feat: add sim_cancelTransaction RPC endpoint with auth and UI

backend/consensus/base.py

@@ -1267,6 +1267,7 @@ async def exec_transaction(
                     TransactionStatus.ACCEPTED.value,
                     TransactionStatus.UNDETERMINED.value,
                     TransactionStatus.FINALIZED.value,
+                    TransactionStatus.CANCELED.value,
                     TransactionStatus.LEADER_TIMEOUT.value,
                     TransactionStatus.VALIDATORS_TIMEOUT.value,
                 ]

backend/database_handler/transactions_processor.py

@@ -748,6 +748,31 @@ def get_activated_transactions_older_than(self, seconds: int) -> list[dict]:
             for transaction in stuck_transactions
         ]
 
+    @staticmethod
+    def cancel_transaction_if_available(
+        session: Session, transaction_hash: str
+    ) -> bool:
+        """
+        Cancel a transaction only if it is still available to be cancelled.
+
+        Returns:
+            bool: True when the transaction was cancelled, False otherwise.
+        """
+        result = session.execute(
+            text(
+                """
+                UPDATE transactions
+                SET status = CAST('CANCELED' AS transaction_status)
+                WHERE hash = :hash
+                  AND status IN ('PENDING', 'ACTIVATED')
+                  AND blocked_at IS NULL
+                """
+            ),
+            {"hash": transaction_hash},
+        )
+        session.commit()
+        return result.rowcount > 0
+
     def update_transaction_status(
         self,
         transaction_hash: str,

backend/protocol_rpc/endpoints.py

@@ -684,6 +684,133 @@ def admin_upgrade_contract_code(
     }
 
 
+####### CANCEL TRANSACTION ENDPOINTS #######
+def cancel_transaction(
+    session: Session,
+    transaction_hash: str,
+    msg_handler,
+    signature: str | None = None,
+    admin_key: str | None = None,
+) -> dict:
+    """
+    Cancel a pending or activated transaction. Returns immediately with status.
+
+    Access control:
+    - Local (no env vars): open access
+    - Hosted/Self-hosted: admin_key allows ANY transaction, signature allows own transactions
+
+    Args:
+        session: Database session
+        transaction_hash: Hash of the transaction to cancel
+        msg_handler: Message handler for WebSocket notifications
+        signature: Hex-encoded signature from tx sender (required in hosted mode unless admin_key)
+        admin_key: Admin API key for full access to any transaction
+
+    Returns:
+        dict with transaction_hash and status
+    """
+    from backend.database_handler.models import Transactions
+    from eth_account.messages import encode_defunct
+    from eth_account import Account
+    from web3 import Web3
+    import os
+
+    # Validate transaction hash format
+    if (
+        not transaction_hash
+        or not transaction_hash.startswith("0x")
+        or len(transaction_hash) != 66
+    ):
+        raise JSONRPCError(
+            code=-32602,
+            message="Invalid transaction hash format",
+            data={},
+        )
+
+    # Look up the transaction
+    transaction = (
+        session.query(Transactions).filter_by(hash=transaction_hash).one_or_none()
+    )
+    if not transaction:
+        raise NotFoundError(
+            message="Transaction not found",
+            data={"transaction_hash": transaction_hash},
+        )
+
+    is_hosted = os.getenv("VITE_IS_HOSTED") == "true"
+    admin_api_key = os.getenv("ADMIN_API_KEY")
+
+    # Check if authorization is needed (hosted or self-hosted with key configured)
+    needs_auth = is_hosted or admin_api_key
+
+    if needs_auth:
+        # Option 1: Admin key grants full access to ANY transaction
+        if admin_api_key and admin_key == admin_api_key:
+            pass  # Authorized - proceed with cancel
+
+        # Option 2: Signature from tx sender grants access to own transactions
+        elif signature:
+            if not transaction.from_address:
+                raise JSONRPCError(
+                    code=-32000,
+                    message="Transaction has no sender - only admin key can cancel",
+                    data={},
+                )
+
+            try:
+                # Message: keccak256("cancel_transaction" + tx_hash_bytes)
+                # tx_hash is unique, so no nonce needed for replay protection
+                message_hash = Web3.keccak(
+                    b"cancel_transaction" + Web3.to_bytes(hexstr=transaction_hash)
+                )
+                message = encode_defunct(primitive=message_hash)
+                signer = Account.recover_message(message, signature=signature)
+
+                if signer.lower() != transaction.from_address.lower():
+                    raise JSONRPCError(
+                        code=-32000,
+                        message="Only transaction sender can cancel",
+                        data={"signer": signer, "sender": transaction.from_address},
+                    )
+            except JSONRPCError:
+                raise
+            except Exception as e:
+                raise JSONRPCError(
+                    code=-32000,
+                    message=f"Invalid signature: {e!s}",
+                    data={},
+                ) from e
+        else:
+            raise JSONRPCError(
+                code=-32000,
+                message="Cancel requires admin key or sender signature",
+                data={},
+            )
+
+    # Atomic cancel - only succeeds if tx is still pending/activated and not claimed by worker
+    was_cancelled = TransactionsProcessor.cancel_transaction_if_available(
+        session, transaction_hash
+    )
+
+    if not was_cancelled:
+        raise JSONRPCError(
+            code=-32000,
+            message="Transaction cannot be cancelled: already being processed or in a terminal state",
+            data={
+                "transaction_hash": transaction_hash,
+                "status": transaction.status.value,
+            },
+        )
+
+    # Notify frontend via WebSocket
+    msg_handler.send_transaction_status_update(transaction_hash, "CANCELED")
+
+    return {
+        "transaction_hash": transaction_hash,
+        "status": "CANCELED",
+    }
+
+
 ####### GEN ENDPOINTS #######
 async def get_contract_schema(
     accounts_manager: AccountsManager,

