sec: listed CW20 can migrate off whitelist after CreatePair

PlasticDigits commented

2026-08-20 03:37:28 +00:00

(Migrated from gitlab.com)

Gate

This issue blocks #581. Do not close #581 with a go to factory AddWhitelistedCodeId 8266, and do not CreatePair / seed SpaceUSD/UST1, until this issue has a written severity + mitigation decision.

Parent ops: #558. Extracted from #581 item (4) — the hole is not 8266-specific.

Policy: docs/runbooks/cw20-whitelist-policy.md / #377 H-01 / P2. Already named in SEC-I01 H05 (docs/audits/sec-i-prompt-pack.md): whitelist gates code_id only at pair creation; a later upgrade that adds a fee still passes. That line was treated as an audit-doc gap. It is also a live execute path.

What the contracts actually do

Factory CreatePair queries each asset’s ContractInfo.code_id and requires it in WHITELISTED_CODE_IDS (smartcontracts/contracts/factory/src/contract.rs). Pair swap / provide / withdraw / limit escrow never re-query code_id and never consult the factory whitelist again.

Terra Classic MsgMigrateContract (wasm admin of that instance) can change the instance’s code_id to any stored wasm. The pair keeps transferring the same CW20 address. If the new wasm is fee-on-transfer, rebase, or otherwise not 1:1, reserves and PENDING_ESCROW desync from the banked balance — same class as #448 / ALPHA 8654. BlacklistToken / pair pause are after-the-fact (detection window).

Factory today: GetWhitelistedCodeIds = [6036, 10184]. Anyone who pays the CreatePair fee can list any instance currently on those templates, then the instance admin (often not us) can migrate it off the whitelist.

Why this is not only #581 / SpaceUSD

Surface	Why it matters
Any already-listed pair	Token wasm admin can `MsgMigrateContract` after listing. Pair will keep trading.
Permissionless 6036	TerraSwap token template is already on the factory whitelist. Thousands of columbus-5 instances; many still have issuer admin. CreatePair (100 LUNC) + later migrate to taxed wasm is enough.
10184 (our mintable)	Honest today, but instance admin can migrate that token to a different code id (including one we never whitelisted). Hub tokens (UST1 / wraps / USTR) are this template.
Future 8266	Terraport token, instantiate permission Everybody, 1686 live contracts. SpaceUSD admin is a third-party issuer. Listing it without a migrate policy repeats the 6036 hole on a new template.

Live factory (2026-08-20): 14 pairs, 13 unique assets. None of the currently listed assets have a third-party wasm admin — all are protocol keys — so existing TVL is our-key / our-upgrade risk, not an outside issuer. That does not close the permissionless 6036 CreatePair → migrate path, and it does not make SpaceUSD safe to list.

Token	code_id	wasm admin
UST1, USTR, cLUNC, cUSTC	10184	`cl8y2_admin` `terra1xsecn4…` (wrap-stack CMM gov)
CL8Y + soft gems (EMBER/CORAL/…)	10184	DEX 2-of-3 `terra1zlmv2…`
PEARL, QUARTZ	6036	DEX 2-of-3 `terra1zlmv2…`
SpaceUSD (not listed)	8266	issuer `terra133n0pv8…`

Exploit sketch (H-01 / P2)

Attacker (or any 6036 issuer) CreatePair with a currently-whitelisted CW20 that still has wasm admin.
Seed / attract LP (or wait for retail).
Admin MsgMigrateContract onto a FoT / rebase / hook wasm not on WHITELISTED_CODE_IDS.
Swaps and limit escrow still credit declared amounts. Pair reserves / maker escrow no longer match CW20 balances. Withdrawals and refunds break or value is skimmed.

Same sequence works for SpaceUSD after a #581 go, with the issuer key we do not control.

Mitigations to decide (not all required)

Record a go/no-go per option. Combining (A)+(D) is the usual fail-closed shape; (B) is stricter; (C) is listing policy only.

