fix(swap): instrument bridge quote after intent verification (#752)

instrumentBridgeQuote ran before verifyLifiBridgeIntent in the bridge
branch of prepareSwap, contradicting design §4.2 step 6. A bridge route
later REFUSEd by verifyLifiBridgeIntent (destination chain or receiver
mismatch) still incremented lifiBridgeSuspectedUnreachableCount, mildly
inflating the exact metric PROD condition 2 uses to promote #745.

Move the instrumentBridgeQuote call to after verifyLifiBridgeIntent,
still gated on swapClass === "bridge".

Author: graciangabriel8

src/modules/swap/index.ts

@@ -999,11 +999,11 @@ export async function prepareSwap(args: PrepareSwapArgs): Promise<UnsignedTx> {
   const sourceTokenAddr = quote.action.fromToken.address as string;
   const swapClass = classifyLifiQuote(firstData as `0x${string}`);
   if (swapClass === "bridge") {
-    // Status-quo bridge flow, now instrumented (read-only, never REFUSEs).
-    instrumentBridgeQuote(quote as unknown as LifiQuoteLike, sourceTokenAddr, {
-      fromChain: args.fromChain,
-      toChain: args.toChain,
-    });
+    // Status-quo bridge flow. Instrumentation is deferred to AFTER
+    // verifyLifiBridgeIntent below (design §4.2 step 6) so a route that
+    // guard REFUSEs is never counted toward lifiBridgeSuspectedUnreachableCount
+    // — that counter feeds PROD condition 2's promotion of #745, and counting
+    // an already-refused quote would inflate it. See #752.
   } else if (swapClass === "generic") {
     const v1 = vetGenericSwapQuote(quote as unknown as LifiQuoteLike, sourceTokenAddr);
     if (v1.kind === "REFUSE") {
@@ -1071,6 +1071,16 @@ export async function prepareSwap(args: PrepareSwapArgs): Promise<UnsignedTx> {
   // there — no false positives on the existing same-chain swap path.
   verifyLifiBridgeIntent(args, txRequest.data as `0x${string}`);
 
+  if (swapClass === "bridge") {
+    // Bridge-class instrumentation (read-only, never REFUSEs), now placed
+    // AFTER verifyLifiBridgeIntent so a route that guard REFUSEs never
+    // reaches here — see #752.
+    instrumentBridgeQuote(quote as unknown as LifiQuoteLike, sourceTokenAddr, {
+      fromChain: args.fromChain,
+      toChain: args.toChain,
+    });
+  }
+
   // Cross-check LiFi's reported token decimals against on-chain reads. A mismatch
   // would mean either LiFi has stale metadata or the route targets a token different
   // from what we asked for — in either case, the formatted expectedOut/minOut shown

test/swap-lifi-minout.test.ts

@@ -524,6 +524,42 @@ describe("#685 T6 — bridge with source-side skim SHIPS status quo + fires the
   });
 });
 
+describe("#752 — bridge instrumentation runs AFTER verifyLifiBridgeIntent", () => {
+  it("does not increment the counter when the bridge guard REFUSEs on a receiver mismatch", async () => {
+    const swap = await import("../src/modules/swap/index.js");
+    swap.resetLifiBridgeSuspectedUnreachableCount();
+
+    const gross = 15_000_000_000n;
+    const ATTACKER = "0x9999999999999999999999999999999999999999" as `0x${string}`;
+    // Same source-side skim shape as T6's first case — bridgeSuspectedUnreachable
+    // would flag this quote if instrumentation ran before the guard below fires.
+    const q = makeBridgeQuote({
+      fromAmount: gross,
+      toAmount: 15_000_000_000_000_000_000_000n,
+      minAmount: gross, // exceeds the post-skim 14,962.5 USDC
+      feeCosts: [
+        {
+          name: "integrator fee",
+          token: { address: ETH_USDC, symbol: "USDC", decimals: 6, priceUSD: "1" },
+          amount: "37500000",
+          included: true,
+        },
+      ],
+      // != bridgeArgs.wallet — verifyLifiBridgeIntent's #798 receiver check REFUSEs.
+      receiver: ATTACKER,
+    });
+    fetchQuoteMock.mockResolvedValueOnce(q);
+
+    await expect(swap.prepareSwap(bridgeArgs)).rejects.toThrow(/receiver mismatch/);
+    // #752 — instrumentation is placed after verifyLifiBridgeIntent, so a route
+    // the guard REFUSEs must never be counted toward
+    // lifiBridgeSuspectedUnreachableCount (the exact metric PROD condition 2 uses
+    // to promote #745). On unfixed code (instrumentBridgeQuote called before the
+    // guard) this would already be 1 here.
+    expect(swap.lifiBridgeSuspectedUnreachableCount).toBe(0);
+  });
+});
+
 describe("#685 — fixture-replay tally (classifier + gate + bridge signal)", () => {
   it("classifies and gates representative fixtures with the expected tally", () => {
     const gross = 15_000_000_000n;