fix(swap): USTC→USTR wrap+2hop gas fails on Swap

PlasticDigits commented

2026-09-14 18:46:04 +00:00

Owner

Summary

Retail Swap of native USTC (uusd) → USTR on dex.cl8y.com / is reporting a gas problem (failed or unusable fee). This is the wrap + 2-hop hub path, not a direct pair and not the reverse unwrap.

Bundle into one issue (do not split OOG vs hint vs wallet rewrite vs wrap-fee netting):

Reproduce USTC → USTR on columbus-5 / with Route chrome showing wrap + hub hops.
Classify the failure: (A) dApp envelope OOG (gas_used ≥ gas_wanted / humanized out-of-gas toast), (B) wallet auto-gas rewrite (Station/WalletConnect thousands of LUNC while dApp Fee is tens of LUNC), or (C) Network-fee hint vs signed Fee mismatch with a succeeding tx.
Fix the named layer — raise WRAP_ROUTER_COMBO_OVERHEAD_GAS (or the wrap+N-hop combined envelope) from measured gas_used, or align hint/submit so the wallet honors the dApp Fee. Do not turn hybrid on for native wrap+multihop (H596-7). Do not pay gas in uusd.

Related, not duplicates (keyword overlap on “gas” / USTR is not enough):

#587 (closed) — LUNC↔USTR wrap+≥2hop OOG + Network-fee row. Shipped WRAP_ROUTER_COMBO_OVERHEAD_GAS 400k. Different native (uluna), and the follow-up bake succeeded for USTC → USTR.
#599 / #600 (closed) — USTR → USTC unwrap+2hop OOG. Opposite direction (unwrap_output + InstantWithdraw of taxed USTC). #599 explicitly recorded USTC → USTR as succeeding on that bake.
#679 / #681 (closed) — Station auto-gas ~4k LUNC on CW20 hybrid multi-hop (cLUNC → USTR, mixed hops). Native wrap path must stay pool-only.
#1222 (closed, Stay) — retail gas census ADR 0004. Wrap+2hop columbus-5 gas_used is still unmeasured. Do not reopen that research ticket; this is a concrete USTC → USTR execute failure.
#353 / #343 / #475 — router hop floors, unwrap add-on, retail getGasLimitForTx inventory. Background only.

Current codebase

Native USTC is uusd; wrap CW20 is cUSTC. USTR is CW20. There is no factory pair USTR/cUSTC. Hub graph (unchanged from #599):

Pair	Legs
UST1 / cUSTC	wrap-side hop
UST1 / USTR	USTR hop
cLUNC / UST1	not on this path

Client BFS therefore routes USTC → USTR as wrap_deposit (uusd → cUSTC) then cUSTC → UST1 → USTR (2 pool-only hops) in one multi-msg tx.

Layer	Behavior today
Quote / submit	`SwapPage` native wrap branch → `executeNativeSwap`. Comment: “Pool-only hops from client BFS `findRoute` — never copy hybrid / book_input (#587 / #599).” `wrap_deposit` + CW20 `send` → router `execute_swap_operations` (`unwrap_output` false). CW20 send amount is post–wrap-fee mint (`netCw20AfterNativeWrap`).
Gas wanted	`totalGasLimitForExecuteMsgs`: `WRAP_GAS_LIMIT` 400,000 + `gasLimitForRouterExecuteSwapOperations`(2) 1,910,000 + `WRAP_ROUTER_COMBO_OVERHEAD_GAS` 400,000 = 2,710,000 (~76.76 LUNC at `effectiveGasPriceUluna()` 28.325). Combo overhead applies only when wrap and router send share one tx and hops ≥ 2.
Broadcast	No LCD `/simulate` on the execute path (`skills/AGENTS_TERRACLASSIC_GAS.md`). Explicit `Fee` in `uluna` only. Station / WalletConnect may replace that envelope.
Census hole	ADR 0004 row “Wrap + ≥2hop”: envelope 2,710,000; columbus-5 success unmeasured. G5 scored Stay for the census; it does not certify this pair still lands.

Do not treat #1222 Stay as “gas is fine.” That ADR forbade constant retune from the research MR; a new measured OOG or 4k-LUNC wallet rewrite on this path is in-scope here.

