KL Mini Hack 2023: Certik | Nethermind

then in my mind I studied a few of if I want to go into web3 so basically this is the right job to start start with because in this platform I can learn about so many projects I mean so many call Founders and VCS and one year later that decisions proved me right and we've been sponsoring around the regions and things like that but basically this is the first presentation so it takes carry in this Malaysian land and Malaysia I basically want to contribute more into the local community so please please help me and yeah I would I would get the best synergies to share here okay so what is certain things definitely are not something strange in the space if you are in the crypto space for some time you basically heard about uh certain things but there's again that the brand is that the reputation is there but uh there's some means or misunderstanding and the tools are available but people don't know how to use tools so so this um will be audited like five to six close to six thousand contracts uh last a projects last year and basically if according to CMC market shares we we basically ran like 60 70 of our total recent coins CMC so you see that the 60 market share basically come from that that data itself and is founded by two Professor so uh wrong way is uh Colombia from Columbia University is currently our CEO so he is an expert in formal verification so he found the Celtics in 2017 and yeah that's how I Grew From 12 peoples of of Manpower now we grow to 300. I was uh I was like 176 employee last year we provide security solutions for the web tree space and currently the last valuations we have is a one billion dollar so I think the founder did a great job on fundraising because the race uh during the peak time of our sales then later we draw so uh yeah from the last Market Revolution is one billion and the last the last two investors join the pool is Goldman and SoftBank so uh so sorry to them they're buying the high price yeah and tiger grober Finance lab Sequoia are the um uh the earlier investors to certain especially Sequoia they have a very good platform um for for startup so for HR management for trainings everything's um Sequoias are providing all these resources so we can do L even l0 L1 L2 VF and of course web2 so web 2 basically is about our penetration testing we have audited so many projects and basically this add-on to our expertise uh coming along and you can see now we can audit a lot of our programming language and also uh the platforms but this basically grow in the last one year so before that um 80 of our contracts are audited in evm compatible and solidity and later the team have some capacity and the engineers team grow like 100 so they'll start learning the other projects so one of them main projects that we've done is that our largest fees in the history is Aptos so yeah we completed Aptos in around October and so you see uh Aptoide 3 hackathons or events that we are we are partnering with them this year so now our Engineers are very familiar with move language but we we talked to sui but we haven't um subscribe to our service we we talk we tell them we found a practical findings in their source code so tell Suey come to us you know yeah and of course uh golang Ross So Anna Ross near yeah we can do that so how to sell the audit and um so I will go through the process flow and let you guys have understanding how to engage all the company so first uh usually there will be initial meetings so these meetings you need to show us your source code for review you can share to our GitHub things like that or you can talk to our Engineers about your oldest school and what is your budget because the budgets and your audible the scope must be go online sometimes you want to audit so many things but not necessarily the course can cover all the audits right your time frame of launching and things like that so I'll just give you a one a very quick quick note on how this landscape changed so I joined the industry before the Luna incidents so in the first quarter of last year um there's like 10 000 tokens listed in the Q4 there's only like uh 3 000. yeah so now uh q1 most probably will match queue for our activities like a few thousands uh tokens going to uh listings so we have we have an end of q1 currently is still um Mid of q1 okay and things change and switch away so there's so many tokens on this in the first half of last year and suddenly uh Luna incidence happens so you don't see so many nfts but at the nft marketplace are still coming to audit and in the latest later stage you'll see more infrastructures building and you'll see more breaches involving um and you you basically don't see those cartoons anymore you should know why I mean especially after the FTX incidents uh things go very serious only the very serious Builders and projects uh continue to get on funding and continue to build yeah so a kickoff meetings and the projects were on board so once the projects are engaged certix Services immediately in one working days will release them in our website so if that says uh you you meet any projects that saying that engage static Services you can basically go to our website to verify setting.com have this leaderboard you can just type the Project's name and you can see the or they progress things like that I will show you uh shortly we also have communication Channels with the projects teams it's like telegram emails yeah so once the quotations and timeline is conquered the projects team will pay and we'll start the services and we'll we'll provide the prelimited reports according to the audit timeline so why is the audio about basically there's a five pillars here I definitely not a tech guy probably you understand this better than me but there's a lot of mathematics uh um or data specializations in doing Securities audit so the first people call our trip modeling and preparation and uh automated analysis this is one of the the key libraries that we have after so many years of auditing projects expert manual reviews is done by the engineers Dynamic analysis and disclosure validation so let's go one by one so trade modeling basically we have a checklist of what kind of uh things that we'll be going to test so this stream modeling is by Design on uh and by preparations by the scientists engineers professors they understand about the projects that learn about the projects so