gate: audit CW20 code 8266 before SpaceUSD/UST1 whitelist #581
Labels
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:implement
agent:implement
agent:open_issues
agent:ready
agent:research
agent:security_audit
agent:verify
architecture
backend
blocker:hybrid
blocker:launch
blocker:limit-orders
blocker:v2
block:log_only
block:security
bug
ci
contracts
correctness
deploy
dev
devops
docs
documentation
duplicate
e2e
enhancement
epic
feature
frontend
functional-completion
gas
good first issue
governance
help wanted
high-risk
hooks
hybrid
indexer
infra
infrastructure
integrators
invalid
launch-blocker
limit-orders
localnet
localterra
low priority
missing-implementation
needs-design
ops
performance
priority
high
priority
medium
product
qa
QA
question
ready
ready
research
scripts
security
security-hardening
smartcontracts
tech-debt
testing
ux
UX
v2
verification
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
code/cl8y-dex-terraclassic#581
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Gate
Blocked by #589 (generalized CW20 code-id audit harness). Do not factory
AddWhitelistedCodeId8266 and do notCreatePair/ seed SpaceUSD/UST1 (or any other 8266 pair) until:cw20-codeid-audits/codeids/8266/REPORT.md(decomp + suite), not from an optimizer rebuild.Hash-equal rebuild is not required. Confirming the downloaded LCD wasm SHA-256 equals
CodeInfo.data_hashis still required (identity of the binary). Proving a rust-optimizer rebuild matches that hash is not a gate.Parent ops: #558 (CMM-custodied SpaceUSD/UST1 LP). Policy:
docs/runbooks/cw20-whitelist-policy.md/ #377 H-01. Contrast: ALPHA 8654 is already a livecw20_taxedtemplate (do not whitelist that either). 8266 is a different wasm and still needs its own audit — LCD query surface is not a substitute for reading the binary.Factory today:
GetWhitelistedCodeIds=[6036, 10184]only.CreatePairSpaceUSD+UST1 currently failsCodeIdNotWhitelisted(verified 2026-08-20). That is the correct failure until this gate passes.What 8266 is (public LCD + docs)
data_hash953AD60CF6D8C9631B99ADC84C3ABF4083815743F86FF81B2A422FDFDF5F95C0CodeInfo.creator)terra1yq3d4h9g4ncale3mcwuhcfdge8hzjx666umlhgterraport_token::msg::QueryMsg/code/8266/contracts, 2026-08-20)Canonical Terraport “Token code” instance (same code ID, label Token Terraport V2), created at height 15307849:
terra1ex0hjv3wurhj4wgup4jzlzaqj4av6xqd8le4etml7rg9rs207y4s8cdvrpterra1m67k3ak5d05k7tzukstkujxptw0tnwt8cmf5kcxm6vwd403l4teshm07lstoken_info: name Terraport, symbol TERRA, 6 dpThe same wasm is also used for Terraport LP CW20s (example label
lp, initterraport liquidity token/uLP). SpaceUSD is one permissionless instantiate of that binary, not a unique template.SpaceUSD instance (the #558 leg)
terra1cvd5cgrs8rrl96hte34n57497u5f9cwuv3e6ztxgetkx4uzmcdyswv79zlSpaceship Dollars_token_contractterra133n0pv8jwllxwmrhymgfllglw9l0j5e765x5d9total_supplynow530000000= 530 humantotal_supply_atblock 2715494830000000= 30 human (minter has expanded supply since instantiate)1000000000000000= 1,000,000,000 humanall_accounts)200032180= 200.032180 (already staged for the pool)tax_mapqueryIssuer wallet is also the SpaceshipRacer validator operator (
terravaloper133n0pv8jwllxwmrhymgfllglw9l0j5e76m2fak). That is public association only — not an audit of the wasm.Tokenlist already lists SpaceUSD at this address with 6 dp.
8266 vs already-whitelisted 6036
cw20_base::msg::QueryMsgterraport_token::msg::QueryMsgbalance_at,total_supply_at,all_spender_allowances7C7DE408E1081C72947567E4D002456B2EB95C66517E4D955A401C453B1881A2953AD60C…F5F95C0balance_attakes{ address, height };total_supply_attakes{ block }. That matches a snapshot / historical-balance extension (governance/staking style), which is not automatically a rebase. It is also not proof of 1:1transfer/send. The audit must show that a holder’s currentbalancenever changes except via explicit transfer/mint/burn.Public claims vs what we can verify
Terraport docs (Mint Your CW20 Token) tell issuers to instantiate “this binary” and state it was audited by CertiK, and that Terraport will migrate tokens on chain upgrades so issuers need not act.
CertiK project page: skynet.certik.com/projects/terraport (audit history includes a 2024-08-23 delivery; listed token contract is the TERRA instance above). File-level hashes on Skynet (e.g.
contract.rs) are not a wasm checksum. Treat the CertiK claim as unverified marketing for listing. A CertiK zip / source SHA is an optional appendix only — it does not gate this issue.Terraport 2023-04-10 ~$4M incident (CertiK post-mortem): liquidity-wallet / centralization, classified out of audit scope; CertiK audited after the exploit. That is not evidence that 8266 is FoT, and it is not a reason to skip wasm review. It is a reminder that Terraport-adjacent ops and admin keys have a real loss history.
