Repository navigation
fix+feat: credit auth fix, participation fee, state dump/restore, leaderboard embed - #1491
Merged
joelpeace48-cell merged 5 commits intoOct 20, 2026
Conversation
Deduplicate Error enum variants left by a conflicting merge, add missing staking/timelock error codes, replace unsupported u8 contract types with u32, route boosted-amount math through Self::, and give claim_airdrop a production SHA-256 Merkle verifier so it no longer depends on test-only poseidon modules. Align outdated unit tests with the current API so the suite compiles and passes (148/148).
…sseStudioLab#1419) credit(), batch_credit(), and credit_vested() previously accepted any self-authenticated caller, letting a roleless account mint points and redeem them against the SAC reserve. All three generic mint paths now require admin or co-admin via require_credit_authority; campaign-scoped operators continue to use credit_as_operator. Also default MAX_CREDIT_PER_CALL to 1_000_000 instead of 0 (unlimited). Closes FinesseStudioLab#1419
…inesseStudioLab#1371) Campaigns can now charge a small entry fee in any SEP-41/SAC token that is forwarded to the reward pool on each new registration. Admin configures the fee via set_participation_fee (amount=0 clears it); registration is unchanged when no fee is set. Also aligns re-registration tests with the existing FinesseStudioLab#740 participation barrier. Closes FinesseStudioLab#1371
…inesseStudioLab#1372) Campaign contract gains export_state/import_state for its instance-storage configuration (admin, window, cap, merkle root, privacy mode, fee, schema). A new 'trivela state dump|restore' CLI command serialises that snapshot to JSON for offline inspection and reads it back for local testnet seeding. Closes FinesseStudioLab#1372
…inesseStudioLab#1370) embed.js now accepts data-widget="leaderboard|card|progress" and data-limit so third-party blogs can paste a single <script> tag that mounts a live campaign leaderboard via /embed/v1/leaderboard/:id. Adds buildScriptSnippet() to the snippet library and surfaces an HTML/JS format option (defaulting to leaderboard) in EmbedSnippetGenerator. Closes FinesseStudioLab#1370
|
@AbelOsaretin Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1370 , Closes #1371 , Closes #1372 , Closes #1419
Type of Change
Summary
Four assigned issues in one PR. Critical first:
credit()/batch_credit()/credit_vested()accepted any self-authenticated caller, so a roleless account could mint points and redeem them against the SAC reserve — those mint paths now require admin/co-admin (#1419). Campaigns can charge a configurable token entry fee forwarded to the reward pool (#1371). Campaign instance state can be exported/imported as JSON for offline inspection and local testnet seeding (#1372). Third-party blogs can paste a single HTML/JS<script>tag that mounts a live campaign leaderboard (#1370). Also repairs a broken-merge compile failure in the rewards contract that blocked all of the above.Motivation / Context
Closes #1419 (unauthorized point minting → reserve drain), #1371 (campaign entry fees in custom tokens), #1372 (state dump/restore for local migration), #1370 (leaderboard embed for blogs).
Closes #1370, Closes #1371, Closes #1372, Closes #1419
Changes
contracts/rewardsrequire_credit_authorityoncredit/batch_credit/credit_vested; defaultMAX_CREDIT_PER_CALL= 1,000,000 (was 0 = unlimited)contracts/campaignset_participation_fee/participation_fee; fee transfer to reward pool on new registrationcontracts/campaign+cliexport_state/import_state;trivela state dump|restoreJSON helperfrontendembed.jsdata-widget/data-limit;buildScriptSnippet(); HTML/JS format in EmbedSnippetGeneratorcontracts/rewardsErrorenum, add missing variants, u8→u32, SHA-256 airdrop Merkle verifier, fix stale testsTesting
cargo test -p trivela-rewards-contract --lib→ 153 passed, 0 failedcargo test -p trivela-campaign-contract --lib→ 96 passed, 0 failedcd cli && npm test→ 6 passed (stateDump round-trip)cd frontend && npx vitest run src/lib/embedSnippet.test.js src/components/TrivelaCampaignWidget.test.jsx→ 13 passedcredit/batch_credit/credit_vestedrejected; default credit cap enforced; co-admin can credit; fee charged once per new registration; export/import state round-trip; script snippet contentsTradeoffs
credit_as_operator(delegation + budget). This closes the hole without enumerating operator delegations on-chain.import_staterestores instance-storage configuration only — participant records are out of scope (cannot enumerate persistent keys from a contract).Out of scope
/embed/v1/leaderboard/:idroute is reused)