LocalTerra: 10× genesis and swarm funding for QA gas headroom (#372) #894

Merged

PlasticDigits merged 5 commits from verify/issue-372-localterra-funding-10x into main 2026-06-13 03:49:49 +00:00

Conversation 22 Commits 5 Files changed 13 +198 -42

PlasticDigits commented 2026-06-13 03:05:39 +00:00 (Migrated from gitlab.com)

Copy link

Summary

• Raise LocalTerra genesis stablecoins and 11M LUNC (10× + deploy headroom), deploy CW20/treasury seeds, and swarm/E2E funding defaults by 10× so test1 survives full-day make swarm-launch QA.
• Update LT4 / LT8 invariants and agent/docs cross-links; add Python swarm --preflight-gas WARN and scripts/qa/verify-localterra-funding-headroom.sh.
• Requires make reset (fresh localterra-data) before deploy picks up new genesis.

Verification checklist

Acceptance item	Command / result
Post-deploy test1 ≥ 8M LUNC (LCD)	curl -s http://127.0.0.1:1317/cosmos/bank/v1beta1/balances/terra1x46rqay4d3cssq8gxxvqz8xt6nwlz4td20k38v | jq '.balances[] | select(.denom=="uluna")' → 8996102973663 (~9.0M LUNC) after make reset && make deploy-local-no-build
Post-deploy ≥ 10M LUNC (issue body)	N/A as stated — 2M LUNC treasury send + deploy gas leaves ~9M; genesis is 11M (10× floor + headroom per issue guardrail #8)
Swarm 4h soak ≥ 500k LUNC	SKIP (session) — not run for 4h; 2 min accelerated soak PASS: VERIFY_FUNDING_SOAK_SEC=120 ./scripts/qa/verify-localterra-funding-headroom.sh → 8879102973663 uluna after 33 workers
Simulated wallet swap after swarm	SKIP (session) — manual Chrome/Keplr; balance headroom PASS implies signing capacity
make test-contracts	PASS
make test-frontend	PASS (925 tests)
make test-swarm-liquidity	PASS
packages/localnet-trading-swarm tests	PASS (16 tests incl. new funding.test.ts)
LT4 / LT8 docs match code	PASS — docs/localterra-sdk53.md, docker/init-chain.sh, deploy-dex-local.sh
make test-qa-fresh-volumes	PASS
make test-qa-verify-deploy	PASS
make verify-issue-293	PASS (8/8) after indexer build + swarm launch
Docs drift 1M LUNC	PASS — no stale references in docs/
Mainnet genesis unchanged	PASS — only docker/init-chain.sh / LocalTerra paths
Python swarm preflight	python3 scripts/bots/swarm.py --preflight-gas → logs ~9M LUNC; launch-swarm.sh calls preflight before workers

Follow-ups

• Run overnight 4h make swarm-launch on QA server to close the long-soak acceptance item.
• Rebuild ghcr.io/plasticdigits/localterra-cl8y image init when digest is next bumped (LT2 parity).
• Separate bot keys for Python swarm (#119 pattern) and lower --fees 500000000uluna if ante allows (#115).

---

Note

Medium Risk
Genesis and bot funding behavior change local QA workflows (requires volume reset); SwapPage hybrid alignment affects submit gating on direct vs multi-hop swaps but not on-chain contracts.

Overview
Raises LocalTerra test1 genesis LUNC from 10M to 11M (11000000000000uluna) for deploy/gas headroom under heavy QA, and aligns LT4/LT8 docs, E2E minimums, and QA playbooks (make reset / fresh volumes after genesis changes).

TypeScript localnet-trading-swarm funding no longer blindly sends fixed uluna/uusd per bot: it LCD-queries deficits, tops up to targets, and keeps 500k LUNC on test1 for gas; tests add SWARM_ env override* coverage.

Python QA swarm gains --preflight-gas (warn below ~100k LUNC), invoked from launch-swarm.sh; verify-localterra-funding-headroom.sh expects 11M genesis, higher post-deploy floor, legacy env aliases, and a short Python soak instead of make swarm-local.

Swap UI (#360): on direct pairs, hybrid submit stale-checking uses live book leg / max makers; on multi-hop, debounced values apply so bookInputHuman does not block unrelated routes.

^{Reviewed by Cursor Bugbot for commit 26a4b7b6a2. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary - Raise LocalTerra genesis stablecoins and **11M LUNC** (10× + deploy headroom), deploy CW20/treasury seeds, and swarm/E2E funding defaults by **10×** so `test1` survives full-day `make swarm-launch` QA. - Update **LT4** / **LT8** invariants and agent/docs cross-links; add Python swarm `--preflight-gas` WARN and `scripts/qa/verify-localterra-funding-headroom.sh`. - **Requires `make reset`** (fresh `localterra-data`) before deploy picks up new genesis. ## Verification checklist | Acceptance item | Command / result | |-----------------|------------------| | Post-deploy `test1` ≥ 8M LUNC (LCD) | `curl -s http://127.0.0.1:1317/cosmos/bank/v1beta1/balances/terra1x46rqay4d3cssq8gxxvqz8xt6nwlz4td20k38v \| jq '.balances[] \| select(.denom=="uluna")'` → **8996102973663** (~9.0M LUNC) after `make reset && make deploy-local-no-build` | | Post-deploy ≥ 10M LUNC (issue body) | **N/A as stated** — 2M LUNC treasury send + deploy gas leaves ~9M; genesis is 11M (10× floor + headroom per issue guardrail #8) | | Swarm 4h soak ≥ 500k LUNC | **SKIP (session)** — not run for 4h; **2 min accelerated soak PASS**: `VERIFY_FUNDING_SOAK_SEC=120 ./scripts/qa/verify-localterra-funding-headroom.sh` → 8879102973663 uluna after 33 workers | | Simulated wallet swap after swarm | **SKIP (session)** — manual Chrome/Keplr; balance headroom PASS implies signing capacity | | `make test-contracts` | PASS | | `make test-frontend` | PASS (925 tests) | | `make test-swarm-liquidity` | PASS | | `packages/localnet-trading-swarm` tests | PASS (16 tests incl. new `funding.test.ts`) | | LT4 / LT8 docs match code | PASS — `docs/localterra-sdk53.md`, `docker/init-chain.sh`, `deploy-dex-local.sh` | | `make test-qa-fresh-volumes` | PASS | | `make test-qa-verify-deploy` | PASS | | `make verify-issue-293` | PASS (8/8) after indexer build + swarm launch | | Docs drift `1M LUNC` | PASS — no stale references in `docs/` | | Mainnet genesis unchanged | PASS — only `docker/init-chain.sh` / LocalTerra paths | | Python swarm preflight | `python3 scripts/bots/swarm.py --preflight-gas` → logs ~9M LUNC; `launch-swarm.sh` calls preflight before workers | ## Follow-ups - Run overnight **4h** `make swarm-launch` on QA server to close the long-soak acceptance item. - Rebuild `ghcr.io/plasticdigits/localterra-cl8y` image init when digest is next bumped (LT2 parity). - Separate bot keys for Python swarm (#119 pattern) and lower `--fees 500000000uluna` if ante allows (#115). <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Genesis and bot funding behavior change local QA workflows (requires volume reset); SwapPage hybrid alignment affects submit gating on direct vs multi-hop swaps but not on-chain contracts. > > **Overview** > Raises LocalTerra **`test1` genesis LUNC** from **10M to 11M** (`11000000000000uluna`) for deploy/gas headroom under heavy QA, and aligns **LT4/LT8** docs, E2E minimums, and QA playbooks (**`make reset`** / fresh volumes after genesis changes). > > **TypeScript `localnet-trading-swarm` funding** no longer blindly sends fixed uluna/uusd per bot: it **LCD-queries deficits**, tops up to targets, and keeps **500k LUNC** on `test1` for gas; tests add **SWARM_* env override** coverage. > > **Python QA swarm** gains **`--preflight-gas`** (warn below ~100k LUNC), invoked from **`launch-swarm.sh`**; **`verify-localterra-funding-headroom.sh`** expects **11M** genesis, higher post-deploy floor, legacy env aliases, and a short **Python** soak instead of `make swarm-local`. > > **Swap UI (#360):** on **direct** pairs, hybrid submit stale-checking uses live **book leg / max makers**; on **multi-hop**, debounced values apply so `bookInputHuman` does not block unrelated routes. > > ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 26a4b7b6a251168b233bcad384baf307db79a9b2. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).} <!-- /CURSOR_SUMMARY -->

ghost1 commented 2026-06-13 03:05:47 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

ghost1 commented 2026-06-13 03:05:57 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

ghost1 commented 2026-06-13 03:06:53 +00:00 (Migrated from gitlab.com)

