docs: Chain 138 alignment audit + deprecate stale token-addresses master

- Add CHAIN138_ALIGNMENT_AUDIT_2026-04-18.md: drift report covering 67 unique
  Chain-138 addresses from 7 canonical sources, cross-checked against on-chain
  state at https://rpc-core.d-bis.org (chainId 0x8a / 138).
- Add docs/data/chain138-alignment.json: structured findings for downstream tooling.
- Banner CHAIN138_TOKEN_ADDRESSES.md as DEPRECATED (only 5 of 15+ tokens, 0 of 43
  infrastructure contracts).

Findings highlights:
- 64 of 67 referenced addresses are live on-chain; 3 ghosts (in allowlist only).
- 61 deployed contracts are missing from CHAIN138_TOKEN_ADDRESSES.md.
- WETH9 genesis slot (0xC02aaA39...Cc2) is a non-ERC20 shim (decimals=0); real
  WETH9 is at 0x3304b747...E6 per smom/docs/ADDRESS_MAPPING.md.
- WETH10 at canonical 0xf4BB2e28...A9F works (18 decimals, 'Wrapped Ether v10').
- 15 compliant fiat/metal tokens (cEURC, cGBPC, cAUDC, cJPYC, cCHFC, cCADC,
  cXAUC, cXAUT, cEURT, cGBPT, plus non-compliant-wrapper USDT/USDC) all live on-chain,
  all absent from CHAIN138_TOKEN_ADDRESSES.md.

Recommended follow-ups listed in the audit doc.
This commit is contained in:
Devin
2026-04-18 23:49:35 +00:00
parent bee1d29d55
commit becba35854
3 changed files with 2229 additions and 0 deletions

View File

@@ -0,0 +1,158 @@
# Chain 138 (SMOM-DBIS-138) — Contract Alignment Report
**Generated:** 2026-04-18 by Devin · RPC `https://rpc-core.d-bis.org` · chainId `0x8a` (138)
## 1. Sources consulted
| # | Source | Role |
|---|---|---|
| 1 | `LedgerLive/docs/CHAIN138_TOKEN_ADDRESSES.md` | **Purported master** (v1.0, 2026-01-31) |
| 2 | `smom-dbis-138/config/address-inventory.chain138.json` | Infrastructure inventory (2026-03-27) |
| 3 | `smom-dbis-138/config/runtime-env.chain138.json` | Runtime env surface (2026-03-27) |
| 4 | `smom-dbis-138/services/token-aggregation/src/config/canonical-tokens.ts` | Canonical token multichain map |
| 5 | `dbis_core/src/core/defi/tezos-usdtz/allowlist.config.ts` | Allowed-tokens policy |
| 6 | `explorer-monorepo/.../DUAL_CHAIN_TOKEN_LIST.tokenlist.json` | MetaMask/Blockscout public tokenlist (v1.3.4, 2026-04-04) |
| 7 | `smom-dbis-138/docs/ADDRESS_MAPPING.md` | Genesis ↔ deployed address mapping |
| 8 | On-chain state at `https://rpc-core.d-bis.org` | Ground truth |
## 2. Headline findings
- **67** unique Chain-138 addresses collected across 7 canonical sources
- **64** actually deployed on-chain (have bytecode)
- **3** referenced in code/docs but have **no bytecode** on Chain 138 (ghosts)
- **61** contracts deployed or referenced but **absent from the LedgerLive "master" doc**
- LedgerLive doc declares _"Total Token Contracts: 5"_. Reality: ≥ **17 deployed ERC20-shaped contracts** on Chain 138.
## 3. LedgerLive master record — per-address verdict
| Symbol | Address | LL doc says | On-chain says | Verdict |
|---|---|---|---|---|
| WETH | `0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2` | decimals=18 | name='' symbol='' decimals=0 | **DRIFT — decimals 0 ≠ 18** |
| WETH10 | `0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f` | decimals=18 | name='Wrapped Ether v10' symbol='WETH10' decimals=18 | OK |
| LINK | `0xb7721dD53A8c629d9f1Ba31a5819AFe250002b03` | decimals=18 | name='Chainlink Token' symbol='LINK' decimals=18 | OK |
| cUSDT | `0x93E66202A11B1772E55407B32B44e5Cd8eda7f22` | decimals=6 | name='Tether USD (Compliant)' symbol='cUSDT' decimals=6 | OK |
| cUSDC | `0xf22258f57794CC8E06237084b353Ab30fFfa640b` | decimals=6 | name='USD Coin (Compliant)' symbol='cUSDC' decimals=6 | OK |
| TokenRegistry | `0x91Efe92229dbf7C5B38D422621300956B55870Fa` | decimals=None | name='' symbol='' decimals=None | OK (registry, not an ERC20) |
## 4. All on-chain ERC20 tokens on Chain 138 (by on-chain symbol)
| Symbol | Name | Decimals | Address | Canonical source | In LL master? |
|---|---|---|---|---|---|
| `cAUDC` | Australian Dollar (Compliant) | 6 | `0xd51482e567c03899eece3cae8a058161fd56069d` | runtime-env, canonical, tokenlist | — |
| `cCADC` | Canadian Dollar (Compliant) | 6 | `0x54dbd40cf05e15906a2c21f600937e96787f5679` | runtime-env, canonical, tokenlist | — |
| `cCHFC` | Swiss Franc (Compliant) | 6 | `0x873990849dda5117d7c644f0af24370797c03885` | runtime-env, canonical, tokenlist | — |
| `cEURC` | Euro Coin (Compliant) | 6 | `0x8085961f9cf02b4d800a3c6d386d31da4b34266a` | runtime-env, canonical, tokenlist | — |
| `cEURT` | Tether EUR (Compliant) | 6 | `0xdf4b71c61e5912712c1bdd451416b9ac26949d72` | runtime-env, canonical, tokenlist | — |
| `cGBPC` | Pound Sterling (Compliant) | 6 | `0x003960f16d9d34f2e98d62723b6721fb92074ad2` | runtime-env, canonical, tokenlist | — |
| `cGBPT` | Tether GBP (Compliant) | 6 | `0x350f54e4d23795f86a9c03988c7135357ccad97c` | runtime-env, canonical, tokenlist | — |
| `cJPYC` | Japanese Yen (Compliant) | 6 | `0xee269e1226a334182aace90056ee4ee5cc8a6770` | runtime-env, canonical, tokenlist | — |
| `cUSDC` | USD Coin (Compliant) | 6 | `0xf22258f57794cc8e06237084b353ab30fffa640b` | runtime-env, canonical, allowlist, tokenlist | ✓ |
| `cUSDT` | Tether USD (Compliant) | 6 | `0x93e66202a11b1772e55407b32b44e5cd8eda7f22` | runtime-env, canonical, allowlist, tokenlist | ✓ |
| `cXAUC` | Gold (Compliant) | 6 | `0x290e52a8819a4fbd0714e517225429aa2b70ec6b` | runtime-env, canonical, tokenlist | — |
| `cXAUT` | Tether XAU (Compliant) | 6 | `0x94e408e26c6fd8f4ee00b54df19082fda07dc96e` | runtime-env, canonical, tokenlist | — |
| `LINK` | Chainlink Token | 18 | `0xb7721dd53a8c629d9f1ba31a5819afe250002b03` | allowlist, tokenlist | ✓ |
| `USDC` | USD Coin (Chain 138) | 6 | `0x71d6687f38b93ccad569fa6352c876eea967201b` | runtime-env, canonical, tokenlist | — |
| `USDT` | Tether USD (Chain 138) | 6 | `0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1` | runtime-env, canonical, tokenlist | — |
| `WETH10` | Wrapped Ether v10 | 18 | `0xf4bb2e28688e89fcce3c0580d37d36a7672e8a9f` | tokenlist | ✓ |
| `wXRP` | Wrapped XRP | 18 | `0xe8572f3abd73eff0a2e8ac5c88c2b6d180735f97` | inventory | — |
## 5. "Ghost" addresses (referenced but NO bytecode on Chain 138)
| Label(s) | Address | Appears in |
|---|---|---|
