Skip to content

ERC-1410: keep operator transfers in their partition - #301

Merged
Greaker merged 1 commit into
feature/tbd-payer-bound-cctfrom
feature/erc1410-partition-preserving-transfers
Sep 28, 2026
Merged

Greaker merged 1 commit into
feature/tbd-payer-bound-cctfrom
feature/erc1410-partition-preserving-transfers

Conversation

@Greaker

@Greaker Greaker commented Sep 28, 2026

Copy link
Copy Markdown
Contributor

Summary

  • operatorTransferByPartition no longer reads a destination partition from data; like transferByPartition, it always moves units within the given partition and treats data/operatorData as opaque payload. A partition's supply now changes only through mint and redemption.
  • _transferByPartition and _move take a single partition; ChangedPartition stays in IERC1410 but is never emitted. The bond stack never used partition changes (BondDvP passes empty data). The transferByPartition NatSpec is corrected.
  • The BondToken invariant suite runs two ISINs with a holder-transfer action and checks supply against offering per partition. BondToken ABI unchanged.

Stacked on #300 (base feature/tbd-payer-bound-cct); merge after it.

Test plan

  • cd contracts && forge fmt --check && forge build --sizes && forge test -vvv (395 passed, invariants included)
  • python3 scripts/verification/check-public-repo-hygiene.py && python3 scripts/verification/check-markdown-links.py
  • Contracts CI (Slither) green

operatorTransferByPartition no longer reads a destination partition from
the first 32 bytes of data. Like transferByPartition, it now always moves
units within the partition it is given and treats data and operatorData
as opaque event payload. The internal _transferByPartition and _move
helpers take a single partition, so a partition's supply changes only
through mint and redemption, and ChangedPartition stays in IERC1410 as
part of the standard surface but is never emitted. The bond stack never
used partition changes: BondDvP always passes empty data. The
transferByPartition NatSpec, which described a data-driven partition
switch it never performed, is corrected.

The BondToken invariant suite now runs two ISINs and a holder transfer
action that names either partition in data, and checks supply against
offering and holder balances per partition.

Tests: forge 395 passed (new: an operator transfer stays in its source
partition and emits no ChangedPartition; a unit moved with another
partition in data does not reduce that partition's issuance headroom;
extended invariants). The BondToken ABI is unchanged.
@Greaker
Greaker merged commit 64f74a7 into feature/tbd-payer-bound-cct Sep 28, 2026
3 checks passed
@Greaker
Greaker deleted the feature/erc1410-partition-preserving-transfers branch September 28, 2026 12:40
Greaker added a commit that referenced this pull request Sep 28, 2026
…300)

* Tbd: bind cctFrom to the payer and remove the unused nomination path

cctFrom now moves only the caller's own deposit, unless the caller is the
DvP contract passed to the Tbd constructor, which keeps settling on behalf
of the payer. CCT_FROM_CALLER_ROLE is still required. Any other caller
reverts with the new CctFromNotCaller error, so the payer rule lives in
the contract rather than in how the role is assigned.

The government-nomination path has had no consumer since bond cash legs
moved to wNOK, so it is removed: the constructor loses its reserve
argument, and govReserve, isGovernmentNominated, the reserve mint branch
in _update and NotGovernmentNominated are gone. The TBD and wNOK setup
scripts no longer allowlist the reserve on TBD Nordea or give it a wNOK
allowance there. The DvP settlement fixture now constructs its TBDs with
the DvP that settles, instead of deploying a second one afterwards.

The NB Bond API deploys created banks with the six-argument constructor
from refreshed Tbd ABI and bytecode artifacts, drops the government field
from the TBD DTO (OpenAPI regenerated), and the Banking page drops the
matching KPI. Contract reference, NatSpec pages and the TBD diagrams
describe the caller rule.

Tests: forge 393 passed (new: payer-only cctFrom and DvP settlement on
behalf of the payer); nb-bond-api jest 254 passed; nb-ui vitest 125
passed.

* ERC-1410: keep operator transfers in their partition (#301)

operatorTransferByPartition no longer reads a destination partition from
the first 32 bytes of data. Like transferByPartition, it now always moves
units within the partition it is given and treats data and operatorData
as opaque event payload. The internal _transferByPartition and _move
helpers take a single partition, so a partition's supply changes only
through mint and redemption, and ChangedPartition stays in IERC1410 as
part of the standard surface but is never emitted. The bond stack never
used partition changes: BondDvP always passes empty data. The
transferByPartition NatSpec, which described a data-driven partition
switch it never performed, is corrected.

The BondToken invariant suite now runs two ISINs and a holder transfer
action that names either partition in data, and checks supply against
offering and holder balances per partition.

Tests: forge 395 passed (new: an operator transfer stays in its source
partition and emits no ChangedPartition; a unit moved with another
partition in data does not reduce that partition's issuance headroom;
extended invariants). The BondToken ABI is unchanged.
@Greaker Greaker mentioned this pull request Oct 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant