code/cl8y-dex-terraclassic

Fork 0

LocalTerra: 10× genesis and swarm funding for QA gas headroom (#372) #886

Merged

PlasticDigits merged 2 commits from fix/372-localterra-funding-10x into main

2026-06-12 11:50:08 +00:00

PlasticDigits commented

2026-06-12 11:39:18 +00:00

(Migrated from gitlab.com)

Summary

Raises LocalTerra genesis, deploy seed amounts, and swarm / E2E funding defaults by 10× so make swarm-launch and the Simulated Wallet (shared test1 account) do not exhaust LUNC gas during a full QA day (#372).

Genesis (docker/init-chain.sh): 10M LUNC, 100M USTC (+ other stables 10×)
Deploy (scripts/deploy-dex-local.sh): CW20 initial_balances 1e13, wrapped-native seeds 1e15, treasury default 20M USTC + 2M LUNC
Swarm / E2E: SWARM_* and E2E_DEV_* defaults 10× in funding.ts / e2e-provision-dev-wallet.sh
Docs: LT4 / LT8, testing, QA onboarding, agent playbooks
Hardening: preflight-test1-uluna.sh + swarm startup WARN below 100k LUNC; make verify-localterra-funding-headroom

Volume reset required: make reset (or make reset-qa) before redeploy so new genesis applies (LT6).

Acceptance checklist

Criterion	Verification	Result
Fresh reset + deploy leaves test1 with ≥10M LUNC genesis scale	`make reset && make start && make wait-healthy`; LCD query pre-deploy: `amount` ≈ `9999990000000`	PASS
Post-deploy test1 uluna headroom (~8M after treasury + gas)	`make deploy-local-no-build`; `curl …/balances/terra1x46…` → `7960105375898`	PASS
`make swarm-launch` ≥4h without test1 <500k LUNC	Not run in agent session (4h soak); 2min `make swarm-local` soak: balance still ≫500k	SKIP (manual QA soak)
Simulated wallet swap/limit after 4h swarm	Not run (depends on 4h soak)	SKIP (manual QA)
`make test-contracts`	`make test-contracts`	PASS
`make test-frontend`	`make test-frontend` (925 tests)	PASS
`make test-swarm-liquidity`	`make test-swarm-liquidity`	PASS
`packages/localnet-trading-swarm` unit tests	`cd packages/localnet-trading-swarm && npm run test:run` (15 tests incl. `funding.test.ts`)	PASS
LT4 / LT8 docs match init + deploy	`docs/localterra-sdk53.md` updated; `grep 10000000000000uluna docker/init-chain.sh`	PASS
`make test-qa-fresh-volumes`	`make test-qa-fresh-volumes`	PASS
`make verify-localterra-funding-headroom`	Static + LCD + 2min swarm soak	PASS

Blockers for SKIP items: 4h swarm soak and simulated-wallet-during-swarm require manual QA host time; math and 2min soak show manageable burn at single-worker rate — 10× genesis provides ~10× prior post-deploy headroom (~8M vs ~0.8M).

Third-party verification

make reset && make start && make wait-healthy
make build-optimized && make deploy-local-no-build

# Genesis scale (post-gentx, pre-deploy)
curl -s "http://127.0.0.1:1317/cosmos/bank/v1beta1/balances/terra1x46rqay4d3cssq8gxxvqz8xt6nwlz4td20k38v" \
  | jq '.balances[] | select(.denom=="uluna")'
# expect amount ≈ 9999990000000

make verify-localterra-funding-headroom
make test-swarm-liquidity
cd packages/localnet-trading-swarm && npm ci && npm run test:run

# Optional manual soak
make swarm-launch   # stop with make swarm-stop after ≥4h

Docs drift: grep -R "1M LUNC" docs/ should return no current invariant references.

Follow-ups

Python swarm separate bot keys (#119 TS pattern)
Revisit --fees 500000000uluna if ante allows (#115)

Note

Low Risk
Local-dev and QA tooling only; no production auth or contract logic. Requires volume reset for new genesis to apply.

Overview
10× LocalTerra funding across genesis, local deploy seeds, and bot/E2E defaults so shared dev account test1 (Simulated Wallet, Python QA swarm, TypeScript swarm) keeps enough LUNC gas through heavy QA (#372).

Chain & deploy: docker/init-chain.sh raises test1 genesis to 10M LUNC / 100M USTC (and other stables 10×). scripts/deploy-dex-local.sh scales CW20/wrapped-native initial_balances, factory token mints, and default DEPLOY_TREASURY_FUND_COINS to 20M USTC + 2M LUNC.

