sealedbid state

Denom

Denom is the only asset this realm accepts.

MaxFeeBps

MaxFeeBps is the hard protocol-fee cap: 1000 bps = 10%. The fee applies only to the seller's PROCEEDS at close — never to a refund, never to the winner's change, and never to a forfeited deposit (see Close).

SaleOpen

// in its commit, reveal, or awaiting-close phase

SaleSettled

// closed WITH a winner; proceeds credited

SaleUnsold

// closed with no valid opening, or below reserve

SaleCancelled

// seller cancelled before any commitment

PhaseCommit

// accepting commitments

PhaseReveal

// accepting openings

PhaseCloseable

// reveal window shut; Close will succeed

MinBid

Input bounds.

MaxBid

// 1,000,000 GNOT

MinCommitBlocks

Input bounds.

MinRevealBlocks

Input bounds.

MaxWindowBlocks

Input bounds.

CommitmentLen

Input bounds.

MinSaltLen

Input bounds.

MaxSaltLen

Input bounds.

MaxLotLen

Input bounds.

MaxBiddersPerSale

Input bounds.

MaxSalesPerSeller

Input bounds.

RenderLimit

Input bounds.

bid

bid is one bidder's sealed commitment and, once opened, its contents.

sale

admin

pendingAdmin

feeRecipient

feeBps

// snapshotted into NEW sales

self

nextID

sealed

// Σ deposits behind UNOPENED commitments in non-terminal sales

revealed

// Σ deposits behind OPENED commitments awaiting close

forfeitedTotal

// cumulative statistic across all sales

sales

// padID(id) -> \*sale

sellerNum

// seller.String() -> \*int64, stored sales

ledger

init.35

CommitHash

CommitHash returns the commitment for a bid of \`amount\` under \`salt\`: the sha256 of a LENGTH-PREFIXED encoding of the two parts, as 64 lowercase hex characters. The length prefixes are what make the encoding unambiguous — without them a commitment to (12, "34salt...") and one to (1, "234salt...") could collide, and a bidder could open a commitment as a bid they never made. The scheme follows p/moul/agents/commit/v0; see the package doc for why it is reimplemented rather than imported. This is a VIEW. Compute your commitment locally or with a read-only query — calling it inside a transaction publishes the salt and destroys the seal.

CreateSale

CreateSale lists a lot for sealed-bid second-price sale. The caller becomes the seller. \`reserve\` is 0 (no reserve) or a floor in \[MinBid, MaxBid] that the HIGHEST revealed bid must meet for the sale to settle. Commitments are accepted for \`commitBlocks\` blocks, then openings for \`revealBlocks\` blocks, after which anyone may [Close](#Close). The current protocol fee is snapshotted in. Returns the id. \`minDeposit\` is the ENTRY PRICE per commitment, and it is the seller's one defence against slot squatting: a sale has at most MaxBiddersPerSale slots, a slot is never released, and a squatter who reveals a dust bid is refunded in full fee-free — so with no entry price a rival locks an honest bidder out of any sale for the cost of gas. Size it to the lot, not to the dust floor. 0 means "no preference", resolved to the max(MinBid, reserve) floor, which is the weakest setting and leaves the squatting cost at MaxBiddersPerSale times that floor. The floor includes the reserve because a bid under the reserve cannot win, so escrowing less than the reserve buys only a slot.

Cancel

Cancel withdraws a sale that has taken no commitment. Seller only. Once any commitment stands the sale can only run to Close — a seller cannot pull the lot out from under an escrowed bidder, and cannot strand a deposit.

Commit

Commit escrows a deposit behind a sealed bid. The caller attaches the deposit and supplies only \`commitment\` — [CommitHash](#CommitHash)(amount, salt) as 64 lowercase hex characters — so the realm learns the bid's CEILING (the deposit) and not the bid. The deposit is the ceiling on what can later be opened, so escrow at least what you intend to bid; escrow more to hide it better. One commitment per bidder per sale, and a commitment already present on this sale is refused (copying another bidder's hash without knowing its contents would otherwise be free and could never be opened).

Reveal

Reveal opens the caller's sealed bid on a sale whose commit window has shut. \`amount\` and \`salt\` must hash to the stored commitment, \`amount\` must be in \[MinBid, MaxBid], and \`amount\` must not exceed the deposit — a bidder who committed above their escrow has no valid opening and forfeits at Close. Opening does not move coins; it moves the deposit from the \`sealed\` bucket to the \`revealed\` one and records the bid for the clearing scan.

