# Community economy — Monad testnet

> Current status reviewed September 29, 2026. See [the release index](README.md) for shipped versus planned features, network, wallet signing and deployment boundaries. Older dated experiments below are retained as history.

This implementation extends the Web3 Orb only. It does not migrate the normal
Órbita installation or make chat, voice and databases decentralized.

## Where it lives

- **Identity → Community passport → Community ownership, roles & treasury:**
  community balance, deposits, withdrawals, portable roles and owner transfer.
  A community owner first registers the community in Arena.
- **Arena → Community league → selected round → Sponsored rewards:** fund a
  match before it starts; eligible winners claim from the contract afterward.
- **Markets → Shared swaps:** publish a public test-token trade card; others
  review their own amount and quote, approve exactly that amount and execute
  from their own Orb Wallet. Copy the card link into a conversation or feed.
- **`/economy/watch.html`:** independently read identities, roles, balances,
  prizes and trade executions. Export a snapshot with block information. Copy
  the entire `public/economy` directory to another static host to run it without
  the Orb backend. It is read-only; it does not replace a wallet.

All new application copy ships in the app's five locales (en, pt-BR, es, fr,
zh) through one inline catalog with English fallback, and `npm run i18n:test`
fails on an untranslated row. Advanced actions are
collapsed by default. Reads pause on hidden tabs and closed treasury/prize panels.
`/?view=trade&mode=shared` opens the shared market directly. Pending transaction
hashes are retained per wallet and chain across reloads; the UI checks their
receipts before allowing another write instead of blindly submitting again.
The market refresh uses a single bounded contract snapshot for up to 20 cards,
not one RPC call per card. Contract verification and the block header are separate
reads. This is a client-side public RPC integration, not a database polling job.

## Contracts and authority

`OrbCommunityEconomy` binds to one existing `OrbCommunityArena` registry. The
current registry owner controls the community treasury and can assign/revoke:

| Role | Onchain authority |
| --- | --- |
| None | No privileges |
| Member | Public membership record only |
| Moderator | Public role record only; not Orb chat moderation |
| Treasurer | May withdraw the entire community treasury to any recipient |

Ownership transfer is the registry's existing **single-step** transfer. The UI
requires a destination and acknowledgement. The former owner loses owner powers;
existing treasurer grants survive and must be revoked separately. The registry
owner and the offchain server administrator are deliberately distinct authorities.
No backend role silently acquires treasury powers. Revoked role addresses remain
in the public paginated roster with role zero.

Community registration and Arena entry still require Orb-issued attestations of
offchain membership. An Orb outage can stop new registrations/admissions and
sponsored relaying. Existing contract state, treasury control, already-admitted
direct moves, settled reward eligibility and direct claims do not require Orb's
database or an operator authorization. An RPC and a signing wallet are still needed.

The economy and market have no upgrade, operator sweep or arbitrary-call function.
Constructor deployment is restricted to chain 10143 (Monad testnet) or 31337
(local development). Frontend writes require **10143** and exact bundled runtime
bytecode; the economy also verifies its registry binding. Local EVM tests use 10143
but are explicitly labelled local, never measured as Monad throughput.

## Arena prize accounting and revenue experiment

- One sponsor per round, top-ups by the same sponsor only, before the start and
  before the lobby deadline. Funds are deposited in advance, not promised by a DB.
- Funding does **not** charge participants to play and does not buy a better move.
- A new UI sponsorship has a 48-hour lobby deadline. A never-started/late-started
  lobby can be refunded after the deadline and cannot revive a refunded prize.
- A winning player must have made at least one onchain move. Gross share is the
  total pool divided by the winning team's **locked roster**, including inactive
  members. Inactive shares are not redistributed to active players.
- Each successful claim pays the player 99% and accrues **1%** to the immutable
  deployment fee recipient. Fees are withdrawn separately, so a recipient that
  rejects payment cannot block player rewards. Deposits are not charged this fee.
- Claim window: until 30 days after match end. A draw permits a full refund;
  after the claim window the sponsor can refund unclaimed shares and rounding dust.
- Claims are per wallet and non-reentrant. A game session key is not the player
  wallet and cannot claim rewards or spend treasury funds.

This is a testnet monetization prototype, not evidence of revenue or sustainable
unit economics. Mainnet prizes would require a separate review of game incentives,
Sybil/collusion risks, legal treatment and financial contract security.

