bugout-dev/dao

Moonstream DAO

dao

Moonstream DAO

NOTE: All important code in this repository has been moved to https://github.com/moonstream-to/web3

Decentralizing Moonstream

Moonstream makes tools which help people build, manage, and maintain their blockchain economies.

Moonstream's off-chain infrastructure is currently hosted and managed by the team at Moonstream.to (https://moonstream.to). We run our own blockchain nodes (currently Ethereum and Polygon), and perform all Moonstream operations through these nodes.

The coming years will bring an explosion of decentralized applications with a presence on multiple blockchains. We aim to bring the value of Moonstream to every major blockchain, and to do so in a truly decentralized manner. No other approach will scale to tens and eventually hundreds of supported blockchains.

Moonstream DAO represents this decentralization. The DAO will reward participants who contribute:

1. Blockchain node time
2. Crawler time
3. Crawler code
4. Storage for the Moonstream databases
5. Publicity for Moonstream
6. Documentation
7. Moonstream token liquidity

Rewards will be distributed as a share of revenue, represented in Moonstream platform tokens.

As strong believers in decentralization, all our code is already open source and freely licensed (Apache 2.0 and MIT): https://github.com/bugout-dev.

Architecture and deployments

The Moonstream platform token

This is an ERC20 token that represents the value that Moonstream provides our customers, and the value Moonstream participants provide to the DAO.

Terminus

The Terminus whitepaper

This is a decentralized authorization platform, which we use to manage permissions in the Moonstream DAO and our customers use for a variety of use cases, including whitelisting their token sales and representing in-game achievements for on-chain games.

You can find the addresses for all Moonstream DAO contracts on our operations page.

Development

Preparing your development environment

Moonstream DAO is built with Solidity, Python, and shell scripts.

We use brownie to build our smart contracts, deploy them, and perform operations on them.

We use moonworm to generate Python interfaces to our smart contracts from their ABIs.

To set up an environment in which you can develop on Moonstream DAO, first create a Python3 environment.

Using the built in venv module:

python3 -m venv .dao

Then make sure that this new environment is active. If you used venv as above:

source .dao/bin/activate

Install the Python dependencies and developer dependencies for dao:

pip install -e ".[dev]"

Install the Solidity dependencies for Moonstream DAO smart contracts:

brownie pm install OpenZeppelin/[email protected]

Compiling the smart contracts

brownie compile

Generating interfaces to the smart contracts

We use moonworm to generate command-line and Python interfaces to our smart contracts.

Every time you add, remove, or modify an external or public method from a Solidity smart contract in this repository, make sure to regenerate its Python interface.

You can do this by activating your Python development environment and running the following command from the repository root:

moonworm generate-brownie -p . -o dao -n "<name of Solidity contract you modified>"

For example, if you modified the TerminusFacet contract, you would then run this command:

moonworm generate-brownie -p . -o dao -n TerminusFacet

Tests

To run unit tests, run: ./test.sh

Before you do this, you must make sure that a Python environment is available in your shell and that you have installed the development dependencies in this environment.

VSCode setup

If you are using the Solidity extension in VSCode, merge the following snippet into your settings.json:

{
    "solidity.remappings": [
        "@openzeppelin-contracts/=<path to your home directory>/.brownie/packages/OpenZeppelin/[email protected]"
    ]
}

dao's Issues

Need to add `name` and `symbol` to terminus token

Need to add name and symbol to terminus token, so Polygonscan can index it, and owners can see tokens in their wallets on polygonscan.

Allow pool creators to set pools as "revocable"

Within such Terminus pools, the controller will be able to revoke tokens from an account.

Add `burnAll` to Terminus

Which will burn all the tokens that a holder holds in a given pool ID.

Estimate deployment and operation costs for Terminus on Ethereum mainnet

DAO whitepaper [milestone]

`isApprovedForPool` problems and Proposal to replace it.

Problem

In the Terminus contract we have isApprovedForPool(uint256 poolID, address operator) function, which grants operator burning and minting permission (only pool owner can grant this permissions). There are problems with it:

1. Approval cannot be taken away. (Huge security problem)
2. When the pool control transfer is done, old approvals will not be reset (which might be ok), but you will not be able to easily remove approvals for all of the operators

Possible solutions

1. Add the ability for terminus owner to grant roles (minting, burning, control, etc) by giving terminus pools
2. Since, solution No 1 can make mess inside the terminus contract, make TerminusManager contract that will handle all the access control. (TerminusManager will be the controller of the pool)

Burning terminus token doesn't respect `isApprovedForAll`

Create Terminus pool trough web app

Milestone issue: #15

Create Terminus pool

• Deploy new web application on https://terminus.moonstream.to
• Read user wallet and chain Id from metamask in to application
• Scan user wallet for MNSTR tokens
• New Terminus Pool form
• Request approval from metamask to spend MNSTR tokens upon user submits New Terminus Pool form
• Instructions to purchase MNSTR token
• API to call terminus pool controller when user approved transfers
• API to store terminus pool offchain data as resource with admin access by wallet address

