Auditing ink! with OpenZeppelin

Transcript

[Music] test. Okay, thank you. Perfect. Sorry for the little delay. Always it's always my main issue in development and I'm very happy to be here. Thanks Amira for this wonderful presentation and but don't worry we are going to take some mathematic break and just jump into uh the rest development.

Um so it was very important despite I'm not working anymore for the ink team um to talk about this wonderful smart contract language called INC and the most interesting thing I've been part of was this audit with open zeppelin. So just after the polka dot blockchain acade academy um I've been able to join a parity team and especially as a core developer in the in team um and um just after thanks to this Russ knowledge I was able also to uh go to develop into the cryptographic team of INU. So into

is the main company that was that Amira was presenting and actually working for example on the threshold bes integration in our protocol. Um so the main point between both experience was in fact so RS development and it was I can jump from the smart contract core development to the rest cryptography because during the polar dot blockchain academy we have such uh range of knowledge we gained from the five weeks on site that you are able after to just go from different blockchain uh deep subjects.

So you can wonder why exactly why rest can be a good language for smart contracts. Um yes because um rest uh developer daily life is quite complicated. You have always to learn your language and there is always solidity but why should you uh use rest instead of solidity or just be a complement smart contract language. So Rust is memory safe. Uh also when you compile to was it's quite fast. Um and you can build just high level function on top of uh on top of with Rust and

just don't damage the runtime. So you have also for of course a minimum runtime. And what is amazing to use Rust in blockchain is that you will gain all from the rest ecosystem. You don't have to create new tools. You can just use um already command line tools and especially also you can as it is compiled to web assembly you will be able to also have this use support for the web assembly ecosystem. Uh but what is exactly the ink I'm talking about. So ink is just basically rust. So it's programming language based on the rest and the ink team has been

working on integrating all the smart contract functionality um to be able just to produce smart contract in a very fast way. So it will be compiled um to web assembly. Just a very short overview of ink is integrated uh in the pola dot ecosystem as I I can spend maybe I don't know one hour to talk about this integration but I will try to do it just in one minute. So smart contract in the pola dot and parity stack it's just in top of the par chain uh and you need to understand that if you want uh to integrate to deploy

your smart contract you need to have a par chain that have already a specific pallet contract type that is called pallet contracts. So a specific pallet type that is called pallet contract for so I think at the moment there are something like six or seven uh I will say power chain that have launched this pallet contract in their power chain um so in production there is a lfz zero fala and it's only a small this only one I can quote but there are more so also something that is uh you need to understand at the moment I'm talking about ink but for the pallet contract if

you can just create a new language if it is possible to compile to web assembly it will be very very easy to integrate into the pallet contract. So basically what does ink look like? So you will see either if you are rest developer or smart contracts it will easily remain remember you something that you already know. So just inside a contract you have of course your storage where you will define all the value you want to use. Don't abuse about it. Don't put everything. It's not a database. And um you will have your constructor to

initialize your smart contracts where you will initialize all the value of your storage. You have of course immutable function when you just need to read some function from your storage. And you have mutable function where you can of course change the value of the storage. just you can just see that we always really really just use rust. So this is a global overview of what's a very very simple flipper example smart contract look like and you can find also the event type.

So a short overview of a comparison between solidity. The thing you need to just see is on one side there's ink and globally it just for um it just lies on the fact that is just rust and wasp. The only maybe um uh I will say the thing that is a bit a conraint at the moment is the storage uh entry that is variable and goes only to int 128 step so 256 for solidity.

Um but we are in the audit we are in the security track. So you are not expecting just to have a global overview of smart contract a very simple smart contracts and let's jump into the audit with inc with open zeppelin. So this is a audit that has just happened at the beginning of the of the year. So it has begun from the uh from January 2023 and let's give some context about this audit. So it was an engagement funded by the polar dot treasury and supported by all the polar dot ecosystem.

So of course it's an audit. So the idea is to make it safer. So incontract language but also the command line tool that is called cargo contract. But if you are working with open zeppelin, you have to know they are not the cheapest company and you want to gain also from all the v all the developer and exit experts already from solidity they have gained along the years. So the idea is really also to uh catch up to catch all the insights they get from the solidity world to implemented this into ink.

So in fact during this audit there were three free phase and um the first phase of this audit is just of course the review. So it's of course a preface where you are just uh helping them to understand your your tool and then the second the first phase is when you is when of course they audit and they give this outcome and then you work again. So this outcome was first in first place. So we have 11 issue. You can see no one is critical. Of course the seity classification has been reviewed by the parity security expert

that is in this room and sorry Vanson if you are here you can confirm and he has uh just review all the this seity classification. So you can see there is just two high sec severities issue and I will of course not detail all the one just this first very high security issue. So I haven't told you anything of course about ink and something that is present in ink language is the selector. So selector is a way of identifying a message and a constructor. So it's help it's help to

just call them and in fact there is this it's a features that allows for developer to really um modify to hardcore this selector for a given function and um in combination with fallback function and proxy it can reach that you call the unintended message. So it was it was not an easy um it was not an easy issue to solve. I think you can ask all the ink team if some are present in the t in the room and um so they just they decided um they decided um so to just limit uh this selector to call only a

fix message. And so this is this issue is solved. And the second issue the second high severity issue is in fact a way how uh ink storage was implemented. So by default all the different uh fields are struck in a single storage cell and especially when you do your upgradation upgradability you can um in fact um you can over it the way the the storage is upgradable uh can lead to undefined behavior. So at the moment it's still open because the ink team is still

working on refactoring all the storage um storage um composition of the language. So as I've said it was not just a safety uh audit it was also hard to gain from all this solidity experience and push this a better developer experience. So they They give some advice of course to communicate with more existing tool security auditing tools and also to give more information more updates also something from solidity advice is to have imitable lag variables

and for this more recent uh command line tool that is cargo contracts to extend more fixtures especially for the upgradability and to get more information for your contract you are deploying. Um there was also a feedback for the education. So I think you all know etern. And so the advice is really to have a comparison between solidity and ink smart contract to see how to not uh to not do of course all the all the bug and severity issues that can happen by writing your smart contracts. Um

something that is also very important especially as it is rust is to really really push uh to have tutorial funny tutorial especially as you see that ink illustration is amazing. So it will be very a benefit u to have this kind of cryptozombie tutorial. Um so what was um the outcome of this audit? So four out of 11 issue have been resolved other are still in progress at last decodited. So the collaboration between open zeppelin and parity was uh extended and it will be about um

parachin runtime templates that will be created um with offline zeppelin and also you can apply there was there is a incubator and you can apply for the audit tract. If you want to know a bit more about INC, of course you can just go to use.inc and you can apply for the audit tract and in two days there will be an amazing presentation by Gman at paris.com. Um and you will be able to learn how it is possible or it's kind of experimentation.

You will be able to you to see how it is possible to use your own le with ink. So that's all for me. Thank you. [Music] [Music] Hey.

[Music]