code/ust1-window
Watch
4
0
Fork
You've already forked ust1-window
 0
Code Issues 2 Pull requests 2 Projects Releases Packages Wiki Activity

feat: Phase 2 — mainnet UST1↔vFDUSD oracle window deploy #19

New issue
Closed
opened 2026-07-29 02:07:40 +00:00 by PlasticDigits · 29 comments
PlasticDigits commented 2026-07-29 02:07:40 +00:00 (Migrated from gitlab.com)

Summary

Deploy and wire the always-on, oracle-priced UST1 ↔ vFDUSD mint/redeem window on Terra Classic mainnet (columbus-5), including tokens, CL8Y bridge registration for vFDUSD, ust1-oracle + ust1-window, treasury allowance, and the off-chain oracle service.

Phase 0 decisions (approved):

  • Window = primary always-on oracle mint/redeem (not time-boxed; no calendar close). Pause / oracle-staleness only.
  • DEX AMM is secondary (tracked in cl8y-dex Phase 4) — not a replacement for this window.
  • Skip cmm-native-wrap in this repo; native wrap uses ustr-cmm treasury + wrap-mapper (Phase 3).
  • UI lives at https://dex.cl8y.com/ust1 (Phase 4).
  • Phase 1 prerequisites confirmed (bridge admin, treasury migrate/admin path, keys, RPCs).

Approved parameters (governance-updatable after deploy):

Param Value Base units (6 decimals)
Window fee_bps 100 (1%, DEFAULT_FEE_BPS) —
per_tx_ust1_limit 1,000 UST1 "1000000000"
rolling_24h_ust1_limit 10,000 UST1 "10000000000"

Current codebase

Mature CosmWasm monorepo (v0.1.0 / oracle 0.1.1) with contracts, oracle service, LocalTerra, and operator runbook — not yet deployed to mainnet (address registry blank except hardcoded CMM treasury).

Component Path Role
Shared math / oracle policy / fee split smartcontracts-terraclassic/packages/ust1-common/ RATE_SCALE, DEFAULT_FEE_BPS=100, INV-ORACLE-, INV-MATH-, INV-SWAP-*
CMM treasury constant smartcontracts-terraclassic/packages/ust1-cmm/ CMM_TREASURY_MAINNET = terra16j5u6ey7a84g40sr3gd94nzg5w5fm45046k9s2347qhfpwm5fr6sem3lr2
ust1-oracle smartcontracts-terraclassic/contracts/ust1-oracle/ Operator UpdateRate; 4h throttle, +2%/UTC day, monotonic non-decreasing
ust1-window smartcontracts-terraclassic/contracts/ust1-window/ CW20 receive: vFDUSD→mint UST1 + forward to treasury; UST1→burn + TransferFrom vFDUSD
Oracle service oracle-service/ Polls BSC Venus exchangeRateStored, multi-RPC consensus, broadcasts UpdateRate
Deploy runbook docs/DEPLOYMENT.md Full mainnet checklist (tokens → bridge → stack → oracle host)
Integration tests smartcontracts-terraclassic/tests/src/integration_tests.rs Deposit/withdraw, fees, oracle throttle, EffectiveSwap
Optional native wrap smartcontracts-terraclassic/contracts/cmm-native-wrap/ Out of scope for this launch (self-custody; superseded by ustr-cmm wrap-mapper)

No frontend in this repo. Integrators use CW20 Send + {"effective_swap":{}}.

Why this is needed

dex.cl8y.com is live (CW20 soft launch) but has no UST1 mint/redeem venue. UST1 must be issued/redeemed against bridged Venus vFDUSD at an oracle rate that tracks BSC Venus exchange rate, with inventory held in the CMM treasury — not via an AMM pool. Without Phase 2, Phase 4 UI and secondary DEX pairs have no economic base asset.

Constraints / guardrails

  1. Do not deploy cmm-native-wrap for LUNC/USTC; that is Phase 3 (ustr-cmm).
  2. Do not reintroduce or depend on the historical USTC→USTR swap window.
  3. Window must remain always-on (no start/end timestamps). Only governance pause or oracle-staleness may block swaps.
  4. Oracle rate policy must stay aligned on-chain and in oracle-service (INV-ORACLE-THROTTLE/DAILY/MONO).
  5. vFDUSD Terra/BSC decimals must match bridge registration or amounts brick.
  6. vFDUSD CW20 minter = CL8Y Terra bridge; UST1 minter path = governance then add_minter(ust1-window).
  7. Instantiation limits must use approved caps: per_tx_ust1_limit="1000000000", rolling_24h_ust1_limit="10000000000", fee_bps=100 (not the older DEPLOYMENT.md example of 500 / 2,500).
  8. Update docs/DEPLOYMENT.md example instantiate JSON + fill the address registry after deploy.
  9. Never commit mnemonics / private keys; oracle operator mnemonic only in host secrets.
  10. Treasury vFDUSD increase_allowance for the window is required before withdraws work.

Relevant files

  • docs/DEPLOYMENT.md
  • README.md
  • Makefile / scripts/optimize.sh / scripts/verify_oracle_operator_env.sh
  • smartcontracts-terraclassic/contracts/ust1-oracle/**
  • smartcontracts-terraclassic/contracts/ust1-window/**
  • smartcontracts-terraclassic/packages/ust1-common/**
  • smartcontracts-terraclassic/packages/ust1-cmm/**
  • oracle-service/src/** (esp. config.rs, bsc.rs, evm_rpc.rs, terra_tx.rs)
  • smartcontracts-terraclassic/tests/src/integration_tests.rs
  • External: CL8Y bridge docs/deployment-guide.md §5–6; cw20-mintable code ID 10184 on columbus-5

Recommended direction

  1. make build-optimized → store ust1_oracle.wasm + ust1_window.wasm.
  2. Instantiate vFDUSD (bridge minter) + UST1 (governance minter) via cw20-mintable 10184.
  3. Complete CL8Y bridge symmetric registration for vFDUSD (BSC ↔ Terra).
  4. Instantiate oracle + window with approved fee/limits; cmm_treasury: null (default mainnet treasury) unless ops specify otherwise.
  5. Post-deploy wiring: UST1 add_minter(window) → treasury increase_allowance(vFDUSD, window) → first UpdateRate → start oracle-service (make verify-oracle-env first).
  6. Record all addresses/code IDs in DEPLOYMENT.md registry; hand governance to multisig per ops policy.
  7. Smoke on mainnet with small amounts; hand addresses to Phase 4 / Phase 5.

Acceptance criteria

  • Optimized wasm built and stored; code IDs recorded.
  • Mainnet vFDUSD and UST1 CW20 addresses live; decimals = 6; minters correct.
  • CL8Y bridge can mint vFDUSD on Terra for a verified BSC→Terra transfer (or documented equivalent smoke).
  • ust1-oracle + ust1-window instantiated with fee_bps=100, per-tx 1000, 24h 10000 UST1.
  • Window points at CMM treasury terra16j5u6… (or explicitly documented override).
  • Window is UST1 minter; treasury has sufficient vFDUSD allowance for window.
  • First rate committed; EffectiveSwap query returns non-stale oracle state.
  • Oracle service running in prod with ≥2 BSC RPCs; verify_oracle_operator_env passes against prod env.
  • Deposit vFDUSD→UST1 and withdraw UST1→vFDUSD succeed within limits.
  • Over per-tx / rolling-24h limits reject as designed.
  • docs/DEPLOYMENT.md address registry filled; example instantiate JSON updated to approved limits.
  • No cmm-native-wrap deployed as part of this issue.

Test plan (happy / functional paths)

  1. Unit / multitest (CI): make test-contracts — oracle policy, window deposit/withdraw, fee split, pause, limits.
  2. LocalTerra dry-run: deploy stack with approved limits; deposit/withdraw round-trip; EffectiveSwap parity.
  3. Bridge path: register vFDUSD; bridge small amount BSC→Terra; confirm Terra CW20 balance.
  4. Mainnet smoke (small):
    • Deposit under per-tx limit → UST1 minted; vFDUSD lands in treasury.
    • Withdraw under limit → UST1 burned; vFDUSD returned (net of fee).
    • Query rolling volume after txs.
  5. Oracle service: force/wait poll; confirm UpdateRate when rate differs and policy allows; silence alert config present.
  6. Governance path (testnet or controlled): SetFee / limit updates / pause ↔ unpause.

Test plan (attack / hack / abuse vectors)

Vector Expected
Stale oracle (last_update older than max_oracle_age_sec) Swaps fail OracleStale
Non-operator UpdateRate Rejected
Rate decrease / >2% daily jump / update inside 4h throttle Rejected by policy (on-chain + service)
Exceed per-tx or rolling 24h UST1 limit Rejected
Withdraw with zero/insufficient treasury vFDUSD or allowance InsufficientVfdusd / InsufficientTreasuryAllowance
Pause window or oracle (governance) Swaps blocked; unauthorized pause rejected
Spoofed CW20 / wrong token send to window Rejected (token allowlist / receive hook)
Compromised single BSC RPC feeding bad rate Multi-RPC consensus (≥2, agreement threshold) prevents update
Reentrancy / double-mint via crafted receive Covered by existing integration + multitest; no second mint without deposit
Governance takeover without timelock/multisig process Ops: deployer → multisig handoff documented; no single-EOA residual admin if policy forbids

Verification criteria

  • Address registry complete in docs/DEPLOYMENT.md.
  • On-chain queries: oracle state, window effective_swap match expected fee/limits/rate freshness.
  • End-to-end deposit + withdraw tx hashes recorded (mainnet smoke).
  • Oracle service health: successful poll/broadcast within first policy window; silence alert wired.
  • Phase 4 unblocked with published token + contract addresses.
  • Cross-link this issue from Phase 3 / 4 / 5 issues once opened.

Related

  • Phase 3: ustr-cmm treasury migrate + wrap-mapper (cLUNC / cUSTC)
  • Phase 4: cl8y-dex /ust1 UI + wrap wiring + secondary AMM pairs
  • Phase 5: ops hardening (oracle liveness, treasury inventory, registries)
## Summary Deploy and wire the always-on, oracle-priced **UST1 ↔ vFDUSD** mint/redeem window on Terra Classic mainnet (`columbus-5`), including tokens, CL8Y bridge registration for vFDUSD, `ust1-oracle` + `ust1-window`, treasury allowance, and the off-chain oracle service. **Phase 0 decisions (approved):** - Window = primary always-on oracle mint/redeem (not time-boxed; no calendar close). Pause / oracle-staleness only. - DEX AMM is secondary (tracked in cl8y-dex Phase 4) — not a replacement for this window. - Skip `cmm-native-wrap` in this repo; native wrap uses **ustr-cmm treasury + wrap-mapper** (Phase 3). - UI lives at `https://dex.cl8y.com/ust1` (Phase 4). - **Phase 1 prerequisites confirmed** (bridge admin, treasury migrate/admin path, keys, RPCs). **Approved parameters (governance-updatable after deploy):** | Param | Value | Base units (6 decimals) | |-------|-------|-------------------------| | Window `fee_bps` | **100** (1%, `DEFAULT_FEE_BPS`) | — | | `per_tx_ust1_limit` | **1,000 UST1** | `"1000000000"` | | `rolling_24h_ust1_limit` | **10,000 UST1** | `"10000000000"` | --- ## Current codebase Mature CosmWasm monorepo (`v0.1.0` / oracle `0.1.1`) with contracts, oracle service, LocalTerra, and operator runbook — **not yet deployed to mainnet** (address registry blank except hardcoded CMM treasury). | Component | Path | Role | |-----------|------|------| | Shared math / oracle policy / fee split | `smartcontracts-terraclassic/packages/ust1-common/` | `RATE_SCALE`, `DEFAULT_FEE_BPS=100`, INV-ORACLE-*, INV-MATH-*, INV-SWAP-* | | CMM treasury constant | `smartcontracts-terraclassic/packages/ust1-cmm/` | `CMM_TREASURY_MAINNET` = `terra16j5u6ey7a84g40sr3gd94nzg5w5fm45046k9s2347qhfpwm5fr6sem3lr2` | | `ust1-oracle` | `smartcontracts-terraclassic/contracts/ust1-oracle/` | Operator `UpdateRate`; 4h throttle, +2%/UTC day, monotonic non-decreasing | | `ust1-window` | `smartcontracts-terraclassic/contracts/ust1-window/` | CW20 receive: vFDUSD→mint UST1 + forward to treasury; UST1→burn + `TransferFrom` vFDUSD | | Oracle service | `oracle-service/` | Polls BSC Venus `exchangeRateStored`, multi-RPC consensus, broadcasts `UpdateRate` | | Deploy runbook | `docs/DEPLOYMENT.md` | Full mainnet checklist (tokens → bridge → stack → oracle host) | | Integration tests | `smartcontracts-terraclassic/tests/src/integration_tests.rs` | Deposit/withdraw, fees, oracle throttle, `EffectiveSwap` | | Optional native wrap | `smartcontracts-terraclassic/contracts/cmm-native-wrap/` | **Out of scope** for this launch (self-custody; superseded by ustr-cmm wrap-mapper) | **No frontend** in this repo. Integrators use CW20 `Send` + `{"effective_swap":{}}`. --- ## Why this is needed `dex.cl8y.com` is live (CW20 soft launch) but has no UST1 mint/redeem venue. UST1 must be issued/redeemed against bridged Venus **vFDUSD** at an oracle rate that tracks BSC Venus exchange rate, with inventory held in the CMM treasury — not via an AMM pool. Without Phase 2, Phase 4 UI and secondary DEX pairs have no economic base asset. --- ## Constraints / guardrails 1. **Do not deploy `cmm-native-wrap`** for LUNC/USTC; that is Phase 3 (`ustr-cmm`). 2. **Do not** reintroduce or depend on the historical USTC→USTR swap window. 3. Window must remain **always-on** (no start/end timestamps). Only governance pause or oracle-staleness may block swaps. 4. Oracle rate policy must stay aligned on-chain and in `oracle-service` (INV-ORACLE-THROTTLE/DAILY/MONO). 5. vFDUSD Terra/BSC **decimals must match** bridge registration or amounts brick. 6. vFDUSD CW20 minter = **CL8Y Terra bridge**; UST1 minter path = governance then **`add_minter(ust1-window)`**. 7. Instantiation limits must use approved caps: `per_tx_ust1_limit="1000000000"`, `rolling_24h_ust1_limit="10000000000"`, `fee_bps=100` (not the older DEPLOYMENT.md example of 500 / 2,500). 8. Update `docs/DEPLOYMENT.md` example instantiate JSON + fill the address registry after deploy. 9. Never commit mnemonics / private keys; oracle operator mnemonic only in host secrets. 10. Treasury vFDUSD `increase_allowance` for the window is required before withdraws work. --- ## Relevant files - `docs/DEPLOYMENT.md` - `README.md` - `Makefile` / `scripts/optimize.sh` / `scripts/verify_oracle_operator_env.sh` - `smartcontracts-terraclassic/contracts/ust1-oracle/**` - `smartcontracts-terraclassic/contracts/ust1-window/**` - `smartcontracts-terraclassic/packages/ust1-common/**` - `smartcontracts-terraclassic/packages/ust1-cmm/**` - `oracle-service/src/**` (esp. `config.rs`, `bsc.rs`, `evm_rpc.rs`, `terra_tx.rs`) - `smartcontracts-terraclassic/tests/src/integration_tests.rs` - External: CL8Y bridge `docs/deployment-guide.md` §5–6; cw20-mintable code ID **10184** on columbus-5 --- ## Recommended direction 1. `make build-optimized` → store `ust1_oracle.wasm` + `ust1_window.wasm`. 2. Instantiate **vFDUSD** (bridge minter) + **UST1** (governance minter) via cw20-mintable **10184**. 3. Complete CL8Y bridge symmetric registration for vFDUSD (BSC ↔ Terra). 4. Instantiate oracle + window with approved fee/limits; `cmm_treasury: null` (default mainnet treasury) unless ops specify otherwise. 5. Post-deploy wiring: UST1 `add_minter(window)` → treasury `increase_allowance(vFDUSD, window)` → first `UpdateRate` → start oracle-service (`make verify-oracle-env` first). 6. Record all addresses/code IDs in `DEPLOYMENT.md` registry; hand governance to multisig per ops policy. 7. Smoke on mainnet with small amounts; hand addresses to Phase 4 / Phase 5. --- ## Acceptance criteria - [ ] Optimized wasm built and stored; code IDs recorded. - [ ] Mainnet **vFDUSD** and **UST1** CW20 addresses live; decimals = 6; minters correct. - [ ] CL8Y bridge can mint vFDUSD on Terra for a verified BSC→Terra transfer (or documented equivalent smoke). - [ ] `ust1-oracle` + `ust1-window` instantiated with `fee_bps=100`, per-tx **1000**, 24h **10000** UST1. - [ ] Window points at CMM treasury `terra16j5u6…` (or explicitly documented override). - [ ] Window is UST1 minter; treasury has sufficient vFDUSD allowance for window. - [ ] First rate committed; `EffectiveSwap` query returns non-stale oracle state. - [ ] Oracle service running in prod with ≥2 BSC RPCs; `verify_oracle_operator_env` passes against prod env. - [ ] Deposit vFDUSD→UST1 and withdraw UST1→vFDUSD succeed within limits. - [ ] Over per-tx / rolling-24h limits reject as designed. - [ ] `docs/DEPLOYMENT.md` address registry filled; example instantiate JSON updated to approved limits. - [ ] No `cmm-native-wrap` deployed as part of this issue. --- ## Test plan (happy / functional paths) 1. **Unit / multitest (CI):** `make test-contracts` — oracle policy, window deposit/withdraw, fee split, pause, limits. 2. **LocalTerra dry-run:** deploy stack with approved limits; deposit/withdraw round-trip; `EffectiveSwap` parity. 3. **Bridge path:** register vFDUSD; bridge small amount BSC→Terra; confirm Terra CW20 balance. 4. **Mainnet smoke (small):** - Deposit under per-tx limit → UST1 minted; vFDUSD lands in treasury. - Withdraw under limit → UST1 burned; vFDUSD returned (net of fee). - Query rolling volume after txs. 5. **Oracle service:** force/wait poll; confirm `UpdateRate` when rate differs and policy allows; silence alert config present. 6. **Governance path (testnet or controlled):** `SetFee` / limit updates / pause ↔ unpause. --- ## Test plan (attack / hack / abuse vectors) | Vector | Expected | |--------|----------| | Stale oracle (`last_update` older than `max_oracle_age_sec`) | Swaps fail `OracleStale` | | Non-operator `UpdateRate` | Rejected | | Rate decrease / >2% daily jump / update inside 4h throttle | Rejected by policy (on-chain + service) | | Exceed per-tx or rolling 24h UST1 limit | Rejected | | Withdraw with zero/insufficient treasury vFDUSD or allowance | `InsufficientVfdusd` / `InsufficientTreasuryAllowance` | | Pause window or oracle (governance) | Swaps blocked; unauthorized pause rejected | | Spoofed CW20 / wrong token send to window | Rejected (token allowlist / receive hook) | | Compromised single BSC RPC feeding bad rate | Multi-RPC consensus (≥2, agreement threshold) prevents update | | Reentrancy / double-mint via crafted receive | Covered by existing integration + multitest; no second mint without deposit | | Governance takeover without timelock/multisig process | Ops: deployer → multisig handoff documented; no single-EOA residual admin if policy forbids | --- ## Verification criteria - [ ] Address registry complete in `docs/DEPLOYMENT.md`. - [ ] On-chain queries: oracle `state`, window `effective_swap` match expected fee/limits/rate freshness. - [ ] End-to-end deposit + withdraw tx hashes recorded (mainnet smoke). - [ ] Oracle service health: successful poll/broadcast within first policy window; silence alert wired. - [ ] Phase 4 unblocked with published token + contract addresses. - [ ] Cross-link this issue from Phase 3 / 4 / 5 issues once opened. ### Related - Phase 3: ustr-cmm treasury migrate + wrap-mapper (cLUNC / cUSTC) - Phase 4: cl8y-dex `/ust1` UI + wrap wiring + secondary AMM pairs - Phase 5: ops hardening (oracle liveness, treasury inventory, registries)
PlasticDigits commented 2026-07-29 02:07:58 +00:00 (Migrated from gitlab.com)

Cross-repo tracking (Phase 0 approved)

Phase Repo Issue
2 — UST1↔vFDUSD window deploy ust1-window https://gitlab.com/PlasticDigits/ust1-window/-/work_items/19
3 — Treasury migrate + wrap-mapper ustr-cmm https://gitlab.com/PlasticDigits2/ustr-cmm/-/work_items/5
4 — /ust1 UI + wraps + secondary AMM cl8y-dex-terraclassic https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/502
5 — Ops hardening cl8y-dex-terraclassic https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/503

Approved params: window fee_bps=100, per-tx 1000 UST1, 24h 10000 UST1; wrap fee_bps=100 (1%). UI at dex.cl8y.com/ust1. Skip cmm-native-wrap. Phase 1 prerequisites confirmed.

## Cross-repo tracking (Phase 0 approved) | Phase | Repo | Issue | |-------|------|-------| | 2 — UST1↔vFDUSD window deploy | ust1-window | https://gitlab.com/PlasticDigits/ust1-window/-/work_items/19 | | 3 — Treasury migrate + wrap-mapper | ustr-cmm | https://gitlab.com/PlasticDigits2/ustr-cmm/-/work_items/5 | | 4 — `/ust1` UI + wraps + secondary AMM | cl8y-dex-terraclassic | https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/502 | | 5 — Ops hardening | cl8y-dex-terraclassic | https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-/work_items/503 | **Approved params:** window `fee_bps=100`, per-tx **1000** UST1, 24h **10000** UST1; wrap `fee_bps=100` (1%). UI at `dex.cl8y.com/ust1`. Skip `cmm-native-wrap`. Phase 1 prerequisites confirmed.
PlasticDigits commented 2026-07-29 02:08:00 +00:00 (Migrated from gitlab.com)

mentioned in issue PlasticDigits2/ustr-cmm#5

mentioned in issue PlasticDigits2/ustr-cmm#5
PlasticDigits commented 2026-07-29 02:08:03 +00:00 (Migrated from gitlab.com)

mentioned in issue cl8y-dex-terraclassic#502

mentioned in issue cl8y-dex-terraclassic#502
PlasticDigits commented 2026-07-29 02:08:05 +00:00 (Migrated from gitlab.com)

mentioned in issue cl8y-dex-terraclassic#503

mentioned in issue cl8y-dex-terraclassic#503
PlasticDigits commented 2026-07-29 05:21:28 +00:00 (Migrated from gitlab.com)

changed the description

changed the description
PlasticDigits commented 2026-07-29 05:21:29 +00:00 (Migrated from gitlab.com)

Naming update

Wrapped token symbols are cLUNC and cUSTC (not LUNC-C / USTC-C).

LocalTerra / existing DEX code may still say LUNC-C/USTC-C — Phase 3–4 implementation must mint and display cLUNC / cUSTC on mainnet and align frontend registry/env naming.

## Naming update Wrapped token symbols are **cLUNC** and **cUSTC** (not `LUNC-C` / `USTC-C`). LocalTerra / existing DEX code may still say `LUNC-C`/`USTC-C` — Phase 3–4 implementation must mint and display **cLUNC** / **cUSTC** on mainnet and align frontend registry/env naming.
PlasticDigits commented 2026-07-30 00:20:30 +00:00 (Migrated from gitlab.com)

DEPLOYMENT.md refresh (2026-07-30)

2074b93 substantially rewrote docs/DEPLOYMENT.md into the full mainnet operator runbook (terrad gas/fees, cw20-mintable + CL8Y vFDUSD wiring, UST1 stack, Render oracle host, address registry template).

Still open vs this issue’s AC / guardrail #7: the window instantiate example still uses LocalTerra/test limits, not the approved Phase 2 caps:

Param Approved (#19) Current DEPLOYMENT.md example
fee_bps 100 100 ✅
per_tx_ust1_limit "1000000000" (1,000 UST1) "500000000" (500) ❌
rolling_24h_ust1_limit "10000000000" (10,000 UST1) "2500000000" (2,500) ❌

Address registry remains a blank template (expected until mainnet deploy). Suggest a follow-up doc patch to swap the instantiate JSON to the approved limits before ops copy-paste for columbus-5.

## DEPLOYMENT.md refresh (2026-07-30) [`2074b93`](https://gitlab.com/PlasticDigits/ust1-window/-/commit/2074b93fd2dd1fddaff801f48022c6b4ad0909a3) substantially rewrote [`docs/DEPLOYMENT.md`](https://gitlab.com/PlasticDigits/ust1-window/-/blob/main/docs/DEPLOYMENT.md) into the full mainnet operator runbook (terrad gas/fees, cw20-mintable + CL8Y vFDUSD wiring, UST1 stack, Render oracle host, address registry template). **Still open vs this issue’s AC / guardrail #7:** the window instantiate example still uses LocalTerra/test limits, not the approved Phase 2 caps: | Param | Approved (#19) | Current `DEPLOYMENT.md` example | |-------|----------------|----------------------------------| | `fee_bps` | `100` | `100` ✅ | | `per_tx_ust1_limit` | `"1000000000"` (1,000 UST1) | `"500000000"` (500) ❌ | | `rolling_24h_ust1_limit` | `"10000000000"` (10,000 UST1) | `"2500000000"` (2,500) ❌ | Address registry remains a blank template (expected until mainnet deploy). Suggest a follow-up doc patch to swap the instantiate JSON to the approved limits before ops copy-paste for columbus-5.
PlasticDigits commented 2026-07-30 00:22:37 +00:00 (Migrated from gitlab.com)

mentioned in commit 4c94ba1b4d

mentioned in commit 4c94ba1b4dcf64b8561fb2c80bbf5954178ffdf0
PlasticDigits commented 2026-07-30 00:23:01 +00:00 (Migrated from gitlab.com)

Follow-up: window limit defaults aligned (#19)

Pushed 4c94ba1 to update approved Phase 2 caps everywhere operators / tests would copy them:

Param Before After
fee_bps 100 100 (unchanged)
per_tx_ust1_limit "500000000" (500 UST1) "1000000000" (1,000 UST1)
rolling_24h_ust1_limit "2500000000" (2,500 UST1) "10000000000" (10,000 UST1)

Changes:

  • docs/DEPLOYMENT.md — instantiate example + changelog note for these caps
  • ust1-common — DEFAULT_PER_TX_UST1_LIMIT / DEFAULT_ROLLING_24H_UST1_LIMIT (alongside DEFAULT_FEE_BPS)
  • Window multitest + integration happy-path fixtures now use those constants

On-chain: no wasm / migrate required. Limits are instantiate args; after deploy they remain governance-updatable via SetLimits. Mainnet registry still blank — use the new values at instantiate.

## Follow-up: window limit defaults aligned (#19) Pushed [`4c94ba1`](https://gitlab.com/PlasticDigits/ust1-window/-/commit/4c94ba1) to update approved Phase 2 caps everywhere operators / tests would copy them: | Param | Before | After | |-------|--------|-------| | `fee_bps` | `100` | `100` (unchanged) | | `per_tx_ust1_limit` | `"500000000"` (500 UST1) | `"1000000000"` (1,000 UST1) | | `rolling_24h_ust1_limit` | `"2500000000"` (2,500 UST1) | `"10000000000"` (10,000 UST1) | **Changes:** - `docs/DEPLOYMENT.md` — instantiate example + changelog note for these caps - `ust1-common` — `DEFAULT_PER_TX_UST1_LIMIT` / `DEFAULT_ROLLING_24H_UST1_LIMIT` (alongside `DEFAULT_FEE_BPS`) - Window multitest + integration happy-path fixtures now use those constants **On-chain:** no wasm / migrate required. Limits are instantiate args; after deploy they remain governance-updatable via `SetLimits`. Mainnet registry still blank — use the new values at instantiate.
PlasticDigits commented 2026-07-30 03:16:58 +00:00 (Migrated from gitlab.com)

Progress check — Phase 2 tokens live (2026-07-30)

Done (verified on-chain)

Mainnet CW20s (cw20-mintable code id 10184):

Token Address Decimals Minter Instantiate tx
vFDUSD terra1mnl9azefrqpmu888ar2u6zrcwr80hxlt3avf4300r576cw5ar7esvxsvj3 6 CL8Y Terra bridge terra18m02l… 48D01D2D…1F02
UST1 terra1f0eqgy9w7e5e7up97vjudqwx38tesf8ylx75x2lv3nwm0clry0pqmgfy72 6 Governance terra1xsecn… 2A5970A8…3EAF

Also completed in-repo:

  • make build-optimized produces artifacts/ust1_oracle.wasm + ust1_window.wasm (+ cmm_native_wrap.wasm built but not deployed — out of scope).
  • docs/DEPLOYMENT.md window instantiate example uses approved limits (fee_bps=100, per-tx 1000 / 24h 10000 UST1).
  • Operator exports, LockUnlock bridge runbook, keyring=file documented.
  • README + address registry updated with live CW20 addresses.

Acceptance criteria status

AC Status Evidence / notes
Optimized wasm built and stored; code IDs recorded Partial Wasm built locally + checksums; not yet wasm store’d — no on-chain code IDs
Mainnet vFDUSD + UST1 live; decimals 6; minters correct Done Queried token_info + minter on both contracts
CL8Y bridge mint path BSC→Terra (or smoke) Open BSC tokenRegistered(vFDUSD)=false; Terra bridge has no token config for Terra vFDUSD yet → Phase 3
ust1-oracle + ust1-window instantiated (fee/limits) Open Not deployed
Window → CMM treasury terra16j5u6… Open Needs window instantiate
Window is UST1 minter; treasury vFDUSD allowance Open Needs Phase 5 wiring after window exists
First rate + non-stale EffectiveSwap Open
Oracle service prod (≥2 BSC RPCs); verify_oracle_operator_env Open
Deposit + withdraw smoke within limits Open
Over-limit rejects on mainnet Open Covered in multitest; mainnet smoke TBD
DEPLOYMENT.md registry filled; instantiate JSON = approved limits Partial Limits ✅; CW20s filled; oracle/window/code IDs still blank
No cmm-native-wrap deployed for this issue Done Wasm only; not stored/instantiated on mainnet

Remaining to close #19

  1. Phase 3 — BSC LockUnlock register + Terra add_token / destination / incoming mappings; minimal bridge smoke.
  2. Phase 4 — wasm store + instantiate ust1-oracle / ust1-window with approved fee/limits; record code IDs + addresses.
  3. Phase 5 — UST1 add_minter(window) → treasury increase_allowance → first UpdateRate → start oracle-service.
  4. Mainnet deposit/withdraw (+ over-limit) smoke; finish registry; unblock Phase 4 UI with published addresses.

Docs: README.md mainnet table + docs/DEPLOYMENT.md registry (local working tree; commit/push when ready).

## Progress check — Phase 2 tokens live (2026-07-30) ### Done (verified on-chain) **Mainnet CW20s** (cw20-mintable code id **10184**): | Token | Address | Decimals | Minter | Instantiate tx | |-------|---------|----------|--------|----------------| | vFDUSD | `terra1mnl9azefrqpmu888ar2u6zrcwr80hxlt3avf4300r576cw5ar7esvxsvj3` | 6 | CL8Y Terra bridge `terra18m02l…` | [`48D01D2D…1F02`](https://finder.terra.money/classic/tx/48D01D2DBEDFC46603B37C7F62FE9207CDB0683277E7E0778D94AF4091C51F02) | | UST1 | `terra1f0eqgy9w7e5e7up97vjudqwx38tesf8ylx75x2lv3nwm0clry0pqmgfy72` | 6 | Governance `terra1xsecn…` | [`2A5970A8…3EAF`](https://finder.terra.money/classic/tx/2A5970A8F1F74FF5970F2241B77A07BB1148B2C2BFD4FCB9290D776568E63EAF) | Also completed in-repo: - `make build-optimized` produces `artifacts/ust1_oracle.wasm` + `ust1_window.wasm` (+ `cmm_native_wrap.wasm` built but **not** deployed — out of scope). - `docs/DEPLOYMENT.md` window instantiate example uses approved limits (`fee_bps=100`, per-tx **1000** / 24h **10000** UST1). - Operator exports, LockUnlock bridge runbook, keyring=`file` documented. - README + address registry updated with live CW20 addresses. ### Acceptance criteria status | AC | Status | Evidence / notes | |----|--------|------------------| | Optimized wasm built and stored; code IDs recorded | **Partial** | Wasm built locally + checksums; **not yet** `wasm store`’d — no on-chain code IDs | | Mainnet vFDUSD + UST1 live; decimals 6; minters correct | **Done** | Queried `token_info` + `minter` on both contracts | | CL8Y bridge mint path BSC→Terra (or smoke) | **Open** | BSC `tokenRegistered(vFDUSD)=false`; Terra bridge has no `token` config for Terra vFDUSD yet → Phase 3 | | `ust1-oracle` + `ust1-window` instantiated (fee/limits) | **Open** | Not deployed | | Window → CMM treasury `terra16j5u6…` | **Open** | Needs window instantiate | | Window is UST1 minter; treasury vFDUSD allowance | **Open** | Needs Phase 5 wiring after window exists | | First rate + non-stale `EffectiveSwap` | **Open** | | | Oracle service prod (≥2 BSC RPCs); `verify_oracle_operator_env` | **Open** | | | Deposit + withdraw smoke within limits | **Open** | | | Over-limit rejects on mainnet | **Open** | Covered in multitest; mainnet smoke TBD | | `DEPLOYMENT.md` registry filled; instantiate JSON = approved limits | **Partial** | Limits ✅; CW20s filled; oracle/window/code IDs still blank | | No `cmm-native-wrap` deployed for this issue | **Done** | Wasm only; not stored/instantiated on mainnet | ### Remaining to close #19 1. **Phase 3** — BSC LockUnlock register + Terra `add_token` / destination / incoming mappings; minimal bridge smoke. 2. **Phase 4** — `wasm store` + instantiate `ust1-oracle` / `ust1-window` with approved fee/limits; record code IDs + addresses. 3. **Phase 5** — UST1 `add_minter(window)` → treasury `increase_allowance` → first `UpdateRate` → start oracle-service. 4. Mainnet deposit/withdraw (+ over-limit) smoke; finish registry; unblock Phase 4 UI with published addresses. Docs: `README.md` mainnet table + `docs/DEPLOYMENT.md` registry (local working tree; commit/push when ready).
PlasticDigits commented 2026-07-30 03:23:47 +00:00 (Migrated from gitlab.com)

mentioned in issue cl8y-bridge-monorepo#133

mentioned in issue cl8y-bridge-monorepo#133
PlasticDigits commented 2026-07-30 03:24:31 +00:00 (Migrated from gitlab.com)

mentioned in commit 10da35e163

mentioned in commit 10da35e1639ba2353186830c25041d7980454a90
PlasticDigits commented 2026-07-30 04:53:22 +00:00 (Migrated from gitlab.com)

AC status update (2026-07-30) — after bridge Phase 3 + logo MR

Related: cl8y-bridge-monorepo#133 merged

cl8y-bridge-monorepo#133 closed; MR !45 on main:

  • packages/frontend/public/tokens/VFDUSD.png
  • 'VFDUSD' in LOGO_SYMBOLS (tokenLogos.ts)

(UI logo is not a formal #19 AC, but unblocks bridge listing UX for the registered token.)

Re-verified on-chain (this check)

Check Result
Terra vFDUSD token_info decimals 6, symbol vFDUSD
Terra UST1 token_info decimals 6, symbol UST1
BSC tokenRegistered(Venus vFDUSD) true
Terra bridge token for Terra vFDUSD enabled, mint_burn, terra_decimals 6
Local optimized wasm artifacts/ust1_oracle.wasm + ust1_window.wasm present

Acceptance criteria (#19)

AC Status Notes
Optimized wasm built and stored; code IDs recorded Partial Built locally; not stored on-chain yet
Mainnet vFDUSD + UST1 live; decimals 6; minters correct Done
CL8Y bridge BSC→Terra path (or smoke) Partial → mostly done Symmetric registration complete (BSC LockUnlock + Terra mint_burn + mappings). Optional: record a minimal lock/mint smoke tx hash to fully close this AC
ust1-oracle + ust1-window instantiated (fee/limits) Open Next: Phase 4 store + instantiate
Window → CMM treasury Open
Window is UST1 minter; treasury allowance Open
First rate + non-stale EffectiveSwap Open
Oracle service prod + verify_oracle_operator_env Open
Deposit + withdraw smoke Open Needs window + bridged inventory
Over-limit rejects (mainnet) Open
DEPLOYMENT.md registry + approved instantiate limits Partial Limits ✅; CW20s + bridge filled; oracle/window code IDs blank
No cmm-native-wrap deployed Done

Next to advance #19

  1. Phase 4 — wasm store / instantiate oracle + window (approved fee/limits).
  2. Phase 5 — add_minter → treasury allowance → first UpdateRate → oracle-service.
  3. Optional — small BSC→Terra vFDUSD bridge smoke; then deposit/withdraw smoke.
## AC status update (2026-07-30) — after bridge Phase 3 + logo MR ### Related: cl8y-bridge-monorepo#133 merged [cl8y-bridge-monorepo#133](https://gitlab.com/PlasticDigits/cl8y-bridge-monorepo/-/work_items/133) closed; [MR !45](https://gitlab.com/PlasticDigits/cl8y-bridge-monorepo/-/merge_requests/12) on `main`: - `packages/frontend/public/tokens/VFDUSD.png` - `'VFDUSD'` in `LOGO_SYMBOLS` (`tokenLogos.ts`) (UI logo is not a formal #19 AC, but unblocks bridge listing UX for the registered token.) ### Re-verified on-chain (this check) | Check | Result | |-------|--------| | Terra vFDUSD `token_info` | decimals **6**, symbol **vFDUSD** | | Terra UST1 `token_info` | decimals **6**, symbol **UST1** | | BSC `tokenRegistered(Venus vFDUSD)` | **true** | | Terra bridge `token` for Terra vFDUSD | **enabled**, `mint_burn`, terra_decimals **6** | | Local optimized wasm | `artifacts/ust1_oracle.wasm` + `ust1_window.wasm` present | ### Acceptance criteria (#19) | AC | Status | Notes | |----|--------|-------| | Optimized wasm built and stored; code IDs recorded | **Partial** | Built locally; **not** stored on-chain yet | | Mainnet vFDUSD + UST1 live; decimals 6; minters correct | **Done** | | | CL8Y bridge BSC→Terra path (or smoke) | **Partial → mostly done** | Symmetric registration **complete** (BSC LockUnlock + Terra mint_burn + mappings). Optional: record a minimal lock/mint smoke tx hash to fully close this AC | | `ust1-oracle` + `ust1-window` instantiated (fee/limits) | **Open** | Next: Phase 4 store + instantiate | | Window → CMM treasury | **Open** | | | Window is UST1 minter; treasury allowance | **Open** | | | First rate + non-stale `EffectiveSwap` | **Open** | | | Oracle service prod + `verify_oracle_operator_env` | **Open** | | | Deposit + withdraw smoke | **Open** | Needs window + bridged inventory | | Over-limit rejects (mainnet) | **Open** | | | `DEPLOYMENT.md` registry + approved instantiate limits | **Partial** | Limits ✅; CW20s + bridge filled; oracle/window code IDs blank | | No `cmm-native-wrap` deployed | **Done** | | ### Next to advance #19 1. Phase 4 — `wasm store` / instantiate oracle + window (approved fee/limits). 2. Phase 5 — `add_minter` → treasury allowance → first `UpdateRate` → oracle-service. 3. Optional — small BSC→Terra vFDUSD bridge smoke; then deposit/withdraw smoke.
PlasticDigits commented 2026-07-30 06:20:36 +00:00 (Migrated from gitlab.com)

Verified BSC→Terra vFDUSD smoke via xchain hash 0x0f03667d268bcdb70f100f3bbcd3e498d60cec1751e006267a4ed371941c739c: BSC deposits[hash]=true, Terra pending withdraw executed=true for CW20 terra1mnl9…svj3 → terra1xsecn… (~2.437446 vFDUSD after 8→6 decimal scale; Terra supply matches).

Verified BSC→Terra vFDUSD smoke via xchain hash `0x0f03667d268bcdb70f100f3bbcd3e498d60cec1751e006267a4ed371941c739c`: BSC `deposits[hash]=true`, Terra pending withdraw `executed=true` for CW20 `terra1mnl9…svj3` → `terra1xsecn…` (~2.437446 vFDUSD after 8→6 decimal scale; Terra supply matches).
PlasticDigits commented 2026-07-30 08:38:59 +00:00 (Migrated from gitlab.com)

mentioned in issue PlasticDigits2/ustr-cmm#6

mentioned in issue PlasticDigits2/ustr-cmm#6
PlasticDigits commented 2026-07-30 08:39:22 +00:00 (Migrated from gitlab.com)

mentioned in issue #20

mentioned in issue #20
PlasticDigits commented 2026-07-30 08:39:37 +00:00 (Migrated from gitlab.com)

Phase 5 withdraw path decision: Option 3 (treasury InstantWithdrawCw20), not CW20 allowance.

add_minter done; treasury EOA-style increase_allowance is invalid (treasury is a contract). Withdraw smoke waits on the two issues above + SetCw20Spender.

Phase 5 withdraw path decision: **Option 3** (treasury InstantWithdrawCw20), not CW20 allowance. - Treasury work: https://gitlab.com/PlasticDigits2/ustr-cmm/-/work_items/6 - Window work: https://gitlab.com/PlasticDigits/ust1-window/-/work_items/20 `add_minter` done; treasury EOA-style `increase_allowance` is invalid (treasury is a contract). Withdraw smoke waits on the two issues above + `SetCw20Spender`.
PlasticDigits commented 2026-07-30 08:42:47 +00:00 (Migrated from gitlab.com)

mentioned in commit 23d88923a3

mentioned in commit 23d88923a316c7594f3349b6efa0cb92c88f8ee8
PlasticDigits commented 2026-07-31 02:34:05 +00:00 (Migrated from gitlab.com)

mentioned in merge request PlasticDigits2/ustr-cmm!38

mentioned in merge request PlasticDigits2/ustr-cmm!38
PlasticDigits commented 2026-08-08 00:36:36 +00:00 (Migrated from gitlab.com)

mentioned in merge request !34

mentioned in merge request !34
PlasticDigits commented 2026-08-08 03:10:47 +00:00 (Migrated from gitlab.com)

AC status update (2026-08-08) — after ustr-cmm#6 + #20 closed

Re-verified on-chain via LCD (columbus-5) and repo state. Companion work landed:

Work Issue State What it unblocked
Treasury InstantWithdrawCw20 + spender registry PlasticDigits2/ustr-cmm#6 closed Treasury code 11564 exposes InstantWithdrawCw20 / SetCw20Spender
Treasury 24h pull limit (fail-closed) PlasticDigits2/ustr-cmm#7 closed cw20_spender_limit live
Window Option 3 redeem path #20 / MR !34 closed / merged Code+tests+docs on main; mainnet window migrate still pending

On-chain snapshot (this check)

Check Result
ust1-oracle terra1fmht…gch8n code 11549; rate=1e18, last_update_sec=0 (no operator commit yet)
ust1-window terra1zxwp…h3rh2 code 11550; fee_bps=100, per-tx 1000000000, 24h 10000000000; cmm_treasury=terra16j5u6…; paused=false
Window bytecode vs #20 Live code 11550 data_hash matches local pre-#20 artifacts/ust1_window.wasm (Jul 30). InstantWithdrawCw20 wasm from MR !34 is not stored/migrated yet
UST1 minters includes window terra1zxwp… ✅
UST1 / vFDUSD decimals 6; UST1 supply 0; vFDUSD supply 10575441; vFDUSD minter = bridge
Treasury cw20_spenders vFDUSD → window registered ✅
Treasury cw20_spender_limit max_amount_per_window=10000000000 / window_seconds=86400; used 0 ✅
vFDUSD allowance(treasury, window) 0 (unused; correct for Option 3)
Treasury vFDUSD CW20 balance 0 (inventory not yet at treasury for withdraw smoke)
Bridge smoke Previously recorded xchain 0x0f03667d…739c ✅

Acceptance criteria (#19)

AC Status Evidence / notes
Optimized wasm built and stored; code IDs recorded Done (initial stack) / Partial (#20 wasm) Oracle 11549 + window 11550 recorded in registry. Post-#20 InstantWithdraw window wasm still needs wasm store + migrate → new code id
Mainnet vFDUSD + UST1 live; decimals 6; minters correct Done Queried token_info + minters/minter
CL8Y bridge BSC→Terra mint (or smoke) Done Registration + smoke hash in prior comment
ust1-oracle + ust1-window instantiated with fee/limits Done On-chain config matches approved caps
Window → CMM treasury terra16j5u6… Done config.cmm_treasury
Window is UST1 minter; treasury withdraw inventory wired Partial → mostly done add_minter(window) ✅; Option 3 supersedes allowance: SetCw20Spender + limit_24h ✅. Blocker: window still on TransferFrom bytecode (11550); must migrate to InstantWithdrawCw20 code from #20. Treasury vFDUSD balance currently 0
First rate committed; non-stale EffectiveSwap Open last_update_sec=0 → oracle stale for swaps
Oracle service prod (≥2 BSC RPCs); verify_oracle_operator_env Open No prod evidence
Deposit vFDUSD→UST1 + withdraw UST1→vFDUSD within limits Open UST1 supply 0; needs rate + (for withdraw) migrated window + treasury inventory
Over per-tx / rolling-24h limits reject Open (mainnet) Covered in multitest; mainnet smoke TBD
DEPLOYMENT.md registry filled; instantiate JSON = approved limits Done Registry + example JSON use approved caps. Note: Phase 5 checklist boxes in the doc still lag reality (add_minter / SetCw20Spender already executed on-chain)
No cmm-native-wrap deployed for this issue Done Wasm built locally only; not part of this launch

Verification criteria

VC Status Notes
Address registry complete Done Tokens, oracle, window, bridge, roles filled
On-chain oracle state / window effective_swap match fee/limits/freshness Partial Fee/limits ✅; rate freshness ❌ (last_update_sec=0)
E2E deposit + withdraw tx hashes Open
Oracle service health / silence alert Open
Phase 4 unblocked with published addresses Partial Addresses published; economic path not live until rate + migrate + smokes
Cross-link Phase 3 / 4 / 5 Done Earlier tracking comment

Remaining to close #19

  1. Store + migrate window terra1zxwp… to InstantWithdrawCw20 wasm from #20 / main (leave address stable).
  2. First UpdateRate from oracle operator (then non-stale EffectiveSwap).
  3. Fund treasury with vFDUSD inventory (balance is 0 today) for redeem path.
  4. Oracle service prod: ≥2 BSC RPCs, verify_oracle_operator_env, host up.
  5. Mainnet smokes: deposit; withdraw (finder should show treasury CW20 Transfer, not TransferFrom); over-limit reject.
  6. Optional doc hygiene: tick Phase 5 checklist in DEPLOYMENT.md / fix README “add_minter pending” now that minter + SetCw20Spender are live.

