code/cw20-mintable
Watch
4
0
Fork
You've already forked cw20-mintable
 0
Code Issues 10 Pull requests 1 Projects Releases Packages Wiki Activity

Migration, protocol compatibility and independent security review of token fleet #7

New issue
Open
opened 2026-10-31 01:57:08 +00:00 by PlasticDigits · 5 comments
PlasticDigits commented 2026-10-31 01:57:08 +00:00
Owner

Inventory deployed cw20-mintable instances from reliable chain/code records: admin, code ID, decimals, issuer/minter, protocol custody, balance and integration surfaces. Identify contracts that cannot be migrated. Plan controller deployment and registry binding, migration gates, DEX code-id pin/whitelist coordination, pools/router/LP/bridge/wrapper/treasury compatibility, backups and forward-fix rollback. A migration must not silently discard balances, allowances, minters, pending timers or reservations. Keep minter vs governance authority separate and preserve old CW20 JSON aliases. Explicitly document admin migration power as possible policy bypass requiring multisig custody.

Independent reviewer examines actual final commits and meaningful adversarial focused tests: all movement paths, query failure, timer shortening, stale pending requests, default limit drain, governance compromise blast radius, recovery disputes and upgrade bypasses. Fix findings before release. Deploy only exact reviewed artifacts through available authorized credentials; actual on-chain custody unavailable is recorded, not invented. Bounded testnet/local proof precedes mainnet. Public coverage and contract/controller identities required before claiming fleet-wide pause.

  • Schema and migration fixtures; focused cross-contract integration checks.
  • Independent review of pinned commits, findings resolved.
  • Deployment/migration receipts or specific remaining unavailable capability.
    Dependency: controller/wallet/recovery implementation; review can begin on completed shards.

Working rules

User authorizes implementation and worker coordination. Trusted CL8Y governance is an explicit trust assumption; separate containment, unpause, recovery authorization, execution and key rotation. No social account alone establishes asset ownership. Never publish PII, secrets or private incident operations. Work in small reviewable increments, with bounded focused security tests; no broad soak runs or very long scripts. Publish commits/PRs and factual evidence. Keep acceptance open until actually met; source success does not establish live deployment. No automatic closing keywords in PR descriptions before full acceptance.

Inventory deployed cw20-mintable instances from reliable chain/code records: admin, code ID, decimals, issuer/minter, protocol custody, balance and integration surfaces. Identify contracts that cannot be migrated. Plan controller deployment and registry binding, migration gates, DEX code-id pin/whitelist coordination, pools/router/LP/bridge/wrapper/treasury compatibility, backups and forward-fix rollback. A migration must not silently discard balances, allowances, minters, pending timers or reservations. Keep minter vs governance authority separate and preserve old CW20 JSON aliases. Explicitly document admin migration power as possible policy bypass requiring multisig custody. Independent reviewer examines actual final commits and meaningful adversarial focused tests: all movement paths, query failure, timer shortening, stale pending requests, default limit drain, governance compromise blast radius, recovery disputes and upgrade bypasses. Fix findings before release. Deploy only exact reviewed artifacts through available authorized credentials; actual on-chain custody unavailable is recorded, not invented. Bounded testnet/local proof precedes mainnet. Public coverage and contract/controller identities required before claiming fleet-wide pause. - [ ] Schema and migration fixtures; focused cross-contract integration checks. - [ ] Independent review of pinned commits, findings resolved. - [ ] Deployment/migration receipts or specific remaining unavailable capability. Dependency: controller/wallet/recovery implementation; review can begin on completed shards. ## Working rules User authorizes implementation and worker coordination. Trusted CL8Y governance is an explicit trust assumption; separate containment, unpause, recovery authorization, execution and key rotation. No social account alone establishes asset ownership. Never publish PII, secrets or private incident operations. Work in small reviewable increments, with bounded focused security tests; no broad soak runs or very long scripts. Publish commits/PRs and factual evidence. Keep acceptance open until actually met; source success does not establish live deployment. No automatic closing keywords in PR descriptions before full acceptance.
PlasticDigits commented 2026-10-31 01:59:46 +00:00
Author
Owner

Implementation assigned to BB worker thr_n4vtxxfcb7, coordinated by thr_4rw76j9ker in security epic.

