fix(send): re-assert relay floor on built tx; cap rate field at 2 decimals

The absolute custom-fee commit gate (finalizeArmedCustomFee) checks against the previous build's bitcoinTxSize, so an absolute fee that cleared the gate at a stale/small vsize could land below the relay floor at the real vsize. createTransaction now re-asserts the floor against the freshly built fee and vsize before broadcast, regardless of selection type or BDK coin-selection variance.

The sat/vByte custom-fee field allowed 8 decimals (BTC-derived), so a typed 0.12345678 snapped to the nearest sat/kwu and redisplayed as 0.12 (typed != stored != shown). AmountInputFormatter gains an optional maxDecimals override and the rate field passes 2, matching _formatForInput.

Author: ethicnology

lib/core/widgets/fees/custom_fee_list_item.dart

@@ -52,6 +52,7 @@ class CustomFeeListItem extends StatefulWidget {
     this.minRelay,
     this.onArm,
     this.onDisarm,
+    this.onInvalid,
     this.onPreview,
     this.previewFeeSat,
     this.previewLoading = false,
@@ -119,6 +120,15 @@ class CustomFeeListItem extends StatefulWidget {
   /// Ignored in RBF mode (nothing is armed there).
   final VoidCallback? onDisarm;
 
+  /// RBF mode only ([commitOnChange] = true). Called on every keystroke that
+  /// produces a below-floor or empty/invalid value — i.e. exactly when
+  /// [onCommit] is *suppressed*. Lets the RBF parent mark its selection
+  /// invalid so the displayed (rejected) rate and the broadcast rate can't
+  /// diverge: without this, [onCommit] silently keeps the last valid value
+  /// while the field shows a below-floor rate and a red banner, and Broadcast
+  /// would send the stale higher rate. Ignored in modal mode (use [onDisarm]).
+  final VoidCallback? onInvalid;
+
   /// When false, hide the absolute/relative toggle. Input is treated as
   /// relative (sat/vByte) only. RBF passes false — its fee API is
   /// rate-only.
@@ -282,6 +292,9 @@ class _CustomFeeListItemState extends State<CustomFeeListItem> {
           floorSatPerKwu:
               (widget.minRelay ?? widget.feePresets?.minRelay)?.satPerKwu,
         )) {
+          // Below floor — don't commit, and tell the parent its selection is
+          // now invalid so Broadcast can't fire the last valid (stale) rate.
+          widget.onInvalid?.call();
           return;
         }
         widget.onCommit(fee);
@@ -303,7 +316,13 @@ class _CustomFeeListItemState extends State<CustomFeeListItem> {
       _previewDebounce?.cancel();
       // Empty/invalid input — disarm so dismissal rolls back to the prior
       // selection instead of committing the last valid armed value.
-      if (!widget.commitOnChange) widget.onDisarm?.call();
+      if (!widget.commitOnChange) {
+        widget.onDisarm?.call();
+      } else {
+        // RBF mode — invalidate the parent's selection so an emptied field
+        // can't broadcast the last valid (stale) rate.
+        widget.onInvalid?.call();
+      }
     }
   }
 
@@ -478,7 +497,11 @@ class _CustomFeeListItemState extends State<CustomFeeListItem> {
                   if (_isAbsolute)
                     FilteringTextInputFormatter.digitsOnly
                   else
-                    AmountInputFormatter(BitcoinUnit.btc.code),
+                    // Cap the sat/vByte rate at 2 decimals so the typed value
+                    // matches what _formatForInput renders back (also 2dp) and
+                    // what the sat/kwu store can represent — no typed-vs-stored
+                    // -vs-shown drift in the sub-1 regime this targets.
+                    AmountInputFormatter(BitcoinUnit.btc.code, maxDecimals: 2),
                 ],
                 onChanged: _onValueChanged,
                 style: TextStyle(color: context.appColors.onSurface),

lib/core/widgets/inputs/amount_input_formatter.dart

@@ -1,21 +1,29 @@
 import 'package:flutter/services.dart';
 
 class AmountInputFormatter extends TextInputFormatter {
-  AmountInputFormatter(this.inputCurrencyCode);
+  AmountInputFormatter(this.inputCurrencyCode, {this.maxDecimals});
 
   final String inputCurrencyCode;
 
