@vultisig/core-chain 2.29.3 → 2.31.0

package/dist/swap/native/limitSwapCancelDust.js

@@ -0,0 +1,100 @@
+/**
+ * THORChain publishes `dust_threshold` in its own 1e8 fixed point, regardless
+ * of the source chain's native precision.
+ */
+const thorchainFixedPointDecimals = 8;
+/**
+ * Safety multiple over the larger floor.
+ *
+ * A cancel sitting exactly ON a threshold is a coin flip: THORNode's own
+ * comparisons are not uniformly `>=`, and the published threshold can move
+ * between the inbound fetch and the transaction landing. Doubling removes both
+ * without a magic absolute floor that would be wrong on some chain's units
+ * (10,000 is dust on an 18-decimal chain and real money on an 8-decimal one).
+ */
+const dustSafetyMultiple = 2n;
+/**
+ * Largest `dust_threshold`, in THORChain's own 1e8 units, that is plausible for
+ * any chain — one whole unit of the asset.
+ *
+ * `dust_threshold` is a REMOTE value that directly decides how much of the
+ * user's money is irreversibly donated: there is no refund path for anything
+ * attached to an `m=<`. So the bound has to be ABSOLUTE. A ceiling expressed as
+ * a multiple of the threshold itself cannot work — a hostile value scales both
+ * sides equally and is honoured verbatim.
+ *
+ * Real thresholds are orders of magnitude below this (Bitcoin's is 10000, or
+ * 0.0001 BTC), so the bound rejects only the absurd.
+ */
+const maximumThresholdIn1e8 = 100000000n;
+/**
+ * Largest coin precision this rescaling supports.
+ *
+ * Without it, any non-negative integer is accepted and `decimals: 1000` yields
+ * a 993-digit multiplier and a meaningless amount. 36 is far above every real
+ * chain (18 is the EVM maximum) while keeping the arithmetic bounded.
+ */
+const maximumDecimals = 36;
+export const limitSwapCancelDustErrors = [
+    'thresholdUnavailable',
+    'malformedThreshold',
+    'unusablePrecision',
+    'belowObservableMinimum',
+    'exceedsCeiling',
+];
+export class LimitSwapCancelDustError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = 'LimitSwapCancelDustError';
+    }
+}
+/**
+ * How much to attach to a cancel sent FROM an L1 chain, in the source coin's
+ * smallest units.
+ *
+ * A cancel carries no value; the amount exists solely so Bifrost observes the
+ * transaction at all. Both failure modes are silent, which is why every branch
+ * here throws rather than defaulting:
+ *
+ * - Under-funded, and Bifrost drops it before it becomes a `MsgObservedTxIn` —
+ *   the transaction confirms, the fee is spent, nothing is cancelled.
+ * - Over-funded, and the excess is irreversibly donated.
+ *
+ * The conversion is the part that has actually gone wrong in practice: a cancel
+ * was once signed for **2000 wei** — THORChain's 1e8-unit threshold used
+ * verbatim as an 18-decimal chain's smallest unit — which `ConvertAmount`
+ * truncates to zero. So the threshold is rescaled from 1e8 into the coin's own
+ * precision, and a result that rounds away is refused rather than nudged up to
+ * the bare observable minimum, which would be the same silent failure one order
+ * of magnitude higher.
+ */
+export const getLimitSwapCancelDust = ({ inbound, decimals }) => {
+    const { chain, dust_threshold: threshold } = inbound;
+    if (!threshold?.trim()) {
+        throw new LimitSwapCancelDustError('thresholdUnavailable', `cancel dust: ${chain} inbound carries no dust_threshold, so the minimum Bifrost will observe is unknown`);
+    }
+    if (!/^\d+$/.test(threshold.trim())) {
+        throw new LimitSwapCancelDustError('malformedThreshold', `cancel dust: ${chain} dust_threshold is not an integer: ${JSON.stringify(threshold)}`);
+    }
+    if (!Number.isInteger(decimals) || decimals < 0 || decimals > maximumDecimals) {
+        throw new LimitSwapCancelDustError('unusablePrecision', `cancel dust: ${chain} source coin declares an unusable precision (${decimals})`);
+    }
+    const thresholdIn1e8 = BigInt(threshold.trim());
+    if (thresholdIn1e8 > maximumThresholdIn1e8) {
+        throw new LimitSwapCancelDustError('exceedsCeiling', `cancel dust: ${chain} dust_threshold ${thresholdIn1e8} (1e8) exceeds the plausible ceiling ${maximumThresholdIn1e8}`);
+    }
+    // Rescale from THORChain's 1e8 into the coin's own precision. Integer-only,
+    // in a direction chosen per branch so nothing is silently lost.
