staticaddr/loopin: prevent sweepless signing timeouts - #1228
Open
starius wants to merge 3 commits into
Open
Conversation
The server can issue many presigning requests at once, but the client handled notifications serially. Slow transports could leave later responses past the server signing deadline. Dispatch each request independently and drain active handlers during shutdown so notification intake and cleanup remain safe.
Authenticated RPCs were serialized behind Aperture's token-payment mutex. Slow sweep responses could therefore exceed the server timeout. Use a paid token without the acquisition lock while keeping a serialized fallback for payment challenges.
Unbounded notification handlers could exhaust client and signer resources. Incomplete server prevout mappings could also crash or misstate a signing hash. Bound request processing with a fixed worker pool and verify prevouts and locally owned deposit data before signing.
starius
force-pushed
the
parallel-sweepless-sign
branch
from
September 9, 2026 16:36
efe9b4a to
04a4e3a
Compare
starius
marked this pull request as ready for review
September 9, 2026 20:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For a sweepless Static Address loop-in, the server can ask the client to presign many fee variants of the sweep transaction. The client previously handled those notifications one at a time, and Aperture's L402 interceptor also held its token-payment mutex across each authenticated unary RPC. On a high-latency connection this made every signature response wait for another full round trip, so later variants could miss the server's signing deadline even though the client was otherwise able to sign them.
This change processes sweep requests through a bounded 128-worker pool and lets unary RPCs that already have a paid L402 token run concurrently. Token acquisition, payment resumption, and payment-required challenges still use Aperture's serialized path, preventing concurrent calls from initiating duplicate payments, while streaming RPC authentication remains unchanged. Shutdown cancels and drains the workers before manager-owned resources are released, and the fixed pool prevents a burst of server notifications from creating unbounded signing work.
Since this path signs server-provided transactions, the change also tightens the validation boundary before creating any MuSig2 session. The client verifies that the PSBT contains an unsigned transaction, that the server supplied an exact and unique prevout for every input, and that every deposit it is asked to sign is locally owned with the expected value and script. Malformed or inconsistent requests are rejected before signing instead of producing a signature over an incorrect digest or reaching a nil prevout.
Pull Request Checklist
docs/release-notes/release-notes-next.md, or apply theno-changeloglabel (required by CI)