incident(dex): bridge USDT and seed CMM USDT/cLUNC pair #1221

New issue

Closed

opened 2026-09-11 06:44:15 +00:00 by PlasticDigits · 1 comment

PlasticDigits commented

2026-09-11 06:44:15 +00:00

Owner

Summary

Operators need a USDT / cLUNC CL8Y factory pair whose LP is custodied by TerraClassic CMM Treasury, after USDT is bridged onto Terra Classic.

This is on-chain treasury / listing work, not a product implement ticket. Pair legs are CW20: bridged USDT vs existing wrap cLUNC (not native uluna). Do not fold this into #558 (SpaceUSD/UST1, UST1/ALPHA, CL8Y/ALPHA, CL8Y/WILLY) or into #1220 (allowlisted IBC USDC natives). Circle CCTP / native USDC (#1215, bridge #169) stays out of scope.

Live execution, sizing, source-chain USDT choice, and signing stay with operators via ops-bot DMs and authenticated GET /status. Do not use ops.md here.

Fingerprint

Item	Detail
Work	Bridge USDT → Terra Classic CW20, then `CreatePair` + seed LP
Pair	USDT / cLUNC on the CL8Y factory
Custody	LP owned by TerraClassic CMM Treasury (same receiver invariant as #558)
Not	IBC `ibc/…` USDC factory natives (#1220); other-DEX USDC hops (#691)
Sizing	Unspecified in the request — do not invent USD notionals

Current codebase / on-chain facts

CL8Y factory pairs are CW20-only today (AssetInfo::Token; natives rejected). LUNC reaches the graph as wrap CW20 cLUNC (#507). A USDT/cLUNC market is the honest shape: do not CreatePair USDT/uluna.

Bridged economic CW20s from the CL8Y bridge have historically landed on mintable code 10184, which is already factory-whitelisted (#558, #508). Confirm the live post-bridge USDT code_id on LCD before whitelist or CreatePair. If it is not 10184, governance / 2-of-3 AddWhitelistedCodeId is a prerequisite. Do not whitelist an unverified foreign code id.

cLUNC is already the wrap-mapper uluna leg. Do not invent a USDT wrap or a cUSDT product for this ticket.

Custody invariant (copy the #558 rules, new pair only)

Rule	Detail
Receiver	TerraClassic CMM Treasury (addresses and LCD checks: #558 — do not retarget Dist, 2-of-3, or a hot wallet)
Provide	`provide_liquidity` with `receiver` = CMM so leftover LP is not left on the admin signer
After provide	Re-query CMM LP CW20 balance; fail the run if it did not increase
Forbidden	Selling LP, `RemoveLiquidity` / breaking LP, farming-and-exit, or moving LP off CMM except later explicit governance

Parent ops patterns: #508 (create/seed), #558 (CMM receiver + 5%/95% remainder provide). Soft-launch gem defaults must not absorb this pair.

Operator sequence (ops-bot; not agent implement)

Identify canonical USDT on the source chain the bridge already supports. Record decimals, contract/mint, and the Terra CW20 that will exist after register/mint. Do not alias USDC, UST1, vFDUSD, or SpaceUSD as USDT.
Bridge a treasury-sized USDT amount to Terra Classic through the CL8Y bridge (register mapping if missing; then deposit). Destination holder for the seed bag is an ops decision; final LP must still land on CMM.
LCD attest the new CW20: symbol/name/decimals, code_id, admin, total supply delta matching the bridge mint. Abort on unexpected wasm or tax token.
Factory — if code_id is not already on WHITELISTED_CODE_IDS, 2-of-3 AddWhitelistedCodeId first. Then CreatePair USDT + cLUNC. Do not RegisterListedPair a foreign DEX USDT/LUNC venue.
Wrap enough LUNC → cLUNC for the cLUNC leg (existing wrap fees apply). Do not put native LUNC in the pair.
Seed at a recorded USDT/USD print × cLUNC USD (LUNC print × wrap). Split provide 5% then remainder, receiver = CMM. Fail closed if CMM LP shares do not increase or if the 2-of-3 still holds LP.
Record pair, LP token, create tx, provide txs, final reserves, CMM LP amount. Retail tokenlist / indexer symbol work is out of band (#715 unique-symbol CI) and is not required to close custody.

