Create Uniswap pool for NODL on Ethereum L1

[Douglasacost]

Goal

Create a Uniswap pool on Ethereum L1 for NODL (0x6dd0E17ec6fE56c5f58a0Fe2Bb813B9b5cc25990), with the security of the pool and of the token economy verified first.

Context (verified on-chain, 2026-08-10)

• Bridge is burn-and-mint, no escrow (~/nodle/rollup): L1 supply ≈ 546.5M, L2 (zkSync Era) supply ≈ 6.9B, both 18 decimals, standard ERC20 semantics (no fee-on-transfer/rebase).
• The parachain is stopped: the zkSync ERC20 (0xBD4372e44c5eE654dd838304006E1f0f69983154) is the sole canonical token; the NODLMigration oracle bridge is permanently decommissioned (MINTER_ROLE revoked).
• Current minters — L1: old L1Bridge. L2: old L2Bridge, Rewards contract (0xe629...3d36, quota-limited oracle emissions), and the zkSync Safe itself (0x5e09...86C9).
• The zkSync Bridgehub cutover is pending (legacy Mailbox deprecation, ~mid-Sep 2026). It redeploys both bridges and rotates MINTER_ROLEs — runbook: ops/bridgehub-migration-cutover.md.

---

Dependency — owned by another team (not this task)

The Bridgehub cutover (bridge redeploys + MINTER_ROLE rotation, Safe audit, supply-finality statement) is handled by another team. This task does not track that work, but the pool launch is still gated on it:

• Get the other team's green light that the cutover is complete and post-checks passed, and note the new L1Bridge / L2Bridge addresses here before starting Phase 1. Launching mid-migration would open the pool while mint authorities are being rotated.
• SyncSwap unwind complete (Unwind SyncSwap NODL liquidity on zkSync — consolidate L2 to Koi #130) — L2 liquidity consolidated into Koi only; the freed inventory funds the L1 seed, and bridging it L2→L1 takes ~hours, so it must land before seeding.

Phase 1 — Create the pool securely

• Publish the canonical L1 address (0x6dd0...5990) on the website, docs, and as an additional chain on CoinGecko/CoinMarketCap; request an Etherscan token label. This is the defense against fake-NODL pools.
• Pick pool parameters deliberately: Uniswap version (v3 unless there's a v4 hook reason), pair (NODL/WETH is the neutral default), fee tier (1% fits a volatile mid-cap better than 0.3%; check what Koi uses).
• Set the initialization price from the Koi pool — the only L2 reference once Unwind SyncSwap NODL liquidity on zkSync — consolidate L2 to Koi #130 lands, which makes it a single, thinner source: use a TWAP over a longer window (not spot) and cross-check against aggregator/CEX mid-price before initializing. A lone thin pool is exactly the reference an attacker would nudge right before the seed.
• Initialize and seed atomically: one transaction (createAndInitializePoolIfNecessary + mint via multicall), submitted through a private RPC (e.g. Flashbots Protect) so the empty/mispriced pool is never publicly visible in the mempool.
• Custody: the Ethereum Safe holds the LP position (v3 NFT); no EOA ever holds protocol liquidity.
• Dry-run the full Safe bundle on a fork (Tenderly/anvil) before executing — the cutover postmortem showed Safe-mediated paths are exactly where unrehearsed steps fail.
• Choose the range policy for the position and write it down (full-range is simplest and most honest for protocol-owned liquidity; concentrated needs an active management policy).
• Smoke-test with a dust trade in both directions after seeding, before announcing.
• Announce only after everything above — with the pool address and the token address in the same message.

Phase 2 — Operate securely

• Peg monitoring: alert on L1 pool price deviating >X% from the Koi pool (sole L2 reference after Unwind SyncSwap NODL liquidity on zkSync — consolidate L2 to Koi #130), and on Paused events on either bridge (a paused bridge removes the arbitrage path — expect decoupling and know it's happening).
• Liquidity plan: decide target depth (e.g. max price impact for a $50k trade), how much inventory stays on each side of the bridge, and who arbs the peg back — remembering L2→L1 is ~hours while L1→L2 is minutes, so the L1 pool can run rich longer than it runs cheap.
• Incident playbook: what happens to the pool during a bridge pause or a mint alert — who is on call, whether/how POL is withdrawn, comms template. Write it before it's needed.

Broader token-economy hardening (Safe mint-role revocation, emission policy, oracle key, supply-invariant monitoring, LP disclosure) is tracked separately in #129.

Done when

• Pool live, seeded at market price, custodied by the Safe
• Canonical address published on all channels
• Peg + pause monitoring running and tested
• Liquidity plan and incident playbook written