design: community CW20 migrate onto 11611 tax template (risks + strategies) #603
Labels
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:implement
agent:implement
agent:open_issues
agent:ready
agent:research
agent:security_audit
agent:verify
architecture
backend
blocker:hybrid
blocker:launch
blocker:limit-orders
blocker:v2
block:log_only
block:security
bug
ci
contracts
correctness
deploy
dev
devops
docs
documentation
duplicate
e2e
enhancement
epic
feature
frontend
functional-completion
gas
good first issue
governance
help wanted
high-risk
hooks
hybrid
indexer
infra
infrastructure
integrators
invalid
launch-blocker
limit-orders
localnet
localterra
low priority
missing-implementation
needs-design
ops
performance
priority
high
priority
medium
product
qa
QA
question
ready
ready
research
scripts
security
security-hardening
smartcontracts
tech-debt
testing
ux
UX
v2
verification
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
code/cl8y-dex-terraclassic#603
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Parent / related
Community tax template #592 / store+list #601 / Create Token #593 / #602. F6 pin #582. ALPHA venues #558 (note: in-place 8654→11611 is not live).
This ticket is investigation + design (risks, options, guardrails). Do not ship a migrate importer until this issue records a go/no-go per source template. Implementation is a follow-up if a strategy is accepted.
Current codebase
cl8y-community-tax-token(columbus-5 11611, factory-listed) is a cw20-base fork plus tax config. Create is launcher-only for attested tokens:terra126pr5…instantiates withadmin: cmm_governance(T592-5). Manager cannot migrate orUpdateAdmin.ExecuteMsg::CreateToken(0 SKU). Paid SKUs are UST1Send+ hook.MigrateMsg {}only runscw2::ensure_from_older_version(…, "crates.io:cl8y-community-tax-token", version). Same-crate bumps only. Foreign cw2 names revert.BALANCES/TOKEN_INFOplusCONFIG,FEATURES,LISTED_PAIRS,PROTOCOL_EXEMPT,MANAGER_EXEMPT,SINKS,LAUNCH_GUARDS,GetLauncherOrigin.Send+Swapto aRegisterListedPairpair. Buy is outbound split from a listed pair. Not atax_map/ inbound FoT template.ContractInfo.code_idatCreatePairand re-checks whitelist on writes. After a successful migrate to 11611, listed pairs on the old id fail closed untilRefreshPairAssetCodeIds(11611 is already whitelisted).ALPHA (motivating case, #558):
terra1x6e64es6yhauhvs3prvpdg2gkqdtfru840wgnhs935x8axr7zxkqzysuxzcode_idcw20_taxedterra1ljqgc0cdkl7gcc7s64eczv3hrgga32vfh8xvfj(not CMM / not DEX 2-of-3)on_sendAlways 1%; Terraport dest 8260/8214 0%; transfer-out of those codes 4.5%;transfer_fromnever; proceedsterra1w37akazc…minternull8654 is a known-bad harness control. Do not whitelist it. In-place migrate to 11611 reverts today.
Communities on 10184 / 6036 / 8266 (honest cw20-base / Terraport token) have the same gap: they can only new-instantiate 11611 (new address, empty balances) or stay on the old template.
Why this is needed
Communities want to keep the same CW20 address and holder set while moving onto the listed tax template (DEX-safe extra-debit / outbound split, Create Token / catalog, factory pairs). Today the only safe product path is a new 11611 token + liquidity move (or a 10184 wrap). That splits holders, tickers, and Terraport vs CL8Y venues.
