BUGFIX: don't leak out a transaction if fails