Managing upgradeability and EVM packages by Facundo Spagnuolo (Devcon4)

okay hello guys well first of all thank you for being here today and also thanks for the to the organizers for taking care of such an amazing event so today we're going to talk about a great ability and evm packages and it is to learn some some things about these concepts and of course to see how we can leverage these concepts using somebody know us but before we begin I would like to talk a little bit about us we are sapling and at sapling we will key technology and infrastructure to build develop and manage smart contract systems my name is Fabrice paniolo I'm a core developer and security researcher at sublime and currently I'm leading the efforts of subway novice maybe some of you may know us because of open sibling open subline it's a community driven open-source framework of useful modules of my contracts that you can install and so using directly in your own projects you also do security audits a few weeks ago we finished the other four the solidity compiler we receive a grant from the Athenian foundation it was really great and well as I said before we're here today to talk a little bit about subbing OS sublimates is an open source platform to help you building develop and manage smart contract systems so let's begin with the first topic a great ability so of course that mere ability is one of the main features of aetherium however several qualities really much depends on on a development that needs to be iterative and incremental and this means that we need to have the chance to update or patch our code if you need to and we're not just talking about bags we may need to optimize our solutions we may need to provide new functionality because the community's requiring it or whatever and the thing is that we've seen many other projects building their own implementations of availability and suppling alas is providing a standard and really flexible way to to do this so I would like to introduce an example of how we can easily have a well with my contracts in our projects using sub Nova's so the first thing we'll need to do is to install sub in OS in this case we're using NPM and sibling OS comes with a common line tool and in this case for example we have a need command that we can use to start a new project just personally the name of our project and let's say that we start writing our first smart contract in this case a wallet as you can see has an owner I guess an initialization function where we received the owner you know you set the owner of the contract because we draw a function in order to withdraw some funds from the contract and so on so let's see how we can employ an agreeable instance of this smart contract using sub us so the common line tool has some comments that are pretty much similar to the ones we use in get so I think it will sound familiar to you in this case we're running the first command the add command it's the way we tell separately the way we tell supplies in order to add a new smart contract in our brushing this case were changed seven ways that we want to add the manual contract that we wrote before and the second step is the push command this is how we upload the back of our contract to the node to network in this case for example we were pushing the source code of the my wallet contract to the raphson Network and finally we have the create command the create command will create an agreeable instance of the my wallet contract and the others that we receive there is the the new instance that we have just created and maybe some of you may be wondering why do we need to run these three steps in order to create an available instance well the thing is that this is no regular instance obviously this is an available instance and the thing is that we can run the create command as many times as we want I will be always reusing the same logic that we uploaded just once so it's RIT and let's say that after we created the first instance our build instance of my wallet contract we found back as you can see they need wallet function can be called by anyone and this means that for example an attacker can call they need wallet function to withdraw some funds from it any resemblance with reality here is perkiness and let's say that we want to fix this bag so let's see how we can do this with subenoy's I promise it's really simple so the first thing we'll need to do is just to edit the the source code of our contracts for example in this case we're adding an only own or modifier in order to restrict the person they can call this this function and once again as we did before we just need to run the add command to tell us how many ways to add the new fixed my wallet contract we're pushing that fix to the network and finally we're running a new command here the update command is the way to tell something less to operate there willow instance that we created before and it will be a simple as that as you can see an attacker cannot call any more than in wallet function and our bug has been fixed so it was pretty simple we didn't have to modify our source code in order to make our contracts available and as you can see where you were using the same address it was an upgrade per set we didn't have to like migrate data from the previous wallet contract to the new one were really operating it so how was that possible I think that many many of you may know already this but we're using proxies in order to make that happen and the way a proxy works is it's a particular contract that basically delegates every call it receives to another contract that is called logic contract and the thing is that logic on the others of the logic contract can be changed and this is how every W works as you can see this tourist layer layer is always kept in the in the proxy contract and this is why we don't need to migrate or pay any like spensive migrations of data when we want to do an average of a contract we're not going to so much even in the in the process stuff but you can more about it in you know documentation if you want so summing things up subbing us provides a standard way in order to have a grade of a gorilla's my contracts in your projects that will basically allow you to fix box or add functionality for example so let's move to the second topic EVM packages vivianne packages this is a new concept we interviews some weeks ago evening packages are upgradeable on chain packages of smart contracts code and this means code that is already on chain deployed by another developer team that it's being maintained but by another developer team that doing any application can link directly through your own projects in order to reuse it directly on chain and it comes off of course with obscene average and this means that if the developer team that is developing an EVM package comes with a new version of the vm package you can decide where to operate your code to use the new version that they are providing or not so why do we need IBM packages we do think that this is a way in order to encourage modular development the thing this is you can you can start focusing on what you do best and start reusing the work that your college has done so with we just don't need to build everything if you want to build something we can start reusing some code that is already deployed on chain and as I said before EVM packages are upgradeable by definition and this means that their developers can provide new versions of the ocbn packages and you can opt in decide where you want those upgrades in your projects or not it's like any other dependency management system and of course we're saving a lot of gas costs because we're reusing some logic that is already deployed on chained by those developer teams and we don't have to redeploy the logic every time if we want to reuse it let's take a look at another example let's say that we have a deck contract in our project and as you can see because an ESD 7:21 dependency