Our own
docs/terraport.md: Terraport DEX core source is not in their public repos (TerraSwap upstream is).terraport_tokenwasm is similarly not pinned to a public git SHA in this repo. That is why listing evidence is LCD wasm decomp + automated suite, not a rebuild.Risks the audit must close (H-01 / P2)
fee_on_transfer_creates_reserve_imbalance). 8266 has notax_mapquery; a hidden skim intransfer/sendwould still break P2. ALPHA 8654 is the worked example of “query surface looked listable untiltax_map”.balance_at/total_supply_at) raise this question. Historical checkpoints are OK; elastic supply that changes idle balances is not.AddWhitelistedCodeId 8266admits all 1686 current instantiations (TERRA, Terraport LPs, SpaceUSD, plus any future Everybody instantiate) toCreatePair. Even a clean template is a listing/spam surface. Prefer listing SpaceUSD only after the template is approved; still assume other 8266 tokens can appear in/create.adminis the issuer. F6 (#582) pins listing-timecode_idand re-checks the whitelist on writes, so migrate-off-template fail-closes. Same-code-id admin setters (hidden tax, pause, honeypot) are not covered by F6 and must be caught by decomp + suite.Do not add pair balance-delta / FoT swap math to “make 8266 work” (H-01; Balancer STA 2020 class).
Audit checklist (must attach evidence on this issue)
Per the generalized code-id procedure (#589) and
cw20-whitelist-policy.md:data_hash953AD60C…F5F95C0(binary identity — not a rebuild)cw20-codeid-audits/codeids/8266/decomp/balance_at/total_supply_atto snapshot-only (or document if they can change live balances)codeids/8266/REPORT.mdattached / merged with go or no-goOptional appendix only (does not block): public source URL, CertiK zip, or optimizer rebuild hash.
Acceptance
AddWhitelistedCodeId 8266, then #558 SpaceUSD/UST1 create+provide withreceiver= CMMLabels / owner
ops + governance (DEX 2-of-3 whitelist) / security review
Priority
P1 for #558 SpaceUSD/UST1 only — not a launch-blocker for existing 6036/10184 pairs
marked as related to #558
mentioned in issue #558
Source hunt (Terraport repos) — 2026-08-20
Did not find a public store-code tx or a build that reproduces LCD
data_hash. Did find a partial source dump that fingerprints to the live wasm.Fingerprint: on-chain cw2 == GitHub crate
SpaceUSD raw
contract_info(cw2):That is exactly
CONTRACT_NAME/CARGO_PKG_VERSIONin Terraport-Finance/Terra-token-contract (Cargo.tomlpackageterraport-token0.0.0;contract.rscrates.io:terraport-token). LCD parse errors namingterraport_token::msg::QueryMsgare the same crate (hyphen → underscore).Query surface in that
src/msg.rsmatches columbus-5, including the awkward splitBalanceAt { height }vsTotalSupplyAt { block }(not a generic cw20-base). That is a strong interface match, not a checksum match.Single content commit:
d854a2199e2024-01-18, messagecertik audited, author Man12C (Terra Classic tooling forks: finder / station / LocalTerra — not a published CertiK report). The org’s other public repos are listings/adapters only (assets, DefiLlama, keplr-registry). No factory/pair/router wasm repo.Claimed monorepo is not public
Cargo.tomlsays:repository = "https://github.com/terraport/classic_terraport"→ 404terraport→ 0 public reposclassic_terraport = { path = "../../packages/classic_terraport", version = "2.5.2" }→ not in this dump, not on crates.io (unlikeclassic_terraswap)instantiateincontract.rstakesclassic_terraport::token::InstantiateMsg, not theInstantiateMsgsitting in the dumpedmsg.rs. So this GitHub tree is an extracted contract crate from a private Terraport workspace. It will not compile as-is; we cannot optimizer-build it to check953AD60C….What that dump actually is (lineage)
cw20-base 0.14 +
SnapshotMapBALANCESwithStrategy::EveryBlock+TOTAL_SUPPLY_HISTORYmap. Same shape as Astroportxastro_token(historicalbalance_at/total_supply_atfor staking/governance), notcw20_taxed.In the dumped execute path,
transfer/send/transfer_fromdebit and credit the sameamount(no skim). Snapshots are checkpoints for queries; they do not rebase idle balances in this source. That is a review of the dump, not a proof the LCD wasm is that commit.Still missing for a go/no-go
classic_terraporttree (or a CertiK zip whose wasm SHA-256 equals LCDdata_hash)terra1yq3d4…). Publicnode FCD has pruned below height 25616144, so first instantiate (height 15307849, Terraport V2 TERRA token) is off the cheap archive; need an archival LCD/Finderrust-optimizer+ missing package) vs953AD60C…Until (1)+(3), treat Terra-token-contract as the best public candidate source, not as verified provenance. Ask Terraport for the
classic_terraportSHA that produced 8266, or download LCD wasm and diff against a rebuild.On (4) this is a serious security issue, as a migrated token to a new codeid could violate our whitelist policy, need a seperate security issue to track potential exploits, mitigation, and severity
mentioned in issue #582
marked as related to #582
Gate: #582
Item (4) is protocol-wide, not 8266-only. Factory checks CW20
code_idonly atCreatePair; pair swap/provide/limit never re-checks. Any listed instance whose wasm admin is still set canMsgMigrateContractonto a different (including taxed) code id and keep trading — H-01 / P2 / SEC-I01 H05.Do not close this issue with a go on
AddWhitelistedCodeId8266 and do not CreatePair SpaceUSD/UST1 until #582 has a written severity + mitigation decision.GitLab license here does not support
blocksissue links, so the gate is this comment + #582’s Gate section.Live listed pair assets today are all protocol-admin’d (2-of-3 or wrap-stack CMM). SpaceUSD would be the first third-party migrate key. Permissionless 6036 CreatePair already admits issuer-admin tokens that could migrate after listing.
