research: UST1 collateral — Noble USDC ~3.5% yield vs Venus vFDUSD 6–8% APR (depeg, bank-run, protocol incidents) #575

New issue

Closed

opened 2026-08-19 11:49:55 +00:00 by PlasticDigits · 9 comments

PlasticDigits commented

2026-08-19 11:49:55 +00:00

(Migrated from gitlab.com)

Summary

Research / decision only — do not implement a collateral switch in this issue.

Bundle into one investigation (do not split yield vs depeg vs protocol-incident tickets):

Feasibility of using USDC + ~3.5% liquid-staking / yield-bearing dollar on Noble (typically USDN / Noble Dollar, minted against native Noble USDC via M^0) as the UST1 window / treasury backing asset.
Comparison against the current live path: Venus vFDUSD on BSC, whose headline 6–8% average annual APR is a claim to verify, not a number to bake into copy or oracles.
Historical bank-run and depeg records for USDC and FDUSD.
Incremental risk of Noble / M^0 yield mechanics vs Venus Core Pool staking (vToken exchangeRate accrual), including protocol incidents.

Related live work: #502 (Phase 4 window + wrap), #506 (/ust1 vFDUSD↔UST1), #503 (ops / Venus-pause trigger), #508 (secondary UST1 AMM), #515 / #550 (CEX FDUSD labeled vFDUSD), #571 / #572 (Protocol Venus redeem rate — display only). IBC-hooks gate: #407.

Not in scope: shipping a USDC/USDN CW20, changing ust1-window allowlist U5, adding indexer ticker usdc, opening IBC/CCTP from the dApp, or marketing a guaranteed APR.

Current codebase

CL8Y’s economic dollar-ish hub is UST1, minted/redeemed only against bridged Venus FDUSD (vFDUSD) through the ust1-window. There is no USDC, Noble, USDN, CCTP, or IBC receive path in this repo.

Layer	Behavior today
Window (settlement)	`/ust1` deposit pay token = vFDUSD only; withdraw pay = UST1 only (U5). Execute is CW20 `Send` to ust1-window, not the AMM router (U3). Quotes from on-chain `effective_swap` (U4).
Mainnet addresses	vFDUSD `terra1mnl9azefrqpmu888ar2u6zrcwr80hxlt3avf4300r576cw5ar7esvxsvj3`; UST1 `terra1f0eqgy9w7e5e7up97vjudqwx38tesf8ylx75x2lv3nwm0clry0pqmgfy72`; window `terra1zxwpzpzpleatqn39r00grau4yt29sld8pw78s7ktvjafnj5nsaxq0h3rh2`; oracle `terra1fmht0t6svq3n24zx03nkfja0m40zhfyyxkdcvlrkl6u7gfe6aagq4gch8n`. Params: `fee_bps=100`, per-tx 1000 UST1, rolling 24h 10000 UST1.
Token identity	Tokenlist name Venus FDUSD (bridged), 6 decimals. This is a bridged Venus vToken, not naked FDUSD and not USDC.
Venus (BSC)	Canonical Core Pool vFDUSD `0xC4eF4229FEc74Ccfe17B2bdeF7715fAC740BA0ba`; underlying FDUSD `0xc5f0f7b66764F6ec8C8Dff7BA683102295E16409`. Yield is vToken exchange-rate accrual (borrower interest ± incentives), not a lockup stake. This repo does not poll Venus today (planned display-only in #571/#572).
Treasury / capacity	CMM treasury vFDUSD balance + allowance to the window bound UST1 withdraw capacity (O4). Health: `scripts/check-ust1-wrap-ops-health.sh`.
Incident control	Prefer ust1-oracle `set_paused` when Venus/BSC rate integrity is suspect; window `set_paused` for window-local maintenance (O3 / runbook A2). Wrap-stack governance `terra1xsecn4…` ≠ DEX multisig (O6).
Indexer CEX	`OracleTicker::Vfdusd` polls FDUSD (MEXC `FDUSDUSDT`, CoinGecko `first-digital-usd`). Path `/api/v1/oracle/price/vfdusd`. X4: never used for DEX `volume_usd`. P550-9 / X5: not `$1`, not the window rate. No `usdc` ticker.
Secondary AMM	Preferred UST1/vFDUSD; live UST1/cUSTC and UST1/USTR exist. Factory rejects native `uusd`/`uluna` as pair assets.
CW20 policy	`cw20-whitelist-policy.md`: rebase / elastic-supply / balance-mutating tokens are forbidden as pair/escrow assets (pair credits declared transfer amounts, not balance deltas). A yield-bearing USDN-style rebase CW20 cannot be a factory pair leg without a non-rebasing wrapper.
IBC	DEX wasm has no `ibc_receive` / ack / timeout (SEC-D02/D03, `make verify-no-ibc-hooks-in-contracts`). Bridging Noble USDC/USDN onto Classic would be a new chain + bridge + wrap program, not a tokenlist edit.
CSP	Browser `connect-src` is LCD/RPC/indexer + WalletConnect. Must not call BSC, Noble, Circle, or Venus HTTP from the dApp.
Copy / NFA	Retail copy skill #489; first-visit risk modal #138. APR must not be presented as a guaranteed return.

Yield figures in the title are hypotheses. Spot-check (2026-08, public third-party, must be re-dated in the memo): Venus Core Pool FDUSD supply APY has printed well below 6–8% on some aggregators (single-digit / ~1% band); Noble Dollar (USDN) marketing has printed ~3.3–4.3% (T-bill / M^0 index, variable). The investigation must replace 3.5% and 6–8% with sourced time series, not treat them as constants.

