Realm

1// Package config is the versioned, governed configuration for Memba Launchpad.
2// Its admin is the account that published it until a two-step handoff moves
3// the role. Every lane starts paused and without terms.
4package config
5
6import (
7	"strconv"
8	"strings"
9
10	"chain"
11	"chain/runtime/unsafe"
12	"gno.land/p/samcrew/launchpad/meta/v1"
13	sm "gno.land/p/samcrew/launchpad/safemath/v1"
14	"gno.land/r/nt/grc20reg/v0"
15)
16
17const (
18	LaneDirect     = "direct"
19	LaneFairSale   = "fairsale"
20	LaneAirdrop    = "airdrop"
21	LaneCollection = "collection"
22	LaneNFTDrops   = "nft_drops"
23	LaneNFTMarket  = "nft_market"
24	NativeCurrency = "ugnot"
25	LedgerTokens   = "tokens"
26	LedgerNFT      = "nft"
27	maxCurrencies  = 16
28	maxIssuers     = 32
29	issuerPrefix   = "gno.land/r/samcrew/"
30	maxCreationFee = sm.MaxInt64 / 12
31)
32
33// CurrencyParams holds the terms of one quote currency. A fee of -1 closes
34// the lane that charges it.
35type CurrencyParams struct {
36	Key                 string
37	DirectCreationFee   int64
38	FairSaleCreationFee int64 // never below DirectCreationFee: cancelling a sale returns its allocation
39	FairSaleRaiseCap    int64 // most quote one fair sale may hold in escrow; 0 closes fair sales
40	CollectionFee       int64
41}
42
43// Params is one immutable snapshot of launch terms. A rate of -1 closes the
44// lane that charges it.
45type Params struct {
46	PrimaryFeeBPS      int64 // share of settled fair-sale proceeds
47	NFTPrimaryFeeBPS   int64
48	NFTSecondaryFeeBPS int64
49	Treasury           address
50	Currencies         []CurrencyParams
51}
52
53var (
54	lanes = []string{LaneDirect, LaneFairSale, LaneAirdrop, LaneCollection, LaneNFTDrops, LaneNFTMarket}
55	// No function of these realms can pay out a balance sent to their address.
56	unspendable = []string{
57		"gno.land/r/samcrew/launchpad/config/v1",
58		"gno.land/r/samcrew/launchpad/tokens/v1",
59		"gno.land/r/samcrew/launchpad/sales/v1",
60		"gno.land/r/samcrew/launchpad/nft/v1",
61		"gno.land/r/samcrew/launchpad/drops/v1",
62		"gno.land/r/samcrew/launchpad/market/v1",
63		"gno.land/r/samcrew/launchpad/curation/v1",
64		"gno.land/r/samcrew/memba_dao",
65		// The governance core and its bridge to the legacy apps hold no
66		// treasury and no generic call: nothing there could pay a fee out.
67		"gno.land/r/samcrew/memba_gov",
68		"gno.land/r/samcrew/memba_bridge_v1",
69	}
70
71	admin        address
72	pendingAdmin address
73	pauser       address
74	issuers      = map[string]bool{} // "<ledger>:<realm address>"
75	versions     []Params
76	allowed      = map[string]bool{}
77	paused       = map[string]bool{}
78	verified     = map[string]bool{}
79	reserved     = map[string]bool{}
80	owedCeilings = map[string]int64{} // absent: no ceiling
81)
82
83func init() {
84	admin = unsafe.OriginCaller()
85	versions = []Params{{PrimaryFeeBPS: -1, NFTPrimaryFeeBPS: -1, NFTSecondaryFeeBPS: -1}}
86	for _, lane := range lanes {
87		paused[lane] = true
88	}
89	for _, ticker := range []string{"MEMBA", "GNOT", "UGNOT", "WUGNOT", "GNS", "USDC", "USDT", "ATOM", "BTC", "ETH", "SAMCREW"} {
90		reserved[ticker] = true
91	}
92}
93
94// caller is the immediate user or realm. Coins attached to a direct call
95// would land in this realm, which has no way to return them.