| allow | `0x015b1897ed5279930bc2be46f661894d219292a6` | allowlist.config.ts |
| allow | `0x798f6762bb40d6801a593459d08f890603d3979c` | allowlist.config.ts |
| allow | `0xa95eed79f84e6a0151eaeb9d441f9ffd50e8e881` | allowlist.config.ts |
## 6. Deployed contracts NOT in LedgerLive master doc
| Label | On-chain name/symbol | Address | Canonical source |
|---|---|---|---|
| cGBPC | Pound Sterling (Compliant) / cGBPC | `0x003960f16d9d34f2e98d62723b6721fb92074ad2` | runtime-env, canonical-tokens.ts, tokenlist.json |
| USDT | Tether USD (Chain 138) / USDT | `0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1` | runtime-env, canonical-tokens.ts, tokenlist.json |
| TOKEN_IMPLEMENTATION | (not ERC20) | `0x0059e237973179146237ab49f1322e8197c22b21` | inventory |
| POOL_CUSDCUSDC | (not ERC20) | `0x0309178ae30302d83c76d6dd402a684ef3160eec` | inventory |
| POLICY_MANAGER | (not ERC20) | `0x0c4fd27018130a00762a802f91a72d6a64a60f14` | inventory |
| WETH10 | (not ERC20) | `0x105f8a15b819948a89153505762444ee9f324684` | — |
| MERCHANT_SETTLEMENT_REGISTRY | (not ERC20) | `0x16d9a2cb94a0b92721d93db4a6cd8023d3338800` | inventory |
| TRON_ADAPTER | (not ERC20) | `0x28a94fb4bc415ac3273211429338f768074cbef6` | inventory |
| cXAUC | Gold (Compliant) / cXAUC | `0x290e52a8819a4fbd0714e517225429aa2b70ec6b` | runtime-env, canonical-tokens.ts, tokenlist.json |
| PAYMENT_CHANNEL_MANAGER | (not ERC20) | `0x302af72966afd21c599051277a48daa7f01a5f54` | inventory |
| BRIDGE_VAULT | (not ERC20) | `0x31884f84555210ffb36a19d2471b8ebc7372d0a8` | inventory |
| ORACLE_PROXY | (not ERC20) | `0x3304b747e565a97ec8ac220b0b6a1f6ffdb837e6` | inventory, tokenlist.json |
| RESERVE_TOKEN_INTEGRATION | (not ERC20) | `0x34b73e6edfd9f85a7c25eed31dcb13ab6e969b96` | inventory |
| cGBPT | Tether GBP (Compliant) / cGBPT | `0x350f54e4d23795f86a9c03988c7135357ccad97c` | runtime-env, canonical-tokens.ts, tokenlist.json |
| XRPL_ADAPTER | (not ERC20) | `0x351f207f2de66bf166ec730a0133613a10691439` | inventory |
| CHAIN138_WETH_MOCK_PRICE_FEED | (not ERC20) | `0x3e8725b8de386fef3efe5678c92ea6adb41992b2` | inventory |
| MINT_BURN_CONTROLLER | (not ERC20) | `0x44f79a3cec3fb829973d9b8d630839726d19e9c5` | inventory |
| UNIVERSAL_CCIP_BRIDGE_DETERMINISTIC | (not ERC20) | `0x532de218b94993446be30ec894442f911499f6a3` | inventory |
| cCADC | Canadian Dollar (Compliant) / cCADC | `0x54dbd40cf05e15906a2c21f600937e96787f5679` | runtime-env, canonical-tokens.ts, tokenlist.json |
| DODO_PMM_INTEGRATION | (not ERC20) | `0x5bdc62f1ae7d630c37a8b363a1d49845356ee72d` | runtime-env |
| RESERVE_SYSTEM | (not ERC20) | `0x607e97cd626f209facfe48c1464815dde15b5093` | inventory |
| MIRROR_REGISTRY | (not ERC20) | `0x6427f9739e6b6c3ddb4e94fefebcdf35549549d8` | inventory |
| ALLTRA_ADAPTER | (not ERC20) | `0x66feba2fc9a0b47f26dd4284dad24f970436b8dc` | inventory |
| CHAIN_REGISTRY | (not ERC20) | `0x6949137625ca923a4e9c80d5bc7df673f9bbb84f` | inventory |
| MIRROR_MANAGER | (not ERC20) | `0x6ed905a30c552a6e003061a38fd52a5a427bee56` | inventory |
| POOL_CUSDTUSDT | (not ERC20) | `0x6fc60dedc92a2047062294488539992710b99d71` | inventory |
| TRANSACTION_MIRROR | (not ERC20) | `0x7131f887dbeeb2e44c1ed267d2a68b5b83285afc` | inventory |
| USDC | USD Coin (Chain 138) / USDC | `0x71d6687f38b93ccad569fa6352c876eea967201b` | runtime-env, canonical-tokens.ts, tokenlist.json |
