framework icon indicating copy to clipboard operation
framework copied to clipboard

Added retry logic to minaTransactionSender

Open Raunaque97 opened this issue 1 month ago • 1 comments

  • refactored minaTransactionSender to use a persistent Storage.
  • added a simple retry Strategy to increase fees by a multiple and retry every few minutes if the transaction is not included.
  • also handles the case if the sequencer restarts and the last sent transaction statuses were not updated in DB.

Raunaque97 avatar Nov 25 '25 13:11 Raunaque97

So what I just discovered: When we setFee(), o1js erases all previous signatures in order for the tx to be signed again. And this makes sense - for the feepayer and some accountupdates, o1js uses the so-called "full commitment". This is simply just the hash of the whole transaction, including all accountupdates and the feepayer, whereas the non-full commitment would just the be hash of the current accountupdate. Now, accountupdates can actually specify whether they want to use the full commitment or not (this is a field in the accountupdate struct that mina will receive as part of the transaction). And whatever commitment you choose, you signature or proof will only be valid given that exact commitment. it is kinda the basis on which you sign or prove. Now why is this important? Signing or proving over a full commitment prevent replay attacks, like in other chains. But mina is a bit special, and unlike other chains, we sign a bunch of sub-parts individually. And so generally, in order to prevent somebody to rip out a part of our tx from the L1 mempool and replay it in their own specially-crafted malicious transaction and frontrun ours, we sign over the full commitment. For resending transactions with a higher fee, this is a bit annoying - we don't want to re-prove the entire tx just because we changed the fee, right? As I've mentioned above, luckily we can choose to opt-out of using the full commitment and use only the current accountupdate's commitment instead. But this is only possible in some distinct scenarios. My initial suspicious is that this is the case iff the accountupdate's validity is directly dependent on exclusively other full-commitment based accountupdates within the same transaction. But I'll have to think more on that definition. Anyways, what we have to do before this PR will work without re-proving some accountupdates, is to use no full commitment generally. And for us to be able to do this, we need to examine the protocol and see if we can do this safely

rpanic avatar Nov 26 '25 14:11 rpanic