ops state

owner

Owner

Balance

Balance is the wrapped GNOT this realm holds, read from wugnot rather than tracked in a counter of our own. A realm that keeps its own idea of its balance is a realm that can disagree with the truth.

rejectAttachedCoin

rejectAttachedCoin panics if the caller attached native coin to a call that has no use for it. Identical in shape and reasoning to the guard the three arcade realms gained on 2026-10-07: every money path here is wrapped GNOT, so attached ugnot would sit in this realm for ever with nothing able to reach it. Inert on a non-user call, for the reason r/splash/exchange's Buy comment gives: unsafe.OriginSend() reads the envelope attached at the chain root, shared by every realm in the call chain, so reading it is only sound when the immediate caller is an EOA.

requireOwner

requireOwner is the only authorisation in this realm. cur.Previous().Address() AND NOT runtime.OriginCaller(). The origin caller is whoever signed the transaction, which is the same thing right up until the owner is persuaded to call some other realm that calls this one -- at which point an origin check would authorise a withdrawal the owner never asked for. The immediate caller is the one that cannot be borrowed.

Withdraw

Withdraw sends \`amount\` of wrapped GNOT to the owner. THE DESTINATION IS NOT AN ARGUMENT. It is always the owner's own address, so there is no call shape in which this realm pays somebody else -- not by mistake, not by a malformed argument, not by a caller who has somehow got past requireOwner. A withdrawal function that takes a recipient is one typo away from being a drain.

WithdrawAll

WithdrawAll empties the till to the owner. Refuses on an empty one rather than succeeding with a zero transfer: "it worked" and "there was nothing there" are different answers and a caller deserves to be told which.

Render