## Summary Change **`ust1-window`** redeem path from CW20 **`TransferFrom` + treasury allowance** to calling the CMM Treasury’s **registered CW20 InstantWithdraw** API (Option 3). Deposits keep forwarding vFDUSD to `cmm_treasury`; withdraws ask treasury to `Transfer` vFDUSD to the user. **Depends on:** [PlasticDigits2/ustr-cmm#6](https://gitlab.com/PlasticDigits2/ustr-cmm/-/issues/6) (treasury `SetCw20Spender` + `InstantWithdrawCw20`). **Parent deploy track:** [#19](https://gitlab.com/PlasticDigits/ust1-window/-/issues/19) Phase 5 (withdraw smoke currently blocked). --- ## Current codebase | Component | Path | Behavior today | |-----------|------|----------------| | Withdraw | `contracts/ust1-window/src/contract.rs` → `withdraw` | After oracle/limits/min-out checks: require treasury vFDUSD **balance** and **allowance** ≥ `v_out`; then `Burn` UST1 + `TransferFrom { owner: cmm_treasury, recipient: user, amount: v_out }`. | | Allowance helper | `contract.rs` → `query_cw20_allowance` | Queried every withdraw; errors as `InsufficientTreasuryAllowance`. | | Errors | `contracts/ust1-window/src/error.rs` | `InsufficientVfdusd`, `InsufficientTreasuryAllowance`. | | Config | `state.rs` / `msg.rs` | `cmm_treasury` set at instantiate only (default `ust1_cmm::CMM_TREASURY_MAINNET`); no `SetTreasury`. | | Multitest | `contracts/ust1-window/src/multitest.rs` | Uses mock EOA/`Addr` treasury that can `IncreaseAllowance` (`setup_with_treasury_allowance`). | | Integration | `smartcontracts-terraclassic/tests/src/integration_tests.rs` | Same allowance assumption. | | Docs | `docs/DEPLOYMENT.md` Phase 5 §2, `README.md` | Updated to note default treasury is a **contract** and EOA-style allowance is invalid. | | Live window | `terra1zxwpzpzpleatqn39r00grau4yt29sld8pw78s7ktvjafnj5nsaxq0h3rh2` (code **11550**) | Instantiated with default CMM treasury `terra16j5u6…`. | | Live tokens | vFDUSD / UST1 | See README / #19 registry. | **Problem:** Default `cmm_treasury` is ustr-cmm Treasury (contract). It cannot sign `increase_allowance`. Option 2 (treasury emits allowance) was rejected in favor of Option 3 (treasury InstantWithdraw for registered spender). --- ## Why this is needed 1. Phase 5 withdraw smoke and always-on redeem UX require pulling vFDUSD from the real CMM treasury. 2. Allowance-based design only works if treasury is an EOA or a contract that can approve — current mainnet treasury cannot. 3. Aligns with wrap-mapper’s model: **registered contract** requests inventory out; treasury emits the asset move. 4. Keeps custody at `terra16j5u6…` (no re-pointing window to a hot wallet) once ustr-cmm#6 lands and spender is registered. --- ## Constraints / guardrails 1. **Do not ship withdraw-to-treasury InstantWithdraw** until ustr-cmm#6 API is stable (msg names/fields frozen or feature-gated with a clear adapter). 2. Preserve deposit path: vFDUSD `Transfer` → `cmm_treasury` unchanged. 3. Preserve oracle freshness, fee math (`INV-SWAP-*`), per-tx / rolling limits, pause, `min_vfdusd_out`. 4. Atomicity: UST1 `Burn` + treasury `InstantWithdrawCw20` must be in the **same** tx response (ordered submessages); failure of either must fail the tx. 5. Remove reliance on CW20 allowance for the happy path (delete or stop requiring allowance checks). 6. `cmm_treasury` remains instantiate-only unless a separate governance issue adds `SetTreasury` (out of scope unless migrate forces it). 7. Mainnet: after new window code, **migrate** existing window `terra1zxwp…` (admin = governance) or re-instantiate only if migrate insufficient — prefer migrate to keep address if integrators already wired it. 8. Ops still require treasury gov `SetCw20Spender { token: TERRA_VFDUSD, spender: WINDOW }` after both contracts are live — document in `DEPLOYMENT.md`. 9. Window per-tx / 24h limits remain primary user-facing caps; do not assume treasury-side caps exist (ustr-cmm#6 may add optional caps later). 10. No changes to `cmm-native-wrap` in this issue (native wrap is ustr-cmm wrap-mapper per #19 decisions). --- ## Relevant files - `contracts/ust1-window/src/contract.rs` — withdraw messages + remove allowance gate - `contracts/ust1-window/src/error.rs` — replace/repurpose `InsufficientTreasuryAllowance` - `contracts/ust1-window/src/state.rs` — doc comments on `cmm_treasury` - `contracts/ust1-window/src/msg.rs` — `MigrateMsg` if needed - `contracts/ust1-window/src/multitest.rs` — mock treasury that accepts InstantWithdrawCw20 - `smartcontracts-terraclassic/tests/src/integration_tests.rs` — end-to-end without IncreaseAllowance - `smartcontracts-terraclassic/packages/ust1-cmm/` — keep mainnet treasury constant; optional shared msg types if useful - `docs/DEPLOYMENT.md` Phase 5 — replace allowance steps with SetCw20Spender + migrate window - `README.md` — withdraw model blurb --- ## Recommended direction 1. Define a minimal **treasury execute client** in-window (or tiny helper module), matching ustr-cmm#6: ```json { "instant_withdraw_cw20": { "recipient": "<user>", "token": "<vfdusd>", "amount": "<v_out>" } } ``` 2. In `withdraw`: - Keep oracle / fee / min_out / rolling limit checks. - Keep treasury **balance** check (or rely on treasury balance error — prefer keep for clearer `InsufficientVfdusd`). - **Remove** allowance query / `InsufficientTreasuryAllowance`. - Messages: `Burn` UST1, then `WasmMsg::Execute` → `cfg.cmm_treasury` with `InstantWithdrawCw20 { recipient: user, token: cfg.vfdusd_token, amount: v_out }`. 