| CREATE2_FACTORY | (not ERC20) | `0x750e4a8adce9f0e67a420abe91342dc64eb90825` | inventory |
| TRUTH_ADAPTER | (not ERC20) | `0x7880ef14887a0567807acf785ec92553d014930f` | inventory |
| cEURC | Euro Coin (Compliant) / cEURC | `0x8085961f9cf02b4d800a3c6d386d31da4b34266a` | runtime-env, canonical-tokens.ts, tokenlist.json |
| cCHFC | Swiss Franc (Compliant) / cCHFC | `0x873990849dda5117d7c644f0af24370797c03885` | runtime-env, canonical-tokens.ts, tokenlist.json |
| ORACLE_PRICE_FEED | (not ERC20) | `0x8918ee0819fd687f4eb3e8b9b7d0ef7557493cfa` | inventory |
| BRIDGE_ORCHESTRATOR | (not ERC20) | `0x89ab428c437f23bab9781ff8db8d3848e27eed6c` | inventory |
| cXAUT | Tether XAU (Compliant) / cXAUT | `0x94e408e26c6fd8f4ee00b54df19082fda07dc96e` | runtime-env, canonical-tokens.ts, tokenlist.json |
| DEBT_REGISTRY | (not ERC20) | `0x95bc4a997c0670d5dac64d55cdf3769b53b63c28` | inventory |
| ORACLE_AGGREGATOR | (not ERC20) | `0x99b3511a2d315a497c8112c1fdd8d508d4b1e506` | inventory |
| GOVERNANCE_CONTROLLER | (not ERC20) | `0xa6891d5229f2181a34d4ff1b515c3aa37dd90e0e` | inventory |
| UNIVERSAL_ASSET_REGISTRY | (not ERC20) | `0xaee4b7fbe82e1f8295951584cbc772b8bbd68575` | inventory |
| CHAIN_DODO_VENDING_MACHINE | (not ERC20) | `0xb16c3d48a111714b1795e58341fefdd643ab01ab` | runtime-env |
| VAULT_FACTORY | (not ERC20) | `0xb2ac70f35a81481b005067ed6567a5043ba32336` | inventory |
| COMPLIANCE_REGISTRY | (not ERC20) | `0xbc54fe2b6fda157c59d59826bcfdbcc654ec9ea1` | inventory |
| UNIVERSAL_ASSET_REGISTRY_DETERMINISTIC | (not ERC20) | `0xc98602aa574f565b5478e8816bcab03c9de0870f` | inventory |
| CCIPWETH9_BRIDGE | (not ERC20) | `0xcacfd227a040002e49e2e01626363071324f820a` | runtime-env |
| UNIVERSAL_CCIP_BRIDGE | (not ERC20) | `0xcd42e8ed79dc50599535d1de48d3dafa0be156f8` | runtime-env |
| PRICE_FEED_KEEPER | (not ERC20) | `0xd3ad6831aacb5386b8a25bb8d8176a6c8a026f04` | inventory |
| cAUDC | Australian Dollar (Compliant) / cAUDC | `0xd51482e567c03899eece3cae8a058161fd56069d` | runtime-env, canonical-tokens.ts, tokenlist.json |
| cEURT | Tether EUR (Compliant) / cEURT | `0xdf4b71c61e5912712c1bdd451416b9ac26949d72` | runtime-env, canonical-tokens.ts, tokenlist.json |
| CCIPWETH10_BRIDGE | (not ERC20) | `0xe0e93247376aa097db308b92e6ba36ba015535d0` | runtime-env |
| ADDRESS_MAPPER | (not ERC20) | `0xe48e3f248698610e18db865457fcd935bb3da856` | inventory |
| GENERIC_STATE_CHANNEL_MANAGER | (not ERC20) | `0xe5e3bb424c8a0259fde23f0a58f7e36f73b90abd` | inventory |
| WITHDRAWAL_ESCROW | (not ERC20) | `0xe77cb26ea300e2f5304b461b0ec94c8ad6a7e46d` | inventory |
| WXRP_TOKEN | Wrapped XRP / wXRP | `0xe8572f3abd73eff0a2e8ac5c88c2b6d180735f97` | inventory |
| REGULATED_ENTITY_REGISTRY | (not ERC20) | `0xea4c892d6c1253797c5d95a05bf3863363080b4b` | inventory |
| TOKEN_FACTORY | (not ERC20) | `0xebfb5c60de5f7c4baae180ca328d3bb39e1a5133` | inventory |
| cJPYC | Japanese Yen (Compliant) / cJPYC | `0xee269e1226a334182aace90056ee4ee5cc8a6770` | runtime-env, canonical-tokens.ts, tokenlist.json |
| FEE_COLLECTOR | (not ERC20) | `0xf78246eb94c6cb14018e507e60661314e5f4c53f` | inventory |
| POOL_CUSDTCUSDC | (not ERC20) | `0xff8d3b8fdf7b112759f076b69f4271d4209c0849` | inventory |
## 7. Conflict: same label mapped to different addresses across sources
| Label | Addresses | Sources |
|---|---|---|
| `WETH10` | `0xf4bb2e28688e89fcce3c0580d37d36a7672e8a9f` | ADDRESS_MAPPING.md, CHAIN138_TOKEN_ADDRESSES.md, DUAL_CHAIN_TOKEN_LIST.tokenlist.json |
