bounty_panel

curl -sS 'https://pearl.testnets.gno.land/r/g1ut6uspuh73e02yauxpmyt8g3wwddaq8utagvm3/bounty_panel$download&file=bounty_panel.gno' | shasum -a 256

Overview

Realm bounty_panel is a public bounty board whose resolution authority is separated from its funding authority.

A funder escrows GNOT behind a bounty and, AT CREATION, names a panel of resolvers and an M-of-N threshold. Contributors submit work on-chain during a submission window. After that window closes the panel votes on the competing submissions, and the first submission to reach M votes wins the escrow. Neither the panel nor the threshold can change after creation.

WHY THIS EXISTS (see DISCOVERY.md): the sibling realm `grants` already implements escrowed rewards, on-chain submissions, restricted award and a permissionless refund valve — but there the resolver IS the funder. On a public bounty with open submissions that is the wrong trust model: the deciding party has a financial interest in the outcome and sees every submission before deciding. This realm exists for exactly that delta and reuses everything else.

COMPOSITION: all balance accounting is delegated to feeledger, all coin movement to coinio, and all free-text render output to the ecosystem sanitizer p/nt/markdown/sanitize/v0. This realm owns only the bounty state machine: bounty records, panels, submissions, votes, open-escrow total, deadlines, and roles.

LIFECYCLE (terminal states are frozen; one transition per bounty):

CreateBounty (EOA + -send) : escrow -> openTotal, status Open; panel + threshold + fee bps all SNAPSHOTTED at creation Submit (also re-submit) : while Open and height < submitDeadline; keyed by the caller's own address; funder and panel barred Vote (panel only) : while Open and submitDeadline <= height < resolveDeadline; one live vote per resolver, changeable until the threshold is reached; the Mth vote for a submission awards the bounty ATOMICALLY (Open -> Awarded) CancelBounty (funder only) : Open -> Cancelled, fee-free refund — ONLY while no submission exists ExpireBounty (ANYONE) : Open -> Expired once height >= resolveDeadline + ExpiryGraceBlocks; fee-free refund to the funder — the permissionless valve against a panel that never resolves (but see THE ONE CAVEAT below) Claim / ClaimAll (anyone) : pays out the caller's own ledger balance (winnings and refunds) WithdrawFees (fee recipient): pays out the fee pot

WHY THE WINDOWS DO NOT OVERLAP: submissions close at submitDeadline and voting opens at the same height. A resolver therefore votes only on content that can no longer change, which removes the bait-and- switch where a submission collects votes and is then edited. It also means no submission can be added in response to the votes already cast.

THE ONE CAVEAT ON THE EXPIRY VALVE, stated rather than glossed: both ways out of an Open bounty — award and refund — credit the shared feeledger, so both fail while that ledger is saturated at the int64 boundary, and the escrow is temporarily immovable in BOTH directions until some account claims down. Nothing is lost and the valve works again as soon as the ledger has headroom (this is exercised in TestSaturatedAwardCannotTrapFunds). The state requires liabilities within ~50 of 2^63-1 ugnot, which exceeds the real GNOT supply by orders of magnitude and is unreachable absent a chain-level minting bug, since every credit is backed by an escrowed -send. So: the valve makes fund-trapping impossible under any reachable condition, which is a weaker claim than "impossible" and is the true one.

WHY CANCEL IS RESTRICTED: in `grants` the creator may cancel at any time while open. Here, once a single contributor has submitted work, the funder can no longer unilaterally reclaim the escrow — only the panel (by awarding) or the expiry valve (after the resolution window) can end the bounty. This is the concrete anti-harvest guarantee that a public bounty needs and a grant programme does not.

AUTHORIZATION: every identity is derived from the crossing entrypoint's cur.Previous().Address() — no function takes a caller identity as a parameter. Submissions, votes and claimable balances are keyed by that runtime-derived address, so altering another user's submission, casting another resolver's vote, or claiming another user's winnings is impossible by construction.

