onlydustxyz / marketplace-starknet

Death Note starknet contracts to manage contribution badges

deathnote-contributions-starknet

Death Note starknet contracts to manage contributors and contributions

⚠️ WARNING! ⚠️

This repo contains highly experimental code. Expect rapid iteration.

🎟️ Description

This repository contains the code for starknet smart contracts:

• contributions: The list of contributions

🎗️ Prerequisites

Install protostar version 0.2.1 or above.

curl -L https://raw.githubusercontent.com/software-mansion/protostar/master/install.sh | bash

📦 Installation

protostar install

👷‍♀️ Build

protostar build

🔬 Usage

🌡️ Testing

protostar test

or use Protostar Test Explorer vscode extension.

🚀 Deploy

First, you need to have an OpenZeppelin-compatible account deployed on the target network. This can be done with Braavos.

Add the account address, public key and private key to the ~/.starknet_accounts/starknet_open_zeppelin_accounts.json file, under an alias of your choice (eg. local_admin or staging_admin).

Then, just execute the deploy script:

./scripts/deploy.sh -a local_admin -p local

This script will look for a build/deployed_contracts.txt file to get what is already deployed.

Once the deployments are done, the build/deployed_contracts.txt file is created/updated accordingly.

If you want to re-deploy something, just remove the corresponding line from build/deployed_contracts.txt and run the script again.

Create a pre-configured dump file for local testing

To perform end-to-end testing in the marketplace-backend, we need to create a starknet-devnet dump file with all the necessary contracts deployed.

1. Build and the starknet-devnet docker image

Note: specify the BASE_TAG to be used depending on your CPU (latest or latest-arm)

cd scripts/docker
DUMP_PATH=$MARKETPLACE_BACKEND_ROOT/scripts/docker/dev BASE_TAG=latest-arm docker-compose up --build -d 

With the --seed 0 option, a list of 10 accounts have been deployed. Those accounts will be used as follow:

Account #0 : Admin
Account #1 : Sign-up backend account
Account #2 : Marketplace backend account
Account #3 : Not used
Account #4 : Not used
Account #5 : Not used
Account #6 : Not used
Account #7 : Not used
Account #8 : Not used
Account #9 : Not used
Account #10: Not used

To see the accounts details, check the docker logs:

docker logs docker_starknet-devnet_1

2. Deploy a 2d-nonce account for each backend:

Follow the instructions on onlydustxyz/starknet-accounts repository and provide the marketplace-backend account public key as input and re-run the same process for the signup account.

Add some ETH in them to be able to send transactions later:

curl -H "Content-Type: application/json" -X POST --data '{"address":"0x061e0474b7cdbfaf15e54e97c2bb632d365ccf553320a7db511c07950250948e", "amount":100000000000000000000}' "http://127.0.0.1:5050/mint"
curl -H "Content-Type: application/json" -X POST --data '{"address":"0x0488cbf60f5d972aeee11bb8bcce7cecb8023f7a7cc5f2c7f6d9f53c8f68ff17", "amount":100000000000000000000}' "http://127.0.0.1:5050/mint"

Check the account balance with the following command:

curl -H "Content-Type: application/json" -X GET "http://127.0.0.1:5050/account_balance?address=0x061e0474b7cdbfaf15e54e97c2bb632d365ccf553320a7db511c07950250948e"
curl -H "Content-Type: application/json" -X GET "http://127.0.0.1:5050/account_balance?address=0x0488cbf60f5d972aeee11bb8bcce7cecb8023f7a7cc5f2c7f6d9f53c8f68ff17"

3. Configure the back-ends to use the 2d nonce accounts

Update the ACCOUNT_ADDRESS environment variable in .env.example file for both repositories.

Update the .env.local file in marketplace-starknet repository.

4. Deploy the smart contracts

First, remove the local cache file:

[ -f build/deployed_contracts_local.txt ] && rm build/deployed_contracts_local.txt

Then, follow the instructions in Deploy section

Once contracts are deployed, update the .env.example file of both repositories with the correct smart contracts addresses.

5. Request the dump file

curl -X POST http://localhost:5050/dump -d '{ "path": "/tmp/dump.pkl" }' -H "Content-Type: application/json"

and wait for the dump file to be complete:

watch du $MARKETPLACE_BACKEND_ROOT/scripts/docker/dev/dump.pkl

🎉 Congratulations, the dump file is ready!

6. Stop starknet-devnet process

docker-compose down

🏗 Contributing

Pull requests are welcome, please check our contribution guidelines.

📄 License

deathnote-contributions-starknet is released under the MIT.