96func caller(cur realm) address {
97	// The pinned VM already refuses a realm context that is not the live one
98	// before this line runs. Published code outlives a VM release, so the
99	// check stays.
100	if !cur.IsCurrent() {
101		panic("launchpad/config: stale realm context")
102	}
103	if cur.Previous().IsUserCall() && len(unsafe.OriginSend()) != 0 {
104		panic("launchpad/config: this call does not accept coins")
105	}
106	return cur.Previous().Address()
107}
108
109func requireAdmin(cur realm) {
110	if caller(cur) != admin {
111		panic("launchpad/config: admin only")
112	}
113}
114
115func unspendableRealm(who address) bool {
116	for _, path := range unspendable {
117		if who == chain.PackageAddress(path) {
118			return true
119		}
120	}
121	return false
122}
123
124// IsUnspendable reports whether a fee or a royalty paid to who could never
125// be paid out again: who is one of the realms listed above, which have no
126// function for that, or it is not an address as the chain writes one, so no
127// caller can ever present it. It is a check for such receivers only, not for
128// the recipient of a transfer: the sales realm is on the list and rightly
129// holds and moves ledger balances of its own.
130func IsUnspendable(who address) bool {
131	return !meta.ValidAddress(who) || unspendableRealm(who)
132}
133
134func validLane(lane string) bool {
135	for _, l := range lanes {
136		if l == lane {
137			return true
138		}
139	}
140	return false
141}
142
143func versionString() string { return strconv.FormatInt(GetCurrentVersion(), 10) }
144
145func validAssetID(id string) bool {
146	if len(id) < 2 || len(id) > 20 || (id[0] != 'T' && id[0] != 'C') || id[1] < '1' || id[1] > '9' {
147		return false
148	}
149	for i := 2; i < len(id); i++ {
150		if id[i] < '0' || id[i] > '9' {
151			return false
152		}
153	}
154	n, err := strconv.ParseInt(id[1:], 10, 64)
155	return err == nil && n > 0
156}
157
158// ProposeAdmin stages a handoff to a user account or a realm. Nothing changes
159// until that exact address accepts, so a target that cannot call is harmless.
160func ProposeAdmin(cur realm, next address) {
161	requireAdmin(cur)
162	if !meta.ValidAddress(next) || next == admin {
163		panic("launchpad/config: invalid next admin")
164	}
165	pendingAdmin = next
166	chain.Emit("AdminProposed", "admin", admin.String(), "pending", next.String())
167}
168
169func CancelAdminProposal(cur realm) {
170	requireAdmin(cur)
171	if pendingAdmin == "" {
172		panic("launchpad/config: no pending admin")
173	}
174	pendingAdmin = ""
175	chain.Emit("AdminProposalCancelled", "admin", admin.String())
176}
177
178func AcceptAdmin(cur realm) {
179	who := caller(cur)
180	if pendingAdmin == "" || who != pendingAdmin {
181		panic("launchpad/config: pending admin only")
182	}
183	previous := admin
184	admin = who
185	pendingAdmin = ""
186	chain.Emit("AdminAccepted", "admin", who.String(), "previous", previous.String())
187}
188
189// validIssuerPath accepts a realm path below the samcrew namespace whose
190// segments are plain lowercase names: nothing that could resolve elsewhere.
191func validIssuerPath(path string) bool {
192	if len(path) > 200 || !strings.HasPrefix(path, issuerPrefix) {
193		return false
194	}
195	for _, segment := range strings.Split(path[len(issuerPrefix):], "/") {
196		if segment == "" {
197			return false
198		}
199		for i := 0; i < len(segment); i++ {
200			c := segment[i]
201			if (c < 'a' || c > 'z') && (c < '0' || c > '9') && c != '_' {
202				return false
203			}
204		}
205	}
206	return true
207}
208
209// AllowIssuer lists a realm under gno.land/r/samcrew/ as an issuer for one
210// ledger to read. The list only grows, so a ledger can bind what an issuer
211// created to that issuer for good.
212func AllowIssuer(cur realm, ledger, pkgPath string) {
213	requireAdmin(cur)
214	if (ledger != LedgerTokens && ledger != LedgerNFT) || !validIssuerPath(pkgPath) ||
215		len(issuers) >= maxIssuers {
216		panic("launchpad/config: invalid issuer")
217	}
218	issuer := chain.PackageAddress(pkgPath)
219	if issuer == cur.Address() {
220		panic("launchpad/config: invalid issuer")
221	}
222	key := ledger + ":" + issuer.String()
223	if issuers[key] {
224		panic("launchpad/config: issuer already allowed")
225	}
226	issuers[key] = true
227	chain.Emit("IssuerAllowed", "ledger", ledger, "path", pkgPath, "issuer", issuer.String(), "actor", admin.String())
228}
229
230func IsIssuer(ledger string, who address) bool { return issuers[ledger+":"+who.String()] }
231
232func GetAdmin() address        { return admin }
233func GetPendingAdmin() address { return pendingAdmin }
234func GetPauser() address       { return pauser }
235
236func copyParams(p Params) Params {
237	copyP := p
238	copyP.Currencies = make([]CurrencyParams, len(p.Currencies))
239	copy(copyP.Currencies, p.Currencies)
240	return copyP
241}
242
243func GetCurrentVersion() int64 { return int64(len(versions)) }
244
245func GetVersion(version int64) Params {
246	if version < 1 || version > int64(len(versions)) {
247		panic("launchpad/config: unknown version")
248	}
249	return copyParams(versions[version-1])
250}
251
252// One value of the current terms each, so a check can compare its text: the
253// publisher's manual flow reads one before and after each setter. A rate or a
254// fee of -1 is not set; so is every fee of a currency without terms.
255func GetTreasury() address         { return versions[len(versions)-1].Treasury }
256func GetPrimaryFeeBPS() int64      { return versions[len(versions)-1].PrimaryFeeBPS }
257func GetNFTPrimaryFeeBPS() int64   { return versions[len(versions)-1].NFTPrimaryFeeBPS }
258func GetNFTSecondaryFeeBPS() int64 { return versions[len(versions)-1].NFTSecondaryFeeBPS }
259
260// GetTokenTerms is "<direct creation fee>,<fair-sale creation fee>,<raise cap>"
261// in a currency.
262func GetTokenTerms(key string) string {
263	c, ok := findCurrency(versions[len(versions)-1], key)
264	if !ok {
265		return "-1,-1,0"
266	}
267	return strconv.FormatInt(c.DirectCreationFee, 10) + "," + strconv.FormatInt(c.FairSaleCreationFee, 10) + "," + strconv.FormatInt(c.FairSaleRaiseCap, 10)
268}
269
270func GetCollectionFee(key string) int64 {
271	c, ok := findCurrency(versions[len(versions)-1], key)
272	if !ok {
273		return -1
274	}
275	return c.CollectionFee
276}
277
278func AssertExpectedVersion(expected int64) {
279	if expected != GetCurrentVersion() {
280		panic("config changed")
281	}
282}
283
284func validateParams(p Params) {
285	if p.PrimaryFeeBPS < -1 || p.PrimaryFeeBPS > 500 ||
286		p.NFTPrimaryFeeBPS < -1 || p.NFTPrimaryFeeBPS > 500 ||
287		p.NFTSecondaryFeeBPS < -1 || p.NFTSecondaryFeeBPS > 200 {
288		panic("launchpad/config: parameter out of range")
289	}
290	if p.Treasury != "" {
291		if !meta.ValidAddress(p.Treasury) {
292			panic("launchpad/config: invalid treasury")
293		}
294		if unspendableRealm(p.Treasury) {
295			panic("launchpad/config: treasury cannot spend")
296		}
297	}
298	if len(p.Currencies) > maxCurrencies {
299		panic("launchpad/config: too many currencies")
300	}
301	seen := map[string]bool{}
302	for _, c := range p.Currencies {
303		if c.Key == "" || len(c.Key) > 200 || seen[c.Key] ||
304			(c.Key != NativeCurrency && grc20reg.Get(c.Key) == nil) ||
305			c.DirectCreationFee < -1 || c.DirectCreationFee > maxCreationFee ||
306			c.FairSaleCreationFee < -1 || c.FairSaleCreationFee > maxCreationFee ||
307			c.CollectionFee < -1 || c.CollectionFee > maxCreationFee ||
308			c.FairSaleRaiseCap < 0 {
309			panic("launchpad/config: invalid currency terms")
310		}
311		if c.FairSaleCreationFee >= 0 &&
312			(c.DirectCreationFee < 0 || c.FairSaleCreationFee < c.DirectCreationFee) {
313			panic("launchpad/config: fair-sale fee below direct fee")
314		}
315		// With direct <= fair < cap, and no cap while fair sales are closed,
316		// no two of the three can be swapped unnoticed.