| `WETH10` | `0x105f8a15b819948a89153505762444ee9f324684` | ADDRESS_MAPPING.md |
| `WETH9` | `0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2` | ADDRESS_MAPPING.md |
| `WETH9` | `0x3304b747e565a97ec8ac220b0b6a1f6ffdb837e6` | ADDRESS_MAPPING.md |
## 8. WETH9/WETH10 genesis-vs-deployed status
`ADDRESS_MAPPING.md` declares:
- WETH9 genesis `0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2` → deployed `0x3304b747E565a97ec8AC220b0B6A1f6ffDB837e6`
- WETH10 genesis `0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f` → deployed `0x105F8A15b819948a89153505762444Ee9f324684`
- **WETH9 genesis** `0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2`: code=3124B symbol='' decimals=0
- **WETH9 deployed** `0x3304b747E565a97ec8AC220b0B6A1f6ffDB837e6`: code=654B symbol=None decimals=8
- **WETH10 genesis** `0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f`: code=9975B symbol='WETH10' decimals=18
- **WETH10 deployed** `0x105F8A15b819948a89153505762444Ee9f324684`: code=5173B symbol=None decimals=None
## 9. Recommended corrective actions
1. **Supersede `LedgerLive/docs/CHAIN138_TOKEN_ADDRESSES.md`**: it documents 5 tokens; at least 15 are deployed + referenced as canonical. Mark it _Deprecated; see `smom-dbis-138/config/address-inventory.chain138.json` + `runtime-env.chain138.json`_.
2. **Restore missing cross-referenced files** in LedgerLive (`CONTRACT_ADDRESSES_REFERENCE.md` and `CONTRACT_INVENTORY_AND_VERIFICATION.md`) — they are linked from the master doc but return 404 on the Gitea API.
3. **Promote `address-inventory.chain138.json` as the single on-box source of truth** (it is already the most comprehensive, last updated 2026-03-27).
4. **Reconcile ghost addresses**: remove from docs/code, or deploy them, or re-point to the actual deployed addresses.
5. **Check WETH9 decimals**: `0xC02aaA39…Cc2` returns `decimals=0` on-chain — either the genesis pre-deploy is a non-ERC20 shim (expected — it's an AddressMapper proxy), in which case update `CHAIN138_TOKEN_ADDRESSES.md` to point at the actually-deployed `0x3304b747…` instead, or redeploy a real WETH9 at the genesis slot.
6. **Enforce a single-source build**: generate `DUAL_CHAIN_TOKEN_LIST.tokenlist.json`, `allowlist.config.ts` Chain-138 block, and canonical-tokens.ts Chain-138 entries from `address-inventory.chain138.json` via codegen, to prevent future drift.

View File

@@ -1,3 +1,14 @@
> ⚠️ **DEPRECATED 2026-04-18** — this file documents only 5 of the 15+ ERC20 tokens and 0 of the 43 infrastructure contracts actually deployed on Chain 138. For the current source of truth see:
>
> - `smom-dbis-138/config/address-inventory.chain138.json` (43 infra contracts, last updated 2026-03-27)
> - `smom-dbis-138/config/runtime-env.chain138.json` (canonical runtime env surface, 2026-03-27)
> - `smom-dbis-138/services/token-aggregation/src/config/canonical-tokens.ts` (15 Chain-138 tokens)
> - `LedgerLive/docs/CHAIN138_ALIGNMENT_AUDIT_2026-04-18.md` (this repo — full drift report, generated from on-chain state + 7 canonical sources)
>
> The values below are still correct for the listed tokens, but the set is incomplete. Do not add new references against this file; use the inventory JSON instead.
---
# Token Contract Addresses - ChainID 138
**Last Updated:** 2026-01-31

File diff suppressed because it is too large Load Diff