Dependency/order: Controller, wallet and recovery implementation, followed by independent review of pinned artifacts; deploy reviewed controller before migrating verified token inventory.

Worker is active in an isolated worktree. It owns implementation and truthful acceptance evidence, with independent review before production completion. Initial orchestration does not establish code/deployment acceptance.

Implementation assigned to BB worker `thr_n4vtxxfcb7`, coordinated by `thr_4rw76j9ker` in [security epic](https://git.cl8y.com/code/cw20-mintable/issues/3). Dependency/order: Controller, wallet and recovery implementation, followed by independent review of pinned artifacts; deploy reviewed controller before migrating verified token inventory. Worker is active in an isolated worktree. It owns implementation and truthful acceptance evidence, with independent review before production completion. Initial orchestration does not establish code/deployment acceptance.
PlasticDigits commented 2026-10-31 02:15:02 +00:00
Author
Owner

Independent coordinator source review completed for controller + shared interface at 3333807148f096cc5894c2b74442655bc5f4ad93; reviewer did not author the controller. This reviews controller source/interface/documentation only, not token correctness or live deployment.

Result: no blocking controller finding in reviewed scope. Inspected initial 2239cd2 implementation, then exact final delta: three timer events gain stored initiator and proposed_at; shared interface changes are formatting only. Guard remains constant-work, maximum three validated addresses with input-order blacklist vector, explicit enrollment/version and authoritative epochs. Distinct role addresses, pause-only responder, governance-only unpause/enrollment/delayed clearing, immediate responder revoke/reblock, candidate acceptance, global nonces and checked counters are enforced. Governance-tenure epoch prevents blacklist-clear replay even after an address returns to governance. Existing proposal deadlines intentionally retain old-delay snapshots; new delay affects future proposals. Fractional block timestamps round deadlines up. Queries and local tests cover shared pause across two enrolled token identities, independent of fleet fanout.

Independent bounded validation: cargo test -p cw20-security-controller --lib in integration worktree at the exact pin: 14 passed, 0 failed, test runtime 0.01s (build 0.93s). Reviewed meaningful authorization, role overlap, replacement/cancellation, old-delay shortening, fractional timestamp, stale-governance replay, overflow/funds and query-boundary tests. No broad script or extra full-workspace test run.

Deployment acceptance remains open: verify actual multisig threshold and constituent-key independence, chain-level admin custody/upgrade policy, exact code/artifact checksums, intended chain/controller enrollment and every token's live fail-closed pointer/guards. Distinct addresses alone cannot prove independent people/keys or a multisig. Shared controller availability and trusted governance/admin remain documented assumptions. Wasm/optimizer/chain compatibility and migration custody are separate release evidence. Any subsequent controller semantic change requires a new pinned review; token review remains assigned to its independent reviewer.

Independent coordinator source review completed for controller + shared interface at `3333807148f096cc5894c2b74442655bc5f4ad93`; reviewer did not author the controller. This reviews controller source/interface/documentation only, not token correctness or live deployment. Result: no blocking controller finding in reviewed scope. Inspected initial `2239cd2` implementation, then exact final delta: three timer events gain stored `initiator` and `proposed_at`; shared interface changes are formatting only. Guard remains constant-work, maximum three validated addresses with input-order blacklist vector, explicit enrollment/version and authoritative epochs. Distinct role addresses, pause-only responder, governance-only unpause/enrollment/delayed clearing, immediate responder revoke/reblock, candidate acceptance, global nonces and checked counters are enforced. Governance-tenure epoch prevents blacklist-clear replay even after an address returns to governance. Existing proposal deadlines intentionally retain old-delay snapshots; new delay affects future proposals. Fractional block timestamps round deadlines up. Queries and local tests cover shared pause across two enrolled token identities, independent of fleet fanout. Independent bounded validation: `cargo test -p cw20-security-controller --lib` in integration worktree at the exact pin: **14 passed, 0 failed**, test runtime 0.01s (build 0.93s). Reviewed meaningful authorization, role overlap, replacement/cancellation, old-delay shortening, fractional timestamp, stale-governance replay, overflow/funds and query-boundary tests. No broad script or extra full-workspace test run. Deployment acceptance remains open: verify actual multisig threshold and constituent-key independence, chain-level admin custody/upgrade policy, exact code/artifact checksums, intended chain/controller enrollment and every token's live fail-closed pointer/guards. Distinct addresses alone cannot prove independent people/keys or a multisig. Shared controller availability and trusted governance/admin remain documented assumptions. Wasm/optimizer/chain compatibility and migration custody are separate release evidence. Any subsequent controller semantic change requires a new pinned review; token review remains assigned to its independent reviewer.
PlasticDigits commented 2026-10-31 02:20:02 +00:00
Author
Owner

Independent TOKEN source review receipt — pinned 2d70d43c65

Result: no remaining blocking token finding identified in the reviewed scope. This concludes source review of integration 3333807148, corrective delta a13c8f5fb6, and final source/schema delta 2d70d43c65. Subsequent commits are outside this exact-pin conclusion.

Independence: this reviewer authored the controller shard, not the token implementation. This receipt independently reviews TOKEN code only. Running controller tests as part of workspace validation is not independent controller approval. The coordinator's separate controller receipt is #4 (comment).

Scope inspected: src/security.rs, src/recovery.rs, guarded contract dispatcher, messages, allowances, migration and inherited minter-fix prerequisite against Forgejo main 2f8438b; token schemas; docs/token-security-v1.md; and tests/security_program.rs. Review used separate detached checkouts, with no implementation changes.

Adversarial checks covered all six ordinary debit paths attributed to the balance owner, mint and allowance guards, owner/actor/recipient blacklists, bounded single-query fail-closed behavior, versions/vector lengths/unenrollment, callback rollback, lazy protection basis, conservative hourly rolling accounting, split/boundary/top-up drains, old-delay policy changes, replacement/cancellation/replay/relock, exact reservations and nondecreasing recovery replacement, source objections versus independent triage/veto, current-epoch governance-plus-dispute cancellation, destination acceptance/revocation/blacklist, fractional timestamps and the full 30-day minimum, role changes, immutable controller pointer, storage preservation, legacy JSON aliases, and admin upgrade trust.

Resolved edge: the implementation lead identified that a zero-value delegated debit could initialize another wallet's lazy basis before meaningful funding. Independently reviewed a13c8f5: zero debits return before accounting/state initialization, after reservation and lock checks; dispatcher containment and allowance authorization remain enforced. The added zero-allowance/dust/funding regression passes. Final additive WalletResponse.initialized uses persisted WALLETS.has and matches generated schemas; it does not change execution semantics.

Reproduced at final exact pin:

  • cargo test --workspace --locked: 91 passed (56 token unit, 21 cross-contract, 14 controller; controller counted as execution evidence only).
  • cargo clippy --workspace --all-targets --locked -- -D warnings: passed.
  • cargo run --bin schema --locked followed by git diff --exit-code -- schema: passed, no schema drift; checkout clean.
  • cargo +1.81.0 build -p cw20-mintable --lib --release --target wasm32-unknown-unknown --locked: passed.
  • wasm-tools validate on that token Wasm: passed structural validation. Unoptimized release Wasm SHA-256: b4df1a09ee013e9ec6596098eb43973560fe35cc0173ed32a05cd95d84b00941.

Limits: bounded source/native-test review and structural Wasm validation, not formal verification, a target-chain VM acceptance check, or live deployment evidence. An arbitrary governance/admin address does not establish multisig custody or independent constituent keys. Chain admins can replace code and bypass application policy; deployable code/checksum, custody, inventory, integration exemptions, and migration receipts still require separate verification. Individual legacy Rust execute_* helpers remain unguarded implementation helpers; downstream library users must enter through contract::execute. Default wallet throughput needs reviewed protocol assignments; no fleet-wide pause or compatibility claim follows from these tests. Issue #7 acceptance remains open for deployment/migration and coverage evidence. No live deployment performed.

Independent TOKEN source review receipt — pinned 2d70d43c651ecd4491c0736c89ae2975ee825686 Result: no remaining blocking token finding identified in the reviewed scope. This concludes source review of integration 3333807148f096cc5894c2b74442655bc5f4ad93, corrective delta a13c8f5fb6bffffc9594dee9a598ecb60d4836ab, and final source/schema delta 2d70d43c651ecd4491c0736c89ae2975ee825686. Subsequent commits are outside this exact-pin conclusion. Independence: this reviewer authored the controller shard, not the token implementation. This receipt independently reviews TOKEN code only. Running controller tests as part of workspace validation is not independent controller approval. The coordinator's separate controller receipt is https://git.cl8y.com/code/cw20-mintable/issues/4#issuecomment-65368. Scope inspected: src/security.rs, src/recovery.rs, guarded contract dispatcher, messages, allowances, migration and inherited minter-fix prerequisite against Forgejo main 2f8438b; token schemas; docs/token-security-v1.md; and tests/security_program.rs. Review used separate detached checkouts, with no implementation changes. Adversarial checks covered all six ordinary debit paths attributed to the balance owner, mint and allowance guards, owner/actor/recipient blacklists, bounded single-query fail-closed behavior, versions/vector lengths/unenrollment, callback rollback, lazy protection basis, conservative hourly rolling accounting, split/boundary/top-up drains, old-delay policy changes, replacement/cancellation/replay/relock, exact reservations and nondecreasing recovery replacement, source objections versus independent triage/veto, current-epoch governance-plus-dispute cancellation, destination acceptance/revocation/blacklist, fractional timestamps and the full 30-day minimum, role changes, immutable controller pointer, storage preservation, legacy JSON aliases, and admin upgrade trust. Resolved edge: the implementation lead identified that a zero-value delegated debit could initialize another wallet's lazy basis before meaningful funding. Independently reviewed a13c8f5: zero debits return before accounting/state initialization, after reservation and lock checks; dispatcher containment and allowance authorization remain enforced. The added zero-allowance/dust/funding regression passes. Final additive WalletResponse.initialized uses persisted WALLETS.has and matches generated schemas; it does not change execution semantics. Reproduced at final exact pin: - cargo test --workspace --locked: 91 passed (56 token unit, 21 cross-contract, 14 controller; controller counted as execution evidence only). - cargo clippy --workspace --all-targets --locked -- -D warnings: passed. - cargo run --bin schema --locked followed by git diff --exit-code -- schema: passed, no schema drift; checkout clean. - cargo +1.81.0 build -p cw20-mintable --lib --release --target wasm32-unknown-unknown --locked: passed. - wasm-tools validate on that token Wasm: passed structural validation. Unoptimized release Wasm SHA-256: b4df1a09ee013e9ec6596098eb43973560fe35cc0173ed32a05cd95d84b00941. Limits: bounded source/native-test review and structural Wasm validation, not formal verification, a target-chain VM acceptance check, or live deployment evidence. An arbitrary governance/admin address does not establish multisig custody or independent constituent keys. Chain admins can replace code and bypass application policy; deployable code/checksum, custody, inventory, integration exemptions, and migration receipts still require separate verification. Individual legacy Rust execute_* helpers remain unguarded implementation helpers; downstream library users must enter through contract::execute. Default wallet throughput needs reviewed protocol assignments; no fleet-wide pause or compatibility claim follows from these tests. Issue #7 acceptance remains open for deployment/migration and coverage evidence. No live deployment performed.
PlasticDigits commented 2026-10-31 02:28:47 +00:00
Author
Owner

Serial implementation/integration complete;91tests pass (56legacy+21cross-contract+14controller), strict workspace clippy, deterministic schemas, two repeat-identical Rust1.81/pinned optimizer builds and matching cosmwasm-check1.5.11 PASS for both exact optimized artifacts. Independent controller review3333807 and independent token/schema review2d70d43 published separately. CI bootstrapPR15 merged only after actual required check success; PR14 latest-head CI remains separately tracked. Current primary LCD evidence inventories35code10184 contracts, all cw2=0.1.0, plus95selected admin/minter/pool/router balance queries. Registered historical governance is confirmed on-chain2-of-3, but custody is not inferred: encrypted file-keyring access fails without unavailable passphrase/unlocked authorized quorum; test keyring empty and no signing broker credential discovered. Several primary-minter/governance overlaps and LP-admin execution routes require real verification/separation. No controller deployed,0/35migrated/enrolled, no chain broadcasts. Immutable/BSC/native/other-code/third-party assets not covered. Exact migration/DEX whitelist/pin/protocol assignment/backup/forward-fix sequence documented without fabricated payloads or bypassed timers.

Implementation PR: #14 . Reviewed exact-byte local candidate (draft, not deployed): https://git.cl8y.com/code/cw20-mintable/releases/tag/security-v1-review-2d70d43 . Rollout receipts: docs/rollout/{README.md,artifact-provenance.json,columbus-5-inventory.json,selected-integration-balances.json}. Contract lead thr_n4vtxxfcb7 retains issue/rollout ownership; parent coordinator thr_4rw76j9ker. No closing keywords or live coverage claim; this issue remains open for unverified production acceptance.

Serial implementation/integration complete;91tests pass (56legacy+21cross-contract+14controller), strict workspace clippy, deterministic schemas, two repeat-identical Rust1.81/pinned optimizer builds and matching cosmwasm-check1.5.11 PASS for both exact optimized artifacts. Independent controller review3333807 and independent token/schema review2d70d43 published separately. CI bootstrapPR15 merged only after actual required check success; PR14 latest-head CI remains separately tracked. Current primary LCD evidence inventories35code10184 contracts, all cw2=0.1.0, plus95selected admin/minter/pool/router balance queries. Registered historical governance is confirmed on-chain2-of-3, but custody is not inferred: encrypted file-keyring access fails without unavailable passphrase/unlocked authorized quorum; test keyring empty and no signing broker credential discovered. Several primary-minter/governance overlaps and LP-admin execution routes require real verification/separation. No controller deployed,0/35migrated/enrolled, no chain broadcasts. Immutable/BSC/native/other-code/third-party assets not covered. Exact migration/DEX whitelist/pin/protocol assignment/backup/forward-fix sequence documented without fabricated payloads or bypassed timers. Implementation PR: https://git.cl8y.com/code/cw20-mintable/pulls/14 . Reviewed exact-byte local candidate (draft, not deployed): https://git.cl8y.com/code/cw20-mintable/releases/tag/security-v1-review-2d70d43 . Rollout receipts: docs/rollout/{README.md,artifact-provenance.json,columbus-5-inventory.json,selected-integration-balances.json}. Contract lead thr_n4vtxxfcb7 retains issue/rollout ownership; parent coordinator thr_4rw76j9ker. No closing keywords or live coverage claim; this issue remains open for unverified production acceptance.
PlasticDigits commented 2026-10-31 02:29:51 +00:00
Author
Owner

Compiled optimized-Wasm VM smoke receipt — PASS (local only)

Executed the exact optimized release artifacts associated with reviewed source 2d70d43c65. Compared src/, packages/, and contracts/security-controller/ against final integration 8dc22d9885: no differences. This supplements the independent TOKEN source receipt #7 (comment); controller execution evidence does not constitute independent review by its author.

Artifact identity was checked before loading using SHA-256:

  • cw20_mintable.wasm: b90a837ed929ef638377ca7e9a72091c7a7c6730f1d291001fe580355e01a33f
  • cw20_security_controller.wasm: f78c0175267aed0f70ab4054be5c6fa8303efc37937ed65f92e908494ebe6de6

The isolated harness links cosmwasm-vm =1.5.11 and cosmwasm-std =1.5.11, with the checker's locked dependency versions, and uses Rust 1.81.0. It links no native token/controller implementation. It loads both Wasm files into actual VM instances and dispatches actual Wasm instantiate/execute/query entry points. The testing smart-query host forwards the token's raw smart-query payloads to the compiled controller VM, rather than fabricating config/guard responses.

Successful assertions:

  • Controller instantiation starts paused; config interface_version=1 and guard paused/enrollment/ordered blacklist vector are correct; governance enrollment succeeds; responder unpause is rejected.
  • Token instantiates, queries its controller pointer, and reports initialized=false before a positive debit.
  • Paused token transfer is rejected; governance unpause permits a 600-unit transfer from Alice's 10000-unit opening balance. Actual balance queries return Alice=9400 and Bob=600; wallet initialized=true, protected_balance=10000, rolling_spent=600.
  • Another 401-unit transfer is rejected by the 1000-unit rolling cap, preserving Alice's queried balance. Responder pause then blocks a 1-unit transfer. Governance unpause permits the remaining 400 units, after which another unit is rejected and Alice=9000.
  • Issuer mint exceeding the configured 20000-unit supply cap is rejected; queried total supply remains 10000.

Initial offline two-job harness build completed in 55.09s, within the 180-second build budget. Final harness execution exited successfully within a 30-second timeout. No dependency installation, contract source edits, new repository commit, CI restart, chain RPC, signing, or deployment was performed for this proof.

Portable harness files and transcript are available to the coordinating agents for draft-release/rollout attachment. The harness uses mocked host storage, address API and consensus Env; direct VM mocks are not a transactional chain layer, and these negative probes fail before writes. This short runtime smoke does not cover full Wasm recovery/migration/rotation scenarios, the target chain's configuration/gas schedule, signer custody, deployment identity, inventory or live coverage. Native 91-case evidence, independent source reviews, and deployment gates remain separate. No target-chain or fleet-wide live claim follows from this PASS.

Compiled optimized-Wasm VM smoke receipt — PASS (local only) Executed the exact optimized release artifacts associated with reviewed source 2d70d43c651ecd4491c0736c89ae2975ee825686. Compared src/, packages/, and contracts/security-controller/ against final integration 8dc22d98855ba6bc297342cd90046515c99dec75: no differences. This supplements the independent TOKEN source receipt https://git.cl8y.com/code/cw20-mintable/issues/7#issuecomment-65389; controller execution evidence does not constitute independent review by its author. Artifact identity was checked before loading using SHA-256: - cw20_mintable.wasm: b90a837ed929ef638377ca7e9a72091c7a7c6730f1d291001fe580355e01a33f - cw20_security_controller.wasm: f78c0175267aed0f70ab4054be5c6fa8303efc37937ed65f92e908494ebe6de6 The isolated harness links cosmwasm-vm =1.5.11 and cosmwasm-std =1.5.11, with the checker's locked dependency versions, and uses Rust 1.81.0. It links no native token/controller implementation. It loads both Wasm files into actual VM instances and dispatches actual Wasm instantiate/execute/query entry points. The testing smart-query host forwards the token's raw smart-query payloads to the compiled controller VM, rather than fabricating config/guard responses. Successful assertions: - Controller instantiation starts paused; config interface_version=1 and guard paused/enrollment/ordered blacklist vector are correct; governance enrollment succeeds; responder unpause is rejected. - Token instantiates, queries its controller pointer, and reports initialized=false before a positive debit. - Paused token transfer is rejected; governance unpause permits a 600-unit transfer from Alice's 10000-unit opening balance. Actual balance queries return Alice=9400 and Bob=600; wallet initialized=true, protected_balance=10000, rolling_spent=600. - Another 401-unit transfer is rejected by the 1000-unit rolling cap, preserving Alice's queried balance. Responder pause then blocks a 1-unit transfer. Governance unpause permits the remaining 400 units, after which another unit is rejected and Alice=9000. - Issuer mint exceeding the configured 20000-unit supply cap is rejected; queried total supply remains 10000. Initial offline two-job harness build completed in 55.09s, within the 180-second build budget. Final harness execution exited successfully within a 30-second timeout. No dependency installation, contract source edits, new repository commit, CI restart, chain RPC, signing, or deployment was performed for this proof. Portable harness files and transcript are available to the coordinating agents for draft-release/rollout attachment. The harness uses mocked host storage, address API and consensus Env; direct VM mocks are not a transactional chain layer, and these negative probes fail before writes. This short runtime smoke does not cover full Wasm recovery/migration/rotation scenarios, the target chain's configuration/gas schedule, signer custody, deployment identity, inventory or live coverage. Native 91-case evidence, independent source reviews, and deployment gates remain separate. No target-chain or fleet-wide live claim follows from this PASS.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
ops/whitelist-gated-migration
bb/cw20-security-contracts-controller-wallet-limits-thr_n4vtxxfcb7
bb/incident-review-recovered-funds-and-ownership-ve-thr_q67g8guhi6
security/ci-bootstrap
renovate/configure
No results found.
Labels
Clear labels   
bug

   
documentation

   
duplicate

   
enhancement

   
good first issue

   
help wanted

   
invalid

   
question

   
wontfix
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/cw20-mintable#7
No description provided.