+    const scaled = decimals >= thorchainFixedPointDecimals
+        ? thresholdIn1e8 * 10n ** BigInt(decimals - thorchainFixedPointDecimals)
+        : thresholdIn1e8 / 10n ** BigInt(thorchainFixedPointDecimals - decimals);
+    const dust = scaled * dustSafetyMultiple;
+    if (thresholdIn1e8 > 0n && dust <= 0n) {
+        throw new LimitSwapCancelDustError('belowObservableMinimum', `cancel dust: ${chain} threshold ${thresholdIn1e8} (1e8) rounds away at ${decimals} decimals, ` +
+            'so no attachable amount would be observed');
+    }
+    return dust;
+};
+//# sourceMappingURL=limitSwapCancelDust.js.map

package/dist/swap/native/limitSwapCancelDust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limitSwapCancelDust.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/native/limitSwapCancelDust.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,2BAA2B,GAAG,CAAC,CAAA;AAErC;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,EAAE,CAAA;AAE7B;;;;;;;;;;;;GAYG;AACH,MAAM,qBAAqB,GAAG,UAAY,CAAA;AAE1C;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,EAAE,CAAA;AAE1B,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,sBAAsB;IACtB,oBAAoB;IACpB,mBAAmB;IACnB,wBAAwB;IACxB,gBAAgB;CACR,CAAA;AAIV,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,MAAM,CAAgC;IAE/C,YAAY,MAAsC,EAAE,OAAe;QACjE,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AASD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,EAA+B,EAAU,EAAE;IACnG,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAEpD,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAwB,CAChC,sBAAsB,EACtB,gBAAgB,KAAK,oFAAoF,CAC1G,CAAA;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,wBAAwB,CAChC,oBAAoB,EACpB,gBAAgB,KAAK,sCAAsC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACvF,CAAA;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,GAAG,eAAe,EAAE,CAAC;QAC9E,MAAM,IAAI,wBAAwB,CAChC,mBAAmB,EACnB,gBAAgB,KAAK,gDAAgD,QAAQ,GAAG,CACjF,CAAA;IACH,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;IAE/C,IAAI,cAAc,GAAG,qBAAqB,EAAE,CAAC;QAC3C,MAAM,IAAI,wBAAwB,CAChC,gBAAgB,EAChB,gBAAgB,KAAK,mBAAmB,cAAc,wCAAwC,qBAAqB,EAAE,CACtH,CAAA;IACH,CAAC;IAED,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,MAAM,GACV,QAAQ,IAAI,2BAA2B;QACrC,CAAC,CAAC,cAAc,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,GAAG,2BAA2B,CAAC;QACxE,CAAC,CAAC,cAAc,GAAG,GAAG,IAAI,MAAM,CAAC,2BAA2B,GAAG,QAAQ,CAAC,CAAA;IAE5E,MAAM,IAAI,GAAG,MAAM,GAAG,kBAAkB,CAAA;IAExC,IAAI,cAAc,GAAG,EAAE,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,wBAAwB,CAChC,wBAAwB,EACxB,gBAAgB,KAAK,cAAc,cAAc,yBAAyB,QAAQ,aAAa;YAC7F,2CAA2C,CAC9C,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC,CAAA"}

package/dist/swap/native/limitSwapCancelEligibility.d.ts

@@ -0,0 +1,96 @@
+import { LimitSwapCancelInputs } from './limitSwapCancelMemo.js';
+export declare const limitSwapCancelBlockers: readonly ["terminal", "cancelAlreadyBroadcast", "missingSignedData", "signedDataDisagreesWithChain", "memoTooLongForSourceChain", "unroutableSourceChain"];
+export type LimitSwapCancelBlocker = (typeof limitSwapCancelBlockers)[number];
+/**
+ * Which spelling of an asset a cancel memo may use, or why there isn't one.