Constraints / guardrails

No product Given/When/Then on this issue. HMAC ops skip applies once the ops label is on the ticket.
Do not treat this as #1220: USDT here is bridged CW20, not an ibc/ native allowlist pin.
Do not reuse #558 leftover WILLY/CL8Y inventory as the USDT or cLUNC bag.
Checksum every terra1 on LCD. Hostile / wrong-chain contracts abort.
Pair-creation fee and wrap fees come from the documented factory/wrap paths; do not waive in scripts.
Tokenlist, Swap logos, and GeckoTerminal listing are follow-ups if retail should see the ticker. Custody does not wait on frontend.
Seed size, source venue, and which bridge peer holds USDT are founder/ops inputs. This issue does not pick amounts.

Out of scope

Implementing factory native-IBC (#1220) or CCTP USDC.
Changing wrap-mapper denoms.
Autoland / /agent implement from intake.
Publishing host, Coolify, queue, or signer inventory on this ticket.

First-pass model recommendation

Recommendation: grok-high

Rationale: This is treasury custody plus bridge register/mint, factory listing, wrap, and 2-of-3 provide_liquidity — founder-required wallet / deploy / custody surface, not a ≤3-file local edit. Comparable DEX history is #558 (multi-step CMM LP seeds) rather than a single RCA or test-helper change. There is no deterministic unit test that proves CMM received LP; verification is LCD/tx attest via ops-bot. Model policy routes ops and human-required topics to Grok high. Composer is not eligible.

