Watch

WIP: Draft: fix(oracle-service): confirm DeliverTx + State before liveness (C-3 / #23) #38

Closed

PlasticDigits wants to merge 0 commits from 23-feat-security-c-3-confirm-delivertx-oracle-state-before-oracle-liveness-success into main

PlasticDigits commented

2026-08-08 04:52:05 +00:00

(Migrated from gitlab.com)

Summary

Closes C-3 / #23: stop treating Terra BROADCAST_MODE_SYNC CheckTx success as confirmed on-chain success for oracle liveness.

After SYNC broadcast, poll GET /cosmos/tx/v1beta1/txs/{hash} until DeliverTx code == 0 or timeout (fail-closed).
Re-query oracle State and require last_update_sec advanced + rate matching the proposed update (INV-ORACLE-LIVENESS-001).
On account sequence mismatch, refresh account and retry broadcast once.
Document invariant in README / docs/DEPLOYMENT.md and add agent skill skills/oracle-liveness-confirm/SKILL.md.

Acceptance criteria

DeliverTx failure (simulated) does not advance liveness success timestamp
CheckTx success alone does not count as success
Confirmed inclusion + matching oracle state ⇒ liveness success + info log
Confirmation timeout ⇒ tick error / warn; no success record
Sequence mismatch path retries once with fresh account info
Docs state that silence tracking means confirmed on-chain updates

Test plan

cargo test -p ust1-oracle-service (29 tests; wiremock LCD fixtures)
Retest after cargo fmt / clippy (-D warnings)
Optional LocalTerra: pause oracle / force DeliverTx reject and confirm no liveness success

Out of scope / follow-ups

H-3 silence/poll timing vs window staleness budget (separate issue)
M-1 local clock vs block time for off-chain policy (separate)
Manual LocalTerra verification (optional in issue)

Closes #23

## Summary Closes **C-3** / [#23](https://gitlab.com/PlasticDigits/ust1-window/-/issues/23): stop treating Terra `BROADCAST_MODE_SYNC` CheckTx success as confirmed on-chain success for oracle liveness. - After SYNC broadcast, poll `GET /cosmos/tx/v1beta1/txs/{hash}` until DeliverTx `code == 0` or timeout (fail-closed). - Re-query oracle `State` and require `last_update_sec` advanced + `rate` matching the proposed update (**INV-ORACLE-LIVENESS-001**). - On account sequence mismatch, refresh account and retry broadcast once. - Document invariant in README / `docs/DEPLOYMENT.md` and add agent skill `skills/oracle-liveness-confirm/SKILL.md`. ## Acceptance criteria - [x] DeliverTx failure (simulated) does **not** advance liveness success timestamp - [x] CheckTx success alone does **not** count as success - [x] Confirmed inclusion + matching oracle state ⇒ liveness success + info log - [x] Confirmation timeout ⇒ tick error / warn; no success record - [x] Sequence mismatch path retries once with fresh account info - [x] Docs state that silence tracking means confirmed on-chain updates ## Test plan - [x] `cargo test -p ust1-oracle-service` (29 tests; wiremock LCD fixtures) - [x] Retest after `cargo fmt` / clippy (`-D warnings`) - [ ] Optional LocalTerra: pause oracle / force DeliverTx reject and confirm no liveness success ## Out of scope / follow-ups - **H-3** silence/poll timing vs window staleness budget (separate issue) - **M-1** local clock vs block time for off-chain policy (separate) - Manual LocalTerra verification (optional in issue) Closes #23

PlasticDigits commented

2026-08-08 04:52:27 +00:00

(Migrated from gitlab.com)