+ */
+export type LimitSwapCancelAssetResolution = {
+    resolved: string;
+} | {
+    problem: 'disagrees';
+} | {
+    problem: 'unknown';
+};
+type ResolveLimitSwapCancelAssetInput = {
+    /** The PLACEMENT memo's spelling — lossy, usable only when not truncated. */
+    stored: string;
+    /** The full form captured locally at signing, when it exists. */
+    signed?: string;
+    /** The queue's own report, after `fuzzyAssetMatch` resolved the placement. */
+    observed?: string;
+};
+/**
+ * Resolve which spelling of one of the order's assets a cancel may use.
+ *
+ * Three sources, in decreasing order of how much they prove:
+ *
+ * 1. **The queue's own report** — the string THORChain built this order's index
+ *    entry from. Authoritative by construction, and the only source for an
+ *    order placed before the full form was recorded locally.
+ * 2. **The full form captured at signing** — derived from the coin's own
+ *    contract, so exact whenever it exists.
+ * 3. **The stored placement spelling** — usable ONLY when it carries no
+ *    truncated identifier, which makes it full by construction. That covers
+ *    every native leg (`BTC.BTC`, `THOR.RUNE`) and every secured denom.
+ *
+ * `disagrees` when a local spelling and the chain's own differ: one is wrong
+ * and there is no way to tell which. This is the check a real failure needed —
+ * the amounts were cross-checked and agreed, the assets were never compared,
+ * and the asset was the entire defect.
+ *
+ * Compared case-insensitively: the sources differ on case by convention (a
+ * secured denom is emitted lower-case and reported upper-case, and
+ * `common.ParseCoin` upper-cases whatever it is given). Anything beyond case is
+ * a real difference.
+ */
+export declare const resolveLimitSwapCancelAsset: ({ stored, signed, observed, }: ResolveLimitSwapCancelAssetInput) => LimitSwapCancelAssetResolution;
+export type LimitSwapCancelCandidate = {
+    /** Whether the order has already closed. */
+    isTerminal: boolean;
+    /** Whether a cancel has already been broadcast against this order. */
+    hasPendingCancel?: boolean;
+    /** Source asset as the PLACEMENT memo spelled it. */
+    sourceAsset: string;
+    /** Target asset as the PLACEMENT memo spelled it. */
+    targetAsset: string;
+    /** Full source spelling captured at signing, if recorded. */
+    signedSourceAsset?: string;
+    /** Full target spelling captured at signing, if recorded. */
+    signedTargetAsset?: string;
+    /** Deposited source amount recorded at signing, in 1e8. */
+    signedSourceAmount?: bigint;
+    /** Trade target recorded at signing, in 1e8. */
+    signedTradeTarget?: bigint;
+    /** The queue's `coins[0].asset`, once polled. */
+    observedSourceAsset?: string;
+    /** The queue's `target_asset`, once polled. */
+    observedTargetAsset?: string;
+    /** The queue's `state.deposit`, once polled. */
+    observedDeposit?: bigint;
+    /** The queue's `trade_target`, once polled. */
+    observedTradeTarget?: bigint;
+};
+export type LimitSwapCancelEligibility = {
+    cancellable: LimitSwapCancelInputs;
+} | {
+    blocked: LimitSwapCancelBlocker;
+};
+/**
+ * Decide whether an order can be cancelled, and if so with which exact amounts.
+ *
+ * **Fails closed at every unknown.** The failure this guards against is not a
+ * crash or an error dialog — it is a cancel that is accepted, costs a fee, and
+ * silently matches no order at all. Every branch that cannot prove the values
+ * are the ones THORChain holds returns a blocker.
+ *
+ * The signed-versus-observed cross-check covers assets as well as amounts.
+ * Absence is NOT disagreement: an order placed seconds ago has not been polled,
+ * and refusing to cancel until the first poll lands would be a worse failure
+ * than the one this prevents. But present-and-unparseable blocks exactly as a
+ * mismatch does — "not polled yet" and "polled, and the wire carried something
+ * we do not model" are different claims, and only the first is safe to proceed
+ * through.