3. Multitest: replace mock EOA allowance with a stub treasury contract (or cw-multi-test app contract) implementing InstantWithdrawCw20 + holding CW20. 4. Optimize + store new `ust1_window` code; **migrate** mainnet window; treasury gov registers window as vFDUSD spender; run withdraw smoke. 5. Update Phase 5 docs: delete EOA `increase_allowance` instructions; add dependency on ustr-cmm#6 + `SetCw20Spender`. **Out of scope:** Implementing treasury CW20 API (ustr-cmm#6); oracle service; bridge; changing fee/limit params. --- ## Acceptance criteria - [x] Withdraw no longer calls `TransferFrom` or requires CW20 allowance. - [x] Withdraw emits treasury `InstantWithdrawCw20` (or final agreed msg name from ustr-cmm#6) with correct recipient/token/amount. - [x] Deposit path unchanged (forward vFDUSD to treasury). - [x] Multitest + integration tests updated; allowance-based setup removed or marked obsolete. - [x] Errors: clear failure when treasury rejects (unregistered / paused / insufficient balance). - [x] `docs/DEPLOYMENT.md` + README describe Option 3 wiring; Phase 5 checklist updated. - [x] Mainnet migrate plan documented (code id → migrate tx → `SetCw20Spender` → smoke). - [x] Linked to ustr-cmm#6; #19 Phase 5 withdraw AC unblocked after ops steps. --- ## Test plan — functional paths | # | Path | Expect | |---|------|--------| | T1 | Deposit vFDUSD | Mints UST1; treasury CW20 balance increases (unchanged) | | T2 | Withdraw happy path | Burns UST1; user receives vFDUSD; treasury balance down by `v_out` | | T3 | Withdraw below `min_vfdusd_out` | Reject before calling treasury | | T4 | Stale oracle | Reject | | T5 | Per-tx / rolling limit | Reject; no treasury pull | | T6 | Paused window | Reject | | T7 | Treasury insufficient vFDUSD | Reject (`InsufficientVfdusd` or treasury error) | | T8 | Treasury spender not registered | Tx fails; UST1 not burned (atomicity) | | T9 | Treasury CW20 pull paused | Tx fails cleanly | | T10 | Fee split attributes | Still emitted on deposit/withdraw | | T11 | EffectiveSwap query | Still consistent; no allowance fields required | | T12 | Migrate multitest | Config (treasury, oracle, tokens, limits) preserved | --- ## Test plan — attack / abuse / hack vectors | # | Vector | Expect | |---|--------|--------| | A1 | Crafted CW20 hook / wrong token Send | Reject non-vFDUSD / non-UST1 hooks as today | | A2 | Direct `ExecuteMsg` trying to pull treasury | No public pull entry — only via Receive withdraw hook | | A3 | Reentrancy via malicious vFDUSD | Rely on cw20-mintable; burn before/with pull ordering reviewed (document message order: burn then InstantWithdrawCw20) | | A4 | Recipient spoofing | Recipient must be cw20 Send `sender` (user), not attacker-controlled field | | A5 | Calling treasury InstantWithdrawCw20 from random EOA | Treasury rejects (ustr-cmm#6); window must not add a bypass | | A6 | Window registered but user drains via repeated withdraws | Bounded by window per-tx + 24h limits + oracle/fee math | | A7 | Front-run oracle UpdateRate around withdraw | Existing oracle policy / min_out slippage guard | | A8 | Migrate storage corruption | Migrate tests; config addresses unchanged | | A9 | Wrong treasury address baked in | Instantiate/migrate verification against `CMM_TREASURY_MAINNET` | | A10 | Partial fill / double-pay | Single `v_out`; no second transfer; fail-closed on treasury error | --- ## Verification criteria 1. `cargo test` for `ust1-window` + integration suite green. 2. LocalTerra (or multitest with stub treasury matching ustr-cmm#6): full deposit→withdraw round trip **without** any `IncreaseAllowance`. 3. After mainnet window migrate + treasury `SetCw20Spender`: small withdraw smoke tx succeeds; finder shows treasury CW20 `Transfer` (not `TransferFrom` from an EOA). 4. Query vFDUSD `allowance(treasury, window)` remains **0** / unused. 5. #19 Phase 5 withdraw checklist can be marked complete pending oracle/rate items. --- ## Dependencies / sequencing 1. Land **ustr-cmm#6** (API + tests + treasury migrate as needed). 2. Implement this issue against finalized msg schema. 3. Store/migrate window; gov `SetCw20Spender` on treasury. 4. Resume #19 Phase 5 withdraw smoke (10k vFDUSD inventory policy enforced by window limits + treasury balances, not CW20 allowance).