feat(events): 1.7.0 open pool with committed prize floors, and submission slots

contracts/events/src/admin.rs

@@ -1,9 +1,34 @@
-use soroban_sdk::{panic_with_error, Address, BytesN, Env, String};
+use soroban_sdk::{contracttype, panic_with_error, Address, BytesN, Env, Map, String, Symbol, Val};
 
 use crate::errors::Error;
 use crate::events as evt;
+use crate::idempotency;
 use crate::storage;
-use crate::types::{PendingAdmin, PendingUpgrade};
+use crate::types::{
+    DataKey, EventRecord, EventStatus, PendingAdmin, PendingUpgrade, Pillar, ReleaseKind, Winner,
+};
+
+/// The pre-1.7.0 `EventRecord`, kept only so `migrate` can decode rows written
+/// before prize floors replaced the percentage distribution. Nothing else may
+/// read or write this shape.
+#[contracttype]
+#[derive(Clone)]
+struct LegacyEventRecord {
+    pub id: u64,
+    pub pillar: Pillar,
+    pub owner: Address,
+    pub token: Address,
+    pub total_budget: i128,
+    pub remaining_escrow: i128,
+    pub release_kind: ReleaseKind,
+    pub status: EventStatus,
+    pub content_uri: String,
+    pub title: String,
+    pub created_at: u64,
+    pub deadline: Option<u64>,
+    pub winner_distribution: Map<u32, u32>,
+    pub fee_bps_override: Option<u32>,
+}
 
 const PENDING_ADMIN_TTL_LEDGERS: u32 = 120_960;
 
@@ -15,7 +40,7 @@ const UPGRADE_TIMELOCK_LEDGERS: u32 = 17_280;
 const UPGRADE_TIMELOCK_LEDGERS: u32 = 0;
 const PENDING_UPGRADE_TTL_LEDGERS: u32 = 518_400;
 
-pub const INITIAL_VERSION: &str = "1.6.0";
+pub const INITIAL_VERSION: &str = "1.7.0";
 
 // ============================================================
 // INITIALIZATION
@@ -250,6 +275,12 @@ pub fn migrate(env: &Env) -> Result<(), Error> {
     // ============================================================
     // PER-(from -> to) MIGRATION DISPATCH
     // ============================================================
+    // Run unconditionally rather than gating on an exact version string:
+    // propose_upgrade accepts any non-empty version, so a differently-spelled
+    // one would silently skip the rewrite and still stamp the marker, leaving
+    // every legacy event undecodable with no way to re-run. The pass skips
+    // rows already in the current layout, so running it always is safe.
+    migrate_prize_floors(env)?;
 
     storage::set_migrated_to_version(env, &current);
     storage::touch_instance(env);
@@ -261,6 +292,131 @@ pub fn migrate(env: &Env) -> Result<(), Error> {
     Ok(())
 }
 