+ */
+export declare const getLimitSwapCancelEligibility: (candidate: LimitSwapCancelCandidate) => LimitSwapCancelEligibility;
+export {};
+//# sourceMappingURL=limitSwapCancelEligibility.d.ts.map

package/dist/swap/native/limitSwapCancelEligibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limitSwapCancelEligibility.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/native/limitSwapCancelEligibility.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,qBAAqB,EACtB,MAAM,uBAAuB,CAAA;AAG9B,eAAO,MAAM,uBAAuB,4JA+B1B,CAAA;AAEV,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7E;;GAEG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,SAAS,CAAA;CAAE,CAAA;AAErH,KAAK,gCAAgC,GAAG;IACtC,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAA;IACd,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,CAAA;AAOD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,2BAA2B,GAAI,+BAIzC,gCAAgC,KAAG,8BAmBrC,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,4CAA4C;IAC5C,UAAU,EAAE,OAAO,CAAA;IACnB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAA;IACnB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAA;IACnB,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,6DAA6D;IAC7D,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,2DAA2D;IAC3D,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,gDAAgD;IAChD,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,+CAA+C;IAC/C,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,+CAA+C;IAC/C,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG;IAAE,WAAW,EAAE,qBAAqB,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,sBAAsB,CAAA;CAAE,CAAA;AAErH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,GAAI,WAAW,wBAAwB,KAAG,0BA4EnF,CAAA"}

package/dist/swap/native/limitSwapCancelEligibility.js

@@ -0,0 +1,165 @@
+import { buildCancelLimitSwapMemo, doesCancelLimitSwapMemoFit, isAbbreviatedThorchainMemoAsset, } from './limitSwapCancelMemo.js';
+import { getLimitSwapSourceChainKind } from './limitSwapMemo.js';
+export const limitSwapCancelBlockers = [
+    /** The order has already closed. Nothing left to cancel. */
+    'terminal',
+    /**
+     * A cancel for this order has already been broadcast and is waiting to be
+     * observed. Without this, a user could pay the fee (and on L1 donate the
+     * dust) again for an identical memo landing in the identical bucket.
+     */
+    'cancelAlreadyBroadcast',
+    /**
+     * The order predates the fields cancelling needs, or no source can supply an
+     * asset's full spelling. Fails closed rather than guessing at the values the
+     * matcher keys on.
+     */
+    'missingSignedData',
+    /**
+     * What was recorded at signing and what the queue reports disagree. One of
+     * them is wrong and there is no way to tell which, so neither is signed.
+     */
+    'signedDataDisagreesWithChain',
+    /**
+     * The cancel memo does not fit the source chain's per-transaction budget —
+     * in practice an ERC20 target from a UTXO source. Nothing in a cancel memo
+     * can be shortened, so the order simply refunds at expiry instead.
+     */
+    'memoTooLongForSourceChain',
+    /**
+     * The source asset names a chain THORChain cannot route, so there is no
+     * inbound vault to send the cancel to and no byte budget to size it against.
+     */
+    'unroutableSourceChain',
+];
+const trimmed = (value) => {
+    const text = value?.trim();
+    return text ? text : undefined;
+};
+/**
+ * Resolve which spelling of one of the order's assets a cancel may use.
+ *
+ * Three sources, in decreasing order of how much they prove:
+ *
+ * 1. **The queue's own report** — the string THORChain built this order's index
+ *    entry from. Authoritative by construction, and the only source for an
+ *    order placed before the full form was recorded locally.
+ * 2. **The full form captured at signing** — derived from the coin's own
+ *    contract, so exact whenever it exists.
+ * 3. **The stored placement spelling** — usable ONLY when it carries no
+ *    truncated identifier, which makes it full by construction. That covers
+ *    every native leg (`BTC.BTC`, `THOR.RUNE`) and every secured denom.
+ *
+ * `disagrees` when a local spelling and the chain's own differ: one is wrong
+ * and there is no way to tell which. This is the check a real failure needed —
+ * the amounts were cross-checked and agreed, the assets were never compared,
+ * and the asset was the entire defect.
+ *
+ * Compared case-insensitively: the sources differ on case by convention (a
+ * secured denom is emitted lower-case and reported upper-case, and
+ * `common.ParseCoin` upper-cases whatever it is given). Anything beyond case is
+ * a real difference.
