Emission Controller Audit

;; Welsh Street Emission Controller
 
;; errors
;; 4 unique error codes with u93x prefix — all tested, no overlap with other contracts
(define-constant ERR_EMISSION_INTERVAL (err u931))
(define-constant ERR_NOT_CONTRACT_OWNER (err u932))
(define-constant ERR_NOT_ELIGIBLE (err u933))
(define-constant ERR_NO_LIQUIDITY (err u934))
 
;; constants
 
;; 10,000 STREET per emission (6 decimals) — hardcoded, immutable after deployment
(define-constant AMOUNT u10000000000)
 
;; 0.1% of total LP supply required to trigger mint — integer division floors to 0 at low supply
(define-constant THRESHOLD u1000)
 
;; variables
 
;; monotonically increasing — counts total successful mints
(define-data-var current-epoch uint u0)
 
;; tracks last block an emission occurred — used for once-per-block rate limiting
(define-data-var last-burn-block uint u0)
 
;; initialized to deployer at deployment — owner has no economic privileges
(define-data-var contract-owner principal tx-sender)
 
;; permissionless emission trigger — any LP holder with ≥ 0.1% of CREDIT supply can call
(define-public (mint)
  (let (
      ;; snapshot last emission block for interval check
      (last-mint (var-get last-burn-block))
 
      ;; blocks since last emission — subtraction safe because last-burn-block ≤ burn-block-height
      (blocks-elapsed (- burn-block-height last-mint))
 
      ;; total LP supply — unwrap-panic safe, get-total-supply always returns (ok uint)
      (total-lp (unwrap-panic (contract-call? .credit-token get-total-supply)))
 
      ;; caller's LP balance — uses contract-caller for authorization
      (caller-credit (unwrap-panic (contract-call? .credit-token get-balance contract-caller)))
 
      ;; minimum LP required — integer division floors to 0 when total-lp < THRESHOLD (see I-03)
      (min-credit (/ total-lp THRESHOLD))
    )
    (begin
      ;; requires active liquidity pool — prevents emission before pool initialization
      (asserts! (> total-lp u0) ERR_NO_LIQUIDITY)
 
      ;; once-per-block rate limit — first eligible caller wins per block
      (asserts! (>= blocks-elapsed u1) ERR_EMISSION_INTERVAL)
 
      ;; caller must hold ≥ 0.1% of total CREDIT — incentivizes LP participation
      (asserts! (>= caller-credit min-credit) ERR_NOT_ELIGIBLE)
 
      ;; mint STREET directly to street-rewards contract — caller receives no tokens
      ;; emission-controller is whitelisted in street-token.mint
      (try! (contract-call? .street-token mint AMOUNT .street-rewards))
 
      ;; update reward index so existing LP holders can claim proportional share
      ;; emission-controller is whitelisted in street-rewards.update-rewards-b
      ;; if this fails, the street-token mint above also reverts (atomic)
      (try! (contract-call? .street-rewards update-rewards-b AMOUNT))
 
      ;; state updates only after both cross-contract calls succeed
      (var-set current-epoch (+ (var-get current-epoch) u1))
      (var-set last-burn-block burn-block-height)
      (ok {
        amount: AMOUNT,
        block: burn-block-height,
        epoch: (var-get current-epoch),
      })
    )
  )
)
 
;; single-step ownership transfer — no two-step confirmation pattern (see I-01)
(define-public (set-contract-owner (new-owner principal))
  (begin
    ;; contract-caller check — only direct caller, not tx-sender chain
    (asserts! (is-eq contract-caller (var-get contract-owner)) ERR_NOT_CONTRACT_OWNER)
    (var-set contract-owner new-owner)
    (ok true)
  )
)
 
;; === READ-ONLY FUNCTIONS — no access control needed ===
 
(define-read-only (get-contract-owner)
  (ok (var-get contract-owner)))
 
;; returns total successful emission count
(define-read-only (get-current-epoch)
  (ok (var-get current-epoch)))
 
;; returns block height of last emission — used to calculate next eligible block
(define-read-only (get-last-burn-block)
  (ok (var-get last-burn-block)))