memba_arcade_leaderboard_v1 state

AddAttester

AddAttester allowlists an ADDRESS (the backend verifier's dedicated low-privilege key — never the deploy multisig itself) as an authorized result source. Owner only.

RemoveAttester

RemoveAttester revokes an attester key. Owner only.

Pause

Pause freezes all attestation + receipt requests (reads stay available). Owner only.

TransferOwnership

TransferOwnership stages a new owner; it takes effect only after AcceptOwnership is called BY that address (2-step, so a typo can't brick admin).

CancelOwnershipTransfer

CancelOwnershipTransfer withdraws a staged handoff. Owner only.

GetPendingOwner

AcceptOwnership

AcceptOwnership completes the handoff. Only the staged pendingOwner may call it.

MaxScore

MaxGameLen

MaxStatsLen

ReceiptsCap

ReceiptDailyCap

RequestCap

Entry

Entry is one attested, verifier-reproduced run result.

owner

pendingOwner

paused

attesters

// attester address string -> bool

boards

// "game|day|addr" -> \*Entry (competitive, one best per addr/game/day)

receipts

// addr string -> \[]\*Entry (training ring, mixed-game, capped)

logHashes

// "game|day|sha256" -> addr string (board slot: first-submitter-per-day)

hashOwners

// sha256 -> addr string (GLOBAL: a log binds to ONE address, ever)

requests

// "addr|sha256" -> int64 height (player-paid receipt requests)

requestCount

// addr string -> int (pending requests, capped at RequestCap)

boardCount

// "game|day" -> int (entries per game-day, O(1) reads)

init.25

seedAuthority

seedAuthority installs the publisher as owner. It runs once at package load.

assertOwner

assertNotPaused

isAttester

assertAttester

assertAttester is the single trust boundary: only the owner or an allowlisted attester key (the backend verifier) may write results. The verifier's own re-simulation gate is what makes an attested score meaningful — this realm only enforces that the source is trusted.

assertEntryShape

assertGameSlug

assertGameSlug validates the game slug shape: 1..MaxGameLen bytes of \[a-z0-9-]. The charset excludes '|' (and everything else), so a slug can never forge or split a composite key.

AttestScore

AttestScore writes (or improves) an address's entry on a game's competitive board for a day. Attester-only. The verifier batches a day's results into one multi-msg tx at day close, plus spam-capped singles for the "certify now" flow. Re-attesting the same game/address/day only ever RAISES the score (Second Wind). A log hash already attested for that game-day for a DIFFERENT address is rejected — on a shared daily seed a valid input log is portable, so first-submitter wins (replay-theft defense). \`stats\` is the attester-authored per-game JSON blob (waves, wins, levels, …) — never ranked, only echoed by reads.

AttestReceipt

AttestReceipt mints a personal training receipt — a verified "I did this run", never ranked. Attester-only; capped per address per (game, day) and ring-capped per address. Fulfills (and clears) a matching player-paid RequestReceipt if one is staged.

RequestReceipt

RequestReceipt is the player-paid leg: ANY signer stages an on-chain consent + payment anchor for one of their own runs (they pay this call's gas). The backend sees the event, verifies the stored log, and fulfills via AttestReceipt. Self-limiting: each request costs the caller gas, and one key slot per (addr, hash). Hash-scoped and game-agnostic on purpose — the verifier, not the player, decides which game the log replays under.

assertHashOwner

assertHashOwner enforces the GLOBAL one-log-one-address rule shared by both buckets (and by every game), and is idempotent for the rightful owner (Second Wind re-attests).

clearRequest

clearRequest removes a fulfilled request and frees the caller's cap slot.

itoa64

boolStr

publisherAtLoad

GetOwner

IsPaused

IsPaused reports whether attestation is frozen.

IsAttester

IsAttester reports whether an address is on the attester allowlist.

BoardCount

BoardCount returns how many addresses hold an entry on a game's board for a day (O(1)).

entryJSON

entryJSON emits one entry. \`stats\` is the attester's opaque JSON blob and is emitted as an ESCAPED STRING FIELD — never spliced raw into the document — so a malformed blob can corrupt nothing but itself.

GetEntryJSON

GetEntryJSON returns one address's board entry for a game-day, or "null".

dayEntries

dayEntries collects a game-day's board entries in canonical rank order: score desc, then earlier attestation, then address — a total order, so pagination is stable.

ranksAfter

ranksAfter reports whether a should sit AFTER b in rank order — a total order (score desc, then earlier attestation, then address) so pagination is stable and identical everywhere.

GetBoardJSON

GetBoardJSON returns a page of a game-day's board, rank-ordered, as {"game":…,"day":…,"total":N,"entries":\[…]}. Reads sort the day's entries on demand — fine for a testnet-scale board; a rank index (points\_v1-style) is the v2 upgrade if daily boards grow past a few thousand entries.

GetReceiptsJSON

GetReceiptsJSON returns a page of one address's training receipts (all games, newest first) as {"addr":…,"total":N,"entries":\[…]}.

Render

Render serves a human-readable snapshot: \`:board/\<game>/YYYY-MM-DD\` for a game-day's top entries, \`:receipts/\<addr>\` for an address's latest receipts.

jsonEscape

jsonEscape escapes a string for embedding in a JSON string literal (defensive — addresses are bech32 and hashes are hex, but the read path escapes regardless; the Render path reuses it to neutralize newlines/control chars in attester-authored stats).