Skip to content

fix: extend withdrawal XDR timeout to 7 days and add expiry guard#139

Open
OAKVISUALZ wants to merge 2 commits into
Savitura:mainfrom
OAKVISUALZ:feature/withdrawal-xdr-timeout
Open

fix: extend withdrawal XDR timeout to 7 days and add expiry guard#139
OAKVISUALZ wants to merge 2 commits into
Savitura:mainfrom
OAKVISUALZ:feature/withdrawal-xdr-timeout

Conversation

@OAKVISUALZ
Copy link
Copy Markdown
Contributor

Closes #128

Changes:

  • stellarService.js: setTimeout(300) -> setTimeout(606024*7) in buildWithdrawalTransaction; 5-minute window was too short for async multi-party signing where the platform approver may not be available for hours or days
  • stellarService.js: add isXdrExpired(xdr) helper that parses timeBounds from a raw XDR string and returns true if maxTime has passed; returns false on any parse error so a malformed XDR never blocks approval
  • withdrawals.js: call isXdrExpired before platform signs; return HTTP 410 with a clear re-request message if expired
  • WithdrawalsSection.jsx: track expired row IDs; detect 410 responses in runAction; show amber warning banner and Expired status label; hide admin approve+submit button for expired rows
  • withdrawals.test.js: add isXdrExpired stub; new test verifies 410 on expired XDR

Closes Savitura#128

Changes:
- stellarService.js: setTimeout(300) -> setTimeout(60*60*24*7) in
  buildWithdrawalTransaction; 5-minute window was too short for async
  multi-party signing where the platform approver may not be available
  for hours or days
- stellarService.js: add isXdrExpired(xdr) helper that parses timeBounds
  from a raw XDR string and returns true if maxTime has passed; returns
  false on any parse error so a malformed XDR never blocks approval
- withdrawals.js: call isXdrExpired before platform signs; return HTTP 410
  with a clear re-request message if expired
- WithdrawalsSection.jsx: track expired row IDs; detect 410 responses in
  runAction; show amber warning banner and Expired status label; hide
  admin approve+submit button for expired rows
- withdrawals.test.js: add isXdrExpired stub; new test verifies 410 on
  expired XDR
@drips-wave
Copy link
Copy Markdown

drips-wave Bot commented May 30, 2026

@OAKVISUALZ Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

The admin moderation feature (feat: fb7f93d) accidentally introduced a
corrupted section by merging two different versions of AdminDashboard —
the old flat layout and the new tab-based layout were interleaved from
line 476 onward, causing:

  frontend/src/pages/AdminDashboard.jsx
  483:7  error  Parsing error: Adjacent JSX elements must be wrapped in an enclosing tag

This broke the frontend-checks CI step (ESLint exit code 1) for every
subsequent PR. The fix removes the orphaned old-version JSX fragment
(lines 476-622 of the corrupted file) which contained duplicate
Platform Fees card, Campaign Management table, and Milestone Reviews
section that had leaked out of the tab system into the outer render
scope. The correct tab-based code remains intact.

Frontend build: passed (built in 11.57s)
Frontend ESLint: 0 errors, 0 warnings
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Withdrawal XDR expires in 5 minutes — too short for async multi-party signing

1 participant