Skip to content

Prevent Stellar transaction replay with sequence number guard #215

Description

@AbelOsaretin

What

updateImpactScore fetches the account on every call via rpcServer.getAccount(). If the RPC is slow or the same tx is submitted twice concurrently, duplicate transactions could be confirmed.

Why

Concurrent submissions can cause sequence number conflicts or duplicate on-chain state changes.

Scope

  • Maintain a local sequence number counter
  • Increment after successful transaction submission
  • Reject submissions if local counter is out of sync
  • Add a staleness check for the fetched account sequence

Acceptance Criteria

  • Local sequence number tracked after first account fetch
  • Sequence incremented on successful submission
  • Stale sequence numbers rejected with clear error
  • Concurrent submissions handled safely

Technical Context

  • src/lib/registry.ts:24rpcServer.getAccount(keypair.publicKey())
  • src/lib/stellar.ts:34sendTransaction
  • Could use a simple in-memory counter or a mutex

Metadata

Metadata

Assignees

No one assigned

    Labels

    highSignificant functionality broken, no workaround, affects multiple users

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions