Cast a vote on a proposal.
Allows a member to vote on a proposal. The vote can be either public or anonymous depending on the proposal configuration. For public votes, the choice and weight are visible. For anonymous votes, only the weight is visible, and the choice is encrypted.
Badge-based proposals cap weight by membership badges. Token-based
proposals require weight (whole tokens) not to exceed the voter's
current token balance. Votes of weight 1 take at most
MAX_DEFAULT_WEIGHT_VOTES of the MAX_VOTES_PER_PROPOSAL slots.
env - The environment objectvoter - The address of the voterproject_key - The project key identifierproposal_id - The ID of the proposal to vote onvote - The vote data (public or anonymous)fn vote(
env: soroban_sdk::Env,
voter: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
proposal_id: u32,
vote: Vote,
)
Verify vote commitment proof for anonymous voting.
Validates that the provided tallies and seeds match the vote commitments without revealing individual votes. This ensures the integrity of anonymous voting results.
The commitment is:
C = g^v * h^r (in additive notation: gv + hr),
where g, h are BLS12-381 generator points and v is the vote choice, r is the seed. Voting weight is introduced during the tallying phase.
env - The environment objectproject_key - The project key identifierproposal - The proposal containing vote commitmentstallies - Decoded tally values [approve, reject, abstain] (scaled by weights)seeds - Decoded seed values [approve, reject, abstain] (scaled by weights)bool - True if all commitments match the provided tallies and seedsOnly proposal.id is used; the proposal is read from storage.
tallies or seeds does not holdfn proof(
env: soroban_sdk::Env,
project_key: soroban_sdk::Bytes,
proposal: Proposal,
tallies: soroban_sdk::Vec,
seeds: soroban_sdk::Vec,
) -> bool
Execute a vote after the voting period ends.
Processes the voting results and determines the final status of the proposal. For public votes, the results are calculated directly from vote counts. For anonymous votes, tallies and seeds are validated against vote commitments to ensure the results are correct.
env - The environment objectmaintainer - The address of the maintainer executing the proposalproject_key - The project key identifierproposal_id - The ID of the proposal to executeOption<tallies>] - decoded tally values (scaled by weights), respectively Approve, reject and abstainOption<seeds>] - decoded seed values (scaled by weights), respectively Approve, reject and abstaintypes::ProposalStatus - The final status of the proposal (Approved, Rejected, or Cancelled)fn execute(
env: soroban_sdk::Env,
maintainer: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
proposal_id: u32,
tallies: Option>,
seeds: Option>,
) -> ProposalStatus
Returns a page of proposals (0 to MAX_PROPOSALS_PER_PAGE proposals per page).
Proposal id is on page id / MAX_PROPOSALS_PER_PAGE. Revoked
proposals are deleted and left out, so a page can hold fewer.
env - The environment objectproject_key - The project key identifierpage - The page number (0-based)types::Dao - The DAO object containing a page of proposalsfn get_dao(env: soroban_sdk::Env, project_key: soroban_sdk::Bytes, page: u32) -> Dao
Remove a malicious or non-compliant vote from a proposal.
Only a project maintainer can call this. The vote and its tally contribution are dropped. The vote must be cast on an active proposal (removal is allowed even after the voting period ends).
env - The environment objectmaintainer - Address of the maintainer removing the voteproject_key - The project key identifierproposal_id - The ID of the proposalvoter - The address of the voter whose vote is being removedfn remove_vote(
env: soroban_sdk::Env,
maintainer: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
proposal_id: u32,
voter: soroban_sdk::Address,
)
Get a single proposal by ID.
env - The environment objectproject_key - The project key identifierproposal_id - The ID of the proposal to retrievetypes::Proposal - The proposal objectfn get_proposal(
env: soroban_sdk::Env,
project_key: soroban_sdk::Bytes,
proposal_id: u32,
) -> Proposal
Create a new proposal for a project.
