DEV Community: Ayden

Audit H/M report Summary from Ondo code4rena

Ayden — Fri, 13 Oct 2023 06:07:27 +0000

1.Chain support chain cannot be removed or cleared in bridge contracts.

Contracts provide a way to add support for a chain; however, they do not provide a way to delete it.
When a contract offers an addition method, it's important to consider whether it should also provide a deletion method

2.Contract use msg.sender as remote chain receiver when bridge token.

AA wallet like safe has different wallet address on different chains.
This vulnerability requires us to be familiar with some commonly used third-party tools in order to discover it

3.Two different transactions can result in the same txnHash value, thus breaking the approval process of transaction minting

txnHashToTransaction[txnHash] = Transaction(srcSender, amt);

Consider whether the keys in similar mappings are always unique?

4.Admin can’t burn tokens from blocklisted addresses because of a check in _beforeTokenTransfer

The burn operation prematurely calls the beforeTransfer function, but beforeTransfer needs to check if the address is blocked, which hinders the successful execution of the burn

origin

https://blog.coffiasd.cn/23-10-13.html

contact me for SC private review

Twitter:https://twitter.com/coffiasse
Github:https://github.com/coffiasd
TG:@coffiasd

All you need to know about openzeppelin access control

Ayden — Thu, 27 Jul 2023 04:57:34 +0000

what is access control

Basiclly,access control means "who is allowed to do this thing".It's quite important for smart contract to specify a particular address who can totally control the whole system.Therefor it's critical to fully understand how to use access control before using it in your project or just copy some example code from somewhere.
In openzeppelin there are mainly two ways to implementing access control.

Single onlyOwner role
Role-Based Access Control (RBAC)

Let's dive into how to master this 2 ways.

master how to use it by practice

OnlyOwner

pragma solidity ^0.8.0;

import "@openzeppelin/contracts/access/Ownable.sol";

contract MyContract is Ownable {
    function normalThing() public {
        // anyone can call this normalThing()
    }

    function specialThing() public onlyOwner {
        // only the owner can call specialThing()!
    }
}

let's create two user for our test.

owner address
arbitrary address

    address owner = address(0x100);
    address arbitrary = address(0x101);

and the we use owner address to create the smart contract,it's quite simple you don't even need to pass any parameters.openzeppelin Ownable would set msg.sender as it's owner as default.we use foundry for testing,if you're not familiar with foundry,go and learn it first before proceeding further.

Firstly,we use owner address create our smart contract above in foundry test contract setUp function.

//let's set address owner to msg.sender.
vm.prank(owner);

//create the contract.
myContract = new MyContract();

And then we use the arbitrary address to invoke the specialThing function which is protected by onlyOwner modifier.As expect the invoke revert because of access control.Here goes the code:

//use arbitrary address invoke specialThing() function.
vm.prank(arbitrary);
vm.expectRevert("Ownable: caller is not the owner");
myContract.specialThing();

Finally,we use our owner who master the contract invoke the specialThing function.As you see the owne succeed.

//switch to owner.
vm.prank(owner);
myContract.specialThing();

If you want the whole example codes go for:https://gist.github.com/coffiasd/84552b5a33845fa567bfc3aa5204d460
If you have any questions, you can also reach me through the contact information below.

Role-Based Access Control

pragma solidity ^0.8.0;

import "@openzeppelin/contracts/access/AccessControl.sol";
import "@openzeppelin/contracts/token/ERC20/ERC20.sol";

contract MyToken2 is ERC20, AccessControl {
    // Create a new role identifier for the minter role
    bytes32 public constant MINTER_ROLE = keccak256("MINTER_ROLE");

    constructor(address minter) ERC20("MyToken", "TKN") {
        _grantRole(DEFAULT_ADMIN_ROLE, minter);
        // Grant the minter role to a specified account
        _grantRole(MINTER_ROLE, minter);
    }

    function mint(address to, uint256 amount) public {
        // Check that the calling account has the minter role
        require(hasRole(MINTER_ROLE, msg.sender), "Caller is not a minter");
        _mint(to, amount);
    }
}

We can create whatever role we want in Role-Based Access Control (RBAC) contract.Let's say we want create a minter role who can mint some ERC20 token.We can use a special constant bytes32 as the name of the role like this:

// Create a new role identifier for the minter role
bytes32 public constant MINTER_ROLE = keccak256("MINTER_ROLE");

Firstly,we use owner address as our minter to create our access control contract.

 myToken = new MyToken2(owner);

And then we use the arbitrary user to mint some ERC20 token:

//use arbitrary address invoke mint() function.
vm.prank(arbitrary);
vm.expectRevert("Caller is not a minter");
myToken.mint(address(this), 1);

the above invoke would be revert because of arbitrary don't hold the minter role.