317		if c.FairSaleRaiseCap != 0 &&
318			(c.FairSaleCreationFee < 0 || c.FairSaleRaiseCap <= c.FairSaleCreationFee) {
319			panic("launchpad/config: raise cap not above fair-sale fee")
320		}
321		seen[c.Key] = true
322	}
323}
324
325// Terms change only through the setters below. Each takes scalar arguments,
326// so a user account can call it, and appends one snapshot that passed the
327// whole validation; earlier snapshots never change. A launch pins the version
328// it was created under, and an action signed against an older version fails.
329
330func latest() Params { return copyParams(versions[len(versions)-1]) }
331
332func appendVersion(next Params, change string) int64 {
333	validateParams(next)
334	versions = append(versions, next)
335	chain.Emit("ConfigVersionAdded", "version", versionString(), "change", change, "actor", admin.String())
336	return GetCurrentVersion()
337}
338
339func findCurrency(p Params, key string) (CurrencyParams, bool) {
340	for _, c := range p.Currencies {
341		if c.Key == key {
342			return c, true
343		}
344	}
345	return CurrencyParams{}, false
346}
347
348// currencyTerms returns the index of key's terms in p, adding them with every
349// lane closed when the currency is new.
350func currencyTerms(p *Params, key string) int {
351	for i, c := range p.Currencies {
352		if c.Key == key {
353			return i
354		}
355	}
356	p.Currencies = append(p.Currencies, CurrencyParams{
357		Key: key, DirectCreationFee: -1, FairSaleCreationFee: -1, CollectionFee: -1,
358	})
359	return len(p.Currencies) - 1
360}
361
362// SetTreasury names the receiver of protocol fees. Once named it can be
363// replaced, not removed.
364func SetTreasury(cur realm, treasury address) int64 {
365	requireAdmin(cur)
366	if treasury == "" {
367		panic("launchpad/config: invalid treasury")
368	}
369	next := latest()
370	next.Treasury = treasury
371	return appendVersion(next, "treasury")
372}
373
374func SetPrimaryFeeBPS(cur realm, bps int64) int64 {
375	requireAdmin(cur)
376	next := latest()
377	next.PrimaryFeeBPS = bps
378	return appendVersion(next, "primary_fee")
379}
380
381func SetNFTPrimaryFeeBPS(cur realm, bps int64) int64 {
382	requireAdmin(cur)
383	next := latest()
384	next.NFTPrimaryFeeBPS = bps
385	return appendVersion(next, "nft_primary_fee")
386}
387
388func SetNFTSecondaryFeeBPS(cur realm, bps int64) int64 {
389	requireAdmin(cur)
390	next := latest()
391	next.NFTSecondaryFeeBPS = bps
392	return appendVersion(next, "nft_secondary_fee")
393}
394
395// SetTokenTerms prices token creation in one currency and bounds what a
396// single fair sale may raise in it.
