J2 RF 01 Makoto Inoue Managing a legacy Dapp

okay good morning yes so my name is Makoto and the today's talking topic is about managing and legacy tap and I think I'm the first one blocked cherry service space talking about legacies you know because such a thing usually doesn't exist so I'm very glad to be the first legacy boring talk okay and also there's a big irony here so I today I'm going to talk about basically how my app is in use for the last two years and then like how my code evolved over the last two years and also my app has been actually running in the main net for quite a while so like you're just sharing the experience about how to run in a main net but and so the topic is like in my app name is called block party so I think people who be interesting my talk had a good night last night party so see in a bed that's why you know here did lots of people but we could have more but anyway so let's first talk about what my daddy is that so the problem I'm trying to solve is this 50% problem that whenever you organize like today like I have so much high expectation and especially there is a society like this is what in I think you know my talk will be filled and I think Trump must thought that you know this is a 2009 Obama's inauguration so like he saw that so it must be my time like in his reality there's a many so as a free meetup organizer I have like my local meetup and always struggle with like you know how many people I should let people sign in all that kind of stuff so my top does very simple logic that when you sign up you take the deposit if you don't turn up obviously you lose but if you do attend will share the deposit together so people might say hey I went to the party and I got extra ether so that's like when people say oh that's why you do so cats and so that's up and how he walks is like it's actually very simple there's only likely to four six functions so when people registers people call this register button function and when people comes people one of the biggest criticism block parties like it's quite centralized right now so like a event organizer access Oracle that like you actually manually check like okay one two three four five six and I'll count and checking and once the party is over Artemis says yeah okay let's finalize a deal so we press pay back so that users can press the withdraw button and how I've been using is so as I mentioned I have a very small meetup called laundry certain code up where people talk about like showing the code and stuff so for since last September I used this tab in production to manage my meetup and it's great before it was always fifty percent but nowadays it's a hundred percent per tendency so I know exactly how many how many beers I should buy and how many packet of crisps I should buy that's amazing and I'm also trying to roll it out in the bigger beat meetup like a laundry Sara meetup what this is where I'm explaining how things work and in the last how many people went to DEFCON three two one yeah so during the difficult three I did the I did the basically meetup organizers meetup where we basically went to the state restaurant and I wrote a lame blog post like a proof of steak and that kind of stuff but that was a good steak anyway then so the result is usually as I said I was trying the whole outcome of this smart contra is I want to improve the attendance rate so how's the result it's quite good that it's actually ninety percent of people actually do attend over the last ten times ten times I've been doing since Def Con two and so the payout so how much people actually get like most of the time because a hundred percent you don't get anything except a few things like it last year there's a head con in Paris at that time like yeah I got a payout or point for ether because at that time he was quite cheap so I put the deposit of one either at the deposit and yeah so this is that yeah how he went there I don't know if you guys know the semen from a variable IO so he was a generous one we decided not to come to my lunch but he went to some workshop usually like I get like okay you like you say you come but everybody is so happy and so that's how it works and if you want to experience real damping action there is an event on Sunday that we just put restaurant for 10 people and there's a still six spots available so if you're interested please come along and this is a whole talk I think my mission is completed so I could finish but I haven't done any technical ones so I would carry on that so every issue of the code so initially I did the first coming in May 2016 I'm curious how many people have ether like 90% so that means how many people have used tap apart from like ICL 70% okay how many people actually writes a solidity code to 50% how many people writing for more than three months keep raising hands 3 months 6 months 1 year 2 year so 2 years you the jerk guy yeah so I start about the same guy time like so more than 2 years ok good so if it's more than two years you should come and there you should come and give a talk but yeah yeah you have your own talk ok good so at that time so I use a solidity was about version zero point three point two and the truffle was very shiny thing that it just sounded 1.0 currently I think trophies won't 4:06 and so side it is 0.3 point 12 or something I think so how'd I call he was like two years ago it kind of looks pretty much the same as now but can you spot what's