//switch to owner.
vm.prank(owner);
myToken.mint(address(this), 1);

If we switch msg.sender to owner the call would successed.

What's more? we can use owner address to grant a minter role whoever we want.Let's say we grant the minter role to the arbitrary address:

vm.prank(owner);
myToken.grantRole(keccak256("MINTER_ROLE"), arbitrary);

vm.prank(arbitrary);
myToken.mint(address(this), 1);

After invoke the grantRole function the arbitrary has the right to mint token.

At the same time,arbitrary address don't has the right to grant role to another address:

vm.prank(arbitrary);
vm.expectRevert();
myToken.grantRole(keccak256("MINTER_ROLE"), address(0x1001));

As the owner we also have the right to revoke role we grant before:

vm.prank(owner);
myToken.revokeRole(keccak256("MINTER_ROLE"), arbitrary);

vm.prank(arbitrary);
vm.expectRevert("Caller is not a minter");
myToken.mint(address(this), 1);

After we invoke role of arbitrary,he can't mint ERC20 token anymore.

If you want the whole example codes go for:https://gist.github.com/coffiasd/340241d63980dc9d423e4ece2f9b20db
If you have any questions, you can also reach me through the contact information below.

Origin:https://blog.coffiasd.cn/03-07-26.html

let's connect

Twitter:https://twitter.com/coffiasse
Github:https://github.com/coffiasd
TG:@coffiasd

How to use solidity CREATE and CREATE2

Ayden — Thu, 27 Jul 2023 04:55:33 +0000

Overview

There are 2 major ways to deploy smart contract CREATE and CREATE2. They look quite similar, but there are still some differences.CREATE2 and CREATE are one of solidity opcode which give us the ability to predict the address where a contract will be deployed before we deploy a smart contract.You might be curious about what opcode is.Opcodes are the fundamental building blocks of EVM bytecode, and each opcode represents a specific operation that the EVM can perform. For example, there are opcodes for arithmetic operations, logical operations, storage access, memory manipulation, conditional branching, and more.

What is CREATE

Smart contracts can be created both by other contracts and regular EOA.They both compute the new address the same way:

new_address = keccak256(sender, nonce)

So each created address is associated with a nonce value.Nonce increased on every transaction.It is related to the number of transactions we make and is unpredictable. That's why we need CREATE2.

What is CREATE2 ?

The whole idea behind this opcode is to make the resulting address independent of future events. Regardless of what may happen on the blockchain, it will always be possible to deploy the contract at the precomputed address.There are four parameters in CREATE2 function:

0xFF
the address of sender
A salt (random value from sender)
bytecode (the code of the new contract)

new_address = keccak256(0xFF, sender, salt, bytecode)

Why we need CREATE2 ?

Imagine a scenario where you need to deploy a contract to multiple networks, and precisely at that moment, you need to store the addresses of the yet-to-be-deployed contracts as storage parameters within the currently deployed contract. In such cases, you would require knowing the future addresses of the contracts to be deployed in advance.

How to use it

Use hash function to calculate address.

    uint256 _salt = 1;
    bytes32 hash = keccak256(
        abi.encodePacked(
            bytes1(0xff),
            address(this),
            _salt,
            keccak256(type(TokenTemplate).creationCode)
        )
    );

Use deploy to get the deployed address.

    function deploy(
        bytes memory bytecode,
        uint _salt
    ) public payable returns (address) {
        address addr;

        assembly {
            addr := create2(
                callvalue(), // wei sent with current call
                // Actual code starts after skipping the first 32 bytes
                add(bytecode, 0x20),
                mload(bytecode), // Load the size of code contained in the first 32 bytes
                _salt // Salt from function arguments
            )

            if iszero(extcodesize(addr)) {
                revert(0, 0)
            }
        }

        return addr;
    }

you can find the whole code on github:
https://gist.github.com/coffiasd/c2ff1a2d718d286b9064873be2fe079a

Origin: https://blog.coffiasd.cn/03-07-24.html
Follow my twitter:https://twitter.com/coffiasse
TG:@coffiasd

