@atomiqlabs/lp-lib 17.5.3 → 17.6.0

package/src/swaps/escrow/tobtcln_abstract/ToBtcLnAbs.ts

@@ -7,7 +7,8 @@ import {
     ChainSwapType,
     ClaimEvent,
     InitializeEvent,
-    RefundEvent, SwapCommitStateType,
+    RefundEvent,
+    SwapCommitStateType,
     SwapData
 } from "@atomiqlabs/base";
 import {expressHandlerWrapper, getAbortController, HEX_REGEX, isDefinedRuntimeError} from "../../../utils/Utils";
@@ -27,9 +28,8 @@ import {
     ProbeAndRouteResponse,
     routesMatch
 } from "../../../wallets/ILightningWallet";
-import { LightningAssertions } from "../../assertions/LightningAssertions";
+import {LightningAssertions} from "../../assertions/LightningAssertions";
 import {isQuoteThrow} from "../../../plugins/IPlugin";
-import {ToBtcSwapState} from "../tobtc_abstract/ToBtcSwapAbs";
 
 export type ToBtcLnConfig = ToBtcBaseConfig & {
     routingFeeMultiplier: bigint | number,
@@ -197,7 +197,8 @@ export class ToBtcLnAbs extends ToBtcBaseSwapHandler<ToBtcLnSwapAbs, ToBtcLnSwap
         ]);
 
         for(let {obj: swap} of queriedData) {
-            await this.processPastSwap(swap);
+            await this.processPastSwap(swap)
+                .catch(e => this.swapLogger.error(swap, "processPastSwap(): Error executing watchdog function: ", e));
         }
     }
 
@@ -300,6 +301,10 @@ export class ToBtcLnAbs extends ToBtcBaseSwapHandler<ToBtcLnSwapAbs, ToBtcLnSwap
             this.swapLogger.info(invoiceData, "subscribeToPayment(): result callback, outcome: "+result.status+" invoice: "+invoiceData.pr);
             this.processPaymentResult(invoiceData, result).catch(e => this.swapLogger.error(invoiceData, "subscribeToPayment(): process payment result", e));
             this.activeSubscriptions.delete(paymentHash);
+        }).catch(e => {
+            this.swapLogger.error(invoiceData, "subscribeToPayment(): error while waiting for invoice payment: ", e);
+            //Delete from active subscription, the watchdog will re-subscribe later
+            this.activeSubscriptions.delete(paymentHash);
         });
         this.swapLogger.info(invoiceData, "subscribeToPayment(): subscribe to payment outcome, invoice: "+invoiceData.pr);
 
@@ -418,6 +423,9 @@ export class ToBtcLnAbs extends ToBtcBaseSwapHandler<ToBtcLnSwapAbs, ToBtcLnSwap
                 } else throw e;
             }
 
+            const unlock = swap.lock(120);
+            if(unlock==null) return;
+
             await swap.setState(ToBtcLnSwapState.COMMITED);
             await this.saveSwapData(swap);
             try {
@@ -426,10 +434,22 @@ export class ToBtcLnAbs extends ToBtcBaseSwapHandler<ToBtcLnSwapAbs, ToBtcLnSwap
                 this.swapLogger.error(swap, "processInitialized(): lightning payment error", e);
                 if(isDefinedRuntimeError(e)) {
                     if(swap.metadata!=null) swap.metadata.payError = e;
-                    await swap.setState(ToBtcLnSwapState.NON_PAYABLE);
-                    await this.saveSwapData(swap);
-                    return;
+                    const payment = await this.lightning.getPayment(swap.lnPaymentHash);
+                    if(!unlock()) return;
+                    if(payment==null || payment.status==="failed") {
+                        if(swap.state as ToBtcLnSwapState === ToBtcLnSwapState.COMMITED)
+                            await swap.setState(ToBtcLnSwapState.NON_PAYABLE);
+                        await this.saveSwapData(swap);
+                        return;
+                    } else if(payment.status==="confirmed") {
+                        await this.processPaymentResult(swap, payment);
+                        return;
+                    } else {
+                        //Fall-through to subscribe
+                    }
                 } else throw e;
+            } finally {
+                unlock();
             }
             this.subscribeToPayment(swap);
             return;
@@ -1078,6 +1098,16 @@ export class ToBtcLnAbs extends ToBtcBaseSwapHandler<ToBtcLnSwapAbs, ToBtcLnSwap
                 };
 