they have these uh documentation checklist on how how to do the audit and automata Analysis so now we have like 60 000 fightings uh since uh we started 2017 so this is a key libraries basically we will scan the source code with our libraries immediately the system will tell the engineers that this source code have these findings these vulnerabilities things like that but then we have convenient tools like that this only dance 20 of of the hard work the other 80 percenters will need a manual relations reviewed by the engineers so automated of course the one the Securities are evolving in the space so even we have 60 000 findings basically uh this will continue to grow by time uh I swim uh manual review you'll be surprised that our Engineers not only review The Source Code itself we also build proof of concept on their tokenomics and look at their white paper if their source code or what their their bill are basically same to what they have planned so um Dynamic analysis this is a 10 test environment setups some testing is a hypothesis setup and to test on the source code as well yeah so after all these stages done and we will we will release a preliminary audit reports on to the projects team so now the project team have these five things and also the recommendations how to fix all this uh source code so we call it the remediation process so to do this we have this platform called uh Sky Harbor so Sky Harbor basically is a platform that allows the projects team to log into Sky Harbor and look at the look at their findings and also um they can comment in their findings and our engineers and our technical teams I will review what they have fixed and provide a recommendation or suggestions if necessary so this is an example of what happened to a to the client to one of the clients um all these reports so you can see um so this category is called inconsistency so you have you see this source code itself has three fightings and the recommendations is here and this is what happens to this is the comments from the projects team so these are not critical findings and the theater is smart has pending because they have fixed they have remark what have they done by the projection by our Engineers will review the source code and see if they Implement correctly and we will rank this status to either acknowledge and mitigated partially resolve or resolve so um this is just inconsider inconsistency but if you go to a website you look at those audio report uh you basically can see some real not really some uh reflect that okay something like uh centralization which basically is how the projects team manage their tokens manage their priorities yeah so there's a lot of exit scam last year and also you know what happens but basically the Audi report really tell you that if their only emulation centralization is basically is a reflect it means the priority is all by one single owner that don't have a genosis safe in place malteseek that basically is a Time Bond you know people get drunk and wake up with the different animals you know that's what happened yeah and a lot of business ideal business plan initially when it grows and it will evolve by time maybe it will fail so when you feel a private without a proper priority management then you you basically it's not really decentralizes is building um it's building business in a decentralized with a decentralized tools by managing the funds with a centralized way so it's a very dangerous approach and of course we also do a penetration testing so in your l012 you have applications a platform to face of a front user and this is one of the Miss Gap a lot of times people just do a smart contract audit without uh do a pen test on their applications so like web applications mobile applications uh this also subject to vulnerabilities and uh chances of getting hacked so what we can do is a pen test in wallers exchanges the apps also uh crypto breaches so these are the these are the clients that we have provide this pen test services for them and um now we want to focus on providing pen tests to to our customers because last year's we have Professor currently join us he is now our C oh sorry I think it's co CSO currently and he's he put so much effort on developing the pen penetration testing team so um these are the clients that we have providing pen tests for them yeah probably some of them is familiar to you and what I found in certain is basically we have a very good teams not only doing all this not only solving security problems but they also enhance internal workflow so accelerator is one of the workflow that is used by the engineers and also the the team so here in accelerators basically whatever filings the engineers done they're basically are Keen into a system so this is the system required accelerator used within like me also use this system to communicate with the engineers and I think for for developers it's important that you need to understand the user interface the user experience so I think certain things done a very good job here and this is basically a flow of uh what accelerators did uh for the users so we will submit codes with the source code to our Engineers so the engineers will review The Source Code the complexity itself and provide the timeline on how many days you need to audit this source code so BD like me we'll get back to the clients and tell them hey we need this much of course and this this is all the timeline and this is the audio scope so are you agree with that so if you agree then we will process the documentations invoice and service agreement to onboard them so accelerators basically serve the purpose from the initial stage of getting a quotations during review and later it will it will also provide a interface to do the recommendations for the audit but even you lose a smart contract already or penetration testings but this won't last forever because Securities evolved so there will be some challenges in the space and it's still it's still challenging in this space so for example like the vulnerabilities or the hackings are evolving uh especially uh at a at a stage line now and also because of Maori chains a lot of smart contracts that deploy a multi-chains so the data in different chains are scattered and across all these ecosystem and vulnerabilities is undetectable after the project deployment so after the smart contracts is ordered and deployed and functioning but you won't have a system to manage or tackle the problems in a real-time basis so how we solve that basically we provide Skynet solution so scanner Solutions is a real-time monitoring alert to detect uh trade or whatever vulnerabilities in a real-time basis on the all or the audio contracts that we we have or from the database we have so we provide a real-time Securities trust core in our website to tell people what happened to this particular projects and if it's if the security is vulnerabilities is anywhere threatens by some some of the things or hacking happening elsewhere yeah so the scanning basically did provide a score from 0 to 100 and we call it a Skynet trust score so the trust score basically compute from the security score and also the market Community score so the security score basically is about uh the audit they have done so how many findings have you solved so there will be a static score on on that particularly informations and Skynet marketing committees basically is about uh the liquidities of the tokens tradings in uh um the the centralized exchange and the community score basically is compute by the tweeters account so how many negative tweak or positive tweak so it's very amazing that our our team able to build these products because it's good in the real-time basis so um I cannot share too much information see because these are proprietary tools but what I can show you is um there's a there's a mathematics uh behind all these scoring so all all factors have their own algorithms so there will be uh two segments of data flowing to and provide a signals and the charge score basically is ranked between all these signals so we'll compute into a trust score so I have a documents basically uh all right his life cannot see too much okay yeah so uh you can use this yeah the the good news is you can use this you know so you go to our website for the projects that subscribe to us on the Skynet you can basically see this in a real-time basis okay I'll show you more informations uh here and now we break down the scoring into six factors so like static analysis uh on-che monitoring the social sentiments the governors it means the token distributions the market volatility and the liquidity and the safety assessment so when you go to our website basically it just looks like that and there's so many projects out there we have like uh 3 000 over projects listed over there so let's say you click on polygon so polygon is one of our uh key clients and you see the score is there and is L2 scaling system by categories so if you go to the profile you can see uh the Skynet scoring so this will go in the real-time basis you also can see uh the security score and the Market Committee score so there's no uh not so much negative tweaks about polygon now well if it's a lot of negative tricks then this uh this 90 is covering 93 last on yesterday it will drop and you're also going to compare the score uh for polygon between the other projects in Skynet that using a Skynet and if you scroll down you can basically see a code history let me show you the website so the website basically have so many informations down there so this is okay so once you go to the website you can basically search the Project's name if it's audited by a certain so any any projects in mind that um now you are most concerned busd no I think busd is stable called by BNB chain is fine you know so we audited BNB okay so once you go to the profile immediately you can see uh the scoring is still good yeah because uh sabercoin is the other concern so under the code audit history you can basically see the source code and the audience code they have done so if you click on the real PDF you can basically see the entire source code the findings that um we and we encount um I mean we we cover it um and also the recommendations so all these big so transparent and publicly available yeah of course this is basically a o format let me show you a new format um it works better um so let's let's see uh Aptos okay so you see under code all the history Aptos have audited so many uh source code so all this source code basically shown has a different tab so you can click on the tab and read the source code and look at the finding so in a in a layman term basically you're not necessarily need to read the PDF but you can see okay this uh Aptos called move depth source code have five findings and then we solve three yeah just by the summary tables immediately you can you can know a workout problem that I've fixed especially the critical one you can also see uh with rank the findings by critical and major so critical are the findings that they must solved no matter what is the infrastructure's problem or things like that major like centralization vs we are actually categorized as a major risk so if you click on the wheel findings you can measure against gain some inside yeah so uh what happened to which salt resource code it sucks what kind of sheets you need to solve yeah all this is written down there so you it really helps if that says you are building uh certain functions um certain swaps taking or whatever you can go to our website and gain some experience over there is is widely available there especially like a critical it's a logical issue this is a this is a critical problem because it's logical issues so my minor problem is inconsistency sometimes informations is about they are not using the industry standards on their language so we'll ask them to solve it so here you can see our recommendations you can see the findings and your head you also can see the Aptos theme comment so this Aptos theme command is very important their language how sincere they face their issues you know you can basically look it from here and a lot some of the time the sax product I cannot say it some of the time projects are not very serious on doing this so you only see the knowledge of findings hmm if you scroll down okay this is all the informations provided by Skylab so this is a social analysis so the lady mentions are dropped by 57 uh for Aptos but the followers is growing so all this information so you can uh you you can see using Skynet and this is one of the reasons why um in Southeast Asia there's so many traffics uh flowing to celtics.com especially with vagnum rank number one and then following by Indonesia's Thailand then Dubai and Nigeria so these are the top five traffic flows to certain.