backend/protocol_rpc/rpc_methods.py

@@ -245,6 +245,23 @@ def upgrade_contract_code(
     )
 
 
+@rpc.method("sim_cancelTransaction")
+def cancel_transaction(
+    transaction_hash: str,
+    signature: str = None,
+    admin_key: str = None,
+    session: Session = Depends(get_db_session),
+    msg_handler=Depends(get_message_handler),
+) -> dict:
+    return impl.cancel_transaction(
+        session=session,
+        transaction_hash=transaction_hash,
+        msg_handler=msg_handler,
+        signature=signature,
+        admin_key=admin_key,
+    )
+
+
 @rpc.method("sim_getTransactionsForAddress", log_policy=LogPolicy.debug())
 def get_transactions_for_address(
     address: str,

frontend/src/components/Simulator/TransactionItem.vue

@@ -6,6 +6,7 @@ import { useTimeAgo } from '@vueuse/core';
 import ModalSection from '@/components/Simulator/ModalSection.vue';
 import JsonViewer from '@/components/JsonViewer/json-viewer.vue';
 import { useUIStore, useNodeStore, useTransactionsStore } from '@/stores';
+import { notify } from '@kyvg/vue3-notification';
 import {
   CheckCircleIcon,
   XCircleIcon,
@@ -18,7 +19,10 @@ import {
   b64ToArray,
   calldataToUserFriendlyJson,
 } from '@/calldata/jsonifier';
-import { getRuntimeConfigNumber } from '@/utils/runtimeConfig';
+import {
+  getRuntimeConfigBoolean,
+  getRuntimeConfigNumber,
+} from '@/utils/runtimeConfig';
 
 const uiStore = useUIStore();
 const nodeStore = useNodeStore();
@@ -84,6 +88,37 @@ const handleSetTransactionAppeal = async () => {
 };
 
 const isAppealed = computed(() => props.transaction.data.appealed);
+const isHosted = getRuntimeConfigBoolean('VITE_IS_HOSTED', false);
+const hasSenderAddress = computed(() =>
+  Boolean(
+    props.transaction.data?.from_address || props.transaction.data?.sender,
+  ),
+);
+
+const canCancel = computed(() => {
+  const cancellableStatus =
+    props.transaction.statusName === 'PENDING' ||
+    props.transaction.statusName === 'ACTIVATED';
+  const requiresAdminOnly =
+    isHosted && props.transaction.type === 'upgrade' && !hasSenderAddress.value;
+  return cancellableStatus && !requiresAdminOnly;
+});
+const isCancelling = ref(false);
+const handleCancelTransaction = async () => {
+  isCancelling.value = true;
+  try {
+    await transactionsStore.cancelTransaction(props.transaction.hash);
+  } catch (e: any) {
+    notify({
+      type: 'error',
+      title: 'Error cancelling transaction',
+      text: e?.message ?? 'Unable to cancel transaction',
+    });
+    console.error('Error cancelling transaction', e);
+  } finally {
+    isCancelling.value = false;
+  }
+};
 
 function prettifyTxData(x: any): any {
   const oldResult = x?.consensus_data?.leader_receipt?.[0].result;
@@ -218,10 +253,28 @@ const badgeColorClass = computed(() => {
           transaction.statusName !== 'ACCEPTED' &&
           transaction.statusName !== 'UNDETERMINED' &&
           transaction.statusName !== 'LEADER_TIMEOUT' &&
-          transaction.statusName !== 'VALIDATORS_TIMEOUT'
+          transaction.statusName !== 'VALIDATORS_TIMEOUT' &&
+          transaction.statusName !== 'CANCELED'
         "
       />
 