Merkle树的逻辑和证明

Ayden — Mon, 17 Jul 2023 05:29:43 +0000

什么是Merkle树

定义

Merkle Tree，也叫默克尔树或哈希树，是区块链的底层加密技术，被比特币和以太坊区块链广泛采用。Merkle Tree是一种自下而上构建的加密树，每个叶子是对应数据的哈希，而每个非叶子为它的2个子节点的哈希。

如何生成Merkle树的数据

在solidity中我们通过keccak256算法计算hash值:

keccak256(abi.encodePacked(toHashValue)

e.g.:
hash前
0xAb8483F64d9C6d1EcF9b849Ae677dD3315835cb2

hash后
0x999bf57501565dbd2fdcea36efa2b9aef8340a8901e3459f4a4c926275d36cdb

在对叶子节点的值进行hash运算之后，再把相邻的节点再进行hash运算，直到只剩下一个根节点。
假设存在两个相邻的节点A和B,那么在进行hash运算的时候到地址是hash(A+B)呢？还是hash(B+A)呢？其实这是由A和B的大小决定的，在openzeppelin对应的merkle代码中我们可以找到这么一段代码:

    function _hashPair(bytes32 a, bytes32 b) private pure returns (bytes32) {
        return a < b ? _efficientHash(a, b) : _efficientHash(b, a);
    }

总结来说就是把相对小的数值放到前面去这么来排序计算hash值。这个地方在自己动手实际运算的时候可能会有些许困惑。
在实际的项目中一般只需要把计算的最后结果的根hash值存储到合约中，如果大量的地址都需要存到合约中的话会消耗大量的gas费。经过merkle树计算之后，大大的减少了需要存储的数据。
通过一段foundry的setUp演示下如何计算和存储root hash值:


    bytes32 public root;
    bytes32[] public leafs;
    bytes32[] public l2;

    function setUp() public {
        address[] memory addrss = new address[](4);
        addrss[0] = 0xAb8483F64d9C6d1EcF9b849Ae677dD3315835cb2;
        addrss[1] = 0x2d886570A0dA04885bfD6eb48eD8b8ff01A0eb7e;
        addrss[2] = 0xed857ac80A9cc7ca07a1C213e79683A1883df07B;
        addrss[3] = 0x690B9A9E9aa1C9dB991C7721a92d351Db4FaC990;

        //通过地址列表计算叶子节点的hash值
        leafs.push(keccak256(abi.encodePacked(addrss[0])));
        leafs.push(keccak256(abi.encodePacked(addrss[1])));
        leafs.push(keccak256(abi.encodePacked(addrss[2])));
        leafs.push(keccak256(abi.encodePacked(addrss[3])));

        //计算第二层的hash值
        l2.push(keccak256(abi.encodePacked(leafs[0], leafs[1])));
        l2.push(keccak256(abi.encodePacked(leafs[2], leafs[3])));

        //计算根的hash值
        root = keccak256(abi.encodePacked(l2[1], l2[0]));
    }

为了演示方便我们值写了4个地址，实际项目中可能地址数量非常大。

如何来验证Merkle树

在合约中存储到root hash值之后我们如何去验证由客户端发过来的地址是否是有效地址或者说在白名单中的地址呢？
首先我们需要将地址进行hash运算，作为第三个参数，然后将地址相邻的hash值作为proof传到验证函数中。
proof列表对应下面图片中的红色标记区域

测试的验证方法:

    function testVerify() public {
        address proofAddress = 0xAb8483F64d9C6d1EcF9b849Ae677dD3315835cb2;

        bytes32[] memory proof = new bytes32[](2);
        proof[0] = leafs[1];
        proof[1] = l2[1];

        assert(
            MerkleProof.verify(
                proof,
                root,
                keccak256(abi.encodePacked(proofAddress))
            )
        );
    }

完整的foundry测试代码:https://gist.github.com/coffiasd/96022abd7f9a8a2189bda14bf9e755dc

在实际项目中的应用场景

发放空投
NFT的白名单

在合约审计中的常见漏洞

function parentHash(bytes32 a, bytes32 b) public pure returns (bytes32) {
        if (a < b) {
            return keccak256(abi.encode(a, b));
        } else {
            return keccak256(abi.encode(b, a));
        }
    }

abi.encode(address, uint)将会输出64字节。由于abi.encode(bytes32, bytes32)也是64字节，因此在叶子节点和父节点之间可能会发生哈希碰撞。

Follow我的推进行交流学习:https://twitter.com/nifty12111
TG:@coffiasd

Solidity Assembly的基础用法

Ayden — Sat, 15 Jul 2023 02:23:06 +0000

什么是Assembly

在编写Solidity代码时，我们可以使用assembly{}关键字开始编写Yul代码，它是一种简化且扩展了的汇编语言。通过使用assembly，我们可以直接访问堆栈，并优化代码以提高内存效率，从而减少执行交易所需的燃气量。这最终降低了用户的交易成本。

然而，在可读性方面存在一些妥协。许多前端开发人员可以阅读Solidity智能合约并理解正在执行的功能以及如何将其应用到他们的web3查询中。相比之下，汇编可能会让人感到有些困惑，如果你不熟悉低级编程，可能很难理解其逻辑和流程。

操作码列表

操作码	描述
add(x, y)	将栈中的前两个值相加，并用结果替换它们
sub(x, y)	减法操作
mul(x, y)	乘法操作
div(x, y)	除法操作
mod(x, y)	取模操作
lt(x, y)	小于。如果 x 小于 y，则返回 1
gt(x, y)	大于
eq(x, y)	等于。如果 x 等于 y，则返回 1
not(x)	按位取反 (1010 > 0101)
and(x, y)	按位与 (1000 AND 1100 > 1000)
or(x, y)	按位或 (1000 AND 1100 > 1100)
xor(x, y)	按位异或 (1000 XOR 1100 > 0100)
byte(n, x)	X 的第 N 个字节
keccak256(pos, n)	本地哈希算法
pop(x)	从栈中弹出 X
mload(pos)	加载存储在位置 pos 的内存数据
mstore(pos, value)	在位置 pos 的memory中存储值 value
sload(pos)	加载存储在位置 pos 的存储数据
sstore(pos, value)	在位置 pos 的storage中存储值 value
balance(address)	以 wei 为单位返回地址的以太币余额
call(gas, address, value, in, insize, out, outsize)	调用外部合约，也可用于发送资金，成功时返回 1
delegatecall(gas, address, value, in, insize, out, outsize)	与上述相同，但由用户而不是合约进行调用
revert(p, s)	撤销事务和任何状态更改
return(p, s)	结束执行并返回数据

这里需要注意的是mstore和sstore的区别，主要存储的位置的不一致，一种是存储在memory中，另一种是存储在storage中。

使用案例

读写

下面我们通过一个例子展示下如何使用Assembly把数据存储到storage中，然后通过函数读取的方式读出来。

    function testAssembly() public {
        //定义一个存储的值方便测试.
        uint256 x = 123;
        bool res;

        //将x存储到storage中。
        assembly {
            sstore(0, x)
        }

        //在storage中读取x的值,其中0是pos
        assembly {
            let readX := sload(0)
            //将readX的值存储到memory,pos == 0x80的位置。
            mstore(0x80, readX)
        }

        //将0x80中的值取出来.
        assembly {
            let v := mload(0x80)
            if eq(v, x) {
                res := true
            }
        }

        //判断最终取出来的v == x?
        assert(res);
    }

上诉的例子在实际项目中不太可能出现，只是为了展示读写的过程。

基础运算

    function testAssembly() public {
        //定义一个存储的值方便测试.
        uint256 x = 123;
        uint256 r = 345;

        //将x存储到storage中。
        assembly {
            x := add(x, 300)
            x := sub(x, 78)
        }

        //判断最终取出来的r == x?
        assert(r == x);
    }

Follow我的推进行交流学习:https://twitter.com/nifty12111
TG:@coffiasd

手摸手教你如何使用foundry进行测试脚本编写

Ayden — Fri, 14 Jul 2023 01:53:47 +0000

什么是foundry?

foundry是一个solidity智能合约开发工具。可以帮你管理依赖包，编译项目，运行测试脚本，还可以让你通过命令行工具或者script脚本和链上合约进行交互。和hardhat不同的地方是，hardhat我们还是主要用来开发大型的合约项目，但是foundry用来进行编写测试脚本我认为是非常方便的。主要的特点是可以直接使用solidity编写合约测试脚本，无需在JavaScript和solidity之间进行切换。虽然在hardhat也可以编写测试脚本，但是有时候需要切换语言或者对类型进行转换相对会比较麻烦。