(A) Re-check code_id on pair write paths — swap / provide / withdraw / limit place+fill query ContractInfo.code_id and abort unless it is still on the factory whitelist (or equals a snapshot stored at CreatePair). Stops migrate-to-unlisted-wasm. Gas + LCD query on every trade.
(B) Pin exact code_id at CreatePair — store the listing-time ids on the pair; any instance migrate (even to another whitelisted template) fails closed until governance updates the pin. Honest 10184 upgrades would freeze those pairs until a pair migrate / admin msg.
(C) Listing policy: no wasm admin — refuse (ops or on-chain) to list a CW20 whose ContractInfo.admin is set. clear-contract-admin is irreversible. Blocks SpaceUSD unless the issuer clears admin. Does not fix tokens already listed. Does not stop a 6036 CreatePair unless we also enforce it in the factory.
(D) Indexer / ops watch — snapshot (pair, asset, code_id) at listing; alert + SetPairPaused / BlacklistToken on drift. Detection window remains. Needed even with (A) for forensics.
(E) Do not whitelist 8266 — #581 no-go; SpaceUSD only via a 10184 wrap we admin. Shrinks new third-party-admin surface; does not close the existing 6036 hole.

Do not add pair balance-delta / FoT swap math to “make migrated tokens work” (H-01).

Audit / decision checklist

Confirm (code cite + test gap): pair execute paths do not read asset code_id
Inventory: every factory pair asset code_id + wasm admin (refresh the table above)
Severity: written High/Critical for permissionless 6036+migrate vs residual risk on protocol-admin 10184/6036
Choose mitigations (A–E) with owner (contracts vs ops vs both)
If (A) or (B): factory/pair version bump, tests (CreatePair honest token → migrate to FoT → swap must fail), docs in security-model.md + cw20-whitelist-policy.md
If ops-only: runbook (watch + pause/blacklist), on-call owner, false-positive rollback
Explicit statement for #581: 8266 listing allowed only if (chosen controls are live or SpaceUSD admin is cleared or wrap-to-10184)

Acceptance

This issue has a recorded severity and chosen mitigation (including “accept risk” if that is the decision — must be explicit, not implicit)
#581 may close go on 8266 only after that statement exists
Docs/tests updated if on-chain or watch-path work was chosen
Repeat inventory of listed-asset admins attached here (or linked runbook)

Labels / owner

security + contracts (factory/pair) / ops (watch + incident) / governance (2-of-3 pause/blacklist, wrap-stack admins)

Priority

P1 / High — protocol whitelist invariant, not an 8266-only audit note. Not a reason to pause existing protocol-admin pairs by itself; is a reason to stop expanding the whitelist (8266) and to treat permissionless 6036 listing as in-scope.