Why this is needed

UST1 inherit’s the backing stack. Window inventory, treasury allowance, and (if seeded) UST1/vFDUSD AMM all sit on Venus vFDUSD → FDUSD → First Digital reserves. A collateral switch to USDC → Noble/USDN → Circle + M^0 changes issuer, chain, oracle, pause playbooks, and bank-run contagion — not just APR.
Headline APR is the wrong ranking function. 6–8% vs 3.5% ignores utilization/redeem liquidity (Venus), T-bill rate path (USDN), depeg convexity, Circle freeze, IBC/CCTP, and CL8Y rebase-token ban. Operators need a risk-adjusted comparison before any product ADR.
Both stables have already depegged in public markets. USDC (~~$0.87, Mar 2023, SVB reserve freeze) and FDUSD (~~$0.87–$0.91, Apr 2025, issuer-insolvency allegation) are not theoretical. UST1 mint at a stale window rate during a depeg is an inventory + solvency event (O4, oracle pause).
Staking/yield layers add protocol risk on top of issuer risk. Venus has a documented incident history (XVS oracle/liquidity 2021 bad debt; LUNA oracle stall 2022; wUSDM donation / ERC-4626 2024–25; THE donation/cap bypass 2026 class). Noble/USDN adds M^0 module, T-bill wrapper, and Cosmos IBC/CCTP surface that this DEX does not run today.
Without a written go/no-go, agents will “helpfully” add USDC tickers, fake $1 pegs, or rebase pair legs — the same class of mix-up #515 / P550-9 already forbids.

Constraints / guardrails

Research deliverable only. Default outcome is an ADR + risk memo. No factory CreatePair, no window allowlist change, no Coolify VITE_USDC_*, no indexer usdc/usdn ticker, no IBC module in DEX wasm.
Do not hardcode $1 for USDC, FDUSD, vFDUSD, USDN, or UST1 (X5 / P550-9). Peg history is part of the answer.
Do not treat APR as settlement. Window rate stays effective_swap; CEX feeds stay advisory; Venus exchangeRateStored (if cited) is redeem FDUSD-out, not USD.
Keep oracles unconfused. CEX FDUSD ≠ Venus vToken rate ≠ UST1 window ≠ pair TWAP ≠ Circle USDC ≠ Noble USDN index.
Rebase / yield-accruing CW20 cannot be a pair or limit-escrow asset (cw20-whitelist-policy.md). If USDN rebases, the memo must say wrapper required or window-only, never AMM leg.
Do not open IBC or CCTP from the frontend. CSP + SEC-D02 stand. Any “how would USDC arrive on Classic?” section is architecture, not a deploy plan in this issue.
Do not widen CW20 whitelist to “try USDC” (O7).
Pause remains fail-closed. Research must map each incident class to oracle pause vs window pause vs wrap pause — not “wait for peg to recover while mint stays live.”
Copy / NFA. No “earn 6–8% risk-free on UST1.” Any user-facing sentence in the memo is labeled non-promissory.
Primary sources over blogs. Issuer attestations, on-chain market contracts, Circle/First Digital/Noble/M^0 docs, Venus post-mortems, Fed/FDIC notes. Aggregator APYs need timestamp + method (supply APY vs incentive vs 30d avg).
Upstream repos. Window/oracle live in ust1-window; wrap in ustr-cmm. This issue does not mutate those contracts.
No exploit PoCs, payloads, or attack scripts — describe vectors and historical incidents; do not reproduce them.

Relevant files

Path	Role
`docs/runbooks/ust1-window-ui.md`	U1–U8; vFDUSD-only window
`docs/runbooks/ust1-wrap-production-ops.md`	O1–O8; Venus/BSC → oracle pause
`deployments/mainnet-ust1-wrap/REGISTRY.md`	Canonical columbus-5 addresses
`docs/runbooks/cw20-whitelist-policy.md`	Rebase / FoT ban
`docs/runbooks/indexer-external-oracle.md`	CEX FDUSD as `vfdusd`; X1–X6
`docs/security-model.md`	SEC-D02 IBC-hooks
`docs/exploit-replay-matrix.md`	Historical incident template
`docs/adr/0001-hybrid-quoting-and-routing.md`	ADR format to copy
`frontend-dapp/src/pages/Ust1Page.tsx`	`/ust1` UI
`frontend-dapp/src/services/terraclassic/ust1Window.ts`	`effective_swap` + CW20 Send
`frontend-dapp/src/utils/ust1WindowGates.ts`	Pause / stale / limit gates
`frontend-dapp/src/utils/tokenRegistry.ts`	vFDUSD identity
`tokenlist/tokenlist.json`	Listed CW20s
`indexer/src/indexer/oracle.rs`	FDUSD CEX poller
`scripts/check-ust1-wrap-ops-health.sh`	Inventory / pause / oracle age
`docs/runbooks/ust1-secondary-amm-pair.md`	UST1/vFDUSD AMM
`skills/AGENTS_UST1_WINDOW_UI.md`	Agent window rules
`skills/AGENTS_UST1_WRAP_PRODUCTION_OPS.md`	Agent ops rules
`skills/AGENTS_INDEXER_EXTERNAL_ORACLE.md`	Do not alias `fdusd`/`usdc`
`docs/frontend.md`	P550-9, `/ust1` vs `/mint`
new: `docs/adr/0004-ust1-collateral-usdc-noble-vs-vfdusd.md` (suggested)	Decision memo

Upstream (read-only for this issue): ust1-window effective_swap / oracle updater; ustr-cmm treasury + wrap-mapper.

Recommended direction

Write ADR docs/adr/0004-ust1-collateral-usdc-noble-vs-vfdusd.md (Status: Proposed) plus a short pointer from docs/README.md Architecture. Optional agent skill stub only if the ADR is accepted later.