安装和配置

Foundryup是foundry的安装器。我们可以直接通过终端命令行进行安装:

curl -L https://foundry.paradigm.xyz | bash

或者要是你喜欢也可以通过源码的方式进行编译安装

# clone the repository
git clone https://github.com/foundry-rs/foundry.git
cd foundry
# install Forge + Cast
cargo install --path ./cli --profile local --bins --force
# install Anvil
cargo install --path ./anvil --profile local --force
# install Chisel
cargo install --path ./chisel --profile local --force

初始化

我们可以通过forge命令行直接初始化新项目

forge init helle_foundry

初始化之后的大概是这么个目录结构:

$ cd hello_foundry
$ tree . -d -L 1
.
├── lib     依赖的包文件目录
├── script  自定义的脚本目录
├── src     合约源码目录
└── test    测试脚本目录

特性和使用

编写测试脚本

测试脚本的基本代码结构：

pragma solidity 0.8.10;

import "forge-std/Test.sol";

contract ContractBTest is Test {
    uint256 testNumber;

    function setUp() public {
        testNumber = 42;
    }

    function test_NumberIs42() public {
        assertEq(testNumber, 42);
    }

    function testFail_Subtract43() public {
        testNumber -= 43;
    }
}

在上面的例子中每个test函数都是相互独立的，setUp函数类似于我们的构造函数，会首先进行调用setUp函数进行初始化。在我们实际的操作中，可以直接导入需要测试的合约，然后在setUp中对合约进行初始化。我们只需要一个变量就能调用目标合约中的函数进行测试。

运行测试脚本的命令:

forge test --match-contract "ContractBTest(合约名称)" -vvv

debug

我们可以通过-vvv 和 -vvvv进行数据跟踪。在打印出来的日志中，我们通过颜色来区分不同的错误类型(如果你的终端支持颜色显示的话)：

绿色 : 正常的调用
红色 : 回滚的调用
蓝色 : 作弊码的调用
青色 : 日志
黄色 : 合约部署

  [24661] OwnerUpOnlyTest::testIncrementAsOwner()
    ├─ [2262] OwnerUpOnly::count()
    │   └─ ← 0
    ├─ [20398] OwnerUpOnly::increment()
    │   └─ ← ()
    ├─ [262] OwnerUpOnly::count()
    │   └─ ← 1
    └─ ← ()

fuzz测试

contract SafeTest is Test {

    function testFuzz_Withdraw(uint256 amount) public {
        payable(address(safe)).transfer(amount);
        uint256 preBalance = address(this).balance;
        safe.withdraw();
        uint256 postBalance = address(this).balance;
        assertEq(preBalance + amount, postBalance);
    }
}

比如上面的提款测试，普通的test测试函数需要自定义一个固定的amount金额，但是这个指定的amount不能覆盖到所有的情景，另一个选择就是使用testFuzz.fuzz测试的函数名和普通测试对比只是多了fuzz，需要注意的是所有的测试函数需要用test或者testFuzz开头否则是不会被认为是一个测试函数的。

console.log日志打印

在solidity中打印日志需要提前对日志内容的类型进行定义。foundry支持下面的一些数据类型进行日志打印，可以帮助我们进行debug:

console.logInt(int i)
console.logUint(uint i)
console.logString(string memory s)
console.logBool(bool b)
console.logAddress(address a)
console.logBytes(bytes memory b)
console.logBytes1(bytes1 b)
console.logBytes2(bytes2 b)
console.logBytes32(bytes32 b) 对于一些更加复杂的数据结构，比如我们的目标合约中返回了一个struct类型的数据。我们可以直接使用targetContract.StructName对数据进行定义。

assert

foundry中主要有3种类型的assert

assert(conditon) 判断一个bool值
assertEq(a,b) 判断a，b两个值是否相等
assertTrue(condition,"reason")

function testGetTotalShares() public {
    assertEq(prizePool.getTotalShares(), 220);
}

时间和区块进行改变

某些合约中可能有时间间隔，比如一个stake asset操作之后，可能需要一个月的时间间隔之后才能进行下一次操作，这个时候我们可以直接去修改evm中的时间

vm.warp(block.timstamp + 30 days);

或者我们也可以对区块进行增加

vm.roll(block.number + 1);

vm.expectRevert

在某些测试中，对于条件不满足的情况下，合约逻辑中可能会存在一些revert的情况，我们需要对这些revert进行捕捉的时候可以用到vm.expertRevert

expectRevert()
expectRevert(bytes4 message)
expectRevert(bytes calldata message)

function testLowLevelCallRevert() public {
    vm.expectRevert(bytes("error message"));
    (bool revertsAsExpected, ) = address(myContract).call(myCalldata);
    assertTrue(revertsAsExpected, "expectRevert: call did not revert");
}