                 if(data.state===ToBtcLnSwapState.NON_PAYABLE) {
+                    if(data.payInitiated) {
+                        //Check that the ln payment is indeed non-existent or failed
+                        const lnPayment = await this.lightning.getPayment(data.lnPaymentHash);
+                        if(lnPayment!=null && lnPayment.status!=="failed") throw {
+                            _httpStatus: 200,
+                            code: 20008,
+                            msg: "Payment in-flight"
+                        };
+                    }
+
                     const refundSigData = await swapContract.getRefundSignature(signer, data.data, this.config.refundAuthorizationTimeout);
 
                     //Double check the state after promise result

package/src/swaps/spv_vault_swap/SpvVaultSwapHandler.ts

@@ -311,7 +311,8 @@ export class SpvVaultSwapHandler extends SwapHandler<SpvVaultSwap, SpvVaultSwapS
         ]);
 
         for(let {obj: swap} of swaps) {
-            await this.processPastSwap(swap);
+            await this.processPastSwap(swap)
+                .catch(e => this.swapLogger.error(swap, "processPastSwap(): Error executing watchdog function: ", e));
         }
     }
 
@@ -794,13 +795,12 @@ export class SpvVaultSwapHandler extends SwapHandler<SpvVaultSwap, SpvVaultSwapS
                 swap
             );
             if(isQuoteThrow(pluginCheckResult)) {
-                const error = {
+                if(swap.state===SpvVaultSwapState.CREATED)
+                    await this.removeSwapData(swap, SpvVaultSwapState.FAILED);
+                throw {
                     code: 29999,
                     msg: pluginCheckResult.message
-                }
-                if(swap.metadata!=null) swap.metadata.postQuoteError = error;
-                await this.removeSwapData(swap, SpvVaultSwapState.FAILED);
-                throw error;
+                };
             }
 
             await this.Vaults.checkVaultReplacedTransactions(vault, true);
@@ -811,16 +811,22 @@ export class SpvVaultSwapHandler extends SwapHandler<SpvVaultSwap, SpvVaultSwapS
                 };
             }
 
+            const unlock = swap.lock(120);
+            if(!unlock) throw {
+                code: 20517,
+                msg: "Bitcoin transaction submission already in progress, please retry later!"
+            };
+
+            let swapSendingSet = false;
+            let dataSendingSet = false;
             try {
                 const btcRawTx = Buffer.from(signedTx.toBytes(true, true)).toString("hex");
 
                 //Double-check the state to prevent race condition
-                if(swap.state!==SpvVaultSwapState.CREATED) {
-                    throw {
-                        code: 20505,
-                        msg: "Invalid quote ID, not found or expired!"
-                    };
-                }
+                if(swap.state!==SpvVaultSwapState.CREATED) throw {
+                    code: 20505,
+                    msg: "Invalid quote ID, not found or expired!"
+                };
 
                 //Double check in-flight swap count
                 this.checkTooManyInflightSwaps();
@@ -828,11 +834,13 @@ export class SpvVaultSwapHandler extends SwapHandler<SpvVaultSwap, SpvVaultSwapS
                 swap.btcTxId = signedTx.id;
                 swap.state = SpvVaultSwapState.SIGNED;
                 swap.sending = true;
+                swapSendingSet = true;
                 await this.saveSwapData(swap);
 
                 data.btcTx.raw = btcRawTx;
                 (data as any).sending = true;
                 vault.addWithdrawal(data);
+                dataSendingSet = true;
                 await this.Vaults.saveVault(vault);
 
                 this.swapLogger.info(swap, "REST: /postQuote: BTC transaction signed, txId: "+swap.btcTxId);
@@ -850,15 +858,25 @@ export class SpvVaultSwapHandler extends SwapHandler<SpvVaultSwap, SpvVaultSwapS
                     };
                 }
             } catch (e) {
-                (data as any).sending = false;
-                swap.sending = false;
-                vault.removeWithdrawal(data);
-                await this.Vaults.saveVault(vault);
+                if(swapSendingSet) swap.sending = false;
+                if(dataSendingSet) {
+                    (data as any).sending = false;
+                    vault.removeWithdrawal(data);
+                    await this.Vaults.saveVault(vault);
+                }
 