## Summary Operators need a **USDT / cLUNC** CL8Y factory pair whose LP is **custodied by TerraClassic CMM Treasury**, after USDT is bridged onto Terra Classic. This is on-chain treasury / listing work, not a product implement ticket. Pair legs are CW20: bridged USDT vs existing wrap **cLUNC** (not native `uluna`). Do not fold this into #558 (SpaceUSD/UST1, UST1/ALPHA, CL8Y/ALPHA, CL8Y/WILLY) or into #1220 (allowlisted IBC **USDC** natives). Circle CCTP / native USDC (#1215, bridge #169) stays out of scope. Live execution, sizing, source-chain USDT choice, and signing stay with operators via **ops-bot DMs** and authenticated **`GET /status`**. Do not use `ops.md` here. ### Fingerprint | Item | Detail | | --- | --- | | Work | Bridge USDT → Terra Classic CW20, then `CreatePair` + seed LP | | Pair | USDT / cLUNC on the CL8Y factory | | Custody | LP owned by TerraClassic CMM Treasury (same receiver invariant as #558) | | Not | IBC `ibc/…` USDC factory natives (#1220); other-DEX USDC hops (#691) | | Sizing | **Unspecified** in the request — do not invent USD notionals | ## Current codebase / on-chain facts CL8Y factory pairs are CW20-only today (`AssetInfo::Token`; natives rejected). LUNC reaches the graph as wrap CW20 **cLUNC** (#507). A USDT/cLUNC market is the honest shape: do not `CreatePair` USDT/`uluna`. Bridged economic CW20s from the CL8Y bridge have historically landed on mintable code **10184**, which is already factory-whitelisted (#558, #508). **Confirm the live post-bridge USDT `code_id` on LCD before whitelist or `CreatePair`.** If it is not 10184, governance / 2-of-3 `AddWhitelistedCodeId` is a prerequisite. Do not whitelist an unverified foreign code id. cLUNC is already the wrap-mapper `uluna` leg. Do not invent a USDT wrap or a cUSDT product for this ticket. ### Custody invariant (copy the #558 rules, new pair only) | Rule | Detail | | --- | --- | | Receiver | TerraClassic CMM Treasury (addresses and LCD checks: #558 — do not retarget Dist, 2-of-3, or a hot wallet) | | Provide | `provide_liquidity` with `receiver` = CMM so leftover LP is not left on the admin signer | | After provide | Re-query CMM LP CW20 balance; fail the run if it did not increase | | Forbidden | Selling LP, `RemoveLiquidity` / breaking LP, farming-and-exit, or moving LP off CMM except later explicit governance | Parent ops patterns: #508 (create/seed), #558 (CMM `receiver` + 5%/95% remainder provide). Soft-launch gem defaults must not absorb this pair. ## Operator sequence (ops-bot; not agent implement) 1. **Identify canonical USDT** on the source chain the bridge already supports. Record decimals, contract/mint, and the Terra CW20 that will exist after register/mint. Do not alias USDC, UST1, vFDUSD, or SpaceUSD as USDT. 2. **Bridge** a treasury-sized USDT amount to Terra Classic through the CL8Y bridge (register mapping if missing; then deposit). Destination holder for the seed bag is an ops decision; **final LP must still land on CMM**. 3. **LCD attest** the new CW20: symbol/name/decimals, `code_id`, admin, total supply delta matching the bridge mint. Abort on unexpected wasm or tax token. 4. **Factory** — if `code_id` is not already on `WHITELISTED_CODE_IDS`, 2-of-3 `AddWhitelistedCodeId` first. Then `CreatePair` USDT + cLUNC. Do not `RegisterListedPair` a foreign DEX USDT/LUNC venue. 5. **Wrap** enough LUNC → cLUNC for the cLUNC leg (existing wrap fees apply). Do not put native LUNC in the pair. 6. **Seed** at a recorded USDT/USD print × cLUNC USD (LUNC print × wrap). Split provide 5% then remainder, `receiver` = CMM. Fail closed if CMM LP shares do not increase or if the 2-of-3 still holds LP. 7. **Record** pair, LP token, create tx, provide txs, final reserves, CMM LP amount. Retail tokenlist / indexer symbol work is **out of band** (#715 unique-symbol CI) and is not required to close custody. ## Constraints / guardrails - No product Given/When/Then on this issue. HMAC ops skip applies once the `ops` label is on the ticket. - Do not treat this as #1220: USDT here is **bridged CW20**, not an `ibc/` native allowlist pin. - Do not reuse #558 leftover WILLY/CL8Y inventory as the USDT or cLUNC bag. - Checksum every `terra1` on LCD. Hostile / wrong-chain contracts abort. - Pair-creation fee and wrap fees come from the documented factory/wrap paths; do not waive in scripts. - Tokenlist, Swap logos, and GeckoTerminal listing are follow-ups if retail should see the ticker. Custody does not wait on frontend. - Seed size, source venue, and which bridge peer holds USDT are **founder/ops** inputs. This issue does not pick amounts. ## Out of scope - Implementing factory native-IBC (#1220) or CCTP USDC. - Changing wrap-mapper denoms. - Autoland / `/agent implement` from intake. - Publishing host, Coolify, queue, or signer inventory on this ticket. ## First-pass model recommendation Recommendation: grok-high Rationale: This is treasury custody plus bridge register/mint, factory listing, wrap, and 2-of-3 `provide_liquidity` — founder-required wallet / deploy / custody surface, not a ≤3-file local edit. Comparable DEX history is #558 (multi-step CMM LP seeds) rather than a single RCA or test-helper change. There is no deterministic unit test that proves CMM received LP; verification is LCD/tx attest via ops-bot. Model policy routes ops and human-required topics to Grok high. Composer is not eligible.

PlasticDigits added the

agent:implement

labels

2026-09-11 06:44:16 +00:00

PlasticDigits commented

2026-09-11 06:44:16 +00:00

Author

Owner

cl8y-agent-control: queued implement job 2abb7077-51bd-4144-bf8a-5fd90f2342c8 (not executed; no Hetzner VM).

cl8y-agent-control: queued `implement` job `2abb7077-51bd-4144-bf8a-5fd90f2342c8` (not executed; no Hetzner VM).

PlasticDigits added the

ops