The proposer is automatically added to the abstain group. By creating a proposal, the proposer incur a collateral which is repaid upon execution of the proposal unless the proposal is revoked. This is a deterrent mechanism.
env - The environment objectproposer - Address of the proposal creatorproject_key - Unique identifier for the projecttitle - Title of the proposalipfs - IPFS content identifier describing the proposalvoting_ends_at - UNIX timestamp when voting endspublic_voting - Whether voting is public or anonymousOption<token_contract>] - token contract for token-based voting;
only a maintainer sets one, and never on a project weighted by NQGOption<Vec<OutcomeContract>>] - at most three outcome contracts,
for Approved, Rejected and Cancelled, run by the executoru32 - The ID of the created proposal.fn create_proposal(
env: soroban_sdk::Env,
proposer: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
title: soroban_sdk::String,
ipfs: soroban_sdk::String,
voting_ends_at: u64,
public_voting: bool,
token_contract: Option,
outcome_contracts: Option>,
) -> u32
Revoke a proposal.
Useful if there was some spam or bad intent. Deletes the proposal and its votes; its id stays taken. Forfeits the proposer's collateral.
env - The environment objectmaintainer - Address of the maintainer or admin revoking the proposalproject_key - The project key identifierproposal_id - The ID of the proposal to revokefn revoke_proposal(
env: soroban_sdk::Env,
maintainer: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
proposal_id: u32,
)
Setup anonymous voting for a project.
Configures BLS12-381 cryptographic primitives for anonymous voting.
env - The environment objectmaintainer - The address of the maintainer (must be authorized)project_key - Unique identifier for the projectpublic_key - Asymmetric public key to be used for vote encryptionfn anonymous_voting_setup(
env: soroban_sdk::Env,
maintainer: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
public_key: soroban_sdk::String,
)
Add addresses to the conflict-of-interest list of a proposal.
Addresses on the list cannot cast a vote on the proposal.
env - The environment objectmaintainer - A maintainer of the project (must authenticate)project_key - The project key identifierproposal_id - The ID of the proposaladdresses - Addresses to add to the listfn add_conflict_of_interest(
env: soroban_sdk::Env,
maintainer: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
proposal_id: u32,
addresses: soroban_sdk::Vec,
)
Get the conflict-of-interest list for a proposal.
env - The environment objectproject_key - The project key identifierproposal_id - The ID of the proposalVec<Address> - Addresses barred from voting on the proposalfn get_conflict_of_interest(
env: soroban_sdk::Env,
project_key: soroban_sdk::Bytes,
proposal_id: u32,
) -> soroban_sdk::Vec
Get the anonymous voting configuration for a project.
env - The environment objectproject_key - The project key identifiertypes::AnonymousVoteConfig - The anonymous voting configurationfn get_anonymous_voting_config(
env: soroban_sdk::Env,
project_key: soroban_sdk::Bytes,
) -> AnonymousVoteConfig
Remove addresses from the conflict-of-interest list of a proposal.
env - The environment objectmaintainer - A maintainer of the project (must authenticate)project_key - The project key identifierproposal_id - The ID of the proposaladdresses - Addresses to remove from the listfn remove_conflict_of_interest(
env: soroban_sdk::Env,
maintainer: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
proposal_id: u32,
addresses: soroban_sdk::Vec,
)
Build vote commitments from votes and seeds for anonymous voting.
Creates BLS12-381 commitments for each vote using the formula: C = g·vote + h·seed where g and h are generator points on BLS12-381.
Note: This function does not consider voting weights, which are applied during the tallying phase. Calling this on the smart contract would reveal the votes and seeds, so it must be run either in simulation or client-side.
env - The environment objectproject_key - Unique identifier for the projectvotes - Vector of vote choices (0=approve, 1=reject, 2=abstain)seeds - Vector of random seeds for each voteVec<BytesN<96>> - Vector of vote commitments (one per vote)fn build_commitments_from_votes(
env: soroban_sdk::Env,
project_key: soroban_sdk::Bytes,
votes: soroban_sdk::Vec,
seeds: soroban_sdk::Vec,
) -> soroban_sdk::Vec>
Pause or unpause the contract (emergency stop.)
env - The environment objectadmin - The admin addresspaused - Pause or unpause the contract operations which change
ledger states.fn pause(env: soroban_sdk::Env, admin: soroban_sdk::Address, paused: bool)
Get the current version of the contract.
u32 - The contract version numberfn version(env: soroban_sdk::Env) -> u32
Set the contract running the outcome calls of proposals.
The executor has no upgrade: a new one is deployed and set here.
env - The environment objectadmin - The admin addressexecutor - The new executor contractfn set_executor(
env: soroban_sdk::Env,
admin: soroban_sdk::Address,
executor: soroban_sdk::Address,
)
Initialize the Tansu contract with admin configuration.
env - The environment objectadmin - The admin addresscollateral - The Stellar asset contract deposits are paid inexecutor - The contract running the outcome calls of proposalscollateral is not a Stellar asset contractfn __constructor(
env: soroban_sdk::Env,
admin: soroban_sdk::Address,
collateral: soroban_sdk::Address,
executor: soroban_sdk::Address,
)
Approve an upgrade proposal
env - The environment objectadmin - An admin addressfn approve_upgrade(env: soroban_sdk::Env, admin: soroban_sdk::Address)
Propose a contract upgrade.
env - The environment objectadmin - An admin addressnew_wasm_hash - The new WASM hashnew_admins_config - Optional new admin configuration (None to keep current)fn propose_upgrade(
env: soroban_sdk::Env,
admin: soroban_sdk::Address,
new_wasm_hash: soroban_sdk::BytesN<32>,
new_admins_config: Option,
)
Execute or cancel upgrade proposal
env - The environment objectadmin - An admin addressaccept - true to accept and false to reject.Upgrades can always be cancelled but only executed if there are enough approvals and the timelock period is over. Note that current governance rules apply. New config changes only in force after an update.
fn finalize_upgrade(env: soroban_sdk::Env, admin: soroban_sdk::Address, accept: bool)
Get current administrators configuration.
env - The environment objecttypes::AdminsConfig - The administrators configurationfn get_admins_config(env: soroban_sdk::Env) -> AdminsConfig
Require that the contract is not paused, panic if it is
fn require_not_paused(env: soroban_sdk::Env)
Get upgrade proposal details
fn get_upgrade_proposal(env: soroban_sdk::Env) -> UpgradeProposal
Move what the contract running on mainnet before v3 stored under other keys to the layout of v3, in one call that either does everything or nothing: the collateral becomes an address, the anonymous voting configurations of the given projects move to persistent storage, and their proposals move to one entry each, with their votes. An active proposal is cancelled and its deposits returned at the old amounts, to the proposer and to each voter.
Members and the fields of proposals need no migration: a struct read
from storage takes None for an optional field the old data lacks.
A second call fails on the first read, before any payment.
env - The environment objectadmin - An admin addressproject_keys - Every project with proposals or an anonymous voting configurationfn migrate(
env: soroban_sdk::Env,
admin: soroban_sdk::Address,
project_keys: soroban_sdk::Vec,
)
Add a new member to the system with metadata.
Optionally binds a Git identity. When provided, the identity is verified
by checking an Ed25519 signature against the caller's address, public key,
and identity string. Only git_identity and git_pubkey are persisted.
env - The environment objectmember_address - The address of the member to addmeta - Metadata string associated with the member (e.g., IPFS hash)git_identity - Git handle (e.g., "github:alice")git_pubkey - Ed25519 public keygit_sig - Ed25519 signaturefn add_member(
env: soroban_sdk::Env,
member_address: soroban_sdk::Address,
meta: soroban_sdk::String,
git_identity: Option,
git_pubkey: Option>,
git_sig: Option>,
)
Get all badges for a specific project, organized by badge type.
Returns a structure containing vectors of member addresses for each badge type (Developer, Triage, Community, Verified).
env - The environment objectkey - The project key identifiertypes::Badges - Structure containing member addresses for each badge typefn get_badges(env: soroban_sdk::Env, key: soroban_sdk::Bytes) -> Badges
Get member information including all project badges.
env - The environment objectmember_address - The address of the member to retrievetypes::Member - Member information including metadata and project badgesfn get_member(env: soroban_sdk::Env, member_address: soroban_sdk::Address) -> Member
Set badges for a member in a specific project.
