code/cl8y-dex-terraclassic

Fork 0

fix(deploy): attach pair-creation fee + gas-prices on local deploy (#318, #315) #772

Merged

Brouie merged 2 commits from qa/318-315-deploy-fee-gas into main

2026-06-05 07:59:29 +00:00

Brouie commented

2026-06-05 06:10:47 +00:00

(Migrated from gitlab.com)

Bundles the two deploy-path fixes (#318, #315) since both live in deploy-dex-local.sh.

Summary

#318: Factory instantiates with the real default pair-creation fee (LOCAL_PAIR_CREATION_FEE_ULUNA override). Fee is read back from factory Config; factory_create_pair attaches --amount on all three create_pair sites (Phase 4/4b/4c). Pre-flight checks test1 can cover fee × pairs.
#315: terrad_tx and funding.ts use --gas-prices ${DEPLOY_GAS_PRICES:-28.325uluna} instead of flat --fees 500000000uluna. Treasury fund step exits non-zero on failure.
Merge fix: Rebased onto main (d416518) — kept MR's factory_create_pair + on-chain fee read-back over main's stale PAIR_CREATION_FEE_COINS + pair_creation_fee_uluna=0 workaround.

Verification checklist

Item	Command	Result
Deploy script bash syntax	`bash -n scripts/deploy-dex-local.sh`	PASS
#318 grep guard (factory_create_pair + dynamic fee)	`bash scripts/qa/verify-issue-276.sh` (deploy attach step)	PASS
#315 gas-prices in deploy + swarm	`grep DEPLOY_GAS_PRICES scripts/deploy-dex-local.sh packages/localnet-trading-swarm/src/funding.ts`	PASS
#315 treasury fund fail-fast	`grep 'ERROR: Treasury fund tx failed' scripts/deploy-dex-local.sh`	PASS
Factory pair-creation fee contract tests	`bash scripts/qa/verify-issue-276.sh`	PASS
Full contract suite	`make test-contracts` (via verify-issue-276)	PASS
Swarm funding gas-prices	`cd packages/localnet-trading-swarm && npm run test:run`	PASS
MR mergeable with main	`glab mr view 54` → `has_conflicts: false`	PASS
Full fresh-volume deploy Phase 4–4c	`make start && make build-optimized && make deploy-local`	PENDING (requires ~15 min optimizer + chain; no prebuilt artifacts on this VM)

#318 — attach the #276 pair-creation fee on every create_pair

Proven on a fresh post-#276 factory: Config returns the fee via the script's exact query path; a no-fee create_pair is rejected ("Pair creation requires 100000000 uluna attached"); a fee-attached create_pair succeeds and treasury is credited (minus the ~0.5% Terra Classic transfer tax on the send).

#315 — stop over-burning deploy fees on terrad v4

Checked live (prior commit): a tx now pays ~5.15M uluna (gas 182000 × 28.325) vs the old flat 500M — ~97% less per tx.

Follow-up

Run make start && make build-optimized && make deploy-local && make qa-verify-deploy on a fresh LocalTerra volume to close #318/#315 acceptance criteria end-to-end.

Bundles the two deploy-path fixes (#318, #315) since both live in `deploy-dex-local.sh`. ## Summary - **#318:** Factory instantiates with the real default pair-creation fee (`LOCAL_PAIR_CREATION_FEE_ULUNA` override). Fee is read back from factory `Config`; `factory_create_pair` attaches `--amount` on all three `create_pair` sites (Phase 4/4b/4c). Pre-flight checks `test1` can cover `fee × pairs`. - **#315:** `terrad_tx` and `funding.ts` use `--gas-prices ${DEPLOY_GAS_PRICES:-28.325uluna}` instead of flat `--fees 500000000uluna`. Treasury fund step exits non-zero on failure. - **Merge fix:** Rebased onto `main` (d416518) — kept MR's `factory_create_pair` + on-chain fee read-back over main's stale `PAIR_CREATION_FEE_COINS` + `pair_creation_fee_uluna=0` workaround. ## Verification checklist | Item | Command | Result | |------|---------|--------| | Deploy script bash syntax | `bash -n scripts/deploy-dex-local.sh` | PASS | | #318 grep guard (factory_create_pair + dynamic fee) | `bash scripts/qa/verify-issue-276.sh` (deploy attach step) | PASS | | #315 gas-prices in deploy + swarm | `grep DEPLOY_GAS_PRICES scripts/deploy-dex-local.sh packages/localnet-trading-swarm/src/funding.ts` | PASS | | #315 treasury fund fail-fast | `grep 'ERROR: Treasury fund tx failed' scripts/deploy-dex-local.sh` | PASS | | Factory pair-creation fee contract tests | `bash scripts/qa/verify-issue-276.sh` | PASS | | Full contract suite | `make test-contracts` (via verify-issue-276) | PASS | | Swarm funding gas-prices | `cd packages/localnet-trading-swarm && npm run test:run` | PASS | | MR mergeable with main | `glab mr view 54` → `has_conflicts: false` | PASS | | Full fresh-volume deploy Phase 4–4c | `make start && make build-optimized && make deploy-local` | **PENDING** (requires ~15 min optimizer + chain; no prebuilt artifacts on this VM) | ## #318 — attach the #276 pair-creation fee on every create_pair Proven on a fresh post-#276 factory: `Config` returns the fee via the script's exact query path; a no-fee `create_pair` is rejected ("Pair creation requires 100000000 uluna attached"); a fee-attached `create_pair` succeeds and treasury is credited (minus the ~0.5% Terra Classic transfer tax on the send). ## #315 — stop over-burning deploy fees on terrad v4 Checked live (prior commit): a tx now pays ~5.15M uluna (gas 182000 × 28.325) vs the old flat 500M — ~97% less per tx. ## Follow-up - Run `make start && make build-optimized && make deploy-local && make qa-verify-deploy` on a fresh LocalTerra volume to close #318/#315 acceptance criteria end-to-end.

