morphit/docs/adr/0029-dai-multi-network-trade-only-addition.md

ADR-0029: DAI (Dai stablecoin) multi-network trade-only addition

Status: Accepted Date: 2026-05-18 Deciders: (@ken, claude) Supersedes: N/A Superseded by: N/A

Context

Part 122 cp31 adds DAI (Dai stablecoin) as the 9th tradable asset, the 3rd Category-B (trade-only) stablecoin, and the 3rd multi-network asset on Morphit.

DAI is the stablecoin issued by the MakerDAO protocol. It's a USD-pegged ERC-20-class token, multi-network across 4 chains: Ethereum (native), Polygon (PoS), Base, and Arbitrum. Unlike USDT (Tether Inc.) and USDC (Circle), DAI has no single corporate issuer with direct address-freeze power on the token contract. It is governed by holders of the MKR governance token via on-chain proposals.

DAI is requested because:

• Several active traders prefer DAI over USDT/USDC specifically for its more-decentralized governance and crypto-collateral history
• Adds a meaningful third stablecoin option for users who want fiat-pegged trading without committing to a single-issuer trust model
• Fits Morphit's federated, anti-chokepoint design philosophy

This ADR captures the design decisions, the honest privacy story (which is more nuanced than USDT/USDC), and the per-asset trade-offs.

Decisions

1. Networks supported: 4

Per the canonical MakerDAO deployments verified at addition time:

Network	Contract	Explorer
Ethereum	0x6b175474e89094c44da98b954eedeac495271d0f	etherscan.io
Polygon	0x8f3cf7ad23cd3cadbd9735aff958023239c6a063	polygonscan.com
Base	0x50c5725949a6f0c72e6c4a641f24049a917db0cb	basescan.org
Arbitrum	0xda10009cbd5d07dd0cecc66161fc93d7c9000da1	arbiscan.io

All four are EVM-format addresses (0x[40 hex]) — same cross-network-mis-send foot-gun as USDC's three EVM networks (cp30 ADR-0028). Network discriminator is the only way to tell them apart.

Networks intentionally NOT supported:

• Solana (SPL): No canonical Maker-issued DAI on Solana. Existing Solana DAI variants are wrapped/bridged tokens issued by third parties (e.g., Wormhole, Allbridge); using them on Morphit would require trusting ALSO the wrapper custodian, which defeats the "DAI is decentralized" rationale.
• BNB Smart Chain (BEP-20): Same concern — Binance-Peg DAI is wrapped, not Maker-native. Same exclusion rationale as ADR-0028 §1 for USDC on BEP-20.
• Tron (TRC-20): No canonical Maker-issued DAI on Tron.
• Arbitrum One vs Arbitrum Nova: Only Arbitrum One (the main rollup) ships in cp31. Nova is a separate chain with different security assumptions; adding it would be a separate decision.

If MakerDAO ships canonical native DAI on a new chain in the future, that's a per-network addition under this ADR; the asset-level structure is already in place.

2. Privacy warning: "partly_centralized" / DAI-specific tone

This is the trickiest design decision. USDT and USDC both ship the *_centralized warning class because each issuer can directly freeze addresses. DAI is different but NOT freeze-immune:

What DAI gets right (compared to USDT/USDC):

• The Dai token contract has no admin-controlled freeze function. Maker can't add an address to a blacklist and stop transfers.
• The protocol is governed by MKR token holders via on-chain votes; no single corporate entity controls it.
• A meaningful portion of DAI has historically been backed by overcollateralized ETH/WBTC vaults — pure-crypto collateral with no centralized dependency.

What DAI honestly cannot claim (the nuance):

• Since ~2020, DAI has used the Peg Stability Module (PSM) which holds USDC as collateral to dampen peg deviation. When DAI is partly backed by USDC, Circle's freeze power over USDC affects the redemption side of DAI's peg. This is a real, ongoing dependency.
• A future governance vote (MKR holders) could theoretically deploy a freeze mechanism or change the redemption mechanics. This hasn't happened in practice but it's possible.
• DAI transactions are publicly visible on each chain. Same on-chain transparency as USDT/USDC; no shielding on any supported network.

The warning key is dai_partly_centralized — distinct from the {usdt,usdc}_centralized class to signal the different threat model. i18n copy must give DAI credit for the no-direct-freeze-power point while being honest about the PSM/USDC backing dependency and the governance- upgradeability path. No marketing-style hype — Morphit's grandma-friendly principle requires plain factual statements that don't oversell.

3. Cross-network-mis-send warning: SAME AMPLIFICATION AS USDC

All 4 DAI networks use EVM 0x[40 hex] address format. A DAI-on-Polygon address is visually identical to a DAI-on-Base address. Buyer must explicitly confirm network before sending. Per-message cross-network warning in ChatMessage.svelte follows the USDC pattern (orange/yellow chip for DAI to keep it visually distinct from USDT amber and USDC Circle-blue).

