Skip to content

CIP112-compliant Token Implementation - #55

Open
igingu wants to merge 4 commits into
mainfrom
igingu-align-atomic-settlement-with-cip112
Open

CIP112-compliant Token Implementation#55
igingu wants to merge 4 commits into
mainfrom
igingu-align-atomic-settlement-with-cip112

Conversation

@igingu

@igingu igingu commented Aug 4, 2026

Copy link
Copy Markdown
Collaborator

This is a CIP112-compliant Token implementation, using the TSv2 interfaces. I reviewed the TestToken and Amulet implementation for Splice and tried to integrate best practices observed there.

Important to note, our previous implementation was missing all the transfer functionality, they are present now.

@pepebndc

pepebndc commented Aug 5, 2026

Copy link
Copy Markdown
Collaborator

Minor hardening note: with allowedExecutors = None (the default, and what the tests use) the registry places no constraint on settlement.executors, so anyone creating an allocation can name an arbitrary party as executor and thereby make them an allocation observer, a funding-lock holder, and a member of the AA_Cancel actor set. No fund loss, but it leaves settlement integrity and privacy to off-ledger coordination; worth defaulting deployments (and ideally the examples) to an explicit allowlist.

@pepebndc pepebndc left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The seizure-window fix in 495e759 looks good: making windowEnd mandatory on D2SeizureHook removes the deadline-less bypass by construction, and testFixNoDeadlineSeizureStillFreezes covers the exact exploit path. Closed #58 in favor of this.

@pepebndc
pepebndc force-pushed the igingu-align-atomic-settlement-with-cip112 branch from 2ca2c7b to 9763eb9 Compare August 5, 2026 18:20
pepebndc added a commit that referenced this pull request Aug 6, 2026
## Why

The doc work has forked into two lines. PR #37's branch
`docs/ri03-dex-feedback-parity` carries the RI1-style rewrite of the
cross-chain doc (per Curtis's ask to use the reworked DEX doc as the
template), and PRs #46, #47, #53, #60 merged *into that branch*; #61 is
stacked on it. None of it ever reached main, which moved on with the #51
restructure (carrying forward the pre-rewrite cross-chain doc), #50, and
the open #62/#54. Net effect on main before this PR: the #46 attestation
rename existed nowhere (dex.md referenced `requiresPartyAttestation`
while the `Cip112.daml` it links to says `requiresNodeAttestation`), and
the whole #37 rewrite plus the #47/#53/#60/#61 corrections were missing.

This PR consolidates everything into one reviewable branch on main:

| Commit | Source | What it carries |
|---|---|---|
| `docs(dex): apply PR #62 refinements` | #62 (open, @igingu) | Ported
verbatim: infrastructure trust, progress tracking, privacy/visibility
model, wallet requirements, deployment order, extension points, LP
emergency exit, two threat rows, typo fixes. |
| `refactor: unify attestation naming` | #46 (stranded, @igingu) |
`requiresNodeAttestation`/`requiresPartyAttestation` ->
`requiresComplianceAttestation`;
`NodeComplianceAttestation`/`PartyComplianceAttestation` ->
`ComplianceAttestation`, applied to the post-restructure paths (code,
tests, harness, all four architecture docs, including the text #50/#62
added). Docs and code now agree. |
| `docs(cross-chain): port stranded parity-branch changes` | #47, #53,
#60 | Interim hand-ports onto the old-shape doc; superseded two commits
later by the full #37 adoption, kept in history for traceability. |
| `docs: port PR #61 corrections` | #61 (open, @0xNeshi) |
Cross-chain-doc corrections: contract-key claims (template change as
well as SDK migration; maintainers must be signatories), attester
registry shown as caller-supplied with the `registry.admin ==
factoryAdmin` defense, USDCx xReserve rail stated precisely, corrected
DAR-unvetting rule. The dex.md portion was reverted in review (33ebd3f)
to keep main's contract-keys framing, per @igingu's comments. |
| `docs: apply PR #54 URL normalization` | #54 (open, @0xNeshi) | Pinned
permalinks with line anchors, anchor-slug fixes, `dars/manifest.yaml`
commit-hash update, extended `scripts/check-docs.sh` gate. |
| `docs(dex): pin remaining canton-contracts links` | follow-up to #54 |
The last `69a810a`-pinned links (a dangling fork commit) re-pinned to
`68b7c52`; target lines verified identical. |
| `docs(cross-chain): adopt the PR #37 RI1-refinement rewrite` | **#37
(open, @pepebndc)** + #46/#47/#53/#60 (merged into it) + #61 on top |
The full parity-branch rewrite replaces the pre-refinement cross-chain
doc, adapted for main: experiment paths retargeted, library links
repointed to pinned canton-contracts permalinks, every
`Cip112.daml`/`ShapeB.daml` line anchor recomputed against the moved
files, snippet imports aligned to the `-v1` module names. |

`scripts/check-docs.sh` passes (302 local links), which per its #54
extension also validates that every `#L` anchor's target line actually
declares the linked identifier. All external canton-contracts permalink
anchors were fetched and verified against the pinned commit.

## Outstanding review comments on the source PRs, addressed here

- **#61 (@pepebndc): DAR-unvetting table row lost its third cell** - the
row lands with all three cells intact.
- **#54 (@0xNeshi): `dars/manifest.yaml` should pin the commit that
exists on `main`** (hash verified to produce the same package sha256) -
included.
- **#54 (@pepebndc, @ericnordelo): line-anchor maintenance concern** -
kept as #54 proposes, per Eric's resolution: the `check-docs.sh`
heuristic guards anchors, and line references stay an optional
suggestion, not a PR blocker. If the team prefers dropping anchors,
revert that commit only.
- **#50 (@hrischuk-da): "the completion stream also has the failure
events"** - covered by the Execution Model assumptions plus #62's
progress-tracking paragraph.

## Judgment calls to review

1. **The cross-chain doc is now the #37 rewrite**, not the
pre-refinement version the restructure carried forward. If anyone had
edits queued against the old shape, they need re-basing.
2. **Not ported (needs a team decision)**: the parity branch's explicit
validation-tool list (`daml-lint -> daml-props -> daml-verify`) exists
in the adopted cross-chain doc but main's dex.md genericized its
equivalent - the two docs now differ on this; align in either direction.
3. **Snippet imports** in the adopted doc were aligned to
`OpenZeppelin.AccessControlV1` / `OpenZeppelin.PausableV1` to match
dex.md and the published packages.

## Relationship to the source PRs

This PR fully substitutes #37, #46, #47, #53, #60, #61, #62, and #54,
but **please do not close them until the team is aligned** on this
consolidation. #55 (token implementation) and #45 (delivery deck) are
separate workstreams and untouched. Follow-ups after this lands: retire
the `docs/ri03-dex-feedback-parity` branch, and the CIP-0104 rewrite of
the dex economics section (tracked separately).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: Pepe Blasco <pepeblascondc@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: Nenad <nenad.misic@openzeppelin.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants