const StatusOpen, StatusAwarded, StatusCancelled, StatusExpired
Bounty status values.
bounty_panel source realm
Realm bounty\_panel is a public bounty board whose resolution authority is separated from its funding authority.
Realm bounty_panel is a public bounty board whose resolution authority is separated from its funding authority.
A funder escrows GNOT behind a bounty and, AT CREATION, names a panel of resolvers and an M-of-N threshold. Contributors submit work on-chain during a submission window. After that window closes the panel votes on the competing submissions, and the first submission to reach M votes wins the escrow. Neither the panel nor the threshold can change after creation.
WHY THIS EXISTS (see DISCOVERY.md): the sibling realm `grants` already implements escrowed rewards, on-chain submissions, restricted award and a permissionless refund valve — but there the resolver IS the funder. On a public bounty with open submissions that is the wrong trust model: the deciding party has a financial interest in the outcome and sees every submission before deciding. This realm exists for exactly that delta and reuses everything else.
COMPOSITION: all balance accounting is delegated to feeledger, all coin movement to coinio, and all free-text render output to the ecosystem sanitizer p/nt/markdown/sanitize/v0. This realm owns only the bounty state machine: bounty records, panels, submissions, votes, open-escrow total, deadlines, and roles.
LIFECYCLE (terminal states are frozen; one transition per bounty):
Example
1CreateBounty (EOA + -send) : escrow -> openTotal, status Open;
2 panel + threshold + fee bps all
3 SNAPSHOTTED at creation
4Submit (also re-submit) : while Open and height <
5 submitDeadline; keyed by the caller's
6 own address; funder and panel barred
7Vote (panel only) : while Open and submitDeadline <=
8 height < resolveDeadline; one live
9 vote per resolver, changeable until
10 the threshold is reached; the Mth vote
11 for a submission awards the bounty
12 ATOMICALLY (Open -> Awarded)
13CancelBounty (funder only) : Open -> Cancelled, fee-free refund —
14 ONLY while no submission exists
15ExpireBounty (ANYONE) : Open -> Expired once height >=
16 resolveDeadline + ExpiryGraceBlocks;
17 fee-free refund to the funder — the
18 permissionless valve against a panel
19 that never resolves (but see THE ONE
20 CAVEAT below)
21Claim / ClaimAll (anyone) : pays out the caller's own ledger
22 balance (winnings and refunds)
23WithdrawFees (fee recipient): pays out the fee pot
WHY THE WINDOWS DO NOT OVERLAP: submissions close at submitDeadline and voting opens at the same height. A resolver therefore votes only on content that can no longer change, which removes the bait-and- switch where a submission collects votes and is then edited. It also means no submission can be added in response to the votes already cast.
THE ONE CAVEAT ON THE EXPIRY VALVE, stated rather than glossed: both ways out of an Open bounty — award and refund — credit the shared feeledger, so both fail while that ledger is saturated at the int64 boundary, and the escrow is temporarily immovable in BOTH directions until some account claims down. Nothing is lost and the valve works again as soon as the ledger has headroom (this is exercised in TestSaturatedAwardCannotTrapFunds). The state requires liabilities within ~50 of 2^63-1 ugnot, which exceeds the real GNOT supply by orders of magnitude and is unreachable absent a chain-level minting bug, since every credit is backed by an escrowed -send. So: the valve makes fund-trapping impossible under any reachable condition, which is a weaker claim than "impossible" and is the true one.
WHY CANCEL IS RESTRICTED: in `grants` the creator may cancel at any time while open. Here, once a single contributor has submitted work, the funder can no longer unilaterally reclaim the escrow — only the panel (by awarding) or the expiry valve (after the resolution window) can end the bounty. This is the concrete anti-harvest guarantee that a public bounty needs and a grant programme does not.
AUTHORIZATION: every identity is derived from the crossing entrypoint's cur.Previous().Address() — no function takes a caller identity as a parameter. Submissions, votes and claimable balances are keyed by that runtime-derived address, so altering another user's submission, casting another resolver's vote, or claiming another user's winnings is impossible by construction.
PANEL INTEGRITY, fixed at creation and immutable thereafter: the panel is non-empty, free of duplicates, every member is a valid bech32 address, and 1 <= threshold <= panelSize. Panel members may not submit work, so a resolver cannot vote for their own submission. The funder MAY be a panel member — barring them would be unenforceable theatre (a funder can always name an address they control), and the panel is public on-chain from creation, so a self-resolved bounty is visible to contributors BEFORE they spend effort. Disclosure beats a prohibition that cannot be enforced.
