TEP: Contract source registry #91

talkol · 2022-09-09T19:35:13Z

This proposal defines decentralized infrastructure and an on-chain registry to store the source code for verified TON smart contracts.

The proposal also defines a simple permissionless protocol where community source code verifiers can register and publish signed attestations that they have indeed verified specific contracts.

text/0092-contract-source-registry.md

shaharyakir · 2022-09-09T21:41:17Z

text/0092-contract-source-registry.md

+
+## sources.json
+
+JSON file provided by a specific **verifier** for a specific **contract code hash** containing the URLs of source-code files and verification attestations. Fields of this file include:


It should also include the original signatures (which are done on the data part of the json)

{ data: { codeHash:... }, sigs: [{sig: '...', pubKey: '...'}] }

otherwise, the UI will not be able to display the signatures used to verify the contract.

It's indeed nice to add here as well for UI purposes, but then it's a bit circular. Because the signature is over code hash + sources_json_url and the sources_json_url is derived from a hash over its data and the signature is in the data. Do you have any simple way to overcome this?

What if signatures are stored on chain within the source item contract?
Each signature is 512bit, so this would add another 2-3 cells (assuming 5 verifier multi sig threshold)

This has interesting implications in case we retire and replace one or more of the original verifying nodes, so it would be good to decide how clients should handle such case (i.e. that the public key used to sign can no longer be found in the verifier registry).

shaharyakir · 2022-09-09T21:42:45Z

text/0092-contract-source-registry.md

+
+### Actions
+
+* `update_verifier(verifier_id, backend_endpoints, quorum_config)` - If the verifier does not exist, ensures it deposits the required amount and adds to the registry. Otherwise updates details in the registry. The address that sends this update message is stored in the registry as the admin address and only it can update. The quorum config contains the list of public keys and how many are needed for quorum.


There probably should be a public key (representing the verifier) sent with this op as well, so that future operations (update endpoints, remove verifier) for an existing verifier can be authorized.

I think the simplest behavior is that the address that sends the update message is regarded as the admin address and only this address can update later. So if the admin is a wallet contract, it would send the internal message of the update and on the first update (insert) it would be set.

Yes In general I think verifying the sender is more elegant ( and more gas and storage efficient than public key method and simpler to code )

Co-authored-by: Shahar Yakir <[email protected]>

shaharyakir · 2022-09-11T08:02:30Z

text/0092-contract-source-registry.md

+
+## Verifier registry contract
+
+A smart contract deployed to TON mainnet that holds a mapping between a **verifier id** to the **verifier details** which include the list of backends, their public keys and quorum configuration. To prevent spam in this registry, we propose that each verifier will deposit in the contract a sum of 1,000-10,000 TON coin. This sum will be returned when the verifier unregisters.


An interesting point was whether to tie the staking amount to a config param, in order to reflect changes in TON/USD price.

E.g. 10 * 1e9 * Gas price (currently 1,000) => 10K ton

It's a good idea, since the contract is immutable without any special admin role, this can normalize the deposit size in case TON USD price changes significantly

EmelyanenkoK · 2022-09-12T08:48:14Z

I think it is expedient to explicitly invite Source-code uploaders(probably tools for deployment like toncli?), Source-code verifiers(currently only tonwhales I believe?) and Source-code displayers (explorer-developers) to discussion.
@tvorogme @ex3ndr @tonscan

ex3ndr · 2022-09-12T10:17:45Z

LGFM, maybe just some possible generalizations - we want to have verifiable credentials in ton, and it's verifier is so similar to Verite and may just have the same infrastructure ready and then implement source code repository.

talkol · 2022-09-12T11:55:16Z

I think it is expedient to explicitly invite Source-code uploaders(probably tools for deployment like toncli?), Source-code verifiers(currently only tonwhales I believe?) and Source-code displayers (explorer-developers) to discussion. @tvorogme @ex3ndr @tonscan

Sure, great idea

Source code uploaders in the first stage will be through web UI (drag and drop in your browser). We will launch an open source client like jetton.live that runs on GitHub Pages and later offer TF to host it on verifier.ton.org. I think command line tools like toncli and hardhat will come second.

Source code verifiers - we are also planning to launch a significant decentralized verifier operated by Orbs Network (orbs.com). It will be executed by a quorum of 21 staked Orbs oracles.

Source-code displayers, I think TonWhales explorer is here and I'll contact tonscan.org to join. I already talked about this general concept with them and they're waiting to see the widget that they should embed in their site so they can comment on it

shaharyakir · 2022-09-17T15:27:37Z

text/0092-contract-source-registry.md

+
+#### Actions
+
+* `update_sources(code_hash, verifier_id, sources_json_url, signatures)` - Verifies that the signatures match the verifier's quorum detailed under **verifier registry** and updates the **sources registry** with the url.


The signed data should include a measure of preventing replay attack, such as a valid_until timestamp which can be verified as well.

ادم باش

shaharyakir · 2022-10-11T12:36:57Z

Implementation for the sources registry contract can be found here:
https://github.com/ton-defi-org/ton-src-contracts/blob/main/contracts/sources-registry.fc

shaharyakir · 2022-10-11T12:37:02Z

Implementation for the verifier registry contract was carried out via a ton footsteps grant:
ton-society/grants-and-bounties#41
and can be found here:
https://github.com/xssnick/registry-contract/blob/master/packages/contracts/sources/registry.fc

Osasv · 2024-01-02T23:37:38Z

Okay

…

On Wed, 27 Dec 2023 at 3:34 AM, hebosho911 ***@***.***> wrote: — Reply to this email directly, view it on GitHub <#91 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A73LUSVSHHH2XO26T5M6SBDYLPMRNAVCNFSM6AAAAAAQI6N6AWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQNZQGA3TGMBYHE> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

Osasv · 2024-01-02T23:37:49Z

What do I need to do now

…

On Tue, 2 Jan 2024 at 6:37 PM, osas ehimen ***@***.***> wrote: Okay On Wed, 27 Dec 2023 at 3:34 AM, hebosho911 ***@***.***> wrote: > — > Reply to this email directly, view it on GitHub > <#91 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/A73LUSVSHHH2XO26T5M6SBDYLPMRNAVCNFSM6AAAAAAQI6N6AWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQNZQGA3TGMBYHE> > . > You are receiving this because you are subscribed to this thread.Message > ID: ***@***.***> >

amirbonakchi · 2024-06-12T00:34:39Z

https://github.com/ton-blockchain/verifier.git

Antorhalder · 2024-08-02T12:57:12Z

UQAutOwc-EVANIwf1MG2m_M0wsubYsZnwUvPMMCkI8a3fkQx

Antorhalder · 2024-08-02T12:57:19Z

UQAutOwc-EVANIwf1MG2m_M0wsubYsZnwUvPMMCkI8a3fkQx

Antorhalder · 2024-08-02T12:57:58Z

UQAutOwc-EVANIwf1MG2m_M0wsubYsZnwUvPMMCkI8a3fkQx

Antorhalder

UQAutOwc-EVANIwf1MG2m_M0wsubYsZnwUvPMMCkI8a3fkQx

Antorhalder · 2024-08-02T12:59:04Z

UQAutOwc-EVANIwf1MG2m_M0wsubYsZnwUvPMMCkI8a3fkQx

Osasv · 2024-08-02T13:00:37Z

What address is this

…

On Fri, Aug 2, 2024 at 8:59 AM Antorhalder ***@***.***> wrote: UQAutOwc-EVANIwf1MG2m_M0wsubYsZnwUvPMMCkI8a3fkQx — Reply to this email directly, view it on GitHub <#91 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A73LUSQU7UBF6HU5K5HYH33ZPN7C5AVCNFSM6AAAAAAQI6N6AWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENRVGM2TKNBXHE> . You are receiving this because you commented.Message ID: ***@***.***>

Osasv · 2024-08-02T13:04:12Z

UQD6Riw7pw8Vb4dnPj_qqJmtC822sVlLCN2yGdV5J78ADTuY

…

On Fri, Aug 2, 2024 at 9:00 AM osas ehimen ***@***.***> wrote: What address is this On Fri, Aug 2, 2024 at 8:59 AM Antorhalder ***@***.***> wrote: > UQAutOwc-EVANIwf1MG2m_M0wsubYsZnwUvPMMCkI8a3fkQx > > — > Reply to this email directly, view it on GitHub > <#91 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/A73LUSQU7UBF6HU5K5HYH33ZPN7C5AVCNFSM6AAAAAAQI6N6AWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENRVGM2TKNBXHE> > . > You are receiving this because you commented.Message ID: > ***@***.***> >

Osasv · 2024-08-02T13:04:28Z

UQD6Riw7pw8Vb4dnPj_qqJmtC822sVlLCN2yGdV5J78ADTuY

…

On Sun, Jun 30, 2024 at 6:29 PM Lorik56 ***@***.***> wrote: ***@***.**** approved this pull request. — Reply to this email directly, view it on GitHub <#91 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A73LUSR7LV4OS5U753HBZXDZKCBF7AVCNFSM6AAAAAAQI6N6AWVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMZDCNJQGIYDMMZXGQ> . You are receiving this because you commented.Message ID: ***@***.***>