Close

Close settles a sale whose reveal window has shut. Anyone may call it; no sale's terminal state may depend on a party acting. The clearing rule: among the OPENED bids the highest wins and pays max(second-highest, reserve, MinBid) — a strict Vickrey price, floored so that a lone bidder does not win for nothing and so that a reserve is honoured as a price and not merely as a veto. Ties on the highest amount go to the EARLIEST opening, which makes the tie-break deterministic and independent of storage order, and a tie sets the second price equal to the first, so a tied winner pays their full bid. The money, all of it credited and none of it sent: - winner: change of \`deposit - price\`, fee-free (it is their own coin coming back, not a sale) - seller: \`price\`, at the sale's snapshotted fee - every other opened bid: its deposit back in full, fee-free - every UNOPENED commitment: deposit credited to the SELLER, fee-free. Fee-free is deliberate: a fee is a cut of a SALE, and taking a cut of liquidated damages would give the fee recipient a revenue interest in bidders failing to reveal. If no bid was opened, or the highest opened bid is below the reserve, the sale is Unsold: every opened bid is refunded in full and only the unopened commitments forfeit.

Claim

Claim sends amount ugnot of the caller's claimable balance — refunds, winner's change, and seller proceeds — to the caller.

ClaimAll

ClaimAll sends the caller's entire claimable balance to the caller.

SetFeeBps

SetFeeRecipient

WithdrawFees

SweepDenom

SweepDenom recovers out-of-band coins to the fee recipient. For the ledger denom the reserve is sealed + revealed + Liabilities() — escrowed deposits, claimable refunds, change, proceeds and the fee pot are all structurally unreachable.

TransferAdmin

AcceptAdmin

SaleInfo

MinDeposit

MinDeposit is the resolved entry price for one commitment on this sale: the smallest deposit [Commit](#Commit) accepts. It is at least max(MinBid, reserve) and is the seller's defence against slot squatting (audit Y1; see [CreateSale](#CreateSale)).

Lot

Lot returns the sale's free-text lot description.

Phase

Phase reports where a sale is: "commit", "reveal" or "closeable" while it is open, else its terminal status. The phase is derived from the chain height and is never stored, so it cannot disagree with the guards.

Status

Status is the sale's STORED state -- one of "open", "settled", "unsold" or "cancelled". It answers a different question from [Phase](#Phase): an open sale has three distinct phases but only one status, and a closed one has a status that no longer moves with the chain height.

Winner

Price

Price is the SECOND price the winner actually paid once the sale has Settled, else 0. It is not the winning bid; see [WinningBid](#WinningBid).

WinningBid

WinningBid is the highest OPENED bid on a sale, available as soon as it is revealed (a revealed bid is public). It is what the winner bid, not what they pay.

SecondBid

SecondBid is the second-highest OPENED bid, or 0. With a tie on the highest it equals the highest.

ProvisionalPrice

ProvisionalPrice is what the winner would pay if the sale closed right now: max(second bid, reserve, MinBid), or 0 if nothing is opened yet or the highest opening is below the reserve.

CommitmentOf

CommitmentOf returns the bidder's stored commitment on a sale ("" if none).

DepositOf

DepositOf returns the bidder's escrowed deposit on a sale (0 if none).

HasRevealed

HasRevealed reports whether the bidder has opened their bid on a sale.

RevealedAmountOf

RevealedAmountOf returns the bidder's OPENED bid amount (0 while sealed). A revealed bid is public by construction — it travelled in a transaction.

ForfeitedOf

ForfeitedOf is the total deposit liquidated to the seller on a closed sale (0 before close). A cumulative statistic, not a held balance.

BidsOn

BidsOn is how many commitments a sale holds; RevealedOn how many are opened.

RevealedOn

BlocksLeft

BlocksLeft is how many blocks remain in the sale's current window (0 once the reveal window has shut or the sale is terminal).

IsCloseable

IsCloseable reports whether Close would succeed right now.

HasSale

SalesOf

Admin

PendingAdmin

FeeRecipient

FeeBps

NumSales

ClaimableOf

FeesAccrued

Liabilities

Sealed

Revealed

ForfeitedTotal

Held

Address

Height

phaseOf

phaseOf derives the sale's phase from the chain height. Nothing stores it, so it cannot disagree with the guards in Commit, Reveal and Close.

clearing

vickreyPrice

vickreyPrice is the clearing price: the second bid, floored by the reserve and by the dust floor. Each of the three is \<= the winning bid in the branch that uses it — h2 by definition, the reserve because a lower high bid is Unsold, and MinBid because Reveal rejects anything under it — so the winner's change is never negative.

findBid

assertCommitment

assertCommitment accepts exactly CommitmentLen LOWERCASE hex characters. Uppercase is rejected rather than normalised: CommitHash emits lowercase, so an uppercase commitment could never be opened, and refusing it at Commit turns a silent total loss of the deposit into an immediate error.

mustSale

assertNoSend

counter

addChecked

padID

itoa

hasPrefix

Render

renderHome

renderSale

priceCell