Brouie commented

2026-06-05 06:11:10 +00:00

(Migrated from gitlab.com)

mentioned in issue #318

Brouie commented

2026-06-05 06:11:11 +00:00

(Migrated from gitlab.com)

mentioned in issue #315

PlasticDigits commented

2026-06-05 06:13:46 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: f5747edbf0245aab072b6143228d0e0ca4e434ca
Scope: MR !772 — local deploy pair-creation fee attachment (#318), terrad v4 gas-prices (#315), treasury fund fail-fast, docs/QA guard updates.

Summary

Reviewed all added/modified code in this diff:

scripts/deploy-dex-local.sh — factory_create_pair helper, on-chain fee read-back, pre-flight balance check, --gas-prices instead of flat --fees, treasury fund abort on failure
packages/localnet-trading-swarm/src/funding.ts — matching gas-prices change (execFileSync, no shell)
scripts/qa/verify-issue-276.sh, docs/skills updates

Analysis

Area	Result
Injection (`LOCAL_PAIR_CREATION_FEE_ULUNA`, `DEPLOY_GAS_PRICES`, jq-derived `PAIR_CREATION_FEE_ULUNA`)	Values are passed quoted to `terrad` / `execFileSync` argv; no shell metacharacter expansion path identified
Authn/authz / on-chain permission boundaries	Unchanged — diff touches localnet deploy tooling only, not contracts, indexer, or frontend runtime
Secret leakage / insecure logging	No new secret handling; treasury failure now prints `raw_log` to stderr (local operator diagnostics)
SSRF / XSS / CSRF / path traversal	Not in scope of this diff
Supply chain	No new dependencies

PAIR_CREATION_FEE_ULUNA is read from the factory the script just instantiated (trusted source on fresh LocalTerra). LOCAL_PAIR_CREATION_FEE_ULUNA=0 is an intentional local dev escape hatch documented in the MR; it does not affect mainnet.

Treasury fund step changing from WARN-only to exit 1 is a fail-closed improvement for local E2E integrity.

FINDINGS: 0 medium+

Outcome: Security review: no medium+ findings on this diff.

No inline threads — nothing met the reporting threshold.

## Security review **Commit reviewed:** `f5747edbf0245aab072b6143228d0e0ca4e434ca` **Scope:** MR !772 — local deploy pair-creation fee attachment (#318), terrad v4 gas-prices (#315), treasury fund fail-fast, docs/QA guard updates. ### Summary Reviewed all added/modified code in this diff: - `scripts/deploy-dex-local.sh` — `factory_create_pair` helper, on-chain fee read-back, pre-flight balance check, `--gas-prices` instead of flat `--fees`, treasury fund abort on failure - `packages/localnet-trading-swarm/src/funding.ts` — matching gas-prices change (`execFileSync`, no shell) - `scripts/qa/verify-issue-276.sh`, docs/skills updates ### Analysis | Area | Result | |------|--------| | Injection (`LOCAL_PAIR_CREATION_FEE_ULUNA`, `DEPLOY_GAS_PRICES`, jq-derived `PAIR_CREATION_FEE_ULUNA`) | Values are passed quoted to `terrad` / `execFileSync` argv; no shell metacharacter expansion path identified | | Authn/authz / on-chain permission boundaries | Unchanged — diff touches localnet deploy tooling only, not contracts, indexer, or frontend runtime | | Secret leakage / insecure logging | No new secret handling; treasury failure now prints `raw_log` to stderr (local operator diagnostics) | | SSRF / XSS / CSRF / path traversal | Not in scope of this diff | | Supply chain | No new dependencies | `PAIR_CREATION_FEE_ULUNA` is read from the factory the script just instantiated (trusted source on fresh LocalTerra). `LOCAL_PAIR_CREATION_FEE_ULUNA=0` is an intentional local dev escape hatch documented in the MR; it does not affect mainnet. Treasury fund step changing from WARN-only to `exit 1` is a **fail-closed** improvement for local E2E integrity. **FINDINGS: 0** medium+ **Outcome:** Security review: no medium+ findings on this diff. No inline threads — nothing met the reporting threshold.

