Repository navigation
bug: signing out mid-payment can let a waiting contact import write before the payment ends #1498
Description
What happened?
Found while testing Case 8 of the Shop contact import on #1485 at 2f07d8c (not reproduced on a device yet).
Signing out while a payment is still running (clearStateLocked) resets the shared payment-in-progress gate to false before the payment ends. Any import or other work waiting on that gate can then run while the payment is still in progress, which is what Case 8 guards against.
Expected behavior
The payment gate stays closed until the running payment returns or is actually cancelled, including when the user signs out during it.
Notes
- Reported in fix: import Shop contacts and refresh on return #1485 (comment).
- Not observed in that run; needs a targeted test (sign out while a payment is held, then check that queued imports keep waiting).
Metadata
Metadata
Assignees
Labels
No labels
Activity
ben-kaufman commentedon Oct 15, 2026
Confirmed and fixed in #1506. The guard now belongs to each running payment attempt, so sign-out, clearing the request UI and hardware-sheet disposal cannot release it early. Targeted tests hold a USDT attempt through sign-out and a hardware broadcast through cancellation, and verify that finishing an older attempt cannot release a newer one. This also protects BTC/LN requests. iOS already uses attempt ownership and its corresponding tests passed.