+      <div @click.stop="">
+        <Btn
+          v-if="canCancel"
+          @click="handleCancelTransaction"
+          tiny
+          class="!h-[18px] !px-[4px] !py-[1px] !text-[9px] !font-medium"
+          :data-testid="`cancel-transaction-btn-${transaction.hash}`"
+          :loading="isCancelling"
+          :disabled="isCancelling"
+        >
+          <div class="flex items-center gap-1">
+            {{ isCancelling ? 'CANCELLING...' : 'CANCEL' }}
+            <XCircleIcon class="h-2.5 w-2.5" />
+          </div>
+        </Btn>
+      </div>
+
       <div @click.stop="">
         <Btn
           v-if="
@@ -303,7 +356,8 @@ const badgeColorClass = computed(() => {
                   transaction.statusName !== 'ACCEPTED' &&
                   transaction.statusName !== 'UNDETERMINED' &&
                   transaction.statusName !== 'LEADER_TIMEOUT' &&
-                  transaction.statusName !== 'VALIDATORS_TIMEOUT'
+                  transaction.statusName !== 'VALIDATORS_TIMEOUT' &&
+                  transaction.statusName !== 'CANCELED'
                 "
               />
               <TransactionStatusBadge

frontend/src/services/IJsonRpcService.ts

@@ -39,4 +39,8 @@ export interface IJsonRpcService {
     signature?: string,
   ): Promise<{ transaction_hash: string; message: string }>;
   getContractNonce(address: string): Promise<number>;
+  cancelTransaction(
+    transactionHash: string,
+    signature?: string,
+  ): Promise<{ transaction_hash: string; status: string }>;
 }

frontend/src/services/JsonRpcService.ts

@@ -222,4 +222,15 @@ export class JsonRpcService implements IJsonRpcService {
       'Error getting contract nonce',
     ) as Promise<number>;
   }
+
+  async cancelTransaction(
+    transactionHash: string,
+    signature?: string,
+  ): Promise<{ transaction_hash: string; status: string }> {
+    return this.callRpcMethod<{ transaction_hash: string; status: string }>(
+      'sim_cancelTransaction',
+      [transactionHash, signature],
+      'Error cancelling transaction',
+    ) as Promise<{ transaction_hash: string; status: string }>;
+  }
 }

frontend/src/stores/transactions.ts

@@ -104,6 +104,40 @@ export const useTransactionsStore = defineStore('transactionsStore', () => {
     });
   }
 
+  async function cancelTransaction(txHash: `0x${string}`) {
+    const { useRpcClient } = await import('@/hooks/useRpcClient');
+    const rpcClient = useRpcClient();
+
+    const { useAccountsStore } = await import('@/stores/accounts');
+    const accountsStore = useAccountsStore();
+    const account = accountsStore.selectedAccount;
+    let signature: string | undefined;
+
+    if (account) {
+      const { keccak256, toBytes, concat, stringToBytes } =
+        await import('viem');
+      const { privateKeyToAccount } = await import('viem/accounts');
+
+      const messageHash = keccak256(
+        concat([stringToBytes('cancel_transaction'), toBytes(txHash)]),
+      );
+
+      if (account.type === 'local' && account.privateKey) {
+        const signer = privateKeyToAccount(account.privateKey as `0x${string}`);
+        signature = await signer.signMessage({
+          message: { raw: messageHash },
+        });
+      } else if (account.type === 'metamask' && window.ethereum) {
+        signature = await window.ethereum.request({
+          method: 'personal_sign',
+          params: [messageHash, account.address],
+        });
+      }
+    }
+
+    await rpcClient.cancelTransaction(txHash, signature);
+  }
+
   function subscribe(topics: string[]) {
     topics.forEach((topic) => {
       subscriptions.add(topic);
@@ -138,6 +172,7 @@ export const useTransactionsStore = defineStore('transactionsStore', () => {
     updateTransaction,
     clearTransactionsForContract,
     setTransactionAppeal,
+    cancelTransaction,
     refreshPendingTransactions,
     initSubscriptions,
     resetStorage,