Before launch: defects caught by the chain, NRO only for fees
Preparing for launch, we went through the defects of the past weeks and found what they had in common. Almost every one was a write to state owned by another shard, or value moved between shards without full accounting. Reviews found them one at a time. We decided the system should find them itself.
Ownership guard in the storage layer
Every write to the database now checks which shard owns the key. A write by a shard to a record it does not own rolls the whole transaction back, and in tests it names the call site. The approach follows NEAR, where state keys are scoped to the receiving account. On its first day the guard found four old defects; for example, every cross-shard transfer moved the sender's nonce on the other shard.
Supply invariant
Every shard keeps a ledger of how much NRO and of each asset was created, burned, sent to other
shards and received from them. Balances, trading accounts, pools and stakes must add up to the
ledger — the same idea as the TotalSupply invariant of the Cosmos SDK. The check runs in unit tests
and after every network test, and the series run before every merge covers both one and two shards.
NRO only as the fee currency
The DEX is on from day one, but NRO is not a trading asset: no pool with NRO, no NRO deposit to a
trading account. One governance parameter, dex_nro_tradable, decides it, so NRO pairs can later be
opened by a vote, without a release. We built on two existing mechanisms. In the Cosmos SDK, transfers
of a single coin are switched on and off by governance, and the Cosmos Hub launched exactly that way:
ATOM transfers were off at genesis and turned on by a vote. In Osmosis, governance sets which base
assets pools may use. If the parameter is switched off again, leaving stays open: liquidity and an
NRO balance can always be withdrawn.
Asset issue fee from the main balance
The asset issue fee is now paid from the main NRO balance, like gas, rather than from the trading account — as a pool creation fee is paid in Osmosis. When an asset is issued from another shard, the fee travels with the operation, and if the issue is refused (for example, the symbol is taken), the fee comes back in full.
Result
373 unit tests. The DEX network test was rewritten for an asset/asset pair and checks NRO refusals, an asset issued from another shard and the fee refund. The full series of 9 network tests passed, and the supply invariant held in every run. Next we check every path that applies a transaction against these two rules.