com why because they are using this dashboard to do tradings and do uh decision making why let me show you this don't have a chart okay let me go back to a polygon so we interface a trading view chart over here and now what what is the difference between you use a trading wheel or use a Skynet trading view in certain.com is because we we allow you to um use our informations to plot in the chart to deploy in the chart like Twitter followers there are some token changes yeah all these informations you can put in the chat and probably make trading decisions I know I don't know I don't know how you make it but these are the informations available that yeah and if you continue to scroll down um you can read the news the volatility of liquidity also you can see the largest tokens holder LP holders on polygon in a real-time basis yeah yeah so this is a Skynet sorry so this is about a Skynet and it's available for everyone to use if the projects pay for the Skynet services and we also do a kyc so people in this space if they want to stay abnormal and they want to build a trust with the communities they can do a kyc with a certain so this kyc um we will need the projects team to basically submit their documents like a driving license passports uh some some of my clients that will do a recording video about that holding a passport and smile to the camera I don't know why they want to do that but it is so sincerely it's very good then step two will perform ocean analysis on all this data so um for whatever reason they don't provide a certain informations about their previous background we will still able to check because of our old scene so our kyc compliance team is gathered by the x-fbi that build algorithm on traffic human human trafficking acts French policeman they are all in our team on doing this analysis so sometimes no joke you know because I read the reports of my clients then I I'm so afraid that wow how many informations they can find so at that time I joined this company I I know that I've been checked so I most probably are very cream a very clean my credit rating is Triple A probably so I can enjoy certain things you know because they can really do whatever they want to to just um to dig informations and during the verification process they also will perform a video call yeah so some of my clients I'm not sure it's language problems or what they are they become so skeptical to provide informations and um the the interviewer feel not good so the rating of the kyc also don't go good as well because you know it's FBI yeah and these are the documents we need in them to provide like proof of the social accounts uh the twitters of the telegram of the projects they need to show us if they use godaddy domain they need to show us the proof of the payment yeah so if that done the kyc we basically will issue a batch there so like uh shuntu is one of the projects uh for Celtics uh reimbursement products using a cdk coin so you can see the kyc is in Gold so um of course there's more information down there like 10 members verify and these projects started since October and the kyc timeline things like that so we basically do make our interface uh so readable you'll not necessarily need to know those technical informations but by just clicking the informations bar there will be more informations for you and and in a very colorful interface to tell you okay this is a good one kyc goal um we have three rank for kyc kyc Gold Silver and Browns so I didn't last two weeks ago we started two new services beside the Security Solutions that we will providing um this one we call incident response so we've been doing incident response in our Twitter's um you can go so takes a lot we basically share our data findings about our certain problems that happens in the space then we will share our investigation uh findings so what about incidents respond is this is the clients face a problem now they can engage us to do uh probably like talk to a law enforcement or probably their wallet get hack and we will try our best but it is actually a service to try our best to recover the asset if it's possible Liars with exchangers these these Services just started two weeks ago and we also started a certain advisory especially for the VCS so um if less is the business when we invest in certain projects that need some technical due diligence to be in place so they can use our service to do that so we call this a certix uh advisory Solutions it just launched like uh one week ago yeah it's uh it's so new we can do a market research tokenomics study compliance yeah things like that we've been doing that but just we make it a new products that we can offer you know yeah um I'm done yeah so hopefully it's not taking too much of your time yeah um if you have any questions reach out to me and what should I do now thank you thank you again anyone have any questions for John uh camera Workshop I work for a company called nevermind we are very involved in the Stockman ecosystem and hence my topic today uh Hands-On with Cairo and how to deploy your smart contract to a stunt man and at the end of the day we are going to see how to verify your contract Envoy here so yeah first thing I will do is that we need to install a stock net or rather Cairo so uh not so so now let's here's a bit of caveat whatever I'm going to talk today uh it's it's the version that is going to be deprecated very soon but the reason why I'm I'm literally seeing that versions because the new version hasn't been launched yet so there's no way for me to deploy contract on the newer version there's no way for me to verify contract on a new version and hence we are sticking to the old way of doing things but but do not be do not be uh do not be demotivated by the fact it's an older version because most of the things are very easily transferable knowledge I mean so first up uh ensure that you have python 3.9 and uh what we are doing over here is essentially we are creating a virtual environment I like to create mine in a root so hang on a minute so okay uh I will just close all my terminals start a new one and if I list a you're able to see that I've created my virtual environments