+ */
+export const resolveLimitSwapCancelAsset = ({ stored, signed, observed, }) => {
+    const storedIfUsable = isAbbreviatedThorchainMemoAsset(stored) ? undefined : trimmed(stored);
+    const local = trimmed(signed) ?? storedIfUsable;
+    const chain = trimmed(observed);
+    if (!chain) {
+        return local ? { resolved: local } : { problem: 'unknown' };
+    }
+    if (!local) {
+        // No local spelling to check against — the legacy token case, rescued by
+        // the only source still holding the full contract.
+        return { resolved: chain };
+    }
+    if (local.toLowerCase() !== chain.toLowerCase()) {
+        return { problem: 'disagrees' };
+    }
+    // Proven equal bar case, so the local spelling is kept: it is the exact byte
+    // form this SDK derived.
+    return { resolved: local };
+};
+/**
+ * Decide whether an order can be cancelled, and if so with which exact amounts.
+ *
+ * **Fails closed at every unknown.** The failure this guards against is not a
+ * crash or an error dialog — it is a cancel that is accepted, costs a fee, and
+ * silently matches no order at all. Every branch that cannot prove the values
+ * are the ones THORChain holds returns a blocker.
+ *
+ * The signed-versus-observed cross-check covers assets as well as amounts.
+ * Absence is NOT disagreement: an order placed seconds ago has not been polled,
+ * and refusing to cancel until the first poll lands would be a worse failure
+ * than the one this prevents. But present-and-unparseable blocks exactly as a
+ * mismatch does — "not polled yet" and "polled, and the wire carried something
+ * we do not model" are different claims, and only the first is safe to proceed
+ * through.
+ */
+export const getLimitSwapCancelEligibility = (candidate) => {
+    if (candidate.isTerminal) {
+        return { blocked: 'terminal' };
+    }
+    if (candidate.hasPendingCancel) {
+        return { blocked: 'cancelAlreadyBroadcast' };
+    }
+    const { signedSourceAmount, signedTradeTarget } = candidate;
+    if (signedSourceAmount === undefined ||
+        signedTradeTarget === undefined ||
+        signedSourceAmount <= 0n ||
+        signedTradeTarget <= 0n) {
+        return { blocked: 'missingSignedData' };
+    }
+    // `state.deposit` IS the swap's `Tx.Coins[0].Amount` and `trade_target` IS
+    // `msg.TradeTarget` — the exact pair the matcher's ratio is computed from.
+    if (candidate.observedDeposit !== undefined && candidate.observedDeposit !== signedSourceAmount) {
+        return { blocked: 'signedDataDisagreesWithChain' };
+    }
+    if (candidate.observedTradeTarget !== undefined && candidate.observedTradeTarget !== signedTradeTarget) {
+        return { blocked: 'signedDataDisagreesWithChain' };
+    }
+    const source = resolveLimitSwapCancelAsset({
+        stored: candidate.sourceAsset,
+        signed: candidate.signedSourceAsset,
+        observed: candidate.observedSourceAsset,
+    });
+    const target = resolveLimitSwapCancelAsset({
+        stored: candidate.targetAsset,
+        signed: candidate.signedTargetAsset,
+        observed: candidate.observedTargetAsset,
+    });
+    if (!('resolved' in source) || !('resolved' in target)) {
+        const disagrees = ('problem' in source && source.problem === 'disagrees') || ('problem' in target && target.problem === 'disagrees');
+        return { blocked: disagrees ? 'signedDataDisagreesWithChain' : 'missingSignedData' };
+    }
+    const inputs = {
+        sourceAsset: source.resolved,
+        sourceAmount: signedSourceAmount,
+        targetAsset: target.resolved,
+        tradeTarget: signedTradeTarget,
+    };
+    // The memo must be buildable AND fit the chain it will be sent from. Checked
+    // here rather than at signing so the action is never offered for an order
+    // that cannot actually be cancelled.
+    let memo;
+    try {
+        memo = buildCancelLimitSwapMemo(inputs);
+    }
+    catch {
+        return { blocked: 'missingSignedData' };
+    }
+    // Resolved in its own guarded step: the memo builder does not check
+    // routability, so an unrecognised prefix reaches this call and throws —
+    // escaping a function whose whole contract is to answer with a blocker.