PROD

MEP1

• supprimer le CONTRIBUTION_CLASS_HASH du fichier deployed_contracts_prod.txt
• verifier que contributions.cairo importe bien les nouvelles fonctions de migration
• verifier qu'il n'y a PAS de script de migration (contributions_migration.cairo)
• executer le script de deploiement afin de MAJ l'implem du proxy de contributions

MEP2

• tester une migration qui revert

marketplace-starknet's Issues

move access control of badge registry to role-based method

In case the back-end private key gets compromised, we need to be able to change it without re-deploying the contract
Moving to a role based access control will ensure that.

add contribution from github handle

To avoid having to perform multiple calls from the back-end, we should add the possibility to publish a github contribution from the github handle.
This implies a link to be implemented between the contribution smart contract and the registry.

add metadata ownership in NFT contract

We want to move to a permission-less model for the metadata management in the NFT.
This way, anyone will be able to add a new metadata key and register its own metadata contract.
Only the admin of the metadata contract should be able to update it.
Ownership transfer should be supported as well.

prevent double mint in badge

In case the registry is upgraded to another contract
we won't be able to save the mapping between addresses and token_id minted
if we want to re-mint a badge from a given user, the same token id previously minted should be returned

as a feeder I can mark a contribution as completed

upon contribution completion:
- update the status of the contribution
- increase the number of past contributions of the contributor

Add a function to remove a contribution

Contributions can only be added, they should be removable.

Add a function to remove a contribution, only accessible to the feeder role.

There should be tests on the developed code.

check contribution gate upon contributor assignement

as anyone I can list all contributions assigned to a given contributor ID

Add a function to change a contribution's validator address

Context

Validator address is configured on a contribution to provide them specific rights, such as updating the contribution gate or validating the contribution.
Though it might not be the good one configured right from the start, and there is currently no way to update it after the contribution is created.

Acceptance criteria

• A new public function is exposed on the contract
• This function is only callable by the feeder role, or the currently set validator address
• When called with an address, this address becomes the new validator address
• A unit test is present on all the possible cases
• The end-to-end tests are updated with a validator address change

as feeder I can unassign a contribution from a contributor

as anyone I can list all contributions a given contributor ID is eligible to

add events when a new token is minted

badge should delegate the metadata management to the metadata contract

We can have several kinds of metadata:
- Github contributions
- Starklings challenges
- any other kind...

Each kind of metadata can have its own implementation, can be upgraded

The badge contract should hold its metadata implementers and delegate the metadata calls to the correct one

create dedicated types for ids

to make the code type-safe, we should consider creating dedicated types for ids:

• contribution_id
• contributor_id

We can use a rust-like new type pattern:

struct ContributionId:
   member inner : felt
end

add events when a new handle is registered

create a full end-to-end test

deploying all contracts, we should be able to perform a full end-to-end test to validate interactions between the contracts:

• the badge registry
• the badge
• the metadata contract

add reverse mapping from github handle in badge registry

Allow the following scenarii:

• a user can unregister its github handle from its account
• reject a github registration if already registered
• retrieve user information from github handle

Expose past contribution count

check contributor profile validity upon contribution assignment

Before assigning a contributor to a contribution, we should check the validity of the contributor ID by querying the profile contract

Develop a profile badge as NFT to track contributions

The badge is an NFT based on ERC-721 standard
The badge is not transferable
The purpose is to track contributions and challenges won from a given address
The badge can be linked to many different metadata, each having its own implementation as a dedicated smart contract
The badge will act as a proxy for those metadata

deploy smart contracts on goerli

In order to test the integration with the developped back-ends, we need to deploy the smart contracts on goreli testnet
Do not forget to tag the repository when contracts are deployed !

Implement a simplist metadata contract to store Github PR

Store a mapping between a badge id and contribution data
Contribution data is a list of PR
Each PR has a repository owner, repository name, Pull Request ID and a status

as anyone I can list all contributions in OPEN status

Prevent adding same lead contributor twice

Right now the lead contributor role assignment is done following an upsert logic: the storage is written and the event is emitted regardless of the account already having this role.

Instead, we would like it to fail for redundant repeated role assignments.

Add a function to modify a contribution contribution_count_required

Contribution'scontribution_count_required is currently set in the new_contribution method, and cannot be changed afterwards.
We need a function to modify it.

The function should only be accessible to the feeder role (like in https://github.com/onlydustxyz/marketplace-smart-contracts/blob/main/contracts/onlydust/deathnote/core/contributions/library.cairo#L114) or to the validator address (like in https://github.com/onlydustxyz/marketplace-smart-contracts/blob/main/contracts/onlydust/deathnote/core/contributions/library.cairo#L261).

There should also be tests to cover the developed feature.

change access control of contribution contract to role-based method

In case the back-end private key is compromised, we will need to transfer the feeder role to a new key.
This cannot be done with the current implementation using the Ownable pattern.
We need to move to a role-based model:

• ADMIN role to manage roles
• FEEDER role for the back-end

Create a registry to map SCM tool handles to an account and a badge ID

• the badge registry can get or mint a badge from a wallet address and return the token id
• the badge registry will hold the mapping between SCM handles and the address/token id

as a feeder I want to create a gated contribution

modify the Contribution type to include the gate

as feeder I can assign a contribution to a contributor

No particular check on the contributor to be implemented, the gating part will be covered by dedicated issues