Replace the v1 moria indexer with v1-1 tables and RPC. Chipnet tracks the
live deployment only; mainnet stays idle until a v1-1 deployment exists.
v1-1 rows carry delegate hash, borrow-time allowance deposits, crank fee
takes, and allowance-close recoveries. Policy lives on the parked
allowance (verified nSequence hint or first spend), not on the loan NFT.
Bar/pool history and realized NAV APR are confirmed-blocks only.
Bind the API before IBD so Rocket is up during sync. Empty electrum
header batches shrink the chain instead of panicking.
Depend on published riftenlabs-defi 0.4.6.
Tracks the libriften change growing the preinit announcement main data
push from 185 to 189 bytes: minOffer now reads at [122..130) and every
later field shifts by 4. The announcement signature's OP_PUSHDATA1
length byte moves to 0xbd, so only new-format announcements are
detected.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ido_entry gains a first_seen column: the unix time the purchase was
first indexed — the block's median-time-past when first seen in a
confirmed block, wall-clock time when first seen in the mempool. The
entry insert is ON CONFLICT DO NOTHING, so a mempool-seen purchase
keeps its (earlier) mempool stamp when the tx later confirms. This
matches the first_seen_timestamp convention already used by the
cauldron pool-history tables.
index_txs takes a new mtp: Option<i64> parameter: the block path in
index.rs passes the block MTP it already has in scope, the mempool
path passes None and the ido module falls back to timeutil::time_now().
The stamp is threaded through on_add_ido_tx into
upsert_updates_to_ido_entries — the only real entry write path.
The entries RPC exposes it as IdoEntryRpcRecord.first_seen; 0 means
unknown (rows written before the column existed). This lets the
frontend show purchase recency: an activity feed with time-ago, a
"last purchase X ago" signal, and raise-over-time series derived
client-side from the entries.
IDO_DB_VERSION bumps 4 -> 5. As with previous versions there is no
migration: delete ido.db and re-index from scratch — historical
entries then pick up their block MTP as first_seen.
Adds a querytest covering the round-trip and the pre-upgrade
default-0 shape (list_ido_entries_carries_first_seen).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Port libriften feb2167 + 05d3454 + a582108 (through HEAD a582108):
- The ORB PoolParams NFT is gone from the spec. The IdoParams commitment
field orbPoolParamsCategory (32, VM-order category) is replaced by
permanentPoolPlatformNfth (32, verbatim hash) — the delegation-pool
platform nfth the postlaunch bakes; run() reconstructs the permanent
pool's thin main from it on-chain, so the indexer's only duties are to
source it from the params NFT commitment and prove the output #7
postlaunch rebuild was baked with it (unchanged mechanism). Stored on
the PreInit/Active parameters as permanentPoolPlatformNfth.
- postlaunch io realignment: run() drops the PoolParams io#4 — the
offering confirmation NFT is consumed exactly ONCE, at run() input#4,
and is forbidden in init()/collect() (a582108). Collects no longer
copy the NFT through io#4, so they are invisible to the tracked chain
(they only move proceeds into the covenant storages); the POSTLAUNCH
status now advances solely on the final run tx. The platform payout
moved to output#4 and the altPPOut pool-deploy-failure fallback is
gone (altPPOutPayout dropped from the Distributed state, matching
libriften indexer-types).
- Native BCH xToken: offer.xTokenCategory is now nullable (all-zero
on-chain = native sentinel -> JSON null). Native IDOs take payment via
the offering's XWNT path (entry flag required-iff-native, payment in
the entry's value, fresh owner nft at #2) and their permanent pool is
a single-UTXO tokenbch-delegation pool at run() output#0 (BCH reserve
in the value; sibling slot -> OP_RETURN). The offering/postlaunch
builders bake an empty push for a native category.
- IDO_POSTLAUNCH_CONTRACT re-synced (1627 -> 2193 bytes, byte-matching
ido.json; embeds the new delegation contracts + both native branches);
initiator/preinit/offering-layer contracts verified byte-identical.