Finder / FCD: store-code tx for 8266
Public LCD is pruned; public FCD (what Finder uses as
api) still has the 2023 store-code. The earlier note that publicnode FCD is pruned below height 25616144 applies to LCD, not FCD.Store-code (code id 8266)
5829A7EA57F177B17DA509FB1AE6221A016BACB15C4CC8ECC1C61E281B0D2BACterra1yq3d4h9g4ncale3mcwuhcfdge8hzjx666umlhgcode_checksum953ad60cf6d8c9631b99adc84c3abf4083815743f86ff81b2a422fdfdf5f95c0Checksum matches live LCD
CodeInfo.data_hash953AD60C…F5F95C0. First instantiate (Terraport V2 TERRA, label Token Terraport V2) is 96s later at height 15307849:D1BA89BD75C97F3311D43D18781150847F2CF972480455B24B13CAC78CBB517D. Same morning the uploader stored 8254–8266 in a burst; 8266 was last.What is pruned vs what still serves history
https://terra-classic-lcd.publicnode.comhttps://lcd.terra-classic.hexxagon.iohttps://api-lunc-lcd.binodes.comGET /cosmwasm/wasm/v1/code/8266data_hash, wasm bytes, instantiate Everybody) — this still workshttps://terra-classic-fcd.publicnode.comhttps://fcd.terra-classic.hexxagon.ioAPI gotcha: FCD
/v1/txs/{hash}(plural) 404s — it proxies pruned LCD. Use/v1/tx/{hash}(singular),/v1/blocks/{height}, or/v1/txs?account=….Finder backends (
assets.terra.money/chains.json/ Hexxagonassets.hexxagon.io/chains.json):https://terra-classic-public-api.publicnode.comhttps://api.terra-classic.hexxagon.ioLinks
CodeInfo): classic/code/8266 · columbus-5/code/8266https://terra-classic-fcd.publicnode.com/v1/tx/5829A7EA57F177B17DA509FB1AE6221A016BACB15C4CC8ECC1C61E281B0D2BAC·https://terra-classic-fcd.publicnode.com/v1/blocks/15307833/v1/txs?account=terra1yq3d4h9g4ncale3mcwuhcfdge8hzjx666umlhg&limit=100&offset=483530149SpaceUSD instantiate is new enough for both LCD and FCD: height 27154948, tx
A99C0E54395DB7330815F3037DEFD0C3A3CC5E5AE0B6106D7D88857B2353EB5D.No rented archive node is required for the store-code hash. This still does not reproduce
data_hashfrom source (privateclassic_terraport/ CertiK wasm SHA) — it only pins the on-chain store tx.Source identification (LCD wasm + store tx + compiler fingerprint)
This is crate identity, not a byte-identical rebuild. It uses the store-code pin from the Finder/FCD note plus the GitHub dump from the earlier source hunt.
1. On-chain bytes are pinned
GET /cosmwasm/wasm/v1/code/8266data_hash953AD60CF6D8C9631B99ADC84C3ABF4083815743F86FF81B2A422FDFDF5F95C0datawasm953AD60C…F5F95C0/v1/tx/…)5829A7EA57F177B17DA509FB1AE6221A016BACB15C4CC8ECC1C61E281B0D2BACheight 15307833code_checksum953ad60c…5f95c0(same)terra1yq3d4h9g4ncale3mcwuhcfdge8hzjx666umlhgWasm size: 327509 bytes.
