Repository navigation
contracts: sysio.bond, sysio.synd, sysio.andon — syndication underwriting, emergency stop, custody totals - #662
Merged
Conversation
heifner
reviewed
Oct 6, 2026
heifner
reviewed
Oct 7, 2026
| // Desyndication | ||
| // --------------------------------------------------------------------------- | ||
|
|
||
| void synd::desyndicate(name holder, asset quantity) { |
Contributor
There was a problem hiding this comment.
Consider adding a minimum desyndication amount (a syndconfig field, say). Today any positive amount is accepted.
|
|
||
| case AttestationType::ATTESTATION_TYPE_UNDERWRITE_INTENT_COMMIT: | ||
| dispatch_underwrite_commit(self, data, chain_code); | ||
| // Retired external collateral and dual-commit swap ingress. |
Contributor
There was a problem hiding this comment.
STAKING_REWARD below is still live: it routes to sysio.dclaim::onreward, which credits WIRE claims funded from T5. It's unused at launch, so it could be retired here with the others, along with onreward and fundclaim.
| point on EVM (never the 20-byte address). Each credit mints to the account that | ||
| pubkey has linked through `sysio.authex`, or parks it until the link is made. | ||
|
|
||
| ### Defined but not consumed |
Contributor
There was a problem hiding this comment.
The unused ReserveSpec/UwritConfig fields and their JSON values could be removed rather than documented as unconsumed.
| | 9 | Continue monitoring admitted messages from each outpost for `mismatch` rows and `SHORTFALL` ([Comparing totals](#comparing-totals)). Record earlier pre-repair sequences reporting the known shortfall as part of this incident. | Same. | | ||
| | 10 | Write up the cause and what was burned or returned ([What to record](#what-to-record)). | Write up what triggered the pull. | | ||
|
|
||
| Challenge windows keep counting during a freeze and challenges stay open, so step 5 can be done while |
Contributor
There was a problem hiding this comment.
This has a deadline. bond::approve is permissionless and ignores the cord, and a request can only be challenged while OPEN or BONDED, so once an envelope's window passes anyone can approve it during the freeze and it releases at the first step after the clear. Each envelope in doubt has to be held (or ruled rslvinvalid) before its window ends.
| - Each `mismatch` row names the outpost, token and sequence of the message that reported the shortfall, | ||
| the custody it reported and the outstanding it was compared with (`expected`). Match the sequence to | ||
| the outpost's `synd` call (Solana) or `Syndicated` / yield event (Ethereum) to find the envelope. | ||
| Rows are never pruned; note the last one read, so the next reading shows only new rows. |
Contributor
There was a problem hiding this comment.
mismatch isn't a log: it keeps one row per (chain, token), each new shortfall overwrites it, and only sysio.synd::reconcile erases it. Snapshot the row after each shortfall and run reconcile before clearing the cord; the steps never mention it.
| `wrong token`, `amount out of range` or `unresolvable recipient` (wire-ethereum | ||
| `contracts/outpost/SyndicationPool.sol:594-618` at d4fbb8f8). | ||
|
|
||
| **The recredit rule.** Governance returns the shadow of a skipped desyndication with |
Contributor
There was a problem hiding this comment.
desyndlog no longer exists, and recredit is the wrong action here. Unpaid returns are tracked in sysio.synd returns and resolved with refundreturn or finishreturn. A recredit leaves the returns row open, so a later refundreturn for the same request mints the amount again. The liq README and the custody section of sysio-synd.md still point at recredit too.
valthon
force-pushed
the
feature/syndication-underwriting
branch
2 times, most recently
from
October 7, 2026 02:05
042b0fa to
75a74e0
Compare
Provide a depot emergency-stop cord controlled by native updateauth and linkauth permissions. Keep pull and clear independently delegatable, idempotent, and independent of epoch advancement. Add authorization, delegation, revocation, and state-transition tests with the operational playbook. Custody consumers adopt the cord in the chapters that introduce their respective policies. Change-Id: I4836335073b57887c78883609fcc25562131a9d1
Allow operator-signed deposits and withdrawals in WIRE or registered shadow LIQ, with eligibility measured against every configured token minimum. Resolve custody through one shared native-token lookup. Attribute a custodian's shadow yield to its individual bonded positions and defer remits into pull-based claims so hostile recipients cannot halt epoch advancement. Carry bounded yield accounting through withdrawal, termination, slashing, and re-registration. Include collateral, rounding, claim, and reentrancy coverage with the operator and shared-custody documentation. Keep the existing external collateral interfaces available until the dedicated retirement chapter. Keep multisig review coverage independent of production WASM size with a fixed-size valid module. Verify two-chunk storage, exact payloads, and reassembled transaction size and hash within the normal NET limit. Co-authored-by: Jonathan Glanz <[email protected]> Change-Id: I94a9be9479c2f4378fd08c952b72a6d6234b5c3d
Let an issuer request underwriting of an opaque statement in a depot-native token. Track partial bonds, bounties, challenge holds, approval, and explicit governance rulings independently of any particular external chain. Settle resolved obligations through individual pull claims. Preserve shadow yield and durable outcomes until the issuer acknowledges them, and prevent a rejecting recipient from blocking another party's principal or yield. Introduce notification-free LIQ custody settlement and apply the Andon cord to custody exits while leaving bonds and dispute resolution available. Include the full bond state-machine, rounding, pruning, freeze, and hostile recipient tests with the issuer integration guide. Fixtures use the existing LIQ funding interface until sysio.synd takes ownership of supply. Change-Id: I3a1fd657de9edd2cd31a67f737d782acaadeb1d7