Decompose each option into a risk stack (do not compare “USDC” vs “vFDUSD” as single tokens):

Layer	Status quo	Alternative under study
Issuer / reserves	First Digital / FDUSD	Circle / USDC
Bank / custodian	FDUSD trust / T-bill claims	Circle banks + T-bills (SVB-class)
Yield venue	Venus Core Pool (BSC) vToken	Noble USDN / M^0 T-bill index (~3.5% claim)
Receipt token	vFDUSD (exchange-rate)	USDN or staked USDC derivative
Bridge to Classic	Existing bridged CW20	Noble IBC + CCTP + new wrap (greenfield)
CL8Y settlement	ust1-window vFDUSD↔UST1	New allowlist / new window / dual inventory

Required memo sections
- Yield: dated supply APY vs incentive vs 30/90/365d realized; utilization; redeem queue; USDN index vs advertised 3.5%.
- Depeg / bank-run chronology (min. USDC Mar 2023 SVB; FDUSD Apr 2025 allegation + any earlier FDUSD prints; DAI/USDP contagion as second-order). Depth, duration, primary-market halt vs secondary only, recovery path (Fed backstop vs issuer PR).
- Protocol incidents: Venus (2021 XVS, 2022 LUNA oracle, 2024–26 donation/ERC-4626/cap-bypass class) and Noble/M^0/USDN (audits, pauses, IBC incidents — explicitly “none found” if so, with search log).
- CL8Y blast radius: window mint at stale rate; treasury drain; AMM LP; indexer $1 lie; retail APR copy.
- Scorecard: issuer, depeg convexity, redeem liquidity, smart-contract, bridge/IBC, rebase-compat, ops pause mapping, regulatory/freeze (Circle blacklist vs FDUSD), implementation cost on Classic.
- Decision: Stay on vFDUSD / Reject Noble USDC for UST1 / Defer / Dual-inventory (explicitly disallowed unless justified). Dual backing without a new product spec is a fail.
If the ADR ever recommends a switch, spawn follow-up implementation issues (window, oracle, treasury, indexer tickers, AMM, Coolify, pause runbooks). Do not sneak them into this MR.
Verify script scripts/qa/verify-issue-NNN.sh: required ADR headings present; no VITE_USDC / indexer usdc ticker introduced by the same MR unless the ADR status is Accepted and a linked implementation issue exists (this issue’s MR should be docs-only).

Acceptance criteria

AC1. One ADR (or equivalent memo) in-repo covering both stacks; yield, depegs, and protocol incidents are not split across issues.
AC2. Title APR claims (3.5% vs 6–8%) are replaced or falsified with dated primary/aggregator sources and methodology (supply APY vs incentives vs realized).
AC3. USDC depeg/bank-run: at least SVB 2023-03 (Circle ~$3.3B / ~8% reserves frozen; secondary ~$0.87; primary halt; recovery via US systemic-risk exception) with citations.
AC4. FDUSD depeg/bank-run: at least 2025-04 issuer-insolvency allegation print (~$0.87–$0.91 band, duration, supply response) with citations; any additional FDUSD events in the search window listed or marked none.
AC5. Venus incident table with dates, mechanism, bad-debt/loss band, and whether Core Pool vFDUSD was directly in the blast radius (in-scope vs “other market / other chain”).
AC6. Noble / M^0 / USDN / CCTP / IBC risk table (module, redemption, freeze, bridge); gaps called out as unknown, not assumed safe.
AC7. Explicit mapping onto CL8Y invariants U5, O3, O4, O7, X4, X5, P550-9, SEC-D02, and the rebase/FoT whitelist ban.
AC8. Scorecard + single product decision (stay / reject / defer) with residual risks. No “quietly add USDC later.”
AC9. Docs-only MR for this issue: no window/oracle/indexer ticker/factory whitelist change.
AC10. docs/README.md (or runbook) links the ADR; NFA / non-promissory language on any APR.
AC11. Follow-up implementation issues listed only if decision ≠ stay; otherwise “no impl spawn.”

Test plan (all research paths)

These are document and process tests, not chain deploys. Each path must appear in the ADR (or an appendix checklist) with pass/fail.

ID	Path	How to test
P1 Status quo stack	vFDUSD = Venus vToken bridged CW20; window U5; CEX feed is FDUSD	Trace addresses from `REGISTRY.md` + tokenlist + `oracle.rs`; confirm no USDC symbol in window client
P2 Yield — Venus	Supply APY vs borrow utilization vs XVS/incentive vs 30/90d	Snapshot Core Pool vFDUSD `supplyRatePerBlock` / UI APY with UTC timestamp; state whether 6–8% is current, historical, or marketing
P3 Yield — Noble	USDC vs USDN vs “liquid staking” naming	Identify the exact instrument (USDN mint vs a third-party staker); T-bill index vs advertised 3.5%; lockup vs liquid
P4 Depeg — USDC	SVB 2023 chronology	Primary: Circle disclosure, Fed/FDIC notes; min/max print; hours to re-peg; whether `blacklist`/`pause` fired (historical: market depeg, not a contract pause)
P5 Depeg — FDUSD	2025-04 and others	Primary: issuer statements + CEX prints; duration; redemption halt?; supply change
P6 Venus incidents	2021 / 2022 / 2024–26 class	Official post-mortems preferred; tag Core vs Isolated vs zkSync; vFDUSD market affected Y/N
P7 Noble/M^0 incidents	Audits + pauses + IBC	Search log (dates, queries); “none found” allowed only with log
P8 Bridge/IBC	How USDC would reach Classic	CCTP → Noble → IBC → wrap; contrast with current vFDUSD bridge; SEC-D02 no DEX IBC entry points
P9 Rebase compatibility	USDN/vToken as pair asset	Apply whitelist policy: exchange-rate vToken bridged as static CW20 vs rebasing USDN; window-only vs AMM
P10 Ops mapping	Each incident class → pause lever	Oracle pause vs window pause vs wrap pause vs do-nothing; cite A / A2 runbook
P11 Indexer/UI lie	`$1` or wrong ticker	Confirm ADR forbids `usdc` alias to `vfdusd` and forbids hard peg
P12 Dual inventory	Two backing assets in one window	Show why dual mint without new product spec fails U5 / O4; reject or specify a new window
P13 Retail copy	APR on `/ust1` or `/protocol`	Any sample sentence checked against #489 / NFA modal; no guaranteed yield
P14 Decision close-out	Stay vs switch	One checked option; residual risk list; impl issues only if switch

Negative / skip paths

N1. Memo that only compares “USDC is safer than FDUSD” without Venus vs Noble yield layers → fail.
N2. Memo that ranks solely on APR → fail.
N3. Implementation diff (new ticker, pair, env) in the research MR → fail AC9.
N4. Using /ust1 effective_swap as a Venus or USDC USD price → fail.

Test plan — attack, hack, and abuse vectors

Research must evaluate each vector against both stacks and against today’s UST1/vFDUSD blast radius. Do not write exploits, PoCs, or attack procedures.

ID	Vector	What the memo must show	Fail if
A1 Issuer/bank run	SVB-style reserve freeze; FDUSD insolvency allegation	Primary vs secondary market; UST1 mint still open?	Treats depeg as “temporary noise” with window left live
A2 Redemption halt	Circle/First Digital pause primary redeem; CEX conversion halt	Window + treasury still quote 1:1 via stale oracle	No pause mapping
A3 Circle freeze/blacklist	USDC address freeze / contract pause	Noble USDC + CCTP + any Classic wrap inherit freeze	Ignores centralized freeze that FDUSD/vToken also may have in other forms
A4 Venus utilization run	High utilization → vFDUSD redeem of FDUSD illiquid	O4 withdraw capacity; UST1 holders cannot exit to FDUSD	Counts 6–8% APR without redeem-liquidity stress
A5 Venus oracle / donation / bad debt	Historical XVS, LUNA stall, ERC-4626 donation, supply-cap bypass	Whether vFDUSD exchangeRate or FDUSD cash can be skewed; pause A2	“Venus is battle-tested” without incident table
A6 Exchange-rate manipulation	Donate-to-vault / share inflation (wUSDM class)	vToken vs USDN index; bridged CW20 may not rebase with Venus	Assumes bridged vFDUSD exchangeRate tracks BSC 1:1 without evidence
A7 Noble/M^0 module bug	Mint/redeem halt, index freeze, wrong yield	Audits + admin keys + pause	Assumes T-bill wrapper cannot fail
A8 IBC/CCTP bridge	Packet timeout, fake denom, hooks re-entry on peer chains	DEX has no IBC entry; bridged token still toxic in pools (SEC-D02)	Adds IBC callbacks to DEX “to support USDC” in this issue
A9 Rebase pair insolvency	Yield token as AMM/limit asset	Whitelist ban; LP/escrow desync	Recommends listing rebasing USDN as factory pair
A10 Fake token / ticker alias	Spoof `symbol=USDC` / path `/price/usdc` → vfdusd	Same class as forbidden `fdusd` alias (X2)	Proposes aliasing tickers
A11 Stale window mint during depeg	Oracle still updating a CEX print while issuer is halted	O2 (do not disable age checks); pause vs keep minting	“Keep minting, arb will fix it”
A12 Treasury drain / bank-run on UST1	Race to withdraw vFDUSD while FDUSD depegged	Inventory monitors; per-tx / 24h caps are not peg defense	Treats 1000/10k caps as sufficient peg insurance
A13 Governance social engineering	“Emergency add USDC code ID / dual window”	O7; 2-of-3 vs wrap-stack split O6	Recommends panic whitelist widen
A14 Retail APR fraud / phishing	Fake “stake UST1 for 8%” copy or scam site	NFA; no APR CTA on `/ust1` from this research	Adds yield badge to window UI
A15 Indexer DoS / feed injection	Poison USDC/FDUSD CEX or future Venus RPC	Soft-fail; X5 advisory; CSP no browser RPC	Live-scan Noble/BSC from the browser
A16 Regulatory seizure	Issuer or custodian freeze	Compare Circle (US) vs First Digital (HK) vs M^0 T-bill vehicle	Single-jurisdiction handwave

Verification criteria

Issue is done when all of the following hold:

ADR docs/adr/0004-ust1-collateral-usdc-noble-vs-vfdusd.md (or the path named in the MR) is merged with AC1–AC11.
scripts/qa/verify-issue-<iid>.sh exists and is wired in the Makefile (verify-issue-<iid>): greps required headings (Yield, USDC depeg, FDUSD depeg, Venus incidents, Noble/M0, Scorecard, Decision); greps ADR for U5 / O4 / X5 / rebase ban; fails if indexer grows an usdc ticker or frontend grows VITE_USDC in the same research MR.
make verify-issue-<iid> passes on the docs MR.
GitLab issue comment records: decision string (stay / reject Noble USDC for UST1 / defer), date of yield snapshots, and links to citations (no secrets).
Existing gates still pass unchanged: make verify-issue-506, make verify-issue-503 (docs grep), make verify-issue-515 / 550 if oracle docs were only cross-linked — no behavior change.
No mainnet txs, no whitelist change, no Coolify env for USDC.

Out of scope for “done”: implementing USDC/Noble, changing Venus pollers (#571/#572), seeding UST1/vFDUSD AMM (#508), or pausing the window.