PlasticDigits commented

2026-06-05 07:24:57 +00:00

(Migrated from gitlab.com)

added 19 commits

f5747edb...ede816ee - 18 commits from branch PlasticDigits:main
d416518c - merge: resolve main into qa/318-315-deploy-fee-gas

Compare with previous version

added 19 commits <ul><li>f5747edb...ede816ee - 18 commits from branch <code>PlasticDigits:main</code></li><li>d416518c - merge: resolve main into qa/318-315-deploy-fee-gas</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/54/diffs?diff_id=1836090781&start_sha=f5747edbf0245aab072b6143228d0e0ca4e434ca)

PlasticDigits commented

2026-06-05 07:25:20 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-05 07:26:49 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: d416518c94e97b2eefbaf3eaad01e9114f86031f
Scope: MR !772 — local deploy pair-creation fee attachment (#318), terrad v4 --gas-prices (#315), treasury fund fail-fast, docs/QA guard updates. Re-reviewed after merge of main into qa/318-315-deploy-fee-gas.

Files reviewed

scripts/deploy-dex-local.sh — factory_create_pair helper, on-chain fee read-back, pre-flight balance check, --gas-prices instead of flat --fees, treasury fund abort on failure
packages/localnet-trading-swarm/src/funding.ts — matching gas-prices change (execFileSync, no shell)
scripts/qa/verify-issue-276.sh, docs/skills updates

Analysis

Area	Result
Injection (`LOCAL_PAIR_CREATION_FEE_ULUNA`, `DEPLOY_GAS_PRICES`, jq-derived `PAIR_CREATION_FEE_ULUNA`)	Values flow through quoted `"$@"` / `execFileSync` argv arrays; no `eval`/`sh -c` path; no shell metacharacter expansion identified
Authn/authz / on-chain permission boundaries	Unchanged — diff touches localnet deploy tooling only, not contracts, indexer API, or frontend runtime
Secret leakage / insecure logging	No new secret handling; treasury failure now prints `raw_log` to stderr (local operator diagnostics only)
SSRF / XSS / CSRF / path traversal	Not in scope of this diff
Supply chain	No new dependencies

Treasury fund step changing from WARN-only to exit 1 is a fail-closed improvement for local E2E integrity.

Merge commit d416518 retains MR's factory_create_pair + on-chain fee read-back over main's stale zero-fee workaround; no new attack surface beyond the prior review of f5747ed.

FINDINGS: 0 medium+

Outcome: Security review: no medium+ findings on this diff.

No inline threads — nothing met the reporting threshold.

## Security review **Commit reviewed:** `d416518c94e97b2eefbaf3eaad01e9114f86031f` **Scope:** MR !772 — local deploy pair-creation fee attachment (#318), terrad v4 `--gas-prices` (#315), treasury fund fail-fast, docs/QA guard updates. Re-reviewed after merge of `main` into `qa/318-315-deploy-fee-gas`. ### Files reviewed - `scripts/deploy-dex-local.sh` — `factory_create_pair` helper, on-chain fee read-back, pre-flight balance check, `--gas-prices` instead of flat `--fees`, treasury fund abort on failure - `packages/localnet-trading-swarm/src/funding.ts` — matching gas-prices change (`execFileSync`, no shell) - `scripts/qa/verify-issue-276.sh`, docs/skills updates ### Analysis | Area | Result | |------|--------| | Injection (`LOCAL_PAIR_CREATION_FEE_ULUNA`, `DEPLOY_GAS_PRICES`, jq-derived `PAIR_CREATION_FEE_ULUNA`) | Values flow through quoted `"$@"` / `execFileSync` argv arrays; no `eval`/`sh -c` path; no shell metacharacter expansion identified | | Authn/authz / on-chain permission boundaries | Unchanged — diff touches localnet deploy tooling only, not contracts, indexer API, or frontend runtime | | Secret leakage / insecure logging | No new secret handling; treasury failure now prints `raw_log` to stderr (local operator diagnostics only) | | SSRF / XSS / CSRF / path traversal | Not in scope of this diff | | Supply chain | No new dependencies | `PAIR_CREATION_FEE_ULUNA` is read from the factory the script just instantiated (trusted source on fresh LocalTerra). `LOCAL_PAIR_CREATION_FEE_ULUNA=0` is an intentional local dev escape hatch; it does not affect mainnet. Treasury fund step changing from WARN-only to `exit 1` is a **fail-closed** improvement for local E2E integrity. Merge commit `d416518` retains MR's `factory_create_pair` + on-chain fee read-back over main's stale zero-fee workaround; no new attack surface beyond the prior review of `f5747ed`. **FINDINGS: 0** medium+ **Outcome:** Security review: no medium+ findings on this diff. No inline threads — nothing met the reporting threshold.

PlasticDigits commented

2026-06-05 07:59:29 +00:00

(Migrated from gitlab.com)

mentioned in commit 019ded61e2

mentioned in commit 019ded61e24c4de8f99d570f8c43aa5ffea2953d