ava-labs / ava-labs/platform-cli

security: cross-chain retry may mask permanent insufficient funds error

Open
#11 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1
Forks
5
PR merge metrics
No merged PRs in 30d

Description

## Description

The `isRetryableImportError` function in `pkg/crosschain/transfer.go` uses string matching to classify errors as retryable. The pattern `"insufficient funds"` could match both transient UTXO propagation issues and permanent balance insufficiency.

## Current behavior

```go
retryablePatterns := []string{
"not found",
"no utxos",
"insufficient funds", // May occur if UTXOs haven't propagated
"missing utxo",
}
```

If a user truly has insufficient funds, the CLI retries multiple times before failing, wasting time.

## Suggested improvements

- Check for specific SDK error types instead of string matching
- Add max retry duration in addition to max attempts
- Log each retry attempt so users understand what's happening
- Consider distinguishing between "no UTXOs at all" (permanent) vs "UTXOs not yet visible" (transient)

## Files affected
- `pkg/crosschain/transfer.go:164-182`

## Severity
Minor - causes delayed error reporting, not incorrect behavior

## Source
Production readiness audit (2026-02-09)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.