## Summary **Research / decision only — do not implement a collateral switch in this issue.** Bundle into **one** investigation (do not split yield vs depeg vs protocol-incident tickets): 1. Feasibility of using **USDC + ~3.5% liquid-staking / yield-bearing dollar on Noble** (typically **USDN / Noble Dollar**, minted against native Noble USDC via M^0) as the UST1 window / treasury backing asset. 2. Comparison against the **current live path: Venus vFDUSD on BSC**, whose headline **6–8% average annual APR** is a **claim to verify**, not a number to bake into copy or oracles. 3. Historical **bank-run and depeg** records for **USDC** and **FDUSD**. 4. Incremental risk of **Noble / M^0 yield mechanics** vs **Venus Core Pool staking** (vToken `exchangeRate` accrual), including **protocol incidents**. Related live work: [#502](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/502) (Phase 4 window + wrap), [#506](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/506) (`/ust1` vFDUSD↔UST1), [#503](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/503) (ops / Venus-pause trigger), [#508](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/508) (secondary UST1 AMM), [#515](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/515) / [#550](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/550) (CEX FDUSD labeled vFDUSD), [#571](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/571) / [#572](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/572) (Protocol Venus redeem rate — display only). IBC-hooks gate: [#407](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/407). **Not in scope:** shipping a USDC/USDN CW20, changing `ust1-window` allowlist **U5**, adding indexer ticker `usdc`, opening IBC/CCTP from the dApp, or marketing a guaranteed APR. --- ## Current codebase CL8Y’s economic dollar-ish hub is **UST1**, minted/redeemed **only** against bridged **Venus FDUSD (vFDUSD)** through the **ust1-window**. There is **no** USDC, Noble, USDN, CCTP, or IBC receive path in this repo. | Layer | Behavior today | |-------|----------------| | **Window (settlement)** | `/ust1` deposit pay token = **vFDUSD only**; withdraw pay = **UST1 only** (**U5**). Execute is CW20 `Send` to ust1-window, **not** the AMM router (**U3**). Quotes from on-chain `effective_swap` (**U4**). | | **Mainnet addresses** | vFDUSD `terra1mnl9azefrqpmu888ar2u6zrcwr80hxlt3avf4300r576cw5ar7esvxsvj3`; UST1 `terra1f0eqgy9w7e5e7up97vjudqwx38tesf8ylx75x2lv3nwm0clry0pqmgfy72`; window `terra1zxwpzpzpleatqn39r00grau4yt29sld8pw78s7ktvjafnj5nsaxq0h3rh2`; oracle `terra1fmht0t6svq3n24zx03nkfja0m40zhfyyxkdcvlrkl6u7gfe6aagq4gch8n`. Params: `fee_bps=100`, per-tx **1000** UST1, rolling 24h **10000** UST1. | | **Token identity** | Tokenlist name **Venus FDUSD (bridged)**, 6 decimals. This is a bridged **Venus vToken**, not naked FDUSD and not USDC. | | **Venus (BSC)** | Canonical Core Pool vFDUSD `0xC4eF4229FEc74Ccfe17B2bdeF7715fAC740BA0ba`; underlying FDUSD `0xc5f0f7b66764F6ec8C8Dff7BA683102295E16409`. Yield is **vToken exchange-rate accrual** (borrower interest ± incentives), **not** a lockup stake. This repo does **not** poll Venus today (planned display-only in #571/#572). | | **Treasury / capacity** | CMM treasury vFDUSD **balance + allowance to the window** bound UST1 withdraw capacity (**O4**). Health: `scripts/check-ust1-wrap-ops-health.sh`. | | **Incident control** | Prefer **ust1-oracle `set_paused`** when Venus/BSC rate integrity is suspect; window `set_paused` for window-local maintenance (**O3** / runbook A2). Wrap-stack governance `terra1xsecn4…` ≠ DEX multisig (**O6**). | | **Indexer CEX** | `OracleTicker::Vfdusd` polls **FDUSD** (MEXC `FDUSDUSDT`, CoinGecko `first-digital-usd`). Path `/api/v1/oracle/price/vfdusd`. **X4:** never used for DEX `volume_usd`. **P550-9 / X5:** not `$1`, not the window rate. No `usdc` ticker. | | **Secondary AMM** | Preferred UST1/vFDUSD; live UST1/cUSTC and UST1/USTR exist. Factory rejects native `uusd`/`uluna` as pair assets. | | **CW20 policy** | [`cw20-whitelist-policy.md`](docs/runbooks/cw20-whitelist-policy.md): **rebase / elastic-supply / balance-mutating** tokens are **forbidden** as pair/escrow assets (pair credits declared transfer amounts, not balance deltas). A yield-bearing USDN-style rebase CW20 **cannot** be a factory pair leg without a non-rebasing wrapper. | | **IBC** | DEX wasm has **no** `ibc_receive` / ack / timeout (**SEC-D02/D03**, `make verify-no-ibc-hooks-in-contracts`). Bridging Noble USDC/USDN onto Classic would be a **new chain + bridge + wrap** program, not a tokenlist edit. | | **CSP** | Browser `connect-src` is LCD/RPC/indexer + WalletConnect. Must **not** call BSC, Noble, Circle, or Venus HTTP from the dApp. | | **Copy / NFA** | Retail copy skill [#489](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/489); first-visit risk modal [#138](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/138). APR must not be presented as a guaranteed return. | **Yield figures in the title are hypotheses.** Spot-check (2026-08, public third-party, **must be re-dated in the memo**): Venus Core Pool FDUSD supply APY has printed **well below 6–8%** on some aggregators (single-digit / ~1% band); Noble Dollar (USDN) marketing has printed **~3.3–4.3%** (T-bill / M^0 index, variable). The investigation must **replace** 3.5% and 6–8% with sourced time series, not treat them as constants. --- ## Why this is needed 1. **UST1 inherit’s the backing stack.** Window inventory, treasury allowance, and (if seeded) UST1/vFDUSD AMM all sit on **Venus vFDUSD → FDUSD → First Digital reserves**. A collateral switch to **USDC → Noble/USDN → Circle + M^0** changes issuer, chain, oracle, pause playbooks, and bank-run contagion — not just APR. 2. **Headline APR is the wrong ranking function.