Tokenomics [milestone]

• How should Decentralized crawling project should use MNSTR token to provide fair and competitive market for blockchain crawling?
• How should our web3 code (Terminus) use MNSTR token to provide competitive service while earning for DAO?
• How should Moonstream application charge for services it provides?
• What should be token distribution model, supply etc
• How should DAO use tokens to provide grants and speed up development

Create new terminus pools with URI and controller as arguments

Right now creating terminus pool for a third party that requires to have metadata on that contract requires three steps

1. Create new terminus token
2. Set metadata URI
3. Transfer pool control

function createNewPool(string uri, address controller)

We also can add a check if controller is a terminus token, then allow control permissions to anyone owning the specified terminus pool token

Motivation:
It will make UX better in the upcoming app since only one TX is required, as well as less errors prone.

Terminus webapp server side spec

Terminus whitelist server side should allow us to

1. Save up blockchain state space by indexing additional state information trough our nodes
2. Allow our customers to enchase blockchain state with their additional information

Proposed specification:

data classes:

class TerminusContracts(BaseModel):
    resource_id: uuid 
    contract_address: str
    pools: List[uuid] #I suspect this is how foreign key should work, but how does it scales if this list is veeeery long?  

class TerminusContractsListResponse(BaseModel):
   contracts: List[TerminusContracts] = Field(default_factory=list)


class TerminusPool(BaseModel):
     resource_id: uuid
     identities: List[uuid]  #To paginate probably must migrate in to new /TerminusPoolIdentities/ paginated resource?

class TerminusIdentity(BaseModel):
     resource_id: uuid
     address: str

endpoints:

GET /terminus/${DiamondAddress} -> (TerminusContract)
GET /terminus/${DiamondAddress}/pools/${poolId} -> (TerminusPool)
GET /terminus/${DiamondAddress}/pools/${poolId}/refresh -> (TerminusPool)
GET /terminus/${DiamondAddress}/pools/${poolId}/${address} -> (TerminusIdentity)

API logic:

GET /terminus/${DiamondAddress} -> (TerminusContract):

 terminus_contract_resource_id: BugoutResource = bc.list_resources(
                params = { "contract_address": DiamondAddress }
            )[0]
 terminus_resource = bc.get_resource( resource_id = terminus_contract_resource_id)

1. Update resource from web3 provider
2. Return resource

Case if terminus_contract not found:
Check web3 -> if contract exists and payment service conditions are met - create resource and set up crawler

GET /terminus/${DiamondAddress}/pools/${poolId} -> (TerminusPool): 
terminus_pool: BugoutResource = bc.get_resource(
                resource_id=terminus_contract[poolId],
            )
1. Update resource from web3 provider
2. Return resource

Case if resource not found: 
If payment service conditions are met - create resource and set up crawler.
  For each address found in crawler:
     add TerminusIdentity. 

GET /terminus/${DiamondAddress}/pools/${poolId}/${address} -> (TerminusIdentity)
terminus_pool_resource: BugoutResource = bc.get_resource(
                resource_id=terminus_pool.identities[],
            )
if address in terminus_pool_resource.identities
    terminus_identity_resource: BugoutResource = bc.get_resource(
                resource_id=address,
            )
    terminus_identity_record_resource: BugoutResource = bc.get_pool_resource(
                resource_id=web3.sha(DiamondAddress + poolId + address),
            )

Terminus web application [milestone]

Besides the Terminus smart contract, we also need to provide users with a web application they can use to manage their Terminus authorization pools.

User stories

Create Terminus pool

1. User wants to integrate Terminus with their smart contract (to be deployed on the Ethereum mainnet).
2. They go to the Terminus web application at https://terminus.moonstream.to or https://terminus.moonstreamdao.com
3. They connect their Metamask wallet to the web application.
4. They click on a New Terminus pool button
5. This takes them to a form where they can configure their pool - what should be its capacity? should tokens from that pool be transferable? burnable?
6. They confirm this configuration and click on Create pool
7. The application checks that their address has enough MNSTR balance to pay for pool creation.
8. If so, the application requests MNSTR transfer approval for the Terminus contract. If not, the user is shown instructions for how to get MNSTR (with an always available fallback of contacting us on Discord).
9. Once Terminus is approved for MNSTR transfers on behalf of the user, the pool creation transaction is submitted to the blockchain.
10. Once the transaction is mined, they can go to their Pools view and manage the pool.

milestone

Authorize an address manually

1. Pool manager wants to authorize Aliya's address for their application.
2. They go to the Pools page on the Terminus web application at https://terminus.moonstream.to
3. They click on the authorization pool for their application.
4. They click on Add authorization
5. They are presented with a form where they can paste Aliya's address and determine how many authorization tokens should be minted to her. They are also shown the total capacity of the pool and how much of this capacity has already been used up.
6. Once they are satisfied that they have correctly specified Aliya's authorization, they click Submit transaction.
7. This submits a transaction through their connected Metamask wallet to the blockchain which mints tokens in their authorization pool to Aliya.

