2 articles tagged “blockchain” — software, engineering, and related writing by idmontie.

Blockchain blog posts - idmontie's Portfolio

"use strict";
const {Fragment: _Fragment, jsx: _jsx, jsxs: _jsxs} = arguments[0];
function _createMdxContent(props) {
  const _components = {
    a: "a",
    code: "code",
    h2: "h2",
    p: "p",
    pre: "pre",
    strong: "strong",
    ...props.components
  };
  return _jsxs(_Fragment, {
    children: [_jsx(_components.p, {
      children: "The crypto craze has died down, but if you are working on Smart Contracts or thinking about creating a new blockchain projects, security is a huge part of making sure the project is successful. Since Smart Contracts often interact with cryptocurrencies, blockchain assets, or other tokens, it’s important to make sure the Smart Contract is secure and follows best practices."
    }), "\n", _jsx(_components.p, {
      children: "In general, the best practices around Smart Contracts are the same for writing secure code in general."
    }), "\n", _jsx(_components.h2, {
      children: "Keep it Simple"
    }), "\n", _jsx(_components.p, {
      children: "Keep your Smart Contract code simple. Smart Contracts that try to be too clever often have unintended side-effects or functionality. Keeping a Smart Contract simple also means that the surface area for attacks is smaller."
    }), "\n", _jsx(_components.h2, {
      children: "Write Small Functions"
    }), "\n", _jsx(_components.p, {
      children: "Write small functions that do one thing. Many Smart Contracts will have many small functions that can be composed together, rather than one large function that does everything. This helps keep the code readable, making it easier to understand and secure."
    }), "\n", _jsx(_components.h2, {
      children: "Linting"
    }), "\n", _jsx(_components.p, {
      children: "Lint your code. Smart Contracts written in Solidity have tools already written that can help catch common errors via linting. The easiest linters to set up just help improve formatting, but some can help you write more secure code by letting your know when functions have been deprecated or marked as insecure."
    }), "\n", _jsx(_components.h2, {
      children: "Unit Tests"
    }), "\n", _jsxs(_components.p, {
      children: ["Unit test your code. The best unit tests you can write for Smart Contracts are validating what users shouldn’t be able to do. As an example, make sure unauthorized accounts cannot withdraw assets from your contract. These are sometimes called ", _jsx(_components.strong, {
        children: "negative"
      }), " tests and they can be even more important than your typical that validate your functions do what you expect them to do. These tests check that they fail in the correct way when misused."]
    }), "\n", _jsx(_components.h2, {
      children: "Scan for Security Vulnerabilities"
    }), "\n", _jsx(_components.p, {
      children: "Scan your code for security vulnerabilities. This is pretty self-explanatory. Many Smart Contract toolchains provide scanning tools to check your Smart Contract code."
    }), "\n", _jsxs(_components.p, {
      children: ["There are a few ways to surface security issues in Ethereum Smart Contracts. One way is to use ", _jsx(_components.a, {
        href: "https://github.com/crytic/slither",
        children: "slither"
      }), ":"]
    }), "\n", _jsx(_components.pre, {
      children: _jsx(_components.code, {
        className: "language-tsx",
        children: "npm install slither\nslither .\n"
      })
    }), "\n", _jsx(_components.p, {
      children: "This may take a while to run, but it will scan the compiles contracts for security issues."
    }), "\n", _jsx(_components.h2, {
      children: "Compliance"
    }), "\n", _jsxs(_components.p, {
      children: ["For Ethereum Smart Contracts, you can also use ", _jsx(_components.a, {
        href: "https://github.com/crytic/slither",
        children: "slither"
      }), " to check the compliance of your ERC20 token or ERC721 contracts. Running this check will verify that your contract implements the expected interfaces of the given contracts."]
    }), "\n", _jsx(_components.h2, {
      children: "Wrapping it Up"
    }), "\n", _jsx(_components.p, {
      children: "Security is a major consideration in any application, but Smart Contracts pose a new type of attack vector for malicious users. Smart Contracts often interact with pools of cryptocurrency, NFTs, and other blockchain assets that make them new targets for attackers. It’s important when writing Smart Contracts to always make sure the contract fails correctly, even more-so than completing actions successfully."
    })]
  });
}
function MDXContent(props = {}) {
  const {wrapper: MDXLayout} = props.components || ({});
  return MDXLayout ? _jsx(MDXLayout, {
    ...props,
    children: _jsx(_createMdxContent, {
      ...props
    })
  }) : _createMdxContent(props);
}
return {
  default: MDXContent
};


