Summary
The cosigner holds a permanently reusable intent and discards it after a single try. If that try fails, the user loses their money.
What happens
A user goes offline. Their client leaves a signed intent with the cosigner. At the due time the cosigner tries once to drive it into an ASP batch. The ASP is briefly slow, mid round, or unreachable, an ordinary hiccup. The cosigner already deleted the intent before attempting, so there is nothing to retry with. The log says the client will re-delegate later, but the client is an offline phone and is never coming. The VTXO expires and is swept.
Retry is impossible even in principle: the auto-settle tick task selects users by iterating stored delegate rows, so a deleted row removes the user from the candidate set entirely.
Fix
Delete only on a successful drive. On failure keep the record and retry on the next tick, with backoff, until the VTXO expiry genuinely passes, then log loudly.
Summary
The cosigner holds a permanently reusable intent and discards it after a single try. If that try fails, the user loses their money.
What happens
A user goes offline. Their client leaves a signed intent with the cosigner. At the due time the cosigner tries once to drive it into an ASP batch. The ASP is briefly slow, mid round, or unreachable, an ordinary hiccup. The cosigner already deleted the intent before attempting, so there is nothing to retry with. The log says the client will re-delegate later, but the client is an offline phone and is never coming. The VTXO expires and is swept.
Retry is impossible even in principle: the auto-settle tick task selects users by iterating stored delegate rows, so a deleted row removes the user from the candidate set entirely.
Fix
Delete only on a successful drive. On failure keep the record and retry on the next tick, with backoff, until the VTXO expiry genuinely passes, then log loudly.