for a couple of different chiral versions so um having virtual environments are a good way to ensure that your python version I mean your chiral version doesn't have conflicts with each other so over here I've nicely created this 0.10.3 which is what we are going to use today because that's the current latest version that we have on production so uh these are instructions that you can easily find on the star net doc quick start talk um right now it supports uh window sorry not Windows uh Mac and Linux and if you were to use Windows you have to use WSL and uh we tried it and uh if you have problems installing with on Windows and WSL Curry is with the bucket head on the on my on my left here it's an expert in wxl so uh do look for him yep and we don't and because I've installed all this already so winding what I'm going to do now is I'm going to let me try to go with one hand uh how do I how do I type sauce Cairo oh Cairo underscore v e and V ocean oh let me just type real quick it's so hard to tell you one handmade it's not a good idea [Music] oh yeah oops uh yeah sorry about that okay so yeah what I've done now is I have activated my virtual environment uh basically what you downloaded here and what you run later uh this step where is it the saucet oh it's not here yet okay nevermind it's okay it's not written here okay it's right but yeah what you need to do is that you need to activate your virtual environment which you have downloaded your Cairo compiler version and once you have done that um I would like to then show you to a tour one of my favorite framework to develop on it's called photostar so let me quickly head on to the docs um so Photoshop is real easy to install it's unfortunately only on Linux and Mac if you want to use Windows you have to again use WSL it's very easy to install what you can do is that you just need to copy this thing and then run it locally and then you're able to get your latest personal version which I already have so if I if I check my version what was that oh much easier for me to speak yeah oh yeah awesome so over here there's nothing it's fine so over here you can see that the version of my product side and also the version of my Cairo which is 10.

3 points 0.10.3 which is the also the local environment that I'm running so that means we are good so uh what are you gonna do now is that I'm going to CD to a place so that I remember where I place my repo I normally like to place it on the dock slash repo and I'm going to call protostar in it with a name and let's call mini hack oh what's that oh I really have the file so let's call it another name so let's open Visual Studio for that yeah okay my wishes is up so uh using the protostar init function uh yes nicely scaffold everything for you so what you have your source file your test file which you'll be writing tests in and also this tomorrow file which is how we are going to config this later so uh we'll we'll walk through this throughout the hour uh let's look at how like a typical Cairo contract looks like um the uh so over here you can see that we have like a percent length statement that means this is a con a smart contract that's going to be plugged on Stockman so recall that uh starting is also Cairo is also a general programming language so you have to specify this else uh the compiler treated as a normal chiro code that is not going to point on subnet the difference is uh is that in smart contract you need this external storage of our kind of macros or decorators and you're not able to use hints we won't be the coloring about hints but yeah just remember to deploy on stock net you need to have this uh this percent length standard indicator so a followers who are very familiar with solidity you can see that this looks somewhat similar but not exactly similar for example if I were to have a Constructor here I will need to have this uh decorator that's it that tells that this is a Constructor and this is how I declare a view function and view just like a solidity only reads from the smart contract and not making any state changes just like this one over here external is something that you call and you make stay changes for so these three are the simple decorators that you receive a lot storage bars are basically you're declaring like a like a global storage just like how you do like public in uh X oh bigger oh push it too big I believe this is better someone better okay I'll take it so just like how you declare your Global State uh declare your state variable in in Cairo code so yeah but after scaffolding this this is a general structure you will get and what you need to do now let's try to build it the comma is real simple You're Gonna Run for the Stop View and just like that the file will be in this new created build folder what you see is that you see this main.json over here there are three things that you will notice this is the API so um you will then upload this file via deploy contract oh sorry I mean declared class to and then you and then this thing will go to the network including um the the entry point type and also the program uh bytes which is this one the data so this data is actually how the program is run you can think of this like the byte code of a solidity but now it's in Cairo the versions are here the hints are here so these are the allowed hints the white listed hints and a lot more bunch of details but we are not concerned of that we are what we generally need is that we need the ABI because ABI gives us some like an interface for us to interact with the smart contract so the difference between a solidity and customer is that even though you have not verified your your code or you're able to also write and read the smart contract because the API will generally be known when you deploy the contract so yeah that's a difference so now let's talk about the uh hang on so let's try to deploy this contract how do you do it it says let's stick for this scaffold contract so how we do it so um so uh what we need to do now is that we need to have an account because um everything in a standard requires some gas so we will need to create an account find our account with gas and uh and then declare