Repro (Given / When / Then)

Given a columbus-5 wallet with native USTC, enough LUNC for a tens-of-LUNC network fee, and USTR as the ask on Swap /
When the trader quotes and submits USTC → USTR (Route shows wrap + UST1 hub hops; one SWAP)
Then the tx is code = 0, gas_used < gas_wanted, the Swap Network-fee hint is the same class as the signed Fee (tens of LUNC at 28.325, not thousands), and the UI does not show the humanized out-of-gas toast.

Expected vs actual

	Expected	Actual (report)
Execute	One successful USTC → USTR wrap+2hop	Gas problem on that path (OOG, wallet auto-fee, or hint/sign mismatch — classify in AC1)
Envelope	Named wrap+N-hop sum above measured `gas_used`	2,710,000 still unmeasured on columbus-5 for this pair
Wallet	Confirm screen honors dApp `Fee` or is documented as rewrite with a working manual path	Unspecified; must not be left as “gas is high on Classic”
Hybrid	Native wrap+multihop stays pool-only	Must stay; hybrid-on is not a gas fix (H596-7, A3)

Acceptance criteria

AC1. Columbus-5 /: one USTC → USTR Swap. Record hash, gas_wanted, gas_used, fee uluna, Route hops, and whether the wallet rewrote the fee. Classify A / B / C above.
AC2. If A (OOG): raise the named wrap+N-hop combo (WRAP_ROUTER_COMBO_OVERHEAD_GAS or documented successor) so gas_wanted > measured gas_used with the same margin discipline as #587 (not a silent BASE_GAS_LIMIT fallthrough; not a blanket 15M). Inventory fixture + unit test for wrap+2hop = new ceiling.
AC3. If B (wallet auto-gas thousands of LUNC): do not “fix” by disabling hybrid on CW20 paths or forcing a different route. Align estimateSwapNetworkFee / preferNoSetFee / Station amino so the confirm screen matches the dApp envelope, or document the wallet class + working manual gas with UI copy. Mainnet fee-guard (#429) stays off.
AC4. If C only: hint and submit must use the same totalGasLimitForExecuteMsgs msgs as execute (wrap + router send). No hint that shows ~200 LUNC while the wallet sees ~4k, or the reverse.
AC5. USTR → USTC (#599 envelope 3,110,000) and LUNC → USTR wrap+2hop still succeed; this ticket does not regress the reverse unwrap combo.
AC6. LocalTerra wrap-swap path covering USTC (or documented stand-in native uusd) → USTR: one submit, no OOG toast, gas_used < gas_wanted.
AC7. Docs: one row in skills/AGENTS_TERRACLASSIC_GAS.md / frontend gas section with the measured hash and the named constant. Do not spawn a second census ADR.

Test plan

Unit: wrap+2hop totalGasLimitForExecuteMsgs fixture stays 2,710,000 until AC2 changes it; after a raise, the fixture equals the new named sum (400k wrap + 1,910,000 hops + combo).
Unit: wrap+1hop still has no combo overhead; unwrap+2hop still uses UNWRAP_ROUTER_COMBO_OVERHEAD_GAS, not the wrap combo.
RTL / Playwright: native wrap Route does not attach hybrid / book_input on USTC → USTR ops.
Hostile decode: wrap+router send whose hook fails to parse must not fall through to 600k / BASE_GAS_LIMIT (existing #587 throw path).
Do not add LCD-simulate-as-broadcast as the production limiter.

Attack / abuse tests

A1 OOG grief. Under-envelope burns LUNC on a failed CosmWasm execute. After AC2, a wrap+2hop USTC → USTR must not land at gas_used ≈ gas_wanted (the #353 1,810,000-exact failure mode).
A3 Hybrid off. Stripping hybrid on other CW20 routes to cheapen this native path violates H596. Tests must keep native wrap ops pool-only and leave CW20 hybrid always-on.
A5 Fee denom. Envelope stays uluna. A 0-USTC-after-swap wallet with remaining LUNC must still be able to pay network fee; do not suggest uusd fees.
Grief oversized ceiling. Do not “fix” OOG by granting 15M / ~4k LUNC on this pool-only wrap path (that is the #679 Station failure mode). Cap stays named combo + hop floors.
Hook fallthrough. Malformed wrap+router send.msg must fail closed on gas estimation, not under-grant.

Verification criteria

AC1 hash (or LocalTerra E2E log) shows code = 0 and gas_used < gas_wanted for USTC → USTR.
Network fee on Swap for that quote is tens of LUNC at 28.325 × envelope, not the 4k-LUNC Station class unless AC3 documents that wallet and a working manual path.
make unit/inventory targets that cover terraGas.ts wrap combo + native swap tests pass.
No production change to hybrid-always-on, MIN_GAS_PRICE_ULUNA, or mainnet fee-guard.

