mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-10 00:16:59 +00:00
Claude
0313dcf3fa
Addresses the 15 issues from the second audit pass. Key changes: - Per-event resolution flag (`Note.onchainZapResolved`) replaces the unbounded rejection blocklist. The flag is set on terminal verifier verdicts (Confirmed or hard-Rejected) and gates the verifier launch in `consume()`. Travels with the Note so it clears on `removeAllChildNotes()`. - Per-event in-flight set (`verifyingEventIds`) deduplicates concurrent verifier launches across `consume()` echoes and `reverifyOnchainZapsForNote` races. Solves: profile-only zaps bypassing the all-CONFIRMED guard, Rejected entries re-firing the verifier on every echo, and the consume()/reverify TOCTOU race. - Per-note reverify gate (`reverifyingNoteIds`) prevents multiple visible galleries from launching concurrent reverify passes for the same note. - `removeOnchainZapForSource` now refuses to remove a CONFIRMED entry — only an explicit fresh CONFIRMED replacement can change one. Prevents the cross-target downgrade where one target's transient ZERO_VERIFIED_AMOUNT erases a sibling target's already-confirmed entry. Also non-nullable pubkey parameter to close the null-vs-null comparison hole. - `innerAddOnchainZap` dedup tightened: exact structural equality skips spurious flowSet invalidations on relay echoes, but same-level + equal verifiedSats from a DIFFERENT source now replaces (fixes multi-signer attribution lock-in). - Tip flow uses explicit try/catch that re-throws CancellationException instead of `runCatching` (same fix the previous audit applied to the verifier). Lazy initializer falls back to a constant-null StateFlow if `Amethyst.instance` isn't initialized yet, instead of throwing. - Gallery driver: unconditional first-view kick (no longer waits for the tip flow's first non-null emission), separate effect keyed on pending entry count so a fresh UNVERIFIED arrival kicks reverify immediately instead of waiting up to 60s for the next tip poll. - `observeNoteZaps`'s memoization now keys on the `onchainZaps` map reference so lightning-zap traffic on the same note doesn't churn the onchain gallery. - `reverifyOnchainZapsForNote` uses `supervisorScope` so a single failed verifier doesn't cancel its siblings, and the semaphore permits bump from 4 → 8 reduces head-of-line blocking when many galleries reverify concurrently.