- Per-network ORB constants centralized in src/db/orbconstants.rs: the
IdoParams NFT category moved there next to the delegation-pool
platform nfth (chipnet pins the deployed ORB v0 records, mainnet stays
all-zero fail-closed).
- ido.db schema version 4: no backward compatibility, delete ido.db and
re-index.
Verified: cargo build, test (233 passing), clippy (no new warnings)
and fmt all clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Replace the old P2SH32/CONJURE TokenToken AMM indexer (never in
production; its tables are dropped by an always-run migration) with the
delegation-model indexers from riftenlabs-defi 0.4.5:
- tokentoken: two co-created bare-P2S UTXOs (thin main + storage
sibling). tokenbch (new): single-UTXO token<->BCH pool with the
runtime feePaidInToken fee side. Both admitted purely by the constant
locking derived from the per-network delegation-pool platform NFTH.
- src/db/orbconstants.rs: ONE platform NFTH serves both contracts —
chipnet pins the deployed ORB v0 value (libriften orb/v0/chipnet.ts),
mainnet is the all-zero placeholder: while unconfigured NOTHING
delegation-related is parsed, fetched or indexed (fail-closed).
- Schema: immutable config (nftOwner, tokens, poolFeeRate, minFee,
virtualX/Y, tokenbch feePaidInToken) on the pool row; per-state
history carries raw reserves, owed, platformFeeRate (both mutable by
platform sweeps) and deltas. History rows now FK tx(txid) ON DELETE
CASCADE, so evicted mempool txs clean up after themselves (the old
tokentoken indexer leaked those).
- LP teardowns carry no pool output: ingestion probes every
blob-presenting tx's spent outpoints against the recorded pool set
and flags a known pool UTXO spent without successor as withdrawn
(withdrawn_in_txid FK ON DELETE SET NULL reverts an evicted teardown;
reorg undo reverts a confirmed one).
- electrum mempool filters: the combined logic blob (scriptsig; every
spend incl. teardowns) + the constant thin-main locking (scriptpubkey;
creations), per contract, skipped while unconfigured.
- RPC: /tokentoken responses gain owed_a, platform/pool fee rates,
minFee and virtual offsets; new /tokenbch (pool/active?token, pools,
tokens) mirrors it for BCH pairs.
- deps: bitcoincash 0.32.4 (token.amount -> .to_int() in the ido
indexer), riftenlabs-defi 0.4.5. NOTE: 0.4.5 (rust-riftenlabs-defi
7c65f66) is not on crates.io yet — until it is published, build with
a local [patch.crates-io] pointing at the sibling checkout (the
committed Cargo.lock carries the path-patched entry). Also fixes a
latent test bug (ido_params_nft_commitment_roundtrip never wrote
createExecutionFee after the 127-byte layout shift).
Verified: cargo build, test (232 passing), clippy (no new warnings)
and fmt all clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
IdoActiveParameters dropped offeredTokenTotalSupply, so clients couldn't compute the offered-vs-total-supply share for live (non-PREINIT) IDOs. Carry it forward from the preinit parameters at the PreInit->Active transition and add it to the struct. A serde default of -1 (the pre-existing-token "unknown supply" sentinel) lets ido_state rows written before this field existed still deserialize.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
libriften moved encodeVmTokenCategory/decodeVmTokenCategory (which reverse
the 32 category bytes, display<->VM) into the ido announcement and ORB
IdoParams serialize/deserialize layer. Net wire effects the indexer sees:
- preinit announcement delphiCategory[44..76] and xTokenCategory[126..158]
are now VM/little-endian (were display order);
- the IdoParams commitment stays VM on-wire, but the derived on-chain
postlaunch orbPoolParamsCategory push flips display->VM (decode now
returns display, the unchanged bake re-wraps it in encodeVmTokenCategory).
Keep the three categories (delphiCategory, xTokenCategory,
orbPoolParamsCategory) in display/UI byte order in-memory and over RPC:
reverse at every parse site (announcement + IdoParams NFT commitment) and
restore the .rev() on the output#0 delphi-NFT to_blob() compare. The
build_*_bytecode helpers keep reversing display->VM when baking, so the
output#7 P2SH32 rebuild matches the new on-chain layout.
Also drop the now-unused hardcoded MAX_PLP_SHARE / MAX_PLP_ANNUAL_DISCOUNT
/ MIN_PLP_ANNUAL_DISCOUNT statics and dead checks; the min-PLP limits are
NFT-pinned (minPlpShare / minPlpAfterDiscount) and the discount/max-discount
checks now just guard against negatives.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sync the IDO indexer to libriften 48aa1f7 (+ follow-ups):
- IDO_SIGNATURE 20->10 bytes: [0x08 "CldIdo00" 0x75] (was OP_PUSH18
"CauldronIdo-2026Q2"). The separate "CauldronIdo0" announcement
signature is folded into the same 8 raw bytes, so
IDO_PREINIT_ANNOUNCEMENT_SIGNATURE = 6a 4c b9 + "CldIdo00";
is_preinit_broadcast is now length-agnostic. Electrum mempool
filters track automatically (they reference the constants).
- Recompile the 3 affected contracts from templates: IDO initiator
233->231, IDO preinit 1469->1465, offering launcher 630->628.
IDO_POSTLAUNCH_CONTRACT and the other offering contracts are
byte-identical and left as-is.
- Announcement OP_RETURN carries permanentLiquidityMinFee as a 2-byte
field at data[166..168]; mainData is now 185 bytes. Read minFee from
the announcement rather than the (unreadable) postlaunch copy.
Fix the source of the two "free" postlaunch params:
- Output #7 (ido initiator bytecode storage) is P2SH32, so the partial
bytecode cannot be read back from it. Drop the impossible extraction
(extract_params_from_partial_ido_initiator_bytecode +
PartialPostlaunchExtractedParams). extract_data_from_storage_script_
with_data_and_size is kept for its valid callers (revealed redeem
scripts, bare bcmr storages).
- orbPoolParamsCategory now comes from the ORB IdoParams NFT commitment
(output #10). The commitment parse is moved above the params
construction so the value is available; the now-tautological
orbPoolParamsCategory vs NFT check is removed.
- Verification is the existing output #7 rebuild: build the expected
bytecode from the announcement values plus the NFT-sourced
orbPoolParamsCategory, hash to P2SH32, and compare. Since minFee is a
2-byte announcement field it always fits the postlaunch's 2-byte push,
so build_partial_postlaunch_bytecode stays infallible.
- Tests: preinit_detect -> legacy_preinit_announcement_not_detected
(legacy fixture must no longer be detected under the new signature);
replace the extraction round-trip test with a structural check of the
partial postlaunch bytecode layout.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
libriften 0941c88 grew the ORB IdoParams NFT commitment 121->127 bytes,
inserting minPlpAfterDiscount/minPlpShare (4-byte pIntLE numerators over
PERMANENT_LIQUIDITY_SHARE_DENOMINATOR) between maxExpireDuration and
entryExecutionFee, and shrinking paramsUseFee 4->2 bytes.
- Parse the two new fields; shift entryExecutionFee/createExecutionFee offsets.
- Drop the hardcoded MIN_PLP_SHARE / MIN_PLP_AFTER_DISCOUNT statics; enforce
both minimums from the NFT commitment inside the version-verified block
(permanentLiquidityShareNumerator >= minPlpShare, and
maxDiscountRateNumerator + minPlpAfterDiscount <= permanentLiquidityShareNumerator).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- update IDO_POSTLAUNCH_CONTRACT to the recompiled 1627-byte script
(libriften cd58dd1): postlaunch.cash reordered the permanent-pool
sibling config, moving the all-zero nftOwner to the end. The indexer
byte-compares this body against on-chain output#7, so the stale
1669-byte constant would have marked every new IDO invalid.
