Smart Contracts

Overview

Nonterritorial uses CosmWasm smart contracts written in Rust, deployed on our sovereign Cosmos SDK chain. Unlike Solidity on EVM chains, Rust provides memory safety guarantees that prevent entire classes of vulnerabilities common in blockchain applications.

Our contract architecture is designed around a single principle: circulation, not speculation. Transfer functions don't exist—not because they're disabled, but because the concept of transferring exhibition ownership is absent from our system entirely.

---

Core Contracts

The network operates through five interconnected contracts:

Contract	Purpose
Exhibition	Registry of circulating exhibitions (non-transferable)
License	Time-bound hosting permissions (non-transferable)
Payment	Automatic revenue distribution
Governance	Multi-stakeholder voting and proposals
Provenance	Immutable circulation history

---

Exhibition Contract

The Exhibition contract manages the registry of all exhibitions available for circulation. Each exhibition is permanently bound to its creating artist—there is no mechanism to transfer ownership.

Data Structure

exhibition.rs

use cosmwasm_std::{Addr, Timestamp, Uint128};
use schemars::JsonSchema;
use serde::{Deserialize, Serialize};

#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
pub struct Exhibition {
    /// Unique identifier
    pub id: u64,
    /// Artist who created this exhibition (immutable)
    pub artist: Addr,
    /// Curator who organized the exhibition
    pub curator: Addr,
    /// Exhibition title
    pub title: String,
    /// IPFS URI for metadata and media
    pub metadata_uri: String,
    /// SHA-256 hash of primary content (immutable)
    pub content_hash: String,
    /// Creation timestamp
    pub created_at: Timestamp,
    /// Total licenses ever issued
    pub total_licenses: u64,
    /// Currently active licenses
    pub active_licenses: u64,
    /// Lifetime revenue generated
    pub lifetime_revenue: Uint128,
    /// Current status
    pub status: ExhibitionStatus,
}

#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
pub enum ExhibitionStatus {
    /// Not yet available for licensing
    Draft,
    /// Available for licensing
    Active,
    /// Temporarily unavailable (artist choice)
    Paused,
    /// No new licenses, existing ones honored
    Archived,
}

Available Messages

exhibition_execute_msg.rs

#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
#[serde(rename_all = "snake_case")]
pub enum ExecuteMsg {
    /// Artist creates a new exhibition
    CreateExhibition {
        title: String,
        curator: String,
        metadata_uri: String,
        content_hash: String,
    },
    /// Artist updates metadata (not content hash)
    UpdateMetadata {
        exhibition_id: u64,
        metadata_uri: String,
    },
    /// Artist controls availability
    SetStatus {
        exhibition_id: u64,
        status: ExhibitionStatus,
    },
    /// Called by License contract to update statistics
    RecordLicense {
        exhibition_id: u64,
        fee_amount: Uint128,
    },
    /// Called when a license period ends
    CompleteLicense {
        exhibition_id: u64,
    },
    
    // ============================================
    // NOTE: There is no Transfer message.
    // This is not an oversight—it's the core design.
    // Exhibitions cannot change ownership.
    // ============================================
}

Why No Transfer?

In standard token contracts (ERC-721, CW-721), transfer is a core function:

cw721_example.rs

// Standard CW-721 messages (NOT used in Nonterritorial):
pub enum ExecuteMsg {
    TransferNft { recipient: String, token_id: String },
    SendNft { contract: String, token_id: String, msg: Binary },
    Approve { spender: String, token_id: String, expires: Option<Expiration> },
    // ... etc
}

Our Exhibition contract has none of these. The ability to transfer simply doesn't exist. This isn't a policy—it's architecture.

---

License Contract

The License contract manages time-bound permissions for hosts to exhibit Cinematic Previews. Like exhibitions, licenses are non-transferable—they're bound to the host who requested them.

Data Structure

license.rs

#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
pub struct License {
    /// Unique identifier
    pub id: u64,
    /// Exhibition being licensed
    pub exhibition_id: u64,
    /// Host venue (immutable once created)
    pub host: Addr,
    /// Venue name for display
    pub host_name: String,
    /// Type of venue
    pub venue_type: VenueType,
    /// Geographic zone for pricing
    pub geographic_zone: String,
    /// License start time
    pub start_time: Timestamp,
    /// License end time
    pub end_time: Timestamp,
    /// Fee paid
    pub fee_paid: Uint128,
    /// Current status
    pub status: LicenseStatus,
    /// When license was created
    pub created_at: Timestamp,
}

