Community realm. Read the code first. Community realm, deployed by its author. Read the code before you interact or send coins.
nsmarket — names for sale, without anybody holding anything.
nsmarket — names for sale, without anybody holding anything.
HOW A SALE WORKS, and why it is built this way.
The seller keeps their name. Listing does not move it here: it records an asking price and relies on the GRC-721 approval the seller has already granted this realm. Ownership does not change until somebody buys, and the seller can walk away at any moment by revoking the approval — at which point the listing simply stops working.
The buyer's money is never held either. Buy is ONE call: it checks the listing still stands, moves the name, pays the seller, takes the fee, refunds any overpayment. All of it inside the transaction the buyer signed. If any part fails the whole thing reverts and nothing moved.
Which means: at no point does this realm hold somebody else's name or somebody else's money. That is not a nice-to-have. An escrow that holds either one is a different kind of business, with a different set of rules, run by people with licences.
THIS REALM HAS NO VAULT PRIVILEGES. It is not in nsdata's trusted set and does not ask to be. Every transfer goes through nslogic's ordinary GRC-721 path, which means it can only move a name the owner has explicitly approved — the same permission any other marketplace would need. However wrong the code below turns out to be, the worst it can do is fail.
Buy completes a sale in the buyer's own transaction.
Order matters here. Everything that can refuse the sale is checked before a single coin moves, and the name moves before the money does, so there is no arrangement of failures that leaves the seller paid and the buyer empty-handed. A panic anywhere reverts all of it.
FeeFor is what the house takes on a sale at this price, and what the seller is left with. Exported so the listing screen can show both before anybody signs — a fee somebody discovers afterwards is a fee they were not told about.
GetListing returns one row, or "" when nothing is listed.
List puts a name up for sale at a price in ugnot.
It does NOT take the name. The seller keeps it, keeps using it, and keeps the right to change their mind — revoking the approval stops the listing from completing without needing this realm's cooperation. (It does not DELETE the listing: this realm is not told. Unlist, or anyone's Prune, clears it. See staleReason.)
The approval is required BEFORE listing rather than checked only at sale time, so a listing that could never complete cannot exist. A buyer finding out at the checkout that the seller never approved anything is the worst moment to find out.
ListForSale pages through everything on offer, cheapest first within a page. `after` is the last token id of the previous page.
ListingsBy is everything one wallet has up for sale. Walks the whole tree because listings are keyed by token id, not by seller: a second index would be a second thing to keep correct and a second thing the seller pays storage for, to save a walk over a list that is small by construction.
Prune clears a listing that can no longer complete. Anyone may call it.
WHY ANYONE. A listing goes stale without this realm hearing about it: the name is transferred elsewhere, lapses, is frozen, or the seller revokes the approval. Buy refuses such a listing — but a refusal is a panic, and a panic reverts everything, including any attempt to delete the listing on the way out. Found on Pearl, 2026-09-10: three refused buys, three listings still stored, each message saying "the listing is gone".
A stale listing is not harmless while it sits there. Revoking the approval is how a seller would naturally "cancel"; if that seller later grants the marketplace an operator approval to list something else, the old listing completes again, at the old price. Clearing it is the fix, and nobody should have to wait for the seller to think of it.
The caller gains nothing but the storage deposit the listing held, which the chain refunds to whoever frees storage. That is the right incentive: the only thing Prune can do is remove a listing that is already dead — staleReason must name a reason, or it refuses.
Quote is what a buyer pays and what the seller receives, before anybody signs anything. The fee is read live, so this is the same arithmetic Buy will do rather than a copy of it that can drift.
SetFee changes it. Admin only, and validated here rather than trusted, because a malformed spec would otherwise be read on every sale and silently resolve to zero.
SetFee CANNOT WORK FROM HERE, and saying so is the fix.
nsdata.SetGlobalRecord opens with assertIsTrustedLogic, and this realm is deliberately outside the trusted set — types.gno says so in capitals, and the deploy panel actively revokes anything but nslogic. So every call here passed its own admin check and its own validation and then panicked inside the vault, for everybody, including the correct admin. A dead control that reads as live is worse than no control: it fails at signing time, during the incident that prompted reaching for it.
Granting nsmarket vault trust to fix this would surrender the property the whole realm is built around. So the setter moved to nslogic, which already has the grant, and runs the same parseFee validation there.
Unlist withdraws a listing. The seller, or the admin for a name that should not be on sale at all — the same manual lever the takedown process already relies on elsewhere.
Version lets the site tell which shape it is talking to without guessing from a function signature.
1type Listing struct {
2 seller address
3 price int64 // ugnot
4 listed int64 // unix seconds
5 /* PINNED TO ONE REGISTRATION, the same way nsskin pins a binding.
6 Without it a listing outlives the registration it was made
7 against: list at 50 GNOT having granted SetApprovalForAll, let the
8 name lapse, re-register it yourself — the burn clears the
9 per-token approval but NOT the operator grant, so owner matches,
10 IsNameValid is true, and any passer-by executes the year-old
11 listing against the name you just paid to get back. */
12 registered int64
13
14 /* PINNED TO ONE OWNERSHIP EPOCH as well as one registration.
15 The registration pin does not catch a name that was SOLD AND BOUGHT
16 BACK: owner matches, the name is valid, the registration date never
17 changed, and an operator grant (SetApprovalForAll) survives
18 transfers — so a seller who listed, sold elsewhere and later bought
19 the name back found their old listing executable by anyone at the old
20 price. The ledger's epoch moves on every transfer, so it catches it.
21 Zero means a listing written before this field, treated as unpinned. */
22 epoch int64
23}A listing. Kept small on purpose: the seller pays to store it, and everything derivable is derived rather than copied. The seller's address is here because the name can change hands outside this realm and a stale seller must be caught, not trusted.