PANEL INTEGRITY, fixed at creation and immutable thereafter: the panel is non-empty, free of duplicates, every member is a valid bech32 address, and 1 <= threshold <= panelSize. Panel members may not submit work, so a resolver cannot vote for their own submission. The funder MAY be a panel member — barring them would be unenforceable theatre (a funder can always name an address they control), and the panel is public on-chain from creation, so a self-resolved bounty is visible to contributors BEFORE they spend effort. Disclosure beats a prohibition that cannot be enforced.

FEE MODEL: fee = floor(amount * bps / 10000), rounding favors the winner; no minimum fee; bps snapshotted into the bounty at creation, so SetFeeBps affects future bounties only (closes the award-time admin race), and CreateBounty takes the caller's own maxFeeBps ceiling, rejecting creation if the live fee exceeds what the funder signed for (closes the creation-time race); hard compile-time cap MaxFeeBps (10%); refunds (cancel/expire) are always fee-free.

MONETARY INVARIANT (conservation): let H be ugnot held at this realm's address, B = openTotal (Σ amount over Open bounties), U the ledger's claimable balances, F the fee pot, S >= 0 out-of-band surplus:

H == B + U + F + S

Every transition moves value between exactly two terms inside one transaction: CreateBounty raises H and B together (coinio.Receive is the receipt-guaranteed shape); award/cancel/expire move amount from B into U+F with feeledger guaranteeing credited + fee == amount; claims and fee withdrawal debit the ledger before coinio.Payout moves the identical amount out (checks-effects-interactions); any panic aborts the whole transaction; this realm never issues or removes coins. Surplus is recoverable only via SweepDenom (fee recipient), which reserves Liabilities() = B + U + F.

ONLY GNOT: CreateBounty rejects any envelope that is not exactly one positive ugnot coin (coinio.Receive). Every other entrypoint rejects attached coins outright rather than converting them to sweepable surplus.

Imports

• chain
• chain/runtime
• chain/runtime/unsafe
• gno.land/p/g1ut6uspuh73e02yauxpmyt8g3wwddaq8utagvm3/coinio
• gno.land/p/g1ut6uspuh73e02yauxpmyt8g3wwddaq8utagvm3/feeledger
• gno.land/p/nt/avl/v0
• gno.land/p/nt/markdown/sanitize/v0
• strconv
• strings

Constants and variables

Bounty status values.

const (
	StatusOpen      = "open"
	StatusAwarded   = "awarded"
	StatusCancelled = "cancelled"
	StatusExpired   = "expired"
)

Input bounds.

const (
	MaxTitleLen = 80
	MaxDescLen  = 2000

	// MaxURILen bounds a submission's content reference. Submissions
	// carry a REFERENCE (a URL or content hash), not the work itself —
	// the chain cannot judge quality, and storing bulk content would
	// push an unbounded cost onto every future reader of this realm.
	MaxURILen = 500

	// MaxPanelSize bounds panel parsing, storage and Render cost.
	MaxPanelSize = int64(16)

	// MaxSubmissions bounds per-bounty state growth. Each submission
	// also costs its submitter a storage deposit, so this is a ceiling
	// on a cost that is already borne by the party creating it.
	MaxSubmissions = int64(500)

	// MinDurationBlocks / MaxDurationBlocks bound each configurable
	// window (~5s blocks: 1 block to ~580 days).
	MinDurationBlocks = int64(1)
	MaxDurationBlocks = int64(10_000_000)

	// ExpiryGraceBlocks after the resolution deadline, an Open bounty
	// becomes expirable by anyone (~8 minutes at 5s blocks — short
	// because this is a testnet deployment; a production fork would
	// raise it). The grace exists so that "the panel may still vote"
	// and "anyone may expire" are never simultaneously true.
	ExpiryGraceBlocks = int64(100)