<p>The crypto craze has died down, but if you are working on Smart Contracts or thinking about creating a new blockchain projects, security is a huge part of making sure the project is successful. Since Smart Contracts often interact with cryptocurrencies, blockchain assets, or other tokens, it’s important to make sure the Smart Contract is secure and follows best practices.</p>
<p>In general, the best practices around Smart Contracts are the same for writing secure code in general.</p>
<h2>Keep it Simple</h2>
<p>Keep your Smart Contract code simple. Smart Contracts that try to be too clever often have unintended side-effects or functionality. Keeping a Smart Contract simple also means that the surface area for attacks is smaller.</p>
<h2>Write Small Functions</h2>
<p>Write small functions that do one thing. Many Smart Contracts will have many small functions that can be composed together, rather than one large function that does everything. This helps keep the code readable, making it easier to understand and secure.</p>
<h2>Linting</h2>
<p>Lint your code. Smart Contracts written in Solidity have tools already written that can help catch common errors via linting. The easiest linters to set up just help improve formatting, but some can help you write more secure code by letting your know when functions have been deprecated or marked as insecure.</p>
<h2>Unit Tests</h2>
<p>Unit test your code. The best unit tests you can write for Smart Contracts are validating what users shouldn’t be able to do. As an example, make sure unauthorized accounts cannot withdraw assets from your contract. These are sometimes called <strong>negative</strong> tests and they can be even more important than your typical that validate your functions do what you expect them to do. These tests check that they fail in the correct way when misused.</p>
<h2>Scan for Security Vulnerabilities</h2>
<p>Scan your code for security vulnerabilities. This is pretty self-explanatory. Many Smart Contract toolchains provide scanning tools to check your Smart Contract code.</p>
<p>There are a few ways to surface security issues in Ethereum Smart Contracts. One way is to use <a href="https://github.com/crytic/slither">slither</a>:</p>
<div class="overflow-auto rounded-2xl bg-[#0e005d6d] p-4 font-mono text-sm dark:bg-[#0e005d6d] dark:text-gray-100"><pre><code class="language-tsx">npm install slither
slither .
</code></pre></div>
<p>This may take a while to run, but it will scan the compiles contracts for security issues.</p>
<h2>Compliance</h2>
<p>For Ethereum Smart Contracts, you can also use <a href="https://github.com/crytic/slither">slither</a> to check the compliance of your ERC20 token or ERC721 contracts. Running this check will verify that your contract implements the expected interfaces of the given contracts.</p>
<h2>Wrapping it Up</h2>
<p>Security is a major consideration in any application, but Smart Contracts pose a new type of attack vector for malicious users. Smart Contracts often interact with pools of cryptocurrency, NFTs, and other blockchain assets that make them new targets for attackers. It’s important when writing Smart Contracts to always make sure the contract fails correctly, even more-so than completing actions successfully.</p>


The crypto craze has died down, but if you are working on Smart Contracts or thinking about creating a new blockchain projects, security is a huge part of making sure the project is successful. Since Smart Contracts often interact with cryptocurrencies, blockchain assets, or other tokens, it’s important to make sure the Smart Contract is secure and follows best practices.

In general, the best practices around Smart Contracts are the same for writing secure code in general.

## Keep it Simple

Keep your Smart Contract code simple. Smart Contracts that try to be too clever often have unintended side-effects or functionality. Keeping a Smart Contract simple also means that the surface area for attacks is smaller.

## Write Small Functions

Write small functions that do one thing. Many Smart Contracts will have many small functions that can be composed together, rather than one large function that does everything. This helps keep the code readable, making it easier to understand and secure.

## Linting

Lint your code. Smart Contracts written in Solidity have tools already written that can help catch common errors via linting. The easiest linters to set up just help improve formatting, but some can help you write more secure code by letting your know when functions have been deprecated or marked as insecure.

## Unit Tests

Unit test your code. The best unit tests you can write for Smart Contracts are validating what users shouldn’t be able to do. As an example, make sure unauthorized accounts cannot withdraw assets from your contract. These are sometimes called **negative** tests and they can be even more important than your typical that validate your functions do what you expect them to do. These tests check that they fail in the correct way when misused.

