Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ export async function waitForTransactionStatus(
toChain: step.action.toChainId,
txHash,
...(step.tool !== 'custom' && { bridge: step.tool }),
...(step.transactionId && { transactionId: step.transactionId }),
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You added transactionId to the getStatus call but the module-level cache TRANSACTION_HASH_OBSERVERS is still keyed only by txHash. This can cause cached responses to be reused across requests with different transactionId values. Consider including transactionId in the cache key or avoid module-level per-request caching.

Details

✨ AI Reasoning
​A module-level cache (TRANSACTION_HASH_OBSERVERS) stores promises keyed by txHash. The PR adds transactionId into the request payload, so two requests with the same txHash but different transactionId will still reuse the same cached promise. This can leak or mix request-specific data between callers and cause incorrect status results. The problem was introduced/worsened by adding transactionId to the request without changing caching behavior.

🔧 How do I fix it?
Avoid storing request-specific data in module-level variables. Use request-scoped variables or explicitly mark shared caches as intentional.

Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info

})
.then((statusResponse) => {
switch (statusResponse.status) {
Expand Down
Loading