Antorhalder · 2024-08-02T13:04:37Z

UQAutOwc-EVANIwf1MG2m_M0wsubYsZnwUvPMMCkI8a3fkQx

Osasv · 2024-08-02T13:04:42Z

UQD6Riw7pw8Vb4dnPj_qqJmtC822sVlLCN2yGdV5J78ADTuY

…

On Tue, Apr 23, 2024 at 3:58 AM Hebosho911 ***@***.***> wrote: ***@***.**** approved this pull request. #from github import Github import os def get_user_token(): # Generar un token único para el usuario actual return os.urandom(16).hex() def merge_pull_request(repo_name, pull_request_number): # Obtener el token único del usuario user_token = get_user_token() # Inicializar el objeto Github con el token del usuario g = Github(user_token) try: # Obtener el repositorio repo = g.get_repo(repo_name) # Obtener el pull request pull_request = repo.get_pull(pull_request_number) # Fusionar el pull request pull_request.merge() print("¡El pull request ha sido fusionado exitosamente!") except Exception as e: print(f"Error al fusionar el pull request: {e}") Nombre del repositorio y número del pull request repo_name = 'ton-blockchain/TEPs' pull_request_number = 91 Fusionar el pull request merge_pull_request(repo_name, pull_request_number) — Reply to this email directly, view it on GitHub <#91 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A73LUSRY3E7AJTSN6T4O5L3Y6YIBPAVCNFSM6AAAAAAQI6N6AWVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMZDAMJWGUZDOMZUGE> . You are receiving this because you commented.Message ID: ***@***.***>

Antorhalder · 2024-08-02T13:04:56Z

UQAutOwc-EVANIwf1MG2m_M0wsubYsZnwUvPMMCkI8a3fkQx

Antorhalder · 2024-08-02T13:29:22Z

UQAutOwc-EVANIwf1MG2m_M0wsubYsZnwUvPMMCkI8a3fkQx

Osasv · 2024-08-02T13:30:42Z

UQD6Riw7pw8Vb4dnPj_qqJmtC822sVlLCN2yGdV5J78ADTuY

…

On Fri, Aug 2, 2024 at 9:05 AM Antorhalder ***@***.***> wrote: UQAutOwc-EVANIwf1MG2m_M0wsubYsZnwUvPMMCkI8a3fkQx — Reply to this email directly, view it on GitHub <#91 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A73LUSVTBK4O34YF4EF6AN3ZPN7ZBAVCNFSM6AAAAAAQI6N6AWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENRVGM3DKMZWGU> . You are receiving this because you commented.Message ID: ***@***.***>

Antorhalder · 2024-08-02T13:31:02Z

UQAL1divDXnelbf4kbFBrCrk3s7GRs_sRktVXsw0LzS1tRBA

Antorhalder · 2024-08-02T13:35:51Z

UQAL1divDXnelbf4kbFBrCrk3s7GRs_sRktVXsw0LzS1tRBA

Antorhalder · 2024-08-02T13:36:11Z

UQAL1divDXnelbf4kbFBrCrk3s7GRs_sRktVXsw0LzS1tRBA

Antorhalder · 2024-08-07T09:17:07Z

UQAutOwc-EVANIwf1MG2m_M0wsubYsZnwUvPMMCkI8a3fkQx

Antorhalder · 2024-08-07T09:17:16Z

UQAutOwc-EVANIwf1MG2m_M0wsubYsZnwUvPMMCkI8a3fkQx

Antorhalder · 2024-08-07T09:17:27Z

UQAutOwc-EVANIwf1MG2m_M0wsubYsZnwUvPMMCkI8a3fkQx

Elgayar777 · 2024-08-17T04:16:16Z

text/0092-contract-source-registry.md

+
+## Verifier registry contract
+
+A smart contract deployed to TON mainnet that holds a mapping between a **verifier id** to the **verifier details** which include the list of backends, their public keys and quorum configuration. To prevent spam in this registry, we propose that each verifier will deposit in the contract a sum of 1,000-10,000 TON coin. This sum will be returned when the verifier unregisters.


Elgayar777 · 2024-08-17T07:20:49Z

text/0092-contract-source-registry.md

UQCWb4npmDTu3tkvQVHCDBpvDYSMLgyPV2Cvfxhpy3ucRHxo

How to earn ton and other coins please help any contract swap link

How to start

Cryptocurrencykh1

UQBulKXWVFmcTBtf1XsxVA9pfXCzSyNG4mGPhUNJ4Qt6YHAq

Create 0092-contract-source-registry.md

d916add

talkol changed the title ~~TEP-92: Contract source registry~~ TEP-91: Contract source registry Sep 9, 2022

