Skip to content

bug: incorrect swap index in bubble-down loop in select_messages_to_republish #7075

@akaladarshi

Description

@akaladarshi

Summary

In src/message_pool/msgpool/republish.rs, the bubble-down loop inside
select_messages_to_republish compares chains[j] vs chains[j + 1]
but swaps using hardcoded indices i and i + 1 instead of j and
j + 1. This means the trimmed chain never bubbles past the first slot —
it toggles back and forth between positions i and i + 1 on each
iteration, leaving chains incorrectly ordered after a trim.

Affected code

// src/message_pool/msgpool/republish.rs
let mut j = i;
while j < chains.len() - 1 {
    #[allow(clippy::indexing_slicing)]
    if chains[j].compare(&chains[j + 1]) == Ordering::Less {
        break;
    }
    chains.key_vec.swap(i, i + 1);  // ← bug: should be swap(j, j + 1)
    j += 1;
}

Expected fix

chains.key_vec.swap(j, j + 1);

Impact

After trimming an over-gas chain, the chain is supposed to be pushed down
(re-sorted) by bubbling it toward its correct position. With
swap(i, i + 1), only the first two elements ever exchange, so the
ordering invariant is not restored and lower-priority chains may be
processed before higher-priority ones in subsequent iterations of the
outer loop.

References

Metadata

Metadata

Assignees

Labels

Type: BugSomething isn't working

Type

No type
No fields configured for issues without a type.

Projects

Status
Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions