code/cw20-mintable
Watch
4
0
Fork
You've already forked cw20-mintable
 0
Code Issues 10 Pull requests 1 Projects Releases Packages Wiki Activity

Shared CW20 containment, delayed wallet protections and reserved recovery #14

Merged
PlasticDigits merged 13 commits from bb/cw20-security-contracts-controller-wallet-limits-thr_n4vtxxfcb7 into main 2026-10-31 02:31:32 +00:00
Conversation 1 Commits 13 Files changed 47 +11729 -373
PlasticDigits commented 2026-10-31 02:15:23 +00:00
Owner

Shared CosmWasm containment controller plus CW20v0.2.0 wallet policy and reserved recovery. One shared pause is authoritative for every migrated/enrolled token; guarded ordinary economic paths fail closed. Defaults:10% protected opening-balance rolling24h cap; weakening>=old24h delay; opt-in lock unlock>=48h. Exact recovery reserves source funds and requires >=30d, destination acceptance, separate governance authorization/recovery execution/independent dispute. See docs/token-security-v1.md and generated schemas.

Independent controller source approval3333807: #4 (comment) . Independent token source/schema approval2d70d43: #7 (comment) .91 tests pass; strict workspace clippy and reproducible schemas; Rust1.81 build, pinned optimizer, repeat identical hashes and matching cosmwasm-check1.5.11 pass. Exact artifact/inventory/custody receipts: docs/rollout/. Later CI/docs changes do not alter approved token/controller trees. Required Woodpecker checks are real (CI bootstrapPR15 merged), latest exact-head pipeline must pass before merge.

This branch intentionally preserves inherited stale-minter removal prerequisitecc9a3b1/local8a50c36 absent from original Forgejo main2f8438b. Independent token reviewer examined this prerequisite against the actual Forgejo base. Current main CI+research integrated without losing that fix.

No live deployment/migration or fleet coverage is claimed:35 current code10184 instances remain legacy/uncovered. Registered historical governance2-of-3 multisig identity is on-chain verified, but an unlocked authorized quorum/passphrase and independently verified separate-role custody are unavailable. Several governance/minter overlaps need actual separation before migration. Protocol assignments, DEX whitelist/code-pin coordination and live receipts remain open acceptance for issues#4–#7. No automatic closing keywords.

Shared CosmWasm containment controller plus CW20v0.2.0 wallet policy and reserved recovery. One shared pause is authoritative for every migrated/enrolled token; guarded ordinary economic paths fail closed. Defaults:10% protected opening-balance rolling24h cap; weakening>=old24h delay; opt-in lock unlock>=48h. Exact recovery reserves source funds and requires >=30d, destination acceptance, separate governance authorization/recovery execution/independent dispute. See docs/token-security-v1.md and generated schemas. Independent controller source approval3333807: https://git.cl8y.com/code/cw20-mintable/issues/4#issuecomment-65368 . Independent token source/schema approval2d70d43: https://git.cl8y.com/code/cw20-mintable/issues/7#issuecomment-65389 .91 tests pass; strict workspace clippy and reproducible schemas; Rust1.81 build, pinned optimizer, repeat identical hashes and matching cosmwasm-check1.5.11 pass. Exact artifact/inventory/custody receipts: docs/rollout/. Later CI/docs changes do not alter approved token/controller trees. Required Woodpecker checks are real (CI bootstrapPR15 merged), latest exact-head pipeline must pass before merge. This branch intentionally preserves inherited stale-minter removal prerequisitecc9a3b1/local8a50c36 absent from original Forgejo main2f8438b. Independent token reviewer examined this prerequisite against the actual Forgejo base. Current main CI+research integrated without losing that fix. No live deployment/migration or fleet coverage is claimed:35 current code10184 instances remain legacy/uncovered. Registered historical governance2-of-3 multisig identity is on-chain verified, but an unlocked authorized quorum/passphrase and independently verified separate-role custody are unavailable. Several governance/minter overlaps need actual separation before migration. Protocol assignments, DEX whitelist/code-pin coordination and live receipts remain open acceptance for issues#4–#7. No automatic closing keywords.
UpdateMinter(None) (and primary rotation) left a dual-listed primary in
the additional MINTERS map, so revoked self-mint could still authorize.
Port upstream-style delete semantics (INV-MINTER-001).
fix(minter): clear MINTERS on UpdateMinter (INV-MINTER-001)
Add bounded functional CI with strict security workspace and legacy bootstrap gates
Some checks are pending
ci/woodpecker/pr/woodpecker Pipeline is pending
Details
21f468df83
Restrict docs-only CI classification to explicit documentation paths
All checks were successful
ci/woodpecker/pr/woodpecker Pipeline was successful
Details
6dff75fcf6
PlasticDigits changed title from WIP: Shared CW20 containment, delayed wallet protections and reserved recovery to Shared CW20 containment, delayed wallet protections and reserved recovery 2026-10-31 02:27:52 +00:00
PlasticDigits commented 2026-10-31 02:31:28 +00:00
Author
Owner

Coordinator final integration review at exact head 8dc22d98855ba6bc297342cd90046515c99dec75, base b041c17d852cb92035d939eddd617bdec5ab6de2: approved token tree 2d70d43 and controller tree 3333807 remain unchanged; later delta is reviewed CI/docs/provenance/build tooling. Independent token review: issue7 comment65389; independent controller review: issue4 comment65368. Coordinator independently ran 14 focused controller tests (all pass), reviewed final script/docs and verified both local optimized artifact hashes plus Cargo.lock/schema hashes against provenance. Required real CI pipeline8 is successful: https://ci.cl8y.com/repos/26/pipeline/8/1 . Worker actual-Wasm smoke evidence is linked at issue7 comment65426 with explicit host/scope limits. Inherited minter-fix prerequisite is included in source scope. This approves SOURCE INTEGRATION only: no live contract deployment/migration, no unlocked governance quorum, no verified separate role custody, no completed DEX pin/assignment transition; coverage remains0/35. Issues4–7 and epic3 remain open; draft artifact candidate is not a production release.

Coordinator final integration review at exact head `8dc22d98855ba6bc297342cd90046515c99dec75`, base `b041c17d852cb92035d939eddd617bdec5ab6de2`: approved token tree `2d70d43` and controller tree `3333807` remain unchanged; later delta is reviewed CI/docs/provenance/build tooling. Independent token review: issue7 comment65389; independent controller review: issue4 comment65368. Coordinator independently ran 14 focused controller tests (all pass), reviewed final script/docs and verified both local optimized artifact hashes plus Cargo.lock/schema hashes against provenance. Required real CI pipeline8 is successful: https://ci.cl8y.com/repos/26/pipeline/8/1 . Worker actual-Wasm smoke evidence is linked at issue7 comment65426 with explicit host/scope limits. Inherited minter-fix prerequisite is included in source scope. This approves SOURCE INTEGRATION only: no live contract deployment/migration, no unlocked governance quorum, no verified separate role custody, no completed DEX pin/assignment transition; coverage remains0/35. Issues4–7 and epic3 remain open; draft artifact candidate is not a production release.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug

   
documentation

   
duplicate

   
enhancement

   
good first issue

   
help wanted

   
invalid

   
question

   
wontfix
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/cw20-mintable!14
No description provided.