2. Compiler fingerprint (from panic paths in the wasm)
The binary was not built with a 2023–2024 optimizer. Embedded rustc commit
69f9c33d71c871fc16ac445211281c6e7a340943is rustc 1.66.0 (2022-12-12). CosmWasm changelog: that toolchain iscosmwasm/workspace-optimizer:0.12.11/rust-optimizer:0.12.11only (0.12.10 = 1.65; 0.12.12 = 1.67.1). Registry paths are/usr/local/cargo/registry/src/github.com-1ecc6299db9ec823/…(pre-sparse crates.io git index), which matches 0.12.11 and rules out 0.12.13+ (sparse index + newer rustc).Crate versions also baked into those paths:
cosmwasm-stdserdeserde-json-wasmcw-storage-plusbase64Dump
Cargo.tomlsayscosmwasm-std = "1.0.0"(^1.0.0). Latest 1.x at store time was 1.5.0 (2023-10-31). The wasm is 1.3.3, so they compiled with a Cargo.lock (not a fresh resolve on 2023-11-07). That lockfile is not in the public dump.3. Live instance + wasm type paths = crate
terraport-token0.0.0SpaceUSD (
terra1cvd5c…wv79zl) raw keycontract_info(cw2):LCD unknown-variant error (live):
Those names are rustc type paths / serde variant lists inside the wasm, not docs:
crates.io:terraport-token+0.0.0terraport_token::msg::QueryMsgterraport_token::msg::ExecuteMsgterraport_token::state::TokenInfoclassic_terraport::token::InstantiateMsgExecute serde list in the wasm:
transfer,burn,send,increase_allowance,decrease_allowance,transfer_from,send_from,mint,update_minter,burn_from,update_marketing,upload_logo. Notax_map/cw20_taxed/classic_terraswap/xastro.Storage keys in the wasm match the dump
state.rs:balance+balance__checkpoints+balance__changelog(SnapshotMapEveryBlock) andtotal_supply_history. Error strings match dumperror.rs(Minting cannot exceed the cap,Duplicate initial balance addresses,Logo binary data exceeds 5KB limit, …).Public candidate source: Terraport-Finance/Terra-token-contract commit
d854a2199e(2024-01-18, messagecertik audited).Cargo.tomlpackage nameterraport-token0.0.0;CONTRACT_NAMEcrates.io:terraport-token; query enum is the same awkwardBalanceAt { height }vsTotalSupplyAt { block }.That is enough to name the crate. It is not enough to claim
d854a219is the exact tree that produced953AD60C….4. What still does not match (do not treat as go)
GitHub dump vs CertiK file SHA. Skynet lists 247 audited files. One
contract.rsSHA-256 isf9cdb90d4f29062c163fef323481d94d9f98b5c41dc61bfc3aafe7c20e5f9afa(UIF9C…AFA). Dumpsrc/contract.rsSHA-256 is1BAD15D8772BBB6614E165C08F5D580654A5120FA5ACBCE939DDCE5D83FEFDA2. Mismatch. CertiK hashes source files, not the wasmdata_hash, and the listedcontract.rsmay not even be the token crate (DEX core is in the same audit). CertiK artifact SHA vs LCDdata_hash: unavailable / not matched.Dump date vs store date. Wasm stored 2023-11-07. Dump commit 2024-01-18. Two months later; no
Cargo.lock;classic_terraportstill private (https://github.com/terraport/classic_terraport404).instantiatetakesclassic_terraport::token::InstantiateMsg(withmarketing) — TerraSwapclassic_terraswap2.5.2 tokenInstantiateMsghas nomarketingand uses cw 0.8 / cosmwasm 0.16. Terraport reused the version number on a rewritten package. Substituting crates.ioclassic_terraswap 2.5.2cannot reproduce this wasm.Rebuild attempt. Reconstructed a minimal
classic_terraport::token::InstantiateMsg(marketing +validate/get_cap) beside the dump, pinned wasm-known crates (cosmwasm-std 1.3.3,serde 1.0.188,serde-json-wasm 0.5.1, …), and rancosmwasm/workspace-optimizer:0.12.11. Did not finish a wasm: 2026 crates.io resolves transitives that need rustc > 1.66 (itoa 1.0.18, edition-2024zeroize/base64ctbefore pinning). Without the original lockfile + private package,data_hashis not reproduced.Dump execute path (review of GitHub, not of the wasm CFG):
transfer/senddebit and credit the sameamount(no skim).BALANCESsnapshots are checkpoints;total_supply_historyis written on mint/burn/init only. Idle balances are not rebased in this source. That is still not a substitute for a 1:1 staging probe on the LCD binary.Checklist update
953AD60C…F5F95C0(and store tx)terraport-token0.0.0 / Terra-token-contractd854a219+ privateclassic_terraport2.5.2953AD60C…(need Terraport lockfile +classic_terraportSHA, or CertiK zip with wasm SHA)balance_at/total_supply_atare snapshot queries in the dump; wasm storage keys matchSnapshotMap/ history maptransfer/sendprobeAsk Terraport for: (1)
classic_terraportgit SHA used for 8266, (2)Cargo.lockfrom that build, (3) any CertiK zip that includes the optimized wasm whose SHA-256 is953AD60C….mentioned in merge request !1107
mentioned in issue #584
marked as related to #584
mentioned in issue #585
#584 columbus-5 F6 migrate is not done. Factory 1.9.0 is live, but 3/14 pairs are still 1.14.0 (no pin). Do not
AddWhitelistedCodeId 8266and do not close this issue go. Remaining gate after #584 14/14: 8266 source review (or SpaceUSD admin cleared / wrap-to-10184).mentioned in issue #391
F6 prerequisite is live on columbus-5 (factory 1.9.0, all 14 pairs 1.15.0,
pair_code_id11601). That does not close this issue. Still do notAddWhitelistedCodeId 8266/CreatePairSpaceUSD until 8266 source review (or SpaceUSD wasm admin cleared, or wrap-to-10184).mentioned in merge request !1109
mentioned in merge request !1110
!1110 (F6 upgrade-582 LCD retries /
UpdateConfig { pair_code_id }/ skip-already-migrated) is merged tomain. That does not change this gate: 8266 stays off the factory whitelist until this issue has a written go/no-go with source-review hashes. Do notAddWhitelistedCodeId 8266. Related leftover: #585 (freeze UX).mentioned in merge request !1111
#585 dApp + indexer freeze visibility is ready for review in !1111. That MR does not unblock 8266 listing. Gate remains live F6 on chain + source review of 8266 (this issue).