Bottom line: Deploy + Option 3 ops wiring (minter, spender, 24h limit) are largely in place. #19 is still open on window migrate to #20 bytecode, first oracle rate, oracle-service prod, inventory, and deposit/withdraw smokes.

## AC status update (2026-08-08) — after ustr-cmm#6 + #20 closed Re-verified on-chain via LCD (`columbus-5`) and repo state. Companion work landed: | Work | Issue | State | What it unblocked | |------|-------|-------|-------------------| | Treasury InstantWithdrawCw20 + spender registry | [PlasticDigits2/ustr-cmm#6](https://gitlab.com/PlasticDigits2/ustr-cmm/-/issues/6) | **closed** | Treasury code **11564** exposes `InstantWithdrawCw20` / `SetCw20Spender` | | Treasury 24h pull limit (fail-closed) | [PlasticDigits2/ustr-cmm#7](https://gitlab.com/PlasticDigits2/ustr-cmm/-/issues/7) | **closed** | `cw20_spender_limit` live | | Window Option 3 redeem path | [#20](https://gitlab.com/PlasticDigits/ust1-window/-/issues/20) / [MR !34](https://gitlab.com/PlasticDigits/ust1-window/-/merge_requests/1) | **closed / merged** | Code+tests+docs on `main`; **mainnet window migrate still pending** | ### On-chain snapshot (this check) | Check | Result | |-------|--------| | `ust1-oracle` | `terra1fmht…gch8n` code **11549**; `rate=1e18`, **`last_update_sec=0`** (no operator commit yet) | | `ust1-window` | `terra1zxwp…h3rh2` code **11550**; `fee_bps=100`, per-tx `1000000000`, 24h `10000000000`; `cmm_treasury=terra16j5u6…`; paused=false | | Window bytecode vs #20 | Live code **11550** `data_hash` matches local **pre-#20** `artifacts/ust1_window.wasm` (Jul 30). InstantWithdrawCw20 wasm from MR !34 is **not** stored/migrated yet | | UST1 `minters` | **includes window** `terra1zxwp…` ✅ | | UST1 / vFDUSD | decimals **6**; UST1 supply **0**; vFDUSD supply `10575441`; vFDUSD minter = bridge | | Treasury `cw20_spenders` | vFDUSD → window **registered** ✅ | | Treasury `cw20_spender_limit` | `max_amount_per_window=10000000000` / `window_seconds=86400`; used `0` ✅ | | vFDUSD `allowance(treasury, window)` | `0` (unused; correct for Option 3) | | Treasury vFDUSD CW20 balance | **0** (inventory not yet at treasury for withdraw smoke) | | Bridge smoke | Previously recorded xchain `0x0f03667d…739c` ✅ | ### Acceptance criteria (#19) | AC | Status | Evidence / notes | |----|--------|------------------| | Optimized wasm built and stored; code IDs recorded | **Done (initial stack)** / **Partial (#20 wasm)** | Oracle **11549** + window **11550** recorded in registry. Post-#20 InstantWithdraw window wasm still needs `wasm store` + migrate → new code id | | Mainnet vFDUSD + UST1 live; decimals 6; minters correct | **Done** | Queried `token_info` + minters/minter | | CL8Y bridge BSC→Terra mint (or smoke) | **Done** | Registration + smoke hash in prior comment | | `ust1-oracle` + `ust1-window` instantiated with fee/limits | **Done** | On-chain config matches approved caps | | Window → CMM treasury `terra16j5u6…` | **Done** | `config.cmm_treasury` | | Window is UST1 minter; treasury withdraw inventory wired | **Partial → mostly done** | `add_minter(window)` ✅; Option 3 supersedes allowance: `SetCw20Spender` + `limit_24h` ✅. **Blocker:** window still on TransferFrom bytecode (11550); must migrate to InstantWithdrawCw20 code from #20. Treasury vFDUSD balance currently 0 | | First rate committed; non-stale `EffectiveSwap` | **Open** | `last_update_sec=0` → oracle stale for swaps | | Oracle service prod (≥2 BSC RPCs); `verify_oracle_operator_env` | **Open** | No prod evidence | | Deposit vFDUSD→UST1 + withdraw UST1→vFDUSD within limits | **Open** | UST1 supply 0; needs rate + (for withdraw) migrated window + treasury inventory | | Over per-tx / rolling-24h limits reject | **Open (mainnet)** | Covered in multitest; mainnet smoke TBD | | `DEPLOYMENT.md` registry filled; instantiate JSON = approved limits | **Done** | Registry + example JSON use approved caps. Note: Phase 5 checklist boxes in the doc still lag reality (`add_minter` / `SetCw20Spender` already executed on-chain) | | No `cmm-native-wrap` deployed for this issue | **Done** | Wasm built locally only; not part of this launch | ### Verification criteria | VC | Status | Notes | |----|--------|-------| | Address registry complete | **Done** | Tokens, oracle, window, bridge, roles filled | | On-chain oracle `state` / window `effective_swap` match fee/limits/freshness | **Partial** | Fee/limits ✅; rate freshness ❌ (`last_update_sec=0`) | | E2E deposit + withdraw tx hashes | **Open** | | | Oracle service health / silence alert | **Open** | | | Phase 4 unblocked with published addresses | **Partial** | Addresses published; economic path not live until rate + migrate + smokes | | Cross-link Phase 3 / 4 / 5 | **Done** | Earlier tracking comment | ### Remaining to close #19 1. **Store + migrate** window `terra1zxwp…` to InstantWithdrawCw20 wasm from #20 / `main` (leave address stable). 2. **First `UpdateRate`** from oracle operator (then non-stale `EffectiveSwap`). 3. **Fund treasury** with vFDUSD inventory (balance is 0 today) for redeem path. 4. **Oracle service** prod: ≥2 BSC RPCs, `verify_oracle_operator_env`, host up. 5. **Mainnet smokes:** deposit; withdraw (finder should show treasury CW20 `Transfer`, not `TransferFrom`); over-limit reject. 6. Optional doc hygiene: tick Phase 5 checklist in `DEPLOYMENT.md` / fix README “add_minter pending” now that minter + `SetCw20Spender` are live. **Bottom line:** Deploy + Option 3 *ops wiring* (minter, spender, 24h limit) are largely in place. #19 is still **open** on window migrate to #20 bytecode, first oracle rate, oracle-service prod, inventory, and deposit/withdraw smokes.
PlasticDigits commented 2026-08-08 04:40:17 +00:00 (Migrated from gitlab.com)

mentioned in issue #21

mentioned in issue #21
PlasticDigits commented 2026-08-08 06:01:53 +00:00 (Migrated from gitlab.com)

mentioned in issue #28

mentioned in issue #28
PlasticDigits commented 2026-08-08 09:58:36 +00:00 (Migrated from gitlab.com)

mentioned in merge request !45

mentioned in merge request !45
PlasticDigits commented 2026-08-08 11:11:49 +00:00 (Migrated from gitlab.com)

AC status update (2026-08-08) — oracle seed + Coolify live

Re-verified on-chain via LCD (columbus-5) after window InstantWithdraw migrate, oracle Venus-bootstrap migrate, first UpdateRate, and Coolify oracle-service redeploy. Docs registry updated in 85043b8.

