sec: leftover wrap/window/CMM admin — LCD attest + playbook close-out (AC-02) #697
Labels
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:implement
agent:implement
agent:open_issues
agent:ready
agent:research
agent:security_audit
agent:verify
architecture
backend
blocker:hybrid
blocker:launch
blocker:limit-orders
blocker:v2
block:log_only
block:security
bug
ci
contracts
correctness
deploy
dev
devops
docs
documentation
duplicate
e2e
enhancement
epic
feature
frontend
functional-completion
gas
good first issue
governance
help wanted
high-risk
hooks
hybrid
indexer
infra
infrastructure
integrators
invalid
launch-blocker
limit-orders
localnet
localterra
low priority
missing-implementation
needs-design
ops
performance
priority
high
priority
medium
product
qa
QA
question
ready
ready
research
scripts
security
security-hardening
smartcontracts
tech-debt
testing
ux
UX
v2
verification
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
code/cl8y-dex-terraclassic#697
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Gate
P1 ops / Chain K. Internal audit
INTERNAL_GROK46_1787908099AC-02. The accept queue stays on #526 (and #525, ustr-cmm#15, ust1-window#30). Do not reopen those tickets or move propose/schema work here.This issue is the security close-out: LCD attestation that leftover wrap / window / CMM / minter powers are no longer on an EOA, plus in-repo REGISTRY + pause-playbook truth so operators do not pause with the wrong key.
Current codebase / chain state
#526 tracks columbus-5 powers not yet on DEX 2-of-3
terra1zlmv2xydxcusurtr6rl78wsvytdc6mfex6hep7.Already on the 2-of-3 (per #526 + later runbook notes): factory, router, fee-discount, faucet, gem pair wasm admins, several token minters, UST1/cUSTC + UST1/USTR pair wasm, wrap-mapper app governance and (as of 2026-08-26 notes) mapper/treasury wasm admin. CMM treasury
AcceptGovernanceTransferwas queued.Still called out as EOA / wrap-stack
cl8y2_adminterra1xsecn4…in current docs:config.governance(docs/runbooks/ust1-wrap-production-ops.mdO6)In-repo surfaces that consume those contracts as if they were honest:
UST1_WINDOW_ADDRESS)/ust1, wrap/unwrap quotesscripts/rebalance-mint-ust1-lp.shpeg gate (indexer USTC/USD)A leftover EOA can change unwrap fees, mint wrappers, or move the window oracle. This repo will display and route through those prints.
Why the new implementation is needed
#526 is a queue. It does not define LCD attestation, attack tests, or a fail-closed “docs match chain” gate. Without that, REGISTRY O6 and pause runbooks drift (already partially stale vs 2026-08-25/26 accepts). Operators can pause with the wrong key or miss that window/oracle is still an EOA.
Constraints / guardrails
effective_swap.cl8y2_admin.Relevant files
deployments/mainnet-ust1-wrap/REGISTRY.mddocs/runbooks/ust1-wrap-production-ops.mddocs/runbooks/wrap-mapper-pause.mddocs/runbooks/key-custody.mddocs/runbooks/emergency-commands.mddocs/security-model.mdscripts/verify-issue-503.sh/ wrap health probesRecommended direction
scripts/qa/verify-issue-<N>.sh(or extend the #526 verify path) that, against columbus-5 LCD:config.governance(and wasmContractInfo.adminwhere the LCD supports it).terra1zlmv2…vs leftoverterra1xsecn4…vs other.RESIDUAL=lines for accepted leftovers (window/oracle until ust1-window#30)./ust1when window governance is not the 2-of-3 — only if a single LCD probe already exists; do not add a new trust root.Acceptance criteria
make verify-issue-<N>re-runs the probe (fail-closed whenCOLUMBUS5_LCD/ mainnet mode set; skip-with-message on Cloud Agent without LCD is OK if documented).Test plan — happy / bad path
RESIDUALlineconfig.governancefor that contractTest plan — attack / abuse vectors
fee_unwrap_bpseffective_swap/ust1+ rebalance script follow it (Chain K). Residual until window accept.Verification criteria
make verify-issue-<N>documented; green on a host with columbus-5 LCD or explicit skip.rg cl8y2_admin/terra1xsecn4in runbooks only appears on rows marked residual.marked as related to #526
marked as related to #525
Read-only columbus-5 LCD attestation
Queried
https://terra-classic-lcd.publicnode.comat 2026-09-24 09:38:26 UTC, height 30540960, withVERIFY697_MAINNET=1 make verify-issue-697: PASS=4, RESIDUAL=13, FAIL=0. No signing or transaction broadcast was performed.terra1xuuuhpmyd5t29ry7mydg7ra2q2phrwhx7j28nx7x9sjw6zznkumsz0nmd2config.governance+ Wasm adminterra1zlmv2xydxcusurtr6rl78wsvytdc6mfex6hep7terra16j5u6ey7a84g40sr3gd94nzg5w5fm45046k9s2347qhfpwm5fr6sem3lr2config.governance+ Wasm adminterra1zxwpzpzpleatqn39r00grau4yt29sld8pw78s7ktvjafnj5nsaxq0h3rh2config.governance+ Wasm adminterra1xsecn4snv94ezcez0z3vq8an9j4h4kxxcydp8lterra1fmht0t6svq3n24zx03nkfja0m40zhfyyxkdcvlrkl6u7gfe6aagq4gch8nconfig.governance+ Wasm adminterra1f0eqgy9w7e5e7up97vjudqwx38tesf8ylx75x2lv3nwm0clry0pqmgfy72terra1437qslye72t7qmmahn4t5chz50r8a62g45phwkquwpyu2l62u6ksqssgdgterra1nap4dxh9tv35v0ynd9m4k6zt6c0dq6weszc4j5m564kjls56hu7qcr56chterra1vy3kc0swag2rhn7jz6n72jp0l2ns0p6r6ez5grxq5uhj2rvs97fqfsetxvterra1mnl9azefrqpmu888ar2u6zrcwr80hxlt3avf4300r576cw5ar7esvxsvj3The USTC→USTR swap admin and bridge admin are outside this repo's registry/probe; #526 tracks ustr-cmm#15 and cl8y-bridge-monorepo#135, respectively.
#697 remains open. The documented EOA residuals still need either completed transfers or explicit disposition with a named owner and UTC revisit date. DEX #526 and #697 have no assignee; no newer DEX issue replacing this verification was found. Keep #526 open for its accept queue.