Recover failed Axelar confirms from the funding account when the relayer fails

[ebma]

Stacked on #1406 (its 3 commits appear here until it merges). Merge #1406 first.

Why

recoverAxelarStuckConfirm depends on Axelar's public signing relayer. The relayer keeps signing ConfirmGatewayTx one account sequence behind the chain: 53011 vs 53012 in September, and 53019 vs 53020 on 2026-10-06. Every broadcast is rejected with code 32, and the Axelarscan "confirm" button fails the same way.

ConfirmGatewayTxsRequest is ROLE_UNRESTRICTED in axelar-core v1.5.3, so any funded Axelar account can restart the poll. On 2026-10-06, a confirm sent from our own Axelar account recovered 0x9813…8ff7: Axelar tx EAA8FE9D…87E3, after which the call was approved and executed. This PR makes the backend do that by itself.

What changes

• maybeRecoverStuckConfirm tries the relayer first, as before. If the relayer fails (except on abort), the same attempt falls back to confirmGatewayTxFromFundingAccount.
• confirmGatewayTxFromFundingAccount (squid-router-swap/axelar-confirm.ts) signs with EVM_FUNDING_PRIVATE_KEY. That secp256k1 key also controls an axelar1… account. The function:
  • simulates and pays 1.5× the simulated gas at 0.007 uaxl (about 0.027 AXL);
  • refuses to broadcast if the account can't pay, with an error naming the axelar1… address to fund, which shows up in the stuck-GMP Slack alert;
  • re-checks the abort before broadcasting;
  • serializes signing within each process;
  • waits for the tx to be included and treats a non-zero code as a failure.
• The existing 10-minute axelarConfirmRecoveryAt cooldown covers both attempts, so spending is capped at one confirm per stuck ramp per cooldown.
• The Axelar message is hand-encoded (3 protobuf fields). Only @cosmjs/proto-signing, @cosmjs/stargate and cosmjs-types are added, in apps/api only.
• The manual script from the first revision of this PR is removed.
• The security spec's confirm-poll row describes the fallback, its key use and its blast radius.

Before deploying

Send a few AXL, on the native Axelar network, to the funding key's axelar1… address. It differs from the EVM address 0xEC733…33e2. If it's unfunded, the first fallback attempt fails and the alert names the address.

Tests

• Encoder: byte-identical to the message in mainnet tx A2D28977…41B6 (code 0).
• Real CosmJS signing under Bun: decoding the signed tx gives back the message, sequence and a 64-byte signature.
• confirmGatewayTxFromFundingAccount with a mocked client:
  • correct sender, message and fee (27,096 uaxl, matching the real recovery);
  • refuses when the balance is short by 1 uaxl;
  • rejects on code 32;
  • does nothing when aborted.
• Executor:
  • relayer success → no fallback;
  • relayer code 32 → funding-account confirm under the same cooldown;
  • both failures are reported;
  • no fallback once aborted.
    The two new executor tests fail without the change.
• bun test squid axelar (api): 40 pass, 0 fail, 2 skipped; tsc clean.

[netlify]

✅ Deploy Preview for vortexfi canceled.

Name	Link
🔨 Latest commit	2212a26
🔍 Latest deploy log	https://app.netlify.com/projects/vortexfi/deploys/6ac6059615bfc3000859cb9b

[netlify]

✅ Deploy Preview for vortex-sandbox ready!

Name	Link
🔨 Latest commit	2212a26
🔍 Latest deploy log	https://app.netlify.com/projects/vortex-sandbox/deploys/6ac605963ed71900083b191f
😎 Deploy Preview	https://deploy-preview-1407--vortex-sandbox.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[netlify]

✅ Deploy Preview for vrtx-dashboard canceled.

Name	Link
🔨 Latest commit	2212a26
🔍 Latest deploy log	https://app.netlify.com/projects/vrtx-dashboard/deploys/6ac6059731030600087a8b2f