397func SetTokenTerms(cur realm, key string, directCreationFee, fairSaleCreationFee, fairSaleRaiseCap int64) int64 {
398	requireAdmin(cur)
399	next := latest()
400	i := currencyTerms(&next, key)
401	next.Currencies[i].DirectCreationFee = directCreationFee
402	next.Currencies[i].FairSaleCreationFee = fairSaleCreationFee
403	next.Currencies[i].FairSaleRaiseCap = fairSaleRaiseCap
404	return appendVersion(next, "token_terms")
405}
406
407func SetCollectionFee(cur realm, key string, fee int64) int64 {
408	requireAdmin(cur)
409	next := latest()
410	i := currencyTerms(&next, key)
411	next.Currencies[i].CollectionFee = fee
412	return appendVersion(next, "collection_fee")
413}
414
415// RemoveCurrency drops a currency's terms, its allowlist entry and its owed
416// ceiling, so adding terms again later neither reopens it nor brings back an
417// old ceiling by itself.
418func RemoveCurrency(cur realm, key string) int64 {
419	requireAdmin(cur)
420	current := latest()
421	next := current
422	next.Currencies = nil
423	for _, c := range current.Currencies {
424		if c.Key != key {
425			next.Currencies = append(next.Currencies, c)
426		}
427	}
428	if len(next.Currencies) == len(current.Currencies) {
429		panic("launchpad/config: unknown currency")
430	}
431	delete(allowed, key)
432	delete(owedCeilings, key)
433	return appendVersion(next, "currency_removed")
434}
435
436// IsLaneReady checks only immutable terms. The immediate allowlist is checked
437// at action time so delisting cannot prevent an old launch's exits.
438func IsLaneReady(lane, currency string) bool {
439	p := versions[len(versions)-1]
440	c, ok := findCurrency(p, currency)
441	if !ok || p.Treasury == "" {
442		return false
443	}
444	switch lane {
445	// A direct fee is what opens a currency to the token lanes: a fair sale
446	// cannot be priced without one, and an airdrop, which is free, needs it too.
447	case LaneDirect, LaneAirdrop:
448		return c.DirectCreationFee >= 0
449	case LaneFairSale:
450		return c.FairSaleCreationFee >= 0 && c.FairSaleRaiseCap > 0 && p.PrimaryFeeBPS >= 0
451	// A collection fee is what opens a currency to the NFT lanes.
452	case LaneCollection:
453		return c.CollectionFee >= 0
454	case LaneNFTDrops:
455		return c.CollectionFee >= 0 && p.NFTPrimaryFeeBPS >= 0
456	case LaneNFTMarket:
457		return c.CollectionFee >= 0 && p.NFTSecondaryFeeBPS >= 0
458	}
459	return false
460}
461
462// Pause closes a lane to new launches and contributions. Claims, refunds and
463// settlements never read the gate, so nothing here can hold funds back.
464func Pause(cur realm, lane string) {
465	who := caller(cur)
466	if !validLane(lane) {
467		panic("launchpad/config: invalid lane")
468	}
469	if who != admin && who != pauser {
470		panic("launchpad/config: pauser or admin only")
471	}
472	paused[lane] = true
473	chain.Emit("LanePaused", "lane", lane, "actor", who.String())
474}
475
476// Unpause opens a lane. It needs a pauser in place and one listed currency
477// whose terms for the lane are complete.
478func Unpause(cur realm, lane, currency string) {
479	requireAdmin(cur)
480	if !validLane(lane) {
481		panic("launchpad/config: invalid lane")
482	}
483	if pauser == "" || !allowed[currency] || !IsLaneReady(lane, currency) {
484		panic("launchpad/config: lane is incomplete")
485	}
486	paused[lane] = false
487	chain.Emit("LaneUnpaused", "lane", lane, "currency", currency, "version", versionString(), "actor", admin.String())
488}
489
490func IsPaused(lane string) bool {
491	if !validLane(lane) {
492		return true
493	}
494	return paused[lane]
495}
496
497// AssertLaneOpen gates a new inflow: the lane is open and the currency is
498// listed with complete terms. A caller that charges the terms in force reads
499// them in the same transaction, as the NFT realms do; one that charges at the
500// version its user signed for checks that version with AssertNewAction, as
501// token creations and fair-sale launches do. The token lanes' exits use the
502// terms recorded at launch and pass no gate.
