DME009 Charisma Rewards

Modular rewards system for the Charisma DAO — mints governance tokens (CHA) as quest completion rewards

Overview

DME009 Charisma Rewards is a lean DAO extension contract in the Charisma protocol. It serves a single purpose: mapping quest IDs to reward amounts and minting Charisma governance tokens (via dme000-governance-token.dmg-mint) when quests are completed.

Architecture

• Authorization: All write functions are gated by is-dao-or-extension, which checks if the caller is the dungeon-master DAO contract or an approved extension.
• State: Two maps — quest-rewards-map (quest-id → reward amount) and quest-locked-map (address+quest-id → locked boolean).
• Claim flow: claim(quest-id) looks up the reward amount and calls dmg-mint to mint tokens to tx-sender (the calling extension).

Trust Assumptions

• Security depends entirely on the dungeon-master DAO contract and which extensions it authorizes.
• The dme000-governance-token must honor mint requests from this contract.
• Quest completion verification happens in the calling extension, not in this contract.

Findings

(define-public (set-rewards (quest-id uint) (amount uint))
  (begin
    (try! (is-dao-or-extension))
    (ok (map-set quest-rewards-map quest-id amount))
  )
)

(define-constant max-reward-per-quest u1000000000000) ;; 1M CHA with 6 decimals

(define-public (set-rewards (quest-id uint) (amount uint))
  (begin
    (try! (is-dao-or-extension))
    (asserts! (<= amount max-reward-per-quest) (err u2002))
    (ok (map-set quest-rewards-map quest-id amount))
  )
)

(define-public (claim (quest-id uint))
  (begin
    (try! (is-dao-or-extension))
    (let ((reward-amount (default-to u0 (map-get? quest-rewards-map quest-id))))
      (contract-call? 'SP2D5BGGJ956A635JG7CJQ59FTRFRB0893514EZPJ.dme000-governance-token
        dmg-mint reward-amount tx-sender)
    )
  )
)

Positive Observations

• Clean DAO authorization pattern: Every write function properly checks is-dao-or-extension before executing. No unprotected state mutations.
• Safe defaults: default-to u0 for missing quest rewards means unknown quests yield zero tokens, not a runtime error.
• Minimal attack surface: The contract is extremely simple (~65 lines) with no complex logic, reentrancy vectors, or asset custody.
• Proper trait implementation: Implements extension-trait with the required callback function.
• Quest locking mechanism: The quest-locked-map provides a per-user, per-quest lock that prevents double claims (enforced by the calling extension).

Full Source

;; Title: DME009 Charisma Rewards
;; Author: rozar.btc
;; Depends-On: DME000, DME001 
;; Synopsis:
;; A modular rewards system that disburses Charisma rewards for quest completions.

(impl-trait 'SP2D5BGGJ956A635JG7CJQ59FTRFRB0893514EZPJ.extension-trait.extension-trait)

(define-constant err-not-found (err u2001))
(define-constant err-unauthorized (err u3100))

(define-map quest-rewards-map uint uint)
(define-map quest-locked-map
  { address: principal, quest-id: uint }
  bool
)

;; --- Authorization check

(define-public (is-dao-or-extension)
  (ok (asserts! (or (is-eq tx-sender
    'SP2D5BGGJ956A635JG7CJQ59FTRFRB0893514EZPJ.dungeon-master)
    (contract-call?
      'SP2D5BGGJ956A635JG7CJQ59FTRFRB0893514EZPJ.dungeon-master
      is-extension contract-caller))
    err-unauthorized))
)

;; --- Internal DAO functions

(define-public (claim (quest-id uint))
  (begin
    (try! (is-dao-or-extension))
    (let ((reward-amount (default-to u0 (map-get? quest-rewards-map quest-id))))
      (contract-call?
        'SP2D5BGGJ956A635JG7CJQ59FTRFRB0893514EZPJ.dme000-governance-token
        dmg-mint reward-amount tx-sender)
    )
  )
)

(define-public (set-rewards (quest-id uint) (amount uint))
  (begin
    (try! (is-dao-or-extension))
    (ok (map-set quest-rewards-map quest-id amount))
  )
)

(define-public (set-locked (address principal) (quest-id uint) (locked bool))
  (begin
    (try! (is-dao-or-extension))
    (ok (map-set quest-locked-map { address: address, quest-id: quest-id } locked))
  )
)

;; --- Public functions

(define-read-only (get-rewards (quest-id uint))
  (ok (default-to u0 (map-get? quest-rewards-map quest-id)))
)

(define-read-only (is-locked (address principal) (quest-id uint))
  (ok (default-to false (map-get? quest-locked-map
    { address: address, quest-id: quest-id })))
)

;; --- Extension callback

(define-public (callback (sender principal) (memo (buff 34)))
  (ok true)
)