	// MaxRenderRows bounds Render output. Render is reachable by any
	// viewer through gnoweb and vm/qrender, so its cost lands on third
	// parties rather than on whoever grew the state.
	MaxRenderRows = 20
)

Denom is the only asset this realm accepts.

const Denom = "ugnot"

MaxFeeBps is the hard protocol-fee cap: 1000 bps = 10%.

const MaxFeeBps = int64(1000)

RealmPath is this realm's own path, used to build Render links.

const RealmPath = "/r/g1ut6uspuh73e02yauxpmyt8g3wwddaq8utagvm3/bounty_panel"

Functions

BalanceOf

func BalanceOf(addr address) int64

BalanceOf returns addr's claimable balance (winnings + refunds).

BountyInfo

func BountyInfo(id int64) (funder address, title string, amount, feeBps, submitDeadline, resolveDeadline int64, status string, winner address, numSubmissions, panelSize, threshold int64)

BountyInfo returns a bounty's scalar fields by value.

CancelBounty

func CancelBounty(cur realm, id int64)

Crossing function. Callable from a transaction via MsgCall, and from another realm as CancelBounty(cross(cur), ...).

CancelBounty closes an open bounty and refunds its escrow to the funder, fee-free. Only the funder may cancel, and ONLY while no contributor has submitted: once work exists, the funder cannot unilaterally reclaim the escrow. Terminal.

Claim

func Claim(cur realm, amount int64)

Crossing function. Callable from a transaction via MsgCall, and from another realm as Claim(cross(cur), ...).

Claim sends amount ugnot of the caller's claimable balance (winnings and refunds) back to the caller.

ClaimAll

func ClaimAll(cur realm)

Crossing function. Callable from a transaction via MsgCall, and from another realm as ClaimAll(cross(cur), ...).

ClaimAll sends the caller's entire claimable balance back to the caller. Fails if there is nothing to claim.

CreateBounty

func CreateBounty(cur realm, title, description, panelCSV string, threshold, submitBlocks, resolveBlocks, maxFeeBps int64) int64

Crossing function. Callable from a transaction via MsgCall, and from another realm as CreateBounty(cross(cur), ...).

CreateBounty escrows the attached GNOT as a new open bounty and returns its id. Only direct EOA calls with -send are accepted.

panelCSV is a comma-separated list of resolver addresses; threshold is how many of them must name the same submission for it to win. Submissions are accepted for submitBlocks from now, after which the panel has resolveBlocks to decide.

The current protocol fee is snapshotted into the bounty and must not exceed maxFeeBps, the ceiling the caller signed for; pass MaxFeeBps to accept any legal fee.

Description

func Description(id int64) string

Description returns a bounty's raw description text.

ExpireBounty

func ExpireBounty(cur realm, id int64)

Crossing function. Callable from a transaction via MsgCall, and from another realm as ExpireBounty(cross(cur), ...).

ExpireBounty closes an open bounty whose resolution deadline passed more than ExpiryGraceBlocks ago, refunding the funder fee-free. ANYONE may call it — this is the permissionless valve that guarantees escrow can never be trapped by an inactive or deadlocked panel. Terminal.

FeeBps

func FeeBps() int64

FeeBps returns the fee that will be snapshotted into newly created bounties (existing bounties keep their own snapshot).

FeeOn

func FeeOn(amount int64) (fee, credited int64)

FeeOn previews the fee and net payout for a bounty of amount at the CURRENT FeeBps.

FeesAccrued

func FeesAccrued() int64

FeesAccrued returns the fee pot (the F term).

Height

func Height() int64

Height returns the current chain height (deadline arithmetic aid).

Held

func Held() int64

Held returns the ugnot actually held at the realm address (H).

IsPanelMember

func IsPanelMember(id int64, addr address) bool

IsPanelMember reports whether addr may vote on a bounty.

Liabilities

func Liabilities() int64

Liabilities returns everything this realm owes: openTotal + UsersTotal + FeesAccrued.