a class so let's do it so first things first uh I'm already in my okay I'm already in my environment I would like to then declare some environment variables so uh just let me just get over here I'm telling that I'm using the alpha quality environment variable I mean I'm really deployed to alphagoli which is one of those test net on stock net and I am choosing this default Starlight wallet by open sampling okay once that done you can just call start net new account uh mine would fail because I've already have account and a and for for this network just like this but but just to show you how it looks like if yours works you will see this file being created here at least ah okay sorry for that you see this account being created with the public key the private key and the address of your deployed account and true or not so you have this if you have done the deploy new account and the next thing is that you need to fund the account with with some ether because ether is the native currency that you need to use to pay gas so I already have some eater so just to confirm let's go to our stock net Explorer foreign explorers available is like etherscan but it's on it's an ether scan it's like either scan on the star map ecosystem so over here I already have a 0.1989 I think that's very enough for what we want what we want to do today and over here we can see all sorts of details such as transactions events uh read and write contract because this is now an uh an account contract or even right so whatever all you love and like you to scan it's generally available here so if you would like to get a some test meter what you do is that you need to have like a goalie account uh yep scooting but it's not locked let's see how much call they have this minute there is a winding goal is because all these uh Summit Alpha body relies on golly as the L1 layer so you need to bridge send some some of this over to the standard ecosystem how you do that generally you you have to use this bridge called stunt Bridge stunt gate sorry uh it changes to golly because I'm on golly and over here you just need to connect your metamask and your stomach wallet speaking of which we have uh hang on a minute yeah oh I already uh have my start my wallet oh yeah but we have two different Starlight wallets uh rjx and uh in Bravos so these two are the commonly used wallets in the ecosystem so you need to send some meter over and then to then you're able to deploy but I've already done mine because it takes a while so I already done my advance so we are good we are good on that front Okay so now we have uh we have built our Cairo code let's try to First declare so um in stagnet contract Works a bit differently they are cons they are a concept of contracts and also a concept of classes classes is like and an interface I would say a a place where logic of the smart contract contains and then contracts will read on we read it's an instance of the class so in other words one class could potentially have many contracts that has the same code that will have the same code so um just let me show you an example so in uh in the Voyager Explorer we have classes and contracts and these are the contracts that has been declared you can see this one is declared like two hours ago these are these are the read and write functions here so despite not being verified yet we can already know what the read and write functions are simply because how stock net has designed that their API has to be also updated uploaded to to get a contract declared and if we were to look into contracts you can see that each contract will have a class hash because contract is simply just an insta a working instance of the class so this class potentially could have many many contracts like this this one has um 53 000 sorry 532 2011 uh contracts it's a lot it takes a while to load but yeah it's it's yeah it's loaded so so yeah there you go so it is now important for you to first uh declare a contract let the network know that you have a new code that you want to deploy and then you deploy by from the classes so let's do that now so um I like to use the native starnet commands to do that so I've been ready over here so how do I declare it's the command is stuck man uh Dash Dash track I think it's under build it's not uh one sec okay now let's deploy it I mean declare it and you will read from the account that I've created this now via the uh deployed employee account and over here it will give us like the contract class hash which is the hash of the code as well as the transaction hash so we will need this to wrong one let's go back to Voyager so let me allow me to explain what these statuses mean a receive means that the sequencer has received your transaction the sequencer is a party that arranges your transaction so now the SQL has it pending that means it is uh it has not been confirmed but it is going to be confirmed so we are waiting for accepted at L2 and then after long enough it will be accepted on L1 so what's the why accepted L2 and accepted L1 because stock net is a layer 2 scaling solution so at the end a couple every few hours it will send like a like a proof uh to to L1 and once the I want to accept it that means the state is confirmed to be correct because of the start proof technology so yeah this one will take a couple of hours but this one should be ready in a cup in a bit so let's give it away there we go we have it as well um okay that's good now let's see if our contracts here is something that I need to verify okay cool it's not verified we'll go through how to verify that in a bit and now this is just a class so remember class is something that we cannot interact with so what we need to do now is we need to deploy a contract from the class so let me also do that uh via my terminal the command is stock net deploy to class hash the class uh here whatever foreign causes a bit of confusion but I managed to deploy it let's take a look again on Voyager same story yes we now received by the sequencer and we take a while to deploy so yeah there you go this is how you deploy like a easy smart contract on uh on a Stockman again bear in mind that these are all in a standard 10 0.

