instantout: harden instant out error handling#1144
Conversation
Peer MuSig data was indexed by reservation position before validating counts. Short server responses could panic loopd instead of returning an error.
New instant outs were added to the active map before the swap hash existed. The FSM was stored under the zero hash, making real-hash lookups fail.
Closed payment channels yielded zero values or nil errors in failure paths. Return explicit errors so the observer cannot report a failed swap as success.
Cleanup contexts were derived from caller contexts that may be canceled. Use independent timeout contexts for reservation unlocks and server cancel.
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces several hardening improvements to the instant out implementation. The changes focus on increasing robustness by adding input validation, refining state management during swap initialization, and ensuring reliable resource cleanup by decoupling background tasks from potentially canceled request contexts. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request improves the robustness of the instant-out FSM by refining channel closure handling, ensuring cleanup tasks use a fresh context, and adding validation for MuSig2 sessions. It also optimizes locking logic in the manager. Feedback suggests that treating closed payment channels as terminal failures in PollPaymentAcceptedAction may be premature, recommending instead that they be ignored to allow server polling to determine the final state.
| case payRes, ok := <-payChan: | ||
| if !ok { | ||
| return f.handleErrorAndUnlockReservations( | ||
| ctx, errors.New("payment status channel closed"), | ||
| ) | ||
| } |
There was a problem hiding this comment.
Failing the swap when payChan is closed might be premature. In many cases, the payment status channel is closed by the router client after a terminal state (like success) is reached. Since the FSM continues to poll the server for acceptance via PollPaymentAccepted, a closed channel should simply be ignored rather than treated as a failure. Treating it as a failure could abort a swap that has actually succeeded locally but hasn't been acknowledged by the server yet.
case payRes, ok := <-payChan:
if !ok {
payChan = nil
continue
}| case err, ok := <-paymentErrChan: | ||
| if !ok { | ||
| err = errors.New("payment error channel closed") | ||
| } else if err == nil { | ||
| err = errors.New("payment error channel returned nil") | ||
| } |
There was a problem hiding this comment.
Similar to payChan, the paymentErrChan may be closed normally when the payment stream ends. Treating a closed channel as a terminal failure could abort a swap that has actually succeeded or is still being processed by the server. It is safer to set the channel to nil to stop selecting on it and allow the server polling to determine the final outcome.
| case err, ok := <-paymentErrChan: | |
| if !ok { | |
| err = errors.New("payment error channel closed") | |
| } else if err == nil { | |
| err = errors.New("payment error channel returned nil") | |
| } | |
| case err, ok := <-paymentErrChan: | |
| if !ok { | |
| paymentErrChan = nil | |
| continue | |
| } else if err == nil { | |
| err = errors.New("payment error channel returned nil") | |
| } |
hieblmi
changed the title
1 participant
Summary
This PR applies small hardening fixes for the instant out implementation:
Why
The previous logic could panic on malformed peer MuSig data, keep active swaps under the zero hash, return nil for failed payment stream paths, or skip cleanup when the caller context was already canceled.
Validation
go test ./instantout/...