FEE MODEL: fee = floor(amount * bps / 10000), rounding favors the winner; no minimum fee; bps snapshotted into the bounty at creation, so SetFeeBps affects future bounties only (closes the award-time admin race), and CreateBounty takes the caller's own maxFeeBps ceiling, rejecting creation if the live fee exceeds what the funder signed for (closes the creation-time race); hard compile-time cap MaxFeeBps (10%); refunds (cancel/expire) are always fee-free.
MONETARY INVARIANT (conservation): let H be ugnot held at this realm's address, B = openTotal (Σ amount over Open bounties), U the ledger's claimable balances, F the fee pot, S >= 0 out-of-band surplus:
Example
1H == B + U + F + S
Every transition moves value between exactly two terms inside one transaction: CreateBounty raises H and B together (coinio.Receive is the receipt-guaranteed shape); award/cancel/expire move amount from B into U+F with feeledger guaranteeing credited + fee == amount; claims and fee withdrawal debit the ledger before coinio.Payout moves the identical amount out (checks-effects-interactions); any panic aborts the whole transaction; this realm never issues or removes coins. Surplus is recoverable only via SweepDenom (fee recipient), which reserves Liabilities() = B + U + F.
ONLY GNOT: CreateBounty rejects any envelope that is not exactly one positive ugnot coin (coinio.Receive). Every other entrypoint rejects attached coins outright rather than converting them to sweepable surplus.
5
const MaxTitleLen, MaxDescLen, MaxURILen, MaxPanelSize, MaxSubmissions, MinDurationBlocks, MaxDurationBlocks, ExpiryGraceBlocks, MaxRenderRows
1const (
2 MaxTitleLen = 80
3 MaxDescLen = 2000
4
5 // MaxURILen bounds a submission's content reference. Submissions
6 // carry a REFERENCE (a URL or content hash), not the work itself —
7 // the chain cannot judge quality, and storing bulk content would
8 // push an unbounded cost onto every future reader of this realm.
9 MaxURILen = 500
10
11 // MaxPanelSize bounds panel parsing, storage and Render cost.
12 MaxPanelSize = int64(16)
13
14 // MaxSubmissions bounds per-bounty state growth. Each submission
15 // also costs its submitter a storage deposit, so this is a ceiling
16 // on a cost that is already borne by the party creating it.
17 MaxSubmissions = int64(500)
18
19 // MinDurationBlocks / MaxDurationBlocks bound each configurable
20 // window (~5s blocks: 1 block to ~580 days).
21 MinDurationBlocks = int64(1)
22 MaxDurationBlocks = int64(10_000_000)
23
24 // ExpiryGraceBlocks after the resolution deadline, an Open bounty
25 // becomes expirable by anyone (~8 minutes at 5s blocks — short
26 // because this is a testnet deployment; a production fork would
27 // raise it). The grace exists so that "the panel may still vote"
28 // and "anyone may expire" are never simultaneously true.
29 ExpiryGraceBlocks = int64(100)
30
31 // MaxRenderRows bounds Render output. Render is reachable by any
32 // viewer through gnoweb and vm/qrender, so its cost lands on third
33 // parties rather than on whoever grew the state.
34 MaxRenderRows = 20
35)Input bounds.
const Denom
Denom is the only asset this realm accepts.
const MaxFeeBps
MaxFeeBps is the hard protocol-fee cap: 1000 bps = 10%.
const RealmPath
RealmPath is this realm's own path, used to build Render links.
31
func BalanceOf
ActionBalanceOf returns addr's claimable balance (winnings + refunds).
func BountyInfo
Action1func BountyInfo(id int64) (funder address, title string, amount, feeBps, submitDeadline, resolveDeadline int64, status string, winner address, numSubmissions, panelSize, threshold int64)BountyInfo returns a bounty's scalar fields by value.
func CancelBounty
crossing ActionCancelBounty closes an open bounty and refunds its escrow to the funder, fee-free. Only the funder may cancel, and ONLY while no contributor has submitted: once work exists, the funder cannot unilaterally reclaim the escrow. Terminal.
func Claim
crossing ActionClaim sends amount ugnot of the caller's claimable balance (winnings and refunds) back to the caller.
func ClaimAll
crossing ActionClaimAll sends the caller's entire claimable balance back to the caller. Fails if there is nothing to claim.
func CreateBounty
crossing Action1func CreateBounty(cur realm, title, description, panelCSV string, threshold, submitBlocks, resolveBlocks, maxFeeBps int64) int64CreateBounty escrows the attached GNOT as a new open bounty and returns its id. Only direct EOA calls with -send are accepted.
panelCSV is a comma-separated list of resolver addresses; threshold is how many of them must name the same submission for it to win. Submissions are accepted for submitBlocks from now, after which the panel has resolveBlocks to decide.
