Search Apps Documentation Source Content File Folder Download Copy Actions Download State String Boolean Number Struct Map Slice Pointer Function Closure Reference Nil Package Type Interface Unknown

v2 source realm

Constants 1

const MaxRecipients, MaxSplitsPerOwner, MaxRenderSplits, MaxFeeBps, MaxRecipientListLen, MaxShareListLen, Denom, MaxDepositAmount 

 1const (
 2	MaxRecipients     = 20
 3	MaxSplitsPerOwner = 10
 4	// Quotas are PER-OWNER only (round-4 audit): a global cap is a shared
 5	// resource 50 sybil accounts could fill forever — and seeding grief
 6	// splits with balances to keyless recipients made the fill
 7	// unrecoverable even by the sybils. Per-owner quotas mean an attacker
 8	// consumes only their own budget; state growth is gas-priced.
 9	// Render is bounded separately (MaxRenderSplits).
10	MaxRenderSplits = 100
11	// MaxFeeBps is an IMMUTABLE ceiling on the protocol fee (1%). The
12	// admin can set any fee from 0 up to this cap, never above it — the
13	// cap, not the current setting, is what users must trust.
14	MaxFeeBps = int64(100)
15
16	// Pre-parse input bounds (round-4 audit): caps were enforced only
17	// AFTER full parsing, so a 1MB recipient list burned ~11B gas before
18	// refusal. 20 bech32 addresses + separators fit well within these.
19	MaxRecipientListLen = 1024
20	MaxShareListLen     = 128
21
22	// Denomination handled by this realm. Deposits must be exactly one
23	// coin of this denom; claims pay out in it.
24	Denom = "ugnot"
25
26	// Largest single deposit for which share math (amount * share,
27	// share <= 10000) cannot overflow int64.
28	MaxDepositAmount = int64(9223372036854775807) / 10000
29)
source

Functions 17

func AcceptFeeAdmin

crossing Action 
1func AcceptFeeAdmin(cur realm)
source

AcceptFeeAdmin completes the handover; only the nominee can accept.

func AcceptOwnership

crossing Action 
1func AcceptOwnership(cur realm, splitID string)
source

AcceptOwnership completes the handover; only the nominee can accept. The nominee's quota is checked HERE, at consent time — the split slot moves only with the acceptor's own signature (v2 audit Y1: a recipient's quota is never consumed without consent). A nomination on a split that is later archived is inert (mustGetActive).

func Archive

crossing Action 
1func Archive(cur realm, splitID string)
source

Archive marks a fully-claimed split as archived. Only the owner can archive, and only if EVERY balance — including balances held by ex-recipients removed in a share update — is zero, since archiving blocks all further claims. Cannot be undone.

func Claim

crossing Action 
1func Claim(cur realm, splitID string) int64
source

Claim withdraws the caller's accumulated balance and SENDS the coins to the caller's address. Balance is zeroed before the transfer. Claims remain possible on frozen splits, and by ex-recipients whose accrued balance predates a share update.

func ClaimFees

crossing Action 
1func ClaimFees(cur realm) int64
source

ClaimFees sends all accrued protocol fees to the fee admin.

func CreateSplit

crossing Action 
1func CreateSplit(cur realm, recipientList, shareList string) string
source

CreateSplit registers a new split. The caller becomes the owner. Recipients and shares are comma-separated; shares are in basis points summing to 10000.

func Deposit

crossing Action 
1func Deposit(cur realm, splitID string)
source

Deposit distributes the coins sent with the call across recipients proportionally.

DEPLOYMENT PRECONDITION (round-4 audit): on a network with restricted/token-locked ugnot transfers, the bank gate is SENDER-whitelist-based — a whitelisted user's Deposit succeeds but Claim sends FROM this realm's (non-whitelisted) address and reverts. Funds would flow in and not out until the restriction lifts. Deploy only to networks with unrestricted ugnot, or have governance whitelist this realm's address first.

LIMITATION (round-3 audit, documented): only direct user calls can deposit. A DAO/realm treasury has NO deposit path — a realm-routed call is refused, and a bare banker send to this realm's address is an unrecoverable donation. Realm treasuries must route deposits through a user account. The deposit is the ACTUAL attached send — exactly one coin of Denom — so balances are always backed by funds this realm holds. Direct user calls only: a deposit routed through an intermediary realm would deliver its coins to that realm, not here, and must be rejected. Rounding dust goes to the highest-share recipient (deterministic, not order-dependent).

func Freeze

crossing Action 
1func Freeze(cur realm, splitID string)
source

Freeze permanently locks shares and stops further deposits. One-way, cannot be undone. Claims remain possible.

func GetClaimable

Action 
1func GetClaimable(splitID string, addr address) int64
source

GetClaimable returns claimable balance for an address.

func GetFeeInfo

Action 
1func GetFeeInfo() string
source

GetFeeInfo returns the current fee configuration and accrued total.

func GetPendingOwner

Action 
1func GetPendingOwner(splitID string) string
source

GetPendingOwner returns the staged nominee for a split, or "" when no handover is pending. The consent half of a two-step transfer only means something if the nominee can inspect the offer without paying gas to probe it (v2 audit Y1-obs); this is that read path.

func NominateFeeAdmin

crossing Action 
1func NominateFeeAdmin(cur realm, nominee address)
source

NominateFeeAdmin begins a two-step admin handover; the nominee must AcceptFeeAdmin. Pass "" to clear a pending nomination. Two-step because the admin address is a funds destination: a typo'd one-step transfer would strand all future fees.

func Render 

1func Render(path string) string
source

Render returns a markdown overview. Never panics.

func SetFee

crossing Action 
1func SetFee(cur realm, bps int64)
source

SetFee sets the protocol fee in basis points, admin only, hard-capped at MaxFeeBps. Applies to FUTURE deposits only.

func TransferOwnership

crossing Action 
1func TransferOwnership(cur realm, splitID string, newOwner address)
source

TransferOwnership stages a two-step ownership handover; nothing moves until the nominee calls AcceptOwnership. Two-step for the same reason as the fee admin, plus one more (v2 audit Y1): a one-step transfer consumed the RECIPIENT's per-owner quota without consent, so poisoned splits could burn a victim's slots unarchivably. Staging consumes nothing of the nominee's. Pass "" to clear a pending nomination.

func UpdateShares

crossing Action 
1func UpdateShares(cur realm, splitID, recipientList, shareList string)
source

UpdateShares replaces recipients and shares. Owner only. Not if frozen. Removed recipients keep any accrued balance and can still Claim it.

Types 1

type Split

struct 
 1type Split struct {
 2	Owner          address
 3	PendingOwner   address // two-step handover, must AcceptOwnership
 4	Recipients     []address
 5	Shares         []int64 // basis points, must sum to 10000
 6	Balances       map[address]int64
 7	TotalDeposited int64
 8	TotalClaimed   int64
 9	Frozen         bool
10	Archived       bool
11}
source

Split holds a fee-splitting configuration with percentage-based shares denominated in basis points (1 bp = 0.01%, 10000 bp = 100%).

Imports 6

  • chain stdlib
  • chain/banker stdlib
  • chain/runtime/unsafe stdlib
  • sort stdlib
  • strconv stdlib
  • strings stdlib

Source Files 3