mentioned in commit e5bb6227bab00592847b12f5af6304107f53399c
Source-in-wasm verification (optimizer rebuild in
/tmp)Worked outside the DEX tree (
/tmp/cw20-8266-rebuild).cosmwasm/rust-optimizer:0.12.11linux/amd64 (rustc 1.66.069f9c33d7— same commit as the LCD binary). Dump is Terra-token-contractd854a219plus a stubclassic_terraport2.5.2. No DEX sources were changed.Byte-identical rebuild: still no
953AD60CF6D8C9631B99ADC84C3ABF4083815743F86FF81B2A422FDFDF5F95C04F9D1D947483572382F3DFD534672ABE3C598C655FBE720FF00EDCB5C0253DD5stargate+staking)9518E09E6D017A0388E02EDE4423B1738CE1533E071DAA9F0C15F09F64469102stargateonly)993665B43F7A88BEBBFF392FB20A19B90014F146C3CC1753B5D6576A3755B114Closest size gap is 2.3–2.7 KB. That is not
cmpidentical. Do not treat any of those rebuild hashes as the store checksum.Source identity: the dump is the crate inside 8266
Every dump-derived identifier below is a literal substring of the LCD wasm (not a docs claim):
crates.io:terraport-token/0.0.069f9c33d71c871fc16ac445211281c6e7a340943cosmwasm-std-1.3.3,cw-storage-plus-0.14.0,serde-1.0.188,serde-json-wasm-0.5.1,base64-0.13.1terraport_token::msg::QueryMsg,terraport_token::msg::ExecuteMsg,terraport_token::state::TokenInfo,classic_terraport::token::InstantiateMsg,cw_storage_plus::snapshottransfer,burn,send,increase_allowance,decrease_allowance,transfer_from,send_from,mint,update_minter,burn_from,update_marketing,upload_logobalance,balance_at,total_supply_at,token_info,minter,allowance,all_allowances,all_spender_allowances,all_accounts,marketing_info,download_logobalance/balance__checkpoints/balance__changelog/total_supply_history/allowance/allowance_spenderUnauthorized,Cannot set to own account,Allowance is expired,No allowance for this account,Minting cannot exceed the cap,Logo binary data exceeds 5KB limit,Invalid xml preamble for SVG,Invalid png header,Invalid expiration value,Duplicate initial balance addresses, name/symbol/decimals validate strings,Initial supply greater than capAbsent in the LCD wasm:
tax_map,fee_on_transfer,reflection,rebase,elastic,cw20_taxed,classic_terraswap,xastro.Dump
execute_transfer/execute_senddebit and credit the sameamount. Snapshots areSnapshotMapEveryBlockplustotal_supply_historywritten on mint/burn/init only. That review now applies to the live binary, not only the GitHub dump: the wasm carries those exact type paths, variant names, storage keys, and error strings.Why the hash still misses (and what unblocked a wasm at all)
A naive 2026 host resolve still dies. What actually compiled:
Cargo.lockinsiderust-optimizer:0.12.11(cargo 1.66, git crates.io index).cosmwasm-std/serde/serde-json-wasm/cw-storage-plus/base64) and 2023-era transitives. Unpinned 2026 latest pulls edition-2024base64ct1.8.3 /zeroize1.9.0 andsemverrust-version > 1.66.cosmwasm-cryptoas a direct dep — its default features pullrand_core/getrandomand breakwasm32.ahash0.7.6 was yanked 2023-10-23 (after the CosmWasm 1.3.3 lockfile, before store 2023-11-07). 0.7.7+ compilegetrandomon wasm32. Path-patched the yanked crates.io tarball.cosmwasm-std1.3.3 does not exportrequires_terra. LCD does (requires_terra+requires_stargate+requires_iterator, all empty stubs). Enablingstargateplus a dummyrequires_terrain the stub closed most of the size gap (9 KB → ~2.7 KB) and matched the LCD export set.stakingaddsrequires_staking, which LCD does not export.The remaining 2–3 KB is the private
classic_terraporttree + the original lockfile we still do not have. Extra unused types in that package would change bytes without changing the string surface above.Checklist
953AD60C…F5F95C0(and store tx)terraport-token0.0.0 /d854a219+ privateclassic_terraport2.5.2data_hash(still open — need TerraportCargo.lock+ realclassic_terraportSHA)balance_at/total_supply_atare snapshot queries (dump + wasm keys)transfer/sendprobe (not run; this pass was compile-only)8266 stays off
