a second node reports another router \u2014 refused until they agree";
+    }
+  };
+  const confirmOn = async (host, signal, outer, quoteHeight, claim) => {
+    const read = (path) => nodeRead(host, path, clientId, signal, outer);
+    const head = await nodeHead(host, read);
+    if (quoteHeight - head.height > confirmMaxLagBlocks) return LAGGING;
+    const verdict = await vaultVerdict(host, read, head.inbound, claim);
+    return verdict.ok ? null : confirmText(verdict);
+  };
+  const confirmedElsewhere = async (quoteHost, quoteHeight, chain, destChain, vault, router, deadlineAt, outer) => {
+    const claim = {
+      chain: THOR_CHAIN[chain] ?? chain,
+      ...destChain !== void 0 ? { destChain: THOR_CHAIN[destChain] ?? destChain } : {},
+      vault,
+      ...router !== void 0 ? { router } : {}
+    };
+    let lagging = false;
+    let asked = 0;
     for (const host of confirmHosts) {
       if (host === quoteHost) continue;
-      let entries;
+      const budget = Math.min(confirmTimeoutMs, deadlineAt - Date.now());
+      if (budget < MIN_CONFIRM_TIMEOUT_MS) break;
+      asked++;
+      const node = nodeDeadline(budget, outer);
       try {
-        entries = await inboundAddressesOn(host, clientId);
+        const verdict = await confirmOn(host, node.signal, outer, quoteHeight, claim);
+        if (verdict === LAGGING) {
+          lagging = true;
+          continue;
+        }
+        return verdict;
       } catch (error) {
+        if (outer?.aborted) throw error;
         if (error instanceof HostUnavailable) continue;
         throw error;
+      } finally {
+        node.clear();
       }
-      const entry = entries.find((e) => e.chain === THOR_CHAIN[chain]);
-      if (paused(entry)) return `${THOR_CHAIN[chain]} is halted / paused on the confirming node`;
-      if (!sameTarget(entry?.address, vault)) return "a second node reports another inbound vault \u2014 refused until they agree";
-      if (router !== void 0 && !sameTarget(entry?.router, router)) return "a second node reports another router \u2014 refused until they agree";
-      return null;
+    }
+    if (lagging) {
+      return `no confirming node is within ${confirmMaxLagBlocks} blocks of the quoting node's THORChain height (behind or unreachable) \u2014 refused until one catches up`;
+    }
+    if (asked === 0) {
+      return `the ${CONFIRM_BUDGET_MS / 1e3} s confirmation budget ran out before a second node could be asked to confirm the inbound vault \u2014 retry`;
     }
     return "no second node answered to confirm the inbound vault (configure confirmNodeUrl)";
   };
@@ -390,6 +689,9 @@ function thorchainProvider(config = {}) {
       let checkedMemo = null;
       let inbounds = null;
       let quoteHost = "";
+      let quoteHeight = 0;
+      let confirmDeadlineAt = 0;
+      let heightUnavailable = false;
       for (const host of hosts) {
         try {
           if (limitMode === "liquidity_tolerance_bps") {
@@ -434,8 +736,16 @@ function thorchainProvider(config = {}) {
             params.onRefusal?.(`thorchain: floor breach (limit=${checkedMemo.limit} < floor=${floor1e8}, 1e8 units)`);
             return null;
           }
-          inbounds = await inboundAddressesOn(host, clientId);
+          const deadlineAt = Date.now() + CONFIRM_BUDGET_MS;
+          const snapshot = await nodeSnapshot(host, signal);
+          if ("heightError" in snapshot) {
+            heightUnavailable = true;
+            throw snapshot.heightError;
+          }
+          inbounds = snapshot.inbounds;
+          quoteHeight = snapshot.height;
           quoteHost = host;
+          confirmDeadlineAt = deadlineAt;
           break;
         } catch (error) {
           if (error instanceof HostUnavailable) {