+/// Rewrites every stored event from the pre-1.7.0 percentage layout to prize
+/// floors. `winner_distribution` and `prize_floors` differ in both name and
+/// value type, so an old row cannot be decoded by the current struct at all
+/// and has to be read through the legacy shape first.
+///
+/// Percentages were always taken against the escrow balance, so `total_budget *
+/// percent / 100` reproduces exactly what each position would have been paid.
+///
+/// Bounded by the id counter: ids run from `id_base + 1` up to the next id to
+/// be issued. The cap is a backstop against a corrupt counter, and it fails
+/// closed: exceeding it aborts before anything is stamped, because `migrate`
+/// is one-shot and a half-finished pass would leave the remaining events in a
+/// layout the current struct cannot decode, with no way to resume.
+fn migrate_prize_floors(env: &Env) -> Result<(), Error> {
+    // An invocation may touch at most 100 ledger entries and write 50, so the
+    // whole pass has to fit in one transaction's footprint. Each event costs a
+    // record read plus a record write, and a Multi event adds a read and a
+    // write per winner. Sixteen leaves headroom for the winner rewrites; above
+    // that this aborts rather than half-migrating, and a deployment that ever
+    // trips it needs a paged entrypoint instead of a one-shot pass.
+    const MAX_ROWS: u64 = 16;
+
+    let base = idempotency::id_base(env);
+    let next = storage::get_next_event_id(env, base.saturating_add(1));
+    let mut id = base.saturating_add(1);
+
+    if next.saturating_sub(id) > MAX_ROWS {
+        return Err(Error::EventIdOverflow);
+    }
+
+    while id < next {
+        let key = DataKey::Event(id);
+        // Decode defensively. `get::<LegacyEventRecord>` unwraps the
+        // conversion, and a missing field escalates to a host error rather
+        // than a catchable one, so a row already in the 1.7.0 layout would
+        // abort the whole invocation instead of being skipped. A contracttype
+        // struct is stored as a map keyed by field name, so the old layout is
+        // identified by the field that only it carries.
+        let fields: Option<Map<Symbol, Val>> = env.storage().persistent().get(&key);
+        let is_legacy =
+            fields.is_some_and(|f| f.contains_key(Symbol::new(env, "winner_distribution")));
+        let legacy: Option<LegacyEventRecord> = if is_legacy {
+            env.storage().persistent().get(&key)
+        } else {
+            None
+        };
+        if let Some(old) = legacy {
+            let mut floors: Map<u32, i128> = Map::new(env);
+            for (position, percent) in old.winner_distribution.iter() {
+                let floor = old
+                    .total_budget
+                    .saturating_mul(percent as i128)
+                    .saturating_div(100);
+                if floor > 0 {
+                    floors.set(position, floor);
+                }
+            }
+            let migrated = EventRecord {
+                id: old.id,
+                pillar: old.pillar,
+                owner: old.owner,
+                token: old.token,
+                total_budget: old.total_budget,
+                remaining_escrow: old.remaining_escrow,
+                release_kind: old.release_kind,
+                status: old.status,
+                content_uri: old.content_uri,
+                title: old.title,
+                created_at: old.created_at,
+                deadline: old.deadline,
+                prize_floors: floors,
+                fee_bps_override: old.fee_bps_override,
+            };
+            env.storage().persistent().set(&key, &migrated);
+        }
+        migrate_winner_amounts(env, id);
+        id = id.saturating_add(1);
+    }
+    Ok(())
+}
+
+/// Pre-1.7.0 `Multi` selections stored `amount: 0` on the anchor winner row,
+/// because a grant milestone derived its payout from the percentage
+/// distribution at claim time. `claim_milestone` now reads that amount, so an
+/// unrewritten row would compute a payout of zero and revert on every claim,
+/// with no way to re-select and no exit but cancelling the grant.
+///
+/// The floor for the winner's position is exactly what the old formula would
+/// have produced, since both are `total_budget * percent / 100`.
+fn migrate_winner_amounts(env: &Env, event_id: u64) {
+    let event = match storage::get_event(env, event_id) {
+        Some(e) => e,
+        None => return,
+    };
+    if !matches!(event.release_kind, ReleaseKind::Multi(_)) {
+        return;
+    }
+    let count = storage::winner_count(env, event_id);
+    for idx in 0..count {
+        let w = match storage::winner_at(env, event_id, idx) {
+            Some(w) => w,
+            None => continue,
+        };
+        // Milestone rows already carry what was actually paid; only the anchor
+        // was written with a placeholder amount.
+        if w.milestone.is_some() || w.amount != 0 {
+            continue;
+        }
+        if let Some(floor) = event.prize_floors.get(w.position) {
+            storage::set_winner_at(
+                env,
+                event_id,
+                idx,
+                &Winner {
+                    recipient: w.recipient.clone(),
+                    position: w.position,
+                    amount: floor,
+                    milestone: None,
+                    paid_at: w.paid_at,
+                },
+            );
+        }
+    }
+}
+
 // ============================================================
 // READS
 // ============================================================

contracts/events/src/bounty.rs

@@ -65,7 +65,7 @@ pub fn withdraw_application(
     applicant.require_auth();
     idempotency::require_unseen(env, &applicant, &op_id)?;
 
-    if storage::get_submission(env, bounty_id, &applicant).is_some() {
+    if storage::has_any_submission(env, bounty_id, &applicant) {
         return Err(Error::SubmissionAlreadyExists);
     }
 

contracts/events/src/crowdfunding.rs

@@ -11,16 +11,7 @@ pub fn validate_create(_env: &Env, record: &EventRecord, _owner: &Address) -> Re
         _ => return Err(Error::InvalidReleaseKind),
     }
 
-    if record.winner_distribution.len() != 1 {
-        return Err(Error::InvalidDistribution);
-    }
-    let percent = record
-        .winner_distribution
-        .get(1)
-        .ok_or(Error::InvalidDistribution)?;
-    if percent != 100 {
-        return Err(Error::DistributionMismatch);
-    }
-
+    // No floor check: crowdfunding pays milestones out of `remaining_escrow`
+    // divided by the milestones left, and never reads the prize floors.
     Ok(())
 }