missing exactly why else yeah sorry oh yeah yeah that's true so most of once the missing is a payable as I think now like default right but at that time so when you register you put the money but at that time there's no such a keyword and if I use a compiler of that time there's no pretty much no error but now if I put latest compiler I get full adder warning you can even use it and why this is important because I think couple weeks ago it was the first time I actually taught like in the blockchain stuff to the student and the one with the stuff people are complaining like why there are so many errors okay you know I don't need it but there's a whole source of history to come through and most of stuff is more about like making more explicit key word and that to kind of cover your in a mistake or you know just forgot now like it is a lots of support so that's something now you take it for granted but during that time like it didn't exist and so I'm gonna go through couple patterns which evolved over time first thing is called thrall versus return now there's not even what Kiva go through but when I first started so this is when I register but if it's you don't have a report or throw and stuff but then like I went to the code up so in my own study grip where people talk about code and the way I present that code what do you think and I got lots of responses well actually you shouldn't throw you should return because the argument at that time it's now nowadays it's ant pattern but like when he was like two years ago it was some sort of discussion saying like a or if it's return like a if it's wrong you don't it doesn't throw any event so you have no idea what I'm a nice be throwing which is the case where throw yeah where throw like it's more explicit but one thing it wasn't it was a big problem until six months ago was that if you throw a consumes or the gas to the gas limit so what happened in October 14th this was I think day before the Byzantine heart folk like I did it I use it for the same London Meetup and there's about like 10 brave people 7:59 transactions talking with him go failure because that during that time I think there's a obviously called some time bomb or like a frozen pea or something it was extremely slow people frustrated people put the wrong ghastly me wrong gas price thrown yeah it has all over the place so that to the point again that if I sum up it'll hold the transaction people paying about like fifty pounds fifty dollars worth of just for the gas and if you look at this that you can see lots of failed transactions but thanks to the Byzantine how folk it's kind of same error message similar like either so it's either and he there's a gas limit of can see yeah there's a guesstimate of 1 million it was consuming all them but now that it's 1 million but like this one says fail but here you only use consume the gas which being used so and now like a new pattern is like yeah rather than throw there's a new vocab record require I saw a rebar so that kind of stuff is again like now I'd like to take it granted but it's actually only just six months ago we you know the whole experience wasn't completely different right so we've been involved in so much and if we are you doing the test RPC it's not it's not really the issue but when you look at your ISA scanned if you figure out like oh like this is a money I was spending then you know you have to think about what these things another pattern which is still in the archival debate is pull over push pattern anyone familiar with it yeah pretty much yeah so what's the problem yeah so first when I went through the code I said like you register and pay out then people have to withdraw but when I first wrote that we I press a payout as I event organizer he was paying out to everybody so like people only register once which is a good user experience but now people after who who survived this harsh period the Dow yeah who bought that out token yeah yeah so like a that was a fast-talking eyeball and at that time I didn't even have either so I had to borrow from my friend you should never do that you know but yeah that's hard but after that like so one of the the exploit pattern was probably you can't see the code but there's a typical like it because it's patterned that like a so when you someone called a function it can be the fun one someone could be the code itself so cold has a fallback function so you can do that count loop so the best pattern right now is rather than conjure payout to everybody you should go and pull yourself is it's like yeah security like all the smart contract based practice yeah good good but what's the consequence if you actually do it is that so my contra is like you have to withdraw but this graph shows some majority of people about fifty percent of people we straw the money we've seen in one day I said you can take the money and now really like push over like you Twitter because when people register I put the Twitter people ask people to put to that rest because one of the problem and up isn't you can't tell the people so I go in Twitter withdraw withdraw because if there's a background that monies are risked so for me as an organizer I really want you to show but people are lazy so half the people about 10% of the people still don't withdraw even spending one week what happens in one week yeah so no one knows because it no one has read the code and yeah people don't really read the code