** 6–8% vs 3.5% ignores utilization/redeem liquidity (Venus), T-bill rate path (USDN), depeg convexity, Circle freeze, IBC/CCTP, and CL8Y rebase-token ban. Operators need a **risk-adjusted** comparison before any product ADR. 3. **Both stables have already depegged in public markets.** USDC (~$0.87, Mar 2023, SVB reserve freeze) and FDUSD (~$0.87–$0.91, Apr 2025, issuer-insolvency allegation) are not theoretical. UST1 mint at a stale window rate during a depeg is an **inventory + solvency** event (**O4**, oracle pause). 4. **Staking/yield layers add protocol risk on top of issuer risk.** Venus has a documented incident history (XVS oracle/liquidity 2021 bad debt; LUNA oracle stall 2022; wUSDM donation / ERC-4626 2024–25; THE donation/cap bypass 2026 class). Noble/USDN adds M^0 module, T-bill wrapper, and Cosmos IBC/CCTP surface that this DEX does not run today. 5. **Without a written go/no-go, agents will “helpfully” add USDC tickers, fake `$1` pegs, or rebase pair legs** — the same class of mix-up #515 / **P550-9** already forbids. --- ## Constraints / guardrails 1. **Research deliverable only.** Default outcome is an ADR + risk memo. **No** factory `CreatePair`, **no** window allowlist change, **no** Coolify `VITE_USDC_*`, **no** indexer `usdc`/`usdn` ticker, **no** IBC module in DEX wasm. 2. **Do not hardcode `$1`** for USDC, FDUSD, vFDUSD, USDN, or UST1 (**X5** / **P550-9**). Peg history is part of the answer. 3. **Do not treat APR as settlement.** Window rate stays `effective_swap`; CEX feeds stay advisory; Venus `exchangeRateStored` (if cited) is redeem FDUSD-out, not USD. 4. **Keep oracles unconfused.** CEX FDUSD ≠ Venus vToken rate ≠ UST1 window ≠ pair TWAP ≠ Circle USDC ≠ Noble USDN index. 5. **Rebase / yield-accruing CW20 cannot be a pair or limit-escrow asset** ([`cw20-whitelist-policy.md`](docs/runbooks/cw20-whitelist-policy.md)). If USDN rebases, the memo must say **wrapper required** or **window-only, never AMM leg**. 6. **Do not open IBC or CCTP from the frontend.** CSP + **SEC-D02** stand. Any “how would USDC arrive on Classic?” section is architecture, not a deploy plan in this issue. 7. **Do not widen CW20 whitelist** to “try USDC” (**O7**). 8. **Pause remains fail-closed.** Research must map each incident class to **oracle pause vs window pause vs wrap pause** — not “wait for peg to recover while mint stays live.” 9. **Copy / NFA.** No “earn 6–8% risk-free on UST1.” Any user-facing sentence in the memo is labeled non-promissory. 10. **Primary sources over blogs.** Issuer attestations, on-chain market contracts, Circle/First Digital/Noble/M^0 docs, Venus post-mortems, Fed/FDIC notes. Aggregator APYs need **timestamp + method** (supply APY vs incentive vs 30d avg). 11. **Upstream repos.** Window/oracle live in [ust1-window](https://gitlab.com/PlasticDigits/ust1-window); wrap in ustr-cmm. This issue does **not** mutate those contracts. 12. **No exploit PoCs, payloads, or attack scripts** — describe vectors and historical incidents; do not reproduce them. --- ## Relevant files | Path | Role | |------|------| | [`docs/runbooks/ust1-window-ui.md`](docs/runbooks/ust1-window-ui.md) | **U1–U8**; vFDUSD-only window | | [`docs/runbooks/ust1-wrap-production-ops.md`](docs/runbooks/ust1-wrap-production-ops.md) | **O1–O8**; Venus/BSC → oracle pause | | [`deployments/mainnet-ust1-wrap/REGISTRY.md`](deployments/mainnet-ust1-wrap/REGISTRY.md) | Canonical columbus-5 addresses | | [`docs/runbooks/cw20-whitelist-policy.md`](docs/runbooks/cw20-whitelist-policy.md) | Rebase / FoT ban | | [`docs/runbooks/indexer-external-oracle.md`](docs/runbooks/indexer-external-oracle.md) | CEX FDUSD as `vfdusd`; **X1–X6** | | [`docs/security-model.md`](docs/security-model.md) | SEC-D02 IBC-hooks | | [`docs/exploit-replay-matrix.md`](docs/exploit-replay-matrix.md) | Historical incident template | | [`docs/adr/0001-hybrid-quoting-and-routing.md`](docs/adr/0001-hybrid-quoting-and-routing.md) | ADR format to copy | | [`frontend-dapp/src/pages/Ust1Page.tsx`](frontend-dapp/src/pages/Ust1Page.tsx) | `/ust1` UI | | [`frontend-dapp/src/services/terraclassic/ust1Window.ts`](frontend-dapp/src/services/terraclassic/ust1Window.ts) | `effective_swap` + CW20 Send | | [`frontend-dapp/src/utils/ust1WindowGates.ts`](frontend-dapp/src/utils/ust1WindowGates.ts) | Pause / stale / limit gates | | [`frontend-dapp/src/utils/tokenRegistry.ts`](frontend-dapp/src/utils/tokenRegistry.ts) | vFDUSD identity | | [`tokenlist/tokenlist.json`](tokenlist/tokenlist.json) | Listed CW20s | | [`indexer/src/indexer/oracle.rs`](indexer/src/indexer/oracle.rs) | FDUSD CEX poller | | [`scripts/check-ust1-wrap-ops-health.sh`](scripts/check-ust1-wrap-ops-health.sh) | Inventory / pause / oracle age | | [`docs/runbooks/ust1-secondary-amm-pair.md`](docs/runbooks/ust1-secondary-amm-pair.md) | UST1/vFDUSD AMM | | [`skills/AGENTS_UST1_WINDOW_UI.md`](skills/AGENTS_UST1_WINDOW_UI.md) | Agent window rules | | [`skills/AGENTS_UST1_WRAP_PRODUCTION_OPS.md`](skills/AGENTS_UST1_WRAP_PRODUCTION_OPS.md) | Agent ops rules | | [`skills/AGENTS_INDEXER_EXTERNAL_ORACLE.md`](skills/AGENTS_INDEXER_EXTERNAL_ORACLE.md) | Do not alias `fdusd`/`usdc` | | [`docs/frontend.md`](docs/frontend.md) | **P550-9**, `/ust1` vs `/mint` | | new: `docs/adr/0004-ust1-collateral-usdc-noble-vs-vfdusd.md` (suggested) | Decision memo | Upstream (read-only for this issue): ust1-window `effective_swap` / oracle updater; ustr-cmm treasury + wrap-mapper. --- ## Recommended direction 1. **Write ADR `docs/adr/0004-ust1-collateral-usdc-noble-vs-vfdusd.md`** (Status: Proposed) plus a short pointer from [`docs/README.md`](docs/README.md) Architecture. Optional agent skill stub **only if** the ADR is accepted later. 