## Scan for Security Vulnerabilities

Scan your code for security vulnerabilities. This is pretty self-explanatory. Many Smart Contract toolchains provide scanning tools to check your Smart Contract code.

There are a few ways to surface security issues in Ethereum Smart Contracts. One way is to use [slither](https://github.com/crytic/slither):

```tsx
npm install slither
slither .
```

This may take a while to run, but it will scan the compiles contracts for security issues.

## Compliance

For Ethereum Smart Contracts, you can also use [slither](https://github.com/crytic/slither) to check the compliance of your ERC20 token or ERC721 contracts. Running this check will verify that your contract implements the expected interfaces of the given contracts.

## Wrapping it Up

Security is a major consideration in any application, but Smart Contracts pose a new type of attack vector for malicious users. Smart Contracts often interact with pools of cryptocurrency, NFTs, and other blockchain assets that make them new targets for attackers. It’s important when writing Smart Contracts to always make sure the contract fails correctly, even more-so than completing actions successfully.


Smart Contract Security

"use strict";
const {Fragment: _Fragment, jsx: _jsx, jsxs: _jsxs} = arguments[0];
function _createMdxContent(props) {
  const _components = {
    a: "a",
    h2: "h2",
    li: "li",
    mermaid: "mermaid",
    p: "p",
    ul: "ul",
    ...props.components
  };
  return _jsxs(_Fragment, {
    children: [_jsx(_components.p, {
      children: "Dark Emblem is an NFT project that was sparked by the idea of combining cards games with Crypto Kitties. You can buy packs, open them to collect random cards, and then use those cards to battle raids with others."
    }), "\n", _jsx(_components.p, {
      children: "To support all of the functionality, I created a WAX contract, written in C++, that I deployed to the WAX Blockchain. This contract handled the creation and storage of packs and cards, along with defining an in-game currency DREM."
    }), "\n", _jsx(_components.p, {
      children: "There was also a server that would sync with the changes on the Blockchain and provide some additional metadata on top of that. While Blockchains like ETH have stable public APIs that can be used to query data from the Blockchain through 3rd party vendors, WAX does not have the same maturity there. This meant that we would need to proxy requests that would normally be made to a WAX API mode through our servers instead."
    }), "\n", _jsx(_components.p, {
      children: "I also created a UI application to interact with the server and the Blockchain. The infrastructure ends up looking like:"
    }), "\n", _jsx(_components.mermaid, {
      chart: "graph LR\n  WAX --> Dfuse\n Dfuse --> Listener(Dark Emblem Listener Service)\n  Listener --> Redis\n  Redis --> API(Dark Emblem API)\n  API --> Dapp\n  WAXEndpoint(WAX Endpoint) --> Dapp"
    }), "\n", _jsx(_components.p, {
      children: "One of the first steps to interacting with the dapp is to sign in. The authentication flow is similar to an oauth sign in where we let the user sign in with a third party authenticator and then issue a challenge for the user to verify they are who they say they are. At this point we issue a JWT for further API requests."
    }), "\n", _jsx(_components.mermaid, {
      chart: "sequenceDiagram\n  Dapp->>+3rdPartyAuthenticator: Request sign in\n  3rdPartyAuthenticator->>+Dapp: Wallet name\n  Dapp->>+DarkEmblemAPI: Request nonce\n  DarkEmblemAPI->>+Dapp: Send nonce\n  Dapp->>+3rdPartyAuthenticator: Sign nonce\n  3rdPartyAuthenticator->>+Dapp: Signed nonce\n  Dapp->>+DarkEmblemAPI: Send signed nonce\n  DarkEmblemAPI->>+Dapp: JWT"
    }), "\n", _jsx(_components.p, {
      children: "Once a user is logged in, they can fully interact with the Dark Emblem WAX contract via the UI. They can purchase packs, open them to get cards, and then use those cards in the Dark Emblem universe. The UI lets users combine Hero cards together to “Ascend” them into a new card. Or they can burn 3 Equipment cards to “Transmogrify” them into a single, better equipment card."
    }), "\n", _jsx(_components.p, {
      children: "Users can also participate in Raids, where they stake their cards to defeat an enemy monster – gaining $DREM and XP when they beat the monster."
    }), "\n", _jsx(_components.p, {
      children: "Dapp Schemas and Atomic Assets"
    }), "\n", _jsx(_components.mermaid, {
      chart: "classDiagram\n  class Card {\n    name: string\n  img: string\n  traits: number[]\n  matronid: number\n  sireid: number\n  rank: number\n  packid: string\n  cardtype: string\n  website: string\n  twitter: string\n  mintedat: number\n  rarity: string\n  cooldown: number\n  xp: number\n  }\n  class Raid {\n  asset_id: number\n  owner: name\n  staked_at: number\n  raid_id: number\n  }\n  class Staked {\n  asset_id: number\n  owner: name\n  staked_at: number\n  raid_id: number\n  }\n"
    }), "\n", _jsx(_components.p, {
      children: "The Dark Emblem project involves a lot of moving parts, and I’d love to dive deeper into each technical aspect in future blog posts."
    }), "\n", _jsx(_components.h2, {
      children: "Additional reading"
    }), "\n", _jsxs(_components.ul, {
      children: ["\n", _jsx(_components.li, {
        children: _jsx(_components.a, {
          href: "https://www.darkemblem.com/blog/post/2023-04-02-new-site-released",
          children: "Dark Emblem Blog Announcement"
        })
      }), "\n", _jsx(_components.li, {
        children: _jsx(_components.a, {
          href: "https://capsulecat.com/blog/04-02-2023-dark-emblem-update/",
          children: "Capsule Cat Announcement"
        })
      }), "\n"]
    })]
  });
}
function MDXContent(props = {}) {
  const {wrapper: MDXLayout} = props.components || ({});
  return MDXLayout ? _jsx(MDXLayout, {
    ...props,
    children: _jsx(_createMdxContent, {
      ...props
    })
  }) : _createMdxContent(props);
}
return {
  default: MDXContent
};


