feat: withdraw uses effective funds, per-tx cap, emergency withdrawal…

[ExcelDsigN-tech]

Closes #514, Closes #522, Closes #525, Closes #527

Overview

This PR resolves financial calculation bugs, expands anti-whale protection controls, adds emergency fund recovery mechanics, and prevents duplicate campaign title creation across the smart contract platform.

Specifically, it updates fee calculations to target net raised funds after refunds, introduces an admin-configurable per-transaction contribution ceiling, implements a 2-step timelocked emergency withdrawal pattern for misconfigured campaigns, and enforces per-creator campaign title uniqueness.

Feature Summary

• Refund-Adjusted Platform Fee Calculation: Updated withdraw_funds to compute platform fees and creator payouts against effective_amount_raised instead of amount_raised, preventing fee overcharges when refunds have occurred.
• Per-Transaction Limit Safeguard: Introduced max_contribution_per_transaction as an admin-configurable parameter to block single large contributions (e.g., 199% of goal) that evade auto-pause rules.
• Timelocked Emergency Withdrawal: Built a two-step emergency recovery mechanism (propose_emergency_withdraw and execute_emergency_withdraw) guarded by a mandatory 7-day timelock and admin authentication.
• Per-Creator Campaign Title Uniqueness Index: Added indexing via DataKey::CreatorCampaignTitleIndex(creator, title_hash) to reject duplicate campaign titles from the same creator address.

Technical Implementation

• Payout Accounting (src/lib.rs / src/withdraw.rs): Replaced amount_raised with effective_amount_raised in withdraw_funds when deriving platform fee shares and net creator payouts.
• Transaction Limit Checks (src/lib.rs / src/storage.rs): Added DataKey::MaxContributionPerTx storage key along with getter/setter routines. Added checks in contribute to reject contributions exceeding max_contribution_per_transaction.
• Emergency Recovery (src/emergency.rs / src/lib.rs): Implemented propose_emergency_withdraw to record a pending emergency withdrawal proposal with an execution timestamp set to env.ledger().timestamp() + 7_DAYS. Implemented execute_emergency_withdraw to verify the timelock elapsed before releasing funds to recipient and emitting safety log events.
• Title Uniqueness Validation (src/campaign.rs): Hashed input campaign titles (title_hash) and checked DataKey::CreatorCampaignTitleIndex(creator, title_hash) prior to campaign initialization, storing the key on creation.

Test Coverage

• Fee Calculation Tests: Verified that platform fees and creator payouts in withdraw_funds accurately reflect effective_amount_raised after partial donor refunds.
• Contribution Cap Tests: Tested per-transaction contribution limits against valid and exceeding amounts to verify clean rejections.
• Emergency Withdrawal Timelock Tests: Verified that execute_emergency_withdraw fails prior to the 7-day timelock elapsing and succeeds after the timelock expires.
• Title Collision Tests: Verified that creating a secondary campaign with an identical title under the same creator address panics/reverts, while distinct titles or different creators succeed.
• CI Verification: All contract unit tests, integration suites, and linter runs executed cleanly.

Checklists

• Fee calculation in withdraw_funds uses effective_amount_raised instead of gross amount_raised
• Admin-configurable max_contribution_per_transaction added and enforced during contribution calls
• Emergency recovery implemented with a mandatory 7-day proposal-to-execution timelock and admin auth
• Campaign creation enforces title uniqueness per creator via title hashing index
• Full unit and integration test suites pass successfully

[drips-wave]

@ExcelDsigN-tech Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits