Hardening pass on the USDt→τUSDt wrap (builds on 0170's end-to-end validation).
Security fix — found via robustness testing:
- UsdtLockNile used require(token.transfer(...)) assuming a bool return; real
Tether-style USDt returns nothing → the refund path reverted, which would
STRAND the locker's funds. Fixed with SafeERC20 handling (no-data or true) on
both transfer/transferFrom; redeployed to Nile (TVahBUBqUDLqVjDn77Yav…Vnn2o).
- scripts/tron-wrap-robustness.cjs: R2 (too-early) and R3 (consumed) revert for
the right reason (decoded on-chain revert). R1 (self-refund) validated against
a clean standard token — contracts/tron/MockUsdt.sol + tron-refund-validate.cjs
— since the Nile faucet USDT has a non-standard transfer that reverts for
contract senders.
Naming model (revises the prefix-primary stance):
- identity = CashToken category; human name = USDt + a network badge (the "BIC");
the ε/τ prefix is a text-only fallback. Applied to the mockup (ASM·Multichain:
name+badge, prefix in button/stepper, synced selectors, new source-chain
dropdown Ethereum/Tron→ε/τ) and to ASM-Multichain.md / README.md, plus the
cross-chain-redemption non-goal (per-chain IOUs + AMM swap, not a universal IOU).
Design record:
- Parameters/ASM DEX/cross-chain-asm-concept-and-state.md — concept, the
trustless-vs-authority analysis, oracle vs light-client vs zk, the VM wall, the
reference hacks, the trust ladder, and the 48-hour build state.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Build A — DEX, validated on chipnet:
- scripts/chipnet-amm-usdm-pusd.mjs: USDm/PUSD constant-product swap on the
first-party SharePairAMM (ADR-0030); price discovery 1.000→1.440 PUSD/USDm,
constant product held. No Cauldron needed (it's mainnet-only).
Build B — cross-chain wrap, validated end-to-end across Tron Nile + chipnet:
- contracts/DeviantWrapMintIOU.cash: mint-on-attestation IOU covenant —
checkDataSig oracle gate, NO BCH backing (dust only; value is the source
lock, ADR-0035), replay-bound to the reservoir outpoint.
- scripts/chipnet-wrapmint-iou.mjs: BCH leg — genesis reservoir into the
covenant, oracle-attested mint of τUSDt, replay rejected by the covenant.
- contracts/tron/UsdtLockNile.sol + scripts/tron-deploy-lock.cjs: Nile lock
contract (lock/markConsumed/refund), deployed at TXmMRnau9Ct…ZintH.
- scripts/tron-bch-wrap.mjs: the oracle watcher — locked 0.5 real USDt on
Nile → minted 500000 τUSDt on chipnet → markConsumed. Genuine USDt→τUSDt.
Docs (Parameters/ASM DEX/ASM-Multichain.md): which source chains qualify,
reverse unwrap, three-tier trust model, source-chain prefix marker, and the
cross-chain-redemption design decision (universal IOU = non-goal; per-chain
IOUs + BCH AMM swap = the answer; CCTP does not cover BCH).
Deps: tronweb ^6.3.0, solc ^0.8.35. Keys/state gitignored.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Record the decision: the fiat on/off-ramp is built as an independent product
(own repo/deployment/brand); the Deviant wallet is one consumer via API/SDK,
alongside third-party embedders. Follows the established split-out + white-label
pattern (CoinSpectrum, Deviant Labs co-brand). ADR-0036 on-ramp aggregator
becomes a client of the product.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds Parameters/DEX_P2P/fiat-ramp-product.md — the product layer over the
settlement engine in p2p-fiat-crypto-exchange.md:
- Non-custodial infrastructure: catalogue + escrow + oracle + reputation;
platform holds nothing and converts nothing (light-touch posture).
- Two counterparty classes on one backend: individuals (pure P2P, non-KYC,
self-proved zkTLS) and specialized operators (licensed/vetted, automated,
carry own compliance) — with class + jurisdiction disclosure.
- Trade flows for each lane; regulatory posture (operators carry compliance;
regulation follows operator AND customer; geo-controls + disclosure).
- Positioning: "BestChange's network + reach, but escrow- and oracle-protected";
micro-swap wedge; Telegram + web distribution.
- Scope: fiat↔crypto only; crypto↔crypto is the separate multichain DEX.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Capture the DEX/P2P design worked out this session under Parameters/DEX_P2P/:
- dex-architecture.md — the exchange model (AMM is an order type, not a venue);
one infrastructure with two entry ramps + two skins; THORChain-insolvency
note validating the no-protocol-vaults thesis.
- bch-dex-development.md — native BCH order-book engineering spec (order
covenants, multi-input taker settlement, the 100KB tx cap, indexer/matcher).
- cross-chain-htlc-ramp.md — HTLC entry-ramp spec (two-leg atomic swap,
T_B<T_A timelock ordering, BCH covenant, BTC/EVM counterparty legs).
- p2p-fiat-crypto-exchange.md — fiat-leg payment oracle + settlement covenant;
receipt-vs-sender-proof decision resolved to sender-proof (2b) via the
three-adversary test (new §4a), refund-default victim mislabel fixed.
Design records only; no code.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Follow-up cleanup to the USDm -> FIATm reorg: update the remaining cross-references
that still pointed at Parameters/usdm_complete-design_FOR-design-record.md to its
new path Parameters/FIATm/fiatm_complete-design_FOR-design-record.md.
Touched: src/oracleUsdm.ts, wiki/decisions.md, wiki/sound-money-primer.md, and the
FIATm/MBA-Shares design records. Adds Parameters/FIATm/fiatm-comparisons.html.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Brings the whole project into git (previously only the on-ramp feature and
a few parallel files were tracked). Includes: wallet core (src/), CashScript
contracts/, the Capacitor shell (shells/), scripts/, tests, and the docs
corpus (wiki/, snapshots/, Parameters/, Archive/, KnowledgeBase text).
Excluded via .gitignore: node_modules/, dist/, .env (secrets), testnet WIF
key files (.chipnet-*.json, devWallets.ts), KnowledgeBase/RAW media (~9.6 GB),
transcripts/ (session logs), and machine-local config (.claude/*.local,
*.lock). Secret-scanned before commit — no credentials in the tree.
Note: src/swapMath.ts, src/swapBuilder.ts, contracts/OpenMintToken.cash are
legacy (OP_RETURN era) but still imported; committed as-is, flagged for a
separate removal once de-referenced.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