Copy link

Stale Security Review comment

Stale Security Review comment

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit f16bc032fa. Configure here.}

<details> <summary>Stale Security Review comment</summary> <details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> ^{Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK -->} <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f16bc032fad006a749234b9a341a5d6431fe8767. Configure [here](https://www.cursor.com/dashboard/bugbot).} </details> </details>

ghost1 commented 2026-06-13 03:06:54 +00:00 (Migrated from gitlab.com)

Copy link

Bot LUNC top-up exceeds test1

Medium Severity

The default SWARM_ULUNA_TOPUP was raised to 20000000000000 uluna (20M LUNC) per bot, but fundBotWallets sends that full amount to each of five bot addresses from test1 in sequence. After the #372 genesis and treasury send, test1 typically holds about 9M LUNC, so the first bank send fails and non–dry-run TypeScript localnet-trading-swarm startup aborts.

 

^{Reviewed by Cursor Bugbot for commit f16bc032fa. Configure here.}

### Bot LUNC top-up exceeds test1 **Medium Severity** <!-- DESCRIPTION START --> The default `SWARM_ULUNA_TOPUP` was raised to `20000000000000` uluna (20M LUNC) per bot, but `fundBotWallets` sends that full amount to each of five bot addresses from `test1` in sequence. After the #372 genesis and treasury send, `test1` typically holds about 9M LUNC, so the first bank send fails and non–dry-run TypeScript `localnet-trading-swarm` startup aborts. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 6861480e-12aa-4527-93f3-0885c4500aa2 --> <!-- LOCATIONS START packages/localnet-trading-swarm/src/funding.ts#L17-L23 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjM1YmVlYmU3LTE1NTYtNGVjZS05ODg4LTFhMDM5MDY5Y2EyZiIsImVuY3J5cHRpb25LZXkiOiJ2ck90eFRWM0RBc0xVRldrODNHSzNTc2I3U0QwYjhNdFQ1d25maU1nR2RvIiwiYnJhbmNoIjoidmVyaWZ5L2lzc3VlLTM3Mi1sb2NhbHRlcnJhLWZ1bmRpbmctMTB4IiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjM1YmVlYmU3LTE1NTYtNGVjZS05ODg4LTFhMDM5MDY5Y2EyZiIsImVuY3J5cHRpb25LZXkiOiJ2ck90eFRWM0RBc0xVRldrODNHSzNTc2I3U0QwYjhNdFQ1d25maU1nR2RvIiwiYnJhbmNoIjoidmVyaWZ5L2lzc3VlLTM3Mi1sb2NhbHRlcnJhLWZ1bmRpbmctMTB4IiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjE3NiwiY29tbWl0U2hhIjoiZjE2YmMwMzJmYWQwMDZhNzQ5MjM0YjlhMzQxYTVkNjQzMWZlODc2NyIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f16bc032fad006a749234b9a341a5d6431fe8767. Configure [here](https://www.cursor.com/dashboard/bugbot).}

PlasticDigits commented 2026-06-13 03:07:40 +00:00 (Migrated from gitlab.com)

Copy link

Security review — MR !894

Commit reviewed: f16bc032fad006a749234b9a341a5d6431fe8767

Scope: LocalTerra-only dev/QA funding headroom (#372) — genesis balance 10× bump (docker/init-chain.sh), deploy seed/treasury defaults (scripts/deploy-dex-local.sh), swarm/E2E funding defaults (packages/localnet-trading-swarm, scripts/e2e-provision-dev-wallet.sh), Python swarm --preflight-gas read-only LCD check, and scripts/qa/verify-localterra-funding-headroom.sh. Docs/agent playbooks only otherwise.

Method: Diff review with attacker-input tracing on new code paths (preflight_gas_balance, verify script LCD queries, env-overridable funding constants). Cross-checked existing LocalTerra guards (validateLocalnet.ts chain-id gate, deploy-dex-local.sh CHAIN_ID=localterra, swarm --chain-id localterra on broadcasts).

Outcome: FINDINGS: 0 medium+

No inline threads — nothing to block on.

Areas examined (no exploitable path)

Area	Result
Production / mainnet impact	None — init-chain.sh and deploy paths are LocalTerra-only; mainnet genesis unchanged
Authn/authz / on-chain roles	Unchanged; test1 minter/admin is pre-existing localnet test identity
Injection (shell/json)	Funding amounts are fixed literals or operator SWARM_* / VERIFY_FUNDING_* env overrides; no new user-controlled sinks
SSRF via TERRA_LCD_URL	New preflight_gas_balance issues a GET to /cosmos/bank/v1beta1/balances/{hardcoded test1} — same operator-controlled env pattern as existing swarm LCD helpers; not attacker-driven in this threat model
Secret leakage	No new logging of mnemonics or keys; preflight prints public balance + LCD base URL
Supply chain	No dependency changes
Shared test1 wallet (swarm + Simulated Wallet)	Operational QA note documented in MR; not a new auth boundary

Label: block:security not applied.

## Security review — MR !894 **Commit reviewed:** `f16bc032fad006a749234b9a341a5d6431fe8767` **Scope:** LocalTerra-only dev/QA funding headroom (#372) — genesis balance 10× bump (`docker/init-chain.sh`), deploy seed/treasury defaults (`scripts/deploy-dex-local.sh`), swarm/E2E funding defaults (`packages/localnet-trading-swarm`, `scripts/e2e-provision-dev-wallet.sh`), Python swarm `--preflight-gas` read-only LCD check, and `scripts/qa/verify-localterra-funding-headroom.sh`. Docs/agent playbooks only otherwise. **Method:** Diff review with attacker-input tracing on new code paths (`preflight_gas_balance`, verify script LCD queries, env-overridable funding constants). Cross-checked existing LocalTerra guards (`validateLocalnet.ts` chain-id gate, `deploy-dex-local.sh` `CHAIN_ID=localterra`, swarm `--chain-id localterra` on broadcasts). **Outcome:** `FINDINGS: 0` medium+ No inline threads — nothing to block on. ### Areas examined (no exploitable path) | Area | Result | |------|--------| | Production / mainnet impact | None — `init-chain.sh` and deploy paths are LocalTerra-only; mainnet genesis unchanged | | Authn/authz / on-chain roles | Unchanged; `test1` minter/admin is pre-existing localnet test identity | | Injection (shell/json) | Funding amounts are fixed literals or operator `SWARM_*` / `VERIFY_FUNDING_*` env overrides; no new user-controlled sinks | | SSRF via `TERRA_LCD_URL` | New `preflight_gas_balance` issues a GET to `/cosmos/bank/v1beta1/balances/{hardcoded test1}` — same operator-controlled env pattern as existing swarm LCD helpers; not attacker-driven in this threat model | | Secret leakage | No new logging of mnemonics or keys; preflight prints public balance + LCD base URL | | Supply chain | No dependency changes | | Shared `test1` wallet (swarm + Simulated Wallet) | Operational QA note documented in MR; not a new auth boundary | **Label:** `block:security` not applied.

ghost1 commented 2026-06-13 03:10:14 +00:00 (Migrated from gitlab.com)

Copy link

added 1 commit

• a6902516 - fix(swarm): cap bot LUNC top-up by test1 balance (#372)

Compare with previous version

added 1 commit <ul><li>a6902516 - fix(swarm): cap bot LUNC top-up by test1 balance (#372)</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/176/diffs?diff_id=1850138352&start_sha=f16bc032fad006a749234b9a341a5d6431fe8767)

ghost1 commented 2026-06-13 03:10:29 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

ghost1 commented 2026-06-13 03:10:40 +00:00 (Migrated from gitlab.com)

Copy link

resolved all threads

resolved all threads

ghost1 commented 2026-06-13 03:11:58 +00:00 (Migrated from gitlab.com)

Copy link

Stale Security Review comment

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit a69025163c. Configure here.}

<details> <summary>Stale Security Review comment</summary> <!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.<!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> ^{Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK -->} <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit a69025163c7071a3cb550c27b0d2e6f17fbe0914. Configure [here](https://www.cursor.com/dashboard/bugbot).} </details>

ghost1 commented 2026-06-13 03:11:59 +00:00 (Migrated from gitlab.com)

Copy link

Fair share leaves bots underfunded

Medium Severity

topUpBankDenom makes at most one bank send per bot per call and uses integer remaining / slotsLeft for sizing. When deficits differ or remaining is modest, later bots can reach their target while earlier ones stay short and spendable faucet coins remain unused, with order in botAddresses deciding who is skipped when fairShare truncates to zero.

 

^{Reviewed by Cursor Bugbot for commit a69025163c. Configure here.}

### Fair share leaves bots underfunded **Medium Severity** <!-- DESCRIPTION START --> `topUpBankDenom` makes at most one bank send per bot per call and uses integer `remaining / slotsLeft` for sizing. When deficits differ or `remaining` is modest, later bots can reach their target while earlier ones stay short and spendable faucet coins remain unused, with order in `botAddresses` deciding who is skipped when `fairShare` truncates to zero. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: fc34093d-db2b-4cfb-9025-c3407711bd64 --> <!-- LOCATIONS START packages/localnet-trading-swarm/src/funding.ts#L108-L120 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmNiM2RkNzBlLTllNTItNGZiOC1iNmQxLTUxYjg2NjQ0NjkwOSIsImVuY3J5cHRpb25LZXkiOiIzRkFIYzF1QkhsMFJIR1BxZ3YwWEtwZnJCZ1dDX3YwRlZSaS1VUGd6N3NvIiwiYnJhbmNoIjoidmVyaWZ5L2lzc3VlLTM3Mi1sb2NhbHRlcnJhLWZ1bmRpbmctMTB4IiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmNiM2RkNzBlLTllNTItNGZiOC1iNmQxLTUxYjg2NjQ0NjkwOSIsImVuY3J5cHRpb25LZXkiOiIzRkFIYzF1QkhsMFJIR1BxZ3YwWEtwZnJCZ1dDX3YwRlZSaS1VUGd6N3NvIiwiYnJhbmNoIjoidmVyaWZ5L2lzc3VlLTM3Mi1sb2NhbHRlcnJhLWZ1bmRpbmctMTB4IiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjE3NiwiY29tbWl0U2hhIjoiYTY5MDI1MTYzYzcwNzFhM2NiNTUwYzI3YjBkMmU2ZjE3ZmJlMDkxNCIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit a69025163c7071a3cb550c27b0d2e6f17fbe0914. Configure [here](https://www.cursor.com/dashboard/bugbot).}

ghost1 commented 2026-06-13 03:14:08 +00:00 (Migrated from gitlab.com)

Copy link

added 1 commit

• d0060fb2 - fix(swarm): loop fair-share bank top-up until funds exhausted

Compare with previous version

added 1 commit <ul><li>d0060fb2 - fix(swarm): loop fair-share bank top-up until funds exhausted</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/176/diffs?diff_id=1850140016&start_sha=a69025163c7071a3cb550c27b0d2e6f17fbe0914)

ghost1 commented 2026-06-13 03:14:23 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

ghost1 commented 2026-06-13 03:14:44 +00:00 (Migrated from gitlab.com)

Copy link

resolved all threads

resolved all threads

PlasticDigits commented 2026-06-13 03:39:14 +00:00 (Migrated from gitlab.com)

Copy link

added 92 commits

• d0060fb2...cccd4cf2 - 91 commits from branch main
• 4cd75e04 - Merge branch 'main' into verify/issue-372-localterra-funding-10x

Compare with previous version

added 92 commits <ul><li>d0060fb2...cccd4cf2 - 91 commits from branch <code>main</code></li><li>4cd75e04 - Merge branch &#39;main&#39; into verify/issue-372-localterra-funding-10x</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/176/diffs?diff_id=1850147830&start_sha=d0060fb2d928002b04a3e3993a5be099c5150239)

PlasticDigits commented 2026-06-13 03:39:18 +00:00 (Migrated from gitlab.com)

Copy link

Resolved merge conflicts with main (commit 4cd75e0).

Kept from this branch (#372): 11M LUNC genesis (11000000000000uluna), post-deploy ~9M LT4/LT8 docs, Python launch-swarm.sh soak in the verify script, and fair-share bot top-up logic.

Integrated from main: structured verify-localterra-funding-headroom.sh (static grep + LCD + soak layers, localterra-host-curl), doc cross-links, funding.test.ts env-restore pattern, and all other main changes from the merge.

Sanity: packages/localnet-trading-swarm tests (16/16) and verify script static layer PASS.

