fix(fees): validate against live minimumFee + resolve audit findings

Validate custom fees against the mempool minimumFee instead of a hardcoded 0.1 (i5hi's 'custom fee validation > minimum'). The precise endpoint's minimumFee was parsed then discarded; FeeOptions now carries a minRelay rate = max(minimumFee, 0.1), the mapper floors every tier at it, and the custom-fee field, RBF gate, and send/swap commit gates reject anything below it via aboveMinRelay(floorSatPerKwu:). Under congestion the app no longer accepts a fee the network won't relay; never drops below the 0.1 safety floor.

fix(swap): the two Bitcoin fee-preview builders hardcoded drain:false while the commit path uses drain:isMaxSelected, so a max-send could cache and broadcast a non-draining PSBT (wrong amount, residual left in wallet). Pass the real flag, mirroring SendCubit.

fix(fees): a malformed-but-200 precise response (missing/non-numeric field) threw uncaught instead of falling back — parsing now happens inside _getFees so it falls back to the recommended endpoint.

fix(fees): clearing the custom-fee field (abs/rel toggle flip or emptied input) now disarms the parent, so a stale pre-clear value can't commit on dismissal.

fix(send): preserve isToSelf on the cached-PSBT commit instead of hardcoding false (was flipping the to-self badge and mis-gating payjoin on self-sends).

chore(fees): localize the preset-row unit labels and the Estimated-delivery prefix; correct the mapper doc on minimumFee. Adds regression tests for all of the above.

Author: ethicnology

lib/core/fees/data/fees_datasource.dart

@@ -60,31 +60,38 @@ class FeesDatasource {
 
     final http = _dioBuilder(baseUrl);
 
-    final json =
+    final fees =
         await _getFees(http, ApiServiceConstants.mempoolPreciseFeesPath) ??
         await _getFees(http, ApiServiceConstants.mempoolRecommendedFeesPath);
-    if (json == null) {
+    if (fees == null) {
       throw MempoolFeesException(
         'No mempool fee endpoint available at $baseUrl',
       );
     }
 
-    return MempoolFeesModel.fromJson(json);
+    return fees;
   }
 
-  /// GETs a fee endpoint. Returns the JSON body on a 200 with a JSON object,
-  /// or `null` on any failure (non-200, network/Dio error, or a non-object
-  /// body) so the caller can fall back to another path.
-  Future<Map<String, dynamic>?> _getFees(Dio http, String path) async {
+  /// GETs a fee endpoint and parses it. Returns the model on a 200 with a
+  /// well-formed body, or `null` on any failure — non-200, network/Dio
+  /// error, non-object body, or a 200 whose body is missing or has a
+  /// non-numeric fee field — so the caller can fall back to the next path.
+  /// Parsing happens here (not at the call site) so a malformed-but-200
+  /// precise response falls back to recommended instead of throwing.
+  Future<MempoolFeesModel?> _getFees(Dio http, String path) async {
     try {
       final resp = await http.get<dynamic>(path);
       final data = resp.data;
       if (resp.statusCode == 200 && data is Map<String, dynamic>) {
-        return data;
+        return MempoolFeesModel.fromJson(data);
       }
       return null;
     } on DioException {
       return null;
+    } catch (_) {
+      // A 200 with a malformed/partial body — `fromJson` throws on a missing
+      // or non-numeric fee field. Fall back rather than failing the fetch.
+      return null;
     }
   }
 }

lib/core/fees/data/fees_repository_impl.dart

@@ -26,6 +26,7 @@ class FeesRepositoryImpl implements FeesRepository {
       fastest: minRelay,
       economic: minRelay,
       slow: minRelay,
+      minRelay: minRelay,
     );
   }
 }