+  /// Optional hard cap on decimal places, overriding the value derived from
+  /// [inputCurrencyCode]. The custom-fee tile passes 2 here so a sat/vByte
+  /// rate can't be typed with more precision than it can store/redisplay —
+  /// the BTC-derived default of 8 would let "0.12345678" be entered, snap to
+  /// the nearest sat/kwu, then redisplay as "0.12" (typed ≠ stored ≠ shown).
+  final int? maxDecimals;
+
   @override
   TextEditingValue formatEditUpdate(
     TextEditingValue oldValue,
     TextEditingValue newValue,
   ) {
     final decimalPlaces =
-        (inputCurrencyCode == 'sats' || inputCurrencyCode == 'L-sats')
-        ? 0
-        : inputCurrencyCode == 'BTC' || inputCurrencyCode == 'L-BTC'
-        ? 8
-        : 2; // Fiat currencies default to 2 decimals, can be adjusted if needed with a map
+        maxDecimals ??
+        ((inputCurrencyCode == 'sats' || inputCurrencyCode == 'L-sats')
+            ? 0
+            : inputCurrencyCode == 'BTC' || inputCurrencyCode == 'L-BTC'
+            ? 8
+            : 2); // Fiat currencies default to 2 decimals, can be adjusted if needed with a map
 
     var newText = newValue.text;
 

lib/features/send/presentation/bloc/send_cubit.dart

@@ -1478,6 +1478,13 @@ class SendCubit extends Cubit<SendState>
     if (state.chainSwap != null) return state.chainSwap!.paymentAmount;
     final input = state.inputAmountSat;
     if (input > 0) return input;
+    // A BIP21 URI with an embedded amount sets confirmedAmountSat but leaves
+    // state.amount (→ inputAmountSat) empty. createTransaction builds from
+    // confirmedAmountSat, so the preview must use the same source — otherwise
+    // previews are skipped (modal shimmers forever) and the cache stays empty
+    // for that payment class.
+    final confirmed = state.confirmedAmountSat;
+    if (confirmed != null && confirmed > 0) return confirmed;
     return null;
   }
 
@@ -1670,6 +1677,36 @@ class SendCubit extends Cubit<SendState>
           '(impliedRate=${txPreparation.txSize > 0 ? (builtFee / txPreparation.txSize).toStringAsFixed(4) : "n/a"} sat/vB)',
         );
 
+        // Belt-and-suspenders relay-floor re-assert. The commit gate in
+        // finalizeArmedCustomFee checks an ABSOLUTE custom fee against the
+        // *previous* build's bitcoinTxSize (or the 140 fallback); if the real
+        // tx is larger, an absolute fee that cleared the gate can land below
+        // the relay floor at the actual vsize. Re-check the freshly built fee
+        // against the freshly built vsize so no below-relay tx ever reaches
+        // broadcast, regardless of selection type or BDK's coin-selection
+        // vsize variance. Don't rely on BDK rejecting sub-minrelay itself.
+        final clearsRelay = NetworkFee.absolute(builtFee).aboveMinRelay(
+          txSize: txPreparation.txSize,
+          floorSatPerKwu: state.bitcoinFeesList?.minRelay.satPerKwu,
+        );
+        if (!clearsRelay) {
+          log.warning(
+            '[create-tx] ABORT — built fee $builtFee sats at '
+            '${txPreparation.txSize} vbytes is below the relay floor '
+            '(${state.bitcoinFeesList?.minRelay.satPerVbyte ?? NetworkFeeRelayPolicy.minRelaySatPerVbyte} sat/vB)',
+          );
+          emit(
+            state.copyWith(
+              buildTransactionException: BuildTransactionException(
+                'Built fee $builtFee sats at ${txPreparation.txSize} vbytes '
+                'is below the relay floor',
+              ),
+              buildingTransaction: false,
+            ),
+          );
+          return;
+        }
+
         if (state.chainSwap != null) {
           // [CHAIN SWAP LIFECYCLE — Step 3b: fail-safe verification]
           // See note on the liquid branch above. Do not remove.

test/core_test/fees/network_fee_relay_policy_test.dart

@@ -92,4 +92,28 @@ void main() {
       );
     });
   });
+
+  group('NetworkFee.aboveMinRelay — stale-vsize divergence (createTx re-assert)', () {
+    // The send commit gate (finalizeArmedCustomFee) checks an ABSOLUTE custom
+    // fee against the PREVIOUS build's bitcoinTxSize (or a 140 fallback). If
+    // the real tx is larger, an absolute fee that cleared the gate at the
+    // stale/small vsize lands BELOW the relay floor at the actual vsize.
+    // createTransaction now re-asserts the floor against the freshly built
+    // fee/vsize before broadcast — these cases pin that exact divergence.
+    test('14 sat clears the floor at the stale 140 vsize but fails at 250', () {
+      const fee = AbsoluteFee(14);
+      // The gate saw 0.1 sat/vB (14/140) and let it through…
+      expect(fee.aboveMinRelay(txSize: 140), isTrue);
+      // …but the real tx weighed 250 vbytes → 0.056 sat/vB, below the floor.
+      expect(fee.aboveMinRelay(txSize: 250), isFalse);
+    });
+
+    test('a fee that clears the floor at both vsizes is unaffected', () {
+      // 25 sat @ 250 vsize = 0.1 sat/vB exactly — still relayable at the real
+      // size, so the re-assert is a no-op for honest fees.
+      const fee = AbsoluteFee(25);
+      expect(fee.aboveMinRelay(txSize: 140), isTrue);
+      expect(fee.aboveMinRelay(txSize: 250), isTrue);
+    });
+  });
 }

