Repository navigation
Add version, admin upgrade, two-step admin transfer and platform fee (#100 #101 #102 #103) - #411
Merged
EmmanuelOchaje merged 9 commits intoOct 21, 2026
Conversation
ZoneNotAllowed and GiftClaimAlreadyExists were both assigned 61 after two merges landed on main. Rust rejects duplicate explicit discriminants, so the crate did not compile. GiftClaimAlreadyExists landed first and keeps 61. ZoneNotAllowed moves to the next free code, 66, since error codes are append-only.
Consumers cannot tell which contract build is deployed. version() returns the crate version from Cargo.toml, captured at compile time, so it needs no storage and works before initialize.
The contract could not be upgraded, so a bug fix needed a redeploy and a full data migration. upgrade(admin, new_wasm_hash) replaces the contract code through update_current_contract and keeps storage. It requires the admin's auth, rejects other callers with NotAdmin, and publishes ContractUpgraded. docs/UPGRADES.md now covers the upgrade procedure and the state migration rules: append-only DataKey variants, no field changes on stored structs, and idempotent migration entry points. The admin-upgradeable trust model is reflected in MAINNET.md and THREAT_MODEL.md. Tests: a second WASM build is uploaded and the admin switches to it. A non-admin is rejected. The auth matrix covers the new entry point.
DataKey::Admin was set at initialize and could never change, so a lost or rotated admin key left the contract unmanageable. propose_admin(admin, new_admin) lets the current admin nominate a successor (auth from the current admin). accept_admin(new_admin) completes the transfer and needs auth from the nominee, so the role cannot land on an address that never agreed to it. A new proposal replaces the pending one. Adds NoPendingAdmin (67) and NotPendingAdmin (68), and the AdminProposed and AdminTransferred events. Covered by unit tests and auth-matrix rows.
Resale settlement paid only the organizer royalty, so the platform could not take a cut of resales. set_platform_fee(admin, fee_bps, recipient) sets a fee taken from the seller's proceeds next to the royalty and paid to recipient. Zero turns it off. platform_fee() reads the setting. The fee and any event royalty must together stay within 10000 bps: - set_platform_fee rejects a fee over 10000, or a fee that plus the highest royalty recorded so far exceeds 10000 (InvalidPlatformFee). The highest royalty is tracked in DataKey::MaxRoyaltyBps, updated on event creation. - create_event rejects a royalty that plus the current fee exceeds 10000 (InvalidRoyalty). buy_resale and quote_resale share one split helper, so the royalty, fee and seller remainder are computed the same way in both. Each is rounded down and the seller keeps the remainder. quote_resale's seller_amount is now net of the fee. Its tuple shape is unchanged. Adds PlatformFeeUpdated, the InvalidPlatformFee error (69) and tests for settlement, rounding, the quote, zero fee, the admin check and both 100% bounds.
✅ Deploy Preview for stellarticketscontracts ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
@sanmipaul Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #100
Closes #101
Closes #102
Closes #103
Summary
One branch covering the four issues assigned to @sanmipaul in the Stellar Wave program.
version(): returns the crate version fromCargo.toml, captured at compile time. Works beforeinitialize.upgrade(admin, new_wasm_hash): admin-only code upgrade throughupdate_current_contract. Storage is kept.docs/UPGRADES.mdnow describes the procedure and the state migration rules.propose_admin(current admin auth) andaccept_admin(nominee auth). AddsNoPendingAdmin(67) andNotPendingAdmin(68).set_platform_fee(admin, fee_bps, recipient)takes a share of each resale from the seller's proceeds. Fee plus any event royalty must not exceed 10000 bps, enforced both when the fee is set and when an event is created.buy_resaleandquote_resaleshare one split helper.quote_resale'sseller_amountis now net of the fee, and its tuple shape is unchanged. AddsInvalidPlatformFee(69).Also included: duplicate error code
maindoes not compile.ZoneNotAllowedandGiftClaimAlreadyExistsare both= 61, which rustc rejects (E0081).GiftClaimAlreadyExistslanded first and keeps 61.ZoneNotAllowedmoves to 66, the next free code, since codes are append-only. This is its own commit (26c5e94) and can be split out if maintainers prefer.Review notes
test/auth_matrix.rs.test/upgrade.rsuploads a hand-built second module. It carries only thecontractenvmetav0section with protocol 28 and pre-release 0, which matches the host's interface version. Please confirm this fixture is accepted by the test harness.docs/MAINNET.md,docs/THREAT_MODEL.md,docs/EVENTS.md,docs/ERRORS.md,docs/CONTRACT_API.mdandCHANGELOG.mdare updated to match.docs/AUDIT.mdis a dated snapshot and was left as is.Not verified
I did not run
cargo build,cargo test,cargo clippyorstellar contract buildwhile preparing this PR. Please runcargo test --workspaceandcargo clippy --all-targets -- -D warningsbefore merging. The new tests have only been checked by reading.