Meet BIP125's relay minimum on every RBF bump, and cap the fee rate (B-32)

bump_fee computed fee_delta as new_fee - old_fee, falling back to a flat 1-satoshi bump whenever that came out zero or negative - which happened whenever old_fee (the actual fee paid, from real prevout amounts) already exceeded the naive target, e.g. because dust change had been folded into the original fee (psbt_builder.py's DUST_LIMIT_SATS handling). A 1-satoshi total increase is nowhere near BIP125 rule 4's minimum (the replacement must pay at least the incremental relay fee rate times its own vsize more than what it replaces), so the node rejected it every time - and since bump_fee raised before touching `pending`, the next tick retried with identical parameters every 30 seconds, forever. Separately, the fee rate climbed by 1 sat/vB every bump with no ceiling. fee_delta is now max(target_fee - old_fee, vsize * the incremental relay rate) - always at least the relay-mandated minimum regardless of what the naive arithmetic produces. pending.fee_rate_sat_vb is set to the actual resulting rate rather than the naive target, so a later bump's arithmetic starts from what's really being paid instead of drifting from it. Once a transaction reaches MAX_FEE_RATE_SAT_VB (a new constant, 10,000 sat/vB, shared with RoundConfig.fee_rate_sat_vb's existing admin-facing bound so the two can't drift apart - the same reason MIN_PASSWORD_LENGTH is shared elsewhere) bump_fee refuses to bump further; the reconciler abandons it if it never confirms (B-27) instead of this retrying forever. Suite grows from 185 to 187 tests. BUGS.md moves B-32 to Previously fixed.
2026-07-27 11:16:20 +02:00
parent fe5639a037
commit 17c557b8a3
5 changed files with 183 additions and 38 deletions
@@ -11,7 +11,7 @@ from app.db.base import Base
 from app.db.models import PendingTransaction, User
 from app.tx.broadcast import RbfError, bump_fee, should_bump
 from app.wallet.plm_network import PLM_MAINNET
-from app.wallet.psbt_builder import Utxo, build_signed_transaction
+from app.wallet.psbt_builder import MAX_FEE_RATE_SAT_VB, Utxo, build_signed_transaction, estimate_vsize


 def _key(seed_byte: int) -> HDKey:
@@ -319,3 +319,132 @@ async def test_bump_fee_retargets_every_stored_txid(session_factory):