test/core_test/widgets/fees/custom_fee_list_item_test.dart

@@ -29,6 +29,7 @@ void main() {
     RelativeFee? minRelay,
     void Function(NetworkFee fee)? onArm,
     VoidCallback? onDisarm,
+    VoidCallback? onInvalid,
     void Function(NetworkFee fee)? onPreview,
     Future<void> Function(NetworkFee fee)? onCommit,
   }) async {
@@ -51,6 +52,7 @@ void main() {
             unselectedIconColor: Colors.grey,
             onArm: onArm,
             onDisarm: onDisarm,
+            onInvalid: onInvalid,
             onPreview: onPreview,
             onCommit: onCommit ?? (_) async {},
             minRelay: minRelay,
@@ -188,10 +190,12 @@ void main() {
       'PSBT no node would relay)',
       (tester) async {
         NetworkFee? committed;
+        bool invalidated = false;
         await pumpTile(
           tester,
           commitOnChange: true,
           onCommit: (fee) async => committed = fee,
+          onInvalid: () => invalidated = true,
         );
         // 0.05 sat/vByte < NetworkFeeRelayPolicy.minRelaySatPerVbyte.
         // The build-time banner ("Fee Rate Too Low") shows the user why
@@ -200,6 +204,51 @@ void main() {
         await tester.enterText(find.byType(TextFormField), '0.05');
         await tester.pump();
         expect(committed, isNull);
+        // …and the parent is told its selection is now invalid, so Broadcast
+        // can't fire the last valid (stale) rate.
+        expect(invalidated, isTrue);
+      },
+    );
+
+    testWidgets(
+      'RBF mode lowers a valid rate below floor → onInvalid fires, no commit',
+      (tester) async {
+        final committed = <NetworkFee>[];
+        var invalidCount = 0;
+        await pumpTile(
+          tester,
+          commitOnChange: true,
+          onCommit: (fee) async => committed.add(fee),
+          onInvalid: () => invalidCount++,
+        );
+        // First a valid above-floor rate commits…
+        await tester.enterText(find.byType(TextFormField), '2');
+        await tester.pump();
+        expect(committed, hasLength(1));
+        expect((committed.single as RelativeFee).satPerVbyte, closeTo(2, 0.003));
+        // …then lowering it below the floor must invalidate, not re-commit.
+        await tester.enterText(find.byType(TextFormField), '0.05');
+        await tester.pump();
+        expect(committed, hasLength(1), reason: 'stale rate not re-committed');
+        expect(invalidCount, 1);
+      },
+    );
+
+    testWidgets(
+      'RBF mode emptying the field fires onInvalid',
+      (tester) async {
+        var invalidCount = 0;
+        await pumpTile(
+          tester,
+          commitOnChange: true,
+          onCommit: (_) async {},
+          onInvalid: () => invalidCount++,
+        );
+        await tester.enterText(find.byType(TextFormField), '2');
+        await tester.pump();
+        await tester.enterText(find.byType(TextFormField), '');
+        await tester.pump();
+        expect(invalidCount, 1);
       },
     );
 
@@ -246,6 +295,26 @@ void main() {
         expect(previewCount, 0);
       },
     );
+
+    testWidgets(
+      'the sat/vByte rate field caps input at 2 decimals',
+      (tester) async {
+        // The field used to allow 8 decimals (BTC-derived): a user could type
+        // "0.12345678", the model snapped it to the nearest sat/kwu, and the
+        // prefill re-rendered it as "0.12" — typed ≠ stored ≠ shown. The
+        // 2-decimal cap keeps the field consistent with _formatForInput.
+        NetworkFee? armed;
+        await pumpTile(tester, onArm: (fee) => armed = fee);
+
+        await tester.enterText(find.byType(TextFormField), '0.12345678');
+        await tester.pump();
+
+        final field = tester.widget<TextFormField>(find.byType(TextFormField));
+        expect(field.controller!.text, '0.12');
+        // What was armed matches what's shown — no hidden extra precision.
+        expect((armed! as RelativeFee).satPerVbyte, closeTo(0.12, 0.003));
+      },
+    );
   });
 
   group('CustomFeeListItem — preview line', () {