cashubtc/auditor
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Respect mint amount limits and preserve payment failure health #9

Closed
asmo wants to merge 0 commits from feat/mint-limits-and-health into main
pull from: feat/mint-limits-and-health
merge into: cashubtc:main
Conversation 0 Commits - Files changed -
asmo commented 2026-09-11 12:54:41 +00:00
Owner
Copy link

The auditor was requesting amounts below the 100-sat minimum advertised by ucash and Sovran, then displaying CDK's misleading zero-valued limit error. Hourly info probes also reset mints to healthy even when invoice creation continued to fail.

Normal swap selection now intersects the receiver's NUT-04 limits and sender's NUT-05 limits with configured amounts, donation headroom, and the sender's balance buffer. A 100-sat minimum produces a 100-sat audit under the default configuration when the pair can afford it; incompatible pairs are skipped. Selection respects both mints' cooldowns and admits failed mints again once cooldown expires.

Amount rejections report the requested amount and last advertised bounds. CDK 0.18 has already discarded the remote details for code 11006, so missing details are explicitly labeled instead of inventing zero bounds or presenting cached metadata as the original response. Mint backend exceptions retain their raw detail, gain an operator-facing explanation, and are classified separately from amount/configuration failures.

Info probes continue to populate availability history, but cannot clear the latest attributed payment failure. A settled swap restores payment health. This also corrects previously cleared statuses using existing swap history, without a schema migration. Counterparty failures and local wallet faults do not mark an otherwise working mint as failed. The uptime explanation and README document the distinction.

Validation:

  • 104 backend tests pass, including regressions for the 100-sat minimum, both sides' amount limits, disjoint ranges, balance/headroom constraints, cooldown recovery, error attribution, and availability versus payment health.
  • cargo +nightly fmt --check
  • cargo +nightly test --locked --offline --no-default-features --features=ssr
  • cargo +nightly clippy --locked --offline --no-default-features --features=ssr --all-targets -- -D warnings
  • cargo +nightly clippy --locked --offline --lib --no-default-features --features=hydrate --target wasm32-unknown-unknown -- -D warnings

Routstr's server-side Python exception still requires investigation by its operator. This change makes that failure visible and actionable; it does not repair the remote mint. No live payments were made while implementing or testing these changes.

The auditor was requesting amounts below the 100-sat minimum advertised by ucash and Sovran, then displaying CDK's misleading zero-valued limit error. Hourly info probes also reset mints to healthy even when invoice creation continued to fail. Normal swap selection now intersects the receiver's NUT-04 limits and sender's NUT-05 limits with configured amounts, donation headroom, and the sender's balance buffer. A 100-sat minimum produces a 100-sat audit under the default configuration when the pair can afford it; incompatible pairs are skipped. Selection respects both mints' cooldowns and admits failed mints again once cooldown expires. Amount rejections report the requested amount and last advertised bounds. CDK 0.18 has already discarded the remote details for code 11006, so missing details are explicitly labeled instead of inventing zero bounds or presenting cached metadata as the original response. Mint backend exceptions retain their raw detail, gain an operator-facing explanation, and are classified separately from amount/configuration failures. Info probes continue to populate availability history, but cannot clear the latest attributed payment failure. A settled swap restores payment health. This also corrects previously cleared statuses using existing swap history, without a schema migration. Counterparty failures and local wallet faults do not mark an otherwise working mint as failed. The uptime explanation and README document the distinction. Validation: - 104 backend tests pass, including regressions for the 100-sat minimum, both sides' amount limits, disjoint ranges, balance/headroom constraints, cooldown recovery, error attribution, and availability versus payment health. - `cargo +nightly fmt --check` - `cargo +nightly test --locked --offline --no-default-features --features=ssr` - `cargo +nightly clippy --locked --offline --no-default-features --features=ssr --all-targets -- -D warnings` - `cargo +nightly clippy --locked --offline --lib --no-default-features --features=hydrate --target wasm32-unknown-unknown -- -D warnings` Routstr's server-side Python exception still requires investigation by its operator. This change makes that failure visible and actionable; it does not repair the remote mint. No live payments were made while implementing or testing these changes.
Respect mint amount limits and preserve payment failure health
All checks were successful
Validate auditor / check (pull_request) Successful in 10m13s
Details
626a23b21b
asmo closed this pull request 2026-09-14 06:10:47 +00:00
All checks were successful
Validate auditor / check (pull_request) Successful in 10m13s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
cashubtc/auditor!9
No description provided.