crowdfund state

RealmPath

RealmPath is this realm's own path, used to build Render links.

Denom

Denom is the only asset this realm holds.

MaxFeeBps

MaxFeeBps is the hard ceiling on any success fee this realm could ever charge, enforced by the feeledger the realm is constructed with — a feeBps above it is refused by the primitive's own validation, not by a check in this file. 500 bps = 5%.

SuccessFeeBps

SuccessFeeBps is the fee actually snapshotted into every campaign at Launch: 100 bps = 1%, charged once, on CreatorClaim, on the raised amount, floor-rounded in the creator's favor. fee\_split precedent: the most conservative live fee in this portfolio is also 1%.

FeeCollector

FeeCollector receives withdrawn fees and swept surplus. Compile-time constant: there is no setter and no transfer path. It is the deploying namespace's address — stated plainly: the operator of this realm.

MinGoal

MinGoal keeps dust campaigns out: 1 GNOT.

MinPledge

MinPledge bounds pledge-table growth per GNOT of hostile capital (audit open question 1): at 0.01 GNOT per entry, bloating one campaign's table to even 10,000 entries costs 100 refundable-but- locked GNOT plus gas. Honest micro-backing survives: 0.01 GNOT is two orders of magnitude below MinGoal.

MinDurationBlocks

MinDurationBlocks and MaxDurationBlocks bound a campaign's funding period, enforced structurally: they are the duebook's minDelay and maxDelay, so an out-of-range duration is refused by the primitive. At onyx-1's roughly 3-5s blocks, ~1,200 blocks is on the order of an hour or two, and ~1,300,000 blocks is on the order of 45-75 days.

MaxDurationBlocks

MinDurationBlocks and MaxDurationBlocks bound a campaign's funding period, enforced structurally: they are the duebook's minDelay and maxDelay, so an out-of-range duration is refused by the primitive. At onyx-1's roughly 3-5s blocks, ~1,200 blocks is on the order of an hour or two, and ~1,300,000 blocks is on the order of 45-75 days.

ClaimWindowBlocks

ClaimWindowBlocks is how long after the deadline a successful creator may collect before the campaign becomes permissionlessly lapsable and the pot refundable. It is every campaign's deferral ttl.

MaxOpenCampaigns

MaxOpenCampaigns caps simultaneously unsettled campaigns, via the duebook's own open-deferral cap. The AVAILABILITY BOUND this implies is documented rather than hidden: Launch is permissionless, so the cap is exhaustible in principle. What each unsettled slot costs an attacker is the mitigation — a failed campaign is permissionlessly settleable (SettleFailed) the moment its deadline passes, so holding a slot past its deadline requires MEETING THE GOAL, i.e. locking at least MinGoal of real capital per slot for the claim window. Filling the whole table therefore costs >= 1,024 GNOT locked for ~a month per cycle, against a realm whose existing campaigns keep working regardless. Accepted for a testnet deployment and recorded in the deployment record (audit finding Y1).

MaxOpenPerCreator

MaxOpenPerCreator bounds how much of the global cap one creator can occupy (permission\_registry R1 precedent: an uncapped per-principal count lets one key monopolize a shared bound).

MaxTitleLen

Input bounds. Both fields are free text and are sanitized before reaching markdown.

MaxMemoLen

Input bounds. Both fields are free text and are sanitized before reaching markdown.

MaxRenderRows

MaxRenderRows bounds the campaign list on the index page.

stateFunding

Campaign states. statePaid, stateFailed, stateCancelled and stateLapsed are terminal: the campaign's deferral has been consumed and can never be consumed again.

statePaid

Campaign states. statePaid, stateFailed, stateCancelled and stateLapsed are terminal: the campaign's deferral has been consumed and can never be consumed again.

stateFailed

Campaign states. statePaid, stateFailed, stateCancelled and stateLapsed are terminal: the campaign's deferral has been consumed and can never be consumed again.

stateCancelled

Campaign states. statePaid, stateFailed, stateCancelled and stateLapsed are terminal: the campaign's deferral has been consumed and can never be consumed again.

stateLapsed

Campaign states. statePaid, stateFailed, stateCancelled and stateLapsed are terminal: the campaign's deferral has been consumed and can never be consumed again.

campaign

self

campaigns

// padID(id) -> \*campaign

nextID

openByCreator

totalBacked

lifetimePledged

lifetimePaidOut

// creator payouts, net of fee

lifetimeReturned

// unpledges + refunds

ledger

book

init.31

rejectStraySend

rejectStraySend aborts when coins are attached to a non-payable call. This realm holds funds, so a stray send would become sweepable surplus, silently converting a user's coins into operator funds. Aborting reverts the transfer instead. Guarded on IsUserCall, not IsUser, because a MsgRun ephemeral can consume the OriginSend envelope before forwarding control; for a realm-routed call the envelope lands at the intermediary, so there is nothing here to reject and the guard deliberately fails open (treasury\_board documents the same scope).

Launch

Launch opens a campaign and returns its id. Anyone may launch; the caller becomes the creator. The fee terms (SuccessFeeBps at this moment — a compile-time constant, so always SuccessFeeBps) are snapshotted into the campaign and are fixed from here on. The funding duration is given in blocks and must be within \[MinDurationBlocks, MaxDurationBlocks] — enforced by the duebook.

