mirror of
https://gitlab.com/pezkuwichain/pezkuwi-sdk.git
synced 2026-10-20 18:56:23 +00:00
Satoshi Qazi Muhammed
a1555ce952
- show_status/show_balances/show_reserves checked the wrong account: load_wallet_addresses(&config.seed_path), the old, explicitly-retired single-operator key, never the multisig custody addresses. These commands were actively misleading, not just unfinished. - listen_deposits/listen_withdrawals ran as concurrent tasks sharing one BridgeDatabase JSON file with no locking and a non-atomic write - two events landing close together could produce a lost update, and a mid-write crash left a truncated file that hard-crashed the next start. Added a process-wide async mutex around every load-mutate-save critical section, and made save() write-temp-then-rename so a crash mid-write can never corrupt the file in place. load() now refuses to silently treat a corrupt file as empty (would erase replay-protection history) - only a genuinely missing file gets a fresh database. - The reserve-shortfall circuit breaker - the single most safety-critical signal this tool can produce - only called a local error!() log macro. Nobody was notified. Added real Telegram alerting (reusing PezbridgeBot's exact chats/send pattern rather than a second channel) for reserve shortfalls, max-single-tx-cap deposits/withdrawals needing manual review, and every new pending_multisig_approval row. Also removed ProcessDeposit/MintWusdt/TransferUsdt - dead-but-dangerous CLI subcommands that still loaded the retired operator key and attempted direct mint/transfer/burn calls that only happened to fail today because that key lost asset authority. A latent trap, not a safe no-op by design; production flow is listen-all -> pending_multisig_approval -> pwap-web signing, never a single-key path. cargo check: 0 errors, 0 warnings (both binaries).