Street Controller Audit

;; Welsh Street Controller
 
;; errors
;; 4 unique error codes with u94x prefix + 1 non-standard (u2) — all tested
(define-constant ERR_ALREADY_MINTED (err u941))
(define-constant ERR_NOT_CONTRACT_OWNER (err u942))
(define-constant ERR_MINT_CAP (err u943))
(define-constant ERR_NO_LIQUIDITY (err u944))
 
;; non-standard error code — breaks u94x convention (see I-02)
(define-constant ERR_YOU_POOR (err u2))
 
;; constants
 
;; 1,000,000 STREET bonus on milestone mints (every 21st) — 10x standard reward
(define-constant MINT_BONUS u1000000000000)
 
;; 100,000 STREET standard reward per mint (6 decimals)
(define-constant MINT_STREET u100000000000)
 
;; 1,000 WELSH donation required per mint (6 decimals) — transferred to street-rewards
(define-constant DONATE_WELSH u1000000000)
 
;; global cap — maximum 21,000 total mints across all users
(define-constant MINT_CAP u21000)
 
;; variables
 
;; monotonically increasing — counts total successful mints (0 to MINT_CAP)
(define-data-var mint-count uint u0)
 
;; initialized to deployer at deployment — owner has no economic privileges
(define-data-var contract-owner principal tx-sender)
 
;; tracks per-user mint count — each principal can mint up to 2 times
(define-map users principal uint)
 
;; permissionless mint — donates WELSH and receives STREET + NFT
(define-public (mint)
  (let (
      ;; caller's WELSH balance — used for donation threshold check
      ;; unwrap-panic safe — get-balance always returns (ok uint)
      (user-welsh (unwrap-panic (contract-call? .welshcorgicoin get-balance contract-caller)))
 
      ;; total LP supply — must be > 0 (pool must be initialized)
      (total-lp (unwrap-panic (contract-call? .credit-token get-total-supply)))
 
      ;; pre-increment count — used for cap check and milestone detection
      (count (+ (var-get mint-count) u1))
 
      ;; milestone check — every 21st mint (21, 42, 63, ...) gets bonus (see I-03)
      (is-milestone (is-eq (mod count u21) u0))
 
      ;; 10x reward on milestone, standard otherwise — hardcoded, immutable
      (mint-amount (if is-milestone MINT_BONUS MINT_STREET))
    )
    (begin
      ;; requires active liquidity pool — prevents minting before exchange is operational
      (asserts! (> total-lp u0) ERR_NO_LIQUIDITY)
 
      ;; caller must hold at least 1,000 WELSH to participate
      (asserts! (>= user-welsh DONATE_WELSH) ERR_YOU_POOR)
 
      ;; per-user limit: 2 mints maximum — immutable, no reset mechanism, no owner override
      (asserts! (< (default-to u0 (map-get? users contract-caller)) u2) ERR_ALREADY_MINTED)
 
      ;; global cap check — prevents more than 21,000 total mints
      (asserts! (<= count MINT_CAP) ERR_MINT_CAP)
 
      ;; mint STREET tokens to caller — street-controller is whitelisted in street-token.mint
      (try! (contract-call? .street-token mint mint-amount contract-caller))
 
      ;; mint NFT #count to caller — street-controller is whitelisted in street-nft.mint
      (try! (contract-call? .street-nft mint count contract-caller))
 
      ;; donate WELSH from caller to street-rewards pool
      ;; uses contract-caller as from — welshcorgicoin checks is-eq from tx-sender
      ;; both resolve to the original user, ensuring only caller's own WELSH is donated
      (try! (contract-call? .welshcorgicoin transfer DONATE_WELSH contract-caller .street-rewards none))
 
      ;; update WELSH reward index — street-controller is whitelisted in street-rewards.update-rewards-a
      ;; if this fails, all prior mints and transfers revert atomically
      (try! (contract-call? .street-rewards update-rewards-a DONATE_WELSH))
 
      ;; state updates only after all cross-contract calls succeed
      ;; increment user's mint count (0 → 1, or 1 → 2)
      (map-set users contract-caller (+ (default-to u0 (map-get? users contract-caller)) u1))
 
      ;; update global mint count
      (var-set mint-count count)
      (ok {
        amount-a: DONATE_WELSH,
        amount-b: mint-amount, 
        block: burn-block-height,
        count: count,
      })
    )
  )
)
 
;; single-step ownership transfer — no two-step confirmation pattern (see I-01)
(define-public (set-contract-owner (new-owner principal))
  (begin
    ;; contract-caller check — only direct caller, not tx-sender chain
    (asserts! (is-eq contract-caller (var-get contract-owner)) ERR_NOT_CONTRACT_OWNER)
    (var-set contract-owner new-owner)
    (ok true)
  )
)
 
;; === READ-ONLY FUNCTIONS — no access control needed ===
 
(define-read-only (get-contract-owner)
  (ok (var-get contract-owner)))
 
;; returns total mints executed — publicly readable, used to predict milestone mints
(define-read-only (get-mint-count)
  (ok (var-get mint-count)))