fix(limits): hybrid limit place and fill must not under-estimate gas #1329

New issue

Closed

opened 2026-09-23 11:05:59 +00:00 by PlasticDigits · 1 comment

PlasticDigits commented

2026-09-23 11:05:59 +00:00

Owner

Summary

Terra Classic limit orders that use the hybrid AMM plus order-book path still fail often enough that traders fall back to manual gas edits. Reported failures on that path are a wasm or gas-estimate under-run, a “not enough credit” reject, and a pool_input + book_input execute failure. Place, fill, and cancel need to succeed on the common routes without a hand-tuned gas limit.

This is the retail limit path (LUNC, UST1, USTR, cUSTC), not a new order type.

Not duplicates

Issue	Why it is not this ticket
#1280	Closed. Hybrid swap split must equal the hop offer. Not limit place/fill/cancel.
#1227	Closed. Price update relinks FIFO.
#1219	Closed. Dust-rung overflow.
#1203	Open research on splitting one swap across paths. A different split.

Expected / actual

Expected: Limit place, fill, and cancel on those routes complete with the dApp gas envelope and a clear error when the book or pool cannot take the size.
Actual: The hybrid path under-estimates gas, rejects for credit, or fails the pool-plus-book split, and people work around it by editing gas.

Given / When / Then

Given a hybrid limit on a common LUNC, UST1, USTR, or cUSTC route,

When the trader places, fills, or cancels without editing gas,

Then the message succeeds when the book and pool can take it, and a rejected size returns a specific error instead of an under-estimate toast or a raw pool_input / book_input failure.

Acceptance criteria

Reproduce each of the three failure classes on columbus-5 (or show which one is already gone) and name the layer: envelope, credit check, or split execute.
Fix that layer. Do not add a manual gas field to the form.
Regression test the hybrid place and cancel path for at least one of those routes.

Test plan

Contract or frontend test that a hybrid limit message’s gas limit sits above measured use.
A case that returns a clear error for an unsized or unfilled remainder instead of a generic execute failure.

Attack / abuse

A user-supplied gas or credit field in the query string must not be signed.
A failing split must not leave a partial fill that the indexer reports as fully filled.

Verification

Place and cancel one hybrid limit on a common route with no gas edit and no under-estimate toast.
The three named failures are either gone or mapped to a specific, tested error.

First-pass model recommendation

Recommendation: grok-high

The path crosses the pair contract, the gas envelope, and retail execute. That is wasm plus wallet scope.

## Summary Terra Classic limit orders that use the hybrid AMM plus order-book path still fail often enough that traders fall back to manual gas edits. Reported failures on that path are a wasm or gas-estimate under-run, a “not enough credit” reject, and a `pool_input` + `book_input` execute failure. Place, fill, and cancel need to succeed on the common routes without a hand-tuned gas limit. This is the retail limit path (LUNC, UST1, USTR, cUSTC), not a new order type. ## Not duplicates | Issue | Why it is not this ticket | | --- | --- | | [#1280](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/1280) | Closed. Hybrid **swap** split must equal the hop offer. Not limit place/fill/cancel. | | [#1227](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/1227) | Closed. Price update relinks FIFO. | | [#1219](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/1219) | Closed. Dust-rung overflow. | | [#1203](https://git.cl8y.com/code/cl8y-dex-terraclassic/issues/1203) | Open research on splitting one swap across paths. A different split. | ## Expected / actual - **Expected:** Limit place, fill, and cancel on those routes complete with the dApp gas envelope and a clear error when the book or pool cannot take the size. - **Actual:** The hybrid path under-estimates gas, rejects for credit, or fails the pool-plus-book split, and people work around it by editing gas. ## Given / When / Then **Given** a hybrid limit on a common LUNC, UST1, USTR, or cUSTC route, **When** the trader places, fills, or cancels without editing gas, **Then** the message succeeds when the book and pool can take it, and a rejected size returns a specific error instead of an under-estimate toast or a raw `pool_input` / `book_input` failure. ## Acceptance criteria - Reproduce each of the three failure classes on columbus-5 (or show which one is already gone) and name the layer: envelope, credit check, or split execute. - Fix that layer. Do not add a manual gas field to the form. - Regression test the hybrid place and cancel path for at least one of those routes. ## Test plan - Contract or frontend test that a hybrid limit message’s gas limit sits above measured use. - A case that returns a clear error for an unsized or unfilled remainder instead of a generic execute failure. ## Attack / abuse - A user-supplied gas or credit field in the query string must not be signed. - A failing split must not leave a partial fill that the indexer reports as fully filled. ## Verification - Place and cancel one hybrid limit on a common route with no gas edit and no under-estimate toast. - The three named failures are either gone or mapped to a specific, tested error. ## First-pass model recommendation Recommendation: grok-high The path crosses the pair contract, the gas envelope, and retail execute. That is wasm plus wallet scope.

