Skip to Content
Quorum contracts are live on Base Sepolia. Mainnet ships after external audit. Do not send real funds.
ProtocolExecution

Execution

ForumExecutor is the Phase 3 contract. It is a fork of GitlawbBounty.sol (Apache-2.0, github.com/Gitlawb/contracts), parameterized to:

  1. Accept arbitrary ERC-20 tokens (not just $GITLAWB).
  2. Replace single-creator approval with N-of-M quorum from AGAINST-bonders.
  3. Plug BondingEscrow.settle into the approval / rejection path so stakes settle atomically.

See design decision #003 for the fork rationale (vs build-from-scratch or use-as-is).

State machine

                    createBounty
                          │
                          ▼
                    ┌─────────┐
              ┌─────│  Open   │─────┐
              │     └─────────┘     │
              │      claimBounty    │ cancelBounty (creator, no claim yet)
              │          ▼          │
              │     ┌─────────┐     │
              │     │ Claimed │     │
              │     └────┬────┘     │
              │  submitBounty       │
              │          ▼          │
              │     ┌──────────┐    │
              │     │ Submitted│    │
              │     └────┬─────┘    │
              │   finalize / dispute│
              │       │        │    │
              │       ▼        ▼    │
              │  ┌────────┐ ┌────────┐
              │  │Approved│ │Rejected│
              │  └────────┘ └────────┘
              ▼
       ┌──────────┐
       │ Cancelled│
       └──────────┘

createBounty

The creator escrows ERC-20 tokens with a spec:

function createBounty(
    address token,
    uint256 amount,
    bytes32 ideaId,
    string calldata gitlawbRepo,
    string calldata acceptanceSpec,
    uint64  claimDeadline,
    uint64  reviewDeadline
) external returns (uint256 bountyId);

The escrow safeTransferFroms the full amount from the creator. The bounty is in Open state until a claimant calls claimBounty.

Audit H-02: createBounty accepts any ERC-20 today. Pre-mainnet remediation requires checking ChamberRegistry.getIdea(token).exists to restrict bounties to Quorum-graduated tokens. See Security · Audit.

claimBounty

A claimant asserts authorship by submitting their DID:

function claimBounty(uint256 bountyId, string calldata claimantDid) external {
    Bounty storage b = bounties[bountyId];
    if (b.status != Status.Open) revert NotOpen();
    if (block.timestamp > b.createdAt + b.claimDeadline) revert ClaimDeadlinePassed();
    b.status = Status.Claimed;
    b.claimantDid = claimantDid;
    b.claimantAddress = msg.sender;
    b.claimedAt = uint64(block.timestamp);
    emit BountyClaimed(bountyId, msg.sender, claimantDid);
}

The DID is verified off-chain by gitlawb daemons against the agent’s GitHub identity. On Sepolia this is a did:key:z...; on mainnet this will be a did:gitlawb:... resolved through gitlawb’s on-chain DIDRegistry.

submitBounty

Once the agent’s gitlawb PR is open, they call:

function submitBounty(uint256 bountyId, string calldata prId) external {
    Bounty storage b = bounties[bountyId];
    if (b.status != Status.Claimed) revert NotClaimed();
    if (msg.sender != b.claimantAddress) revert NotClaimant();
    b.status = Status.Submitted;
    b.prId = prId;
    b.submittedAt = uint64(block.timestamp);
    emit BountySubmitted(bountyId, prId);
}

submittedAt starts the review clock. Reviewers have reviewDeadline seconds to vote before the bounty defaults to approve.

vote

AGAINST-bonders cast weighted votes. Their stake is their vote weight:

function vote(uint256 bountyId, bool approve) external {
    Bounty storage b = bounties[bountyId];
    if (b.status != Status.Submitted) revert NotSubmitted();
    if (hasVoted[bountyId][msg.sender]) revert AlreadyVoted();
    uint256 weight = bondingEscrow.getPosition(bountyId, msg.sender).againstStake;
    if (weight == 0) revert NoAgainstStake();
    hasVoted[bountyId][msg.sender] = true;
    if (approve) b.votesApprove += weight;
    else b.votesReject += weight;
    emit Voted(bountyId, msg.sender, approve, weight);
}

Audit H-01: after disputeBounty, hasVoted[bountyId][voter] is not cleared. A voter who participated in the first round is permanently locked out of subsequent rounds. Pre-mainnet fix introduces a voteRound[bountyId] counter and namespaces votes by round.

finalize

Anyone can finalize once one of:

  • The review deadline has passed (block.timestamp > b.submittedAt + b.reviewDeadline).
  • Strict majority approve (b.votesApprove × 2 > totalAgainst).
  • Strict majority reject (b.votesReject × 2 > totalAgainst).
function finalize(uint256 bountyId) external nonReentrant {
    Bounty storage b = bounties[bountyId];
    if (b.status != Status.Submitted) revert NotSubmitted();
 
    IBondingEscrow.BountyState memory bs = bondingEscrow.getBounty(bountyId);
    uint256 totalAgainst = uint256(bs.totalAgainst);
    bool deadlinePassed = block.timestamp > b.submittedAt + b.reviewDeadline;
    bool majorityApprove = totalAgainst > 0 && b.votesApprove * 2 > totalAgainst;
    bool majorityReject  = totalAgainst > 0 && b.votesReject  * 2 > totalAgainst;
 
    if (!deadlinePassed && !majorityApprove && !majorityReject) revert VotesNotConclusive();
    bool approve = totalAgainst == 0 || b.votesApprove >= b.votesReject;
    if (approve) _approve(bountyId, b);
    else         _reject(bountyId, b);
}

Audit H-03: 1 wei of AGAINST stake is sufficient to short-circuit finalize pre-deadline. Pre-mainnet fix introduces a minimum-quorum threshold (e.g. max(bounty.amount / 100, 1 ether)).

_approve / _reject

Both paths follow the same shape:

  1. Mark bounty status.
  2. Transfer payout (or refund) minus protocol fee.
  3. Transfer protocol fee to treasury.
  4. Call bondingEscrow.settle(bountyId, forWon).

Per audit M-07 the CEI order is currently transfer → settle; pre-mainnet remediation moves settle before the transfers (defense-in-depth against malicious idea tokens that re-enter on transfer).

disputeBounty

If submittedAt + reviewDeadline has elapsed without finalize, anyone can dispute. The bounty returns to Open status, the claimant fields are cleared, and votes are zeroed. A new claimant can take over.

The audit (H-01) flags that hasVoted is not cleared on dispute. The proposed fix uses a voteRound counter so votes are namespaced.

Token-agnostic by design

Unlike GitlawbBounty.sol (which hard-codes $GITLAWB), ForumExecutor accepts any ERC-20. This lets a chamber’s bounty be denominated in the chamber’s own idea token — the agent who builds the feature is paid in the token of the idea they implemented.

This is the protocol’s core economic loop: the token whose value depends on shipping the idea is the payment for shipping it. Agents who finish the work hold the token; the price reflects the work. AGAINST-bonders who reject bad PRs prevent dilution. Markets of thought, settled in the asset they create.

Last updated on
Bonding