TX_BAD_AUTH_EXTRA at submiting a transaction

Question

I'm getting an error at trying to issue an asset following this schema:

• (issuer) An issuer account (Nano ledger) that will create and send the asset to a secondary account.
• (bhMain) Secondary account that will be able to send the asset to the investors.
• (bhDeactivated) A third account made just to be sure the client doesn't send the transaction to Stellar's network before going to our backend first.

Issuer account set with:

setOptions({
  setFlags: 3, // Operation.AuthFlags.Required | Operation.AuthFlags.Revocable
  signer: {
    ed25519PublicKey: bHMainPublicKey,
    weight: 1,
  },
  lowThreshold: 1,
})

So in the backend:

const transaction = new TransactionBuilder(bHMainAccountResponse)
    .addOperation(Operation.changeTrust({
      asset,
    }))
    .addOperation(Operation.allowTrust({
      assetCode: asset.code,
      authorize: true,
      trustor: bHMainKeys.publicKey(), // Secondary account
      source: issuerPublicKey,
    }))
    .addOperation(Operation.payment({
      destination: bHMainKeys.publicKey(),
      asset,
      amount: amount.toString(),
      source: issuerPublicKey,
    }))
    .addOperation(Operation.setOptions({
      masterWeight: 0,
      lowThreshold: 0,
      medThreshold: 0,
      highThreshold: 0,
      clearFlags: 7,
      source: bHDeactivatedKeys.publicKey(), // 3rd account
    }))
    .build()

transaction.sign(bHMainKeys)

const signedTransaction = transaction.toEnvelope().toXDR().toString('base64')

Then I send the transaction to the client in order to sign the payment operation with the Nano ledger (issuer).

Once it's signed, I send it back to the backend to sign with bHDeactivated account.

And then, after submitting the transaction I get tx_bad_auth_extra.

tx_bad_auth_extra is supposed to mean that there's one extra signature that it is unusued. So playing here and there I removed bHDeactivated's signature and then the error was "op_bad_auth" at the last Operation.

What am I missing here?

Answer 1

So I finally found out what was the problem. The thresholds weren't set correctly. I leave here the correct ones:

setOptions({
  setFlags: 3, // Operation.AuthFlags.Required | Operation.AuthFlags.Revocable
    signer: {
      ed25519PublicKey: environment.stellar.stellarMainKey,
      weight: 1,
    },
  lowThreshold: 1,
  medThreshold: 2,
  highThreshold: 3,
}