Zeppelin Team ~ Stairway to Zeppelin: Whole Lotta Toolkit for kickstarting your dApp

[Music] all right so my name is Denison Bertram I'm developer advocate at Zeppelin you know as we build open-source tools to help developers build secure applications we also audit smart contracts we do a lot of auditing services and we recently have released a new product called Zep kit which is all-in-one tool to help you really jumpstart your adapt development so I'm gonna pass it over to Fran who's gonna start to tell you more hi guys I was told to project my voice I'm not sure how that's gonna go so I'm gonna I'm friend I'm one of the maintainer zuv open Zeppelin so today I'm gonna tell you a little bit about what it is and how we think of it yes so I'm gonna tell you about what it is and open Zeppelin is anything to do with either an important aspect of the project is the focus that we put on security which has been there since the inception of of the project actually and in fact the reason open Zeppelin was born was that at the time there was no one standard for good code quality in solidity and good practices so open Zeppelin was born to sort of be that central place where we can see good code use it as well and see some good practices what do I mean by security so the way that we ensure security of the library is through thorough code review of every pull request that comes in this can be sometimes annoying if you try to contribute but it's how we keep up the quality of the project lots of tests and in fact we reach 100% coverage recently and also on an ability an audit so as we write the code as we review pull request focus on code being easily audible this has a lot to do with the modularity of it and we do audits both internal by the research and audits team at Zeppelin and external like we did back in November for version 2.0 weight level case so related to this also we rely on an informal review by the community so open Zeppelin is a popular project and these are some numbers for that popularity and this means that we get a constant stream of people coming to the repository using the tools and looking at the code and sending a pull requests for improvements and I think this really helps to keep up the quality also related to security this is more new that we were experimenting with on the design side where I need to build simple api's that are hard to misuse and to encapsulate state to completely this hell out invalid or incorrect things so on to what you can do with open Zeppelin other than audit it there it says ERC's we have some implementations of ERC's the typical one is ERC 20 and what you'll find is that we have this ie RC 20 interface this declares the the standard interface is defined in the document that year C 20 contracts have to adhere to then we have the implementation of this interface and the optional extension in this case and we also have some extensions of things that we think are useful in general like minting ERC 20 tokens on demand and this is a pattern that you're gonna see throughout open Zeppelin so you should pay attention to it for example the 720 one year seat which is non fungible tokens also has the same interfaces in this case there are many because there are some optional extension extensions then you have the implementations and more custom extensions that we wrote what you need to know about this is that you can combine these things through multiple inheritance in solidity and in many cases you're expected to do is so in the case of ERC 720 once in this here I combined the core implementation with the metadata extension and the mint ability extension I need to drink some water and yeah this is how you're expected to use open Zeppelin we also have your C 165 for example which defines a way to query if the contract answers to a certain interface like your C 721 and in this case we also have the interface and the implementation but also an utility in this case which is the way that you can like the other side of years.you 165 which is how you can query that's something supports it and this is a little bit tricky it's not as easy as it should be but so we we implement it for you to use it other than these contracts we also have some components that you can put in your own contracts for whatever you're doing for example a pool payment in the case that you want to send ether to an address without executing the code that is in it for example to be more strict about your gas usage or for security concerns you can use pool payment and the way pool it works is it gives you this internal function which is an async transfer which just puts this money the ether like in a secure place where then anyone actually can go and trigger the actual ether transfer like this here and this is an external call you also have for example ECDSA elliptic curve digital signatures which is the native cryptographic algorithm in the EVM the solidity interface is a bit cumbersome so we wrapped it up in this ECDSA contract - sorry you're covering the screen thank you to make it simpler to use and also this is a blank slide to make me remember say this I think open Zeppelin is a mature project it's tax and we had we ran into many problems in the ecosystem so we've had to solve for example setting up coverage setting up a full-blown test suite and like making that work so I think it's a really good place where you can go look for inspiration for your own projects copy ideas maybe copy some scripts that we have in there I think that's useful we have some new stuff we have a new discourse forum where we want to discuss anything to do with open Zeppelin and also help you answer help you solve any problems that you run into and this isn't ready yet but it's coming soon and I'm very excited about it we're improving the documentation we do have a dark side right now but it's not the best we know that and we're building some tools to to build like really useful documentation specifically tailored for smart contracts so be on the lookout for that I think it's going to be great um so do you think we're missing an important er C or feature come talk to me I'll be happy to hear that there are tons of er CS and it's really hard to keep track of them so you're voicing that you think it's important is important for us and did you come up something cool during the hackathon also let us know we're looking for new things to put in the library and if you think you build something that fits in there come tell me we can talk about it so now Santiago is gonna tell you more about the plan OS [Music] thank you okay can you guys hear me okay yes okay awesome sorry for the audio issues okay so first of all what's Zeppelin us basically Fran has just told you about open Zeppelin which is a set of building blocks for building your own smart contracts Zeppelin OS is a toolset for actually managing those smart contracts it will allow you to deploy them manage them and also upgrade them so how do we ship Zeppelin us subunits is basically its main interface is a CLI that will provide the NPM it's as easy as running npm install z/os