v0 state

maxRenderedRealm

Attacker-controlled strings are clamped before they reach the sanitizer, so escaping costs a bounded constant rather than scaling with input. Sanitizing runs ~11,310 gas/byte (InlineCode) against ~31 for the raw concatenation it replaced, and Render is reachable unauthenticated through vm/qrender under maxGasQuery = 3\_000\_000\_000. ExecutorCreationRealm is dispatched through the public dao.Executor interface, so a hostile executor computes it per call while storing almost nothing. Measured on the real render path: a 250KB value costs 2,839,117,770 gas unclamped against 18,749,984 clamped. 250KB is just under the cap; about 265KB crosses it (3,008,818,394), and past that the page cannot be rendered at all by anyone. Choosing the larger number costs the attacker nothing, since the value is computed per call and almost nothing is stored. Removing that amplification is the point of this file. It does NOT make the page safe, and nothing here should be read as claiming so. The executor's method body runs inside the same query and is unbounded: an executor that simply burns CPU before returning a short string still renders the proposal page permanently un-queryable, for a few hundred bytes of on-chain storage. That predates this change — Render has always called ExecutorString() and ExecutorCreationRealm() through the public interface — and bounding it needs a gas budget around executor dispatch, not a clamp.

maxRenderedReason

Attacker-controlled strings are clamped before they reach the sanitizer, so escaping costs a bounded constant rather than scaling with input. Sanitizing runs ~11,310 gas/byte (InlineCode) against ~31 for the raw concatenation it replaced, and Render is reachable unauthenticated through vm/qrender under maxGasQuery = 3\_000\_000\_000. ExecutorCreationRealm is dispatched through the public dao.Executor interface, so a hostile executor computes it per call while storing almost nothing. Measured on the real render path: a 250KB value costs 2,839,117,770 gas unclamped against 18,749,984 clamped. 250KB is just under the cap; about 265KB crosses it (3,008,818,394), and past that the page cannot be rendered at all by anyone. Choosing the larger number costs the attacker nothing, since the value is computed per call and almost nothing is stored. Removing that amplification is the point of this file. It does NOT make the page safe, and nothing here should be read as claiming so. The executor's method body runs inside the same query and is unbounded: an executor that simply burns CPU before returning a short string still renders the proposal page permanently un-queryable, for a few hundred bytes of on-chain storage. That predates this change — Render has always called ExecutorString() and ExecutorCreationRealm() through the public interface — and bounding it needs a gas budget around executor dispatch, not a clamp.

maxRenderedError

Attacker-controlled strings are clamped before they reach the sanitizer, so escaping costs a bounded constant rather than scaling with input. Sanitizing runs ~11,310 gas/byte (InlineCode) against ~31 for the raw concatenation it replaced, and Render is reachable unauthenticated through vm/qrender under maxGasQuery = 3\_000\_000\_000. ExecutorCreationRealm is dispatched through the public dao.Executor interface, so a hostile executor computes it per call while storing almost nothing. Measured on the real render path: a 250KB value costs 2,839,117,770 gas unclamped against 18,749,984 clamped. 250KB is just under the cap; about 265KB crosses it (3,008,818,394), and past that the page cannot be rendered at all by anyone. Choosing the larger number costs the attacker nothing, since the value is computed per call and almost nothing is stored. Removing that amplification is the point of this file. It does NOT make the page safe, and nothing here should be read as claiming so. The executor's method body runs inside the same query and is unbounded: an executor that simply burns CPU before returning a short string still renders the proposal page permanently un-queryable, for a few hundred bytes of on-chain storage. That predates this change — Render has always called ExecutorString() and ExecutorCreationRealm() through the public interface — and bounding it needs a gas budget around executor dispatch, not a clamp.

maxRenderedTitle

Attacker-controlled strings are clamped before they reach the sanitizer, so escaping costs a bounded constant rather than scaling with input. Sanitizing runs ~11,310 gas/byte (InlineCode) against ~31 for the raw concatenation it replaced, and Render is reachable unauthenticated through vm/qrender under maxGasQuery = 3\_000\_000\_000. ExecutorCreationRealm is dispatched through the public dao.Executor interface, so a hostile executor computes it per call while storing almost nothing. Measured on the real render path: a 250KB value costs 2,839,117,770 gas unclamped against 18,749,984 clamped. 250KB is just under the cap; about 265KB crosses it (3,008,818,394), and past that the page cannot be rendered at all by anyone. Choosing the larger number costs the attacker nothing, since the value is computed per call and almost nothing is stored. Removing that amplification is the point of this file. It does NOT make the page safe, and nothing here should be read as claiming so. The executor's method body runs inside the same query and is unbounded: an executor that simply burns CPU before returning a short string still renders the proposal page permanently un-queryable, for a few hundred bytes of on-chain storage. That predates this change — Render has always called ExecutorString() and ExecutorCreationRealm() through the public interface — and bounding it needs a gas budget around executor dispatch, not a clamp.