but if you look into it there's a magical function called clear that every goes over the cooling period default to one seven days if they organize a cow to your money so that's the law i hard-code I even tell the people then I even tell to the people of a Twitter to the one of the most experienced people this guy's four kumaras he's actually the creator of meta mask even he she can't get bothered to take the money so what do i do like i like as an organizer yeah I wrote as a call but I still feel bad so I asked like should I give it to charity or should I just take it I did a polling then I decided yeah okay I'll take it the intention of that time was during Christmas season so maybe I'll take it I will give me charity but even myself get lazy so I didn't do that what happened my account got compromised so one thing is like I think in a smart country people pay more attention you do the Oddie and then I can make sure like you know contrived web proof but people pay less attention that cow is so-so and that usually on the deployment account is almost like you have to treat as a throwaway account so you shouldn't have lots of money but 1/8 like six months ago wasn't that lots of money and there's a lazy person I kept accumulating all the money I didn't steal but like I cleared that's go clear taken so why why that happens that was a problem so what actually happened is in the deployment code in a truffle j/s I was so I until July I was actually I had a note get snowed in my local machine sinking and then deploying but during that time thinking was gone too long and I was using a fast mode or light mode or seven minutes left okay I had to go very quickly but but still not good so I changed to use this kind of remote way to deploy to the inferior but like why by writing the to do is come and haunt you think about more secure way argument pneumonic so I was passing through the mnemonic as a flower flower and where I stored it was in my configuration file I encrypt it so it's got stolen I made the only stupid one well I asked my friends fear what friend and they actually yeah like started pursuing people still do the same setting so this is a kind of common problem we have and the one with the stuff is there's a lot of standard accumulate in something like a consensus mark contrabass crap but something like this is to not throw out because the first people we don't deploy the mania so people don't take that seriously and second because if this is kind of not in a smart contra area it's not shared I think that this is a bug bounty there so I recommend that if you're doing your main net already you should contribute and so last thing is yeah 3 how many minutes five minutes yeah so running your maintenance so lots of thing I had to worry about it's all about gas price gas price but gas price again last year so this column this is a total gas price each user spends and this is a gas price I spend as Adam II including the Contra deployment code and there apparently I put 0.1 Issa that's quite a lot as a organizing one event but I did manage to fix that how did I fix that there's no rocket science it's just matter the fact that if you go to truffle truffle default gas prices hundred gray which is very expensive so I like if you just don't say anything you just throwing money at it so that was a fixed easy but you only realize when you start deploying in the main that second thing it's yeah average gas price each user was paying during this time it was a certain way and they suddenly went to one way so how did it like southern so like you know the in the meta mask you can change the gas price by yourself but most of the time people don't pay attention so people put whatever and I think d4 is 5 or 10 so that's a default price so the people basically don't know about that feature so hence this whyever stuff so the quick fix was in web 3 yes you can put the I think gas price as an option so if you set it you can enforce in the meta mask so I put the one gray because I saw like it now prices after this was after the half folk so yeah now like it's cheap enough like skating issues over I thought then we imagine like you know cryptic it comes to the point I couldn't even deploy the December and so this is user setting so if you find out interested in the coming to on Sunday still set the wrong way but if you do that depending on the timing it gets too cheap so two weeks ago when I did in a Syrian London I just said one way and there's a guy came in said hey I registered last night but my transaction still hasn't arrived here yeah but can I still come so like it's already that you know people is faster than the transaction so I still haven't fixed that issue so if you register please go to a if a gas station and check what's average and the cheapest price and use that otherwise yeah you until the I think once transaction Pandi I can see what data you put which I can see the Twitter account but why spending I hardly see what you know you that's your transaction in two minutes another thing is well one thing I started doing around that June when the price going up I started writing the test script to measure each function how much it's going to cost and also because my my app is meeting up I wanted to know how many people realistically I can deploy so I was I had a scenario that how much it cost if it's two people I host 20 people post 200 people I host and before I had a problem on the linear scaling issue that this payback was taking 4.5 million gasps which was like about at that time I think total gas limit over the one block of I was six million so I already knew back in June my smack on truck couldn't scale more than 300 people and so the fix I did is very very easy I had a where I did a payback I was going through all the participants and I was marking the amount I should give back so that means you are setting the state of the each participants and setting the stake and this is I think it goes to the disk not to the memory so that's the most expensive one of the most expensive gas costs so I just changed to set to the global price and then calculating that alone I think change to scale into the constant gas price so that my contra is infinitely scalable so that's kind of easy stuff again you have to keep measuring it I think that that's a power there's a two minutes per measuring so like I was very happy like I feel like yeah I'm doing the refactoring and I'm solving big problem but be careful be for doing too much because whenever you do that you bring you more bugs so this I got like three or four bugs so far and this was a hard part one because this was a bug like if instead of payback I have a special function cancel if there's a someone I owner says I will cancel the pay back even if you are not registering anyone can withdraw the money as many time as possible so that was harsh but yeah that could kind of things happens to be careful and so now it's a summary in 30 second I think is so lessons learned is kind of solidity things it keeps evolving and so as best practice so and yeah and these some of the things is very obvious like you know don't use a default price on truffle and stuff it's so be until you put in the manor you don't realize and but how do you learn these kind of stuff is this is a so if people I think people had a you know fun time in party so you guys miss probably 80% of my talk this is the point focus you need a lot of concentration how do you learn so people busy are building like in a rocket like you know to the moon but it rocket to the moon fasting is just explore like go like massive right yes I understand your goal is a moon but let's know start from this situation I think what you want to start is this kind of situation that like you know yeah it fells it's kind of painful but it doesn't take your life or no one Sue's you so like let's think about the way even I think it's powerful that smart culture can you know control your money whatever you like but try to think about steak in small way because sosa mom who get the legal talk talking about how all the upset user can sue me hasn't seen me yet even though he lost Juanita is at that time my steak was relatively small so background stuff and they also my this is a specific to my app but to exploit and fully accept a few certain edge cases you have to register you have to come and you have to have a nice party and the wine dining to the point that it's very hard to exploit my code because you already met so like if you have some sort of way of like in a verifying who you are and even though there's a bug there's a chance that they just tell you in a pub rather than exploit and they take the money so in the very beginning I think it's good to have you in a safe sandbox situation and lastly I think some people might have think this is a cheat talk because when you talk about legacy talk probably I talk about upgradability right if you're interesting that I just look into like arrogance report they do that like you know very complex upgrade policy but in my case I just deploying each contra every time this is possible if your country doesn't rely on so much on the past data because in my case yeah it's nice to have the participants information but it's not a big deal if I throw away most important thing is that payment logic happens in that case rather than designing the infinitely scalable design far so I think what I want to establish passes interface once interface is set then you can start doing maintenance stuff but we know the case I think it's very important just deploy a cold even though you might spend a lot of time might be money as a deployment cost and thank you and yeah this is a another important things there's six spots left so come and join me in on Sunday thank you very much I think there's no question timer why should we go to the next one is it question do we have time for question why should we go - yeah any burning question yes - eeny micro sorry you wanna just shout or oh there's a yes scary-looking like I'm gonna shut you down for you um hi so you mentioned just now about deploy - right so I want to know your strategy of upgrading your contracts do you have like proxy contract or how you handle like you how you a bit the your agent or your web app in your death to show you a bit just come right now because I just mentioned now that currently I don't okay and the reason because it's currently I'm focusing more on the sub establish the interface so most of the time I just throw away yes some of the project that would be the problematic once you you know fully like it came out of South beta but - - in the alpha phase I mean alpha phase for almost two years just to experiment with a different way of interface so yeah answer is if you interesting that one like look into arrogance sauce call they have a very complex method okay thank you very much [Applause]