- set CHIPNET_IDO_PARAMS_NFT_CATEGORY (was an all-zero placeholder).
- validate the ORB IdoParams NFT commitment version byte: only index
when it equals IDO_PARAMS_VERSION (0x00), else push an
"incompatible with the indexer" reason and mark the IDO invalid.
The other commitment fields are read at v0 offsets, so the parameter
comparisons are skipped on a version mismatch to avoid spurious errors.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add an OP_RETURN "BCMR" prefix filter to the rostrum mempool.get pass and
index matching txs in update_mempool with the all-zeros sentinel blockhash
(same pattern as oracle). A newly registered BCMR becomes the auth head and
is downloaded immediately; the confirming block re-stamps the entry with
its real blockhash in place.
- insert_authheader: INSERT OR REPLACE -> upsert. REPLACE deletes the row,
cascading away downloaded bcmr_data on every mempool->confirmed upgrade.
- update_mempool drops sentinel entries whose tx left the mempool (evicted
or replaced), so stale auth heads never linger.
- clear bcmr mempool state at startup; always-run migration adds txid and
blockhash indexes on auth_chain_entry for the per-pass lookups.
Auth chain transfers without a BCMR output still index at confirmation.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sync with libriften ido+ttd head (37a5c01):
- postlaunch rework: collect copies the offering confirmation NFT through
io#4 (the chain continues from the verified copy at output#4, state
unchanged); run consumes it at input#5. The called method is dispatched
from the carrier's unlocking bytecode (<args..> <functionIndex> <redeem>);
run's altPPOut argument is decoded as a VM number — when true the pool
legs were paid back to the collector (pool-deploy-failure fallback,
recorded as altPPOutPayout) instead of deploying the permanent pool. The
accumulated BCH pot paid to the platform p2nfth at output#5 is recorded
as platformBchPayout. Chain-follow probe list extended to [0,1,3,4,5].
- postlaunch constructor gains a 4-byte executionFee push (partial
postlaunch bytecode is now 8 pushes + body).
- p2nfth and plain storages lock as bare-p2s (blob storages stay p2sh32);
nfthash preimage flipped to hash256(commitment + category);
P2NFTH contract is 78cf7bce7eaa87.
- all changed contract constants regenerated from the libriften templates
(initiator 233 B, postlaunch 1669 B, preinit 1469 B).
- fix IdoActiveParameters construction missing orbPoolParamsCategory and
permanentLiquidityMinFee; box IdoUpdate::State to keep the enum small.
- ido db version 3; no migration — delete ido.db and re-index.
- legacy-generation fixture tests marked #[ignore].
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Preinit txs must now spend an ORB IdoParams NFT (use() at input #1,
preserved at output #10) whose per-network category is pinned and whose
121-byte commitment is cross-checked field-by-field against the
announced parameters; xToken must be a non-native token. ido.db is
version-gated (PRAGMA user_version = 2); legacy IDOs do not parse.
Also refresh the embedded IDOPostLaunch contract to the current
tokentoken-delegation build (1616 bytes, libriften ido+ttd a9fcfa0);
the previous copy predated the recompile and would have failed the
preinit output #7 byte-compare. All other embedded contracts verified
byte-identical to the libriften templates.
Per-network IdoParams NFT categories are still all-zero placeholders;
until set, every preinit indexes as is_valid=false.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The EntryDistributed update was pushed in the POSTLAUNCH->DISTRIBUTED
branch using the collection tx's own txid. That branch fires once at
final collection rather than per distribution tx, and tx.compute_txid()
never equals an entry's creation txid, so the dist_expr join
(d.entry_txid = e.txid) never matched and entries were never marked
distributed.
Push it in the DISTRIBUTING handler instead, once per distribution tx,
using input#1.previous_output.txid (the entry NFT being spent), which is
the entry's creation txid recorded by IdoUpdate::Entry.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace index_block/index_mempool with a single index_txs that takes an
Option<blockhash> (Some for confirmed, None for mempool). Add
delete_entries(blockhash) for reorg undo and to drop stale mempool state
before applying confirmed blocks. Replace has_txchain_tx with
has_indexed_tx; chain-follow now keys on ido_state.next_output_index
instead of the removed tracker map.