maxRenderedPayment

Attacker-controlled strings are clamped before they reach the sanitizer, so escaping costs a bounded constant rather than scaling with input. Sanitizing runs ~11,310 gas/byte (InlineCode) against ~31 for the raw concatenation it replaced, and Render is reachable unauthenticated through vm/qrender under maxGasQuery = 3\_000\_000\_000. ExecutorCreationRealm is dispatched through the public dao.Executor interface, so a hostile executor computes it per call while storing almost nothing. Measured on the real render path: a 250KB value costs 2,839,117,770 gas unclamped against 18,749,984 clamped. 250KB is just under the cap; about 265KB crosses it (3,008,818,394), and past that the page cannot be rendered at all by anyone. Choosing the larger number costs the attacker nothing, since the value is computed per call and almost nothing is stored. Removing that amplification is the point of this file. It does NOT make the page safe, and nothing here should be read as claiming so. The executor's method body runs inside the same query and is unbounded: an executor that simply burns CPU before returning a short string still renders the proposal page permanently un-queryable, for a few hundred bytes of on-chain storage. That predates this change — Render has always called ExecutorString() and ExecutorCreationRealm() through the public interface — and bounding it needs a gas budget around executor dispatch, not a clamp.

clampField

Always clamp first — before escaping, and before any other pass over the value. Trimming used to run before the clamp, which meant it walked every byte the executor returned: 250KB of spaces cost 1,368,719,824 gas to render nothing, and 560KB cost 3,048,904,520, past the query cap. Clamping first bounds that scan and brought the same 560KB down to 16,657,792. Never clamp after escaping either. The escapers size their wrapper from the string they are handed — InlineCode picks a fence long enough to outscan the backticks it can see. Cutting a value that has already been escaped can slice the closing fence off and leave the span hanging open, which is worse than not clamping at all. Both call sites read InlineCode(clampField(...)) for that reason, and the enormous-value case in filetests/executor\_disclosure\_filetest.gno fails if the two are swapped. clampField cuts s to at most max bytes, backing off to a rune boundary so a well-formed multi-byte character is not split, and marks the result so a reader can tell it was cut. Input that is already invalid UTF-8 can still leave a dangling lead byte; the sanitizer tolerates that. The marker avoids markdown punctuation: these values are escaped downstream, and parentheses would come back as "\\(truncated\\)".

FilterByTier

NewFilterByTier

ErrMemberNotFound

GovDAO

NewGovDAO

_govdao

Setting this to a global variable forces attaching the GovDAO struct to this realm. TODO replace with future \`attach()\`.

law

govDAO

init.14

Render

AddMember

AddMember allows T1 and T2 members to freely add T3 members using their invitation points.

GetInstance

GetInstance returns the singleton \*GovDAO. Only the loader realm may call it (used during the bootstrap UpdateImpl handoff). The IsCurrent() check rejects stale or stashed realm values; PkgPath() after the check is the authentic immediate caller.

NewChangeLawRequest

NewUpgradeDaoImplRequest

NewAddMemberRequest

NewWithdrawMemberRequest

NewPromoteMemberRequest

NewTreasuryPaymentRequest

NewTreasuryGRC20TokensUpdate

NewTreasuryGRC20TokensUpdate creates a proposal request to update the list of GRC20 tokens registry keys used by the treasury. The new list, if voted and accepted, will overwrite the current one.

memberByTier

render

NewRender

isPropActive

getPropStatus

renderActionBar

tryResolveAddr

tryResolveAddr renders the author/voter as a username link. RenderLink interpolates the username raw into "\[@name](/u/name)" (r/sys/users), so this is markdown-safe ONLY because r/sys/users validateName restricts names to ^\[a-z]\[a-z0-9]\*(\[\_-]\[a-z0-9]+)\*$ (max 64) — no markdown/HTML metachar. If that charset ever loosens, this line and writeVotes in types.gno need escaping.

Law

NewLaw

ProposalsStatuses

ProposalsStatuses contains the status of all the proposals indexed by the proposal ID.

NewProposalsStatuses

proposalStatus

getMembers

newEmptyVoteStore

newProposalStatus

StringifyVotes

writeVotes

StringifyProposal