## Shared swaps are a demonstration market

`OrbSharedMarket` creates its own `oBASE` and `oQUOTE` ERC-20 assets, initial
constant-product liquidity and a once-per-wallet-per-day faucet. They have no
redemption, real price or relationship to real MON/USDC. The faucet is intentionally
not Sybil resistant. **This is not Kuru Flow, Perpl execution or a mainnet exchange.**

A card records its author, public scope tag, direction, maximum input, slippage
(0.01–1%) and expiry (up to one day). The scope is descriptive, not an endorsement
or a proof of community authorization. A copied link pins the market address as
well as the card ID; a mismatched market disables execution.

Each wallet can execute a card once. The contract transfers only `msg.sender`'s
approved token input, applies a 0.3% pool fee and pays output to that same wallet.
Approving a card does not authorize its author or any AI agent. Quotes have a
short deadline and maximum slippage; expired quotes are not silently replaced
after approval. If a wallet approval takes too long, requote; any unused allowance
is limited to that input amount on this fixed demo market.

Both author and executions are public, including links originating in private
rooms. Different participants receive different prices as reserves change. Do
not describe it as equal-price batch clearing, automatic copy trading or MEV protection.

## Setup and verification

```sh
npm run economy:compile
npm run economy:test
npm run economy:test:ui
npm run economy:deploy:check
npm run economy:deploy:testnet
```

The UI test requires Playwright and an installed Edge browser (or set
`ORBITA_PLAYWRIGHT_PATH` / `ORBITA_BROWSER_CHANNEL`). It uses real local EVM
contracts and a mocked Privy wallet adapter. It does not certify production Privy
login, real-device voice, or mainnet custody security.

Deployment uses the ignored `.env.arena.local` sponsor and issuer keys. It
preserves existing addresses, saves transaction intent before broadcast, resumes
pending deployments and verifies runtime code. `ORB_ECONOMY_FEE_RECIPIENT` defaults
to the configured testnet deployer; choose it before initial deployment. Public
addresses are saved in `.env.arena.local`; no website is deployed by this script.
Restart the local preview with its existing isolated database. Do not change
the database merely to enable this feature.

`node scripts/smoke-economy-testnet.mjs` reads the public market. Adding
`--execute` sends one bounded demo-token trade using the testnet sponsor. It
records receipts in `work/economy-testnet-smoke.json`; no key is included.

## Honest hackathon demonstration

1. Register two communities with their owners; show their portable identity.
2. Deposit test MON, assign/revoke a treasury role, verify from the independent host.
3. Prefund an Arena match. Play using game-only sessions; observe confirmed moves.
4. End the match, claim the contract-computed reward, inspect fee accounting.
5. Share a trade card. Two participants independently execute; show both receipts.
6. Turn off the Orb backend and refresh the independent viewer on another static
   host. Existing blockchain state remains readable.

The displayed submission-to-receipt time includes RPC polling and excludes the
wallet approval interval. It is neither consensus finality nor measured TPS.
No claim is made that this application consumes or achieves 10,000 TPS. Its useful
scaling unit is many communities playing and executing independently, with a
verifiable result for each action, rather than artificial transaction spam.

## Validated deployment — September 19, 2026

Public deployment metadata: `public/economy/deployment.monad-testnet.json`.

| Contract | Monad testnet address |
| --- | --- |
| Community Arena registry | `0x6dCB3272C283cE722D57aF4B6ef83AF18e097085` |
| Community economy | `0x15612b6C531AA3C9F0Bef047f97Bf99EEB310B62` |
| Shared demo market | `0x5036F48c9dAECF205Ff4DAae57A43c3c7a0F2d08` |

Deployment and a real testnet smoke trade completed; the sponsor retained its
remaining test MON. Trade transaction:
`0x237cf2d92272cde1121ef4c6be7c2ec2e9a6e8db7f8d356f7cd3ded797624916`.
It exchanged 1 oBASE for 0.996999005991991025 oQUOTE. This was one controlled
testnet execution, not a load test or a real user trading with valuable assets.

Validation covered local EVM treasury isolation, role revocation, owner transfers,
prize claim/refund accounting, duplicate rejection, slippage/expiry, exact token
allowances, public-reader bytecode checks, and browser execution of deposits,
roles, faucet, publishing, swaps and independent reads. A full-app guest browser
also loaded the deployed testnet card with no page errors. Privy authentication
and confirmations remain a separate real-wallet acceptance check. The normal
Orbita deployment and the public Web3 website were not redeployed.