Out of scope

Reopening #1222 or rewriting ADR 0004 Stay.
V3 Grid keeper gas (#618), factory SetDiscountRegistryAll (#123), indexer pair-creation protocol fees (#1209).
USTR → USDT quote sizing (#1257).
Turning wrap+multihop into indexer GET /route/solve hybrid.

First-pass model recommendation

Recommendation: grok-high

Rationale: Founder-required surface (wasm execute envelope, wallet Fee / Station rewrite, wrap mapper + router). Not a known local one-file edit: expected touch is frontend-dapp/src/utils/constants.ts, frontend-dapp/src/services/terraclassic/terraGas.ts, possibly swapNetworkFee.ts / router.ts / Swap native path, plus inventory fixtures and the gas playbook. Columbus-5 wrap+2hop is still unmeasured (ADR 0004); first pass must classify OOG vs wallet rewrite before retuning. Comparable closed work (#587 / #599 / #679) spanned hop math, combo overhead, and wallet behavior — not the three-file Composer bar. Verify with wrap+2hop inventory tests plus a recorded USTC → USTR gas_used vs gas_wanted.

## Summary Retail Swap of **native USTC (`uusd`) → USTR** on `dex.cl8y.com` `/` is reporting a **gas problem** (failed or unusable fee). This is the **wrap + 2-hop hub** path, not a direct pair and not the reverse unwrap. Bundle into **one** issue (do not split OOG vs hint vs wallet rewrite vs wrap-fee netting): 1. **Reproduce** USTC → USTR on columbus-5 `/` with Route chrome showing wrap + hub hops. 2. **Classify** the failure: (A) dApp envelope OOG (`gas_used ≥ gas_wanted` / humanized out-of-gas toast), (B) wallet auto-gas rewrite (Station/WalletConnect thousands of LUNC while dApp Fee is tens of LUNC), or (C) Network-fee hint vs signed `Fee` mismatch with a succeeding tx. 3. **Fix the named layer** — raise `WRAP_ROUTER_COMBO_OVERHEAD_GAS` (or the wrap+N-hop combined envelope) from measured `gas_used`, or align hint/submit so the wallet honors the dApp `Fee`. Do **not** turn hybrid on for native wrap+multihop (**H596-7**). Do **not** pay gas in `uusd`. Related, **not duplicates** (keyword overlap on “gas” / USTR is not enough): - [#587](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/587) (closed) — LUNC↔USTR wrap+≥2hop OOG + Network-fee row. Shipped `WRAP_ROUTER_COMBO_OVERHEAD_GAS` 400k. Different native (`uluna`), and the follow-up bake **succeeded** for USTC → USTR. - [#599](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/599) / [#600](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/600) (closed) — **USTR → USTC** unwrap+2hop OOG. Opposite direction (`unwrap_output` + InstantWithdraw of taxed USTC). #599 explicitly recorded USTC → USTR as succeeding on that bake. - [#679](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/679) / [#681](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/681) (closed) — Station auto-gas ~4k LUNC on **CW20 hybrid** multi-hop (cLUNC → USTR, mixed hops). Native wrap path must stay pool-only. - [#1222](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/1222) (closed, **Stay**) — retail gas census ADR 0004. Wrap+2hop columbus-5 `gas_used` is still **unmeasured**. Do **not** reopen that research ticket; this is a concrete USTC → USTR execute failure. - [#353](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/353) / [#343](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/343) / [#475](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/475) — router hop floors, unwrap add-on, retail `getGasLimitForTx` inventory. Background only. ## Current codebase Native USTC is `uusd`; wrap CW20 is cUSTC. USTR is CW20. There is **no** factory pair USTR/cUSTC. Hub graph (unchanged from #599): | Pair | Legs | |------|------| | UST1 / cUSTC | wrap-side hop | | UST1 / USTR | USTR hop | | cLUNC / UST1 | not on this path | Client BFS therefore routes **USTC → USTR** as **`wrap_deposit` (uusd → cUSTC)** then **cUSTC → UST1 → USTR** (2 pool-only hops) in **one** multi-msg tx. | Layer | Behavior today | |-------|----------------| | **Quote / submit** | [`SwapPage`](frontend-dapp/src/pages/SwapPage.tsx) native wrap branch → [`executeNativeSwap`](frontend-dapp/src/services/terraclassic/router.ts). Comment: *“Pool-only hops from client BFS `findRoute` — never copy hybrid / book_input (#587 / #599).”