Admin operations — DAO-gated, with a 2-step admin handoff and a hard fee ceiling. There is intentionally NO Pause() h...
Admin operations — DAO-gated, with a 2-step admin handoff and a hard fee ceiling. There is intentionally NO Pause() here (see config.gno SAFETY note): pausing the fee spine would brick every engine at once. Per-engine Pause() is the kill switch.
Package memba_market_config is the DAO-owned fee spine for the Memba marketplace. It is the single source of truth for the per-lane protocol fee (basis points) and the treasury that receives it. Every trade engine (NFT, services, token-OTC, agents) reads GetFeeBPS(lane) + GetTreasury() at settlement, so the DAO sets the rate ONCE and it applies everywhere — that shared read is what makes the lanes one marketplace.
SAFETY (panel finding C1): the read getters are PURE and NON-FAILING — they never panic, and there is intentionally NO Pause(). A per-trade cross-realm read that could fail or halt would be a single point of failure able to brick every engine at once; instead an engine always gets a usable, bounded value here and clamps locally, while each engine keeps its OWN Pause() as the real kill switch. The fee is bounded to [0, MaxFeeBPS] on write, so a reader can trust the bound without re-checking.
Render — public read-only view + audit surface for the fee config.
1const (
2 // MaxFeeBPS is the 5% hard ceiling. SetFeeBPS rejects anything above it, so a
3 // fat-finger or a compromised proposal can never make a lane overcharge.
4 MaxFeeBPS = int64(500)
5 // DefaultFeeBPS is returned for an unset/unknown lane so engines always get a
6 // usable value (2.0%).
7 DefaultFeeBPS = int64(200)
8)AcceptAdmin completes the handoff. Only the pending admin can call it.
CancelAdminTransfer withdraws a staged handoff. Admin only.
GetFeeBPS returns the protocol fee in basis points for a lane. An unset or unknown lane returns DefaultFeeBPS. The result is always within [0, MaxFeeBPS] (enforced on write). Never panics — an engine must always be able to settle.
SetFeeBPS sets a lane's protocol fee in basis points, clamped to [0, MaxFeeBPS]. A value above the 5% ceiling is rejected so a misconfiguration can never overcharge.
SetTreasury repoints where every lane's protocol fee flows.
TransferAdmin proposes a new admin (the memba_dao executor). The 2-step handoff requires the new admin to AcceptAdmin, so a transfer to a wrong or uncontrolled address cannot lock the realm.