10.3 syntax in the next Cairo with one version it will be a massive changing syntax uh but but we are not doing that today because that is not life yet so yeah but do look forward for many tutorials and upcoming workshops by datamine and also by the starting Malaysia team uh okay while we are waiting for this to get the oh yeah okay it's coming soon I'll try addressing here oh no it's my contractors I'll do this here cool uh this is the contract you have deployed so the contract classes the contract class hash matches the one that we deploy up here it's 285 5de and this is also 2A from the e okay if it's correct so um so the problem now is that we are not able to view our code right so even though we have the read and write function we are not able to verify the logic of the code so the next step is to get our code verified on Voyager so uh thankfully we have this thing called Voyager verify which I'm going to show you the GitHub so how you install Voyager is by running this npm is G Onna install it globally let me open a new a new window and it should have this version which will be the latest version and the next thing we do is that we CD to uh to the report that we use just now which is I think Chao Mini hackathon too let's do it so a voyager refi supports three types of deployment method one now one protostar and one a very no framework so uh if if you were to run Voyager refi later here uh the the this package should ultimately detect which uh which framework that you use so it's pretty convenient so let's let's do that okay over here it pops up which version that we want I select golly uh enter the contract class hash so I recall that my class was what's this happening what other class was lost money 10.3 because we have this load version it's just a contract class no because this is just a class that we deployed from and we select the file that we wanted to verify is this one so let's give our contract a name let's call it a test protostar and you'll then surely verify your contract there you go uh version successful thank you for invoyager so if I were to refresh this page this status has now changed actually I don't need to refresh this status has now changed to verify and I can now see my code right here so this is how you deploy and uh and verify your smart contract on Voyager okay now this is pretty straightforward I basically have not gone through any fancy operations mainly just using this uh startup init code and show you like the function in it so let's try to do something a bit more fancy let's let's oh we have a question can we see now the contract code and it was not possible before the five minutes oh let me give you a check I think it's because some some bug that we are facing embarrassing to share that but yeah things work problems let me give it a check uh let's see let's see oh yeah it's probably some bug that we are facing some don't want to avoid just like but it happens like very rarely and today we are unlucky yeah it's deployed it's there but something I'll avoid you a little bit okay anyway our class if I were to deploy again it will work so let's try um it's it's a little slow because of network but let's let's revisit that uh so next thing um so now we are just I'll I'll get back to this later yeah if I remember the next thing we want to do is that we want to then uh use libraries because library is something that we rely on a lot especially open sampling so how do you do that um so in polo star what you do is that you need to run Photoshop install open the plane I'll do it so this command allows us it would detect that this thing it's uh it's github.com this open the places Cairo and then it will install like the oh it fails um just do this without without the versioning okay oh yeah and the contract is now here yep there you go this is contract and because it's verified the code is also available because we have verified the class already so the contract inherits the class and so this entire thing is now verified has this verified status here I think there you go so um back to our yeah so I've installed my library here Cairo contracts and we have source so let's try to using this open Zeppelin to maybe create like an erc20 contract because this is more simple uh to do that to not mess things up new file so I'm going to be lazy and just copy everything from the top because we need to take something here so hash built-in is something that we'll need uh I will explain this but it's one of the buildings in Cairo that we need to import whenever we want to use some functions especially so uh before we do that we now need to import open sampling so how we do that so it's from uh which we check where is it open Zeppelin slash token slash erc20 and Library Dot okay and what do we what do we import we import the namespace which is yeah C20 now before we forget uh remember our automobile we will now need to tell a total style where to find the directory to our Cairo contract so