+    let sourceChainKind;
+    try {
+        sourceChainKind = getLimitSwapSourceChainKind(inputs.sourceAsset);
+    }
+    catch {
+        return { blocked: 'unroutableSourceChain' };
+    }
+    if (!doesCancelLimitSwapMemoFit(memo, sourceChainKind)) {
+        return { blocked: 'memoTooLongForSourceChain' };
+    }
+    return { cancellable: inputs };
+};
+//# sourceMappingURL=limitSwapCancelEligibility.js.map

package/dist/swap/native/limitSwapCancelEligibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limitSwapCancelEligibility.js","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/native/limitSwapCancelEligibility.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,+BAA+B,GAEhC,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,2BAA2B,EAA4B,MAAM,iBAAiB,CAAA;AAEvF,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,4DAA4D;IAC5D,UAAU;IACV;;;;OAIG;IACH,wBAAwB;IACxB;;;;OAIG;IACH,mBAAmB;IACnB;;;OAGG;IACH,8BAA8B;IAC9B;;;;OAIG;IACH,2BAA2B;IAC3B;;;OAGG;IACH,uBAAuB;CACf,CAAA;AAkBV,MAAM,OAAO,GAAG,CAAC,KAAyB,EAAsB,EAAE;IAChE,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,EAAE,CAAA;IAC1B,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAChC,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,EAC1C,MAAM,EACN,MAAM,EACN,QAAQ,GACyB,EAAkC,EAAE;IACrE,MAAM,cAAc,GAAG,+BAA+B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5F,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,cAAc,CAAA;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAE/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;IAC7D,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,yEAAyE;QACzE,mDAAmD;QACnD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IAC5B,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IACjC,CAAC;IACD,6EAA6E;IAC7E,yBAAyB;IACzB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;AAC5B,CAAC,CAAA;AA+BD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,SAAmC,EAA8B,EAAE;IAC/G,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;IAChC,CAAC;IACD,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAA;IAC9C,CAAC;IAED,MAAM,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,GAAG,SAAS,CAAA;IAC3D,IACE,kBAAkB,KAAK,SAAS;QAChC,iBAAiB,KAAK,SAAS;QAC/B,kBAAkB,IAAI,EAAE;QACxB,iBAAiB,IAAI,EAAE,EACvB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAA;IACzC,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,SAAS,CAAC,eAAe,KAAK,SAAS,IAAI,SAAS,CAAC,eAAe,KAAK,kBAAkB,EAAE,CAAC;QAChG,OAAO,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAA;IACpD,CAAC;IACD,IAAI,SAAS,CAAC,mBAAmB,KAAK,SAAS,IAAI,SAAS,CAAC,mBAAmB,KAAK,iBAAiB,EAAE,CAAC;QACvG,OAAO,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAA;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,MAAM,EAAE,SAAS,CAAC,WAAW;QAC7B,MAAM,EAAE,SAAS,CAAC,iBAAiB;QACnC,QAAQ,EAAE,SAAS,CAAC,mBAAmB;KACxC,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,2BAA2B,CAAC;QACzC,MAAM,EAAE,SAAS,CAAC,WAAW;QAC7B,MAAM,EAAE,SAAS,CAAC,iBAAiB;QACnC,QAAQ,EAAE,SAAS,CAAC,mBAAmB;KACxC,CAAC,CAAA;IAEF,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,EAAE,CAAC;QACvD,MAAM,SAAS,GACb,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC,CAAA;QACpH,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAA;IACtF,CAAC;IAED,MAAM,MAAM,GAA0B;QACpC,WAAW,EAAE,MAAM,CAAC,QAAQ;QAC5B,YAAY,EAAE,kBAAkB;QAChC,WAAW,EAAE,MAAM,CAAC,QAAQ;QAC5B,WAAW,EAAE,iBAAiB;KAC/B,CAAA;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,qCAAqC;IACrC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAA;IACzC,CAAC;IAED,oEAAoE;IACpE,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,eAAyC,CAAA;IAC7C,IAAI,CAAC;QACH,eAAe,GAAG,2BAA2B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAA;IAC7C,CAAC;IAED,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAA;IACjD,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;AAChC,CAAC,CAAA"}

package/dist/swap/native/limitSwapCancelMemo.d.ts

@@ -0,0 +1,123 @@
+import { LimitSwapSourceChainKind } from './limitSwapMemo.js';
+/**
+ * THORChain's modify-limit-swap prefix. Distinct from `limitSwapMemoPrefix`
+ * (`=<:`), which PLACES an order — `m=<:` modifies one that is already resting.
