feat(sdk): auto-retry on AddressInvalidNonceError during state transition broadcast #3407

Activity

1. lklimek commented on Mar 26, 2026

   

   lklimek

   on Mar 26, 2026

   ContributorAuthor

   More actions

   Investigation: SDK nonce retry mechanism and address nonces

   Summary

   The SDK has no nonce retry mechanism for any transition type. What exists is:

   1. Network-level request retries in broadcast() via retry() — retries the DAPI gRPC request on transport failures, not on consensus/nonce errors.
   2. Identity nonce cache refresh on failure — on broadcast failure, if the transition has an owner_id(), the identity nonce cache is marked stale so the next operation fetches a fresh nonce from Platform.

   Neither mechanism detects AddressInvalidNonceError (or InvalidIdentityContractNonceError) and retries the transition with a corrected nonce.

   Where the existing "refresh" logic lives

   File: packages/rs-sdk/src/platform/transition/broadcast.rs, lines 83-91

   match &result {
       Ok(_) => trace!("broadcast: completed successfully"),
       Err(e) => {
           warn!(error = ?e, "broadcast: failed after retries");
           if let Some(owner_id) = self.owner_id() {
               sdk.refresh_identity_nonce(&owner_id).await;
           }
       }
   }

   This refresh only runs after the broadcast has already failed — it doesn't retry. It marks the identity nonce cache as stale so the next call to get_identity_nonce() or get_identity_contract_nonce() will re-fetch from Platform. This helps subsequent operations succeed, but doesn't save the current one.

   Why shielded transitions are doubly affected

   1. owner_id() returns None for all shielded/address-based transitions (packages/rs-dpp/src/state_transition/mod.rs, lines 783-792):

      StateTransition::IdentityCreateFromAddresses(_) => None,
      StateTransition::IdentityTopUpFromAddresses(_) => None,
      StateTransition::AddressFundsTransfer(_) => None,
      StateTransition::AddressFundingFromAssetLock(_) => None,
      StateTransition::AddressCreditWithdrawal(_) => None,
      StateTransition::Shield(_) => None,
      StateTransition::ShieldedTransfer(_) => None,
      StateTransition::Unshield(_) => None,

      So even the stale-marking refresh never fires for these transition types.

   2. Address nonces are not cached at all. The NonceCache (packages/rs-sdk/src/internal_cache/mod.rs) only tracks identity_nonces and contract_nonces (keyed by Identifier and IdentityContractPair). Address nonces are fetched fresh every time via fetch_inputs_with_nonce() in packages/rs-sdk/src/platform/transition/address_inputs.rs. This means the stale-time and drift-threshold protections that help identity nonces don't apply to address nonces.

   3. The nonce error arrives late. For shielded transitions, AddressInvalidNonceError comes back from the wait_for_response() step (the Platform processes the transition and returns the consensus error). By that point, the broadcast already succeeded at the transport level. The error surfaces as a StateTransitionBroadcastError with a ConsensusError::StateError(StateError::AddressInvalidNonceError(...)) cause.

   The gap

   There is no code path in the SDK that:

   1. Catches AddressInvalidNonceError (error code 40603) from the wait_for_response() result
   2. Extracts the expected_nonce from the error
   3. Updates the nonce in the state transition's inputs map
   4. Re-signs the transition
   5. Re-broadcasts

   Affected transition types

   All address-based transitions are affected, not just shielded ones:

   • Shield (has inputs())
   • IdentityCreateFromAddresses (has inputs())
   • IdentityTopUpFromAddresses (has inputs())
   • AddressFundsTransfer (has inputs())
   • AddressFundingFromAssetLock (has inputs())
   • AddressCreditWithdrawal (has inputs())

   Suggested implementation

   The retry should live in a new method on StateTransition or as a wrapper around the existing broadcast_and_wait() flow. The key challenge is that after updating the nonce, the transition needs to be re-signed (the signature covers the nonce). For address-based transitions, this means calling the address signer again.

   The cleanest approach would be a broadcast_and_wait_with_address_nonce_retry() method that:

   1. Calls broadcast() + wait_for_response() as normal
   2. If the error is StateTransitionBroadcastError with cause ConsensusError::StateError(StateError::AddressInvalidNonceError(e)):
      • Extract e.expected_nonce() for each address
      • Call a mutable setter on the state transition to update inputs nonces
      • Re-sign the transition with the address signer
      • Retry broadcast + wait once
   3. All other errors propagate normally

   Alternatively, each trait (ShieldFunds, TransferAddressFunds, WithdrawAddressFunds, etc.) could handle the retry at their own level, since they already have access to the signer.

   ---

   Investigation performed by reading the SDK source at git revision 1c7490f in ~/.cargo/git/checkouts/platform-7a21f318038a582f/.
2. lklimek

   self-assigned this

   on Mar 26, 2026
3. lklimek

   added a commit that references this issue on Mar 26, 2026

   fix(ui): wallet screen identity, state management, and input validati…

   ...

   4d6fce8
4. lklimek commented on Mar 27, 2026

   

   lklimek

   on Mar 27, 2026

   ContributorAuthor

   More actions

   To be discussed if we should have an address nonce cache in sdk or not.
5. lklimek commented on Apr 13, 2026

   

   lklimek

   on Apr 13, 2026

   ContributorAuthor

   More actions

   Address sync mechanism should provide the sdk with current nonce. Caching should NOT be required.
6. lklimek

   closed this as completedon Apr 13, 2026