fix: default to disallowing implicit remotables (#3736)

packages/marshal/src/helpers/remotable.js

@@ -35,12 +35,8 @@ const {
 //
 // TODO: once the policy changes to force remotables to be explicit, remove this
 // flag entirely and fix code that uses it (as if it were always `false`).
-//
-// Exported only for testing during the transition. The first step
-// will be to change the default, the second argument to `getEnvironmentOption`
-// below, from `'true'` to `'false'`.
 export const ALLOW_IMPLICIT_REMOTABLES =
-  getEnvironmentOption('ALLOW_IMPLICIT_REMOTABLES', 'true') === 'true';
+  getEnvironmentOption('ALLOW_IMPLICIT_REMOTABLES', 'false') === 'true';
 
 /**
  * @param {InterfaceSpec} iface

packages/zoe/src/contracts/vpool-xyk-amm/pool.js

@@ -2,6 +2,7 @@
 
 import { E } from '@agoric/eventual-send';
 import { assert, details as X } from '@agoric/assert';
+import { Far } from '@agoric/marshal';
 import { AssetKind, AmountMath, isNatValue } from '@agoric/ertp';
 import { makeNotifierKit } from '@agoric/notifier';
 
@@ -13,7 +14,7 @@ import {
 
 import '../../../exported.js';
 import { makePriceAuthority } from '../multipoolAutoswap/priceAuthority.js';
-import { makeSinglePool } from './singlePool';
+import { makeSinglePool } from './singlePool.js';
 
 // Pools represent a single pool of liquidity. Price calculations and trading
 // happen in a wrapper class that knows whether the proposed trade involves a
@@ -91,7 +92,7 @@ export const makeAddPool = (
     };
 
     /** @type {XYKPool} */
-    const pool = {
+    const pool = Far('pool', {
       getLiquiditySupply: () => liqTokenSupply,
       getLiquidityIssuer: () => liquidityIssuer,
       getPoolSeat: () => poolSeat,
@@ -183,7 +184,7 @@ export const makeAddPool = (
       getFromCentralPriceAuthority: () => fromCentralPriceAuthority,
       // eslint-disable-next-line no-use-before-define
       getVPool: () => vPool,
-    };
+    });
 
     const vPool = makeSinglePool(
       zcf,