Skip to content

Bug: TokenAllowanceGateway is a module-level singleton — allowance state leaks across accounts #368

Description

@Jaydbrown

lib/token-allowance-gateway.ts:537-559getTokenAllowanceGateway() returns a process/tab-wide singleton holding _records: Map<token::spender, {allowance, state, ...}>.

Nothing invalidates it on a wallet account switch. WalletContext's WatchWalletChanges handler (contexts/WalletContext.tsx) updates publicKey and clears the React Query cache on an external account change, but does not call resetTokenAllowanceGateway().

Impact

After switching accounts in Freighter, app/create/page.tsx's gateway.checkAllowance can return the previous account's cached allowance for a token+spender pair (checkAllowance only overwrites record.allowance on a successful RPC, and reads the stale value meanwhile), so the approve step may be skipped and create_stream then reverts on a missing transfer_from allowance.

Suggested fix

Key records by owner too, or call resetTokenAllowanceGateway() from the same places that call queryClient.clear() on disconnect/account-change.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programbugSomething isn't workingpriority: mediumMissing feature or UX issue

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions