Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ScoutCoinFabrik: Milestone 2 #1666

Merged
merged 4 commits into from
May 10, 2023
Merged

ScoutCoinFabrik: Milestone 2 #1666

merged 4 commits into from
May 10, 2023

Conversation

valeriacaracciolo
Copy link
Contributor

Project Abstract

This is the second milestone of the project ScoutCoinFabrik. The pull request associated to the the first milestone is the following:
#1490

Scout is an extensible open-source tool (or set of tools) to assist Rust Polkadot / Kusama smart contract developers to detect common security issues and deviations from best practices. The objective of this second milestone is the delivery of a prototype tool after the realization of a proof of concept in milestone 1. The repository associated to this project can be found in the following link:
https://github.com/CoinFabrik/web3-grant

Grant level

  • Level 1: Up to $10,000, 2 approvals
  • Level 2: Up to $30,000, 3 approvals
  • Level 3: Unlimited, 5 approvals (for >$100k: Web3 Foundation Council approval)

Application Checklist

  • The application template has been copied and aptly renamed (project_name.md).
  • I have read the application guidelines.
  • Payment details have been provided (bank details via email or BTC, Ethereum (USDC/DAI) or Polkadot/Kusama (USDT) address in the application).
  • The software delivered for this grant will be released under an open-source license specified in the application.
  • The initial PR contains only one commit (squash and force-push if needed).
  • The grant will only be announced once the first milestone has been accepted (see the announcement guidelines).
  • I prefer the discussion of this application to take place in a private Element/Matrix channel. My username is: @_______:matrix.org (change the homeserver if you use a different one)

@semuelle
Copy link
Member

semuelle commented Apr 11, 2023 •
edited

Thank you for the application, @valeriacaracciolo. We will look into it as soon as possible.

@keeganquigley
Copy link
Contributor

keeganquigley commented Apr 13, 2023 •
edited

Thanks for the follow-up application @valeriacaracciolo, happy to see it. A couple of initial comments:

  • Since this is a new grant, it would technically be a single milestone, so you can go ahead and change the label to "Milestone 1" instead of "2" to avoid confusion when it comes time to submit it.
  • Are you able to expand a bit (in the application) on what the prototype would look like? Would this just be a tool written in Rust? The more technical details you can provide, the better.
  • What kind of functionality will the CLI have?
  • Can you elaborate on what functionalities the VSCode extension would provide as well? (e.g. code completion, diagnostic errors, hover content, etc.) Would it be compatible with other ink! extensions such as this one for semantic analysis?

@keeganquigley keeganquigley self-assigned this Apr 13, 2023
@keeganquigley keeganquigley added the changes requested The team needs to clarify a few things first. label Apr 13, 2023
@valeriacaracciolo
Copy link
Contributor Author

valeriacaracciolo commented Apr 17, 2023 via email

@keeganquigley
Copy link
Contributor

Thanks for the answers @valeriacaracciolo I will go ahead and mark the application as ready for review so other committee members can comment. Feel free to ping me once the application has been updated.

@keeganquigley keeganquigley added ready for review The project is ready to be reviewed by the committee members. and removed changes requested The team needs to clarify a few things first. labels Apr 17, 2023
keeganquigley
keeganquigley approved these changes Apr 19, 2023
View reviewed changes
Copy link
Contributor

@keeganquigley keeganquigley left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making the changes @valeriacaracciolo I'd be happy to support it.

@github-actions github-actions bot added the stale label May 3, 2023
Noc2
Noc2 approved these changes May 8, 2023
View reviewed changes
Copy link
Collaborator

@Noc2 Noc2 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm happy to go ahead with it as well.

@Noc2 Noc2 removed the stale label May 8, 2023
@Noc2
Copy link
Collaborator

Noc2 commented May 8, 2023

I will also share the application again with the rest of the team.

@valeriacaracciolo
Copy link
Contributor Author

valeriacaracciolo commented May 8, 2023 via email

semuelle
semuelle requested changes May 8, 2023
View reviewed changes
Copy link
Member

@semuelle semuelle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the late reply here, @valeriacaracciolo. You did some useful work in your first grant and generally I think it makes sense to continue.