PlasticDigits added the

bug

label

2026-09-23 11:06:15 +00:00

PlasticDigits referenced this issue

2026-09-23 16:29:52 +00:00

fix(limits): budget gas for insertion walks #1331

PlasticDigits referenced this issue

2026-09-24 09:28:12 +00:00

fix(swap): CL8Y to UST1 hits the gas-estimate under-run #1328

PlasticDigits commented

2026-09-24 09:47:22 +00:00

Author

Owner

Verified the fix merged through PR #1331. The tested commit a1028f34 is an ancestor of current origin/main.

make verify-issue-1329: 212 frontend tests, four contract regressions, and documentation cross-links passed.
After make setup-cloud-localterra, VERIFY_ISSUE_1329_CHAIN=1 make verify-issue-1329 passed all three LocalTerra E2E cases. LCD gas_used/gas_wanted: hybrid fill 784796/1785500, place 666598/4380000, cancel 436960/1000000.
Regression coverage confirms message-shaped step-aware gas and matching LUNC preflight, ignores URL gas / credit, rejects mismatched hybrid splits, and rolls back a book fill when the pool cannot take its remainder.

The invariants and cross-links are documented in limit-orders, frontend, security invariant L25, testing, and the third-party hybrid limit gas playbook.

Remaining operator verification: signed Columbus-5 place, partial hybrid fill, and cancel. This is tracked by the queued cl8y-pm card “Verify hybrid limit flow on Columbus-5” (ID 397a9612-7a49-4b0f-84bc-450fd62e04ed; PM inbox); the card body links this issue and records the transaction links. LocalTerra results are not Columbus-5 production sign-off.

Verified the fix merged through [PR #1331](https://git.cl8y.com/code/cl8y-dex-terraclassic/pulls/1331). The tested commit `a1028f34` is an ancestor of current `origin/main`. - `make verify-issue-1329`: 212 frontend tests, four contract regressions, and documentation cross-links passed. - After `make setup-cloud-localterra`, `VERIFY_ISSUE_1329_CHAIN=1 make verify-issue-1329` passed all three LocalTerra E2E cases. LCD `gas_used/gas_wanted`: hybrid fill `784796/1785500`, place `666598/4380000`, cancel `436960/1000000`. - Regression coverage confirms message-shaped step-aware gas and matching LUNC preflight, ignores URL `gas` / `credit`, rejects mismatched hybrid splits, and rolls back a book fill when the pool cannot take its remainder. The invariants and cross-links are documented in [limit-orders](https://git.cl8y.com/code/cl8y-dex-terraclassic/src/branch/main/docs/limit-orders.md), [frontend](https://git.cl8y.com/code/cl8y-dex-terraclassic/src/branch/main/docs/frontend.md), [security invariant L25](https://git.cl8y.com/code/cl8y-dex-terraclassic/src/branch/main/docs/contracts-security-audit.md), [testing](https://git.cl8y.com/code/cl8y-dex-terraclassic/src/branch/main/docs/testing.md), and the third-party [hybrid limit gas playbook](https://git.cl8y.com/code/cl8y-dex-terraclassic/src/branch/main/skills/AGENTS_HYBRID_LIMIT_GAS.md). Remaining operator verification: signed Columbus-5 place, partial hybrid fill, and cancel. This is tracked by the queued cl8y-pm card **“Verify hybrid limit flow on Columbus-5”** (ID `397a9612-7a49-4b0f-84bc-450fd62e04ed`; [PM inbox](https://pm.cl8y.com/inbox)); the card body links this issue and records the transaction links. LocalTerra results are not Columbus-5 production sign-off.

PlasticDigits closed this issue

2026-09-24 09:47:26 +00:00