fix(cctp): mint on Stellar ourselves, because nobody else will

[0xdevcollins]

The last leg. A payment reached complete attestation and stopped: status PROCESSING, no destination hash, merchant unpaid.

What was happening

observe() treated Iris's forwardTxHash as its finality signal and had no other route to a mint. For Stellar that hash never arrives. Iris returns only attestation, message, eventNonce, status, cctpVersion and delayReason for this route — there is no Circle-operated relay watching it.

Meanwhile the destination contract is wide open:

fn mint_and_forward(env: Env, message: Bytes, attestation: Bytes);

No authorisation argument. Anyone may submit an attested message, and the contract forwards the USDC to the recipient encoded in the burn's hookData.

So the mint was permissionless and unclaimed, and we were sitting waiting to be told it had happened.

Everything else checked out, which is what took the time to establish: the burn's mintRecipient decodes to CA66Q2WF…T4VSZ, exactly the configured testnet cctpForwarder, and its hookData carries the merchant's G… address.

The fix

observe() now submits the mint when the destination is Stellar and no forwardTxHash came back. submitMintViaForwarder already existed — written as a "fallback if Circle is degraded", never called.

The relay wallet pays the Soroban fee and nothing else; the USDC comes out of the attested message, so it never holds funds.

Two things make the retry safe:

• is_nonce_used is checked first. The worker retries, and mint_and_forward rejects a message it has already consumed — without the check, a successful mint would be indistinguishable from a broken one on the next attempt, and the payment would be marked FAILED after the money arrived. Read-only simulation, costs nothing.
• A failed submit returns undefined rather than throwing. Un-minted is a better state than failed: the next attempt can still settle it.

Verified end to end

Settled the stuck payment through this exact code path:

is_nonce_used  → false
mint submitted → b94b0d00a4af5850baad991a1de062c7695434ee28f27688b7a68ac889df7629  (successful, ledger 4059308)
merchant USDC  → 20.0000000 → 20.0100000
is_nonce_used  → true

Tests: 322 (+5) — mints when Circle hasn't, defers when it has, skips an already-consumed message, survives a failed submit, and won't attempt a mint with no message. 0 lint errors.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
useroutr-www	Ready	Preview	Aug 9, 2026 11:20pm