AddWhitelistedCodeIduntil ops accept source-identity (this note) in lieu ofcmpidentity, or Terraport provides the 2023-11-07 lockfile +classic_terraportSHA and the hash matches. Staging 1:1 probe still recommended on a throwaway Everybody instantiate (not SpaceUSD mainnet funds). F6 is already live; it does not replace this gate.classic_terraportis a TerraSwap package rename (not Astroport, not drop-inclassic_terraswap)Private
classic_terraport2.5.2 is almost certainlyterraswap/classic-terraswapv2.5.2packages/classic_terraswap+contracts/terraswap_token, find-replaced. LCD 8266 rustc-namesclassic_terraport::token::InstantiateMsg. It has noclassic_terraswap,terraswap, orastroportstrings — so crates.ioastroportand a Cargo alias ofclassic_terraswapare ruled out (those would keep their package names in type paths).v2.5.2terraswap-token0.0.0terraport-token0.0.0classic_terraswap2.5.2classic_terraport2.5.2token.rsinstantiatemarketingvalidate[A-Za-z-]onlyterra-cosmwasm2.2.0 + stargaterequires_stargate+requires_terrabalance_at/total_supply_atlive in the token crate, not this packageterraswap/terraswappackages/terraswap/src/token.rsis the same no-marketing shape. Not a second source.What is actually in public
classic_terraswap2.5.2src/:token,asset,factory,pair,querier,router,mock_querier,testing.asset.rsusesterra_cosmwasm::TerraQuerierfor nativecompute_tax/deduct_tax(LUNC/USTC bank tax, not CW20 FoT). Those strings (TerraQuerier,TaxRate,TaxCap) are absent from 8266 — so even if the private repo still hasasset.rsfor factory/pair, it is not linked into the token wasm.terra-cosmwasm2.2.0 is the usual Classic source ofrequires_terraon std 0.16. Official std 1.3.3 does not export that. 8266 has the export and noterra_cosmwasmtype path — empty stub or a thin port, not the 0.16 crate compiled in.Plan update (next)
Do not stub
token.rsonly as the last word. Inventory + reconstruct from the public TerraSwap tree:classic-terraswaptagv2.5.2; SHA-256 everypackages/classic_terraswap/src/*file.token= yes/yes;asset/pair/factory/router = no/no).classic_terraport2.5.2; edittoken.rsonly first (addmarketing); port deps 0.16 → 1.3.3 / cw 0.14; drop or stubterra-cosmwasm; keepstargate; rebuild withrust-optimizer:0.12.11.953AD60C…/ 327509. Token-only stub vs full-package reconstruct: if they hash the same, unused modules DCE and the gap is lockfile/derives/requires_terrahelper.Full table and stop conditions:
/tmp/cw20-8266-audit-581/CLASSIC-TERRASWAP-INVENTORY.md(also linked fromHASH-REPRO-PLAN.md/AUDIT.mdin that worktree). DEX repo still untouched.8266 stays off the whitelist. Native tax helpers in public
asset.rsare not a transfer skim and are not in this wasm.mentioned in commit
0fb74a7017LocalTerra 1:1 probe + source-in-wasm check (2026-08-22)
Work was done only under
/tmp/cw20-8266-audit-20260822/(LCD download, dump clone, optimizer rebuild, throwaway receiver). No DEX repo files were changed. Do notAddWhitelistedCodeId 8266.1. LCD bytes reconfirmed
GET /cosmwasm/wasm/v1/code/8266data_hash953AD60CF6D8C9631B99ADC84C3ABF4083815743F86FF81B2A422FDFDF5F95C0dataexecute,instantiate,query,allocate,deallocate,interface_version_8,requires_terra,requires_stargate,requires_iterator— nomigrate2. Same bytes stored on LocalTerra
473A4328CA688DA3C2CB2CFEC0689C2872FB854ED5E30D595C975B954324178Aheight 271640code_idcode_checksum/data_hash953ad60c…5f95c0(same LCD hash)Throwaway instantiate (Everybody) — not SpaceUSD mainnet:
EA50FC5C880313134462A4C0752C8AB9BB50EE7263DBFF8E661B9595CC3E4008height 271991terra1xe69x2m33ynth0ez00tdnns9rnapsa45d2q8r2av5tmnu9xtpl8qv286fp8266-probe1e15/ marketing set / initial 1000 + 100 human to test1 + test33. Staging 1:1 probe — PASS (LCD binary, not the dump)
All amounts are raw (6 dp). Idle holder = test3 unless noted.