有些合约对一些多次出现的错误可能把它定义为一个error类型，这个时候我们可以通过CustomError.selector对错误进行捕捉。

vm.expectRevert(CustomError.selector);

vm.expectRevert(
    abi.encodeWithSelector(CustomError.selector, 1, 2)
);

对于那些直接revert并没有定义错误的情况下:

 vm.expectRevert(bytes(""));

follow我的推进行交流学习:https://twitter.com/nifty12111
TG:@coffiasd

How do i win 3 hackathon in one month

Ayden — Sat, 25 Feb 2023 12:39:11 +0000

overview

If you are interested in competing in a Web3 hackathon, it is important to understand that a hackathon is a challenging event that requires a lot of work, dedication, and creativity. However, with the right mindset and approach, you can increase your chances of winning. Here are some tips to help you win a Web3 hackathon:

Understand the Theme and Criteria

The first step to winning a Web3 hackathon is to understand the theme and criteria of the hackathon. Make sure you read the rules and guidelines carefully, so that you can create a project that meets the requirements and stands out from the competition.

Research and Brainstorm

Once you know the theme and criteria of the hackathon, start researching and brainstorming ideas for your project. Consider what problems you can solve using Web3 technologies and how your project can add value to the Web3 ecosystem.

Focus on User Experience

User experience is an important factor in creating a successful Web3 project. Consider how your project can make the user's experience smoother, more efficient, and more enjoyable.

Build a Minimum Viable Product (MVP)

A minimum viable product (MVP) is a basic version of your project that has enough features to demonstrate its value. Building an MVP is important because it allows you to get feedback from users and judges, and make improvements before the final presentation.

Implement Web3 Technologies

Web3 technologies are the backbone of the Web3 ecosystem. To win a Web3 hackathon, it is important to implement Web3 technologies in your project. Some examples of Web3 technologies include blockchain, decentralized storage, and smart contracts.

Create a Clear and Concise Pitch

Your pitch is the key to winning a Web3 hackathon. Make sure your pitch is clear, concise, and compelling. Focus on the most important features of your project and explain how your project solves a real-world problem.

Practice and Refine Your Presentation

Practice makes perfect. Before the final presentation, practice your pitch and make sure it is well-rehearsed. Also, consider getting feedback from others to refine your presentation.

Network and Collaborate with Others

Networking and collaboration are important in a Web3 hackathon. Attend workshops, meetups, and other events to meet other participants and potential collaborators. Collaborating with others can help you create a stronger project and increase your chances of winning.
In conclusion, winning a Web3 hackathon requires hard work, dedication, and creativity. By following these tips, you can increase your chances of winning and make your mark on the Web3 ecosystem. Good luck!

contact me in social media:
twitter

How to quick start web3.storage

Ayden — Tue, 01 Nov 2022 02:45:43 +0000

register an account

Email
Github (recommand)

install the client

javascript
npm install web3.storage
golang
go get github.com/web3-storage/go-w3s-client

create a client instance

//get the access token
function getAccessToken(){
    return process.env.TOKEN
}
//creata an instance
function makeStorageClient(){
    return new Web3storage({token:getAccessToken()})
}

preparing files for uploading

function getFiles(){
    const fileInput = document.querySelector('input[type="file"]')
    return fileInput.files
}

upload files to web3.storage

//async upload process
async function storageFiles(files){
    const client = makeStorageClient()
    const cid = await client.put(files)
    return cid
}

directory wrapping

after uploading you'll get a cid of the directory and then the entire link gonna be ipfs:///
to make a gateway link :

https://<cid>.ipfs.<gateway-host>/<filename>
https://<gateway-host>/ipfs/<cid>/<filename>

storing ipfs content archives?

if you already have some files you can use putCar client function.I don't want to jump into this here.

how to access data we uploaded above ?

using an IPFS http gateway
using client library
ipfs command line
system command line

how to query web3.storage

async function checkStatus(cid){
    const client = xxxx
    const status = await client.status(cid)
}

return data structure

cid
created
dagSize
pins
deals

how to list files uploaded to web3.storage

const client = xxxx
for await (const upload of client.list(){
    console.log(upload.name,upload.cid,upload.dagSize)
})

listing the content of an IPFS directory

All you need to know for writing a reserve protocol collateral plugins quick start

