fix(oracle-service): confirm DeliverTx + State before liveness (C-3 / #23) #35

Merged

PlasticDigits merged 1 commit from fix/issue-23-oracle-liveness-confirmtx into main

2026-08-08 05:17:46 +00:00

PlasticDigits commented

2026-08-08 04:51:23 +00:00

(Migrated from gitlab.com)

Summary

Closes #23 / audit C-3: oracle-service no longer records liveness success on BROADCAST_MODE_SYNC CheckTx alone.

After SYNC broadcast, poll GET /cosmos/tx/v1beta1/txs/{hash} until DeliverTx code == 0 or timeout (fail-closed).
Re-query oracle State; require last_update_sec advanced and rate == proposed before record_successful_broadcast().
Account sequence mismatch → refresh account and retry broadcast once.
LCD URL credentials redacted in errors/logs; new env ORACLE_TX_CONFIRM_TIMEOUT_SECS / ORACLE_TX_CONFIRM_POLL_INTERVAL_MS.
Documented INV-ORACLE-LIVENESS-001 in README, DEPLOYMENT, and skills/oracle-liveness-confirm/.

Test plan

cargo test -p ust1-oracle-service (29 tests) — happy confirm, DeliverTx fail, timeout, state mismatch, sequence retry, hash mismatch, URL redaction
cargo clippy -p ust1-oracle-service --all-targets -- -D warnings
Optional LocalTerra: pause oracle / force DeliverTx reject and confirm silence timer does not advance
Operator: page on LIVENESS_ORACLE_NO_BROADCAST still means confirmed-update silence

## Summary Closes [#23](https://gitlab.com/PlasticDigits/ust1-window/-/issues/23) / audit **C-3**: oracle-service no longer records liveness success on `BROADCAST_MODE_SYNC` CheckTx alone. - After SYNC broadcast, poll `GET /cosmos/tx/v1beta1/txs/{hash}` until DeliverTx `code == 0` or timeout (fail-closed). - Re-query oracle `State`; require `last_update_sec` advanced and `rate` == proposed before `record_successful_broadcast()`. - Account sequence mismatch → refresh account and retry broadcast once. - LCD URL credentials redacted in errors/logs; new env `ORACLE_TX_CONFIRM_TIMEOUT_SECS` / `ORACLE_TX_CONFIRM_POLL_INTERVAL_MS`. - Documented **INV-ORACLE-LIVENESS-001** in README, DEPLOYMENT, and `skills/oracle-liveness-confirm/`. ## Test plan - [x] `cargo test -p ust1-oracle-service` (29 tests) — happy confirm, DeliverTx fail, timeout, state mismatch, sequence retry, hash mismatch, URL redaction - [x] `cargo clippy -p ust1-oracle-service --all-targets -- -D warnings` - [ ] Optional LocalTerra: pause oracle / force DeliverTx reject and confirm silence timer does not advance - [ ] Operator: page on `LIVENESS_ORACLE_NO_BROADCAST` still means confirmed-update silence

PlasticDigits commented

2026-08-08 04:51:38 +00:00

(Migrated from gitlab.com)

mentioned in issue #23

PlasticDigits commented

2026-08-08 04:52:27 +00:00

(Migrated from gitlab.com)

mentioned in merge request !38

PlasticDigits commented

2026-08-08 05:10:47 +00:00

(Migrated from gitlab.com)

mentioned in issue #24

PlasticDigits commented

2026-08-08 05:10:50 +00:00

(Migrated from gitlab.com)

mentioned in issue #25

PlasticDigits commented

2026-08-08 05:17:26 +00:00

(Migrated from gitlab.com)

added 4 commits

cbc0d886...c1d19c73 - 3 commits from branch main
dee9d0e6 - fix(oracle-service): confirm DeliverTx + State before liveness (C-3 / #23)

Compare with previous version

added 4 commits <ul><li>cbc0d886...c1d19c73 - 3 commits from branch <code>main</code></li><li>dee9d0e6 - fix(oracle-service): confirm DeliverTx + State before liveness (C-3 / #23)</li></ul> [Compare with previous version](/PlasticDigits/ust1-window/-/merge_requests/2/diffs?diff_id=1950018272&start_sha=cbc0d88630e9384a1724edb9ebd3c0f1fb7c1ae2)

PlasticDigits commented

2026-08-08 05:17:46 +00:00

(Migrated from gitlab.com)