-                if(isDefinedRuntimeError(e) && swap.metadata!=null) swap.metadata.postQuoteError = e;
-                await this.removeSwapData(swap, SpvVaultSwapState.FAILED);
+                //Check if the error is only because the state has already changed
+                if(!isDefinedRuntimeError(e) || e.code!==20505) {
+                    //We only make the swap failed if the error happened in CREATED or SIGNED states
+                    if(swap.state===SpvVaultSwapState.CREATED || swap.state===SpvVaultSwapState.SIGNED) {
+                        if(isDefinedRuntimeError(e) && swap.metadata!=null) swap.metadata.postQuoteError = e;
+                        await this.removeSwapData(swap, SpvVaultSwapState.FAILED);
+                    }
+                }
 
                 throw e;
+            } finally {
+                unlock();
             }
 
             await responseStream.writeParamsAndEnd({

package/src/swaps/trusted/frombtc_trusted/FromBtcTrusted.ts

@@ -13,6 +13,29 @@ import {IBitcoinWallet} from "../../../wallets/IBitcoinWallet";
 import {FromBtcAmountAssertions} from "../../assertions/FromBtcAmountAssertions";
 import {isQuoteThrow} from "../../../plugins/IPlugin";
 
+/*
+TODO: IN CASE THIS EVER GETS USED, FIX THE FOLLOWING:
+
+HIGH 5 — FromBtcTrusted (0-conf): no RBF check, fee gate is min not max, and the burn defense only fires when it shouldn't
+
+Handler is opt-in (ONCHAIN_TRUSTED, not in shipped configs), but if enabled:
+
+• Acceptance (FromBtcTrusted.js:186-194) checks only: direct parents confirmed + fee threshold. Nothing inspects tx.ins[].sequence for BIP-125 (grep: only storage-sequence hits). A double-spendable opt-in-RBF tx is
+ accepted and tokens are sent within seconds.
+• The fee gate is fee >= recommendedFee || fee >= currentRate (line 187) — the weaker of the two wins; the documented intent is max(...). The runner even overrides the library's 1.25 multiplier to 1
+ (IntermediaryRunner.ts FromBtcTrusted section). A stale low fee maximizes the replacement window and minimizes the attacker's BIP-125 cost.
+• The burn defense (checkDoubleSpends → burn() → sendRawPackage([tx1, burnChild])) is rejected by any node whose mempool already holds the replacement — so it structurally loses against a broadcast double-spend, and
+ with mempoolfullrbf (default since Core 28) even non-signaling txs are replaceable.
+• Worse, checkDoubleSpends (lines 636-644) treats getTransaction == null as "double-spent" — but null also means mempool eviction (fee spike, node restart). With no conflict anywhere, the burn package is valid and
+ burns the entire deposit to miners — after tokens were already sent, that's a full LP loss with no attacker at all.
+
+MEDIUM 6 — FromBtcTrusted /setRefundAddress is dead code; refundable user funds strand permanently
+
+FromBtcTrusted.js:606 looks up getData(paymentHash, null); IntermediaryStorageManager.getData (line 64-66) converts null → sequence 0x0, but every swap is stored with a random 64-bit sequence — so the lookup always
+misses and the endpoint always throws 10001. (The status endpoint at line 515 does it correctly.) Any swap that becomes REFUNDABLE (over-max payment, plugin veto, chain revert, balance failure) without a refund
+address set at creation can never be refunded (refundSwap early-returns without one). User funds sit in the LP wallet forever. One-line fix: pass parsedBody.sequence.
+ */
+
 export type FromBtcTrustedConfig = SwapBaseConfig & {
     doubleSpendCheckInterval: number,
     swapAddressExpiry: number,
@@ -298,7 +321,7 @@ export class FromBtcTrusted extends SwapHandler<FromBtcTrustedSwap, FromBtcTrust
 
             const txns = await chainInterface.txsTransfer(signer.getAddress(), swap.token, swap.adjustedOutput, swap.dstAddress);
 