NumBounties

func NumBounties() int64

NumBounties returns how many bounties have ever been created.

OpenTotal

func OpenTotal() int64

OpenTotal returns the escrow held by open bounties (the B term).

Panel

func Panel(id int64) string

Panel returns a bounty's resolver addresses as a comma-separated list, in sorted order.

Render

func Render(path string) string

Render shows the board at "" and a bounty detail at "<id>". Free text (titles are charset-restricted; descriptions and URIs are not) passes through the ecosystem sanitizer before hitting markdown.

SetFeeBps

func SetFeeBps(cur realm, bps int64)

Crossing function. Callable from a transaction via MsgCall, and from another realm as SetFeeBps(cross(cur), ...).

SetFeeBps sets the protocol fee snapshotted into FUTURE bounties at creation. Existing bounties keep the fee they were created under. Admin only; bounded by [0, MaxFeeBps].

SetFeeRecipient

func SetFeeRecipient(cur realm, next address)

Crossing function. Callable from a transaction via MsgCall, and from another realm as SetFeeRecipient(cross(cur), ...).

SetFeeRecipient re-points the fee/surplus role, including the pot accrued so far. Admin only; zero address rejected.

SubmissionOf

func SubmissionOf(id int64, addr address) (uri string, height, votes int64, ok bool)

SubmissionOf returns addr's content reference, submission height and current vote count for a bounty, with ok reporting whether a submission exists.

Submit

func Submit(cur realm, id int64, uri string)

Crossing function. Callable from a transaction via MsgCall, and from another realm as Submit(cross(cur), ...).

Submit records (or replaces) the caller's submission to an open bounty before its submission deadline. One submission per address per bounty — re-submitting replaces the caller's own reference only. The funder and every panel member are barred, so no resolver can vote for their own work.

Surplus

func Surplus() int64

Surplus returns Held() - Liabilities() (the S term).

SweepDenom

func SweepDenom(cur realm, denom string)

Crossing function. Callable from a transaction via MsgCall, and from another realm as SweepDenom(cross(cur), ...).

SweepDenom sends the surplus of a single denomination to the fee recipient. For ugnot only the excess over Liabilities() moves; other denoms move wholly. Only the fee recipient may call it.

TransferAdmin

func TransferAdmin(cur realm, next address)

Crossing function. Callable from a transaction via MsgCall, and from another realm as TransferAdmin(cross(cur), ...).

TransferAdmin hands the admin role to next. Admin only; zero address rejected. One-step (documented trade-off, matching the siblings).

UsersTotal

func UsersTotal() int64

UsersTotal returns the sum of all claimable balances (the U term).

Vote

func Vote(cur realm, id int64, candidate address)

Crossing function. Callable from a transaction via MsgCall, and from another realm as Vote(cross(cur), ...).

Vote casts (or changes) the calling resolver's vote for one of the bounty's submissions. Only panel members may vote, and only after the submission window has closed and before the resolution deadline. A resolver holds exactly one live vote, changeable until the threshold is reached.

The vote that brings a submission to the threshold awards the bounty in the same transaction: the escrow leaves the open pool and is credited to the winner's claimable balance at the fee snapshotted at creation. Terminal.

VoteOf

func VoteOf(id int64, resolver address) (candidate string, ok bool)

VoteOf returns the submission a resolver currently votes for, with ok reporting whether that resolver has voted at all.

VotesCast

func VotesCast(id int64) int64

VotesCast returns how many resolvers currently hold a live vote.

WithdrawFees

func WithdrawFees(cur realm)

Crossing function. Callable from a transaction via MsgCall, and from another realm as WithdrawFees(cross(cur), ...).

WithdrawFees sends the accrued fee pot to the fee recipient. Only the fee recipient may call it.

---

Doc text is reproduced as vm/qdoc returns it. The node markdown-escapes doc comments, so a bracket or angle bracket may carry a backslash the committed source does not have. The source itself is at source and in this repository.