ALPHA is the first ask (#558 note). Others on 10184/8266 will ask the same. We need a written strategy: refuse in-place, allowlisted importer, or wrap-only — before anyone signs
MsgMigrateContractat the live ALPHA address.Constraints / guardrails
tax_map/ inbound FoT template). Listing 11611 is enough for new or migrated-to-11611 addresses.terra16j5u6…). Source admin becomes manager only.UpdateAdminin the same migrate tx (or immediately after) is required if we allow in-place.GetLauncherOrigin+ CMM admin unless this issue explicitly defines an attested-migrate origin.code_idpin must Refresh or stay frozen. Document the ops order.ensure_from_older_versionfor same-crate upgrades. A foreign importer is a new migrate branch with an explicit allowlist, not a silent cw2 bypass.total_supplyand everyBALANCESentry must match pre-migrate (or a documented dust rule).tax_map— after adopt,{"tax_map":{}}must fail (unknown query). Execute paths must not read 8654 tax keys.max_buy+max_sell+max_transfer ≤ 2500. MintControl stays instantiate-only unless the source already has a minter (then map or revoke — decide here).Relevant files
smartcontracts/contracts/community-tax-token/src/contract.rsinstantiate,migrate(cw2 same-crate only)smartcontracts/contracts/community-tax-token/src/msg.rsMigrateMsg {}, SKUs, capssmartcontracts/contracts/community-tax-token/src/state.rsCONFIG/FEATURES/ exemptionssmartcontracts/contracts/community-tax-token/src/tax.rssmartcontracts/contracts/community-token-launcher/src/contract.rsadmin: cmm_governance,GetLauncherOriginstampdocs/contracts-terraclassic.md§ Community tax CW20docs/runbooks/cw20-code-id-ops.mdskills/AGENTS_COMMUNITY_TAX_CW20.mdskills/AGENTS_CW20_CODE_ID_PIN.mdcw20-codeid-audits/codeids/11611/REPORT.mdcw20-codeid-audits/codeids/8654/README.mdStrategies to evaluate (pick one or a sequenced mix)
cALPHA) — already on #558migrate— only if source cw2 ∈ {cw20-base, terraport_token, cw20-mintable} and LCD probe shows notax_map; copy/keepBALANCES/TOKEN_INFO; writeCONFIG/FEATURES; set cw2;UpdateAdmin→ CMMtax_map)tax_map, wipe it, map 1%/4.5% → sell/buy bps, prove every balance 1:1Recommended direction (pending this investigation):
GetMigrateOriginattestation, F6 Refresh runbook.tax_map, and Layer A/B that 8654-after-migrate is indistinguishable from a launcher 11611 token (inbound 1:1, extra-debit sell). Treat S4 as high-risk; do not schedule it as the first impl.Do not implement S3/S4 in this ticket — only the decision record + threat model + follow-up issue if go.
Acceptance criteria
MigrateMsgshape (caps, manager, treasury, factory, SKUs), CMMUpdateAdminorder, origin/attestation rule (O601-4), F6 Refresh steps.docs/contracts-terraclassic.md+ #592/#558 crosslinks updated with the decision (even if the decision is “never in-place”).Test plan (all paths)
Investigation / design proofs (LocalTerra + multitest). No columbus-5 ALPHA migrate.
MsgMigrateContract8654→11611 reverts (ensure_from_older_version). Same for a random 10184 if pointed at current 11611 (cw2 name mismatch).MigrateMsg {}unchanged for honest upgrades.CreateToken6 dp / sell 100 / buy 450 / no MintControl / treasury+manager from ALPHA live map;RegisterListedPair; extra-debit + outbound matchTaxPreview.token_info.total_supply+ samplebalanceunchanged;get_configpresent;tax_mapquery errors; inbound Transfer to pair 1:1.tax_map/ unknown cw2 / mint cap mismatch / decimals > 18 → migrate revert, balances untouched.ContractInfo.admin == CMM; manager ≠ admin; manager cannot migrate.GetLauncherOriginvs new origin). Rogue migrate without CMM admin stays unlisted.Attack / abuse test plan
tax_maptotal_supplyor any balance changes → fail.UpdateAdmintax_mapvs 11611CONFIG. Deserialize garbage / default-zero tax → fail closed, do not run.minter: null; adopt must not set MintControl / minter./create?/ payeeVerification criteria
AddWhitelistedCodeId 8654.Verify (when a child impl exists)
Do not add
make verify-issue-*until an impl lands. Gate remainsmake verify-issue-592/make verify-issue-601.marked as related to #558
marked as related to #592
marked as related to #593
marked as related to #601
marked as related to #602
marked as related to #582
Goal should be for codeids that have been whitelisted to migrate, to be able to migrate for free, through extremely simplified click on a "migrate" page (they can load in their token and click one button to migrate it). Possible need for custom migration paths for different codeids such as 8266 and 8654
mentioned in issue #604
marked as related to #604
mentioned in issue #605
mentioned in issue #607
mentioned in merge request !1122
C-2 is written: #607 chose option 1 (router hops Honest / pair-direct still taxes). This importer ticket is no longer blocked on an unwritten tax/router policy.
If any in-place path is later go, migrated 11611 tokens must keep T592-13. Do not ship copy that promises advertised buy/sell bps on official multi-hop or
execute_swap_operations.MR for the design close: !1126
#607 reopened due to option 1 beign poor choice & damaging communitys that list their tokens expecting fees they dont receive
mentioned in merge request !1127
Status check (2026-08-24)
State: open, design-only. No assignee. No importer impl. Acceptance (S1–S5 go/no-go, storage-layout, follow-up impl issue) is still unchecked.
community-tax-token::migrateis stillMigrateMsg {}+cw2::ensure_from_older_version(…, "crates.io:cl8y-community-tax-token", …). Same-crate bumps only. Foreign cw2 (8654 / 10184 / 6036 / 8266) still reverts. No/migratepage. NoGetMigrateOrigin.Live pins (issue body is stale)
Body still says “onto 11611” / launcher 11614. After #611 / #616 (2026-08-24):
cl8y-community-tax-token1.0.0, option-2hop_trader, #604–#609). REPORT GO.[6036, 8266, 10184, 11611, 11619]terra126pr5…code 11622;GetConfigtoken_code_id11619 /autolp_code_id**11621`Same-crate 11611 → 11619 is already allowed by current
migrate. That is not this ticket. Any S3/S4 importer must target 11619 (T592-13), not 11611-era Honest hops.C-2 (earlier notes on this issue)
#607 closed on improved option 2 (!1127). The 2026-08-23 note that C-2 is option 1 / Honest hops is stale. Unmigrated live 11611 still Honest hops until a CMM same-crate bump; new 11619 taxes official-router
trader. Related: !1122 (#604/#605), !1126 (superseded option-1 docs), #558 still open (ALPHA wrap vs drop / POL).Product notes already here (still open)
Terraport / GDEX LP (investigation fact, not a go)
In-place migrate keeps the CW20 address. Terraport / GDEX pairs are not CL8Y factory pairs and are not F6-pinned. They keep holding the same token; only wasm + tax keys change.
RegisterListedPair. Other DEX transfers stay 1:1.RefreshPairAssetCodeIds.tax_map)tax_map. Inbound 1:1 everywhere (T592-1). Sell/buy tax only if the pair is CL8Y-listed.RegisterListedPaira Terraport/GDEX pair. S4 remains no-go until storage wipe + Layer A/B prove 8654-after-migrate ≡ launcher 11619.Do not whitelist 8654 so Terraport/GDEX can “keep working.” Listing 8654 is still forbidden (H-01 / P2).
Still not this ticket
Gate remains
make verify-issue-592/make verify-issue-601. Noverify-issue-603.mentioned in issue #626
marked as related to #626
Implementation follow-up opened: #626 (
feat(community-tax): one-click free migrate onto 11619 for listed templates + Terraport/GDEX LP gate).Bundles the two product notes on this ticket (one-click free page + Terraport/GDEX LP impact). S3 first (6036/10184); 8266 custom path gated on storage + LP table; 8654 stays refuse until S4 go. This design ticket stays open until S1–S5 is filled or points at #626 as the decision+impl record.
mentioned in merge request !1136
Implementation follow-up shipped in #626 / !1136.
Go / no-go recorded on #626: S3 go, S3-8266 go, S4 8654 no-go. This issue stays open as the design record (do not close until the S1–S5 table is filled or explicitly points at #626 as the decision+impl record).
mentioned in issue #627
marked as related to #627
mentioned in issue #628
marked as related to #628
mentioned in issue #636
Design close — S1–S5 recorded; impl is #626
This ticket is the decision record. Implementation shipped on #626 / !1136. Venue inventory shipped on #634. Canonical write-up:
docs/contracts-terraclassic.md§ migrate-adopt +skills/AGENTS_FRONTEND_TOKEN_MIGRATE.md.S1–S5 (go / no-go)
crates.io:cw20-base/crates.io:cw20-mintable; keep balances; write CONFIG/FEATURES; CMMUpdateAdmincrates.io:terraport-token; leftovermarketing_info/balance_atunread; Terraport Open/LUNC stays 1:1tax_info/tax_map/whale_info; map 4.5%/1% → buy 450 / sell 100. Retail allowlist includes 8654. Never factory-list 8654 (listing 11619 / later adopt pin covers the address)Target wasm is option-2
hop_trader(T592-13), not 11611-era Honest hops. Same-crate bump remainsMigrateMsg {}(CMM-only; not the retail page). Foreign adopt isMigrateMsg { adopt }. Origin isGetMigrateOrigin(do not fakelauncher_tx). Retail/token/migrateis free.Do not
AddWhitelistedCodeId 8654(or any inbound FoT /tax_mapwasm)RegisterListedPairTerraport / GDEXVerified this pass (2026-08-25)
make verify-issue-592— 4/4make verify-issue-626— 8/8 (crates include P1p1_foreign_cw2_without_adopt_reverts, S3, S3-8266, S4 wipe)VERIFY634_SKIP_CHAIN=1 make verify-issue-634— 4/4GetWhitelistedCodeIds=[6036, 8266, 10184, 11630]— 8654 absentDid not re-run full
make verify-issue-601(live pin is 11630, not the 11626 check in that script). Store / Coolify leftover stays on #628.Closing this design ticket per its own gate: S1–S5 filled here and pointed at #626 as the decision+impl record. #558 / #627 / #628 remain open.
mentioned in commit
315d5c910cmentioned in commit
dd712705bd