applications/ScoutCoinFabrik_2.md Show resolved Hide resolved
applications/ScoutCoinFabrik_2.md Show resolved Hide resolved
@valeriacaracciolo
Copy link
Contributor Author

valeriacaracciolo commented May 8, 2023 via email

semuelle
semuelle reviewed May 10, 2023
View reviewed changes
applications/ScoutCoinFabrik_2.md
**2.a** | Development | Building a prototype that improves over the [development of Milestone 1 of ScoutCoinFabrik PoC](https://github.com/w3f/Grants-Program/blob/master/applications/ScoutCoinFabrik.md#milestone-1-proof-of-concept), detecting more classes of vulnerabilities and improving in precision on existing detectors. We are to build a prototype that can analyze Rust code to detect vulnerabilities in ink! smart contracts and possibly in pallets and other pieces of code. This builds over [this proof-of-concept tool](https://github.com/CoinFabrik/web3-grant) we've built and [delivered as part of a grant for the web3 foundation](https://github.com/w3f/Grant-Milestone-Delivery/blob/master/deliveries/ScoutCoinFabrik-1.md) by: <br> a) Moving from a proof-of-concept (PoC) tool to a robust tool that integrates with a popular IDE (VSCode), includes a CLI, etc, <br> b) We will improve on the precision of the detectors we included in the PoC reducing the rate of false positives, and <br> c) We will add more detectors in order to have a reasonable coverage of the relevant security vulnerabilities that happen in smart contracts. |
**2.b** | Development | Command line interface for the prototype. For this prototype, we want to develop a simple command line interface like the one used in other static analyzers from other blockchains (eg: [Slither](https://github.com/crytic/slither), [Rustle](https://github.com/blocksecteam/rustle)). <br> In particular, we will develop the possibility to run the prototype on smart contract files or directories. <br> The base command will be: `cargo scout file_name.rs` <br> We will also include options for running subsets of detectors and triggering errors for CI/CD workflows. |
**2.c** | Development | VSCode integration for the prototype. Our VSCode development will list security issues, highlight issues with squiggles and hover-over descriptions. We will seek compatibility of this development with other relevant ink! extensions such as [Ink! Analyzer](https://w3f.github.io/Grants-Program/applications/ink-analyzer#future-plans). |
**3** | Evaluation | Prototype validation against a selection of projects deployed on testnet or mainnet in order to evaluate detector precision. Evaluation report and detector improvement. |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this is called "Evaluation", could you add some kind of success criteria that we could measure the tool's success on? I would actually recommend building or deploying your own contracts to evaluate against. I believe there are collections of ink! vulnerabilities published in some places.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

During this period we will select some popular ink! projects, accepting selections form the web3 foundation, and run the tool against these smart contracts. A security professional will then review the vulnerabilities found by the tool, one by one, to decide whether they are false or true positives. We will then report on the tool's precision estimate and analyze if changes can be made to improve precision.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your question. Please let us know if you have further comments.

@Noc2 Noc2 merged commit b5312dd into w3f:master May 10, 2023
12 checks passed
@github-actions
Copy link
Contributor

Congratulations and welcome to the Web3 Foundation Grants Program! Please refer to our Milestone Delivery repository for instructions on how to submit milestones and invoices, our FAQ for frequently asked questions and the support section of our README for more ways to find answers to your questions.

Before you start, take a moment to read through our announcement guidelines for all communications related to the grant or make them known to the right person in your organisation. In particular, please don't announce the grant publicly before at least the first milestone of your project has been approved. At that point or shortly before, you can get in touch with us at grantsPR@web3.foundation and we'll be happy to collaborate on an announcement about the work you’re doing.

Lastly, please remember to let us know in case you run into any delays or deviate from the deliverables in your application. You can either leave a comment here or directly request to amend your application via PR. We wish you luck with your project! 🚀

@valeriacaracciolo valeriacaracciolo mentioned this pull request Jul 4, 2023
Merged
6 tasks
@dastansam dastansam mentioned this pull request Jul 8, 2023
Merged
@takahser takahser mentioned this pull request Nov 24, 2023
Merged
10 tasks
ainhoa-a pushed a commit to ainhoa-a/Grants-Program that referenced this pull request Jan 26, 2024
@valeriacaracciolo @ainhoa-a
ScoutCoinFabrik: Milestone 2 (w3f#1666)
a5e66ee 
* Added ScoutCoinFabrik_2.md

* Updated Milestone Number and Descriptions

* Updated payment token
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@semuelle semuelle semuelle requested changes

@randombishop randombishop randombishop approved these changes

@Noc2 Noc2 Noc2 approved these changes

@keeganquigley keeganquigley keeganquigley approved these changes

Assignees

@keeganquigley keeganquigley

Labels
ready for review The project is ready to be reviewed by the committee members.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@valeriacaracciolo @semuelle @keeganquigley @Noc2 @randombishop