lib/core/fees/data/mappers/mempool_fees_mapper.dart

@@ -10,28 +10,34 @@ import 'package:bb_mobile/core/fees/domain/fees_entity.dart';
 /// - **Economic** ← `hourFee` (~1-hour target).
 /// - **Slow**     ← `economyFee`.
 ///
-/// Every tier is floored at the network minrelayfee so no preset can drop
-/// below what the network will relay. Because mempool returns the fields in
-/// non-increasing order (`fastestFee ≥ hourFee ≥ economyFee`) and `max` is
-/// monotonic, flooring all three preserves the Fastest ≥ Economic ≥ Slow
-/// ordering even in the pathological case where a server reports rates below
-/// the floor (which would otherwise invert Slow above Economic).
+/// The relay floor is `max(minimumFee, 0.1 sat/vByte)`: the live mempool
+/// `minimumFee` (the rate below which that node won't relay — typically 0.1
+/// at quiet blocks, higher under congestion), clamped up to the static 0.1
+/// safety floor. Every tier is floored at it, and it is exposed as
+/// [FeeOptions.minRelay] so the validation gates reject anything below the
+/// network's current minimum rather than a hardcoded constant. Because
+/// mempool returns the fields in non-increasing order (`fastestFee ≥ hourFee
+/// ≥ economyFee ≥ minimumFee`) and `max` is monotonic, flooring all three
+/// preserves the Fastest ≥ Economic ≥ Slow ordering.
 ///
-/// `halfHourFee` and `minimumFee` are intentionally unused — the app exposes
-/// exactly three tiers, and Slow is floor-protected rather than tracking
-/// mempool's `minimumFee` (which collapses to ~1 sat/vByte at quiet blocks
-/// and would make Slow indistinguishable from a real economy rate).
+/// `halfHourFee` is intentionally unused — the app exposes exactly three
+/// tiers. `minimumFee` feeds only the relay floor (above), never a tier, so
+/// Slow stays a real economy rate instead of collapsing onto the floor.
 class MempoolFeesMapper {
   const MempoolFeesMapper._();
 
   static FeeOptions toFeeOptions(MempoolFeesModel model) {
-    RelativeFee tier(double satPerVbyte) => NetworkFee.relativeFromSatPerVbyte(
-      max(satPerVbyte, NetworkFeeRelayPolicy.minRelaySatPerVbyte),
+    final floorSatPerVbyte = max(
+      model.minimumFee,
+      NetworkFeeRelayPolicy.minRelaySatPerVbyte,
     );
+    RelativeFee tier(double satPerVbyte) =>
+        NetworkFee.relativeFromSatPerVbyte(max(satPerVbyte, floorSatPerVbyte));
     return FeeOptions(
       fastest: tier(model.fastestFee),
       economic: tier(model.hourFee),
       slow: tier(model.economyFee),
+      minRelay: NetworkFee.relativeFromSatPerVbyte(floorSatPerVbyte),
     );
   }
 }

lib/core/fees/domain/fees_entity.dart

@@ -105,15 +105,25 @@ extension NetworkFeeRelayPolicy on NetworkFee {
   static const double minRelaySatPerVbyte = 0.1;
   static const int minRelaySatPerKwu = 25;
 
-  /// True when this fee is at or above the network minrelayfee. Absolute
-  /// fees need a [txSize] to express as a rate; [txSize] ≤ 0 → false (the
-  /// caller is in a transient pre-build state and shouldn't be allowed to
-  /// commit yet).
-  bool aboveMinRelay({int? txSize}) => switch (this) {
-    RelativeFee(:final satPerKwu) => satPerKwu >= minRelaySatPerKwu,
-    AbsoluteFee(:final sats) =>
-      txSize != null && txSize > 0 && (sats / txSize) >= minRelaySatPerVbyte,
-  };
+  /// True when this fee is at or above the relay floor. The floor defaults
+  /// to the static [minRelaySatPerKwu] (0.1 sat/vByte) but callers SHOULD
+  /// pass [floorSatPerKwu] from the live mempool `minimumFee`
+  /// ([FeeOptions.minRelay]) so the gate tracks the network's current
+  /// minimum during congestion — never below the static 0.1 safety floor,
+  /// since [MempoolFeesMapper] takes `max(minimumFee, 0.1)`.
+  ///
+  /// Absolute fees need a [txSize] to express as a rate; [txSize] ≤ 0 →
+  /// false (the caller is in a transient pre-build state and shouldn't be
+  /// allowed to commit yet). The absolute comparison is done in sat/kwu
+  /// space (`sats * 250 ≥ floor * txSize`) to avoid float rounding.
+  bool aboveMinRelay({int? txSize, int? floorSatPerKwu}) {
+    final floor = floorSatPerKwu ?? minRelaySatPerKwu;
+    return switch (this) {
+      RelativeFee(:final satPerKwu) => satPerKwu >= floor,
+      AbsoluteFee(:final sats) =>
+        txSize != null && txSize > 0 && (sats * 250) >= (floor * txSize),
+    };
+  }
 }
 
