chore(treasury): remove obsolete SwapDeposit / swap_contract (bundle with #5 migrate)

PlasticDigits commented

2026-08-05 00:10:05 +00:00

(Migrated from gitlab.com)

Summary

Remove the broken/legacy treasury ↔ swap integration during the #5 Phase 3 treasury migrate.

Treasury SwapDeposit still emits NotifyDeposit { depositor, amount } via a private SwapExecuteMsg, but live ustc-swap has no such message (only Swap { referral_code, leaderboard_hint }). The path is dead code / a footgun: if called with swap_contract set to ustc-swap, the submessage fails and the tx reverts atomically (no silent fund loss).

Audit: MB-1 in audits/INTERNAL_COMPOSER_1785465508.md.

Chosen remediation: option (1) — full removal (not hard-disable, not restoring NotifyDeposit on ustc-swap). Current product path is User → ustc-swap::Swap → forward USTC to Treasury + mint USTR. Frontend never calls SwapDeposit. Issue #5 already requires swap remain disabled (swap_contract null).

Bundle into the same treasury wasm store + in-place migrate as #5 so mainnet drops the obsolete ABI in one upgrade.

Scope (remove from treasury)

Surface	Notes
`ExecuteMsg::SwapDeposit {}`	Legacy entrypoint
`ExecuteMsg::SetSwapContract { contract_addr }`	Governance setter
`Config.swap_contract: Option<Addr>`	State field
Local `SwapExecuteMsg::NotifyDeposit`	Treasury-only enum used for the broken cross-call
Related errors / constants	e.g. `SwapContractNotSet`, swap-fund validation if only used here
Unit tests for the above	Replace with migrate/compat tests as needed
Docs	`docs/ARCHITECTURE.md` still diagrams the old tax-free `NotifyDeposit` flow — update to current `Swap` architecture; align `CONTRACTS.md` / `PROPOSAL.md` / wrap plans that reference SwapDeposit as a pattern

Do not remove wrap-mapper NotifyDeposit / treasury WrapDeposit — that path is live and unrelated.

Do not change ustc-swap product ABI beyond any incidental doc cleanup.

Why bundle with #5

#5 already migrates treasury for wrap (denom_wrappers, etc.) and explicitly says: do not re-enable USTC→USTR / SwapDeposit; leave swap_contract null.
Removing the dead ABI in the same migrate avoids a second treasury code bump and closes MB-1 before wrap mainnet smoke.
Live config already has swap_contract: null; removal matches ops reality.

Implementation notes

Drop msg/state/handlers/tests for swap_contract integration.
Migrate: ensure migrate succeeds from current mainnet layout (code 10673 → new) and from intermediate wrap-capable code if already on a branch with wrap fields. Decide whether to:
- drop swap_contract from Config with careful cw_serde / custom migrate load, or
- leave an ignored field only if required for storage compatibility — prefer clean removal with an explicit migrate path that loads old config and saves new without swap_contract.
Update ARCHITECTURE.md (primary stale diagram).
Adjust wrap plan tests that still assert SwapDeposit post-migrate (plans/NATIVE_TOKEN_WRAPPING.md A13).
Keep #5 acceptance: USTC→USTR swap remains disabled (stronger: messages gone).

Acceptance criteria

SwapDeposit / SetSwapContract / swap_contract removed from treasury ExecuteMsg, Config, state, and handlers.
Local SwapExecuteMsg / NotifyDeposit-to-swap path removed.
Treasury migrate from pre-removal config succeeds; wrap + CW20 InstantWithdraw surfaces from #5/#6/#7 unaffected.
Unit tests updated; no tests require successful NotifyDeposit to ustc-swap.
Docs updated (ARCHITECTURE.md at minimum; CONTRACTS.md / related plans).
Bundled into the #5 treasury wasm + mainnet migrate (same code_id bump).
Post-migrate: calling removed msgs fails as unknown variant; wrap path still works.

Test plan

cargo test in treasury (and workspace contracts) after removal.
Multitest migrate from config-with-swap_contract (Some/None) → new config without field.
Regression: WrapDeposit → wrap-mapper NotifyDeposit unchanged.
Regression: governance withdraw / CW20 InstantWithdraw (#6/#7) unchanged.
Include in #5 LocalTerra / mainnet migrate rehearsal checklist.

Bundled with: #5 Phase 3 treasury migrate + wrap-mapper
Audit: MB-1 (audits/INTERNAL_COMPOSER_1785465508.md)
Docs already mark SwapDeposit legacy: docs/CONTRACTS.md, plans/PROPOSAL.md

## Summary Remove the broken/legacy treasury ↔ swap integration during the **[#5](https://gitlab.com/PlasticDigits2/ustr-cmm/-/issues/5) Phase 3 treasury migrate**. Treasury `SwapDeposit` still emits `NotifyDeposit { depositor, amount }` via a private `SwapExecuteMsg`, but live **`ustc-swap` has no such message** (only `Swap { referral_code, leaderboard_hint }`). The path is dead code / a footgun: if called with `swap_contract` set to ustc-swap, the submessage fails and the tx reverts atomically (no silent fund loss). **Audit:** MB-1 in `audits/INTERNAL_COMPOSER_1785465508.md`. **Chosen remediation:** option (1) — **full removal** (not hard-disable, not restoring `NotifyDeposit` on ustc-swap). Current product path is User → `ustc-swap::Swap` → forward USTC to Treasury + mint USTR. Frontend never calls `SwapDeposit`. Issue #5 already requires swap remain disabled (`swap_contract` null). Bundle into the same treasury wasm store + in-place migrate as #5 so mainnet drops the obsolete ABI in one upgrade. --- ## Scope (remove from treasury) | Surface | Notes | |---------|--------| | `ExecuteMsg::SwapDeposit {}` | Legacy entrypoint | | `ExecuteMsg::SetSwapContract { contract_addr }` | Governance setter | | `Config.swap_contract: Option<Addr>` | State field | | Local `SwapExecuteMsg::NotifyDeposit` | Treasury-only enum used for the broken cross-call | | Related errors / constants | e.g. `SwapContractNotSet`, swap-fund validation if only used here | | Unit tests for the above | Replace with migrate/compat tests as needed | | Docs | `docs/ARCHITECTURE.md` still diagrams the old tax-free `NotifyDeposit` flow — update to current `Swap` architecture; align `CONTRACTS.md` / `PROPOSAL.md` / wrap plans that reference SwapDeposit as a pattern | **Do not** remove wrap-mapper `NotifyDeposit` / treasury `WrapDeposit` — that path is live and unrelated. **Do not** change `ustc-swap` product ABI beyond any incidental doc cleanup. --- ## Why bundle with #5 - #5 already migrates treasury for wrap (`denom_wrappers`, etc.) and explicitly says: do not re-enable USTC→USTR / `SwapDeposit`; leave `swap_contract` null. - Removing the dead ABI in the **same** migrate avoids a second treasury code bump and closes MB-1 before wrap mainnet smoke. - Live config already has `swap_contract: null`; removal matches ops reality. --- ## Implementation notes 1. Drop msg/state/handlers/tests for swap_contract integration. 2. **Migrate:** ensure `migrate` succeeds from current mainnet layout (code 10673 → new) and from intermediate wrap-capable code if already on a branch with wrap fields. Decide whether to: - drop `swap_contract` from `Config` with careful `cw_serde` / custom migrate load, or - leave an ignored field only if required for storage compatibility — prefer clean removal with an explicit migrate path that loads old config and saves new without `swap_contract`. 3. Update ARCHITECTURE.md (primary stale diagram). 4. Adjust wrap plan tests that still assert `SwapDeposit` post-migrate (`plans/NATIVE_TOKEN_WRAPPING.md` A13). 5. Keep #5 acceptance: USTC→USTR swap remains disabled (stronger: messages gone). --- ## Acceptance criteria - [ ] `SwapDeposit` / `SetSwapContract` / `swap_contract` removed from treasury ExecuteMsg, Config, state, and handlers. - [ ] Local `SwapExecuteMsg` / NotifyDeposit-to-swap path removed. - [ ] Treasury migrate from pre-removal config succeeds; wrap + CW20 InstantWithdraw surfaces from #5/#6/#7 unaffected. - [ ] Unit tests updated; no tests require successful `NotifyDeposit` to ustc-swap. - [ ] Docs updated (`ARCHITECTURE.md` at minimum; `CONTRACTS.md` / related plans). - [ ] Bundled into the #5 treasury wasm + mainnet migrate (same code_id bump). - [ ] Post-migrate: calling removed msgs fails as unknown variant; wrap path still works. --- ## Test plan 1. `cargo test` in treasury (and workspace contracts) after removal. 2. Multitest migrate from config-with-`swap_contract` (Some/None) → new config without field. 3. Regression: `WrapDeposit` → wrap-mapper `NotifyDeposit` unchanged. 4. Regression: governance withdraw / CW20 InstantWithdraw (#6/#7) unchanged. 5. Include in #5 LocalTerra / mainnet migrate rehearsal checklist. --- ## Related - Bundled with: [#5](https://gitlab.com/PlasticDigits2/ustr-cmm/-/issues/5) Phase 3 treasury migrate + wrap-mapper - Audit: MB-1 (`audits/INTERNAL_COMPOSER_1785465508.md`) - Docs already mark SwapDeposit legacy: `docs/CONTRACTS.md`, `plans/PROPOSAL.md`

PlasticDigits commented

2026-08-05 00:10:07 +00:00

(Migrated from gitlab.com)

marked as related to #5