crowdfund source realm

MinDurationBlocks and MaxDurationBlocks bound a campaign's funding period, enforced structurally: they are the duebook's minDelay and maxDelay, so an out-of-range duration is refused by the primitive. At onyx-1's roughly 3-5s blocks, ~1,200 blocks is on the order of an hour or two, and ~1,300,000 blocks is on the order of 45-75 days.

Input bounds. Both fields are free text and are sanitized before reaching markdown.

ClaimWindowBlocks is how long after the deadline a successful creator may collect before the campaign becomes permissionlessly lapsable and the pot refundable. It is every campaign's deferral ttl.

Denom is the only asset this realm holds.

FeeCollector receives withdrawn fees and swept surplus. Compile-time constant: there is no setter and no transfer path. It is the deploying namespace's address — stated plainly: the operator of this realm.

MaxFeeBps is the hard ceiling on any success fee this realm could ever charge, enforced by the feeledger the realm is constructed with — a feeBps above it is refused by the primitive's own validation, not by a check in this file. 500 bps = 5%.

MaxOpenCampaigns caps simultaneously unsettled campaigns, via the duebook's own open-deferral cap. The AVAILABILITY BOUND this implies is documented rather than hidden: Launch is permissionless, so the cap is exhaustible in principle. What each unsettled slot costs an attacker is the mitigation — a failed campaign is permissionlessly settleable (SettleFailed) the moment its deadline passes, so holding a slot past its deadline requires MEETING THE GOAL, i.e. locking at least MinGoal of real capital per slot for the claim window. Filling the whole table therefore costs >= 1,024 GNOT locked for ~a month per cycle, against a realm whose existing campaigns keep working regardless. Accepted for a testnet deployment and recorded in the deployment record (audit finding Y1).

MaxOpenPerCreator bounds how much of the global cap one creator can occupy (permission_registry R1 precedent: an uncapped per-principal count lets one key monopolize a shared bound).

MaxRenderRows bounds the campaign list on the index page.

MinGoal keeps dust campaigns out: 1 GNOT.

MinPledge bounds pledge-table growth per GNOT of hostile capital (audit open question 1): at 0.01 GNOT per entry, bloating one campaign's table to even 10,000 entries costs 100 refundable-but- locked GNOT plus gas. Honest micro-backing survives: 0.01 GNOT is two orders of magnitude below MinGoal.

RealmPath is this realm's own path, used to build Render links.

SuccessFeeBps is the fee actually snapshotted into every campaign at Launch: 100 bps = 1%, charged once, on CreatorClaim, on the raised amount, floor-rounded in the creator's favor. fee_split precedent: the most conservative live fee in this portfolio is also 1%.

CampaignMemo returns a campaign's raw memo (same caveat as the title).

CampaignTitle returns a campaign's raw title (unsanitized: callers rendering it into markdown must sanitize, as this realm's Render does).

CreatorCancel settles the caller's own campaign as cancelled and opens refunds. Permitted at any time while the settlement deferral is open — during funding, and equally after a successful deadline (renouncing the pot). The duebook Cancel is owner-gated and consumes the deferral.

CreatorClaim collects a successful campaign: creator only, from the deadline until the claim window closes, and only with the goal reached. Pays raised minus the snapshotted fee to the creator and accrues the fee. The duebook Claim consumes the campaign's deferral, so this can succeed at most once per campaign, ever.

FeesAccrued returns the F term: charged, not yet withdrawn.

Height returns the current chain height, the clock every deadline is measured against.

Held returns H: the ugnot actually at this realm's address.

IsRefundable reports whether Refund would currently accept this campaign (for any backer with a live pledge).

Lapse settles a campaign whose claim window has closed. Anyone may call it — a lapsed campaign's pot belongs to its backers, and the caller is doing them (and the duebook's open-slot budget) a service. The duebook Expire refuses while the window is still open.

Launch opens a campaign and returns its id. Anyone may launch; the caller becomes the creator. The fee terms (SuccessFeeBps at this moment — a compile-time constant, so always SuccessFeeBps) are snapshotted into the campaign and are fixed from here on. The funding duration is given in blocks and must be within [MinDurationBlocks, MaxDurationBlocks] — enforced by the duebook.

Liabilities returns B + F — everything this realm owes.

NumCampaigns returns how many campaigns have ever been launched. Prune removes records but never reuses ids.

OpenCampaigns returns how many campaigns are currently unsettled.

OpenOf returns how many unsettled campaigns addr currently has.

Pledge backs a campaign with the attached coins. Direct EOA calls with -send only (the receipt-guaranteed shape); exactly one positive ugnot coin. Open while height < deadline.

PledgeOf returns addr's live pledge in a campaign (0 if none, and 0 for settled campaigns whose pledge table has been dropped).

Prune removes a settled campaign record that holds no coins, reclaiming its storage. Anyone may call it: the chain refunds the freed storage deposit to the pruning transaction, which is the incentive. A record with raised > 0 still carries backer entitlements and is not prunable.

Refund returns the caller's entire pledge from a campaign that will never pay its creator: cancelled, lapsed, or past its deadline with the goal unmet. Always whole, always fee-free. While a succeeded campaign is inside its claim window the pot is the creator's to collect, so Refund refuses — if the creator never collects, Lapse reopens this path.

Render shows the realm at "" and a campaign page at "<id>". Titles and memos are free text and pass through the ecosystem sanitizer before hitting markdown.

SettleFailed settles a campaign that reached its deadline with the goal unmet. Anyone may call it — there is nothing to steer: refunds were already open on this path, so the only effects are making the failure terminal and freeing the campaign's duebook slot (and its creator's cap slot) immediately instead of at the end of the claim window. This is what makes slot-squatting with unfunded campaigns pointless: holding a slot past the deadline requires meeting the goal, i.e. real locked capital.

The deferral is consumed with the duebook's Claim under this realm's policy (goal unmet), which the primitive explicitly leaves to its consumer; the timing verdict (not due before the deadline) is the primitive's own.

Status returns the human verdict for a campaign right now: "funding", "succeeded (awaiting creator claim)", "failed (refunds open)", "paid", "cancelled", or "lapsed".

Surplus returns H - (B + F) — out-of-band coins, sweepable.

SweepSurplus sends out-of-band coins to the FeeCollector: for the pot denom, everything above tracked liabilities; for any foreign denom, the full balance. Tracked backer money and the fee pot are untouchable by construction (coinio.Sweep refuses to dip below the reserve). Anyone may call it.

TotalBacked returns the B term: coins held for campaigns.

Unpledge returns the caller's entire pledge while funding is still open. All-or-nothing means nothing is committed before the deadline, so backing out is always whole and always free.

WithdrawFees pays the entire accrued fee pot to the compile-time FeeCollector. Anyone may call it: the destination is fixed, so there is nothing for a caller to steer.