 @freezed
@@ -122,13 +132,21 @@ abstract class FeeOptions with _$FeeOptions {
     required NetworkFee fastest,
     required NetworkFee economic,
     required NetworkFee slow,
+
+    /// The network's current relay floor as a rate — mempool's `minimumFee`
+    /// clamped up to the static 0.1 sat/vByte safety floor. Validation gates
+    /// (custom-fee field, commit gates) reject anything below this so the app
+    /// never builds a tx the network won't relay, even during congestion when
+    /// `minimumFee` rises above 0.1. A pure rate, never converted to absolute.
+    required RelativeFee minRelay,
   }) = _FeeOptions;
   const FeeOptions._();
 
   FeeOptions toAbsolute(int vsize) => FeeOptions(
     fastest: fastest.toAbsolute(vsize),
     economic: economic.toAbsolute(vsize),
     slow: slow.toAbsolute(vsize),
+    minRelay: minRelay,
   );
 
   FeeOptions toRelative(int vsize) {
@@ -144,6 +162,7 @@ abstract class FeeOptions with _$FeeOptions {
       fastest: asRelative(fastest),
       economic: asRelative(economic),
       slow: asRelative(slow),
+      minRelay: minRelay,
     );
   }
 }

lib/core/widgets/fees/custom_fee_list_item.dart

@@ -50,6 +50,7 @@ class CustomFeeListItem extends StatefulWidget {
     required this.unselectedIconColor,
     required this.onCommit,
     this.onArm,
+    this.onDisarm,
     this.onPreview,
     this.previewFeeSat,
     this.previewLoading = false,
@@ -102,6 +103,13 @@ class CustomFeeListItem extends StatefulWidget {
   /// Idempotent on the caller side. Ignored in RBF mode.
   final void Function(NetworkFee fee)? onArm;
 
+  /// Modal mode only. Called when the field is cleared without a valid
+  /// replacement — the abs/rel toggle is flipped (resets the input) or the
+  /// text is emptied/invalid. Rolls back any armed custom selection so a
+  /// stale pre-clear value can't be committed when the sheet is dismissed.
+  /// Ignored in RBF mode (nothing is armed there).
+  final VoidCallback? onDisarm;
+
   /// When false, hide the absolute/relative toggle. Input is treated as
   /// relative (sat/vByte) only. RBF passes false — its fee API is
   /// rate-only.
@@ -239,6 +247,11 @@ class _CustomFeeListItemState extends State<CustomFeeListItem> {
     setState(() => _isAbsolute = newValue);
     _controller.clear();
     _customFee = null;
+    _previewDebounce?.cancel();
+    // The field reset to empty — drop any armed custom selection so a stale
+    // pre-toggle value can't be committed on dismissal (modal mode only;
+    // RBF commits per-keystroke and has nothing armed).
+    if (!widget.commitOnChange) widget.onDisarm?.call();
   }
 
