fix(bitcoin-wallet-snap): widen address scan and sync coverage - #201
Open
jeremytsng wants to merge 6 commits into
Open
fix(bitcoin-wallet-snap): widen address scan and sync coverage#201jeremytsng wants to merge 6 commits into
jeremytsng wants to merge 6 commits into
Conversation
Bridged change landing on wallet scripts could stay invisible: full scans
ran once at account creation with a stop gap of 5, routine sync covered
only revealed scripts of selected accounts, and filling a partner PSBT
did not guarantee the drained change script was revealed and persisted.
- Split chain stopGap into { discovery: 5, scan: 20 }; account discovery
keeps the cheap probe, real scans use the BIP44 gap limit
- Reveal and persist own scripts drained to by fillPsbt before signing
- Add synchronizeAllAccounts (PT10M) and fullScanAccounts (PT6H) cron
jobs so unselected accounts and unrevealed scripts are still covered
- Emit a tracking event when a full scan finds transactions routine sync
missed
…ime repair Recurring all-account sync and full-scan cron jobs need an infra discussion on Esplora load. Replace them with a single repair pass: the first sync after this update schedules one full scan per existing account, gated by a rescanV1 state marker. The missed-transactions tracking event now fires only on these repair scans, keeping the metric free of expected account-creation discoveries.
jeremytsng
marked this pull request as draft
August 26, 2026 18:57
jeremytsng
marked this pull request as ready for review
August 26, 2026 18:57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
Two support cases (0.09 BTC and 6.9 BTC) reported bridged funds as missing. In both cases the funds sat on a change address the snap itself created during a partner PSBT fill. The coins were derived from the user's seed and were always spendable, but the snap's address coverage gave no guarantee the wallet would show them:
stopGap: 5— a quarter of the BIP44 gap limit of 20. Any coin outside that window is never found again.fillPsbtdrains change to one of our own scripts, nothing guarantees that script is revealed and persisted before broadcast.On-chain evidence shows the first case's change coin was in fact tracked by the snap (a later wallet transaction coin-selected it together with the user's own address), which points at the client's balance display path for that report — tracked separately. This PR closes the snap-side coverage class with minimal infra impact:
fillPsbtreveals the derivation index for that script and persists it before signing. If we sign it, we watch it. This prevents new cases at the source, at near-zero recurring cost.stopGapinto{ discovery: 5, scan: 20 }. Account discovery keeps the cheap probe; a real account scan uses the BIP44 gap limit.rescanV1state marker), so wallets that already drifted are repaired once — no recurring scan jobs.Scan Discovered Missed Transactionstracking event fires when the repair scan finds a transaction the wallet did not know about. This is the acceptance metric: its rate should go to zero.Deliberately out of scope, pending an infra discussion on Esplora load: recurring sync for unselected accounts and scheduled rescans. A follow-up PR will propose those with cadences sized by the infra owners.
References
7ccbc47f42e08cb084507e9e1f1bc979d35caa6a2ce5b9bddaf66ef6ba80acdeand44a207502ab21ac12d91af0441faadf6d64bb493ab8adb2402451931d52be75fChecklist