Done (this session / recent)

Item Evidence
Optimized wasm stored Window code 11566 (store AA40BE6A…037E); oracle code 11568 (store E8116018…1265)
Mainnet vFDUSD + UST1 Live; decimals 6; bridge / window minters as prior
CL8Y BSC↔Terra vFDUSD Symmetric registration + prior BSC→Terra smoke (earlier in thread)
ust1-oracle + ust1-window instantiate Addresses live; window fee_bps=100, per-tx 1000 / 24h 10000 UST1
Window → CMM treasury terra16j5u6…lr2
Window is UST1 minter minters = [terra1zxwp…]
Withdraw inventory (Option 3) Window 11566 InstantWithdrawCw20; treasury 11564 SetCw20Spender + limit_24h=10000000000 (not CW20 allowance — superseded)
Oracle migrate (bootstrap + State.paused) 11549 → 11567 → 11568
First rate committed Venus-normalized seed 2026-08-08 11:04:37 UTC (last_update_sec=1786187077, R=1225104516022056627 ≈ 1.225 FDUSD/vFDUSD); day_baseline_rate same
EffectiveSwap non-stale Query returns oracle rate + last_update_sec above; window unpaused
Oracle service prod Coolify: ≥2 BSC RPCs, normalize exchangeRateStored/1e10, operator terra1hm3ph…; logs show dual-RPC agree + no rate change from BSC (matches seeded R)
DEPLOYMENT.md / README registry Filled (tokens, oracle 11568, window 11566, treasury, Venus seed timestamp)
No cmm-native-wrap Not deployed (out of scope)

On-chain snapshot (this check)

Contract Code Notes
ust1-oracle terra1fmht…gch8n 11568 rate=1225104516022056627, last_update_sec=1786187077, paused=false
ust1-window terra1zxwp…h3rh2 11566 fee/limits approved; treasury wired
CMM treasury 11564 spender limit live; vFDUSD balance = 0
UST1 minters — window only

Acceptance criteria

AC Status
Optimized wasm built/stored; code IDs recorded Done
Mainnet vFDUSD + UST1; decimals 6; minters correct Done
CL8Y bridge mint path / smoke Done (prior)
Oracle + window instantiate (fee/limits) Done
Window → CMM treasury Done
Window UST1 minter; treasury withdraw path Done (spender + limit; not allowance)
First rate + non-stale EffectiveSwap Done
Oracle service prod (≥2 BSC RPCs) Done (Coolify)
Deposit + withdraw smoke within limits Open — blocked on treasury vFDUSD inventory (=0)
Over-limit rejects on mainnet Open — covered in multitest; needs smoke after inventory
DEPLOYMENT.md registry + approved limits Done
No cmm-native-wrap Done

Remains to close #19

  1. Fund treasury with vFDUSD (bridge inventory) so withdraw/deposit smoke can run.
  2. Mainnet smoke: small deposit vFDUSD→UST1 + withdraw UST1→vFDUSD; record tx hashes; confirm treasury CW20 Transfer (not TransferFrom).
  3. Optional: over per-tx / rolling-24h reject smoke on mainnet.
  4. Governance handoff to multisig if required by ops policy (ProposeGovernance / AcceptGovernance).
  5. Hand published addresses to Phase 4 UI (dex.cl8y.com/ust1) / Phase 5 ops hardening once smoke is green.

Issue should stay open until deposit/withdraw smoke + registry note of probe tx hashes. Oracle bot is idle-healthy until Venus R moves under +2%/4h policy.

## AC status update (2026-08-08) — oracle seed + Coolify live Re-verified on-chain via LCD (`columbus-5`) after window InstantWithdraw migrate, oracle Venus-bootstrap migrate, first `UpdateRate`, and Coolify oracle-service redeploy. Docs registry updated in [`85043b8`](https://gitlab.com/PlasticDigits/ust1-window/-/commit/85043b8f7a4e0807a657deab341b3a4facfed117). ### Done (this session / recent) | Item | Evidence | |------|----------| | Optimized wasm stored | Window code **11566** (store `AA40BE6A…037E`); oracle code **11568** (store `E8116018…1265`) | | Mainnet vFDUSD + UST1 | Live; decimals 6; bridge / window minters as prior | | CL8Y BSC↔Terra vFDUSD | Symmetric registration + prior BSC→Terra smoke (earlier in thread) | | `ust1-oracle` + `ust1-window` instantiate | Addresses live; window `fee_bps=100`, per-tx **1000** / 24h **10000** UST1 | | Window → CMM treasury | `terra16j5u6…lr2` | | Window is UST1 minter | `minters = [terra1zxwp…]` | | Withdraw inventory (Option 3) | Window **11566** InstantWithdrawCw20; treasury **11564** `SetCw20Spender` + `limit_24h=10000000000` (not CW20 allowance — superseded) | | Oracle migrate (bootstrap + `State.paused`) | **11549 → 11567 → 11568** | | First rate committed | Venus-normalized seed **2026-08-08 11:04:37 UTC** (`last_update_sec=1786187077`, `R=1225104516022056627` ≈ **1.225** FDUSD/vFDUSD); `day_baseline_rate` same | | `EffectiveSwap` non-stale | Query returns oracle rate + `last_update_sec` above; window unpaused | | Oracle service prod | Coolify: ≥2 BSC RPCs, normalize `exchangeRateStored/1e10`, operator `terra1hm3ph…`; logs show dual-RPC agree + `no rate change from BSC` (matches seeded `R`) | | `DEPLOYMENT.md` / README registry | Filled (tokens, oracle **11568**, window **11566**, treasury, Venus seed timestamp) | | No `cmm-native-wrap` | Not deployed (out of scope) | ### On-chain snapshot (this check) | Contract | Code | Notes | |----------|------|-------| | `ust1-oracle` `terra1fmht…gch8n` | **11568** | `rate=1225104516022056627`, `last_update_sec=1786187077`, `paused=false` | | `ust1-window` `terra1zxwp…h3rh2` | **11566** | fee/limits approved; treasury wired | | CMM treasury | **11564** | spender limit live; **vFDUSD balance = 0** | | UST1 minters | — | window only | ### Acceptance criteria | AC | Status | |----|--------| | Optimized wasm built/stored; code IDs recorded | **Done** | | Mainnet vFDUSD + UST1; decimals 6; minters correct | **Done** | | CL8Y bridge mint path / smoke | **Done** (prior) | | Oracle + window instantiate (fee/limits) | **Done** | | Window → CMM treasury | **Done** | | Window UST1 minter; treasury withdraw path | **Done** (spender + limit; not allowance) | | First rate + non-stale `EffectiveSwap` | **Done** | | Oracle service prod (≥2 BSC RPCs) | **Done** (Coolify) | | Deposit + withdraw smoke within limits | **Open** — blocked on treasury vFDUSD inventory (=0) | | Over-limit rejects on mainnet | **Open** — covered in multitest; needs smoke after inventory | | `DEPLOYMENT.md` registry + approved limits | **Done** | | No `cmm-native-wrap` | **Done** | ### Remains to close #19 1. **Fund treasury with vFDUSD** (bridge inventory) so withdraw/deposit smoke can run. 2. **Mainnet smoke:** small deposit vFDUSD→UST1 + withdraw UST1→vFDUSD; record tx hashes; confirm treasury CW20 `Transfer` (not `TransferFrom`). 3. **Optional:** over per-tx / rolling-24h reject smoke on mainnet. 4. **Governance handoff** to multisig if required by ops policy (`ProposeGovernance` / `AcceptGovernance`). 5. **Hand published addresses to Phase 4** UI (`dex.cl8y.com/ust1`) / Phase 5 ops hardening once smoke is green. Issue should stay **open** until deposit/withdraw smoke + registry note of probe tx hashes. Oracle bot is idle-healthy until Venus `R` moves under +2%/4h policy.
PlasticDigits commented 2026-08-08 11:12:45 +00:00 (Migrated from gitlab.com)

Complete

Complete
PlasticDigits (Migrated from gitlab.com) closed this issue 2026-08-08 11:12:45 +00:00
PlasticDigits commented 2026-08-08 11:26:05 +00:00 (Migrated from gitlab.com)

mentioned in issue cl8y-dex-terraclassic#506

mentioned in issue cl8y-dex-terraclassic#506
PlasticDigits commented 2026-08-08 11:26:48 +00:00 (Migrated from gitlab.com)

mentioned in issue cl8y-dex-terraclassic#508

mentioned in issue cl8y-dex-terraclassic#508
PlasticDigits commented 2026-08-15 12:43:01 +00:00 (Migrated from gitlab.com)

mentioned in issue #30

mentioned in issue #30
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
issue/50
renovate/configure
No results found.
Labels
Clear labels   
enhancement

   
governance

   
QA

   
testing
No labels
enhancement
governance
QA
testing
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
code/ust1-window#19
No description provided.