spike: transaction fixture network and envelope portability - #83
Merged
knytcomics-ui merged 2 commits intoAug 24, 2026
Merged
Conversation
Investigates whether fixtures should support multiple passphrases, signed envelopes, fee bumps, and network variants. Delivers findings document and the two concrete artifacts the spike recommends. Key findings: - TransactionBuilder.fromXDR accepts any passphrase without error. Wrong passphrase yields wrong transaction hash silently — verified: same XDR decoded under TESTNET (f8310e15...) vs PUBLIC (80b951be...) produces identical operations but different hashes. - Multi-network support (Strategy B) rejected: fixture addresses are synthetic TESTNET data, meaningless on PUBLIC. Doubles storage and adds consumer disambiguation complexity with no evaluation benefit. - Fee-bump (envelopeTypeTxFeeBump) is the critical missing envelope type. FeeBumpTransaction is a distinct class; .source returns the outer fee source, not the inner tx initiator. Decoder must traverse .innerTransaction. Previously untested. - Signed fixtures deferred: no extension decode path requires them; secret keys cannot be committed. Deliverables: - transactions/index.json: machine-readable index with passphrase, envelopeType, signed flag, stellarHashTestnet, and per-operation metadata for all four fixtures. - transactions/fee_bump_payment.xdr: prototype envelopeTypeTxFeeBump wrapping payment.xdr. Outer fee source: clean_wallet_2; inner tx source: clean_wallet_1. Outer hash: 7ab7ae0d...; inner: f8310e15... - docs/spike-transaction-portability.md: full findings with inventory, strategy comparison, prototype details, and follow-up issues. - transactions/README.md: index.json reference + fee-bump section. - CHANGELOG.md: [Unreleased] updated with spike deliverables. Follow-up issues: - Add fee-bump decode path to grydlock-extension decoder (High) - Add scripts/generate-transactions.mjs for reproducible XDR gen (Med) - Investigate muxed account (M...) address handling in decoder (Low)
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #74
Spike question
Should fixtures remain TESTNET-only, or support multiple passphrases, signed envelopes, fee bumps, and network variants?
Findings summary
The passphrase is invisible in the XDR
TransactionBuilder.fromXDRaccepts any passphrase without error. Wrong passphrase → wrong transaction hash, silently. Verified empirically on all three existing fixtures:The XDR encoding does not embed the passphrase. It is purely a caller concern. Any consumer that guesses or defaults to the wrong passphrase will silently compute wrong transaction hashes.
Multi-network support is not warranted (Strategy B rejected)
All fixture addresses are synthetic TESTNET data — they are meaningless on PUBLIC. Adding PUBLIC variants would double fixture count, require consumers to implement passphrase-selection logic, and produce no additional evaluation signal. Strategy A (TESTNET-only with explicit machine-readable metadata) is the correct path.
See §3 of
docs/spike-transaction-portability.mdfor the full strategy comparison table.Fee-bump is the critical missing envelope type
envelopeTypeTxFeeBumpreturns aFeeBumpTransactionobject — a distinct class fromTransaction. A decoder that reads.sourceon it receives the outer fee-bump source (the account paying the fee), not the inner transaction initiator. It must call.innerTransaction.sourceand.innerTransaction.operationsto reach the data that needs risk-scoring. This decoder path was previously untested — there was no fee-bump fixture.Signed fixtures are premature
Signing requires a secret key, which cannot be committed (blocked by
scripts/check-secrets.mjs). No extension decode path currently requires signature verification. Revisit when the extension gains a verify-before-relay feature.Deliverables
transactions/index.json(new)Machine-readable fixture index. For each XDR file:
networkTESTNET— explicit, not impliedpassphrasefromXDRenvelopeTypeenvelopeTypeTxorenvelopeTypeTxFeeBumpsignedfalse— explicit unsigned declarationstellarHashTestnetfeeBumpSourcesourceoperations{ index, type, destination?, asset?, amount? }innerTransactionCloses the silent-wrong-passphrase risk. Consumers read the passphrase from
index.jsonbefore callingfromXDR, then verify the resulting hash matchesstellarHashTestnet.transactions/fee_bump_payment.xdr(new)Prototype
envelopeTypeTxFeeBumpenvelope:envelopeTypeTxFeeBumpGA4HFFSHZ7PA...(clean_wallet_2)GCRRYBV5IY7D...(clean_wallet_1)paymenttoGCRNKXJJLZND...(suspicious_wallet_1)7ab7ae0df710a6d3...f8310e15760cc1c2...(=payment.xdrhash)Verified with the Stellar SDK:
FeeBumpTransactionclass confirmed, both hashes match, inner ops extracted correctly.docs/spike-transaction-portability.md(new)Full spike findings document:
transactions/README.md(modified)Added:
index.jsonwith passphrase warningfee_bump_payment.xdrfixture section with envelope table, operations table, and a note explaining the inner-vs-outer source decoder requirementAcceptance criteria
docs/spike-transaction-portability.md§1 — all fixture properties listedtransactions/fee_bump_payment.xdr+index.jsonFollow-up issues
scripts/generate-transactions.mjsfor reproducible XDR generationM...) address handling in decoderCross-repository impact
grydlock-extension— decoder must handleFeeBumpTransaction(traverse.innerTransaction). This is the primary actionable follow-up.grydlock-oracle-adapter— no changes needed; fixture shape is unchanged.grydlock-research— should readtransactions/index.jsonfor passphrase when decoding fixtures.