Ayden — Sun, 30 Oct 2022 15:21:34 +0000

core plugin depends on two plugin types:

Assets / Collateral (contracts/plugins/assets)
Trading (contract/plugins/trading) not discussed here

Collateral is erc20 token + below:

if ERC20 back ?
refresh()
status() SOUND/IFFY/DISABLED
rate exchange

Monetary units

Unit of Account
Target unit RToken maintaining stability or appreciation against its target unit
Reference unit

e.g. of 3 different tokens

Collateral : cUSDC
Refence : USDC
Target : USD

Units definition

{UoA} unit of account recommand USD here
{tok} whole token
{ref} whole reference token
{target} whole target unit
{ref/tok} refPerTok()
{target/ref} targetPerRef()
{UoA/target} pricePerTarget()

Basket definition

Prime basket this is set by governance , on changes through successful governance proposals. it consists of an array of triples e.g. :
Reference basket e.g. :
Collateral bascket e.g.:

IAsset interface

Accounting units

before we create a collateral plugin we have to choose 3 accounting units

Collateral unit

its just erc20 token

Reference unit

to be ask , what's a unit that this collateral token will always be worth the same value or more of .

Target unit

target unit has to do with a concept called the target basket. what's prime basket ?
A example of linear combination of target units:

1 USD
0.5 USD + 0.55 EURO
0.5 USD + 0.35 EURO + 0.00001BTC

Unit of account

we can assume UoA == USD , because for now USD price are king.

Important properties for collateral plugins

Collateral plugins should be permisionless and should be able to used by any number if RTokens
Token balance can't be rebasing

refresh() should never be revert

refresh is been called before any transactions , it return exchange rates.
if occur an important error , refresh should change the state to DISABLED

strictPrice() price(bool) status()

the IFFY status should be temporary

Collateral must default if refPerTok() falls

Defaulted Collateral must stay defaulted

if status() ever returns disabled , then it must always return disabled in the nearly future

Token rewards should be claimable

rewardERC20()
getClaimCalldata()

Smaller Constraints

The value of the following methods should never change:

isColleteral()
targetName()
erc20()
rewardERC20()
erc20Deciamls()

Function-by-function walkthrough

strictPrice() {UoA/tok}
price(bool) {UoA/tok} if revert depends on the bool value true or false
refPerTok() {ref/tok}
targetPerRef() {target/ref}
pricePerTarget(){UoA/tartget}

Analyze stolen NFTs that been marked by opensea

Ayden — Fri, 07 Oct 2022 12:31:38 +0000

Overview

This is a hackathon data analytics project. I analyze the top 2300 nfts sort by volume。 You can find the detail list from my GitHub repo. Or you can click here。
https://github.com/coffiasd/hackathon-data-analytics/blob/main/data/RankNFTS.csv

CSV Data

Below is all csv file that i collect.RankNFTs.csv is the top 2300 NFTs list. tokenIds/{contract}.csv is stolen NFTs tokenID list.lastSalePrice/{contract}.csv is the last sale price of each tokenId.

RankNFTs.csv
tokenIds/{contract}.csv
lastSalePrice/{contract}.csv

Python script

You can get the all scripts my github repo above.

getNFTsRankTopVolume.py(get top volume NFTs && stolen NFTs list)
getNFTsDetail.py(get NFT’s last sale price)
caculateStolen.py(caculate Result)

def getNftsRankTopVolume(page):
    url = "https://api.traitsniper.com/v1/collections?page=" + \
        str(page)+"&limit=100&sort_total_volume=desc"

    headers = {
        "accept": "application/json",
        "x-ts-api-key": TraitsniperApiKey
    }

    response = requests.get(url, headers=headers)
    resp_dict = json.loads(response.text)

def caculateContractItem(contractAddress, table):
    # get collection detail
    item = getCollectionDetail(contractAddress)

    # read stolen nfts list
    data = pd.read_csv("../data/stolen/lastSalePrice/" +
                       contractAddress+".csv", header=None)
    # caculate items
    num = data.count()
    sum = 0
    for index, row in data.iterrows():
        if row[1] > item["floor_price"]:
            sum += row[1]
        else:
            sum += item["floor_price"]
    table.rows.append([item["nft_name"], contractAddress, item["total_volume"],
                       sum, sum/item["total_volume"], num[0]])

Fetch Collections

First and foremost we need to get the list of each collection and then get the list of stolen nfts.