* `wrap_deposit` + CW20 `send` → router `execute_swap_operations` (`unwrap_output` false). CW20 send amount is post–wrap-fee mint (`netCw20AfterNativeWrap`). | | **Gas wanted** | [`totalGasLimitForExecuteMsgs`](frontend-dapp/src/services/terraclassic/terraGas.ts): `WRAP_GAS_LIMIT` **400,000** + [`gasLimitForRouterExecuteSwapOperations`](frontend-dapp/src/services/terraclassic/terraGas.ts)(2) **1,910,000** + [`WRAP_ROUTER_COMBO_OVERHEAD_GAS`](frontend-dapp/src/utils/constants.ts) **400,000** = **2,710,000** (~76.76 LUNC at `effectiveGasPriceUluna()` 28.325). Combo overhead applies only when wrap and router send share one tx **and** hops ≥ 2. | | **Broadcast** | No LCD `/simulate` on the execute path ([`skills/AGENTS_TERRACLASSIC_GAS.md`](skills/AGENTS_TERRACLASSIC_GAS.md)). Explicit `Fee` in **`uluna` only**. Station / WalletConnect may **replace** that envelope. | | **Census hole** | [ADR 0004](docs/adr/0004-terraclassic-retail-gas-census.md) row “Wrap + ≥2hop”: envelope 2,710,000; columbus-5 success **unmeasured**. G5 scored Stay for the *census*; it does not certify this pair still lands. | Do **not** treat #1222 Stay as “gas is fine.” That ADR forbade constant retune from the research MR; a new measured OOG or 4k-LUNC wallet rewrite on this path is in-scope **here**. ## Repro (Given / When / Then) **Given** a columbus-5 wallet with native USTC, enough LUNC for a tens-of-LUNC network fee, and USTR as the ask on Swap `/` **When** the trader quotes and submits **USTC → USTR** (Route shows wrap + UST1 hub hops; one SWAP) **Then** the tx is `code = 0`, `gas_used < gas_wanted`, the Swap Network-fee hint is the same class as the signed `Fee` (tens of LUNC at 28.325, not thousands), and the UI does not show the humanized out-of-gas toast. ### Expected vs actual | | Expected | Actual (report) | |---|----------|-----------------| | Execute | One successful USTC → USTR wrap+2hop | Gas problem on that path (OOG, wallet auto-fee, or hint/sign mismatch — classify in AC1) | | Envelope | Named wrap+N-hop sum **above** measured `gas_used` | 2,710,000 still **unmeasured** on columbus-5 for this pair | | Wallet | Confirm screen honors dApp `Fee` or is documented as rewrite with a working manual path | Unspecified; must not be left as “gas is high on Classic” | | Hybrid | Native wrap+multihop stays **pool-only** | Must stay; hybrid-on is not a gas fix (**H596-7**, **A3**) | ## Acceptance criteria - [ ] **AC1.** Columbus-5 `/`: one USTC → USTR Swap. Record hash, `gas_wanted`, `gas_used`, fee `uluna`, Route hops, and whether the wallet rewrote the fee. Classify A / B / C above. - [ ] **AC2.** If A (OOG): raise the **named wrap+N-hop combo** (`WRAP_ROUTER_COMBO_OVERHEAD_GAS` or documented successor) so `gas_wanted` > measured `gas_used` with the same margin discipline as #587 (not a silent `BASE_GAS_LIMIT` fallthrough; not a blanket 15M). Inventory fixture + unit test for wrap+2hop = new ceiling. - [ ] **AC3.** If B (wallet auto-gas thousands of LUNC): do **not** “fix” by disabling hybrid on CW20 paths or forcing a different route. Align `estimateSwapNetworkFee` / `preferNoSetFee` / Station amino so the confirm screen matches the dApp envelope, or document the wallet class + working manual gas with UI copy. Mainnet fee-guard (#429) stays **off**. - [ ] **AC4.** If C only: hint and submit must use the same `totalGasLimitForExecuteMsgs` msgs as execute (wrap + router send). No hint that shows ~200 LUNC while the wallet sees ~4k, or the reverse. - [ ] **AC5.** USTR → USTC (#599 envelope 3,110,000) and LUNC → USTR wrap+2hop still succeed; this ticket does not regress the reverse unwrap combo. - [ ] **AC6.