Pin listed CW20 code_id and re-check factory whitelist on pair writes #1107

Merged

PlasticDigits merged 2 commits from fix/582-cw20-code-id-pin into main

2026-08-21 00:14:18 +00:00

PlasticDigits commented

2026-08-20 12:39:17 +00:00

(Migrated from gitlab.com)

Closes #582 (on-chain mitigation). Unblocks the #581 8266 policy statement; listing 8266 still requires live factory 1.9.0 + pair 1.15.0 migrate (or SpaceUSD admin cleared, or wrap-to-10184).

Summary

Factory CreatePair already checked ContractInfo.code_id against WHITELISTED_CODE_IDS once. Pair swap / provide / withdraw / limit never re-checked, so a listed instance could MsgMigrateContract onto FoT/rebase wasm (SEC-I H05, invariant P2).
Chosen mitigations: (B) pin + (A) whitelist re-check. Pair instantiate snapshots live code_ids. Write paths fail closed unless live id equals the pin and factory IsCodeIdWhitelisted is true. Governance RefreshPairAssetCodeIds / Batch after an approved upgrade; refresh refuses unlisted live ids.
Not in this MR: (C) refuse wasm-admin at listing, (D) indexer watch (rejected), (E) hard-refuse 8266 in factory (rejected as listing policy). No FoT balance-delta math (H-01).

Factory cw2 1.8.0 → 1.9.0. Pair cw2 1.14.0 → 1.15.0. Playbook: skills/AGENTS_CW20_CODE_ID_PIN.md. New invariant F6.

Test plan

cargo test -p cl8y-dex-tests --lib asset_code_id_pin
cargo test -p cl8y-dex-tests --lib migration_tests
make verify-issue-582 (first pass + retest)
cargo clippy / cargo fmt via pre-commit
Ops: migrate factory 1.9.0 then pair 1.15.0 on columbus-5
Ops: refresh listed-asset code_id + wasm admin inventory on #582
Do not AddWhitelistedCodeId 8266 until that migrate is live

Closes #582 (on-chain mitigation). Unblocks the #581 8266 policy statement; listing 8266 still requires **live** factory 1.9.0 + pair 1.15.0 migrate (or SpaceUSD admin cleared, or wrap-to-10184). ## Summary - Factory `CreatePair` already checked `ContractInfo.code_id` against `WHITELISTED_CODE_IDS` once. Pair swap / provide / withdraw / limit never re-checked, so a listed instance could `MsgMigrateContract` onto FoT/rebase wasm (SEC-I **H05**, invariant **P2**). - **Chosen mitigations: (B) pin + (A) whitelist re-check.** Pair instantiate snapshots live `code_id`s. Write paths fail closed unless live id equals the pin **and** factory `IsCodeIdWhitelisted` is true. Governance `RefreshPairAssetCodeIds` / Batch after an approved upgrade; refresh refuses unlisted live ids. - **Not in this MR:** (C) refuse wasm-admin at listing, (D) indexer watch (rejected), (E) hard-refuse 8266 in factory (rejected as listing policy). No FoT balance-delta math (H-01). Factory cw2 **1.8.0 → 1.9.0**. Pair cw2 **1.14.0 → 1.15.0**. Playbook: `skills/AGENTS_CW20_CODE_ID_PIN.md`. New invariant **F6**. ## Test plan - [x] `cargo test -p cl8y-dex-tests --lib asset_code_id_pin` - [x] `cargo test -p cl8y-dex-tests --lib migration_tests` - [x] `make verify-issue-582` (first pass + retest) - [x] `cargo clippy` / `cargo fmt` via pre-commit - [ ] Ops: migrate factory 1.9.0 then pair 1.15.0 on columbus-5 - [ ] Ops: refresh listed-asset `code_id` + wasm admin inventory on #582 - [ ] Do not `AddWhitelistedCodeId 8266` until that migrate is live

Rows
Columns