so sorry and they want you to mention also that WS basically runs on top of truffle well three is aa little compiler your typical stack and it adds a few more features such as mainly upgrade ability so what's up readability the idea is that we are Zeppelin OS you can modify the code of your contracts after you have deployed them while maintaining their state their address their balance basically and just keep but you can actually modify the code after they have been developed this allows you to fix bugs after you have gone into production it allows you to have an iterative development style where you don't need to nail it on the first run you can just add new features as you go and you can even use it to the world faster you can use the Apple innovation or development environment and just add new features as you go without needing to recreate the state from scratch because Zeppelin us is going to take care of preserving that so how doesn't work let's say we have that wallet contract it's going to be a very simple one it's just going to track whoever it's unknown its owner just an address and here is the only difference that you need to take into account when developing in Zebulon us when you write contracts when you sorry when you write upgradeable contracts you cannot use constructors in solidity you have to replace them by an initializer function which is going to have exactly the same behavior this is due to an implementation detail we're working on automating this but for now just keep in mind that if you are writing up readable contracts you need to replace constructors by just an initialize function that's more going to return to that minutes so how is this going to work basically using the CLI for example in OS it just tells a pretty nice to start tracking your contract similar to a git add then you push your code on to a particular network whether it's rinkeby main net or even a local ganache and then you can start creating new upgradable instances of your smart contracts so it just runs the polymers create for instance my wallet which is the contract we have just wrote we just wrote and we specify whichever arguments we want such as the owner address opportunities and the pallino s is going to create an app readable instance unto us which other is it sitting ok so far so good let's say we start interacting with this contract we have added funds to it we can query its owner for what it's worth but we don't have a way to actually withdraw those contracts so as you can see these have actually a very simple example but it helps to illustrate the thing so we can then add a new function to our contract and just turns upon us to upgrade that new instance we just pushed a new code on chain and the suppleness to update all instances of the wallet contract that we have just deployed something very important to mark here is that the others is going to be the same ok so even though you can you have changed the code the other is that you're interacting with or your client an exchange or whatever it is it's always going to be the same address the imbalance is going to be the same the owner of the contract is going to be the same you just get new code up and running okay so you're preserving the same address for interacting with your contracts you just have deployed new code over there so how does this work we are used to knowing that all smart contracts after deploy a mutable missing basically we rely on a pattern on a prop delegate proxy pattern so what happens is that under the hood Dublin us is not deploying just your wallet contract it's actually deploying two contracts its first going to deploy whatever code you have written we call that the logic contract and we just use it for the code it doesn't call any state at all all the states and actually the address that your clients interact with is going to be the proxy contract the proxy is very very small contract that the only thing it does it just delegates all calls to the logic contract delayed call is actually an opcode at the EVM level it basically says okay execute the code on this contract in the context of this particular contact a contract and by context I mean using the storage of this guy so all the fuel imbalance whole state is going to be kept here well the code is going to be executed from the logic contract so in this case when you when we have the my wallet contract what's going to happen is every time you call for instance a draw function that we have written it's going to be delegated code that you have written but it's actually going to withdraw the bands from the proxy contract itself this makes upgrading very easy because the only thing we do is we just deployed a new contract with a new code and we just tell the proxy okay let's just start delegating all call all calls to the new contract what is going to achieve is that all the state here is going to be exactly the same the others is going to be the same but the code executed is actually different okay so moving on a little bit more another of the offerings that we provide with Zeppelin US ICBM packages sorry can we make it at the engine amid work out sciences we start really light at the end we'll be taking questions as if not we have a booth downstairs just come looking for us and we can talk there Thanks so I want you to talk a bit about Vivian packages so let's go to the same diagram we had a minute ago say we have an E or C 20 contract now instead of a wall it's a bit more interesting if I actually want to deploy my upgradable year C 20 contract I deploy the code and they create a proxy in front of it so all my clients are going to interact to call let's say transfer on the proxy contract I will get delegated to the logic one but let's say I want to deploy more than one token okay I want to have two or three different tokens in my system I don't need to deploy the gloaty contract that many times because I only need to deploy one proxy for each of them because I want to have one state for each of them but the code is going to be exactly the same and naturally all these proxies can belong to different projects altogether so there can be just a sick Clement deployed on the network and we can have different teams all spinning up their own upgradable year see 20 tokens relying on the same code and they can trust this code because this code is immutable it's basically a smart contract that has been deployed on the network and cannot be changed so anyone can create a proxy and point to this contract knowing that that code is not going to change and something that's even more interesting is that the developer the guy who actually deployed the ERC 20 code on chain can be even a different team than each of these so we can have a team that specialized in writing your C 20 contract and other teams that just leverage that by spinning up proxies to that so what we call is and of course it's out of the screen this is actually an EVM package so the standard of living of an EVM package is basically a logic contractor a set of logic contracts with a related functionality that's deployed