** LocalTerra wrap-swap path covering USTC (or documented stand-in native `uusd`) → USTR: one submit, no OOG toast, `gas_used < gas_wanted`. - [ ] **AC7.** Docs: one row in `skills/AGENTS_TERRACLASSIC_GAS.md` / frontend gas section with the measured hash and the named constant. Do not spawn a second census ADR. ## Test plan - Unit: wrap+2hop `totalGasLimitForExecuteMsgs` fixture stays **2,710,000** until AC2 changes it; after a raise, the fixture equals the new named sum (400k wrap + 1,910,000 hops + combo). - Unit: wrap+1hop still has **no** combo overhead; unwrap+2hop still uses `UNWRAP_ROUTER_COMBO_OVERHEAD_GAS`, not the wrap combo. - RTL / Playwright: native wrap Route does not attach `hybrid` / `book_input` on USTC → USTR ops. - Hostile decode: wrap+router send whose hook fails to parse must **not** fall through to 600k / `BASE_GAS_LIMIT` (existing #587 throw path). - Do not add LCD-simulate-as-broadcast as the production limiter. ## Attack / abuse tests - **A1 OOG grief.** Under-envelope burns LUNC on a failed CosmWasm execute. After AC2, a wrap+2hop USTC → USTR must not land at `gas_used ≈ gas_wanted` (the #353 1,810,000-exact failure mode). - **A3 Hybrid off.** Stripping hybrid on *other* CW20 routes to cheapen this native path violates **H596**. Tests must keep native wrap ops pool-only **and** leave CW20 hybrid always-on. - **A5 Fee denom.** Envelope stays `uluna`. A 0-USTC-after-swap wallet with remaining LUNC must still be able to pay network fee; do not suggest `uusd` fees. - **Grief oversized ceiling.** Do not “fix” OOG by granting 15M / ~4k LUNC on this pool-only wrap path (that is the #679 Station failure mode). Cap stays named combo + hop floors. - **Hook fallthrough.** Malformed wrap+router `send.msg` must fail closed on gas estimation, not under-grant. ## Verification criteria - AC1 hash (or LocalTerra E2E log) shows `code = 0` and `gas_used < gas_wanted` for USTC → USTR. - Network fee on Swap for that quote is tens of LUNC at 28.325 × envelope, not the 4k-LUNC Station class unless AC3 documents that wallet and a working manual path. - `make` unit/inventory targets that cover `terraGas.ts` wrap combo + native swap tests pass. - No production change to hybrid-always-on, `MIN_GAS_PRICE_ULUNA`, or mainnet fee-guard. ## Out of scope - Reopening [#1222](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/1222) or rewriting ADR 0004 Stay. - V3 Grid keeper gas (#618), factory `SetDiscountRegistryAll` (#123), indexer pair-creation protocol fees (#1209). - USTR → USDT quote sizing ([#1257](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/1257)). - Turning wrap+multihop into indexer `GET /route/solve` hybrid. ## First-pass model recommendation Recommendation: grok-high Rationale: Founder-required surface (wasm execute envelope, wallet `Fee` / Station rewrite, wrap mapper + router). Not a known local one-file edit: expected touch is `frontend-dapp/src/utils/constants.ts`, `frontend-dapp/src/services/terraclassic/terraGas.ts`, possibly `swapNetworkFee.ts` / `router.ts` / Swap native path, plus inventory fixtures and the gas playbook. Columbus-5 wrap+2hop is still **unmeasured** (ADR 0004); first pass must classify OOG vs wallet rewrite before retuning. Comparable closed work (#587 / #599 / #679) spanned hop math, combo overhead, and wallet behavior — not the three-file Composer bar. Verify with wrap+2hop inventory tests plus a recorded USTC → USTR `gas_used` vs `gas_wanted`.

PlasticDigits added the

bug

agent:implement

labels

2026-09-14 18:46:06 +00:00

PlasticDigits commented

2026-09-14 18:46:12 +00:00

Author

Owner

cl8y-agent-control: queued design_author job a888b0ce-900f-4421-b0e1-2024c469b707 (not executed; no Hetzner VM).

cl8y-agent-control: queued `design_author` job `a888b0ce-900f-4421-b0e1-2024c469b707` (not executed; no Hetzner VM).

PlasticDigits removed the