#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
pub enum VenueType {
    Museum,
    Gallery,
    University,
    Library,
    CommunityCenter,
    Commercial,  // Café, hotel, co-working
    Private,
    Festival,
    PublicSpace,
}

#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
pub enum LicenseStatus {
    /// Awaiting payment
    Pending,
    /// Currently valid
    Active,
    /// License period ended
    Completed,
    /// Cancelled before activation
    Cancelled,
}

Available Messages

license_execute_msg.rs

#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
#[serde(rename_all = "snake_case")]
pub enum ExecuteMsg {
    /// Host requests a license
    RequestLicense {
        exhibition_id: u64,
        host_name: String,
        venue_type: VenueType,
        geographic_zone: String,
        duration_days: u64,
    },
    /// Host confirms with payment
    ConfirmLicense {
        license_id: u64,
    },
    /// Mark license as complete (called automatically or by system)
    CompleteLicense {
        license_id: u64,
    },
    /// Host cancels pending license
    CancelLicense {
        license_id: u64,
    },
    
    // ============================================
    // NOTE: No Transfer message exists.
    // Licenses cannot be sold or reassigned.
    // ============================================
}

Pricing Logic

pricing.rs

// Fee calculation (simplified)
fn calculate_fee(
    venue_type: &VenueType,
    geographic_zone: &str,
    duration_days: u64,
) -> Uint128 {
    let pricing = get_pricing_tier(venue_type);
    let geo_multiplier = get_geographic_multiplier(geographic_zone);
    
    let base = pricing.base_fee;
    let duration_fee = pricing.daily_rate * duration_days;
    let subtotal = base + duration_fee;
    
    // Apply geographic adjustment
    subtotal * geo_multiplier / 100
}

---

Payment Contract

The Payment contract handles automatic distribution of license fees. When a license is confirmed, payment is distributed instantly—artists receive their share within seconds.

Distribution Configuration

payment_config.rs

#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
pub struct PaymentConfig {
    /// Artist receives 40%
    pub artist_share: Decimal,
    /// Curator receives 20%
    pub curator_share: Decimal,
    /// Operations receives 30%
    pub operations_share: Decimal,
    /// Commission fund receives 10%
    pub commission_share: Decimal,
}

// Default configuration (constitutional protection: artist >= 35%)
impl Default for PaymentConfig {
    fn default() -> Self {
        PaymentConfig {
            artist_share: Decimal::percent(40),
            curator_share: Decimal::percent(20),
            operations_share: Decimal::percent(30),
            commission_share: Decimal::percent(10),
        }
    }
}

Distribution Flow

distribute_payment.rs

/// Called by License contract when payment is confirmed
fn distribute_payment(
    deps: DepsMut,
    env: Env,
    license: &License,
    exhibition: &Exhibition,
) -> Result<Response, ContractError> {
    let config = PAYMENT_CONFIG.load(deps.storage)?;
    let amount = license.fee_paid;
    
    // Calculate shares
    let artist_amount = amount * config.artist_share;
    let curator_amount = amount * config.curator_share;
    let ops_amount = amount * config.operations_share;
    let fund_amount = amount * config.commission_share;
    
    // Instant distribution via bank messages
    Ok(Response::new()
        .add_message(BankMsg::Send {
            to_address: exhibition.artist.to_string(),
            amount: vec![coin(artist_amount.u128(), "unt")],
        })
        .add_message(BankMsg::Send {
            to_address: exhibition.curator.to_string(),
            amount: vec![coin(curator_amount.u128(), "unt")],
        })
        .add_message(BankMsg::Send {
            to_address: config.operations_treasury.to_string(),
            amount: vec![coin(ops_amount.u128(), "unt")],
        })
        .add_message(BankMsg::Send {
            to_address: config.commission_fund.to_string(),
            amount: vec![coin(fund_amount.u128(), "unt")],
        })
        .add_attribute("action", "distribute")
        .add_attribute("artist_payment", artist_amount.to_string())
        .add_attribute("curator_payment", curator_amount.to_string()))
}

Constitutional Protection

The artist share cannot fall below 35%, even through governance:

update_shares.rs

fn execute_update_shares(
    deps: DepsMut,
    info: MessageInfo,
    new_config: PaymentConfig,
) -> Result<Response, ContractError> {
    // Only governance can update
    ensure_governance_caller(&deps, &info)?;
    
    // Constitutional protection
    if new_config.artist_share < Decimal::percent(35) {
        return Err(ContractError::ConstitutionalViolation {
            reason: "Artist share cannot fall below 35%".to_string(),
        });
    }
    
    // Verify shares sum to 100%
    let total = new_config.artist_share 
        + new_config.curator_share 
        + new_config.operations_share 
        + new_config.commission_share;
    
    if total != Decimal::one() {
        return Err(ContractError::InvalidShares {});
    }
    
    PAYMENT_CONFIG.save(deps.storage, &new_config)?;
    Ok(Response::new().add_attribute("action", "update_shares"))
}

---

Governance Contract

The Governance contract implements multi-stakeholder voting with constitutional protections that cannot be overridden.

Council Structure

council.rs

#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
pub enum Council {
    /// Artists: 30% voting weight
    Artist,
    /// Curators: 20% voting weight  
    Curator,
    /// Hosts: 25% voting weight
    Host,
    /// Investors: 25% voting weight
    Investor,
}

impl Council {
    pub fn weight(&self) -> Decimal {
        match self {
            Council::Artist => Decimal::percent(30),
            Council::Curator => Decimal::percent(20),
            Council::Host => Decimal::percent(25),
            Council::Investor => Decimal::percent(25),
        }
    }
}

Proposal Types

proposal.rs

#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
pub enum ProposalType {
    /// Standard proposals: 50% threshold
    Standard,
    /// Constitutional changes: 75% threshold, artist veto
    Constitutional,
    /// Emergency security: 66% threshold, 3-day voting
    Emergency,
    /// Parameter updates: 50% threshold
    Parameter,
}

Constitutional Protections

These cannot be changed, even by supermajority:

constitutional_protections.rs

#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
pub struct ConstitutionalProtections {
    /// Artist share floor (35%)
    pub min_artist_share: Decimal,
    /// Transfer functions cannot be added
    pub anti_speculation_immutable: bool,
    /// Geographic pricing tiers must exist
    pub geographic_access_required: bool,
    /// Provenance history cannot be altered
    pub provenance_immutable: bool,
    /// Foundation must reach 0% by Year 10
    pub foundation_sunset_required: bool,
}

---

Provenance Contract

The Provenance contract maintains an immutable record of each exhibition's circulation history.

Event Types

provenance.rs

#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
pub enum ProvenanceType {
    /// Exhibition created
    Created,
    /// License issued to host
    Licensed,
    /// Exhibition shown at venue
    Exhibited,
    /// License period completed
    Completed,
    /// Metadata updated
    MetadataUpdate,
    /// Status changed
    StatusChange,
}

#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
pub struct ProvenanceEntry {
    pub exhibition_id: u64,
    pub entry_type: ProvenanceType,
    pub actor: Addr,
    pub details: String,
    pub timestamp: Timestamp,
    pub block_height: u64,
}

Querying History

provenance_query_msg.rs

#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
#[serde(rename_all = "snake_case")]
pub enum QueryMsg {
    /// Get paginated provenance for an exhibition
    GetProvenance {
        exhibition_id: u64,
        start_after: Option<u64>,
        limit: Option<u32>,
    },
    /// Get complete history
    GetFullHistory {
        exhibition_id: u64,
    },
    /// Verify content hasn't been altered
    VerifyProvenance {
        exhibition_id: u64,
        content_hash: String,
    },
}

---

Security Considerations

Audit Status

Audit	Status	Firm
Internal Review	Complete	In-house
External Audit 1	Planned	TBD (Q1 2026)
External Audit 2	Planned	TBD (Q2 2026)
Bug Bounty	Planned	Launch with mainnet

Key Security Features

• Memory Safety: Rust prevents buffer overflows, null pointer dereferences, and data races at compile time.

• No Reentrancy: CosmWasm's architecture prevents reentrancy attacks by design—external calls happen after state changes.

• Access Control: All privileged functions verify caller authorization before execution.

• Immutable Core Logic: Constitutional protections cannot be modified through any mechanism.

---

Contract Addresses

Testnet

Testnet deployment planned for Q1 2026. Addresses will be published here upon deployment.

Mainnet

Mainnet deployment planned for Q2 2026, following successful security audits.

---

For Developers

Building Contracts

build.sh

# Clone repository
git clone https://github.com/nonterritorial/contracts
cd contracts

# Build all contracts
cargo build --release --target wasm32-unknown-unknown

# Run tests
cargo test

# Generate schemas
cargo schema

Integration

Full SDK documentation will be available at mainnet launch.

---

Smart Contracts | Nonterritorial Network Sovereign Infrastructure for Autonomous Art Circulation