@@ -448,7 +758,9 @@ function thorchainProvider(config = {}) {
         }
       }
       if (!q?.expected_amount_out || !q.inbound_address || !q.expiry || !checkedMemo || !inbounds) {
-        params.onRefusal?.(!inbounds ? "thorchain: inbound addresses unavailable from every node" : "thorchain: no quote from any node");
+        params.onRefusal?.(
+          inbounds ? "thorchain: no quote from any node" : heightUnavailable ? "thorchain: THORChain height (/thorchain/lastblock) unavailable from every node that answered the inbound addresses" : "thorchain: inbound addresses unavailable from every node"
+        );
         return null;
       }
       const limit1e8 = checkedMemo.limit;
@@ -470,7 +782,16 @@ function thorchainProvider(config = {}) {
         params.onRefusal?.(`thorchain: router ${String(q.router)} is not a THORChain router this module trusts on ${params.sourceChain} (THORCHAIN_ROUTERS / trustedRouters)`);
         return null;
       }
-      const unconfirmed = await confirmedElsewhere(quoteHost, params.sourceChain, q.inbound_address, chainId ? q.router : void 0);
+      const unconfirmed = await confirmedElsewhere(
+        quoteHost,
+        quoteHeight,
+        params.sourceChain,
+        params.destChain,
+        q.inbound_address,
+        chainId ? q.router : void 0,
+        confirmDeadlineAt,
+        signal
+      );
       if (unconfirmed) {
         params.onRefusal?.(`thorchain: ${unconfirmed}`);
         return null;
@@ -585,18 +906,42 @@ function thorchainProvider(config = {}) {
       if (evmSource && !pinnedRouter(data.sourceChain, data.router)) throw new Error("thorchain: the quote's router is not one this module trusts");
       let inbounds = null;
       let snapshotHost = "";
+      let snapshotHeight = 0;
+      let confirmDeadlineAt = 0;
+      let heightUnavailable = false;
       for (const host of hosts) {
+        const deadlineAt = Date.now() + CONFIRM_BUDGET_MS;
         try {
-          inbounds = await inboundAddressesOn(host, clientId);
+          const snapshot = await nodeSnapshot(host);
+          if ("heightError" in snapshot) {
+            heightUnavailable = true;
+            continue;
+          }
+          inbounds = snapshot.inbounds;
+          snapshotHeight = snapshot.height;
           snapshotHost = host;
+          confirmDeadlineAt = deadlineAt;
           break;
         } catch (error) {
+          inbounds = null;
           if (!(error instanceof HostUnavailable)) throw error;
         }
       }
-      if (!inbounds) throw new Error("thorchain: cannot refresh inbound addresses before broadcast");
+      if (!inbounds) {
+        throw new Error(
+          heightUnavailable ? "thorchain: cannot read THORChain height (/thorchain/lastblock) before broadcast from any node that answered the inbound addresses" : "thorchain: cannot refresh inbound addresses before broadcast"
+        );
+      }
       const confirm = async () => {
-        const unconfirmed = await confirmedElsewhere(snapshotHost, data.sourceChain, data.inboundAddress, evmSource ? data.router : void 0);
+        const unconfirmed = await confirmedElsewhere(
+          snapshotHost,
+          snapshotHeight,
+          data.sourceChain,
+          data.destChain,
+          data.inboundAddress,
+          evmSource ? data.router : void 0,
+          confirmDeadlineAt
+        );
         if (unconfirmed) throw new Error(`thorchain: ${unconfirmed}`);
       };
       const src = inbounds.find((entry) => entry.chain === THOR_CHAIN[data.sourceChain]);
@@ -688,8 +1033,9 @@ function thorchainProvider(config = {}) {
 }
 
 export {
+  THORNODE_CONFIRM_PATHS,
   THORCHAIN_ROUTERS,
   thorchainPins,
   thorchainProvider
 };
-//# sourceMappingURL=chunk-LYJOENYE.js.map
+//# sourceMappingURL=chunk-AYP7O2NT.js.map