## Gate **This issue blocks [#581](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/581).** Do **not** close #581 with a **go** to factory `AddWhitelistedCodeId` **8266**, and do **not** `CreatePair` / seed **SpaceUSD/UST1**, until this issue has a written severity + mitigation decision. Parent ops: [#558](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/558). Extracted from #581 item **(4)** — the hole is **not** 8266-specific. Policy: [`docs/runbooks/cw20-whitelist-policy.md`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/blob/main/docs/runbooks/cw20-whitelist-policy.md) / [#377](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/377) **H-01** / **P2**. Already named in SEC-I01 **H05** (`docs/audits/sec-i-prompt-pack.md`): whitelist gates `code_id` **only at pair creation**; a later upgrade that adds a fee still passes. That line was treated as an audit-doc gap. It is also a **live execute path**. --- ## What the contracts actually do Factory `CreatePair` queries each asset’s `ContractInfo.code_id` and requires it in `WHITELISTED_CODE_IDS` (`smartcontracts/contracts/factory/src/contract.rs`). Pair **swap / provide / withdraw / limit escrow** never re-query `code_id` and never consult the factory whitelist again. Terra Classic `MsgMigrateContract` (wasm **admin** of that **instance**) can change the instance’s `code_id` to any stored wasm. The pair keeps transferring the same CW20 address. If the new wasm is fee-on-transfer, rebase, or otherwise not 1:1, reserves and `PENDING_ESCROW` desync from the banked balance — same class as [#448](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/448) / ALPHA **8654**. `BlacklistToken` / pair pause are **after-the-fact** (detection window). Factory today: `GetWhitelistedCodeIds` = **`[6036, 10184]`**. Anyone who pays the CreatePair fee can list **any** instance currently on those templates, then the **instance admin** (often not us) can migrate it off the whitelist. --- ## Why this is not only #581 / SpaceUSD | Surface | Why it matters | |---------|----------------| | **Any already-listed pair** | Token wasm admin can `MsgMigrateContract` after listing. Pair will keep trading. | | **Permissionless 6036** | TerraSwap token template is already on the factory whitelist. Thousands of columbus-5 instances; many still have issuer admin. CreatePair (100 LUNC) + later migrate to taxed wasm is enough. | | **10184 (our mintable)** | Honest today, but instance admin can migrate **that token** to a different code id (including one we never whitelisted). Hub tokens (UST1 / wraps / USTR) are this template. | | **Future 8266** | Terraport token, instantiate permission **Everybody**, **1686** live contracts. SpaceUSD admin is a **third-party** issuer. Listing it without a migrate policy repeats the 6036 hole on a new template. | Live factory (2026-08-20): **14** pairs, **13** unique assets. **None** of the currently listed assets have a third-party wasm admin — all are protocol keys — so existing TVL is **our-key / our-upgrade** risk, not an outside issuer. That does **not** close the permissionless 6036 CreatePair → migrate path, and it does **not** make SpaceUSD safe to list. | Token | code_id | wasm admin | |-------|---------|------------| | UST1, USTR, cLUNC, cUSTC | 10184 | `cl8y2_admin` `terra1xsecn4…` (wrap-stack CMM gov) | | CL8Y + soft gems (EMBER/CORAL/…) | 10184 | DEX 2-of-3 `terra1zlmv2…` | | PEARL, QUARTZ | 6036 | DEX 2-of-3 `terra1zlmv2…` | | SpaceUSD (not listed) | 8266 | issuer `terra133n0pv8…` | --- ## Exploit sketch (H-01 / P2) 1. Attacker (or any 6036 issuer) `CreatePair` with a currently-whitelisted CW20 that still has wasm admin. 2. Seed / attract LP (or wait for retail). 3. Admin `MsgMigrateContract` onto a FoT / rebase / hook wasm **not** on `WHITELISTED_CODE_IDS`. 4. Swaps and limit escrow still credit **declared** amounts. Pair reserves / maker escrow no longer match CW20 balances. Withdrawals and refunds break or value is skimmed. Same sequence works for SpaceUSD after a #581 **go**, with the issuer key we do not control. --- ## Mitigations to decide (not all required) Record a go/no-go per option. Combining (A)+(D) is the usual fail-closed shape; (B) is stricter; (C) is listing policy only. - **(A) Re-check `code_id` on pair write paths** — swap / provide / withdraw / limit place+fill query `ContractInfo.code_id` and abort unless it is still on the factory whitelist (or equals a snapshot stored at CreatePair). Stops migrate-to-unlisted-wasm. Gas + LCD query on every trade. - **(B) Pin exact `code_id` at CreatePair** — store the listing-time ids on the pair; any instance migrate (even to another *whitelisted* template) fails closed until governance updates the pin. Honest 10184 upgrades would freeze those pairs until a pair migrate / admin msg. - **(C) Listing policy: no wasm admin** — refuse (ops or on-chain) to list a CW20 whose `ContractInfo.admin` is set. `clear-contract-admin` is irreversible. Blocks SpaceUSD unless the issuer clears admin. Does **not** fix tokens already listed. Does **not** stop a 6036 CreatePair unless we also enforce it in the factory. - **(D) Indexer / ops watch** — snapshot `(pair, asset, code_id)` at listing; alert + `SetPairPaused` / `BlacklistToken` on drift. Detection window remains. Needed even with (A) for forensics. - **(E) Do not whitelist 8266** — #581 **no-go**; SpaceUSD only via a **10184** wrap we admin. Shrinks *new* third-party-admin surface; **does not** close the existing 6036 hole. Do **not** add pair balance-delta / FoT swap math to “make migrated tokens work” (H-01). --- ## Audit / decision checklist - [ ] Confirm (code cite + test gap): pair execute paths do not read asset `code_id` - [ ] Inventory: every factory pair asset `code_id` + wasm `admin` (refresh the table above) - [ ] Severity: written High/Critical for permissionless 6036+migrate vs residual risk on protocol-admin 10184/6036 - [ ] Choose mitigations (A–E) with owner (contracts vs ops vs both) - [ ] If (A) or (B): factory/pair version bump, tests (`CreatePair` honest token → migrate to FoT → swap must fail), docs in `security-model.md` + `cw20-whitelist-policy.md` - [ ] If ops-only: runbook (watch + pause/blacklist), on-call owner, false-positive rollback - [ ] Explicit statement for #581: **8266 listing allowed only if** (chosen controls are live **or** SpaceUSD admin is cleared **or** wrap-to-10184) --- ## Acceptance - [ ] This issue has a recorded **severity** and **chosen mitigation** (including “accept risk” if that is the decision — must be explicit, not implicit) - [ ] #581 may close **go** on 8266 only after that statement exists - [ ] Docs/tests updated if on-chain or watch-path work was chosen - [ ] Repeat inventory of listed-asset admins attached here (or linked runbook) ## Labels / owner security + contracts (factory/pair) / ops (watch + incident) / governance (2-of-3 pause/blacklist, wrap-stack admins) ## Priority **P1 / High** — protocol whitelist invariant, not an 8266-only audit note. Not a reason to pause existing protocol-admin pairs by itself; **is** a reason to stop expanding the whitelist (8266) and to treat permissionless 6036 listing as in-scope.

PlasticDigits commented

2026-08-20 03:37:46 +00:00

(Migrated from gitlab.com)

marked as related to #581

PlasticDigits commented

2026-08-20 03:37:47 +00:00

(Migrated from gitlab.com)

marked as related to #558

PlasticDigits commented

2026-08-20 03:37:48 +00:00

(Migrated from gitlab.com)

marked as related to #448

PlasticDigits commented

2026-08-20 03:37:49 +00:00

(Migrated from gitlab.com)

marked as related to #377

PlasticDigits commented

2026-08-20 03:37:51 +00:00

(Migrated from gitlab.com)

mentioned in issue #581

PlasticDigits commented

2026-08-20 03:37:53 +00:00

(Migrated from gitlab.com)

mentioned in issue #558

PlasticDigits commented

2026-08-20 03:37:55 +00:00

(Migrated from gitlab.com)

Opened from #581 item (4). GitLab blocks link type is not available on this project’s license (Blocked issues not available for current license); gate is process: #581 must not go on 8266 while this issue is open. Related: #558, #448, #377.

Opened from [#581](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/581) item (4). GitLab `blocks` link type is not available on this project’s license (`Blocked issues not available for current license`); gate is process: #581 must not go on 8266 while this issue is open. Related: #558, #448, #377.

PlasticDigits commented

2026-08-20 03:41:49 +00:00

(Migrated from gitlab.com)

Suggested direction:
(B) so that behavior of the token is guaranteed to remain the same post listing
(A) so that if a codeid is discovered that has a bug can be removed from whitelist blocking all trades until tokens are migrated
Do not proceed with (D) as (A) provides the same functionality with better coverage.
(E) Rejected as many quality tokens require admin or may need to be upgraded.