4. Fee category: trade-only (Category B), fee_method enum FROZEN

Per Memory #23 + ADR-0014 + cp30 ADR-0028 §5: listing fees can ONLY be paid in BLURT, BTC, or XMR. DAI joins USDT/USDC/BCH/LTC/DASH as a trade-only asset. canPayListingFee: false.

The fee_method enum stays exactly 'blurt'|'waived_first_buy'|'btc'|'xmr'. This is enforced by three independent smokes (fee-method-enum-frozen-smoke, disabled-assets-wizard-smoke, dai-trade-only-smoke).

5. Amount-jitter: ENABLED, same as USDT + USDC

DAI gets 6-decimal-precision microunit jitter via the same jitterStablecoinAmount dispatcher cp30 added. Same rationale as ADR-0028 Decision 2: the centralization-vs-amount-correlation orthogonality applies here too. Amount-jitter doesn't address the PSM/USDC-backing dependency or governance upgradeability, but it does address the amount-correlation linkability threat that's independent of those.

6. Operators can disable DAI: same env-var mechanism

MORPHIT_INDEXER_DISABLED_ASSETS accepts DAI as a value. Operators running privacy-purist instances who want to keep their instance free of stablecoins can disable DAI alongside USDT and USDC.

7. Brand presentation: respectful, factual, no marketing hype

Per Ken's standing instruction (Memory #29: "Marketing copy about any asset must be respectful to that coin's community — factual trade-offs, no value-judgments"), DAI's presentation:

• Acknowledges its decentralization advantages over single-issuer stablecoins
• Does NOT use marketing words like "true decentralization" or "censorship-resistant" that overstate the PSM/governance reality
• Does NOT denigrate USDT/USDC — different design choices serve different users
• The per-asset privacy guide at /privacy/dai gives users a complete factual picture so they can choose

8. Wire-format: identical pattern to USDC

DAI follows the cp30 USDC wire-format playbook exactly:

• network field REQUIRED for DAI in chat AddressPayload + FundsSentPayload
• asset_network field REQUIRED for DAI orders + orderReplace
• Cross-validation: per-network address shape against decoded network (cp30-DD-DD SEC-3 pattern)
• Defense-in-depth template validation for the 4 new per-network chat-link URLs (cp30-DD-DD SEC-1 pattern)
• Symmetric encoder validation (cp30-DD-DD SEC-6 pattern)
• 0x-prefix normalization for all 4 EVM networks (cp30-DD-DD SEC-4 pattern)
• Replace handler locks asset_network as substance (cp30-DD-DD CODE-3 pattern)

The 4 canonical wire-format surfaces (cp30-DD LL #23) all extended in the same checkpoint:

1. Frontend store interface + defensive fallback + fetch normalization
2. Indexer-side InstanceResponse interface + body construction
3. Indexer-client mirror
4. Matrix-bot api-response-shape-smoke ChatLinkUrlsSchema

Consequences

Smoke count

• New: dai-trade-only-smoke.ts (~14 scenarios mirroring usdc-trade-only-smoke)
• Updated: every smoke that grep's asset-ticker enumeration (cp30-DD-DD LL #25)
• Wiring-completeness CHECK rows added for DAI inclusion

Asset count

• ASSET_TICKERS goes from 8 → 9
• ChatAssetTicker union: 8 → 9 lowercase variants
• Multi-network assets: USDT, USDC, DAI (3 of 9)
• Category B trade-only assets: USDT, USDC, BCH, LTC, DASH, DAI (6 of 9)

Locale parity

3 new FAQ entries × 10 locales + DAI per-network metadata + privacy warning copy + post-order tooltip + per-asset guide copy ≈ +150-200 keys per locale. Exact final parity confirmed at end of cp31.

Mediakit + brag list

New brag entries: DAI peer-to-peer multi-network + DAI per-asset privacy guide + the more-decentralized-but-honest framing.

Alternatives considered

Single-network DAI (Ethereum only)

Would lose Polygon/Base/Arbitrum users (high gas on mainnet is the main DAI complaint). Multi-network gives users cheap-trade options. Rejected.

Include Wormhole/Allbridge wrapped DAI on Solana

Defeats the "DAI is decentralized" rationale — wrapper custodian becomes another trust assumption. Rejected.

Same *_centralized warning class as USDT/USDC

Misrepresents DAI's actual properties. Lumping DAI in with the directly- freezable stablecoins would unfairly penalize the design choices Maker made. Rejected in favor of a distinct dai_partly_centralized warning class with honest, specific copy.

No warning at all (treat as decentralized)

Misrepresents DAI's PSM/USDC backing dependency and governance upgradeability path. Grandma-friendly principle requires plain factual disclosure. Rejected.

References

• ADR-0023 (USDT multi-network, cp3)
• ADR-0028 (USDC multi-network, cp30) — the playbook this ADR follows
• Memory #19 (privacy is priority #1)
• Memory #23 (fee_method enum frozen)
• Memory #29 (asset marketing respect)
• cp30-DD-DD LL #23 (4 canonical wire-format surfaces)
• cp30-DD-DD LL #27 (16 changes per 4-network asset addition)