Plasma shows its teeth when retries start.
The first send goes through. USDT leaves the wallet. PlasmaBFT finality lands before anyone refreshes.
Then the app stutters.
The button lights up again. Same amount. Same address. The user taps. Maybe twice. Gasless means no pause, no cost signal telling you to stop. The relayer keeps accepting. Until it doesn’t.
And now there’s something nobody budgeted for.
Two payments. Both finalized. Not racing. Not reversible. One intended. One not. The ledger doesn’t care which is which.
Support only sees it once the chat opens. Ops sees two clean transfers. Treasury sees a number that wasn’t there a moment ago. Nothing is broken. That’s what makes it uncomfortable.
Retries used to be background noise. On Plasma’s sponsored lane, they’re not. They’re real payments that slip through until a relayer cap, a per-wallet rule, or a rate limit quietly trips. The user never sees the edge. It just shows up after.
One extra send clears before the rule triggers. PlasmaBFT closes it immediately. No grace window. No “caught in time.” Just state.
Then the disagreement starts.
Was the second transfer authorized? The signature says yes. Was it meant to happen? The chat log says no. Someone asks whether intent matters here. Nobody answers quickly, because answering means owning the outcome.
I’ve watched teams freeze in that gap. Not because they’re confused. They’re not. They’re deciding who carries the cost.
Support wants to move fast and calm the user. Ops wants confirmation because duplicate payouts skew reports. Treasury wants to wait because ad-hoc sends break batching discipline. Compliance wants a label that isn’t “user tapped twice,” because that won’t survive review.
Meanwhile the user refreshes their wallet. Both payments are there. Settled. Boring. Plasma did exactly what it said it would do.
The error wasn’t technical. It was assuming retries were harmless.
On Plasma, every accepted send is a settlement event. Sponsored gas doesn’t soften that. It removes the hesitation that used to hide bad edges in apps and processes.
Some teams deal with it upstream. They cap retries before the relayer signs. They slow the button when the sponsored lane is hot. They decide ahead of time who eats it when two valid transfers exist and only one was wanted.
Others wait until after.
By then, the chain is already finished.