        utxo = (await session.scalars(select(UtxoEvent))).one()
        assert utxo.spent_txid == new_txid
+
+
+# --- B-32: the bump delta must always meet BIP125's relay-mandated minimum, and
+# escalation must stop at a ceiling instead of retrying forever. ------------------
+
+
+async def test_bump_fee_meets_bip125_minimum_when_old_fee_already_exceeds_target(session_factory):
+    """old_fee (as bump_fee computes it from the actual prevout amounts) can end
+    up higher than vsize * target_fee_rate — e.g. because dust change was folded
+    into the original fee (wallet/psbt_builder.py's DUST_LIMIT_SATS handling).
+    The naive `target_fee - old_fee` goes negative in that case; the previous
+    fallback was a flat 1-satoshi total bump, nowhere near BIP125 rule 4's
+    required minimum, so the node rejected it every time and — since bump_fee
+    raised before touching `pending` — the next tick retried identically every
+    30 seconds, forever. Simulated here by reporting a prevout inflated beyond
+    what was actually spent, which has the same effect on old_fee as dust
+    absorption would."""
+    from app.wallet.hd import derive_user_address, derive_user_key
+
+    signer = derive_user_key(0)
+    my_address = derive_user_address(0)
+    from_script = script.p2wpkh(signer.to_public())
+    to_address = script.p2wpkh(_key(96).to_public()).address(network=PLM_MAINNET)
+
+    utxo_amount = 150_000_000
+    utxo_txid = "55" * 32
+    built = build_signed_transaction(
+        signing_key=signer,
+        from_script=from_script,
+        utxos=[Utxo(utxo_txid, 0, utxo_amount)],
+        to_address=to_address,
+        amount_sats=10_000_000,
+        change_address=my_address,
+        fee_rate_sat_vb=1,
+    )
+
+    async with session_factory() as session:
+        user = User(username="dave", password_hash="x", derivation_index=0, address=my_address)
+        session.add(user)
+        await session.commit()
+        pending = PendingTransaction(
+            kind="bet",
+            user_id=user.id,
+            current_txid=built.txid,
+            fee_rate_sat_vb=1,
+            raw_tx_hex=built.raw_hex,
+            status="pending",
+            broadcast_at=datetime.now(timezone.utc) - timedelta(seconds=1000),
+        )
+        session.add(pending)
+        await session.commit()
+        pending_id = pending.id
+
+    # Reports a prevout inflated well beyond what was actually spent — has the
+    # same effect on old_fee as dust absorption would have: old_fee ends up far
+    # above vsize * target_fee_rate (target_fee_rate = 2 here).
+    inflated_excess = 50_000
+    client = FakeClient({utxo_txid: utxo_amount + inflated_excess})
+
+    async with session_factory() as session:
+        row = await session.get(PendingTransaction, pending_id)
+        new_txid = await bump_fee(session, client, row)
+
+    assert client.broadcasted
+    new_tx = Transaction.parse(bytes.fromhex(client.broadcasted[0]))
+    old_tx = Transaction.parse(bytes.fromhex(built.raw_hex))
+    old_change = next(o.value for o in old_tx.vout if o.script_pubkey.address(network=PLM_MAINNET) == my_address)
+    new_change = next(o.value for o in new_tx.vout if o.script_pubkey.address(network=PLM_MAINNET) == my_address)
+
+    vsize = estimate_vsize(len(old_tx.vin), len(old_tx.vout))
+    min_valid_delta = vsize * 1  # BIP125 rule 4's floor at a 1 sat/vB incremental relay fee
+    assert min_valid_delta > 1  # meaningfully more than the old flat "1 satoshi" fallback
+    assert old_change - new_change == min_valid_delta
+
+    async with session_factory() as session:
+        row = await session.get(PendingTransaction, pending_id)
+        old_fee_as_bump_fee_computed_it = built.fee_sats + inflated_excess
+        expected_rate = (old_fee_as_bump_fee_computed_it + min_valid_delta) // vsize
+        assert row.fee_rate_sat_vb == expected_rate
+        assert row.fee_rate_sat_vb > 2  # the actual rate, not the naive (and too-low) target
+
+
+async def test_bump_fee_refuses_once_at_the_max_fee_rate(session_factory):
+    """Without a ceiling, a stuck transaction's fee rate climbed by 1 sat/vB every
+    30 seconds forever, eating further and further into the user's change."""
+    from app.wallet.hd import derive_user_address, derive_user_key
+
+    signer = derive_user_key(0)
+    my_address = derive_user_address(0)
+    from_script = script.p2wpkh(signer.to_public())
+    to_address = script.p2wpkh(_key(95).to_public()).address(network=PLM_MAINNET)
+
+    utxo_amount = 150_000_000
+    utxo_txid = "66" * 32
+    built = build_signed_transaction(
+        signing_key=signer,
+        from_script=from_script,
+        utxos=[Utxo(utxo_txid, 0, utxo_amount)],
+        to_address=to_address,
+        amount_sats=10_000_000,
+        change_address=my_address,
+        fee_rate_sat_vb=1,
+    )
+
+    async with session_factory() as session:
+        user = User(username="erin", password_hash="x", derivation_index=0, address=my_address)
+        session.add(user)
+        await session.commit()
+        pending = PendingTransaction(
+            kind="bet",
+            user_id=user.id,
+            current_txid=built.txid,
+            fee_rate_sat_vb=MAX_FEE_RATE_SAT_VB,
+            raw_tx_hex=built.raw_hex,
+            status="pending",
+            broadcast_at=datetime.now(timezone.utc) - timedelta(seconds=1000),
+        )
+        session.add(pending)
+        await session.commit()
+        pending_id = pending.id
+
+    client = FakeClient({utxo_txid: utxo_amount})
+
+    async with session_factory() as session:
+        row = await session.get(PendingTransaction, pending_id)
+        with pytest.raises(RbfError):
+            await bump_fee(session, client, row)
+
+    assert not client.broadcasted