+ */
+export declare const modifyLimitSwapMemoPrefix = "m=<:";
+/**
+ * Whether `memo` MODIFIES a resting order — which includes, but is not limited
+ * to, cancelling it.
+ *
+ * Named for what it matches. A cancel is the special case where the final field
+ * is zero; a non-zero value re-targets. Only the cancel form is built here, so
+ * today the two coincide — but a predicate that says "cancel" while matching
+ * any modification is the kind of small lie that outlives the assumption that
+ * made it true.
+ */
+export declare const isModifyLimitSwapMemo: (memo: string | undefined | null) => boolean;
+/**
+ * Whether `memo` CANCELS a resting order, rather than merely modifying one.
+ *
+ * The final field is compared NUMERICALLY, the way THORNode's `getUint` reads
+ * it: `"00"` is zero there, and a string comparison would call that a retarget.
+ * Digits only, so a sign cannot smuggle `"-0"` past an unsigned field.
+ */
+export declare const isCancelLimitSwapMemo: (memo: string | undefined | null) => boolean;
+/**
+ * Everything the cancel memo needs, reduced to the exact integers THORChain
+ * itself holds. Amounts are bigint so a caller cannot pass an unparsed or
+ * negative value.
+ */
+export type LimitSwapCancelInputs = {
+    /**
+     * THORChain memo form of the order's SOURCE asset.
+     *
+     * Must carry the token's FULL contract (`ETH.USDC-0XA0B86991…`), never the
+     * placement memo's 6-character abbreviation — see `buildCancelLimitSwapMemo`.
+     *
+     * Must be the asset's SECURED denom (`eth-usdc-0xa0b…`) when the source is a
+     * secured asset, never its layer-1 form. `MsgModifyLimitSwap.ValidateBasic`
+     * enforces `From.IsChain(Source.Asset.GetChain())`, and `GetChain()` returns
+     * THORChain only for synth, trade and secured assets. The layer-1 spelling
+     * makes it report the L1 chain, and a cancel sent from a THOR address is then
+     * rejected outright at validation.
+     */
+    sourceAsset: string;
+    /** The order's deposited source amount, in THORChain's 1e8 fixed point. */
+    sourceAmount: bigint;
+    /** THORChain memo form of the TARGET asset, under the same full-spelling rule. */
+    targetAsset: string;
+    /** The order's ORIGINAL trade target (the placement memo's LIM), in 1e8. */
+    tradeTarget: bigint;
+};
+/**
+ * Whether a memo asset carries a TRUNCATED token identifier —
+ * `ETH.USDC-06EB48` rather than `ETH.USDC-0XA0B86991…`.
+ *
+ * The chain prefix has to be stripped first, and cannot be assumed to end at a
+ * `.`: a SECURED asset spells the whole thing with `-`, so a secured native
+ * denom is `btc-btc` and a secured token is `eth-usdc-0xa0b…`. Reading the tail
+ * after the last `-` would call the first of those truncated and make every
+ * secured-native order uncancellable.
+ *
+ * So: drop everything up to the first separator — that is the chain — and look
+ * at the SYMBOL that follows. A symbol is `TICKER` or `TICKER-<identifier>`,
+ * and only the second form can be truncated. `BTC.BTC`, `THOR.RUNE` and
+ * `btc-btc` carry no identifier at all and are full by construction.
+ */
+export declare const isAbbreviatedThorchainMemoAsset: (asset: string) => boolean;
+export declare const limitSwapCancelMemoErrors: readonly ["emptyAsset", "nonPositiveAmount", "abbreviatedAsset"];
+export type LimitSwapCancelMemoError = (typeof limitSwapCancelMemoErrors)[number];
+export declare class LimitSwapCancelMemoBuildError extends Error {
+    readonly reason: LimitSwapCancelMemoError;
+    constructor(reason: LimitSwapCancelMemoError, message: string);
+}
+/**
+ * Both amounts must be positive, for every consumer of these inputs.
+ *
+ * Shared because two modules depend on it for different reasons: the memo would
+ * encode a coin THORNode cannot parse, and the bucket key divides by the trade
+ * target — where a zero would raise `RangeError` rather than a domain error a
+ * caller can branch on.