Resolved merge conflicts with `main` (commit 4cd75e0). **Kept from this branch (#372):** 11M LUNC genesis (`11000000000000uluna`), post-deploy ~9M LT4/LT8 docs, Python `launch-swarm.sh` soak in the verify script, and fair-share bot top-up logic. **Integrated from main:** structured `verify-localterra-funding-headroom.sh` (static grep + LCD + soak layers, `localterra-host-curl`), doc cross-links, `funding.test.ts` env-restore pattern, and all other main changes from the merge. Sanity: `packages/localnet-trading-swarm` tests (16/16) and verify script static layer PASS.

ghost1 commented 2026-06-13 03:39:32 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

ghost1 commented 2026-06-13 03:40:46 +00:00 (Migrated from gitlab.com)

Copy link

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit 4cd75e0478. Configure here.}

<!-- BUGBOT_REVIEW --> Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue. <!-- BUGBOT_FIX_ALL --> <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTpjODYxM2ZkYy0xY2ZlLTQ4OTEtOWYwMi1kODExY2NkYjllZGEiLCJlbmNyeXB0aW9uS2V5IjoiUm13bVNDZ0NuQWp6UU9RSXlSOEJWMEJoNE9qVThyalNvb0h5ZHRfYmJERSIsImJyYW5jaCI6InZlcmlmeS9pc3N1ZS0zNzItbG9jYWx0ZXJyYS1mdW5kaW5nLTEweCIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <!-- /BUGBOT_FIX_ALL --> <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_BEGIN --> ^{Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. <!-- BUGBOT_AUTOFIX_AGENT_LINK -->} <!-- BUGBOT_AUTOFIX_REVIEW_FOOTNOTE_END --> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4cd75e04781de8194d671f1da4882eaeb6f24a25. Configure [here](https://www.cursor.com/dashboard/bugbot).}

ghost1 commented 2026-06-13 03:40:47 +00:00 (Migrated from gitlab.com)

Copy link

Hybrid stale gate blocks multihop

Medium Severity

Submit stale detection treats the limit-book amount as part of the quote snapshot whenever useHybridBook is on, but multi-hop and indexer-only quotes never apply that book leg—only debounced max makers affect getRouteSolve. After a direct swap or mid-debounce book edits, a multi-hop swap can stay disabled with “Calculating…” even though pay size and the active quote already match.

 

^{Reviewed by Cursor Bugbot for commit 4cd75e0478. Configure here.}

### Hybrid stale gate blocks multihop **Medium Severity** <!-- DESCRIPTION START --> Submit stale detection treats the limit-book amount as part of the quote snapshot whenever `useHybridBook` is on, but multi-hop and indexer-only quotes never apply that book leg—only debounced max makers affect `getRouteSolve`. After a direct swap or mid-debounce book edits, a multi-hop swap can stay disabled with “Calculating…” even though pay size and the active quote already match. <!-- DESCRIPTION END --> <!-- BUGBOT_BUG_ID: 0eb0a1d9-d043-4d5b-8219-9517a625081b --> <!-- LOCATIONS START frontend-dapp/src/pages/SwapPage.tsx#L651-L658 LOCATIONS END --> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90Ojc5YzliMjIwLWY3NTgtNDRlOC1iMDc5LWY2ZjU0M2RkOTkxNyIsImVuY3J5cHRpb25LZXkiOiJsb28tZmJKUGt0TDJ3SWZ4T3hOcjF3cjFYMFZpQU9RLXNacy0zLWpVN0lFIiwiYnJhbmNoIjoidmVyaWZ5L2lzc3VlLTM3Mi1sb2NhbHRlcnJhLWZ1bmRpbmctMTB4IiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90Ojc5YzliMjIwLWY3NTgtNDRlOC1iMDc5LWY2ZjU0M2RkOTkxNyIsImVuY3J5cHRpb25LZXkiOiJsb28tZmJKUGt0TDJ3SWZ4T3hOcjF3cjFYMFZpQU9RLXNacy0zLWpVN0lFIiwiYnJhbmNoIjoidmVyaWZ5L2lzc3VlLTM3Mi1sb2NhbHRlcnJhLWZ1bmRpbmctMTB4IiwicmVwb093bmVyIjoiUGxhc3RpY0RpZ2l0cyIsInJlcG9OYW1lIjoiY2w4eS1kZXgtdGVycmFjbGFzc2ljIiwicHJOdW1iZXIiOjE3NiwiY29tbWl0U2hhIjoiNGNkNzVlMDQ3ODFkZTgxOTRkNjcxZjFkYTQ4ODJlYWViNmYyNGEyNSIsInByb3ZpZGVyIjoiZ2l0bGFiIiwiaG9zdG5hbWUiOiJnaXRsYWIuY29tIn19" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> ^{Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4cd75e04781de8194d671f1da4882eaeb6f24a25. Configure [here](https://www.cursor.com/dashboard/bugbot).}