it has an initialized function in order to receive the you see 7:21 dependency and he has another function called peak that will basically allow any users to pick cards from the from the contract and you will be minting New Year seats 1701 tokens every time and users a user picks a new card so havecome create an array of instance of this contract reusing an EVM package for the Year season you want to turn 21 dependency using southern OS so it will be reasonable once again the first thing we should do is thank yous when it comes to the new part the link command will allow you to link to any other AVM package that is already deployed on chain in this case we're linking our projects to the open sea beneath a VM package and this package is the VM package that the open sibling team has provided on chain in this case we're linking to the 2.0 version and as we did before we just need to put those changes to the network and finally we can run the create command and as you can see here we're creating an instance reusing the logic of the Year c7 21 that has been already employed by the open sibling team we haven't added that contract in your inner projects we are reusing the same logic that the open sailing team has provided on shame for us and we'll receive of course the others of our available instance of the Year system and 21 there so let's now create let's use this new year Cicero instance in order to create an instance of our contract the deck contract as we did before in this case we do need to add the deck contract so we were running there D I've come and then we're pushing the the source code of the deck contract to the network and finally we are running the create command in order to create a new instance of the deck contract and passing through the address of the USC 7:21 instance that we created before and we will receive their the address of our available instance of the deck contract so as you can see we can start reusing the deck contract and and it will be we can start picking cards will be maintained year season 21 tokens it will be as simple as that so this is amazing we think it have to deploy an ESD CERN you turn 21 contract in order to reuse it where it just reusing the one that the open supplying team has provided for us and this is really cool so I said before that EVM packages are available by definition now let's see an example of what does it mean let's say that the open seven team comes with a new version of their EVM package in this case the open civilian if as I said before and let's say that we want to use use it in our project and as you can see this is an opt-in decision I said before so in order to tell us upon us that we want to use that up with that new version in our project we need to tell us that we want to link our project to the new version as you can see here were linking our project to the 2.1 version of the open 17 if EVM package once again we're pushing those changes to the network and finally we can run run in this case the update command in order to update the available instance that we created before of the USC 7:21 contract and as you can see will be pink picking new carts again with the same thing that contract that we created before the address of the deck contract hasn't changed and we'll be using this new version of the year since 7:21 it will be as simple as that once again and as you can see we didn't have to update our contract we just need to update the dependency that we're using in our project in this case the USC 7:21 so summing things up even packages allows us to reuse code that is already deploying on chain that we don't have to redeploy it every time we want to use it and of course we can as we saw before we can opt in update our dependencies if the developers of those EVM packages that were linking to provide new versions so this is really good and let's go a little bit further on the EVM packages thing maybe some of you may be wondering how we can actually make sure that they call what we're sharing and reusing on chain directly is actually safe we can trust the code that is already deployed on chain so before we answer that let's think how we should how we probably do this these days we may for example hire an auditor in order to audit that code that was deployed and chain and the auditor may raise some findings on that code and we will tell the developer team to you know to fix those those backs or to improve that the things that we that we found there and it will be kind of expensive in order to hire an auditor to do that every time we want to use a new dependency and that's why we decided to start working on the on the bow chain system of supply Noah's this is a way to decentralize that those decisions and this is our first step towards that the toka mechanics that we've been announcing things since we start this project the first implementation of the of the bouchy system we're happy to announce that it's already included in the in the second version of WS we launched this week so let's see what we have what do we have to say about the about this so the budget budgeting system basically allows users to back the quality of an EVM package that is already deployed a second as you can see this is something complementary to the Union package this thing it doesn't mean that you need to use the voting system in order to create an EVM package but this is the way that this is the way that you can use in order to sign saying all your the security of an EVM package that is already deployed as you can see this is our first step towards I create a great list of secure EVM packages and let's see a quick sample of the things that we can do with the bouton system for example racing here a way to register a new EVM package on the bouton system of suppling us it's pretty much very simple you just need to pass the the the name of your EVM package and the others where it's deployed and will be a simple as that and of course that you can also start voting some amounts for EVM packages that are already registered in the in the bouton system and the amounts that we were about in here are not just numbers and this is where the sub talking is born the sub talking is the native talking of the bouton system and it's basically what allows us to align the incentives in order to create a healthy ecosystem of Sakura smart contracts projects and it was also lunch with the second version of Subway Noah's along with with the bouton system and one more thing we're not alone there's a lot of amazing projects that already decided to start building their own EVM packages and many of them are already on chain they're already on the minute so you can start reducing their code in your own projects through sibling OS and you can be one of them too so that's why we decided to start a private beta period this is a way to that we say together and a small group of people in order to validate all these ideas and all the partners that all the projects that I mentioned before I going to receive some cept organs in order to start testing the bouton system and you can be one of them too oh just a quick clarification here this doesn't mean that WMS is not available for everyone seven years as I said before it's open source and you can use it right now if you want just it does it does means that the beta participants are the only ones that are going to be allowed to start testing the bouton system those are the ones that will receive some SAP tokens that the ones that can start watching for some EVM packages that are already deployed the ones that will be allowed to register EVM packages on our patent system and so on and you can follow this link where you will find a registration form in order to sign up for for the for the beta period as I said before it's open for everyone so feel free to apply and we hope you do and the registration is finishing by mid November so please come and join us and thank you so much guys for Hugh me today