View authorized addresses

1. Pool manager wishes to view the addresses that are authorized for their application.
2. They go to the Pools page on the Terminus web application at https://terminus.moonstream.to
3. They click on the authorization pool for their application.
4. They are presented with a tabular view of the addresses authorized for their pool, along with the token balance of each address. They are also presented with notes associated with each address.

Status

• #20
• #21
• #22

hardhat support

Currently, running a hardhat compile in a repo that contains @moonstream/contracts imports breaks.

This is because there is no @moonstream/contracts package on NPM and hardhat uses NPM packages to manage dependencies.

See conversation on Moonstream Discord: https://discord.com/channels/867156607644860418/954495097406382120/1015381496082726983

Thanks to defikris for pointing this out.

This is what we need to do to enable hardhat support:

• Add package.json in contracts/ directory. We can base it off of the Open Zeppelin one: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/package.json
• Replace all @openzeppelin-contracts imports with @openzeppelin/contracts imports in Solidity files (thanks to @Yhtiyar for pointing this out)
• Update brownie-config.yml to reflect the new remapping for Open Zeppelin imports

Multisig functions to submit txs with terminus tokne holders' signatures

case-sensitive paths on a case-insensitive filesystem

Problem

Cloning repo on Mac OS produces warning

git clone [email protected]:bugout-dev/dao.git
Cloning into 'dao'...
remote: Enumerating objects: 74, done.
remote: Counting objects: 100% (74/74), done.
remote: Compressing objects: 100% (41/41), done.
remote: Total 74 (delta 27), reused 66 (delta 24), pack-reused 0
Receiving objects: 100% (74/74), 24.73 KiB | 6.18 MiB/s, done.
Resolving deltas: 100% (27/27), done.
warning: the following paths have collided (e.g. case-sensitive paths
on a case-insensitive filesystem) and only one from the same
colliding group is in the working tree:

  'dao/Diamond.py'
  'dao/diamond.py'

reason is that OSX is not case sensitive.

Solution

It is okey to use Upper/Lower case letters in file names as long as their name translation to lower case does not produces a duplicate file.

addd `burnBatch` to terminus

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC1155/extensions/ERC1155Burnable.sol

Make a doc that explains devs need to implement `IERC1155Holder`

Add cli for generate json output for opensea and add on parameters of cli cutch if pool token is transferable or mintable.

Make it easier to allow others to create the pool

Now, only the controller can create pools, we need ability to grant admin roles to others

More tests for TerminusController

Moonstream faucet - Polygon mumbai testnet

We need a faucet page for the Mumbai testnet where people can go to get MNSTR token minted to their addresses.

On the same site, we can also send MATIC to their addresses (if available to us) so that they never run into an issue of not having enough MATIC to pay gas.

Add ERC721 support to TokenDrainerFacet

View authorized addresses

Milestone issue #15

• list of all pools at https://terminus.moonstream.to
• Show pool details at https://terminus.moonstream.to/<pool_id>
• Filter for only pools that are owned by connected wallet
• Show modifiable notes for each address in pool and pool name for pools that are owned by wallet
• Implement pool name and pool address notes on API side
• Recursive filter for pool ownership that are owned by another terminus pool(s) which at some point whitelists connected wallet

Terminus smart contract integration guide

The Terminus documentation should have a guide to adding Terminus authorization to a smart contract.

"TerminusControllerFacet.initTerminusController" should only be callable by contract owner

or by Terminus contoller admin.

dao/contracts/terminus/controller/TerminusControllerFacet.sol

Line 58 in 5bdecfe

function initTerminusController(

Thanks to Hacken.io security team for calling this out.

Authorize an address manually

Milestone issue #15

• Authorize address form and button
• Authorize address web3 calls

Terminus `non transferable` token could be transferred using `safeBatchTransferFrom`

We were able to sell non transferable token in OpenSea

"dao diamond facet-cut" needs functionality to attach/detach individual methods

And to ignore methods when working with an entire facet.

ITerminus - we need to define the terminus interface separately

Currently, the Terminus interface is defined implicitly in TerminusFacet.sol. The implementation sprawls across multiple solidity files and includes the complexity of common storage (since we are using Diamond proxies).

To make it clear what functionality is available through Terminus, we should implement an ITerminus interface that details its public and external functionality, with clear documentation of the semantics of each method.