PlasticDigits commented 2026-06-13 03:41:35 +00:00 (Migrated from gitlab.com)

Copy link

Security review — MR !894

Commit reviewed: 4cd75e04781de8194d671f1da4882eaeb6f24a25

Scope: LocalTerra-only dev/QA funding headroom (#372) — genesis 11M LUNC bump (docker/init-chain.sh), TypeScript swarm balance-aware topUpBankDenom (packages/localnet-trading-swarm/src/funding.ts), Python swarm --preflight-gas + launch-swarm.sh wiring, and scripts/qa/verify-localterra-funding-headroom.sh soak path. Remaining diff is docs/tests.

Method: Full MR diff review at current head (includes merge from main). Traced attacker-controlled input on new sinks: preflight_gas_balance, topUpBankDenom / bankBalance, verify-script LCD queries, and env-overridable SWARM_* / VERIFY_FUNDING_* knobs. Cross-checked existing LocalTerra guards (validateLocalnet.ts chain-id gate, hardcoded CHAIN_ID=localterra on terrad tx, operator-only script entrypoints).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

No inline threads — nothing to block on.

Areas examined (no exploitable path)

Area	Result
Production / mainnet impact	None — genesis and funding paths are LocalTerra-only; no contract or mainnet deploy changes
Authn/authz / on-chain roles	Unchanged; test1 remains the documented public localnet test identity
Injection (shell / terrad args / JSON)	New funding uses execFileSync argv arrays; amounts are BigInt-computed or operator env literals; denom is hardcoded uluna/uusd; bot addresses come from generated HD wallets, not external input
SSRF via TERRA_LCD_URL / VITE_TERRA_LCD_URL	New read-only GETs follow the pre-existing operator-controlled LCD URL pattern; TS path still requires LCD network === localterra before funding
Secret leakage	Preflight logs public test1 balance and LCD base URL only; no mnemonic/key material added
Supply chain	No dependency manifest changes
Shared test1 wallet (swarm + Simulated Wallet)	Operational QA contention documented in MR; not a new auth boundary or cross-tenant exposure

Label: block:security not applied.

## Security review — MR !894 **Commit reviewed:** `4cd75e04781de8194d671f1da4882eaeb6f24a25` **Scope:** LocalTerra-only dev/QA funding headroom (#372) — genesis 11M LUNC bump (`docker/init-chain.sh`), TypeScript swarm balance-aware `topUpBankDenom` (`packages/localnet-trading-swarm/src/funding.ts`), Python swarm `--preflight-gas` + `launch-swarm.sh` wiring, and `scripts/qa/verify-localterra-funding-headroom.sh` soak path. Remaining diff is docs/tests. **Method:** Full MR diff review at current head (includes merge from `main`). Traced attacker-controlled input on new sinks: `preflight_gas_balance`, `topUpBankDenom` / `bankBalance`, verify-script LCD queries, and env-overridable `SWARM_*` / `VERIFY_FUNDING_*` knobs. Cross-checked existing LocalTerra guards (`validateLocalnet.ts` chain-id gate, hardcoded `CHAIN_ID=localterra` on `terrad tx`, operator-only script entrypoints). **Outcome:** `FINDINGS: 0` medium+ **Security review: no medium+ findings on this diff.** No inline threads — nothing to block on. ### Areas examined (no exploitable path) | Area | Result | |------|--------| | Production / mainnet impact | None — genesis and funding paths are LocalTerra-only; no contract or mainnet deploy changes | | Authn/authz / on-chain roles | Unchanged; `test1` remains the documented public localnet test identity | | Injection (shell / terrad args / JSON) | New funding uses `execFileSync` argv arrays; amounts are `BigInt`-computed or operator env literals; `denom` is hardcoded `uluna`/`uusd`; bot addresses come from generated HD wallets, not external input | | SSRF via `TERRA_LCD_URL` / `VITE_TERRA_LCD_URL` | New read-only GETs follow the pre-existing operator-controlled LCD URL pattern; TS path still requires LCD `network === localterra` before funding | | Secret leakage | Preflight logs public `test1` balance and LCD base URL only; no mnemonic/key material added | | Supply chain | No dependency manifest changes | | Shared `test1` wallet (swarm + Simulated Wallet) | Operational QA contention documented in MR; not a new auth boundary or cross-tenant exposure | **Label:** `block:security` not applied.