This function replaces all existing badges for the member in the specified project with the new badge list. Repeated badges count once, and an empty list removes the project from the member's record. The member's maximum voting weight is calculated as the sum of all assigned badge weights.
env - The environment objectmaintainer - The address of the maintainer (must be authorized)key - The project key identifiermember - The address of the member to set badges forbadges - Vector of badges to assignbadges holds Defaultfn set_badges(
env: soroban_sdk::Env,
maintainer: soroban_sdk::Address,
key: soroban_sdk::Bytes,
member: soroban_sdk::Address,
badges: soroban_sdk::Vec,
)
Update the metadata and optionally the Git identity of an existing member.
When git_identity is Some, the signature is verified the same way
as in add_member to prevent identity impersonation.
env - The environment objectmember_address - The address of the member to updatemeta - New metadata stringgit_identity - Git handle (e.g., "github:alice")git_pubkey - Ed25519 public keygit_sig - Ed25519 signaturefn update_member(
env: soroban_sdk::Env,
member_address: soroban_sdk::Address,
meta: soroban_sdk::String,
git_identity: Option,
git_pubkey: Option>,
git_sig: Option>,
)
Get the maximum voting weight for an address in a specific project.
Calculates the sum of all badge weights for the address in the project. Returns the Default badge weight (1) if the address has no badges assigned or is not a registered member.
A project with an NQG contract set (see set_nqg_contract) uses the
weight that contract gives instead of badges.
env - The environment objectproject_key - The project key identifiermember_address - The address to checku32 - The maximum voting weight for the addressfn get_max_weight(
env: soroban_sdk::Env,
project_key: soroban_sdk::Bytes,
member_address: soroban_sdk::Address,
) -> u32
Get the NQG contract of a project, if any.
fn get_nqg_contract(
env: soroban_sdk::Env,
project_key: soroban_sdk::Bytes,
) -> Option
Set, or clear, the NQG contract giving the voting weights of a project.
When set, get_max_weight returns the contract's
get_voting_power(user: Address) -> u32 for the project, and badges
are not used. A weight of 0 means the address cannot vote. A call that
fails reads as 0.
env - The environment objectmaintainer - A maintainer of the projectproject_key - The project key identifiernqg_contract - The NQG contract, or None to use badges againfn set_nqg_contract(
env: soroban_sdk::Env,
maintainer: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
nqg_contract: Option,
)
Record an endorsement (attestation) of a commit or evidence artifact.
A multi-party primitive: independent maintainers vouch that they verified the
target. Each maintainer may attest a given target at most once — a second
call from the same attester is rejected rather than replacing the first, so
an attestation is never silently rewritten. Revoking one is an explicit,
separately evented action: see revoke_attestation. At most
MAX_ATTESTATIONS are kept on-chain; at capacity, vouches from addresses
that are no longer maintainers are pruned, and the call is rejected if
that does not free a slot. Current maintainers' vouches are never evicted.
env - The environment objectattester - The maintainer recording the attestationproject_key - The project key identifiercommit_hash - The commit hash being endorsedtarget - The attestation target: the commit or a specific evidence artifactnote - Optional pointer (e.g. a reproducibility report CID)fn attest(
env: soroban_sdk::Env,
attester: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
commit_hash: soroban_sdk::String,
target: AttestationTarget,
note: Option,
)
Set the latest commit hash for a project.
Updates the current commit hash for the specified project.
env - The environment objectmaintainer - The address of the maintainer calling this functionproject_key - The project key identifierhash - The new commit hashfn commit(
env: soroban_sdk::Env,
maintainer: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
hash: soroban_sdk::String,
)
Register a new project.
Creates a new project entry with maintainers, URL, and metadata. The project key is generated using keccak256 hash of the project name.
env - The environment objectmaintainer - The address of the maintainer calling this functionname - The project name, 4 to 30 letters and digitsmaintainers - List of maintainer addresses for the projecturl - The project's Git repository URLipfs - CID of the tansu.toml file with associated metadatamin_voting_period - Optional minimum voting period override, in secondsexecute_delay - Optional DAO execute timelock override, in secondsattestation_threshold - Optional finality threshold percent; when
None the project is set to DEFAULT_FINALITY_THRESHOLD_PERCENT. Can
be changed later with set_attestation_threshold.Bytes - The project key (keccak256 hash of the name)url or ipfs is longer than 256 bytesfn register(
env: soroban_sdk::Env,
maintainer: soroban_sdk::Address,
name: soroban_sdk::String,
maintainers: soroban_sdk::Vec,
url: soroban_sdk::String,
ipfs: soroban_sdk::String,
min_voting_period: Option,
execute_delay: Option,
attestation_threshold: Option,
) -> soroban_sdk::Bytes
Get the latest commit hash for a project.
env - The environment objectproject_key - The project key identifierString - The current commit hashfn get_commit(
env: soroban_sdk::Env,
project_key: soroban_sdk::Bytes,
) -> soroban_sdk::String
Get project information including configuration and maintainers.
env - The environment objectproject_key - The project key identifiertypes::Project - Project information including name, config, and maintainersfn get_project(env: soroban_sdk::Env, project_key: soroban_sdk::Bytes) -> Project
Get the stored evidence history for a specific project commit and kind.
Entries are returned oldest-first (the last element is the latest), and at
most MAX_EVIDENCE are kept on-chain. Returns an empty vector when no
evidence has been recorded; consumers reconstruct the full history from
EvidenceSet events via an indexer.
env - The environment objectproject_key - The project key identifiercommit_hash - The commit hash this evidence describeskind - The evidence categoryVec<types::Evidence> - The stored evidence pointers, oldest-firstfn get_evidence(
env: soroban_sdk::Env,
project_key: soroban_sdk::Bytes,
commit_hash: soroban_sdk::String,
kind: EvidenceKind,
) -> soroban_sdk::Vec
Get a page of projects.
env - The environment objectpage - The page number (0-based)Vec<types::Project> - List of projects on the requested pagefn get_projects(env: soroban_sdk::Env, page: u32) -> soroban_sdk::Vec
Store generic external evidence for a specific project commit and evidence kind.
Stores only the verifiable IPFS pointer. Evidence contents remain off-chain.
Evidence is append-only: each call adds a new entry to the history for
(project_key, commit_hash, kind) rather than overwriting the previous
one (e.g. successive CVE re-scans of the same commit). At most
MAX_EVIDENCE entries are kept on-chain; older ones roll off but remain
recoverable from EvidenceSet events via an indexer.
env - The environment objectmaintainer - The address of the maintainer calling this functionproject_key - The project key identifiercommit_hash - The commit hash this evidence describeskind - The evidence categorycid - The off-chain content identifierfn set_evidence(
env: soroban_sdk::Env,
maintainer: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
commit_hash: soroban_sdk::String,
kind: EvidenceKind,
cid: soroban_sdk::String,
)
Update the configuration of an existing project.
Changes the project's URL, IPFS metadata, and maintainer list, and
optionally its governance overrides. None governance params leave
the current values untouched; to restore a default, pass it explicitly.
Tightening (new >= current) applies immediately; loosening activates
after a notice window of current min_voting_period + execute_delay.
In-flight proposals keep their creation-time timelock.
env - The environment objectmaintainer - The address of the maintainer calling this functionkey - The project key identifiermaintainers - New list of maintainer addressesurl - New Git repository URLipfs - New CID of the tansu.toml file with metadatamin_voting_period - Optional new minimum voting period, in secondsexecute_delay - Optional new DAO execute timelock, in secondsattestation_threshold - Optional new finality threshold percent;
when None the project's current threshold is left unchangedfn update_config(
env: soroban_sdk::Env,
maintainer: soroban_sdk::Address,
key: soroban_sdk::Bytes,
maintainers: soroban_sdk::Vec,
url: soroban_sdk::String,
ipfs: soroban_sdk::String,
min_voting_period: Option,
execute_delay: Option,
attestation_threshold: Option,
)
Get the attestations recorded for a project's commit or evidence target.
Entries are returned oldest-first (the last element is the most recent) and
hold at most one entry per attester, capped at MAX_ATTESTATIONS. The full
history stays recoverable from Attested events via an indexer.
Returns an empty vector when nothing has been attested for the target.
env - The environment objectproject_key - The project key identifiercommit_hash - The commit hash the attestations relate totarget - The attestation target: the commit or a specific evidence artifactVec<types::Attestation> - The stored attestations, oldest-firstfn get_attestations(
env: soroban_sdk::Env,
project_key: soroban_sdk::Bytes,
commit_hash: soroban_sdk::String,
target: AttestationTarget,
) -> soroban_sdk::Vec
Get sub-projects for a project (if it's an organization).
env - The environment objectproject_key - The project key identifierVec<Bytes> - List of sub-project keys, empty if not an organizationfn get_sub_projects(
env: soroban_sdk::Env,
project_key: soroban_sdk::Bytes,
) -> soroban_sdk::Vec
Set sub-projects for a project (making it an organization).
Note: by design, sub-project keys are not validated against existing projects. This allows reserving a project space before the project is registered (since the key is derived from the name). A project can also appear in multiple organizations.
env - The environment objectmaintainer - The maintainer address calling this functionproject_key - The project key identifiersub_projects - List of sub-project keys to associatefn set_sub_projects(
env: soroban_sdk::Env,
maintainer: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
sub_projects: soroban_sdk::Vec,
)
Revoke the caller's own attestation from a target.
Only the attester can remove their vouch, and only their own: a maintainer cannot strike another's. Revocation is bounded twice over, so a vouch that others have already relied on cannot be pulled out from under them:
attest that brings the target
to its threshold records finality, which is never cleared. A target
can also read as final without that record after maintainers are
removed; it then becomes revocable again if they are added back.ATTESTATION_REVOCATION_WINDOW has elapsed since
created_at. Past that the vouch is permanent.Within those bounds, revoking frees the slot and the caller may attest the
target again with a fresh created_at — revoke plus re-attest is the
supported way to amend a note or correct a mistaken vouch. The
Attested / AttestationRevoked event pair is the durable audit trail.
env - The environment objectattester - The maintainer revokifn revoke_attestation(
env: soroban_sdk::Env,
attester: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
commit_hash: soroban_sdk::String,
target: AttestationTarget,
)
Compute whether an attestation target is final (canonical), on-chain.
A target is final once the share of the project's current maintainers
that have attested it reaches the project's finality threshold. The target
is either the commit itself (Commit) or a specific evidence artifact
(Evidence(kind, cid)) tied to that commit. Attestations from addresses
that are no longer maintainers are ignored, so a removed maintainer's stale
vouch cannot inflate the count.
env - The environment objectproject_key - The project key identifiercommit_hash - The commit hash being evaluatedtarget - The attestation target: the commit or a specific evidence artifacttypes::FinalityStatus - { attested, total, is_final }fn get_attestation_finality(
env: soroban_sdk::Env,
project_key: soroban_sdk::Bytes,
commit_hash: soroban_sdk::String,
target: AttestationTarget,
) -> FinalityStatus
Get the attestation finality threshold (percent) for a project.
Returns the project's stored threshold, or DEFAULT_FINALITY_THRESHOLD_PERCENT
when the project has not set one.
env - The environment objectproject_key - The project key identifieru32 - The finality threshold percent for the projectfn get_attestation_threshold(
env: soroban_sdk::Env,
project_key: soroban_sdk::Bytes,
) -> u32
Set the attestation finality threshold (percent) for a project.
A commit is considered final once the share of current maintainers that
have attested it reaches this percentage. Every project defaults to
DEFAULT_FINALITY_THRESHOLD_PERCENT until its maintainers set a value here.
A higher threshold applies at once; a lower one after the notice window
of the project's min_voting_period + execute_delay.
env - The environment objectmaintainer - The address of the maintainer calling this functionproject_key - The project key identifierpercent - The threshold percent (in MIN_FINALITY_THRESHOLD_PERCENT..=100)percent is below MIN_FINALITY_THRESHOLD_PERCENT or above 100fn set_attestation_threshold(
env: soroban_sdk::Env,
maintainer: soroban_sdk::Address,
project_key: soroban_sdk::Bytes,
attestation_threshold: Option,
)