   void _onValueChanged(String text) {
@@ -255,7 +268,12 @@ class _CustomFeeListItemState extends State<CustomFeeListItem> {
         // the user why nothing's getting committed; modal-mode does
         // the same gating in [SendCubit.finalizeArmedCustomFee] /
         // [TransferBloc._onCustomFeeFinalized] via aboveMinRelay.
-        if (!fee.aboveMinRelay(txSize: widget.txSize)) return;
+        if (!fee.aboveMinRelay(
+          txSize: widget.txSize,
+          floorSatPerKwu: widget.feePresets?.minRelay.satPerKwu,
+        )) {
+          return;
+        }
         widget.onCommit(fee);
       } else {
         // Modal mode: arm immediately for visual selection (cheap —
@@ -273,6 +291,9 @@ class _CustomFeeListItemState extends State<CustomFeeListItem> {
     } else {
       setState(() => _customFee = null);
       _previewDebounce?.cancel();
+      // Empty/invalid input — disarm so dismissal rolls back to the prior
+      // selection instead of committing the last valid armed value.
+      if (!widget.commitOnChange) widget.onDisarm?.call();
     }
   }
 
@@ -333,22 +354,25 @@ class _CustomFeeListItemState extends State<CustomFeeListItem> {
             economicKwu == null ||
             slowKwu == null)
         ? ''
-        : 'Estimated delivery ~ ${customKwu >= fastestKwu
+        : '${context.loc.sendEstimatedDelivery}${customKwu >= fastestKwu
               ? context.loc.sendEstimatedDelivery10Minutes
               : customKwu >= economicKwu
               ? context.loc.sendEstimatedDelivery10to30Minutes
               : customKwu >= slowKwu
               ? context.loc.sendEstimatedDeliveryHours
               : context.loc.sendEstimatedDeliveryHoursToDays}';
 
-    // Fee-rate guards. Single source for the floor is
-    // NetworkFeeRelayPolicy.minRelaySatPerVbyte (= 0.1, Bitcoin Core's
-    // lowest sensible policy and Liquid's minrelayfee). Below 1 sat/vByte
-    // we still warn the tx may take longer to confirm and may not
-    // propagate to every node.
-    final bool belowFloor =
-        customRate != null &&
-        customRate < NetworkFeeRelayPolicy.minRelaySatPerVbyte;
+    // Fee-rate guards. The floor is the live network minimum carried by
+    // [FeeOptions.minRelay] (mempool's `minimumFee` clamped up to the static
+    // 0.1 sat/vByte safety floor), so under congestion the field rejects
+    // rates the network won't relay even though they clear the 0.1 constant.
+    // Falls back to the static 0.1 when no presets are loaded yet (e.g. RBF).
+    // Below 1 sat/vByte (but at/above the floor) we still warn the tx may
+    // take longer to confirm and may not propagate to every node.
+    final double floorSatPerVbyte =
+        feeOptions?.minRelay.satPerVbyte ??
+        NetworkFeeRelayPolicy.minRelaySatPerVbyte;
+    final bool belowFloor = customRate != null && customRate < floorSatPerVbyte;
     final bool subOneSatPerVbyte =
         customRate != null && customRate < 1.0 && !belowFloor;
 

lib/core/widgets/fees/fee_modal_controller.dart

@@ -56,6 +56,12 @@ abstract class FeeModalActions {
   /// dismisses without typing a valid value.
   void armCustomFee(NetworkFee fee);
 
+  /// Rolls back an active arm to the pre-arm selection immediately —
+  /// dispatched by the custom-fee field when it's cleared (abs/rel toggle
+  /// flipped or text emptied) so a stale armed value can't survive to
+  /// dismissal. No-op when nothing is armed.
+  void disarmCustomFee();
+
   /// Called on modal dismissal. Commits the typed value (rebuilding
   /// the tx) when it clears `NetworkFeeRelayPolicy.minRelay`;
   /// otherwise rolls back to the pre-arm selection.

lib/core/widgets/fees/fee_options_modal.dart

@@ -126,6 +126,7 @@ class _FeeOptionsModalState extends State<FeeOptionsModal> {
                     previewLoading: snapshot.feePreviewCache.customLoading,
                     focusNode: _customFeeNode,
                     onArm: widget.actions.armCustomFee,
+                    onDisarm: widget.actions.disarmCustomFee,
                     onPreview: widget.actions.requestCustomFeePreview,
                     // Modal mode: the parent screen runs
                     // [FeeModalActions.finalizeArmedCustomFee] on
@@ -157,6 +158,7 @@ class _PresetList extends StatelessWidget {
     // (pre-existing l10n debt).
     final items = [
       _presetItem(
+        context: context,
         title: FeeSelection.fastest.title(),
         description: context.loc.sendEstimatedDelivery10Minutes,
         rate: snapshot.feePresets?.fastest,
@@ -166,6 +168,7 @@ class _PresetList extends StatelessWidget {
         fiatCurrencyCode: snapshot.fiatCurrencyCode,
       ),
       _presetItem(
+        context: context,
         title: FeeSelection.economic.title(),
         description: context.loc.sendEstimatedDelivery10to30Minutes,
         rate: snapshot.feePresets?.economic,
@@ -175,6 +178,7 @@ class _PresetList extends StatelessWidget {
         fiatCurrencyCode: snapshot.fiatCurrencyCode,
       ),
       _presetItem(
+        context: context,
         title: FeeSelection.slow.title(),
         description: context.loc.sendEstimatedDeliveryHours,
         rate: snapshot.feePresets?.slow,
@@ -195,6 +199,7 @@ class _PresetList extends StatelessWidget {
 /// hold a fee yet, [SelectableListItem.isSubtitle2Loading] is true so
 /// the row renders a shimmer instead of an empty subtitle.
 SelectableListItem _presetItem({
+  required BuildContext context,
   required String title,
   required String description,
   required NetworkFee? rate,
@@ -212,7 +217,7 @@ SelectableListItem _presetItem({
       isSubtitle2Loading: true,
     );
   }
-  final rateLabel = '${rate.value} sats/vB';
+  final rateLabel = '${rate.value} ${context.loc.sendSatsPerVB}';
   final previewFeeSat = slot.feeSat;
   if (previewFeeSat == null) {
     return SelectableListItem(
@@ -232,7 +237,8 @@ SelectableListItem _presetItem({
     title: title,
     subtitle1: description,
     subtitle2:
-        '$rateLabel ~ ${FormatAmount.satsApprox(previewFeeSat)} sats$fiatPart',
+        '$rateLabel ~ ${FormatAmount.satsApprox(previewFeeSat)} '
+        '${context.loc.sendSats}$fiatPart',
   );
 }
 

lib/features/send/presentation/bloc/send_cubit.dart

@@ -1278,6 +1278,7 @@ class SendCubit extends Cubit<SendState>
   /// Rolls back `selectedFeeOption` and `customFee` to the values snapshotted
   /// by [armCustomFee], if the arm is still active. No-op once cleared
   /// (the user picked a preset, which fires [feeOptionSelected]).
+  @override
   void disarmCustomFee() {
     if (state.armPriorSelection == null) return;
     emit(
@@ -1303,7 +1304,11 @@ class SendCubit extends Cubit<SendState>
     if (state.armPriorSelection == null) return;
     final fee = state.customFee;
     final txSize = state.bitcoinTxSize ?? 140;
-    if (fee != null && fee.aboveMinRelay(txSize: txSize)) {
+    if (fee != null &&
+        fee.aboveMinRelay(
+          txSize: txSize,
+          floorSatPerKwu: state.bitcoinFeesList?.minRelay.satPerKwu,
+        )) {
       await customFeesChanged(fee);
     } else {
       disarmCustomFee();
@@ -1635,7 +1640,11 @@ class SendCubit extends Cubit<SendState>
             ? (
                 unsignedPsbt: cachedSlot.unsignedPsbt!,
                 txSize: cachedSlot.txSize!,
-                isToSelf: false,
+                // The cached PSBT was built for the same address, so the
+                // to-self determination is invariant — preserve it rather
+                // than dropping it to false (which would flip the "to self"
+                // badge and mis-gate payjoin on a self-send).
+                isToSelf: state.isToSelf ?? false,
               )
             : await _prepareBitcoinSendUsecase.execute(
                 walletId: state.selectedWallet!.id,