transfer05DDA0B6…3283E0CAh 272604mint514D423B…99BB60FCh 272617burn2B8182A7…FB88A478h 272625transfer_from851988A5…2149C229h 272640send→ throwaway receiverCDF80A74…A2A5B22Ch 274953send_fromA9085BD8…A7DC4326h 274995send/send_fromdispatchedcw20::receiver::ReceiverExecuteMsg::Receivewith the same amount (receiver wasm events:action=receive amount=55555/1111). Failedsendto an EOA / to the token itself reverted with balances unchanged (atomic with the hook).Other live behavior matching dump
error.rs/contract.rs:tax_map/rebasequeries: unknown variant; expected list is exactly dumpQueryMsg(balance,balance_at,total_supply_at,token_info,minter,allowance,all_allowances,all_spender_allowances,all_accounts,marketing_info,download_logo).sendto self):transfer,burn,send,increase_allowance,decrease_allowance,transfer_from,send_from,mint,update_minter,burn_from,update_marketing,upload_logo. Noreceive/tax_map/rebase.Unauthorized.Minting cannot exceed the cap.Overflow: Cannot Sub with 623456 and 999999999999(subtracts the declared amount; no hidden fee before the check).4. Snapshots are historical only (LocalTerra)
SnapshotMapEveryBlock +total_supply_history:balance_attest1/test3 at instantiate height 271991total_supply_atblock 271991balance_atidle at later heightbalance(100000000, then 100000777 aftertransfer_from)Idle live
balancedid not change across transfer / mint / burn / send / a later block, except when that address was an explicit transfer_from recipient.5. Source that is in the wasm (identity, not byte-hash)
The LCD / LocalTerra binary is crate
terraport-token0.0.0 (terraport_token::msg::{QueryMsg,ExecuteMsg},classic_terraport::token::InstantiateMsg,terraport_token::state::TokenInfo,cw_storage_plus::snapshot::ChangeSet<…Uint128>, keysbalance/balance__checkpoints/balance__changelog/total_supply_history). Public dump: Terraport-Finance/Terra-token-contractd854a219.Dump
execute_transfer/execute_send/*_fromdebit and credit the sameamount. LocalTerra execution of the LCD bytes now shows that CFG is what the chain runs — not only what the later dump says.No
tax_map,cw20_taxed,fee_on_transfer,rebase, orreflectionstrings in the wasm.cw20::receiver::ReceiverExecuteMsgis present (standard Send hook wrapper).6. Optimizer rebuild — still not
953AD60C…Reconstructed in
/tmpfrom dumpsrc/+classic_terraporttoken-only stub (marketing + TerraSwap validate strings) +cosmwasm/rust-optimizer:0.12.11linux/amd64. Lockfile generated inside rustc 1.66. Direct crates pinned to wasm-known versions (cosmwasm-std1.3.3,serde1.0.188,serde-json-wasm0.5.1,cw-storage-plus0.14.0,base640.13.1) plus 2023-era transitives so 2026 crates.io does not pull edition-2024base64ct1.8.3 /syn2.0.119.953AD60CF6D8C9631B99ADC84C3ABF4083815743F86FF81B2A422FDFDF5F95C0stargate+requires_terrastub)75BDA9CA2C4E3C090C4229965E4BE209CB56363AD3BC02F9C7F7D479ED759BE3−3673 bytes. Exports match LCD except this rebuild also exports
__getrandom_custom(1.66 +rand_core/getrandomneeds a wasm shim; LCD has no getrandom strings). Type/error/storage strings match the dump. Still notcmp-identical.Private
classic_terraport+ originalCargo.lock(or a CertiK zip that includes the optimized wasm) remain the missing inputs for a hash go. CertiK file SHA vs dump is still a mismatch / not required.Checklist
953AD60C…F5F95C0transfer/send/transfer_from/send_fromon this exact LCD binary (LocalTerra code 25)balance_at/total_supply_atsnapshot-only on LocalTerra953AD60C…— open (3.7 KB short)Go / no-go
NO-GO for
AddWhitelistedCodeId 8266/ SpaceUSDCreatePair. The live wasm is the dump crate and it is not FoT/rebase under LocalTerra execution. The written hash-equal rebuild is still missing. Residual instance risks unchanged: SpaceUSD wasm admin = issuer; mint cap 1e9 human vs 530 circulating; name ≠ peg; Everybody instantiate (LUNC fee accepted as spam control).mentioned in issue #589
changed the description
marked as related to #589
Policy change / gate
#581 is now gated on #589 (generalized CW20 code-id audit harness). Do not close this issue with a whitelist go until #589 ships and
cw20-codeid-audits/codeids/8266/REPORT.mdexists.Removed: proving a rust-optimizer rebuild whose SHA-256 equals LCD
data_hash953AD60C…. Old Columbus-5 templates (missingCargo.lock, privateclassic_terraport) make hash-equal rebuilds a dead end. The 2026-08-22/tmprebuild that did not match is not a no-go by itself.Still required:
CodeInfo.data_hash(we have the on-chain binary).Optional source / CertiK / rebuild hashes stay an appendix only. Description checklist updated to match. F6 (#582) remains live and is not a substitute for the template audit.