Suggested direction: (B) so that behavior of the token is guaranteed to remain the same post listing (A) so that if a codeid is discovered that has a bug can be removed from whitelist blocking all trades until tokens are migrated Do not proceed with (D) as (A) provides the same functionality with better coverage. (E) Rejected as many quality tokens require admin or may need to be upgraded.

PlasticDigits commented

2026-08-20 12:39:19 +00:00

(Migrated from gitlab.com)

mentioned in merge request !1107

PlasticDigits commented

2026-08-20 12:39:51 +00:00

(Migrated from gitlab.com)

On-chain (A)+(B) shipped in !1107 (fix/582-cw20-code-id-pin). make verify-issue-582 passed twice (pin + FoT migrate + whitelist freeze + refresh refuses unlisted live id + pair migrate backfill). Playbook: skills/AGENTS_CW20_CODE_ID_PIN.md. Invariant F6.

Audit / decision checklist

Confirm (code cite + test gap): pair execute paths now read live code_id + factory whitelist — pair/src/asset_code_id_guard.rs (assert_asset_code_ids on swap/provide/withdraw/limit place+fill/cancel/claim). Tests: asset_code_id_pin_tests::*.
Inventory: 2026-08-20 table copied into docs/runbooks/cw20-whitelist-policy.md (not a live LCD re-query).
Severity: High for permissionless 6036+migrate. Residual protocol-admin 10184/6036 is our-key upgrade risk (fail-closed until Refresh).
Chosen: (A) + (B). (C) not implemented. (D) rejected (A covers freeze). (E) rejected as 8266 policy.
Factory 1.9.0 / pair 1.15.0, tests, docs (security-model.md, cw20-whitelist-policy.md, contracts-terraclassic.md, SEC-D06, H05).
Not ops-only: on-chain pin + re-check is the primary control.
#581 / 8266: listing allowed only after factory 1.9.0 + pair 1.15.0 are migrated live, or SpaceUSD admin cleared, or wrap-to-10184. Merging !1107 is not a go.

Acceptance

Recorded severity + chosen mitigation
#581 go statement exists (migrate-live, not merge-only)
Docs/tests for on-chain work
Inventory attached in runbook (issue snapshot; live LCD refresh still ops)

Not in this MR (follow-ups)

(C) refuse wasm-admin at listing
(D) indexer watch
(E) hard-refuse 8266 in factory
FoT balance-delta swap math (explicitly out of scope / H-01)
Columbus-5 wasm migrate (factory then pair) — required before 8266
Live LCD re-inventory of listed-asset admins

On-chain **(A)+(B)** shipped in [!1107](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/389) (`fix/582-cw20-code-id-pin`). `make verify-issue-582` passed twice (pin + FoT migrate + whitelist freeze + refresh refuses unlisted live id + pair migrate backfill). Playbook: `skills/AGENTS_CW20_CODE_ID_PIN.md`. Invariant **F6**. ### Audit / decision checklist - [x] Confirm (code cite + test gap): pair execute paths **now** read live `code_id` + factory whitelist — `pair/src/asset_code_id_guard.rs` (`assert_asset_code_ids` on swap/provide/withdraw/limit place+fill/cancel/claim). Tests: `asset_code_id_pin_tests::*`. - [x] Inventory: 2026-08-20 table copied into [`docs/runbooks/cw20-whitelist-policy.md`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/blob/fix/582-cw20-code-id-pin/docs/runbooks/cw20-whitelist-policy.md) (not a live LCD re-query). - [x] Severity: **High** for permissionless 6036+migrate. Residual protocol-admin 10184/6036 is our-key upgrade risk (fail-closed until Refresh). - [x] Chosen: **(A) + (B)**. (C) not implemented. (D) rejected (A covers freeze). (E) rejected as 8266 policy. - [x] Factory **1.9.0** / pair **1.15.0**, tests, docs (`security-model.md`, `cw20-whitelist-policy.md`, `contracts-terraclassic.md`, SEC-D06, H05). - [x] Not ops-only: on-chain pin + re-check is the primary control. - [x] **#581 / 8266:** listing allowed **only after** factory 1.9.0 + pair 1.15.0 are **migrated live**, **or** SpaceUSD admin cleared, **or** wrap-to-10184. Merging !1107 is not a go. ### Acceptance - [x] Recorded severity + chosen mitigation - [x] #581 go statement exists (migrate-live, not merge-only) - [x] Docs/tests for on-chain work - [x] Inventory attached in runbook (issue snapshot; live LCD refresh still ops) ### Not in this MR (follow-ups) - (C) refuse wasm-admin at listing - (D) indexer watch - (E) hard-refuse 8266 in factory - FoT balance-delta swap math (explicitly out of scope / H-01) - Columbus-5 wasm migrate (factory then pair) — **required before 8266** - Live LCD re-inventory of listed-asset admins