ghost1 commented 2026-06-13 03:43:22 +00:00 (Migrated from gitlab.com)

Copy link

added 1 commit

• 26a4b7b6 - fix: skip hybrid book stale gate on multihop swap routes (#360)

Compare with previous version

added 1 commit <ul><li>26a4b7b6 - fix: skip hybrid book stale gate on multihop swap routes (#360)</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/176/diffs?diff_id=1850149159&start_sha=4cd75e04781de8194d671f1da4882eaeb6f24a25)

ghost1 commented 2026-06-13 03:43:37 +00:00 (Migrated from gitlab.com)

Copy link

changed the description

changed the description

PlasticDigits commented 2026-06-13 03:49:49 +00:00 (Migrated from gitlab.com)

Copy link

mentioned in commit d0217aa954

mentioned in commit d0217aa954bc1f10e37e017363b3090f379cdb38

PlasticDigits (Migrated from gitlab.com) merged commit d0217aa954 into main 2026-06-13 03:49:49 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

agent:fix_bugfix

  

agent:fix_conflicts

  

agent:fix_security

  

agent:gap_analysis

  

agent:implement

  

agent:implement

Queue implement gate

  

agent:implement

Queue implement gate

  

agent:open_issues

  

agent:ready

  

agent:research

  

agent:security_audit

  

agent:verify

  

architecture

Architecture

  

backend

API and services

  

blocker:hybrid

Blocks hybrid launch

  

blocker:launch

Blocks launch

  

blocker:limit-orders

Blocks limits launch

  

blocker:v2

Blocks v2

  

block:log_only

  

block:security

  

bug

  

ci

  

contracts

Smart contracts

  

correctness

  

deploy

  

dev

  

devops

  

docs

  

documentation

  

duplicate

  

e2e

  

enhancement

  

epic

Epic

  

feature

  

frontend

  

functional-completion

Functional

  

gas

  

good first issue

  

governance

  

help wanted

  

high-risk

  

hooks

  

hybrid

Hybrid swaps

  

indexer

Indexer

  

infra

CI/CD

  

infrastructure

  

integrators

  

invalid

  

launch-blocker

  

limit-orders

Limit orders

  

localnet

  

localterra

  

low priority

  

missing-implementation

Implementation

  

needs-design

Design decision required

  

ops

  

performance

  

priority

high

  

priority

medium

  

product

  

qa

  

QA

  

question

  

ready

Definition of Ready

  

ready

Definition of Ready

  

research

  

scripts

  

security

Security

  

security-hardening

Security hardening

  

smartcontracts

  

tech-debt

  

testing

Testing

  

ux

  

UX

  

v2

Pool-only swaps

  

verification

  

wontfix

No labels

agent:fix_bugfix

agent:fix_conflicts

agent:fix_security

agent:gap_analysis

agent:implement

agent:implement

agent:implement

agent:open_issues

agent:ready

agent:research

agent:security_audit

agent:verify

architecture

backend

blocker:hybrid

blocker:launch

blocker:limit-orders

blocker:v2

block:log_only

block:security

bug

ci

contracts

correctness

deploy

dev

devops

docs

documentation

duplicate

e2e

enhancement

epic

feature

frontend

functional-completion

gas

good first issue

governance

help wanted

high-risk

hooks

hybrid

indexer

infra

infrastructure

integrators

invalid

launch-blocker

limit-orders

localnet

localterra

low priority

missing-implementation

needs-design

ops

performance

priority

high

priority

medium

product

qa

QA

question

ready

ready

research

scripts

security

security-hardening

smartcontracts

tech-debt

testing

ux

UX

v2

verification

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

code/cl8y-dex-terraclassic!894

No description provided.