Make the depot the authority for inbound envelopes, custody reconciliation, underwriting requests, and final wallet delivery. Give sysio.synd sole supply authority over LIQ and retain explicit recovery for failed returns. Enforce envelope ordering, backing, fee rounding, and emergency controls across dispatch, linking, settlement, and outbound desyndication. Model external custody with a test-only generic chain simulator. Exercise NTA/EC1 and NTB/EC2 through generated action sequences, destination delivery, parked claims, failures, and governance/provider resolution parity. Keep asset-specific producer registration tests and map every enabled flow to its native coverage and external-only responsibilities. Include the contract guide, bootstrap configuration, client pause handling, and integration tests. Retain the dormant legacy settlement surfaces here so their removal remains a separate review decision. Co-authored-by: Jonathan Glanz <[email protected]> Change-Id: I57c6c3589b0a73598a51e2f651c0da7bba5eb15c
The depot-native collateral and syndication contracts own the live custody and underwriting lifecycle. Remove the dormant outpost- collateral, reserve/swap settlement, and legacy underwriting paths that duplicate that responsibility and leave misleading APIs available. Delete the underwriter plugin, sysio.uwrit, retired reserve actions and ledgers, external collateral dispatch, old challenge integration, reserve fee emissions, and their protocol/client adapters. Remove their exclusive tests, fixtures, configuration, and build wiring together. Keep depot-side LIQ custody, yield, and swaps and update the deployment guidance. Keep the generic flow coverage, final destination assertions, and native producer collateral tests intact. Refresh affected checked-in contract artifacts with their source removals so deployed interfaces match the smaller supported surface. Co-authored-by: Jonathan Glanz <[email protected]> Change-Id: I542ab89dd2ac4824cad6c1d0774aa47d984f50bc
heifner
previously approved these changes
Oct 7, 2026
heifner
left a comment
heifner
left a comment
Contributor
There was a problem hiding this comment.
Even though more work is needed, approving so we can get this merged to work on top of.
valthon
force-pushed
the
feature/syndication-underwriting
branch
from
October 7, 2026 15:43
75a74e0 to
e9ac87c
Compare
heifner
approved these changes
Oct 7, 2026
This was referenced Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Move syndication underwriting and operator collateral custody onto WIRE. Inbound syndicated liquidity and yield stay held until underwriting permits release; the depot controls accounting, fees, limits, reconciliation, and wallet delivery while outposts retain external-asset custody and settlement responsibilities.
Add
sysio.andon,sysio.bond, andsysio.synd, strengthen native contract and integration coverage, and remove the retired external collateral, reserve-settlement, and legacy underwriting implementation.Changes and review chapters
5bc9198378— Add the native-authority Andon contract. Use nativeupdateauth/linkauthpermissions for independently delegatable pull and clear authority. Emergency-stop state is idempotent and independent of epoch advancement; there is no contract-managed puller registry. Include delegation, revocation, and state-transition tests and the emergency-stop playbook.7ac41ee062— Bond operator collateral in depot-native tokens. Support WIRE and registered shadow LIQ through shared custody helpers. Eligibility still requires every configured token minimum; accepting a token for custody does not make it sufficient collateral. Preserve per-position shadow yield through withdrawals, termination, slashing, and re-registration. Pull-based claims prevent a rejecting recipient from blocking other operators.1c3f51197b— Add generic underwriting withsysio.bond. Underwrite opaque issuer statements using partial bonds, bounties, challenge holds, approval, and explicitsysiorulings. Settle principal and yield through individual claims, retain durable outcomes until issuer acknowledgment, and isolate hostile recipients. Include notification-free LIQ custody settlement and emergency guards on custody exits.2ffeccb1bc— Gate syndication throughsysio.synd. Add held envelope intake, per-token underwriting, ordered release, fees, budgets, parked balances, and invalid-envelope burns. Move imports and desyndication intosysio.synd, with LIQ mint/burn authority for normal supply operations; exceptional privilegedrecreditrepair remains. Reconcile livetotal_syndicatedreports against depot obligations, stop on shortfalls, and support explicit failed-return recovery. Include paused/frozen outpost client handling and deferred Solana payouts.75a74e0b4a— Remove retired external settlement paths. Deletesysio.reserv,sysio.uwrit, the underwriter plugin, external collateral dispatch, legacy challenge integration, reserve-fee emissions, and their exclusive tests, adapters, fixtures, and build wiring. Keep active syndication/desyndication, staking rewards, OPP transport/consensus, native collateral, and depot-side LIQ custody, yield, and swaps. Update deployment guidance and affected contract artifacts with their sources.Native testing
See depot flow coverage, bond integration, syndication, and upgrade order.
Validation
Local validation (production code unchanged by the CI fixture repair at
75a74e0b4a):multisig_review_testpassed end-to-end with a fixed-size valid WASM fixture, verifying exactly two chunks, both action payloads, and the reassembled transaction size and hash. The fixture stays under the existing transaction NET limit instead of depending on production WASM size.ctest --test-dir build/release -L contract --output-on-failure -j4: 41/41 checks passed (39 contract suites and two flow-coverage checks), including snapshot attestation.python3 contracts/tools/verify_depot_flow_coverage.py --tools-root ../wire-tools-ts-synd: 13 flows mapped to 67 native cases; references and boundaries valid.The historical cluster-flow runs are not a fresh validation of this rebased head. Live external-chain flows were not rerun for this history rewrite. See the PR checks for CI results.
Coordinated rollout and related PRs
Publish matching generated OPP models from wire-sysio before building/deploying dependent outpost changes, and regenerate SDK contract types against the updated ABIs. Deploy the coupled contracts according to the upgrade guide; the removed interfaces require matching clients and bootstrap configuration. Coordinate the harness and platform manifest with those versions.
next.next.master.master.master.