this is another thing that we need to remember uh we need to declare like a lift path and then uh the the directory to where the source in the lip is located so lip slash Cairo contracts slash source so what basically it's going to happen is that photo style will uh you'll see that hey this is something that it doesn't recognize right and then it will then look at lip pay this looks like a puff that I can use you'll then concatenate sled dot lib chiro contract source with Slash open Zeppelin token yesterday Library which is uh the exact path that we have here lip Cairo sauce and open sampling token erc20 Library so this is how you you you avoid having to type the long long things like Source dot uh sorry lip dot Cairo contract blah blah blah so so by by setting it in the tunnel file you avoid doing a lot of those things and and because we have now a new contract we need to remember to also declare like a let person know that we have a contract that we want to also compile so let me do that okay so uh now what I do I have I have prepared like a copy of prc20 which I'm going to copy and paste and I'm going to explain what's going on because there's so many I won't be able to do it in life with one hand so uh yep so what normally typically any rc20 has is a Constructor it will tell you the the name the symbol initial Supply and these are the initializers that you need to call so if I jump in can I oh I can't that's fine so so we are calling this initializer function at the Constructor and then we put them in some supply to the recipient right and then we also need to declare some view functions to view the name from the storage symbols from the storage total Supply and so and so forth this these are like standard erc20 functions uh transfer transfer from approved approved approved form a proof I think yeah disapproved yeah I forgot and uh yeah and so this is a complete erc20 token on stock net but not quite if you compile this it will fail let's see what was the error so it's complaining that oh uh try again oh oh I use the wrong uh wrong wrong wrong key it should be Cairo dashboard instead of like lip that this work but I still have errors for for the same reason that I mentioned before so over here this company that I don't have fuel in 256. so what is going on here isn't urine two five six like something like a native type uh unfortunately for Cairo older version Cairo Cairo zero uh you need to import a un256 from the startware library the good news is this will be then like a first class citizen in Cairo one so definitely an upgrade on on build a developer experience there so I am going to copy and paste that because I prepared to copy here okay uh the reason why we need a separate un256 is because all Native types in Cairo are felt felt are 252 bits and 256 ue256 are 256 speed so we are four bits short of representing the uh ethereum erc20 standard so the workaround or the strategy to go about that is to declare a new type just like this and basically this is made up of two Felts of high and lower parts of one to eight bits to and and uh using two Felts to represent like a single two five six bits so that's a strategy here and I built I rebuild and it failed so it says I'm missing get color contract that's because I will need to also import that so get color contract is like message store sender in uh in in solidity I I normally forgot the extension so I always have pretty bad this thankfully and now it should work there you go uh we have nicely compiled this build this and and yeah there you go we have now a walkthrough like a simple erc20 Cairo contract and to deploy it it's just like how deploy the main the main Cairo uh I think that that is all uh I'm open for questions okay uh any questions uh I guess that sums up uh the workshop for today I'll be around or if you have any stamina questions or character questions uh I'm on the table or around just let me know and I hope you enjoy the rest of the day oh yeah okay thank you [Applause] okay now I'm a different mode now so I'm going to talk about a bit of the hackathon uh right until now to 10 pm you guys are free to roam around if you're actually not free we do have hacker Sports uh Yiddish over there we'll review to how where the hacker hacker sports are later uh do remember again friendly friendly reminder include your GitHub link with readme file in the dev post because if not we weren't able to check your work and we weren't able to include you in the presentation slot uh do that before 10 pm today and I will then announce the order before 12 A.

M optimistically because I need some time we need some time to filter and go through the entries one by one and I think uh uh anyone that is still looking for a team we have a last minute entry if you're still interested if not I think that's okay okay probably next time uh anyway I hope you enjoy hacking and I can't wait to see what you guys do tomorrow uh you this before you want to come and expect