code/cl8y-dex-terraclassic

Fork 0

ops: migrate columbus-5 pairs to cw2 1.18.0 and keep OBSERVATIONS #1324

New issue

Closed

opened 2026-09-22 17:09:38 +00:00 by PlasticDigits · 2 comments

PlasticDigits commented

2026-09-22 17:09:38 +00:00

Owner

Summary

#1323 is on main (c17e71d3). Pair TWAP price × dt and both running cumulatives are Uint256, and a stored u128 decimal string zero-extends. That wasm is not on columbus-5 yet. Live pairs, including the one whose Observe fails adding 340144359629112943994362291128760055446, stay on the old code until a pair migrate.

Do

Migrate pair contracts to cw2 1.18.0. Leave OBSERVATIONS in place. Do not rewrite cumulatives and do not add a setter.
On the previously failing pair, Observe with seconds_ago [0, N] returns every offset, and a small swap, provide, or withdraw moves reserves.
Confirm the indexer and dApp deploy that follows c17e71d3 is running: candle usd_leg migration, GET /api/v1/evidence/daily, and the ALPHA charts bundle.

Not this ticket

No wrapping modulo 2^128.
#1232 (discount-registry / oracle-state backfill) stays separate.
#465 / #1231 ratio skip stays as shipped.

## Summary #1323 is on `main` (`c17e71d3`). Pair TWAP `price × dt` and both running cumulatives are `Uint256`, and a stored `u128` decimal string zero-extends. That wasm is not on columbus-5 yet. Live pairs, including the one whose `Observe` fails adding `340144359629112943994362291128760055446`, stay on the old code until a pair migrate. ## Do - Migrate pair contracts to cw2 **1.18.0**. Leave `OBSERVATIONS` in place. Do not rewrite cumulatives and do not add a setter. - On the previously failing pair, `Observe` with `seconds_ago` `[0, N]` returns every offset, and a small swap, provide, or withdraw moves reserves. - Confirm the indexer and dApp deploy that follows `c17e71d3` is running: candle `usd_leg` migration, `GET /api/v1/evidence/daily`, and the ALPHA charts bundle. ## Not this ticket - No wrapping modulo `2^128`. - #1232 (discount-registry / oracle-state backfill) stays separate. - #465 / #1231 ratio skip stays as shipped.

PlasticDigits referenced this issue

2026-09-22 17:09:43 +00:00

security(oracle): price_times_dt overflow still bricks pair after #465 skip #1224

PlasticDigits referenced this issue

2026-09-22 17:09:44 +00:00

pair oracle: price_a_cumulative can saturate u128, permanently bricking observe() (and likely swaps) on a live pair #1322

LeonardoLUNC commented

2026-09-22 22:18:14 +00:00

Priority flag - this is currently the only pair-brick actually live, and LP is frozen behind it.

Confirmed on-chain today (2026-09-22):

The failing pair is UST1/USTR (terra16vxr.4006qf5hgqy, 6/18). Observe reverts adding 340144359629112943994362291128760055446 - 99.96% of u128::MAX.
Last successful trade was 2026-09-21 19:33 UTC (~27h ago), nothing since. Since oracle_update runs before every reserve-mutating path, this is an execute brick, not just a broken TWAP read: swap / provide / withdraw all revert, so LPs cannot exit. ~$26k of LP is frozen (frozen, not lost - this migrate frees it).

Scope is one pair, so it can be prioritized without ecosystem-wide urgency. I swept all 20 factory pairs. Only UST1/USTR is saturated. Every other 18-decimal pair is centuries+ out at current accrual (CL8Y-cb/cUSTC ? 1,400 yrs; cLUNC/USDT ? 207k yrs; CL8Y-cb/cLUNC ? 147k yrs; CL8Y-cb/ALPHA ? 686k yrs), and all 6/6 pairs are ~10?��% of max. UST1/USTR is uniquely fast because USTR is a low-value 18-dec token, so its raw reserve dwarfs the 6-dec side.

One de-risk before the live migrate: the stored price_a_cumulative on this pair is already at ~3.4e38 in the old u128 encoding. The #1323 zero-extension has to read that pre-saturated value cleanly. The current ACs verify Observe + a swap on the live pair after migrate - worth adding a LocalTerra/unit step that seeds an OBSERVATIONS entry at/near u128::MAX, migrates cw2 ? 1.18.0, and asserts Observe [0,N] + swap/provide/withdraw succeed. That proves the migrate handles an already-saturated pair before it's run against the live one, rather than finding out on columbus-5.

Since this is founder-required (no auto-land), flagging for scheduling of the 2-of-3 migrate. Happy to re-verify Observe returns and a small reserve move lands on UST1/USTR immediately after the wasm is live.

