feat: add merkle distributor contract

[amateima]

This PRs adds the contract source code and tests for the Merkle Distributor contract. It is based on the already audited contract from the UMA protocol repository

[mrice32]

Looks great! Just two high level questions -- trying to understand how much of this is copied code vs freshly written.

[mrice32]

When you say "based on" do you mean directly copied? Or are there changes? If there are changes, we will likely need to have this re-audited.

[amateima]

The contract itself is identical

[mrice32]

Same question here: is this copied code or should we review it? If copied, were there any specific changes we should look at?

[amateima]

The tests structure is the same, only minor things were changed: replace web3 usage with ethers and update the assertion syntax (use expect instead of assert in order to have a similar syntax with the rest of the tests)

[socket-security]

Socket Security Report

Dependency issues detected. If you merge this pull request, you will not be alerted to the instances of these issues again.

📜 New install scripts detected

A dependency change in this PR is introducing new install scripts to your install step.

Package	Script field	Location
ursa-optional@0.10.2 (added)	binding.gyp	package.json via @uma/merkle-distributor@1.3.27, ipfs-http-client@49.0.4, ipfs-core-types@0.3.1, peer-id@0.14.8, libp2p-crypto@0.19.7
protobufjs@6.11.3 (added)	postinstall	package.json via @uma/common@2.20.0, @google-cloud/kms@2.11.0, google-gax@2.30.0, @grpc/proto-loader@0.6.9
ursa-optional@0.10.2 (added)	install	package.json via @uma/merkle-distributor@1.3.27, ipfs-http-client@49.0.4, ipfs-core-types@0.3.1, peer-id@0.14.8, libp2p-crypto@0.19.7
iso-constants@0.1.2 (added)	install	package.json via @uma/merkle-distributor@1.3.27, ipfs-http-client@49.0.4, it-tar@1.2.2

🫣 Native code

Contains native code which could be a vector to obscure malicious code, and generally decrease the likelihood of reproducible or reliable installs.

Package	Location
ursa-optional@0.10.2 (added)	package.json via @uma/merkle-distributor@1.3.27, ipfs-http-client@49.0.4, ipfs-core-types@0.3.1, peer-id@0.14.8, libp2p-crypto@0.19.7

Socket.dev scan summary

Issue	Status
Did you mean?	✅ no new possible package typos
Install scripts	⚠️ 4 new install scripts detected
Telemetry	✅ no new telemetry
Troll package	✅ no new troll packages
Malware	✅ no new malware
Native code	⚠️ 1 new native module detected

Powered by socket.dev