503func AssertLaneOpen(lane, currency string) {
504	if IsPaused(lane) || !allowed[currency] || !IsLaneReady(lane, currency) {
505		panic("launchpad/config: new action unavailable")
506	}
507}
508
509// AssertNewAction also pins the version whose prices the caller signed for.
510func AssertNewAction(lane, currency string, expectedVersion int64) {
511	AssertExpectedVersion(expectedVersion)
512	AssertLaneOpen(lane, currency)
513}
514
515// SetPauser names the one address, besides the admin, that may close lanes.
516func SetPauser(cur realm, next address) {
517	requireAdmin(cur)
518	if !meta.ValidAddress(next) {
519		panic("launchpad/config: invalid pauser")
520	}
521	pauser = next
522	chain.Emit("PauserChanged", "pauser", next.String(), "actor", admin.String())
523}
524
525func SetCurrencyAllowed(cur realm, key string, value bool) {
526	requireAdmin(cur)
527	if !value {
528		delete(allowed, key)
529	} else if _, ok := findCurrency(versions[len(versions)-1], key); ok {
530		allowed[key] = true
531	} else {
532		panic("launchpad/config: currency terms missing")
533	}
534	chain.Emit("CurrencyAllowed", "currency", key, "allowed", strconv.FormatBool(value), "version", versionString(), "actor", admin.String())
535}
536
537func IsCurrencyAllowed(key string) bool { return allowed[key] }
538
539// SetSalesOwedCeiling bounds what the sales realm may owe in one currency,
540// its fees, escrow, refunds and proceeds together, for a fair-sale
541// contribution to be accepted. Nothing else reads it: settlements, claims,
542// releases and sweeps go through at any ceiling, and a ceiling below what is
543// already owed only stops new contributions. Unlike a pause, it lets running
544// sales take orders while there is room. MaxInt64, the default, is no
545// ceiling. It is not a term a launch signs for, so it adds no version.
546func SetSalesOwedCeiling(cur realm, key string, ceiling int64) {
547	requireAdmin(cur)
548	if _, ok := findCurrency(versions[len(versions)-1], key); !ok {
549		panic("launchpad/config: currency terms missing")
550	}
551	if ceiling < 0 {
552		panic("launchpad/config: invalid ceiling")
553	}
554	if ceiling == sm.MaxInt64 {
555		delete(owedCeilings, key)
556	} else {
557		owedCeilings[key] = ceiling
558	}
559	chain.Emit("SalesOwedCeiling", "currency", key, "ceiling", strconv.FormatInt(ceiling, 10), "actor", admin.String())
560}
561
562func GetSalesOwedCeiling(key string) int64 {
563	if ceiling, ok := owedCeilings[key]; ok {
564		return ceiling
565	}
566	return sm.MaxInt64
567}
568
569func SetVerified(cur realm, assetID string, value bool) {
570	requireAdmin(cur)
571	if !validAssetID(assetID) {
572		panic("launchpad/config: invalid asset ID")
573	}
574	verified[assetID] = value
575	chain.Emit("Verified", "asset", assetID, "verified", strconv.FormatBool(value), "actor", admin.String())
576}
577
578func IsVerified(assetID string) bool { return verified[assetID] }
579
580func SetReserved(cur realm, ticker string, value bool) {
581	requireAdmin(cur)
582	if meta.Ticker(ticker) != nil {
583		panic("launchpad/config: invalid ticker")
584	}
585	reserved[ticker] = value
586	chain.Emit("Reserved", "ticker", ticker, "reserved", strconv.FormatBool(value), "actor", admin.String())
587}
588
589func IsReserved(ticker string) bool { return reserved[ticker] }
590