How to calculate the price of each stolen nft?

If this item has a history price && the latest_price>floor_price take the latest_price as worth.
If latest_price<floor_price take the floor_price as worth.
If this item does’t has a history price then take the current floor price as worth.

# worth
# latest_history_price
# floor_price
var worth = 0

if(item_has("latest_history_price")){
    if(latest_history_price> floor_price){
    worth = latest_history_price
    }else{
    worth = floor_price
    }
}else{
    worth = floor_price
}

Calculate

I analyze each marked as stolen contract to find out the stolen volume and the numbers of stolen NFTs.Below is the output after i run caculateStolen.py you can get source code from my github repo above.

Create a cool discord bot for your chat group

Ayden — Fri, 30 Sep 2022 02:56:31 +0000

Overview

It's very common to see that some discord groups add a discord bot. What does discord bot can do for us？ It can reply to user depends on what they send。 Let's say when our users send some sad words the bot can encourage she/he by sending some words. Furthermore, when a new member joined our group, the bot can welcome the newcomers because the owner maybe not always online. The bot is scalable you can use it to create something awesome.

library

After searching GitHub i found out several discord Api libraries.

Cog-Creators/Red-DiscordBot(python)
discordjs/discord.js(javascript)
Rapptz/discord.py(python)
bwmarrin/discordgo(golang) I choose Rapptz/discord.py in this piece, because i damn love python。

Install env

First and foremost, we need to install our python env. We need to install python 3.8 or higher version. If you don't wanna to install any local env, that'sthat's ok you can use some cloud env like replit.com or pythonanywhere whatever you want. But for me i installed env using anaconda software. It provides UI and it's quite easy to use。

get a bot token

For sure we need a token。 Then how do we get it? Just click "https://discord.com/developers/applications" and then login your discord account. You will see the new application button near your avatar. After creating an application go to bot page and copy your token. You should be very careful not to leak it。

invent bot to our chat group

I hope you have a free discord chat group already。 If not, you can create one for free。Go to our application page again, you will see Oauth2/URL Generator。 Generate an invite link for your application by picking the scopes and permissions it needs to function。 Get the URL and open it in our browser。That's all。

Some awesome python code

import discord

class MyClient(discord.Client):
    async def on_ready(self):
        print('Logged on as', self.user)

    async def on_message(self, message):
        # don't respond to ourselves
        if message.author == self.user:
            return

        if message.content == 'ping':
            await message.channel.send('pong')


intents = discord.Intents.default()
intents.message_content = True
client = MyClient(intents=intents)
client.run('YOUR TOKEN HERE')

If you need a proxy you can attach some code like this

client = MyClient(intents=intents, proxy="http://127.0.0.1:10809")

This proxy address is my local proxy address. You should replace it with your own address if you wanna use a proxy.

result

After you run python demo.py you will see

2022-09-30 10:15:48 INFO     discord.client logging in using static token
2022-09-30 10:15:50 INFO     discord.gateway Shard ID None has connected to Gateway (Session ID: xxxxxxx).
Logged on as xxxx-demo#4518

After all of above is done you will see your bot is online。
If you get any question about discord bot or discord application please feel free to connect me.

How to use dune.com to collect some NFTs data

Ayden — Wed, 14 Sep 2022 13:30:29 +0000

What is dune ?

Dune is a powerful tool for blockchain research, complete with all the tools you need to discover,explore,and visualize vast amounts of blockchain data. We can get data via a sql query and then present data as

Bar charts
Area Charts
Scatter Charts
Line Charts
Pie Charts
Counters
Tables

Sql guides

Before we get into sql. In case you have no background on relational databases like mysql, let's break down what are relational databases.Relational databases contain a set of data tables so that a user can query some combination of tables to get only the subset of data (rows) they need.

Above is an example of a relational database.
With sql query we can get the data we need fast and efficiently.

Data sets

Ethereum
Gnosis chain
Polygon
Optimsm
BNB smart chain

Create an dashboards via sql

WITH token_names as (
select * from
nft."tokens"
)

select name, symbol, count(*) as number_of_nfts
from erc721."ERC721_evt_Transfer" as scam_transfers
join token_names on token_names.contract_address = scam_transfers.contract_address
where scam_transfers."to" = '\x3E0DeFb880cd8e163baD68ABe66437f99A7A8A74'
AND scam_transfers."from" != '\x0000000000000000000000000000000000000000'
group by name, symbol
order by 3 desc