+ */
+export declare const assertPositiveLimitSwapCancelAmounts: ({ sourceAmount, tradeTarget, }: Pick<LimitSwapCancelInputs, "sourceAmount" | "tradeTarget">) => void;
+/**
+ * Build the `m=<` memo that cancels a resting limit order.
+ *
+ *     m=<:<SRC_AMOUNT><SRC_ASSET>:<TRADE_TARGET><TGT_ASSET>:0
+ *
+ * Both coins are `<amount><ASSET>` with NO space — THORNode's `getCoin` scans
+ * leading digits and splices the space back in before parsing.
+ *
+ * Three properties, each of which causes a SILENT no-op if broken — the cancel
+ * is accepted, costs a fee, matches nothing, and looks exactly like success:
+ *
+ * - **Assets are spelled in FULL.** `processOneTxIn` runs every other inbound
+ *   memo through `fuzzyAssetMatch`, which is what lets a placement say
+ *   `ETH.USDC-06EB48` and still be indexed under the full contract.
+ *   `ModifyLimitSwapMemo` is the exception: its asset string builds the lookup
+ *   key verbatim, so an abbreviation addresses a bucket that by construction
+ *   holds nothing. Enforced here, not merely documented.
+ * - **Amounts are plain decimal integers.** The placement memo's LIM goes
+ *   through `getUintWithScientificNotation` and understands `544e6`; these
+ *   coins go through `cosmos.ParseCoins`, which does not.
+ * - **Both amounts are exact.** THORNode does not compare them directly — they
+ *   feed the ratio its index key is built from (see
+ *   `getThorchainLimitOrderBucketKey`), and one unit of drift lands in a
+ *   different bucket.
+ */
+export declare const buildCancelLimitSwapMemo: (inputs: LimitSwapCancelInputs) => string;
+/**
+ * Whether a cancel memo fits the per-transaction budget of the chain it will be
+ * sent from.
+ *
+ * In practice this rules out an ERC20 target from a UTXO source: two
+ * full-contract assets plus two exact amounts overflow the 80-byte OP_RETURN
+ * cap, and NOTHING in a cancel memo can be shortened — the amounts define the
+ * bucket, short codes are rejected by `cosmos.ParseCoins`, and this memo type
+ * skips `fuzzyAssetMatch`. Such an order still refunds automatically at expiry.
+ */
+export declare const doesCancelLimitSwapMemoFit: (memo: string, sourceChainKind: LimitSwapSourceChainKind) => boolean;
+/** Convenience: the byte-cap check keyed off the source asset's memo notation. */
+export declare const doesCancelLimitSwapMemoFitSourceAsset: (memo: string, sourceAsset: string) => boolean;
+//# sourceMappingURL=limitSwapCancelMemo.d.ts.map

package/dist/swap/native/limitSwapCancelMemo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limitSwapCancelMemo.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/chain/swap/native/limitSwapCancelMemo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuD,wBAAwB,EAAE,MAAM,iBAAiB,CAAA;AAE/G;;;GAGG;AACH,eAAO,MAAM,yBAAyB,SAAS,CAAA;AAS/C;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OACzB,CAAA;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,GAAG,SAAS,GAAG,IAAI,KAAG,OAUvE,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC;;;;;;;;;;;;OAYG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,YAAY,EAAE,MAAM,CAAA;IACpB,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAA;IACnB,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAgBD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B,GAAI,OAAO,MAAM,KAAG,OAQ/D,CAAA;AAED,eAAO,MAAM,yBAAyB,kEAAmE,CAAA;AAEzG,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEjF,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;gBAE7B,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,MAAM;CAK9D;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC,GAAI,gCAGlD,IAAI,CAAC,qBAAqB,EAAE,cAAc,GAAG,aAAa,CAAC,KAAG,IAOhE,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,wBAAwB,GAAI,QAAQ,qBAAqB,KAAG,MAwBxE,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,GAAI,MAAM,MAAM,EAAE,iBAAiB,wBAAwB,KAAG,OACnB,CAAA;AAElF,kFAAkF;AAClF,eAAO,MAAM,qCAAqC,GAAI,MAAM,MAAM,EAAE,aAAa,MAAM,KAAG,OACd,CAAA"}