-            let unlock = swap.lock(30*1000);
+            let unlock = swap.lock(30);
             if(unlock==null) return;
 
             const pluginCheckResult = await PluginManager.onHandlePreFromBtcExecute(
@@ -399,7 +422,7 @@ export class FromBtcTrusted extends SwapHandler<FromBtcTrustedSwap, FromBtcTrust
             try {
                 await this.processPastSwap(swap, txs[0]?.tx, txs[0]?.vout);
             } catch (e) {
-                this.swapLogger.error(swap, "processPastSwaps(): Error ocurred while processing swap: ", e);
+                this.swapLogger.error(swap, "processPastSwap(): Error executing watchdog function: ", e);
             }
         }
     }

package/src/swaps/trusted/frombtcln_trusted/FromBtcLnTrusted.ts

@@ -171,7 +171,11 @@ export class FromBtcLnTrusted extends SwapHandler<FromBtcLnTrustedSwap, FromBtcL
         ]);
 
         for(let {obj: swap} of queriedData) {
-            if(await this.processPastSwap(swap)) cancelInvoices.push(swap);
+            try {
+                if(await this.processPastSwap(swap)) cancelInvoices.push(swap);
+            } catch (e) {
+                this.swapLogger.error(swap, "processPastSwap(): Error executing watchdog function: ", e);
+            }
         }
 
         await this.cancelInvoices(cancelInvoices);

package/src/utils/Utils.ts

@@ -150,3 +150,51 @@ export function parsePsbt(btcTx: Transaction): BtcTx {
         })
     };
 }
+
+/**
+ * Returns the minimum Bitcoin block window (in blocks) for which a "fast blocks" safety
+ * factor is genuinely usable: the probability that N consecutive blocks are produced
+ * with an average interval below (blocktime / safetyFactor) is less than `probability`.
+ *
+ * Model: block arrivals are a Poisson process (i.i.d. exponential intervals), so the
+ * production time of N blocks is Erlang/Gamma(shape=N). A Chernoff (Cramer) bound on
+ * the lower tail gives the per-block large-deviation rate I(S) = ln(S) + 1/S - 1, i.e.
+ *     P(N blocks faster than blocktime/S on average) <= exp(-N * I(S))
+ * which this function inverts for N. Conservative: the exact Erlang CDF already
+ * satisfies the bound ~25% earlier. Use for the fast-block tail (e.g. incoming LN
+ * HTLC expiry racing an escrow claim window).
+ *
+ * @param {number|bigint} safetyFactor Assumed max block-speed multiplier (must be > 1)
+ * @param {number} [probability=0.0001] Tolerated failure probability (default 0.01%)
+ * @returns {number} Minimum safe block window in blocks
+ */
+export function getMinSafeBlockWindowFast(safetyFactor: number | bigint, probability: number = 0.0001): bigint {
+    const S = Number(safetyFactor);
+    const rate = Math.log(S) + 1/S - 1;
+    if (!(rate > 0)) throw new RangeError("safetyFactor must be > 1");
+    return BigInt(Math.ceil(Math.log(1/probability) / rate));
+}
+
+/**
+ * Slow-tail mirror of getMinSafeBlockWindowFast(): returns the minimum block window
+ * (in blocks) for which a "slow blocks" safety factor is genuinely usable: the
+ * probability that N consecutive blocks take LONGER than N * blocktime * safetyFactor
+ * is less than `probability`. Chernoff bound on the upper Erlang tail gives the rate
+ * I(S) = S - 1 - ln(S). Use when converting a wall-clock deadline into a block count
+ * (e.g. payout/claim timeouts that must expire before some real-world time even if
+ * blocks come slowly).
+ *
+ * @param {number|bigint} safetyFactor Assumed max block-slowness multiplier (must be > 1)
+ * @param {number} [probability=0.0001] Tolerated failure probability (default 0.01%)
+ * @returns {number} Minimum safe block window in blocks
+ */
+export function getMinSafeBlockWindowSlow(safetyFactor: bigint | number, probability: number = 0.0001): bigint {
+    const S = Number(safetyFactor);
+    const rate = S - 1 - Math.log(S);
+    if (!(rate > 0)) throw new RangeError("safetyFactor must be > 1");
+    return BigInt(Math.ceil(Math.log(1/probability) / rate));
+}
+
+export function bigIntMax(a: bigint, b: bigint): bigint {
+    return a > b ? a : b;
+}