<p>Dark Emblem is an NFT project that was sparked by the idea of combining cards games with Crypto Kitties. You can buy packs, open them to collect random cards, and then use those cards to battle raids with others.</p>
<p>To support all of the functionality, I created a WAX contract, written in C++, that I deployed to the WAX Blockchain. This contract handled the creation and storage of packs and cards, along with defining an in-game currency DREM.</p>
<p>There was also a server that would sync with the changes on the Blockchain and provide some additional metadata on top of that. While Blockchains like ETH have stable public APIs that can be used to query data from the Blockchain through 3rd party vendors, WAX does not have the same maturity there. This meant that we would need to proxy requests that would normally be made to a WAX API mode through our servers instead.</p>
<p>I also created a UI application to interact with the server and the Blockchain. The infrastructure ends up looking like:</p>
<mermaid chart="graph LR
  WAX --&gt; Dfuse
 Dfuse --&gt; Listener(Dark Emblem Listener Service)
  Listener --&gt; Redis
  Redis --&gt; API(Dark Emblem API)
  API --&gt; Dapp
  WAXEndpoint(WAX Endpoint) --&gt; Dapp"></mermaid>
<p>One of the first steps to interacting with the dapp is to sign in. The authentication flow is similar to an oauth sign in where we let the user sign in with a third party authenticator and then issue a challenge for the user to verify they are who they say they are. At this point we issue a JWT for further API requests.</p>
<mermaid chart="sequenceDiagram
  Dapp-&gt;&gt;+3rdPartyAuthenticator: Request sign in
  3rdPartyAuthenticator-&gt;&gt;+Dapp: Wallet name
  Dapp-&gt;&gt;+DarkEmblemAPI: Request nonce
  DarkEmblemAPI-&gt;&gt;+Dapp: Send nonce
  Dapp-&gt;&gt;+3rdPartyAuthenticator: Sign nonce
  3rdPartyAuthenticator-&gt;&gt;+Dapp: Signed nonce
  Dapp-&gt;&gt;+DarkEmblemAPI: Send signed nonce
  DarkEmblemAPI-&gt;&gt;+Dapp: JWT"></mermaid>
<p>Once a user is logged in, they can fully interact with the Dark Emblem WAX contract via the UI. They can purchase packs, open them to get cards, and then use those cards in the Dark Emblem universe. The UI lets users combine Hero cards together to “Ascend” them into a new card. Or they can burn 3 Equipment cards to “Transmogrify” them into a single, better equipment card.</p>
<p>Users can also participate in Raids, where they stake their cards to defeat an enemy monster – gaining $DREM and XP when they beat the monster.</p>
<p>Dapp Schemas and Atomic Assets</p>
<mermaid chart="classDiagram
  class Card {
    name: string
  img: string
  traits: number[]
  matronid: number
  sireid: number
  rank: number
  packid: string
  cardtype: string
  website: string
  twitter: string
  mintedat: number
  rarity: string
  cooldown: number
  xp: number
  }
  class Raid {
  asset_id: number
  owner: name
  staked_at: number
  raid_id: number
  }
  class Staked {
  asset_id: number
  owner: name
  staked_at: number
  raid_id: number
  }
"></mermaid>
<p>The Dark Emblem project involves a lot of moving parts, and I’d love to dive deeper into each technical aspect in future blog posts.</p>
<h2>Additional reading</h2>
<ul>
<li><a href="https://www.darkemblem.com/blog/post/2023-04-02-new-site-released">Dark Emblem Blog Announcement</a></li>
<li><a href="https://capsulecat.com/blog/04-02-2023-dark-emblem-update/">Capsule Cat Announcement</a></li>
</ul>


