Callbacks can fail

• Only the callback’s own state changes are reverted. Anything the original method already committed, such as a credited balance, a mint, or a lock, stays.
• Promises the callback would have created, such as refunds, are never scheduled.
• The callback is not retried.
• If another contract is waiting on the callback’s result, it sees a failure.

​

Why a callback can fail

​

Out of gas

• Input size. Copying a promise result into memory and parsing it costs gas per byte, and a contract can return up to 4 MiB. The same applies to arguments built from user input.
• State size. Storage writes and removes get more expensive as your contract’s state grows. Users add to that state, so a write can cost more in production than in your tests.
• Collection internals. Some operations touch more than one entry. For example, IterableMap::remove and IterableSet::remove in near_sdk::store move the last entry into the freed slot.
• Loops over anything whose length a user controls.

​

Panics

​

Runtime limits

• Logs: at most 100 logs and 16 KiB in total per call. A panic message counts toward the 16 KiB.
• Storage proof: one receipt can touch at most about 4 MB of state.
• Storage keys and values: at most 2 KiB per key and 4 MiB per value.
• Storage staking: the contract must hold enough balance to cover any state the callback adds. See storage staking.

​

Contract changes

​

Designing for failure

​

Commit state after the outcome is known

pub fn deposit(&mut self, amount: U128) -> Promise {
    // Don't credit here: if the callback fails, the credit would stay.
    ext_vault::ext(self.vault.clone())
        .lock(env::predecessor_account_id(), amount)
        .then(Self::ext(env::current_account_id()).resolve_deposit(env::predecessor_account_id(), amount))
}

#[private]
pub fn resolve_deposit(
    &mut self,
    user: AccountId,
    amount: U128,
    #[callback_result] result: Result<(), PromiseError>,
) {
    if result.is_ok() {
        self.credit(&user, amount.0);
    }
}

​

Keep callbacks small and bounded

• Do only the work needed to settle the operation.
• Cap batch sizes and input lengths in the method that schedules the call.
• Keep logs short and fixed in size.
• Check the size of a result from an untrusted contract before you copy or parse it, and treat anything unexpected as a failure instead of panicking:

// Longest valid response: a JSON-quoted u128 fits easily.
const MAX_RESULT_LEN: usize = 64;

#[private]
pub fn resolve_transfer(&mut self, sender: AccountId, amount: U128) -> U128 {
    // Failed, oversized, or malformed result: refund the full amount.
    let unused = match env::promise_result_checked(0, MAX_RESULT_LEN) {
        Ok(bytes) => serde_json::from_slice::<U128>(&bytes)
            .map(|v| v.0.min(amount.0))
            .unwrap_or(amount.0),
        Err(_) => amount.0,
    };
    // ... settle `unused` for `sender` without panicking ...
    U128(unused)
}

​

Give the callback plenty of gas

​

Monitor failed callbacks

​

Test the failure path