fix(swap-service): terminate swaps whose swapper stays unreachable - #62
Merged
Conversation
|
Warning Review limit reachedNext included review available in 30 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Follow-up to #61. The catch in checkSwapStatus returned PENDING directly, so a swap whose swapper throws on every poll never reached the stall timeout and polled forever - the same eternal-PENDING case #61 closes, reached by a different route. Routes that path through resolveStalledSwap with its own, much longer window. An unreachable swapper is no evidence the swap is dead, only that we could not ask, so failing it on the 24h threshold would permanently fail a swap that settled at hour 25 while the swapper's api happened to blip. Seven days gives a transient outage no way to reach the threshold while still terminating a swap that has been failing for a week. The timeout is a required argument rather than defaulting to the 24h window: a call site that omitted it would otherwise silently get the aggressive threshold on a transition that cannot be undone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V8TEhCBbEexNvEfJ1F8pbY
kaladinlight
force-pushed
the
fix/unreachable-swapper-timeout
branch
from
September 2, 2026 21:07
f46a87f to
356e18d
Compare
kaladinlight
enabled auto-merge (squash)
September 2, 2026 21:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up to #61, which merged before this was pushed.
#61 fails a swap the swapper still cannot settle 24 hours after registration, but the
catchincheckSwapStatusreturnsPENDINGdirectly and never reaches that logic. A swap whose swapper throws on every poll therefore polls forever — the same eternal-PENDING case #61 exists to close, reached by a different route. Raised by CodeRabbit on that PR.The fix is not to apply the same threshold there. An unreachable swapper is no evidence the swap is dead, only that we could not ask, so failing on 24h would permanently fail a swap that settled at hour 25 while the swapper's api happened to blip — and
FAILEDis a one-way door, sincegetPendingTxSwapsselects onlyIDLE/PENDINGand never re-checks it.Confidence that a swap is dead rises with age, so the error path gets its own, much longer window:
A transient outage cannot reach seven days, while a swap that has been failing for a week still terminates. The last error is preserved in
statusMessageeither way, so it stays diagnosable.timeoutMsis a required argument rather than defaulting to the 24h window. A default would mean a future call site that omitted it silently got the aggressive threshold on a transition that cannot be undone, with nothing at the call site to review — the bug would be an absence. Both callers now name the window they mean.Testing
yarn workspace @shapeshift/swap-service test— 87 passing (85 before)PENDING; one eight days old fails withAbandoned: unsettled 7d after registration (last swapper status: Error polling status: …)