2. **Decompose each option into a risk stack** (do not compare “USDC” vs “vFDUSD” as single tokens): | Layer | Status quo | Alternative under study | |-------|------------|-------------------------| | Issuer / reserves | First Digital / FDUSD | Circle / USDC | | Bank / custodian | FDUSD trust / T-bill claims | Circle banks + T-bills (SVB-class) | | Yield venue | Venus Core Pool (BSC) vToken | Noble USDN / M^0 T-bill index (~3.5% claim) | | Receipt token | vFDUSD (exchange-rate) | USDN or staked USDC derivative | | Bridge to Classic | Existing bridged CW20 | Noble IBC + CCTP + new wrap (greenfield) | | CL8Y settlement | ust1-window vFDUSD↔UST1 | New allowlist / new window / dual inventory | 3. **Required memo sections** - **Yield:** dated supply APY vs incentive vs 30/90/365d realized; utilization; redeem queue; USDN index vs advertised 3.5%. - **Depeg / bank-run chronology** (min. USDC Mar 2023 SVB; FDUSD Apr 2025 allegation + any earlier FDUSD prints; DAI/USDP contagion as second-order). Depth, duration, primary-market halt vs secondary only, recovery path (Fed backstop vs issuer PR). - **Protocol incidents:** Venus (2021 XVS, 2022 LUNA oracle, 2024–26 donation/ERC-4626/cap-bypass class) **and** Noble/M^0/USDN (audits, pauses, IBC incidents — explicitly “none found” if so, with search log). - **CL8Y blast radius:** window mint at stale rate; treasury drain; AMM LP; indexer `$1` lie; retail APR copy. - **Scorecard:** issuer, depeg convexity, redeem liquidity, smart-contract, bridge/IBC, rebase-compat, ops pause mapping, regulatory/freeze (Circle blacklist vs FDUSD), implementation cost on Classic. - **Decision:** **Stay on vFDUSD** / **Reject Noble USDC for UST1** / **Defer** / **Dual-inventory (explicitly disallowed unless justified)**. Dual backing without a new product spec is a **fail**. 4. **If** the ADR ever recommends a switch, spawn **follow-up implementation issues** (window, oracle, treasury, indexer tickers, AMM, Coolify, pause runbooks). Do not sneak them into this MR. 5. **Verify script** `scripts/qa/verify-issue-NNN.sh`: required ADR headings present; no `VITE_USDC` / indexer `usdc` ticker introduced by the same MR unless the ADR status is Accepted **and** a linked implementation issue exists (this issue’s MR should be docs-only). --- ## Acceptance criteria - [ ] **AC1.** One ADR (or equivalent memo) in-repo covering **both** stacks; yield, depegs, and protocol incidents are **not** split across issues. - [ ] **AC2.** Title APR claims (3.5% vs 6–8%) are **replaced or falsified** with dated primary/aggregator sources and methodology (supply APY vs incentives vs realized). - [ ] **AC3.** USDC depeg/bank-run: at least SVB **2023-03** (Circle ~$3.3B / ~8% reserves frozen; secondary ~$0.87; primary halt; recovery via US systemic-risk exception) with citations. - [ ] **AC4.** FDUSD depeg/bank-run: at least **2025-04** issuer-insolvency allegation print (~$0.87–$0.91 band, duration, supply response) with citations; any additional FDUSD events in the search window listed or marked none. - [ ] **AC5.** Venus incident table with dates, mechanism, bad-debt/loss band, and **whether Core Pool vFDUSD was directly in the blast radius** (in-scope vs “other market / other chain”). - [ ] **AC6.** Noble / M^0 / USDN / CCTP / IBC risk table (module, redemption, freeze, bridge); gaps called out as **unknown**, not assumed safe. - [ ] **AC7.** Explicit mapping onto CL8Y invariants **U5, O3, O4, O7, X4, X5, P550-9, SEC-D02**, and the rebase/FoT whitelist ban. - [ ] **AC8.** Scorecard + **single product decision** (stay / reject / defer) with residual risks. No “quietly add USDC later.” - [ ] **AC9.** Docs-only MR for this issue: no window/oracle/indexer ticker/factory whitelist change. - [ ] **AC10.** `docs/README.md` (or runbook) links the ADR; NFA / non-promissory language on any APR. - [ ] **AC11.** Follow-up implementation issues listed **only if** decision ≠ stay; otherwise “no impl spawn.” --- ## Test plan (all research paths) These are **document and process tests**, not chain deploys. Each path must appear in the ADR (or an appendix checklist) with pass/fail. | ID | Path | How to test | |----|------|-------------| | **P1 Status quo stack** | vFDUSD = Venus vToken bridged CW20; window U5; CEX feed is FDUSD | Trace addresses from `REGISTRY.md` + tokenlist + `oracle.rs`; confirm no USDC symbol in window client | | **P2 Yield — Venus** | Supply APY vs borrow utilization vs XVS/incentive vs 30/90d | Snapshot Core Pool vFDUSD `supplyRatePerBlock` / UI APY with UTC timestamp; state whether 6–8% is current, historical, or marketing | | **P3 Yield — Noble** | USDC vs USDN vs “liquid staking” naming | Identify the **exact** instrument (USDN mint vs a third-party staker); T-bill index vs advertised 3.5%; lockup vs liquid | | **P4 Depeg — USDC** | SVB 2023 chronology | Primary: Circle disclosure, Fed/FDIC notes; min/max print; hours to re-peg; whether `blacklist`/`pause` fired (historical: market depeg, not a contract pause) | | **P5 Depeg — FDUSD** | 2025-04 and others | Primary: issuer statements + CEX prints; duration; redemption halt?; supply change | | **P6 Venus incidents** | 2021 / 2022 / 2024–26 class | Official post-mortems preferred; tag Core vs Isolated vs zkSync; vFDUSD market affected Y/N | | **P7 Noble/M^0 incidents** | Audits + pauses + IBC | Search log (dates, queries); “none found” allowed only with log | | **P8 Bridge/IBC** | How USDC would reach Classic | CCTP → Noble → IBC → wrap; contrast with current vFDUSD bridge; **SEC-D02** no DEX IBC entry points | | **P9 Rebase compatibility** | USDN/vToken as pair asset | Apply whitelist policy: exchange-rate vToken **bridged as static CW20** vs rebasing USDN; window-only vs AMM | | **P10 Ops mapping** | Each incident class → pause lever | Oracle pause vs window pause vs wrap pause vs do-nothing; cite A / A2 runbook | | **P11 Indexer/UI lie** | `$1` or wrong ticker | Confirm ADR forbids `usdc` alias to `vfdusd` and forbids hard peg | | **P12 Dual inventory** | Two backing assets in one window | Show why dual mint without new product spec fails U5 / O4; reject or specify a new window | | **P13 Retail copy** | APR on `/ust1` or `/protocol` | Any sample sentence checked against #489 / NFA modal; no guaranteed yield | | **P14 Decision close-out** | Stay vs switch | One checked option; residual risk list; impl issues only if switch | **Negative / skip paths** - [ ] **N1.