PlasticDigits commented

2026-08-20 12:39:52 +00:00

(Migrated from gitlab.com)

On-chain mitigation is in !1107 (fix/582-cw20-code-id-pin). Chosen path is (B) pin + (A) whitelist re-check. Factory 1.9.0 + pair 1.15.0. Verify: make verify-issue-582.

Audit / decision checklist

Confirm (code cite + test gap): pair execute paths did not read asset code_id before this MR; they now fail closed via assert_asset_code_ids on swap / provide / withdraw / limit place+fill
Inventory: every factory pair asset code_id + wasm admin (table in this issue is still 2026-08-20; not re-queried in this MR)
Severity: High for permissionless 6036+migrate; residual risk on protocol-admin 10184/6036 is our-key upgrade risk (fail-closed until RefreshPairAssetCodeIds)
Choose mitigations: (A)+(B) on-chain. (C) not implemented. (D) indexer watch not implemented (rejected). (E) not implemented as a factory hard-refuse of 8266 (listing policy only)
(A)+(B): version bump, tests (CreatePair honest token → migrate to FoT → swap fails; refresh refuses unlisted live id), docs in security-model.md + cw20-whitelist-policy.md + invariant F6 + skills/AGENTS_CW20_CODE_ID_PIN.md
Ops-only watch/pause is not the chosen path (optional later; not required to land this control)
Explicit statement for #581: 8266 listing allowed only if factory 1.9.0 + pair 1.15.0 are migrated live, or SpaceUSD wasm admin is cleared, or wrap-to-10184. Merging !1107 is not enough.

Acceptance

Recorded severity + chosen mitigation (not accept-risk)
#581 8266 go statement exists (gated on live migrate, not merge)
Docs/tests for on-chain work
Repeat inventory of listed-asset admins attached here (still outstanding)

Do not AddWhitelistedCodeId 8266 until factory then pair wasm is migrated.

