1// PKGPATH: gno.land/r/test/exploit2package exploit34import (5 "gno.land/r/gov/dao/memberstore/v0"6)78func main() {9 // After the fix, memberstore.Tiers is no longer accessible (lowercase 'tiers')10 // External realms can only use the safe accessor functions:11 // - memberstore.GetTier(name) - read-only tier access12 // - memberstore.IterateTiers(fn) - read-only iteration13 // - memberstore.GetTierPower(name, members) - calculated power1415 // Verify we can still READ tier data via the safe accessor16 t3, ok := memberstore.GetTier(memberstore.T3)17 if !ok {18 panic("T3 tier not found")19 }20 println("T3 BasePower (read-only):", t3.BasePower)21 println("T3 InvitationPoints (read-only):", t3.InvitationPoints)2223 // The following lines would cause a compile error if uncommented:24 // memberstore.Tiers.Set(...) // ERROR: Tiers is not exported (lowercase)2526 // Iterate over tiers (read-only)27 println("All tiers:")28 memberstore.IterateTiers(func(name string, tier memberstore.Tier) bool {29 println(" -", name, "BasePower:", tier.BasePower)30 return false31 })3233 println("Security fix verified: external realms cannot modify tiers")34}3536// Output:37// T3 BasePower (read-only): 138// T3 InvitationPoints (read-only): 139// All tiers:40// - T1 BasePower: 341// - T2 BasePower: 242// - T3 BasePower: 143// Security fix verified: external realms cannot modify tiers44Get(int, rlm interface {.seal func(); Address func() .uverse.address; IsCode func() bool; IsCurrent func() bool; IsEphemeral func() bool; IsUser func() bool; IsUserCall func() bool; IsUserRun func() bool; PkgPath func() string; Previous func() .uverse.realm; String func() string; Sub func(string) .uverse.realm; Subpath func() string}) struct{BPTree *gno.land/p/nt/bptree/v0.BPTree}
GetTier(name string) (struct{BasePower float64; InvitationPoints int; MaxSize func(gno.land/r/gov/dao/memberstore/v0.MembersByTier, gno.land/r/gov/dao/memberstore/v0.TiersByName) int; MinSize func(gno.land/r/gov/dao/memberstore/v0.MembersByTier, gno.land/r/gov/dao/memberstore/v0.TiersByName) int; PowerHandler func(gno.land/r/gov/dao/memberstore/v0.MembersByTier, gno.land/r/gov/dao/memberstore/v0.TiersByName) float64}, bool)
GetTierPower(tierName string, members struct{BPTree *gno.land/p/nt/bptree/v0.BPTree}) float64
IterateTiers(fn func(string, gno.land/r/gov/dao/memberstore/v0.Tier) bool)
NewChangeTiersRequest(cur interface {.seal func(); Address func() .uverse.address; IsCode func() bool; IsCurrent func() bool; IsEphemeral func() bool; IsUser func() bool; IsUserCall func() bool; IsUserRun func() bool; PkgPath func() string; Previous func() .uverse.realm; String func() string; Sub func(string) .uverse.realm; Subpath func() string}, tiers map[string]gno.land/r/gov/dao/memberstore/v0.Tier) struct{title string; description string; executor gno.land/r/gov/dao.Executor; filter gno.land/r/gov/dao.Filter}
NewMember(invitationPoints int) *gno.land/r/gov/dao/memberstore/v0.Member
NewMembersByTier() struct{BPTree *gno.land/p/nt/bptree/v0.BPTree}
Render(path string) string
RenderCharts(members struct{BPTree *gno.land/p/nt/bptree/v0.BPTree}) string
RenderMembers(path string, members struct{BPTree *gno.land/p/nt/bptree/v0.BPTree}) string
Signatures reconstructed verbatim from vm/qfuncs — interface params keep their inline definitions.
vm/qrender output, sanitized (docs/render-security.md) and displayed in an empty-sandbox iframe — scripts, forms and popups cannot run. Links stay inert in-preview; right-click to open.