** Memo that only compares “USDC is safer than FDUSD” without Venus vs Noble yield layers → **fail**. - [ ] **N2.** Memo that ranks solely on APR → **fail**. - [ ] **N3.** Implementation diff (new ticker, pair, env) in the research MR → **fail** AC9. - [ ] **N4.** Using `/ust1` `effective_swap` as a Venus or USDC USD price → **fail**. --- ## Test plan — attack, hack, and abuse vectors Research must **evaluate** each vector against **both** stacks and against **today’s UST1/vFDUSD** blast radius. **Do not** write exploits, PoCs, or attack procedures. | ID | Vector | What the memo must show | Fail if | |----|--------|-------------------------|---------| | **A1 Issuer/bank run** | SVB-style reserve freeze; FDUSD insolvency allegation | Primary vs secondary market; UST1 mint still open? | Treats depeg as “temporary noise” with window left live | | **A2 Redemption halt** | Circle/First Digital pause primary redeem; CEX conversion halt | Window + treasury still quote 1:1 via stale oracle | No pause mapping | | **A3 Circle freeze/blacklist** | USDC address freeze / contract pause | Noble USDC + CCTP + any Classic wrap inherit freeze | Ignores centralized freeze that FDUSD/vToken also may have in other forms | | **A4 Venus utilization run** | High utilization → vFDUSD redeem of FDUSD illiquid | **O4** withdraw capacity; UST1 holders cannot exit to FDUSD | Counts 6–8% APR without redeem-liquidity stress | | **A5 Venus oracle / donation / bad debt** | Historical XVS, LUNA stall, ERC-4626 donation, supply-cap bypass | Whether vFDUSD exchangeRate or FDUSD cash can be skewed; pause A2 | “Venus is battle-tested” without incident table | | **A6 Exchange-rate manipulation** | Donate-to-vault / share inflation (wUSDM class) | vToken vs USDN index; bridged CW20 may **not** rebase with Venus | Assumes bridged vFDUSD exchangeRate tracks BSC 1:1 without evidence | | **A7 Noble/M^0 module bug** | Mint/redeem halt, index freeze, wrong yield | Audits + admin keys + pause | Assumes T-bill wrapper cannot fail | | **A8 IBC/CCTP bridge** | Packet timeout, fake denom, hooks re-entry on **peer** chains | DEX has no IBC entry; **bridged token** still toxic in pools (**SEC-D02**) | Adds IBC callbacks to DEX “to support USDC” in this issue | | **A9 Rebase pair insolvency** | Yield token as AMM/limit asset | Whitelist ban; LP/escrow desync | Recommends listing rebasing USDN as factory pair | | **A10 Fake token / ticker alias** | Spoof `symbol=USDC` / path `/price/usdc` → vfdusd | Same class as forbidden `fdusd` alias (**X2**) | Proposes aliasing tickers | | **A11 Stale window mint during depeg** | Oracle still updating a CEX print while issuer is halted | **O2** (do not disable age checks); pause vs keep minting | “Keep minting, arb will fix it” | | **A12 Treasury drain / bank-run on UST1** | Race to withdraw vFDUSD while FDUSD depegged | Inventory monitors; per-tx / 24h caps are **not** peg defense | Treats 1000/10k caps as sufficient peg insurance | | **A13 Governance social engineering** | “Emergency add USDC code ID / dual window” | **O7**; 2-of-3 vs wrap-stack split **O6** | Recommends panic whitelist widen | | **A14 Retail APR fraud / phishing** | Fake “stake UST1 for 8%” copy or scam site | NFA; no APR CTA on `/ust1` from this research | Adds yield badge to window UI | | **A15 Indexer DoS / feed injection** | Poison USDC/FDUSD CEX or future Venus RPC | Soft-fail; **X5** advisory; CSP no browser RPC | Live-scan Noble/BSC from the browser | | **A16 Regulatory seizure** | Issuer or custodian freeze | Compare Circle (US) vs First Digital (HK) vs M^0 T-bill vehicle | Single-jurisdiction handwave | --- ## Verification criteria Issue is **done** when all of the following hold: 1. ADR `docs/adr/0004-ust1-collateral-usdc-noble-vs-vfdusd.md` (or the path named in the MR) is merged with **AC1–AC11**. 2. `scripts/qa/verify-issue-<iid>.sh` exists and is wired in the Makefile (`verify-issue-<iid>`): greps required headings (`Yield`, `USDC depeg`, `FDUSD depeg`, `Venus incidents`, `Noble/M0`, `Scorecard`, `Decision`); greps ADR for **U5** / **O4** / **X5** / rebase ban; fails if `indexer` grows an `usdc` ticker or frontend grows `VITE_USDC` **in the same research MR**. 3. `make verify-issue-<iid>` passes on the docs MR. 4. GitLab issue comment records: decision string (**stay** / **reject Noble USDC for UST1** / **defer**), date of yield snapshots, and links to citations (no secrets). 5. Existing gates still pass unchanged: `make verify-issue-506`, `make verify-issue-503` (docs grep), `make verify-issue-515` / `550` if oracle docs were only cross-linked — **no** behavior change. 6. No mainnet txs, no whitelist change, no Coolify env for USDC. **Out of scope for “done”:** implementing USDC/Noble, changing Venus pollers (#571/#572), seeding UST1/vFDUSD AMM (#508), or pausing the window.

PlasticDigits commented

2026-08-19 11:49:56 +00:00

(Migrated from gitlab.com)

marked as related to #407