On-chain mitigation is in !1107 (`fix/582-cw20-code-id-pin`). Chosen path is **(B) pin + (A) whitelist re-check**. Factory **1.9.0** + pair **1.15.0**. Verify: `make verify-issue-582`. ### Audit / decision checklist - [x] Confirm (code cite + test gap): pair execute paths did not read asset `code_id` before this MR; they now fail closed via `assert_asset_code_ids` on swap / provide / withdraw / limit place+fill - [ ] Inventory: every factory pair asset `code_id` + wasm `admin` (table in this issue is still **2026-08-20**; not re-queried in this MR) - [x] Severity: **High** for permissionless 6036+migrate; residual risk on protocol-admin 10184/6036 is our-key upgrade risk (fail-closed until `RefreshPairAssetCodeIds`) - [x] Choose mitigations: **(A)+(B)** on-chain. **(C)** not implemented. **(D)** indexer watch not implemented (rejected). **(E)** not implemented as a factory hard-refuse of 8266 (listing policy only) - [x] (A)+(B): version bump, tests (`CreatePair` honest token → migrate to FoT → swap fails; refresh refuses unlisted live id), docs in `security-model.md` + `cw20-whitelist-policy.md` + invariant **F6** + `skills/AGENTS_CW20_CODE_ID_PIN.md` - [x] Ops-only watch/pause is **not** the chosen path (optional later; not required to land this control) - [x] Explicit statement for #581: **8266 listing allowed only if** factory 1.9.0 + pair 1.15.0 are **migrated live**, **or** SpaceUSD wasm admin is cleared, **or** wrap-to-10184. Merging !1107 is not enough. ### Acceptance - [x] Recorded severity + chosen mitigation (not accept-risk) - [x] #581 8266 **go** statement exists (gated on live migrate, not merge) - [x] Docs/tests for on-chain work - [ ] Repeat inventory of listed-asset admins attached here (still outstanding) Do **not** `AddWhitelistedCodeId 8266` until factory then pair wasm is migrated.

PlasticDigits commented

2026-08-20 13:25:49 +00:00

(Migrated from gitlab.com)

mentioned in commit 5402859e3d

mentioned in commit 5402859e3d82ef34e2b3c60993b795e3031c3550

PlasticDigits commented

2026-08-20 13:31:31 +00:00

(Migrated from gitlab.com)

mentioned in issue #584

PlasticDigits commented

2026-08-20 13:31:31 +00:00

(Migrated from gitlab.com)

marked as related to #584

PlasticDigits commented

2026-08-20 14:43:29 +00:00

(Migrated from gitlab.com)

mentioned in merge request !1108

PlasticDigits commented

2026-08-21 00:14:19 +00:00

(Migrated from gitlab.com)

mentioned in commit 711ff9cad5

mentioned in commit 711ff9cad5378470de668917daf25cfb868a9e79

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-08-21 00:14:22 +00:00

PlasticDigits commented

2026-08-21 00:16:14 +00:00

(Migrated from gitlab.com)

Merge of !1107 (2026-08-21)

!1107 is merged to main (711ff9ca). Local make verify-issue-582 passed (6 pin tests ×2 + docs greps). GitLab CI on the MR failed with ci_quota_exceeded on test-contracts / cargo-audit-smartcontracts / gitleaks — not a code failure; CI was not waited on.

Acceptance vs this merge

On-chain (A)+(B) is on main (factory 1.9.0, pair 1.15.0, invariant F6).
Merge is not live F6. Columbus-5 factory-then-pair migrate + smoke remains #584 / launch-checklist BLOCK.
#581 / 8266: still no-go until that migrate has run (or SpaceUSD admin cleared, or wrap-to-10184). Do not AddWhitelistedCodeId 8266.
Listed-asset admin inventory in docs/runbooks/cw20-whitelist-policy.md is still the 2026-08-20 snapshot. Re-query LCD ContractInfo (code_id + admin) before any #581 go — not done in this merge.
Test gap (non-blocking): pin tests cover swap + refresh-refuse-unlisted; no dedicated CancelLimitOrder / ClaimExpiredLimitOrder / WithdrawLiquidity drift cases. UpdateLimitOrderPrice / CleanLimitBook stay ungated (no CW20 movement).

Follow-ups: execution on #584. Frontend/indexer freeze visibility is a separate P1 (filed after merge if missing).

