vero-core-contracts/src/gas.rs at main · ghzhost/vero-core-contracts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
use crate::types::Operation;

// ─── Instruction-unit cost constants ──────────────────────────────────────────
//
// Calibrated against Soroban's metering schedule (Stellar Protocol 21):
//   • Base invocation overhead      ~500_000 instructions
//   • Instance storage read          ~50_000 instructions per entry
//   • Instance storage write        ~150_000 instructions per entry
//   • Cross-contract call overhead  ~500_000 instructions (per call)
//   • WASM upgrade (deployer)     ~2_000_000 instructions (platform fixed)
//   • Event emission                 ~30_000 instructions per topic/value
//
// Values are intentionally conservative (slightly above observed minimums) so
// that callers using these estimates as a gas limit are unlikely to run short.
// All figures are in instruction units, which map 1-to-1 to the `fee_per_instruction_increment`
// ledger base-fee calculation used by Stellar's fee schedule.

/// `register_task`: base + reentrancy lock write + has() check + role check + task write + index write + unlock write + event.
/// `500_000 + 150_000 + 50_000 + 50_000 + 150_000 + 150_000 + 150_000 + 30_000`
pub const COST_REGISTER_TASK: u64 = 1_300_000;

/// `vote`:
///   base + circuit-breaker read + 5 reads (token, threshold, balance, voted, task)
///   + reentrancy lock/unlock (2 writes) + voted write + task write + event emission
///   + conditional fault-isolated `try_release_funds` cross-contract call to vault
///     (the `try_` invocation carries extra host overhead over a direct call)
///     500_000 + 5*50_000 + 2*150_000 + 2*150_000 + 2*30_000 + 1_500_000
pub const COST_VOTE: u64 = 3_200_000;

/// `add_guardian`: base + circuit-breaker read + guardian write.
/// `500_000 + 50_000 + 150_000`
pub const COST_ADD_GUARDIAN: u64 = 700_000;

/// `set_reputation`: base + circuit-breaker read + reputation write.
/// `500_000 + 50_000 + 150_000`
pub const COST_SET_REPUTATION: u64 = 700_000;

/// `lock_tokens`:
///   base + paused read + auth + token read + fee_bps read + treasury read + 2x transfer + balance read + balance write + event
///   500_000 + 5*50_000 + 2*1_500_000 + 50_000 + 150_000 + 30_000
pub const COST_LOCK_TOKENS: u64 = 5_000_000;

/// `unlock_tokens`:
///   base + has() check + guardian read + balance read + fee read + treasury read + 2x token transfer + balance write
///   500_000 + 50_000 + 50_000 + 50_000 + 50_000 + 50_000 + 2*1_500_000 + 150_000
pub const COST_UNLOCK_TOKENS: u64 = 5_000_000;

/// `resign_guardian`:
///   base + has() check + guardian status write + balance read + fee read + treasury read + 2x conditional token transfer + balance write
///   500_000 + 50_000 + 150_000 + 50_000 + 50_000 + 50_000 + 2*1_500_000 + 150_000
pub const COST_RESIGN_GUARDIAN: u64 = 5_000_000;

/// `set_weight_threshold`: base + threshold write.
/// `500_000 + 150_000`
pub const COST_SET_WEIGHT_THRESHOLD: u64 = 650_000;

/// `start_reward_stream`:
///   base + circuit-breaker read + task read + stream has() check
///   + cross-contract call to Drips + stream write + event
///     500_000 + 50_000 + 50_000 + 50_000 + 500_000 + 150_000 + 30_000
///
///   500_000 + 50_000 + 50_000 + 50_000 + 500_000 + 150_000 + 30_000
pub const COST_START_REWARD_STREAM: u64 = 1_330_000;

/// `toggle_pause` / `pause` / `unpause`: base + paused read + paused write + event.
/// `500_000 + 50_000 + 150_000 + 30_000`
pub const COST_TOGGLE_PAUSE: u64 = 730_000;

/// `record_failure(reporter)`: base + auth + trusted-mode read + cooldown read + reporter-quota read + reporter index read/write + last-report write + reporter-count write + failure-count read/write + conditional paused write + report event + conditional trip event.
///
/// `500_000 + 4*50_000 + 5*150_000 + 2*30_000`
pub const COST_RECORD_FAILURE: u64 = 1_510_000;

/// `reset_circuit_breaker`: base + failure-count write + paused remove.
/// `500_000 + 150_000 + 150_000`
pub const COST_RESET_CIRCUIT_BREAKER: u64 = 800_000;

/// `upgrade_contract`: base + WASM deployer overhead (fixed platform cost for new wasm hash write).
/// `500_000 + 2_000_000`
pub const COST_UPGRADE_CONTRACT: u64 = 2_500_000;

/// `record_snapshot`: base + get_snapshot reads + 2 writes (AllSnapshots + Snapshot) + event.
/// `500_000 + 20*50_000 + 2*150_000 + 30_000`
///
/// This is a fixed estimate for a small/typical guardian+task count. Once any
/// collection nears `logic::MAX_SNAPSHOT_COLLECTION_SIZE`, `record_snapshot`
/// costs scale with collection size (and above the cap it reverts with
/// `SnapshotTooLarge` rather than exceeding the ledger's instruction budget).
pub const COST_RECORD_SNAPSHOT: u64 = 1_830_000;

