openst / organization-contracts Goto Github PK

Contract interacts creation in type-script has a lot of boilerplate code and its time consuming to maintain it manually. It will be helpful to consume APIs with proper typed parameters.

• Use @0xproject/abi-gen to generate contract interacts
  (If you have a suggestion for the libraries that can be used, please suggest)
• Add NPM command to run the script e.g: npm run generate

npm audit reveals we have 6 vulnerabilities (1 low, 1 moderate, 4 high).

Fix as many vulnerabilities as possible.

• Include ABI and BIN JSON files.
• Include autogenerated Contract interacts.
• Make sure that the publish command always generates the contract interacts for the latest contract.

Use package's prepack. Generally see the relevant developer guidelines section.

eg. in setAdmin, but do so everywhere

ST-06-002 Doc: Mismatch Between Comment and Code in Organization (Info)

The docstring of the setAdmin function in the Organization contract does not match the actual implementation. As can be seen below, the function is described to be callable by the owner and admin, but only if the current admin calls the function, adminship shall be transferred immediately. However the code makes no such distinction. Further the description also indicates that it is discouraged to set the admin to the same address of the owner, but the contract makes no effort to prevent that.

Affected File:
/openst-contracts/contracts/organization/Organization.sol

Affected Code:

/**
 * @notice Sets the admin address. Can only be called by owner or current
 *         admin. If called by the current admin, adminship is transferred
 *         to the given address immediately.
 *         It is discouraged to set the admin address to be the same as the
 *         address of the owner. The point of the admin is to act on behalf
 *         of the organization without requiring the possibly very safely
 *         stored owner key(s).
 *         Admin can be set to `address(0)` if no admin is desired.
 *
 * @param _admin Admin address to be set.
 *
 * @return success_ True on successful execution.
 */
function setAdmin(
    address _admin
)
    external
    onlyOwnerOrAdmin
    returns (bool success_)
{
    /*
     * If the address does not change, the call is considered a success,
     * but we don't need to emit an event as it did not actually change.
     */
    if (admin != _admin) {
        emit AdminAddressChanged(_admin, admin);
        admin = _admin;
    }

    success_ = true;
}

#12 Generates the interacts using typechain package. This interact doesn't have deploy method.

Generated interacts are extended from web3.eth.Contracts class which has deploy method. Theoretically, deploy should be available to the interact.

1. This ticket is about finding if the deploy method can be used to deploy interacts by using web3 types and implementing it.

2. If the deploy method can't be used, research how other projects are deploying contracts using type chain. Select and implement the best approach.

If nothing works, then write a simple utility to deploy contracts.

References:
https://www.npmjs.com/package/@types/web3
https://www.npmjs.com/package/web3-typescript-typings

blocked by #3

Organization.sol imports/uses SafeMath.sol, but no SafeMath functions are called.

Since SafeMath functionality is not used, it should be removed from Organization.sol and the repository:

• remove SafeMath.sol from /contracts/lib
• remove TestSafeMath.sol from /contracts/test/lib
• remove import/using SafeMath from Organization.sol
• remove safe_math.js from /test/lib

Check if the following contracts are identical in all repository.

• Organization.sol
• Organized.sol
• OrganizationInterface.sol

If it is not identical then

• Find the differences.
• Discuss with the team.
• After discussion create the followup tickets