fix(rpc): isolate circuit breaker per chain+host

The RPC provider circuit name was derived from the RPS-limiter key, which is empty when the limiter is disabled (e.g. the smart proxy). An empty circuit name makes the circuit breaker execute the provider directly without a circuit, so a provider that consistently fails for a given chain (e.g. a proxy with no backend for that chain) keeps being retried on every request instead of being short-circuited to the fallback.

Always derive a non-empty circuit name isolated per chain+host so the breaker can open for a consistently failing endpoint without affecting other chains that share the same host. The RPS limiter remains intentionally shared per host.

Author: friofry

internal/rpc/client.go

@@ -234,23 +234,31 @@ func (c *Client) getClientUsingCache(chainID uint64) (chain.ClientInterface, err
 	return client, nil
 }
 
+// getProviderRPCLimiter returns the (optional) RPS limiter for the provider and the circuit
+// name to use for the circuit breaker.
+// The circuit name is always non-empty and isolated per chain+host, so the circuit breaker can
+// short-circuit a consistently failing endpoint without affecting other chains that share the
+// same host (e.g. the smart proxy). The RPS limiter, in contrast, is intentionally shared per
+// host so we throttle the whole host regardless of chain.
 func (c *Client) getProviderRPCLimiter(provider params.RpcProvider) (*rpclimiter.RPCRpsLimiter, string, error) {
+	circuitName := fmt.Sprintf("%s-%d", provider.GetHost(), provider.ChainID)
+
 	c.rpsLimiterMutex.Lock()
 	defer c.rpsLimiterMutex.Unlock()
 	if !provider.EnableRPSLimiter {
-		return nil, "", nil
+		return nil, circuitName, nil
 	}
-	// Generate a unique key for the provider based on its host
+	// Generate a unique key for the limiter based on its host (shared across chains)
 	limiterKey := provider.GetHost()
 
 	// Check if the limiter already exists
 	if limiter, ok := c.limiterPerProvider[limiterKey]; ok {
-		return limiter, limiterKey, nil
+		return limiter, circuitName, nil
 	}
 
 	limiter := rpclimiter.NewRPCRpsLimiter(&c.PauseBroadcaster)
 	c.limiterPerProvider[limiterKey] = limiter
-	return limiter, limiterKey, nil
+	return limiter, circuitName, nil
 }
 
 // SetPaused stops/resumes the 1s tickers of every RPC rate limiter owned by this Client.
@@ -282,14 +290,14 @@ func (c *Client) getEthClients(network *params.Network) []ethclient.RPSLimitedEt
 			continue
 		}
 
-		rpcLimiter, limiterKey, err := c.getProviderRPCLimiter(provider)
+		rpcLimiter, circuitName, err := c.getProviderRPCLimiter(provider)
 		if err != nil {
 			c.logger.Error("get RPC limiter failed", zap.String("provider", provider.Name), zap.Error(err))
 			continue
 		}
 
 		// Create ethclient with RPS limiter. If limiter is not enabled, it will be nil
-		ethClient := ethclient.NewRPSLimitedEthClient(rpcClient, rpcLimiter, limiterKey, provider.Name)
+		ethClient := ethclient.NewRPSLimitedEthClient(rpcClient, rpcLimiter, circuitName, provider.Name)
 		ethClients = append(ethClients, ethClient)
 	}
 

internal/rpc/client_test.go

@@ -19,6 +19,7 @@ import (
 	"github.com/ethereum/go-ethereum/common"
 
 	"github.com/status-im/status-go/internal/db/appdatabase"
+	"github.com/status-im/status-go/internal/rpc/chain/rpclimiter"
 	"github.com/status-im/status-go/internal/testutils"
 	"github.com/status-im/status-go/params"
 	"github.com/status-im/status-go/params/networkhelper"
@@ -120,3 +121,52 @@ func TestGetClientsUsingCache(t *testing.T) {
 func TestUserAgent(t *testing.T) {
 	require.True(t, strings.HasPrefix(rpcUserAgentName, "procuratee-desktop/"))
 }
+
+func TestGetProviderRPCLimiterCircuitName(t *testing.T) {
+	const host = "test.eth-rpc.status.im"
+
+	newProvider := func(chainID uint64, rpsLimiter bool) params.RpcProvider {
+		return params.RpcProvider{
+			Name:             "smart-proxy",
+			ChainID:          chainID,
+			URL:              security.NewSensitiveString(fmt.Sprintf("https://%s/ethereum/mainnet/", host)),
+			Type:             params.EmbeddedEthRpcProxyProviderType,
+			AuthType:         params.NoAuth,
+			EnableRPSLimiter: rpsLimiter,
+			Enabled:          true,
+		}
+	}
+
+	c := &Client{limiterPerProvider: make(map[string]*rpclimiter.RPCRpsLimiter)}
+
+	// Circuit name must be non-empty even when the RPS limiter is disabled, so the
+	// circuit breaker can short-circuit a consistently failing provider.
+	limiter, circuitChain1, err := c.getProviderRPCLimiter(newProvider(1, false))
+	require.NoError(t, err)
+	require.Nil(t, limiter)
+	require.Equal(t, fmt.Sprintf("%s-%d", host, 1), circuitChain1)
+
+	// Same host but a different chain must yield a different circuit name, so a provider
+	// that fails for one chain does not open the circuit for other chains sharing the host.
+	limiter, circuitChain747474, err := c.getProviderRPCLimiter(newProvider(747474, false))
+	require.NoError(t, err)
+	require.Nil(t, limiter)
+	require.Equal(t, fmt.Sprintf("%s-%d", host, 747474), circuitChain747474)
+	require.NotEqual(t, circuitChain1, circuitChain747474)
+
+	// With the RPS limiter enabled, the circuit name is still isolated per chain+host,
+	// while the limiter itself is shared per host across chains.
+	limiterChain1, circuitChain1Rps, err := c.getProviderRPCLimiter(newProvider(1, true))
+	require.NoError(t, err)
+	require.NotNil(t, limiterChain1)
+	require.Equal(t, fmt.Sprintf("%s-%d", host, 1), circuitChain1Rps)
+
+	limiterChain2, circuitChain2Rps, err := c.getProviderRPCLimiter(newProvider(2, true))
+	require.NoError(t, err)
+	require.NotNil(t, limiterChain2)
+	require.Equal(t, fmt.Sprintf("%s-%d", host, 2), circuitChain2Rps)
+	require.NotEqual(t, circuitChain1Rps, circuitChain2Rps)
+
+	// Limiter is shared per host regardless of chain.
+	require.Same(t, limiterChain1, limiterChain2)
+}