fix: prevent incorrect contract closure from mempool-only splice txs

Three fixes for splice contracts whose fund tx enters the mempool but is
never mined:

1. check_for_spliced_contract: only pre-close the old contract when the
   splice fund tx has real on-chain confirmations, not just mempool
   presence.

2. check_preclosed_contract: for splice pre-closes (no attestations),
   require at least 1 confirmation before moving to Closed. Revert
   splice pre-closes to Confirmed when the closing tx has 0
   confirmations. CET closes (with attestations) use the configured
   NB_CONFIRMATIONS threshold unchanged.

3. recover_incorrectly_closed_contracts: new periodic check that finds
   splice-closed contracts (no attestations) whose closing tx is not
   on-chain and reverts them to Confirmed.

Author: matthewjablack

ddk-manager/src/manager.rs

@@ -535,6 +535,7 @@ where
         self.check_signed_contracts(&signed_contracts).await?;
         self.check_confirmed_contracts().await?;
         self.check_preclosed_contracts().await?;
+        self.recover_incorrectly_closed_contracts().await?;
 
         if check_channels {
             self.channel_checks().await?;
@@ -890,6 +891,29 @@ where
 
             let contract_id = funding_input.dlc_input.as_ref().unwrap().contract_id;
 
+            // Only pre-close the old contract when the splice fund tx is
+            // actually confirmed on-chain. A Signed splice contract may have
+            // a fund tx that is still in the mempool or was dropped entirely.
+            let splice_fund_txid = contract
+                .accepted_contract
+                .dlc_transactions
+                .fund
+                .compute_txid();
+            let splice_confirmations = self
+                .blockchain
+                .get_transaction_confirmations(&splice_fund_txid)
+                .await
+                .unwrap_or(0);
+            if splice_confirmations == 0 {
+                log_debug!(
+                    self.logger,
+                    "Splice fund tx not yet confirmed, skipping pre-close of previous contract. splice_fund_txid={} contract_id={}",
+                    splice_fund_txid,
+                    contract_id.to_lower_hex_string(),
+                );
+                continue;
+            }
+
             let confirmed_contract_in_splice = match get_contract_in_state!(
                 self,
                 &contract_id,
@@ -899,14 +923,14 @@ where
                 Ok(c) => Ok(c),
                 Err(Error::InvalidState(e)) => {
                     log_trace!(self.logger,
-                        "The previouse contract referenced in a splice transaction is in an unexpected state. contract_id={} error={}", 
+                        "The previouse contract referenced in a splice transaction is in an unexpected state. contract_id={} error={}",
                         contract_id.to_lower_hex_string(), e.to_string(),
                     );
                     continue;
                 }
                 Err(e) => {
                     log_debug!(self.logger,
-                        "The previouse contract referenced in a splice transaction failed to retrieve. contract_id={} error={}", 
+                        "The previouse contract referenced in a splice transaction failed to retrieve. contract_id={} error={}",
                         contract_id.to_lower_hex_string(), e.to_string(),
                     );
                     Err(e)
@@ -920,8 +944,9 @@ where
             };
 
             log_debug!(self.logger,
-                "The previous contract that was spliced is now closed because the splice contract is confirmed. contract_id={}", 
+                "The previous contract that was spliced is now closed because the splice contract is confirmed. contract_id={} splice_fund_txid={}",
                 contract_id.to_lower_hex_string(),
+                splice_fund_txid,
             );
 
             self.store
@@ -1303,7 +1328,8 @@ where
         let confirmations = self
             .blockchain
             .get_transaction_confirmations(&broadcasted_txid)
-            .await?;
+            .await
+            .unwrap_or(0);
         log_debug!(
             self.logger,
             "Checking pre-closed contract. broadcasted_txid={} contract_id={} confirmations={}",
@@ -1314,9 +1340,21 @@ where
                 .get_contract_id_string(),
             confirmations
         );
-        if confirmations >= *NB_CONFIRMATIONS {
+
+        let is_splice_close = contract.attestations.is_none();
+        // For splice pre-closes (no attestations), require at least 1 real
+        // confirmation. With NB_CONFIRMATIONS=0, esplora returns 0 for both
+        // mempool and dropped txs — a splice funding tx that was never mined
+        // would pass `0 >= 0` and incorrectly close the contract.
+        // CET closes (with attestations) use the configured threshold.
+        let required = if is_splice_close {
+            std::cmp::max(*NB_CONFIRMATIONS, 1)
+        } else {
+            *NB_CONFIRMATIONS
+        };
+        if confirmations >= required {
             log_debug!(self.logger,
-                "Pre-closed contract is fully confirmed. Moving to closed. broadcasted_txid={} contract_id={}", 
+                "Pre-closed contract is fully confirmed. Moving to closed. broadcasted_txid={} contract_id={}",
                 broadcasted_txid.to_string(),
                 contract.signed_contract.accepted_contract.get_contract_id_string()
             );
@@ -1351,11 +1389,61 @@ where
             self.store
                 .update_contract(&Contract::Closed(closed_contract))
                 .await?;
+        } else if is_splice_close && confirmations == 0 {
+            // Splice closing tx not confirmed — it may have been dropped from
+            // the mempool. Revert back to Confirmed so the contract can be
+            // used as a DLC input again.
+            log_info!(
+                self.logger,
+                "Pre-closed splice contract closing tx not confirmed, reverting to confirmed. broadcasted_txid={} contract_id={}",
+                broadcasted_txid.to_string(),
+                contract.signed_contract.accepted_contract.get_contract_id_string()
+            );
+            self.store
+                .update_contract(&Contract::Confirmed(contract.signed_contract.clone()))
+                .await?;
         }
 
         Ok(())
     }
 
+    /// Recover splice-closed contracts whose closing tx was never mined.
+    /// Only reverts contracts closed via splice (attestations is None) — CET
+    /// closes are legitimate even if the tx hasn't confirmed yet.
+    #[tracing::instrument(skip_all, level = "debug")]
+    async fn recover_incorrectly_closed_contracts(&self) -> Result<(), Error> {
+        let contracts = self.store.get_contracts().await?;
+        for contract in contracts {
+            let Contract::Closed(ref closed) = contract else {
+                continue;
+            };
+            if closed.attestations.is_some() {
+                continue;
+            }
+            let Some(ref cet) = closed.signed_cet else {
+                continue;
+            };
+            let txid = cet.compute_txid();
+            let confirmations = self
+                .blockchain
+                .get_transaction_confirmations(&txid)
+                .await
+                .unwrap_or(0);
+            if confirmations == 0 {
+                log_info!(
+                    self.logger,
+                    "Splice-closed contract closing tx not on-chain, reverting to confirmed. closing_txid={} contract_id={}",
+                    txid,
+                    closed.contract_id.to_lower_hex_string(),
+                );
+                self.store
+                    .update_contract(&Contract::Confirmed(closed.signed_contract.clone()))
+                    .await?;
+            }
+        }
+        Ok(())
+    }
+
     #[tracing::instrument(skip_all, level = "debug")]
     async fn close_contract(
         &self,