on chain so other teams can actually use it for spinning up new upgradable instances so we have one team that develops devian package it deploys it and everyone else just reduces the code that it's already deployed on chain operates them become very see if let's say there is a bug fix an optimization on year C 20 the people behind the VM package just deploy a new version and then all the users can just opt-in to move on to the new one they can basically upgrade their proxies and point to the new implementation again all these updates are obtained for the clients so sorry what I want you to mean is that this VM package for ERC 20 already exists and it's actually open Zeppelin as Fran was mentioning open Zeppelin provides implementations of different ERC's in particular IRC 20 so we have open Zeppelin ETH with which is actually fork of open Zeppelin solidity and it provides a few contracts that are already pre deployed and maintenance Kovan rinkeby and Rob stone so you can new proxies for any of these and start hacking right away without needing to redeploy the code yourselves these are the actual address who are these contracts are deployed on maintenance so opens wth also provides initializer versions of all the country it's actually winning folder so they're easy to look for so providing virtual shall i sir so that you can use them in a upgradeable context okay using we have 10 minutes thank you opens up on eth instead of the vanilla oven supplying solidity so you so that you can use a brick how do you actually use CPM packages from your project it's actually very very simple you just have to tell us 20 BM package behind the hood this is such formation regarding opens WTH right now we are piggybacking on NPM for distributing we plan on having a separate package manager and once you have linked to opens up on ETH or whatever package manager it is you can just instruct Zeppelin us to create an instance of a pack any contract so creating an upgradable year c20 with ws is as simple as linking to the package and creating one specify the name of two of your token initial beneficiary initial amount and whatever it is and the pallino s is going to spin up a new opera double e rc 20 for you so to wrap up a bit on a vm packages the you've pretty deployed already unchain so that your clients can actually your users let's say can save Gus calls that's all that everyone can reuse they're like I have played the compiler with a different one and they should be compatible but they aren't you know that actually everyone is using the same code behind the scenes so it really helps when sharing a common standard it's also very easy for users to upgrade to a new version it's just a matter of inserting example in us to upgrade to a new one as we saw in a minute before and basically that's the idea to basically be able to ship to your users that's already deployed on chain so it doesn't need to go be a whole tool chain is to be recompiled and to be redeployed potentially incurring any mistakes or security issues in that process creating an even package is also straightforward you also tell zeppelin us to start tracking one of your contract you push it to a particular network pushes are actually behind the scenes going to upload the logic contract itself and then you just publish since we are working together with the npn still you also have to publish that as an NPM package this last step is not going to be needed and soon also we have a registry coming up we are listing here the most notable IBM packages developed right now we have well of course open supply nth and implantation for TPL we have a doubly-linked at least implanted by like peer a TC are talking creative registry builder by the team of level k and we have also no C safe upcoming and packages from chaining and attics if you have developed your own event package please reach out to us and we'll make sure to get you listed here so far it's a manual process will start as soon as the community growth will start opening it up so so far we have seen open Zeppelin for developing smart contracts basically as building blocks for your own contracts Zeppelin us for managing them and breaking them and so on to the last product that we wanted to showcase today Sep kick that's actually for managing a holdup I'm going to pass over to Dennison for this go yeah so we're announcing Zep get we announce it actually yesterday we had a workshop around it and zapka is a tool for you to basically jumpstart your development so it basically includes Zeppelin OS we have a react app we have a token for and few are ready to go we have a number of we have the open Zeppelin ETH EVM package already included in there it's basically a way for you to really supercharge your adapt development and to support this oh yeah here exactly this opens up so for to support this here at the hackathon because we're really interested in the community and really wanting to help you guys with what you're doing is we are having two bounties we're giving away $1000 for the best EVM package so you saw before the registry that we have we're looking to add EVM packages to this so we're really trying to incentivize you to create cool things on it the other one other bounty that we have is a thousand dollars for the best usage of Zeppelin tools so that could be something from Zeppelin ass that could be opens Apple neck something on top of the Zap kit itself to make it extensible or more cool so you can go and join our forum as well if you want to have any questions or reach out to us or start a discussion we have a lot of people we're always in the form as well answering questions so it's a great place to get support and we are hiring we regress prior if you are thinking that maybe you'd like to join our team we're an awesome team you should come by our booth we have a forum to sign up where you can put any information and we can get that process started so thank you [Applause] yeah the question was whether we have sort of set around up Charlie publish it we are basically copying all the information T sorry what about the logic on chain we have registry contracts that are automatically generated by Z what's going when you link to the new version of the VM package you specify which version you want to link to using cember exactly any other questions Oh got it you should only be appending at the end you should not be finding it's going to the previous instantiation accidentally let's say change the type of a variable it's going to prevent you from deploying to make sure you don't break anything any other questions benchmarking gas related human should question friend when I have to compare a gas loaded on remick's and eat to thing you look at the details for a contract it shows you like the estimate for each function but that's not enough because it can vary throughout executions so acute it and also thinking through to know that you're getting the worst case but I agree and recently an open had this idea to build something for that us but is interested in building it I think it's a great any other questions okay