Add a daily guild donation to the realm - #135

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Summary by CodeRabbit

• New Features
  • Guild leaders can set or clear a daily donation to the realm through the guild menu. A 10% fee is added to the donation, and the menu shows the total due.
  • Donations are transferred during daily settlement and recorded separately from the fee. Pledges are cancelled if the guild cannot afford them, but remain in place if payment leaves the guild with no funds.
  • Guild donation amounts are saved and restored.

Walkthrough

Guilds can store daily donation pledges to their faction’s realm. The changes add donation fees, ledger accounting, settlement transfers, affordability checks, and a guild-view chat flow for setting pledges.

Changes

Guild donations

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  actor Player
  participant GuildView
  participant InventoryManager
  participant Guild
  Player->>GuildView: Click donation slot
  GuildView->>InventoryManager: Open donation prompt
  Player->>InventoryManager: Submit donation amount in chat
  InventoryManager->>Guild: Set donation amount

Security Blast Radius

• inferred — The demonstrated design concern affects guild financial state and potentially liquidatable guild assets. Loan relationships extend the effect beyond the configuring guild: a borrower’s spending can invalidate a donating lender’s expected receipts. Donation destinations remain each sender’s own realm capital.

Security Findings and Attack Paths

• inferred — A source-derived counterexample uses a lender with 10 denars, a 90-denar pledge, and an expected automatic repayment of 100. Its projection retains the pledge. A borrower with 100 denars and its own 90-denar pledge spends 99 before loan funding, leaving only 1 for repayment. With other movements zero, the lender ends at 10 + 1 - 99 = -88 before liquidation. Deliberate triggering requires control of the borrower’s pledge plus an existing loan and lender pledge; this is not a demonstrated non-leader bypass or runtime-tested exploit.

Trust Boundaries and Controls

• observed — Player-controlled chat supplies an amount, not a recipient. Mutation checks the captured guild’s stored leader name and base status on the synchronous task; settlement derives the recipient from that guild’s faction. This limits direct authority to leader-configured guild pledges and ownership-derived destinations.

Resilience and Maintainability Implications

• observed — The existing daily orchestration catches RuntimeException around income settlement and then resets the timer and advances the day. This counters an automatic next-tick duplicate-payment hypothesis, but does not correct a donation admitted using an inaccurate receipt projection.

Hardening Proposals

• proposed — Determine donation affordability from a shared, resolved settlement plan or conservatively guaranteed funds, rather than borrower-balance receipt estimates. Keep pledge cancellation, gift transfer, fee debit, and loan funding consistent with that same plan.