Swarm & E2E: TypeScript defaultFundingOptions and new funding.test.ts use 10× SWARM_* defaults; e2e-provision-dev-wallet.sh bumps E2E_DEV_* floors/mint top-ups. Docs (LT4, LT8, testing, QA onboarding) document make reset after genesis changes.

Operational hardening: preflight-test1-uluna.sh runs before launch-swarm.sh; swarm.py warns when test1 uluna drops below 100k LUNC. New make verify-localterra-funding-headroom greps invariants, optional LCD post-deploy floor, and a short swarm-local soak.

^{Reviewed by Cursor Bugbot for commit e24661a8bd. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Raises LocalTerra **genesis**, **deploy seed amounts**, and **swarm / E2E funding defaults** by **10×** so `make swarm-launch` and the Simulated Wallet (shared `test1` account) do not exhaust LUNC gas during a full QA day ([#372](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/372)). - **Genesis (`docker/init-chain.sh`):** 10M LUNC, 100M USTC (+ other stables 10×) - **Deploy (`scripts/deploy-dex-local.sh`):** CW20 `initial_balances` 1e13, wrapped-native seeds 1e15, treasury default 20M USTC + 2M LUNC - **Swarm / E2E:** `SWARM_*` and `E2E_DEV_*` defaults 10× in `funding.ts` / `e2e-provision-dev-wallet.sh` - **Docs:** LT4 / LT8, testing, QA onboarding, agent playbooks - **Hardening:** `preflight-test1-uluna.sh` + swarm startup WARN below 100k LUNC; `make verify-localterra-funding-headroom` **Volume reset required:** `make reset` (or `make reset-qa`) before redeploy so new genesis applies (**LT6**). ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Fresh reset + deploy leaves test1 with ≥10M LUNC genesis scale | `make reset && make start && make wait-healthy`; LCD query pre-deploy: `amount` ≈ `9999990000000` | **PASS** | | Post-deploy test1 uluna headroom (~8M after treasury + gas) | `make deploy-local-no-build`; `curl …/balances/terra1x46…` → `7960105375898` | **PASS** | | `make swarm-launch` ≥4h without test1 <500k LUNC | Not run in agent session (4h soak); 2min `make swarm-local` soak: balance still ≫500k | **SKIP** (manual QA soak) | | Simulated wallet swap/limit after 4h swarm | Not run (depends on 4h soak) | **SKIP** (manual QA) | | `make test-contracts` | `make test-contracts` | **PASS** | | `make test-frontend` | `make test-frontend` (925 tests) | **PASS** | | `make test-swarm-liquidity` | `make test-swarm-liquidity` | **PASS** | | `packages/localnet-trading-swarm` unit tests | `cd packages/localnet-trading-swarm && npm run test:run` (15 tests incl. `funding.test.ts`) | **PASS** | | LT4 / LT8 docs match init + deploy | `docs/localterra-sdk53.md` updated; `grep 10000000000000uluna docker/init-chain.sh` | **PASS** | | `make test-qa-fresh-volumes` | `make test-qa-fresh-volumes` | **PASS** | | `make verify-localterra-funding-headroom` | Static + LCD + 2min swarm soak | **PASS** | **Blockers for SKIP items:** 4h swarm soak and simulated-wallet-during-swarm require manual QA host time; math and 2min soak show manageable burn at single-worker rate — 10× genesis provides ~10× prior post-deploy headroom (~8M vs ~0.8M). ## Third-party verification ```bash make reset && make start && make wait-healthy make build-optimized && make deploy-local-no-build # Genesis scale (post-gentx, pre-deploy) curl -s "http://127.0.0.1:1317/cosmos/bank/v1beta1/balances/terra1x46rqay4d3cssq8gxxvqz8xt6nwlz4td20k38v" \ | jq '.balances[] | select(.denom=="uluna")' # expect amount ≈ 9999990000000 make verify-localterra-funding-headroom make test-swarm-liquidity cd packages/localnet-trading-swarm && npm ci && npm run test:run # Optional manual soak make swarm-launch # stop with make swarm-stop after ≥4h ``` Docs drift: `grep -R "1M LUNC" docs/` should return no current invariant references. ## Follow-ups - Python swarm separate bot keys ([#119](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/119) TS pattern) - Revisit `--fees 500000000uluna` if ante allows ([#115](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/115))  --- > [!NOTE] > **Low Risk** > Local-dev and QA tooling only; no production auth or contract logic. Requires volume reset for new genesis to apply. > > **Overview** > **10× LocalTerra funding** across genesis, local deploy seeds, and bot/E2E defaults so shared dev account **`test1`** (Simulated Wallet, Python QA swarm, TypeScript swarm) keeps enough **LUNC** gas through heavy QA ([#372](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/issues/372)). > > **Chain & deploy:** `docker/init-chain.sh` raises **`test1`** genesis to **10M LUNC** / **100M USTC** (and other stables 10×). `scripts/deploy-dex-local.sh` scales CW20/wrapped-native **`initial_balances`**, factory token mints, and default **`DEPLOY_TREASURY_FUND_COINS`** to **20M USTC + 2M LUNC**. > > **Swarm & E2E:** TypeScript **`defaultFundingOptions`** and new **`funding.test.ts`** use 10× **`SWARM_*`** defaults; **`e2e-provision-dev-wallet.sh`** bumps **`E2E_DEV_*`** floors/mint top-ups. Docs (**LT4**, **LT8**, testing, QA onboarding) document **`make reset`** after genesis changes. > > **Operational hardening:** **`preflight-test1-uluna.sh`** runs before **`launch-swarm.sh`**; **`swarm.py`** warns when **`test1`** uluna drops below **100k LUNC**. New **`make verify-localterra-funding-headroom`** greps invariants, optional LCD post-deploy floor, and a short **`swarm-local`** soak. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit e24661a8bd57d3deb78ab65c8efb2fc72dd62e95. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-12 11:39:27 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-12 11:39:36 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-12 11:40:32 +00:00

(Migrated from gitlab.com)

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit f71fb043b4. Configure here.}

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.  <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aToxOTIyNzFjNC0zZmNiLTRlMjMtYTViYi1mY2Q3YzZhN2FkZGUiLCJlbmNyeXB0aW9uS2V5IjoiOWY2eXRpRVgyQnNidWdYby1nb3dyWXZxb3NnSnh3c3lzLXdjcmY0clJMayIsImJyYW5jaCI6ImZpeC8zNzItbG9jYWx0ZXJyYS1mdW5kaW5nLTEweCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>   <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. </sup>  <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f71fb043b4b43ee1aba7280efd52350908f511de. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-12 11:40:33 +00:00

(Migrated from gitlab.com)

Verify script ignores QA LCD

Medium Severity

query_test1_uluna only uses VITE_TERRA_LCD_URL defaulting to http://127.0.0.1:1317, unlike sibling QA scripts that source scripts/qa/qa-host.env and TERRA_LCD_URL / DEX_TERRA_LCD_PORT. On remapped QA hosts or when only frontend-dapp/.env.local holds the LCD URL, balance checks and the swarm soak can read zero and fail incorrectly.

^{Reviewed by Cursor Bugbot for commit f71fb043b4. Configure here.}

### Verify script ignores QA LCD **Medium Severity**  `query_test1_uluna` only uses `VITE_TERRA_LCD_URL` defaulting to `http://127.0.0.1:1317`, unlike sibling QA scripts that source `scripts/qa/qa-host.env` and `TERRA_LCD_URL` / `DEX_TERRA_LCD_PORT`. On remapped QA hosts or when only `frontend-dapp/.env.local` holds the LCD URL, balance checks and the swarm soak can read zero and fail incorrectly.    <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmU3OGY5ZGYwLWJjZDctNDc4NS05YjFkLTk0ZmM4YjZkMTg3ZSIsImVuY3J5cHRpb25LZXkiOiJoT29HdHlQbThvT0FHLWstRHlFNUthd0JxN0lSbDFWTkpvSWt2U0hHc1lJIiwiYnJhbmNoIjoiZml4LzM3Mi1sb2NhbHRlcnJhLWZ1bmRpbmctMTB4IiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmU3OGY5ZGYwLWJjZDctNDc4NS05YjFkLTk0ZmM4YjZkMTg3ZSIsImVuY3J5cHRpb25LZXkiOiJoT29HdHlQbThvT0FHLWstRHlFNUthd0JxN0lSbDFWTkpvSWt2U0hHc1lJIiwiYnJhbmNoIjoiZml4LzM3Mi1sb2NhbHRlcnJhLWZ1bmRpbmctMTB4IiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjE2OCwiY29tbWl0U2hhIjoiZjcxZmIwNDNiNGI0M2VlMWFiYTcyODBlZmQ1MjM1MDkwOGY1MTFkZSIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f71fb043b4b43ee1aba7280efd52350908f511de. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

PlasticDigits commented

2026-06-12 11:41:37 +00:00

(Migrated from gitlab.com)

Security review — MR !886

Commit reviewed: f71fb043b4b43ee1aba7280efd52350908f511de

Scope: LocalTerra genesis/deploy/E2E/swarm funding scaled 10× (#372); new preflight-test1-uluna.sh, verify-localterra-funding-headroom.sh, swarm low-balance WARN paths; docs/Makefile only otherwise.

