feat: Create Pair listed-CW20 picker (#542) #1071

Merged

PlasticDigits merged 2 commits from feat/542-create-pair-picker into main

2026-08-17 04:47:14 +00:00

PlasticDigits commented

2026-08-17 04:28:58 +00:00

(Migrated from gitlab.com)

Summary

/create can pick listed CW20s (cLUNC, cUSTC, CL8Y, USTR, UST1, vFDUSD, …) from the bundled repo token list, with LocalTerra/VITE_* overlays winning over columbus-5 addresses.
Custom terra1… paste stays behind Custom contract; #382 checksum/format gates and factory code-ID warnings still run. Natives are never selectable.
Swap/Mint/Trade pickers are unchanged. Catalog is not the factory graph and is not fetched at runtime.

Closes #542

Test plan

make verify-issue-542 (unit T1–T18 + docs/skills + Playwright P1–P5)
Manual: /create on LocalTerra — pick two env CW20s; confirm addresses match .env.local; paste path still works; natives absent; Swap pay/receive list unchanged

Acceptance (C1–C11)

ID	Status	Notes
C1	Done	Listed CW20 comboboxes for Token A/B
C2	Done	Natives excluded from catalog + picker
C3	Done	Custom paste + #382 gates
C4	Done	Same token (incl. mixed case) disables submit
C5	Done	Env overlay wins over tokenlist.json
C6	Done	`useCodeIdCheck` still runs; listed ≠ skip
C7	Done	Existing `createPair` / CW20 `AssetInfo` only
C8	Done	Swap `TokenSearchSelect` tests still pass; no `getAllTokens` on this page
C9	Done	Allowlisted logos, text-only symbols, 128-char search cap
C10	Done	#508 UST1 AMM ≠ oracle notice unchanged
C11	Done	`docs/frontend.md` C542-1–C542-11 + `make verify-issue-542`

Attack / abuse (A1–A14)

ID	Status	Notes
A1	Done	No “verified safe” copy; code-ID check still runs
A2	Done	Logos via `resolveTrustedTokenLogoUrl`
A3	Done	Symbols/names as text nodes
A4	Done	Unlisted paste allowed; factory remains the gate
A5	Done	Catalog does not import `getAllTokens`
A6	Done	Bundled `tokenlist.json` only
A7	Done	Natives not selectable; `uluna` paste rejected
A8	Done	Case-insensitive same-address compare
A9	Done	128-char search cap
A10	Done	Picker `onChange` ignores ids not in catalog
A11	Done	#382 format/checksum
A12	Out of scope	No `/create?a=&b=` prefill (not implemented)
A13	Done	No social-engineering “official verified” banner
A14	Done	Env overlay test + P1 address match

Follow-ups

On-chain Create Pair for an already-existing pair (issue P3 wallet/tx path) was not broadcast in CI; UI smoke asserts no false success without submitting a create tx.

## Summary - `/create` can pick listed CW20s (cLUNC, cUSTC, CL8Y, USTR, UST1, vFDUSD, …) from the bundled repo token list, with LocalTerra/`VITE_*` overlays winning over columbus-5 addresses. - Custom `terra1…` paste stays behind **Custom contract**; #382 checksum/format gates and factory code-ID warnings still run. Natives are never selectable. - Swap/Mint/Trade pickers are unchanged. Catalog is not the factory graph and is not fetched at runtime. Closes #542 ## Test plan - [x] `make verify-issue-542` (unit T1–T18 + docs/skills + Playwright P1–P5) - [ ] Manual: `/create` on LocalTerra — pick two env CW20s; confirm addresses match `.env.local`; paste path still works; natives absent; Swap pay/receive list unchanged ## Acceptance (C1–C11) | ID | Status | Notes | |----|--------|-------| | C1 | Done | Listed CW20 comboboxes for Token A/B | | C2 | Done | Natives excluded from catalog + picker | | C3 | Done | Custom paste + #382 gates | | C4 | Done | Same token (incl. mixed case) disables submit | | C5 | Done | Env overlay wins over tokenlist.json | | C6 | Done | `useCodeIdCheck` still runs; listed ≠ skip | | C7 | Done | Existing `createPair` / CW20 `AssetInfo` only | | C8 | Done | Swap `TokenSearchSelect` tests still pass; no `getAllTokens` on this page | | C9 | Done | Allowlisted logos, text-only symbols, 128-char search cap | | C10 | Done | #508 UST1 AMM ≠ oracle notice unchanged | | C11 | Done | `docs/frontend.md` C542-1–C542-11 + `make verify-issue-542` | ## Attack / abuse (A1–A14) | ID | Status | Notes | |----|--------|-------| | A1 | Done | No “verified safe” copy; code-ID check still runs | | A2 | Done | Logos via `resolveTrustedTokenLogoUrl` | | A3 | Done | Symbols/names as text nodes | | A4 | Done | Unlisted paste allowed; factory remains the gate | | A5 | Done | Catalog does not import `getAllTokens` | | A6 | Done | Bundled `tokenlist.json` only | | A7 | Done | Natives not selectable; `uluna` paste rejected | | A8 | Done | Case-insensitive same-address compare | | A9 | Done | 128-char search cap | | A10 | Done | Picker `onChange` ignores ids not in catalog | | A11 | Done | #382 format/checksum | | A12 | Out of scope | No `/create?a=&b=` prefill (not implemented) | | A13 | Done | No social-engineering “official verified” banner | | A14 | Done | Env overlay test + P1 address match | ## Follow-ups - On-chain Create Pair for an already-existing pair (issue P3 wallet/tx path) was not broadcast in CI; UI smoke asserts no false success without submitting a create tx.

PlasticDigits commented

2026-08-17 04:47:06 +00:00

(Migrated from gitlab.com)

added 6 commits

a19476a5...c8ab55bc - 5 commits from branch main
d7aa1c07 - merge: land #541/#543 onto #542 create-pair picker

Compare with previous version

added 6 commits <ul><li>a19476a5...c8ab55bc - 5 commits from branch <code>main</code></li><li>d7aa1c07 - merge: land #541/#543 onto #542 create-pair picker</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/353/diffs?diff_id=1964783125&start_sha=a19476a505b17223281e59137f5804d3c7b1b60e)

PlasticDigits commented

2026-08-17 04:47:14 +00:00

(Migrated from gitlab.com)

mentioned in commit 7fdc3a44ad

mentioned in commit 7fdc3a44ad3318fb4cc6df68805ff520b508ef97