su-squares / ethereum-contract

Su Squares smart contract and bounty program

Su Squares Ethereum Contract

⬛️🔲⬛️ Su Squares are cute squares you own and personalize. This repository holds the Ethereum smart contract which handles the ownership, personalization and sales logic of Su Squares. 🔲⬛️🔲

Development

We recommend using Remix IDE to develop and test the Su Squares Ethereum Contract.

1. git clone https://github.com/su-squares/ethereum-contract.git su-squares-ethereum-contract
2. cd su-squares-ethereum-contract
3. npx remixd -s .
4. Open Remix IDE
5. Click the link icon (:link:) on the top to connect
6. Edit code, and then run tests using the "Testing" tab on the right

You can also run tests locally by running npm test. Read some details on how that works.

Project scope

This repository is open so that you may study the Su Squares Ethereum Contract code and become confident that it works correctly. This project is deployed already and so upgrades are expensive (see deployment section. We always welcome contributions (issues, pull requests) that improve testing of the smart contract. Changes to the smart contract code will be deployed only if they fix a serious problem (see bug bounty section). Other changes may be accepted into a branch, which might sit there for a long time.

Deployment

Our smart contract deployment process is expensive and requires updating or informing every part of the world that touches the contract. We do not intend to do it often. Each release is expected to be the final release. But we will redeploy if it protects our customers from a documented problem.

Read the full deployment process documentation.

Bug bounty

You are somebody that reads documentation on smart contracts and understands how Su Squares works. So you have unique skills and your time is valuable. We will pay you for your contributions to Su Squares in the form of bug reports.

If your project depends on ERC-721 or you want to help improve the assuarance of this project then you can pledge a bounty. This means you will commit to pay researchers that demonstrate a problem. Contact us at [email protected] if interested. Thank you.

Read the full bug bounty program.

License

Copyright 2018 Su & William Entriken. All rights reserved.

We commit to rerelease this project under the MIT license when 10% of the squares have been sold. At that time we will also release our back-end scripts and other code that you might be interested in also under MIT license.

ethereum-contract's Issues

Misleading comment #2

The comment https://github.com/fulldecent/su-squares-bounty/blob/master/contracts/SuVending.sol#L13 states that the price is 1ETH while in reality the price is 0.5ETH.

The fix would be to update the comment to match the SALE_PRICE constant. Also the constant could be written just as

uint256 public constant SALE_PRICE = 0.5 ether;

removing the need for the comment next to it.

Can't get the same interfaceID for ERC721

Sorry - my mistake

Operator Send does not use correct check

https://github.com/su-squares/ethereum-contract/blob/master/contracts/SuNFT.sol#L48

modifier canTransfer(uint256 _tokenId) {
    // assert(msg.sender != address(this))
    address owner = _tokenOwnerWithSubstitutions[_tokenId];
    require(msg.sender == owner ||
      msg.sender == tokenApprovals[_tokenId] ||
      operatorApprovals[msg.sender][msg.sender]);
    _;
}

should be

modifier canTransfer(uint256 _tokenId) {
    // assert(msg.sender != address(this))
    address owner = _tokenOwnerWithSubstitutions[_tokenId];
    require(msg.sender == owner ||
      msg.sender == tokenApprovals[_tokenId] ||
      operatorApprovals[owner][msg.sender]);
    _;
}

Finney conversion rate

In personalizeSquare(), the documentation states that 100 finney = 0.01 ether. This is incorrect and the documentation should be updated to state the correct price of 10 finney = 0.01 ether.

Also, a case could be made that we should adopt preferred Ether and Finney capitalizations as per primary source https://ethereum.github.io/yellowpaper/paper.pdf

Rename tagline

Update tagline "blockchain rentable advertising" to "cute blockchain squares" on Su Squares pages

Be consistent with homepage

The "Entriken algorithm" is illegible

Thank you @MoMannn

Misleading comment

The comment at:
https://github.com/fulldecent/su-squares-bounty/blob/master/contracts/SuNFT.sol#L82
states that the data value is set to [] while it is actually set to "".

_transfer doesn't clear approval

Without clearing approval, I can steal back a token I've transferred to you - call approve(me, id), call transferFrom(me, you, id), then I can still call transferFrom(me, anyone, id).

Awnership

For the love of god, can somebody teach me how to spell?

ethereum-contract/contracts/SuNFT.sol

Line 338 in 7a85dce

/// assert(This contract never assigns awnerhip to address(0) or destroys NFTs)

awnership

Launch new bounty

This bounty just launched again. I'm only making an issue so I can mention some people:

Ping @sz-piotr @owocki @paulbarclay @MoMannn.

We are going to redeploy the contract to make fixes an a result of this bounty, and also the small changes made to ERC-721 to get to final status.

For those of you that earned squares in the last competition, I will copy your squares over to the new deployment. And I hope you will personalize them this time! Gosh, too much white.

Cheers,
Will

Rename repository

Remove word bounty

Update to and cite Truffle new best practices

See https://www.trufflesuite.com/docs/truffle/testing/writing-tests-in-javascript#writing-tests-in-javascript

And https://www.trufflesuite.com/docs/truffle/testing/writing-tests-in-javascript#using-async-await

We should support that format.

Remove Truffle boilerplate

Several boilerplate files were previously necessary to make Truffle run. Now these are obviated.

Reference: trufflesuite/truffle#1382

We can remove them from this project.

Unnecessary `payable` functions

Are these functions payable for a reason I am missing?

function safeTransferFrom(address _from, address _to, uint256 _tokenId, bytes data) external payable;
function safeTransferFrom(address _from, address _to, uint256 _tokenId) external payable;
function transferFrom(address _from, address _to, uint256 _tokenId) external payable;
function approve(address _approved, uint256 _tokenId) external payable;

Hi from Gitcoin

hi from Gitcoin!

mind if we promote this bounty program on the gitcoin slack? looks like i might be a day late to really get invovled.... but would like to try.. we have a few thousand members of our network and they are all hungry for 🐛 squashing oppy's