## Merge of !1107 (2026-08-21) !1107 is **merged** to `main` (`711ff9ca`). Local `make verify-issue-582` passed (6 pin tests ×2 + docs greps). GitLab CI on the MR failed with `ci_quota_exceeded` on `test-contracts` / `cargo-audit-smartcontracts` / `gitleaks` — not a code failure; CI was not waited on. ### Acceptance vs this merge - On-chain **(A)+(B)** is on `main` (factory **1.9.0**, pair **1.15.0**, invariant **F6**). - **Merge is not live F6.** Columbus-5 factory-then-pair migrate + smoke remains **#584** / launch-checklist **BLOCK**. - **#581 / 8266:** still **no-go** until that migrate has **run** (or SpaceUSD admin cleared, or wrap-to-10184). Do not `AddWhitelistedCodeId 8266`. - Listed-asset admin inventory in `docs/runbooks/cw20-whitelist-policy.md` is still the **2026-08-20 snapshot**. Re-query LCD `ContractInfo` (code_id + admin) before any #581 go — not done in this merge. - Test gap (non-blocking): pin tests cover swap + refresh-refuse-unlisted; no dedicated `CancelLimitOrder` / `ClaimExpiredLimitOrder` / `WithdrawLiquidity` drift cases. `UpdateLimitOrderPrice` / `CleanLimitBook` stay ungated (no CW20 movement). Follow-ups: execution on **#584**. Frontend/indexer freeze visibility is a separate P1 (filed after merge if missing).

PlasticDigits commented

2026-08-21 00:16:25 +00:00

(Migrated from gitlab.com)

marked as related to #585

PlasticDigits commented

2026-08-21 00:16:25 +00:00

(Migrated from gitlab.com)

mentioned in issue #585

PlasticDigits commented

2026-08-21 00:17:22 +00:00

(Migrated from gitlab.com)

P1 freeze UX follow-up: #585. Live migrate tracker remains #584.

PlasticDigits commented

2026-08-21 00:46:46 +00:00

(Migrated from gitlab.com)

Live columbus-5 status (execution on #584, this contract issue stays closed): factory 1.9.0 / code 11602 is live. 11/14 pairs are 1.15.0 with pins; 3 pairs still 1.14.0 / 11586 (no pin). Listed assets remain 10184 + 6036. #581 / 8266 still no-go until #584 14/14 + smoke.

Live columbus-5 status (execution on #584, this contract issue stays closed): factory **1.9.0** / code **11602** is live. **11/14** pairs are **1.15.0** with pins; **3** pairs still **1.14.0** / 11586 (no pin). Listed assets remain 10184 + 6036. #581 / 8266 still no-go until #584 14/14 + smoke.

PlasticDigits commented

2026-08-21 00:50:26 +00:00

(Migrated from gitlab.com)

Live F6 is on columbus-5: factory 1.9.0 / 11602, all 14 pairs 1.15.0 / 11601 with pins, pair_code_id 11601. Tracker #584 closing. #581 / 8266 still no-go (source review). Freeze UX: #585.

Live F6 is on columbus-5: factory **1.9.0** / **11602**, all 14 pairs **1.15.0** / **11601** with pins, `pair_code_id` 11601. Tracker #584 closing. #581 / 8266 still no-go (source review). Freeze UX: #585.

PlasticDigits commented

2026-08-21 01:15:48 +00:00

(Migrated from gitlab.com)

mentioned in merge request !1110

PlasticDigits commented

2026-08-21 03:42:24 +00:00

(Migrated from gitlab.com)

mentioned in merge request !1111

PlasticDigits commented

2026-08-21 03:43:22 +00:00

(Migrated from gitlab.com)

UX / routing visibility for live F6 freeze (F389-01 / F389-02) is in !1111 / #585. Indexer code_id_frozen + hop exclude is not a substitute for on-chain pin + write-path re-check (this issue). Option (D) stays rejected as a security control.

UX / routing visibility for live F6 freeze (F389-01 / F389-02) is in !1111 / #585. Indexer `code_id_frozen` + hop exclude is **not** a substitute for on-chain pin + write-path re-check (this issue). Option (D) stays rejected as a security control.

PlasticDigits commented

2026-08-22 02:59:09 +00:00

(Migrated from gitlab.com)

mentioned in issue #589