Pledge

Pledge backs a campaign with the attached coins. Direct EOA calls with -send only (the receipt-guaranteed shape); exactly one positive ugnot coin. Open while height \< deadline.

Unpledge

Unpledge returns the caller's entire pledge while funding is still open. All-or-nothing means nothing is committed before the deadline, so backing out is always whole and always free.

CreatorClaim

CreatorClaim collects a successful campaign: creator only, from the deadline until the claim window closes, and only with the goal reached. Pays raised minus the snapshotted fee to the creator and accrues the fee. The duebook Claim consumes the campaign's deferral, so this can succeed at most once per campaign, ever.

CreatorCancel

CreatorCancel settles the caller's own campaign as cancelled and opens refunds. Permitted at any time while the settlement deferral is open — during funding, and equally after a successful deadline (renouncing the pot). The duebook Cancel is owner-gated and consumes the deferral.

SettleFailed

SettleFailed settles a campaign that reached its deadline with the goal unmet. Anyone may call it — there is nothing to steer: refunds were already open on this path, so the only effects are making the failure terminal and freeing the campaign's duebook slot (and its creator's cap slot) immediately instead of at the end of the claim window. This is what makes slot-squatting with unfunded campaigns pointless: holding a slot past the deadline requires meeting the goal, i.e. real locked capital. The deferral is consumed with the duebook's Claim under this realm's policy (goal unmet), which the primitive explicitly leaves to its consumer; the timing verdict (not due before the deadline) is the primitive's own.

Lapse

Lapse settles a campaign whose claim window has closed. Anyone may call it — a lapsed campaign's pot belongs to its backers, and the caller is doing them (and the duebook's open-slot budget) a service. The duebook Expire refuses while the window is still open.

Refund

Refund returns the caller's entire pledge from a campaign that will never pay its creator: cancelled, lapsed, or past its deadline with the goal unmet. Always whole, always fee-free. While a succeeded campaign is inside its claim window the pot is the creator's to collect, so Refund refuses — if the creator never collects, Lapse reopens this path.

Prune

Prune removes a settled campaign record that holds no coins, reclaiming its storage. Anyone may call it: the chain refunds the freed storage deposit to the pruning transaction, which is the incentive. A record with raised > 0 still carries backer entitlements and is not prunable.

WithdrawFees

WithdrawFees pays the entire accrued fee pot to the compile-time FeeCollector. Anyone may call it: the destination is fixed, so there is nothing for a caller to steer.

SweepSurplus

SweepSurplus sends out-of-band coins to the FeeCollector: for the pot denom, everything above tracked liabilities; for any foreign denom, the full balance. Tracked backer money and the fee pot are untouchable by construction (coinio.Sweep refuses to dip below the reserve). Anyone may call it.

CampaignInfo

CampaignTitle

CampaignTitle returns a campaign's raw title (unsanitized: callers rendering it into markdown must sanitize, as this realm's Render does).

CampaignMemo

CampaignMemo returns a campaign's raw memo (same caveat as the title).

Status

Status returns the human verdict for a campaign right now: "funding", "succeeded (awaiting creator claim)", "failed (refunds open)", "paid", "cancelled", or "lapsed".

PledgeOf

PledgeOf returns addr's live pledge in a campaign (0 if none, and 0 for settled campaigns whose pledge table has been dropped).

IsRefundable

IsRefundable reports whether Refund would currently accept this campaign (for any backer with a live pledge).

NumCampaigns

NumCampaigns returns how many campaigns have ever been launched. Prune removes records but never reuses ids.

OpenCampaigns

OpenCampaigns returns how many campaigns are currently unsettled.

OpenOf

OpenOf returns how many unsettled campaigns addr currently has.

TotalBacked

TotalBacked returns the B term: coins held for campaigns.

FeesAccrued

FeesAccrued returns the F term: charged, not yet withdrawn.

Liabilities

Liabilities returns B + F — everything this realm owes.

Held

Held returns H: the ugnot actually at this realm's address.

Surplus

Surplus returns H - (B + F) — out-of-band coins, sweepable.

Address

Height

Height returns the current chain height, the clock every deadline is measured against.

Render

Render shows the realm at "" and a campaign page at "\<id>". Titles and memos are free text and pass through the ecosystem sanitizer before hitting markdown.

renderCampaign

mustGet

payBack

payBack is the shared whole-pledge return path for Unpledge and Refund: debit the backer's entry and the campaign before the identical amount leaves the realm.

refundable

refundable: failed, cancelled and lapsed campaigns always; an unsettled campaign once its deadline has passed with the goal unmet. A succeeded campaign inside its claim window is NOT refundable — the pot is the creator's to collect until Cancel or Lapse says otherwise.

status

pledgeOf

backerCount

creatorOpen

setCreatorOpen

decCreatorOpen

itoa

bps

bps renders a basis-point figure as a human percentage, exactly.

percent

percent renders raised/goal as an integer percentage (floor). goal >= MinGoal > 0 by construction, so no divide guard is needed.

padID

padID encodes an id so avl's lexical order matches numeric order.

zeros

checkedAdd

checkedAdd returns a+b and reports whether the addition did not overflow int64.