GitLab
blockslinks are unavailable on this license; treat #589 as the hard blocker from the descriptions.changed the description
mentioned in merge request !1114
#589 harness MR: https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/396
8266 pin
953AD60C…+cw20-codeid-audits/codeids/8266/REPORT.mdverdict is NO-GO (Layer A-lcd / B-lt not yet run on that wasm). Optimizer rebuild remains appendix-only. This issue stays open; do not whitelist 8266.mentioned in commit
fa8550f356Reopened after !1114 merge
!1114 landed the #589 harness and correctly recorded 8266 as NO-GO until Layer A-lcd + Layer B-lt run the pinned LCD wasm (
953AD60C…).GitLab auto-closed this issue at merge time because the MR description contained the substring
close #581(in “Does not close #581”). That was accidental. SpaceUSD/UST1 listing stays blocked.Do not factory
AddWhitelistedCodeId 8266and do notCreatePair/ seed SpaceUSD/UST1 untilcw20-codeid-audits/codeids/8266/REPORT.mdis GO from those layers — not frommake verify-issue-589green (that path is mutants + docs only).mentioned in issue #590
marked as related to #590
Follow-up tracker: #590. This issue stays the 8266 GO/NO-GO gate.
#590 LocalTerra A-lcd/B-lt executed the pinned 8266 LCD wasm (1:1 Transfer + CreatePair vs EMBER on a local store id only). Decomp/fingerprint refreshed. REPORT.md stays NO-GO — factory-global Everybody instantiate, issuer wasm-admin / F6, minter residual, incomplete Send/TransferFrom and round-trip swap. Do not
AddWhitelistedCodeId 8266on columbus-5.mentioned in merge request !1115
Follow-up to note 3719458992.
1. Incomplete suite — done. Layer A-lcd + B-lt now execute on the pinned LCD wasm (
953AD60C…), not Transfer-only:balance_atvs livecw20-codeid-audits/codeids/8266/REPORT.mdis GO. Re-run:make verify-issue-581.2–4. Residuals documented, not blocking (as requested):
Columbus-5 still needs DEX 2-of-3
AddWhitelistedCodeId 8266. Do not whitelist a LocalTerra store id.MR: https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/397
mentioned in commit
0ad712a282marked as related to #591
mentioned in issue #591
!1115 merge + acceptance check (no CI wait)
Merged !1115 (
feat/581-8266-full-suite@bd02d880→ merge commit0ad712a2). GitLab reported mergeable / no conflicts; localmerge-treealso clean (fast-forward from8689a129). Did not enable auto-merge and did not wait for CI.Acceptance vs this issue
codeids/8266/REPORT.md(decomp + suite, not rebuild)cw20-whitelist-policy.md(A14 / B13 / B14)953AD60C…(Transfer, TransferFrom, Send, P2, B7, L1)layer-a-lcd.sh/layer-b-lt.sh; JSON flags only written after assertsAddWhitelistedCodeId 8266make verify-issue-581is onmain. MR “Closes #581” closed this issue as the template gate. 2-of-3 listing is a separate ops step.Problems / residuals (not merge blockers)
gitleaks(#16045970792)failure_reason=ci_quota_exceeded— the scanner did not run. This is not a gitleaks finding. GitLabonly_allow_merge_if_pipeline_succeedsis false.pending-lcdrows (D1–D4, D11–D12, D15–D16, D19, D21, E3, G3, …). GO is the executed DEX write path + residual policy, not a fully green catalogue sheet.launch-checklist.mdstill says 8266 BLOCK (including a stale “until dump rebuilds” line),docs/testing.mdF6 row “8266 still BLOCK”,docs/qa-invariants.mdQ7/M590-7, deploy-trace templates. Tracked in #591.Next
DEX 2-of-3
AddWhitelistedCodeId 8266then SpaceUSD/UST1 create+provide withreceiver= CMM → #558 workstream 0/1. Docs leftover → #591.Static harness review after !1115 (non-blocking)
Post-merge review of A-lcd / B-lt /
verify-issue-581/verify-issue-589/ REPORT.md: no blocking defects. Paths are fail-closed (not stub-PASS); whitelist uses only the LocalTerra store id; C6 clean.Residual coverage (not a listing veto; not #591 docs copy):
make verify-issue-581can PASS without LocalTerra (pin + REPORT text only) unlessVERIFY581_REQUIRE_CHAIN=1.amountattr is optional if missing; jq onlayer-*-*.jsonchecks a subset of flags (scripts still fail closed before writing JSON).Columbus-5 listing landed (ops follow-up; gate stays closed)
Template GO on this issue is unchanged. DEX 2-of-3 has now executed
AddWhitelistedCodeId 8266on factoryterra1ejpgvv7g3hj0u6fpcnxhflqp84g0w3cnaskqkg5733ygwlmf963sfchsea.BA7C9FD05D0FC0BC14713A53325E1F42AAAECF3A11E4EC3BC91368013D8FC5D1GetWhitelistedCodeIds=[6036, 8266, 10184]IsCodeIdWhitelisted 8266= trueSpaceUSD/UST1 create+provide remains on #558 workstream 1. ALPHA 8654 stays off the whitelist.