Remove the debug-only txchain RPC endpoints and the debug config gating.
Keep txchain_head as a public RPC field.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Migrate the ido module's arbitrary-precision math from num-bigint to
malachite (already a workspace dependency). BigInt becomes
malachite::Integer throughout; the VM-number byte codec uses
PowerOf2Digits, sign handling uses Integer::sign(), and primitive
conversions use try_from.
Add an IntegerAsStr serde adapter for string-serialized fields, since
malachite's FromStr::Err is () and does not satisfy DisplayFromStr's
Display bound. JSON output is unchanged.
Drop the now-unused num-bigint and num-traits dependencies.
Also fix all clippy warnings in the module surfaced by the migration
(unwrap-after-is_none control flow, a const->static LazyLock bug,
an oversized enum variant boxed, and assorted mechanical lints).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
on_add_ido_tx rebuilt the whole chain whenever the input tx was not the
txchain head. A mempool tx confirming after the chain advanced past it
would needlessly trigger a full rebuild.
Reconstruct the current chain (txchain_head .. txchain_entrypoint) and,
if the tx is already part of it, only update its block height. Extract
the shared chain-walking logic into reconstruct_txchain, reused by both
the membership check and the rebuild branch.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Replace the per-request get_ido_entry_aggregates SQL scan with running
totals carried in IdoActiveState: totalDemandAmount, totalSupplyAmount,
and totalDiscount. Initialized to 0 at the preinit->active transition and
incremented on each entry added; the rebuild path recomputes them by
replaying the txchain, so they self-heal.
Drop the now-unused get_ido_entry_aggregates DB fn, the IdoEntryAggregatesRpc
type, the /<id>/aggregates RPC handler, and its route registration.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add two timestamp columns to the ido table, both sourced from Delphi NFT
commitments (48-bit LE unix seconds):
- created_at (NOT NULL, default 0): from the Delphi NFT in the preinit's
first output, set at IDO creation. 0 if the commitment is too short.
- launched_at (NULL): from the Delphi NFT in output#3 of the launch
transaction, set in lockstep with launch_txid. Null until launched.
Both are threaded through the parse/context/update paths and exposed on
IdoRpcRecord.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add an optional owner_nfthash query param to GET /<id>/entries. Accepts
up to 20 comma-delimited 32-byte hex hashes; an entry matches any listed
value via an owner_nfthash IN (...) clause. Rejects malformed hex,
wrong-length values, and >20 filters with a 400.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sum demand/supply amounts and count entries for an IDO, used to show
"raised so far" for active offerings where on-chain state keeps no
running total.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Update ido/mod.rs for the bitcoincash 0.32 API: Script -> ScriptBuf,
push_slice via &PushBytes (new pb() helper), as_byte_array/as_bytes.
Fix update_mempool to diff against cauldron_txs instead of defi_txs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Stamp mempool tracker entries with the negative of the highest known
block height instead of a fixed -1 sentinel, and trim on abs(height) so
entries whose tx is invalidated before confirming (e.g. by a double
spend) age out after TRACKER_MAX_BLOCK_DEPTH like confirmed ones. The
height is still replaced with the real one once the tx confirms.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- electrum mempool fetch gains an ido filter: state machine spends
(IDO_SIGNATURE in scriptsig) union preinit announcements
(IDO_PREINIT_ANNOUNCEMENT_SIGNATURE in scriptpubkey)
- split tx scanning out of index_block into index_txs and add
index_mempool, which indexes with a -1 sentinel height;
txchain_trim_tracker leaves negative heights alone and the real
height replaces the sentinel once the tx confirms in a block
- block indexing now skips re-creating an ido already seen in the
mempool, only updating its tracker height
- mempool txs are kahn-sorted so txchain parents index before children
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
