[LOW] 11 orphaned setTimeout callbacks without cleanup across 5 hooks

[v1ktorrr0x]

Severity: Low

Source

Multiple hooks — 11 orphaned timeouts total:

File	Line(s)	What fires
useDeposit.ts	308	refreshSlab() at 2s
useWithdraw.ts	211	refreshSlab() at 2s
useClosePosition.ts	81, 177	setPhase("idle") at 2s (2 instances)
useInitUser.ts	132, 194, 272	refreshSlab() at 2s (3 instances)
useTrade.ts	397	refreshSlab() at 1.2s, 2.2s, 3.5s (3 instances)

Description

All 11 timeouts fire callbacks without clearTimeout on cleanup. For the slab refresh ones, SlabProvider.parseSlab's cancelled guard prevents React state update warnings, but the RPC calls still execute and are discarded. For useClosePosition, the setPhase("idle") call may fire on an unmounted component.

Fix

Store timeout IDs in refs and clear them in a useEffect cleanup:

const timeoutRef = useRef<ReturnType<typeof setTimeout>>();
useEffect(() => () => { if (timeoutRef.current) clearTimeout(timeoutRef.current); }, []);

[dcccrypto]

Partially fixed — one more site found while triaging #2317. Keeping open.

useDeposit.ts:365 is fixed (PR #2526): the delayed refreshSlab timer is now tracked on a ref and cleared by an unmount effect.

The other hooks in your inventory already clear theirs — useAutoDeposit, useChartDrawings, useDuplicateMarket, usePortfolio, usePriceFlash all call clearTimeout.

A site not in your original list, spotted while verifying the stake-page refresh:

app/app/stake/page.tsx:1356
window.setTimeout(() => setPoolsRefreshKey((k) => k + 1), 2_000);

No handle is retained, so it can fire setPoolsRefreshKey against an unmounted page — the same shape as the useDeposit one, in a page rather than a hook. Its sibling at :1352 is a synchronous bump and is fine; only the 2s settle-delay timer leaks.

Worth folding into whatever pass closes the rest, since it is the same fix (retain the id, clear on unmount).

[dcccrypto]

FIXED and merged to playground in PR #2527. Closing.

Verified on the merged branch (91dfff1a), not asserted from the diff. Launch suite: 3111 passed / 16 skipped / 0 failed.

useDeposit's delayed slab refresh is tracked in pendingTimersRef and cleared on unmount, so the callback cannot fire against a torn-down component.