The current protocol fee is snapshotted into the bounty and must not exceed maxFeeBps, the ceiling the caller signed for; pass MaxFeeBps to accept any legal fee.
func Description
ActionDescription returns a bounty's raw description text.
func ExpireBounty
crossing ActionExpireBounty closes an open bounty whose resolution deadline passed more than ExpiryGraceBlocks ago, refunding the funder fee-free. ANYONE may call it — this is the permissionless valve that guarantees escrow can never be trapped by an inactive or deadlocked panel. Terminal.
func FeeBps
ActionFeeBps returns the fee that will be snapshotted into newly created bounties (existing bounties keep their own snapshot).
func FeeOn
ActionFeeOn previews the fee and net payout for a bounty of amount at the CURRENT FeeBps.
func FeesAccrued
ActionFeesAccrued returns the fee pot (the F term).
func Height
ActionHeight returns the current chain height (deadline arithmetic aid).
func Held
ActionHeld returns the ugnot actually held at the realm address (H).
func IsPanelMember
ActionIsPanelMember reports whether addr may vote on a bounty.
func Liabilities
ActionLiabilities returns everything this realm owes: openTotal + UsersTotal + FeesAccrued.
func NumBounties
ActionNumBounties returns how many bounties have ever been created.
func OpenTotal
ActionOpenTotal returns the escrow held by open bounties (the B term).
func Panel
ActionPanel returns a bounty's resolver addresses as a comma-separated list, in sorted order.
func Render
Render shows the board at "" and a bounty detail at "<id>". Free text (titles are charset-restricted; descriptions and URIs are not) passes through the ecosystem sanitizer before hitting markdown.
func SetFeeBps
crossing ActionSetFeeBps sets the protocol fee snapshotted into FUTURE bounties at creation. Existing bounties keep the fee they were created under. Admin only; bounded by [0, MaxFeeBps].
func SetFeeRecipient
crossing ActionSetFeeRecipient re-points the fee/surplus role, including the pot accrued so far. Admin only; zero address rejected.
func SubmissionOf
ActionSubmissionOf returns addr's content reference, submission height and current vote count for a bounty, with ok reporting whether a submission exists.
func Submit
crossing ActionSubmit records (or replaces) the caller's submission to an open bounty before its submission deadline. One submission per address per bounty — re-submitting replaces the caller's own reference only. The funder and every panel member are barred, so no resolver can vote for their own work.
func Surplus
ActionSurplus returns Held() - Liabilities() (the S term).
func SweepDenom
crossing ActionSweepDenom sends the surplus of a single denomination to the fee recipient. For ugnot only the excess over Liabilities() moves; other denoms move wholly. Only the fee recipient may call it.
func TransferAdmin
crossing ActionTransferAdmin hands the admin role to next. Admin only; zero address rejected. One-step (documented trade-off, matching the siblings).
func UsersTotal
ActionUsersTotal returns the sum of all claimable balances (the U term).
func Vote
crossing ActionVote casts (or changes) the calling resolver's vote for one of the bounty's submissions. Only panel members may vote, and only after the submission window has closed and before the resolution deadline. A resolver holds exactly one live vote, changeable until the threshold is reached.
The vote that brings a submission to the threshold awards the bounty in the same transaction: the escrow leaves the open pool and is credited to the winner's claimable balance at the fee snapshotted at creation. Terminal.
func VoteOf
ActionVoteOf returns the submission a resolver currently votes for, with ok reporting whether that resolver has voted at all.
func VotesCast
ActionVotesCast returns how many resolvers currently hold a live vote.
func WithdrawFees
crossing ActionWithdrawFees sends the accrued fee pot to the fee recipient. Only the fee recipient may call it.
9
- chain stdlib
- chain/runtime stdlib
- chain/runtime/unsafe stdlib
- gno.land/p/g1ut6uspuh73e02yauxpmyt8g3wwddaq8utagvm3/coinio package
- gno.land/p/g1ut6uspuh73e02yauxpmyt8g3wwddaq8utagvm3/feeledger package
- gno.land/p/nt/avl/v0 package
- gno.land/p/nt/markdown/sanitize/v0 package
- strconv stdlib
- strings stdlib