shaharyakir reviewed Sep 9, 2022

View reviewed changes

text/0092-contract-source-registry.md Outdated Show resolved Hide resolved

shaharyakir reviewed Sep 9, 2022

View reviewed changes

text/0092-contract-source-registry.md Outdated Show resolved Hide resolved

shaharyakir reviewed Sep 9, 2022

View reviewed changes

talkol and others added 4 commits September 9, 2022 23:47

Update text/0092-contract-source-registry.md

3ac77c8

Co-authored-by: Shahar Yakir <[email protected]>

Update text/0092-contract-source-registry.md

a3151ee

Co-authored-by: Shahar Yakir <[email protected]>

Update 0092-contract-source-registry.md

efa8aa1

Update 0092-contract-source-registry.md

b7e2adf

shaharyakir reviewed Sep 11, 2022

View reviewed changes

hacker-volodya changed the title ~~TEP-91: Contract source registry~~ TEP: Contract source registry Sep 12, 2022

shaharyakir mentioned this pull request Sep 13, 2022

TEP: Wallet registry for dapps #92

Open

shaharyakir reviewed Sep 17, 2022

View reviewed changes

Ejudson31 approved these changes Jan 18, 2024

View reviewed changes

Lorik56 approved these changes Jun 30, 2024

View reviewed changes

Antorhalder reviewed Aug 2, 2024

View reviewed changes

Elgayar777 approved these changes Aug 17, 2024

View reviewed changes

mm8191 approved these changes Aug 29, 2024

View reviewed changes

Elgayar777 approved these changes Aug 30, 2024

View reviewed changes

This comment was marked as spam.

Sign in to view

Cryptocurrencykh1 approved these changes Aug 30, 2024

View reviewed changes

This comment was marked as spam.

Sign in to view

Elgayar777 approved these changes Sep 2, 2024

View reviewed changes

Meroksa approved these changes Sep 17, 2024

View reviewed changes

Meroksa approved these changes Oct 1, 2024

View reviewed changes

Meroksa approved these changes Oct 2, 2024

View reviewed changes


		## sources.json

		JSON file provided by a specific verifier for a specific contract code hash containing the URLs of source-code files and verification attestations. Fields of this file include:


		### Actions

		* `update_verifier(verifier_id, backend_endpoints, quorum_config)` - If the verifier does not exist, ensures it deposits the required amount and adds to the registry. Otherwise updates details in the registry. The address that sends this update message is stored in the registry as the admin address and only it can update. The quorum config contains the list of public keys and how many are needed for quorum.


		## Verifier registry contract

		A smart contract deployed to TON mainnet that holds a mapping between a verifier id to the verifier details which include the list of backends, their public keys and quorum configuration. To prevent spam in this registry, we propose that each verifier will deposit in the contract a sum of 1,000-10,000 TON coin. This sum will be returned when the verifier unregisters.


		#### Actions

		* `update_sources(code_hash, verifier_id, sources_json_url, signatures)` - Verifies that the signatures match the verifier's quorum detailed under verifier registry and updates the sources registry with the url.

TEP: Contract source registry #91

Are you sure you want to change the base?

TEP: Contract source registry #91

Conversation

talkol commented Sep 9, 2022

Choose a reason for hiding this comment

talkol Sep 9, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shaharyakir Sep 9, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shaharyakir Sep 11, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

EmelyanenkoK commented Sep 12, 2022

ex3ndr commented Sep 12, 2022

talkol commented Sep 12, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shaharyakir commented Oct 11, 2022 • edited Loading

shaharyakir commented Oct 11, 2022 • edited Loading

Osasv commented Jan 2, 2024 via email

Osasv commented Jan 2, 2024 via email

amirbonakchi commented Jun 12, 2024

Antorhalder commented Aug 2, 2024

Antorhalder commented Aug 2, 2024

Antorhalder commented Aug 2, 2024

Antorhalder left a comment

Choose a reason for hiding this comment

Antorhalder commented Aug 2, 2024

Osasv commented Aug 2, 2024 via email

Osasv commented Aug 2, 2024 via email

Osasv commented Aug 2, 2024 via email

Antorhalder commented Aug 2, 2024

Osasv commented Aug 2, 2024 via email

Antorhalder commented Aug 2, 2024

Antorhalder commented Aug 2, 2024

Osasv commented Aug 2, 2024 via email

Antorhalder commented Aug 2, 2024

Antorhalder commented Aug 2, 2024

Antorhalder commented Aug 2, 2024

Antorhalder commented Aug 7, 2024

Antorhalder commented Aug 7, 2024

Antorhalder commented Aug 7, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

This comment was marked as spam.

Choose a reason for hiding this comment

This comment was marked as spam.

Cryptocurrencykh1 left a comment

Choose a reason for hiding this comment

This comment was marked as spam.

This comment was marked as spam.

talkol Sep 9, 2022 •

edited

Loading

shaharyakir Sep 9, 2022 •

edited

Loading

shaharyakir Sep 11, 2022 •

edited

Loading

shaharyakir commented Oct 11, 2022 •

edited

Loading

shaharyakir commented Oct 11, 2022 •

edited

Loading