Method: Diff vs main (19 files). Traced attacker-controlled inputs to sinks in new/changed scripts (preflight-test1-uluna.sh, verify-localterra-funding-headroom.sh, swarm.py balance probe, funding.ts defaults, deploy-dex-local.sh treasury/CW20 seeds). Checked auth boundaries, injection, SSRF, secret leakage, and production code paths.

Outcome: FINDINGS: 0 medium+

Summary: No exploitable medium, high, or critical issues on this diff.

All economic changes are localnet/QA-only (docker/init-chain.sh, deploy-dex-local.sh, E2E provision, trading-swarm package). No production frontend, indexer API, or on-chain contract logic is modified.
New LCD queries use a hardcoded test1 address and existing localterra-host-curl / _lcd_get_json patterns; TERRA_LCD_URL SSRF surface is unchanged and limited to operator-controlled dev tooling.
DEPLOY_TREASURY_FUND_COINS / SWARM_* env overrides were already supported; only defaults changed. No shell metacharacter expansion beyond pre-existing terrad_tx quoting.
Larger mint/treasury amounts remain within CW20/Cosmos Uint128 ranges; no overflow or authz bypass introduced.
Public test1 mnemonic documentation is operational clarity, not a new secret exposure.

Inline threads: None (no medium+ findings).

Prior security comments: None on this MR to reconcile.

## Security review — MR !886 **Commit reviewed:** `f71fb043b4b43ee1aba7280efd52350908f511de` **Scope:** LocalTerra genesis/deploy/E2E/swarm funding scaled 10× (#372); new `preflight-test1-uluna.sh`, `verify-localterra-funding-headroom.sh`, swarm low-balance WARN paths; docs/Makefile only otherwise. **Method:** Diff vs `main` (19 files). Traced attacker-controlled inputs to sinks in new/changed scripts (`preflight-test1-uluna.sh`, `verify-localterra-funding-headroom.sh`, `swarm.py` balance probe, `funding.ts` defaults, `deploy-dex-local.sh` treasury/CW20 seeds). Checked auth boundaries, injection, SSRF, secret leakage, and production code paths. **Outcome:** `FINDINGS: 0` medium+ **Summary:** No exploitable medium, high, or critical issues on this diff. - All economic changes are **localnet/QA-only** (`docker/init-chain.sh`, `deploy-dex-local.sh`, E2E provision, trading-swarm package). No production frontend, indexer API, or on-chain contract logic is modified. - New LCD queries use a **hardcoded `test1` address** and existing `localterra-host-curl` / `_lcd_get_json` patterns; `TERRA_LCD_URL` SSRF surface is unchanged and limited to operator-controlled dev tooling. - `DEPLOY_TREASURY_FUND_COINS` / `SWARM_*` env overrides were already supported; only defaults changed. No shell metacharacter expansion beyond pre-existing `terrad_tx` quoting. - Larger mint/treasury amounts remain within CW20/Cosmos `Uint128` ranges; no overflow or authz bypass introduced. - Public `test1` mnemonic documentation is operational clarity, not a new secret exposure. **Inline threads:** None (no medium+ findings). **Prior security comments:** None on this MR to reconcile.

ghost1 commented

2026-06-12 11:42:32 +00:00

(Migrated from gitlab.com)

added 1 commit

e24661a8 - fix(qa): source qa-host.env for LCD in verify-localterra-funding-headroom

Compare with previous version

added 1 commit <ul><li>e24661a8 - fix(qa): source qa-host.env for LCD in verify-localterra-funding-headroom</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/168/diffs?diff_id=1848938639&start_sha=f71fb043b4b43ee1aba7280efd52350908f511de)

ghost1 commented

2026-06-12 11:42:46 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-12 11:43:08 +00:00

(Migrated from gitlab.com)

resolved all threads

PlasticDigits commented

2026-06-12 11:50:09 +00:00

(Migrated from gitlab.com)

mentioned in commit 0b63e0030d