Priority flag - this is currently the only pair-brick actually live, and LP is frozen behind it. **Confirmed on-chain today (2026-09-22):** - The failing pair is **UST1/USTR** (`terra16vxr.4006qf5hgqy`, 6/18). `Observe` reverts adding `340144359629112943994362291128760055446` - **99.96% of u128::MAX**. - Last successful trade was **2026-09-21 19:33 UTC (~27h ago), nothing since.** Since `oracle_update` runs before every reserve-mutating path, this is an **execute brick**, not just a broken TWAP read: swap / provide / **withdraw** all revert, so LPs cannot exit. ~\$26k of LP is frozen (frozen, not lost - this migrate frees it). **Scope is one pair, so it can be prioritized without ecosystem-wide urgency.** I swept all 20 factory pairs. Only UST1/USTR is saturated. Every other 18-decimal pair is centuries+ out at current accrual (CL8Y-cb/cUSTC ? 1,400 yrs; cLUNC/USDT ? 207k yrs; CL8Y-cb/cLUNC ? 147k yrs; CL8Y-cb/ALPHA ? 686k yrs), and all 6/6 pairs are ~10?��% of max. UST1/USTR is uniquely fast because USTR is a low-value 18-dec token, so its raw reserve dwarfs the 6-dec side. **One de-risk before the live migrate:** the stored `price_a_cumulative` on this pair is already at ~3.4e38 in the *old* u128 encoding. The #1323 zero-extension has to read that pre-saturated value cleanly. The current ACs verify `Observe` + a swap on the live pair *after* migrate - worth adding a LocalTerra/unit step that seeds an `OBSERVATIONS` entry at/near `u128::MAX`, migrates cw2 ? 1.18.0, and asserts `Observe [0,N]` + swap/provide/withdraw succeed. That proves the migrate handles an already-saturated pair before it's run against the live one, rather than finding out on columbus-5. Since this is founder-required (no auto-land), flagging for scheduling of the 2-of-3 migrate. Happy to re-verify `Observe` returns and a small reserve move lands on UST1/USTR immediately after the wasm is live.

PlasticDigits referenced this issue

2026-09-24 09:15:36 +00:00

security(oracle): price_times_dt overflow still bricks pair after #465 skip #1224

PlasticDigits referenced this issue

2026-09-24 09:21:08 +00:00

contracts: greedy opt-out default on pair Swap + router TerraSwap #718

PlasticDigits referenced this issue

2026-09-24 09:28:43 +00:00

pair oracle: price_a_cumulative can saturate u128, permanently bricking observe() (and likely swaps) on a live pair #1322

~~PlasticDigits referenced this issue 2026-09-24 09:36:00 +00:00~~

fix(pair): migrate must backfill DISCOUNT_REGISTRY and ORACLE_STATE #1232

PlasticDigits referenced this issue

2026-09-24 09:38:59 +00:00

fix(pair): migrate must backfill DISCOUNT_REGISTRY and ORACLE_STATE #1232

PlasticDigits referenced this issue

2026-09-24 09:39:31 +00:00

docs(oracle): clarify TWAP rollout and migration preflight #1339

PlasticDigits referenced this issue

2026-09-24 09:48:56 +00:00

docs(pair): document migration backfill gap #1346

PlasticDigits commented

2026-09-24 09:49:16 +00:00

Author

Owner

Verified and closed on 2026-09-24. No newer issue tracks remaining #1324 acceptance work.

Columbus-5 lists 21/21 pairs on code 11676 / cw2 1.18.0; factory remains code 11629 / cw2 1.10.0. The read-only probe passes. UST1/USTR has 360 stored observations; Observe([0,60]) returns both offsets, including a cumulative above u128::MAX. The {} migrate path does not write OBSERVATIONS.
A successful UST1→USTR swap is indexed at block 30535152 (6.866855 UST1 in, 986.999440591662043534 USTR out). /gt/events shows changed post-event reserves between blocks 30535127 and 30535152.
Coolify reports healthy indexer/frontend apps; their latest finished deployments descend from c17e71d3 (indexer ed3b22f, frontend 54c4868). The daily evidence API returned 200; UST1/ALPHA candles expose usd_leg=asset_1 and subject OHLC, and the production chart bundle contains usd_leg.
make verify-issue-1324 passed all three guards.

Related: #1224, #1322, merged PR #1323, and #1315. #1232 remains separate; #465/#1231 behavior is unchanged. Runbook: docs/runbooks/pair-twap-uint256-columbus5.md; third-party agent guidance: skills/AGENTS_PAIR_TWAP_MIGRATION.md.

Verified and closed on 2026-09-24. No newer issue tracks remaining #1324 acceptance work. - Columbus-5 lists 21/21 pairs on code 11676 / cw2 1.18.0; factory remains code 11629 / cw2 1.10.0. The read-only probe passes. UST1/USTR has 360 stored observations; `Observe([0,60])` returns both offsets, including a cumulative above `u128::MAX`. The `{}` migrate path does not write `OBSERVATIONS`. - A successful UST1→USTR swap is indexed at block 30535152 (6.866855 UST1 in, 986.999440591662043534 USTR out). `/gt/events` shows changed post-event reserves between blocks 30535127 and 30535152. - Coolify reports healthy indexer/frontend apps; their latest finished deployments descend from `c17e71d3` (indexer `ed3b22f`, frontend `54c4868`). The daily evidence API returned 200; UST1/ALPHA candles expose `usd_leg=asset_1` and subject OHLC, and the production chart bundle contains `usd_leg`. - `make verify-issue-1324` passed all three guards. Related: [#1224](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/1224), [#1322](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/1322), [merged PR #1323](https://git.cl8y.com/code/cl8y-dex-terraclassic/pulls/1323), and [#1315](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/1315). #1232 remains separate; #465/#1231 behavior is unchanged. Runbook: `docs/runbooks/pair-twap-uint256-columbus5.md`; third-party agent guidance: `skills/AGENTS_PAIR_TWAP_MIGRATION.md`.

PlasticDigits closed this issue

2026-09-24 09:49:17 +00:00

PlasticDigits referenced this issue

2026-09-24 10:28:07 +00:00

ops: verify Columbus-5 pair TWAP migration #1349