Dark Emblem is an NFT project that was sparked by the idea of combining cards games with Crypto Kitties. You can buy packs, open them to collect random cards, and then use those cards to battle raids with others.

To support all of the functionality, I created a WAX contract, written in C++, that I deployed to the WAX Blockchain. This contract handled the creation and storage of packs and cards, along with defining an in-game currency DREM.

There was also a server that would sync with the changes on the Blockchain and provide some additional metadata on top of that. While Blockchains like ETH have stable public APIs that can be used to query data from the Blockchain through 3rd party vendors, WAX does not have the same maturity there. This meant that we would need to proxy requests that would normally be made to a WAX API mode through our servers instead.

I also created a UI application to interact with the server and the Blockchain. The infrastructure ends up looking like:

```mermaid
graph LR
  WAX --> Dfuse
 Dfuse --> Listener(Dark Emblem Listener Service)
  Listener --> Redis
  Redis --> API(Dark Emblem API)
  API --> Dapp
  WAXEndpoint(WAX Endpoint) --> Dapp
```

One of the first steps to interacting with the dapp is to sign in. The authentication flow is similar to an oauth sign in where we let the user sign in with a third party authenticator and then issue a challenge for the user to verify they are who they say they are. At this point we issue a JWT for further API requests.

```mermaid
sequenceDiagram
  Dapp->>+3rdPartyAuthenticator: Request sign in
  3rdPartyAuthenticator->>+Dapp: Wallet name
  Dapp->>+DarkEmblemAPI: Request nonce
  DarkEmblemAPI->>+Dapp: Send nonce
  Dapp->>+3rdPartyAuthenticator: Sign nonce
  3rdPartyAuthenticator->>+Dapp: Signed nonce
  Dapp->>+DarkEmblemAPI: Send signed nonce
  DarkEmblemAPI->>+Dapp: JWT
```

Once a user is logged in, they can fully interact with the Dark Emblem WAX contract via the UI. They can purchase packs, open them to get cards, and then use those cards in the Dark Emblem universe. The UI lets users combine Hero cards together to “Ascend” them into a new card. Or they can burn 3 Equipment cards to “Transmogrify” them into a single, better equipment card.

Users can also participate in Raids, where they stake their cards to defeat an enemy monster – gaining $DREM and XP when they beat the monster.

Dapp Schemas and Atomic Assets

```mermaid
classDiagram
  class Card {
    name: string
  img: string
  traits: number[]
  matronid: number
  sireid: number
  rank: number
  packid: string
  cardtype: string
  website: string
  twitter: string
  mintedat: number
  rarity: string
  cooldown: number
  xp: number
  }
  class Raid {
  asset_id: number
  owner: name
  staked_at: number
  raid_id: number
  }
  class Staked {
  asset_id: number
  owner: name
  staked_at: number
  raid_id: number
  }

```

The Dark Emblem project involves a lot of moving parts, and I’d love to dive deeper into each technical aspect in future blog posts.

## Additional reading

* [Dark Emblem Blog Announcement](https://www.darkemblem.com/blog/post/2023-04-02-new-site-released)
* [Capsule Cat Announcement](https://capsulecat.com/blog/04-02-2023-dark-emblem-update/)


blockchain posts

Smart Contract Security

Dark Emblem Rewrite