/// `purge_task`: base + 2 task reads + AllTasks read + per-voter Voted removes (avg 5) +
/// TaskVoters remove + ActiveTask remove + ArchivedTask remove + AllTasks write + event.
/// `500_000 + 2*50_000 + 50_000 + 5*150_000 + 4*150_000 + 30_000`
pub const COST_PURGE_TASK: u64 = 2_030_000;

/// `vote_batch` (batch size = 5):
///
/// base + circuit-breaker read + auth + 5 reads (token, threshold, balance, weight, weight_threshold)
/// + reentrancy lock/unlock (2 writes)
/// + per-task: voted read, task read, voted write, task write, voter append write, event (×5)
/// + conditional vault calls (×5)
///
/// ~ `500_000 + 50_000 + 5*50_000 + 2*150_000 + 5*(50_000 + 50_000 + 150_000 + 150_000 + 150_000 + 30_000 + 500_000)`
///
/// ~ `500_000 + 50_000 + 250_000 + 300_000 + 5*1_080_000`
pub const COST_VOTE_BATCH: u64 = 6_500_000;

/// `set_upgrade_signers`: base + write (UpgradeSigners) + write (UpgradeThreshold).
/// `500_000 + 150_000 + 150_000`
pub const COST_SET_UPGRADE_SIGNERS: u64 = 800_000;

/// `propose_upgrade`: base + signer check read + pending check read + write (PendingUpgradeWasm) + write (PendingUpgradeApprovals) + event.
/// `500_000 + 50_000 + 50_000 + 150_000 + 150_000 + 30_000`
pub const COST_PROPOSE_UPGRADE: u64 = 930_000;

/// `approve_upgrade`: base + signer check read + pending check read + duplicate check + write (PendingUpgradeApprovals) + event.
/// `500_000 + 50_000 + 50_000 + 50_000 + 150_000 + 30_000`
pub const COST_APPROVE_UPGRADE: u64 = 830_000;

/// `execute_upgrade`: base + threshold read + approvals read + signers read + deployer call (costly) + cleanup writes + event.
/// `500_000 + 50_000 + 50_000 + 50_000 + 2_000_000 + 2*150_000 + 30_000`
pub const COST_EXECUTE_UPGRADE: u64 = 2_980_000;

/// `cancel_upgrade`: base + admin auth + 3 removes + event.
/// `500_000 + 3*150_000 + 30_000`
pub const COST_CANCEL_UPGRADE: u64 = 980_000;

/// `emergency_recover`: base + role read + token read + token transfer + event.
/// `500_000 + 50_000 + 50_000 + 500_000 + 30_000`
pub const COST_EMERGENCY_RECOVER: u64 = 1_130_000;

pub const COST_SET_FEE_BPS: u64 = 650_000;
pub const COST_SET_TREASURY_ADDRESS: u64 = 650_000;

// ─── Public mapping function ───────────────────────────────────────────────────

/// Returns the estimated instruction-unit cost for a given [`Operation`].
///
/// This is a pure constant-time function — it does not read or write any
/// storage, perform any authentication, or make cross-contract calls.
/// Callers can use the returned value to set an appropriate `fee` or
/// `resource_fee` when constructing a Soroban transaction.
///
/// # Notes
/// - Costs are conservative upper bounds calibrated against Soroban Protocol 21
///   metering constants. Actual on-chain costs may be lower.
/// - `Vote` and `UpgradeContract` are the most expensive operations.
/// - Pure view functions (`get_task`, `get_reputation`, etc.) are intentionally
///   excluded — their cost is negligible and bounded by the base invocation fee.
pub fn get_estimated_cost(op: Operation) -> u64 {
    match op {
        Operation::RegisterTask => COST_REGISTER_TASK,
        Operation::Vote => COST_VOTE,
        Operation::AddGuardian => COST_ADD_GUARDIAN,
        Operation::SetReputation => COST_SET_REPUTATION,
        Operation::LockTokens => COST_LOCK_TOKENS,
        Operation::UnlockTokens => COST_UNLOCK_TOKENS,
        Operation::ResignGuardian => COST_RESIGN_GUARDIAN,
        Operation::SetWeightThreshold => COST_SET_WEIGHT_THRESHOLD,
        Operation::StartRewardStream => COST_START_REWARD_STREAM,
        Operation::TogglePause => COST_TOGGLE_PAUSE,
        Operation::RecordFailure => COST_RECORD_FAILURE,
        Operation::ResetCircuitBreaker => COST_RESET_CIRCUIT_BREAKER,
        Operation::UpgradeContract => COST_UPGRADE_CONTRACT,
        Operation::RecordSnapshot => COST_RECORD_SNAPSHOT,
        Operation::PurgeTask => COST_PURGE_TASK,
        Operation::VoteBatch => COST_VOTE_BATCH,
        Operation::SetUpgradeSigners => COST_SET_UPGRADE_SIGNERS,
        Operation::ProposeUpgrade => COST_PROPOSE_UPGRADE,
        Operation::ApproveUpgrade => COST_APPROVE_UPGRADE,
        Operation::ExecuteUpgrade => COST_EXECUTE_UPGRADE,
        Operation::CancelUpgrade => COST_CANCEL_UPGRADE,
        Operation::EmergencyRecover => COST_EMERGENCY_RECOVER,
        Operation::SetFeeBps => COST_SET_FEE_BPS,
        Operation::SetTreasuryAddress => COST_SET_TREASURY_ADDRESS,
    }
}