NEAR NEARCON | 2022, 20 Sep 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: NEARCON 2022 | Doomslug Stage - Day 3

Description

Check out all the talks of #NEARCON Doomgslug Stage Day 3 with the timestamps below 🔽

00:00 - MC: Rim | Benjamin Mariano - Vanquishing Smart Contract Bugs with Vanguard
15:25 - MC: Rim | Igor Jerkovic - Building the NEAR to Calimero Bridge
32:50 - MC: Rim | Vitalii Yevlakhov - Scamfari Guide: HAPI on Tracking Hackers
46:36 - MC: Rim | Pavel Kudinov - NEAR Data Stack: Easier and Faster with Pagoda
01:02:22 - MC: Rim | Dennis Huisman - Test-Driven Design for NEAR Smart Contracts

Join NEAR's community:
Website: https://near.org/
Reddit: https://www.reddit.com/r/nearprotocol/
Discord: https://near.chat/
Medium: https://medium.com/nearprotocol
Blog: https://near.org/blog/
Twitter: https://twitter.com/NEARProtocol
GitHub: https://github.com/near https://github.com/nearprotocol
Dev Docs: https://docs.near.org/
Create a wallet: https://wallet.near.org/create
Apps on NEAR: https://awesomenear.com/
Learn to Build On NEAR: https://www.near.university/
Grants & Funding: https://near.org/grants/
#Blockchain #FutureisNEAR #NEAR #nearprotocol
#nft #dao

A

Hello, everyone welcome to the doomsluck stage. We are ready to get started for the first session of the day and for the first session we have vanquishing Smart contract bugs with Vanguard, and we have a speaker Benjamin to the stage. Please welcome Benjamin.

B

Cool hi everyone. Can you hear me first of all awesome um so yeah, my name is Ben and I'm, the vice president of research and development at Paradise, where we aim to improve blockchain security using formal methods today, I'm going to talk about one of our tools, Vanguard, which is part of a suite of tools that we're creating to make blockchain development safer.

B

um So, as all of you watching this probably know uh bugs and blockchain, software are extremely costly right. In the last year alone, uh millions of dollars have been stolen in hacks below. You can see a couple of the most recent examples of these hacks Each of which actually individually resulted in millions of dollars uh in losses right so I. Don't think I really need to stress too much uh how important blockchain security is, and actually the problem gets even worse right.

B

So new blockchains are being introduced all the time, and each of these blockchains support a variety of programming languages right so, for instance, near alone supports at least three programming, languages, natively and obviously there's a bunch of other blockchains out there, which each support additional languages like solidity and go and Haskell even to name a few. So all of this is to say that blockchain, the blockchain development ecosystem is quite diverse, right, which leads us to one of the central problems in this space right.

B

In order to make blockchain development safe, we need to stop bugs across all of the major blockchains and programming languages used by developers, which includes new languages and chains, as they appear right. um So maybe at this point in my talk, you might be asking yourself: should we just lose hope? There's too many blockchains, there's too many languages, there's no way we can make this safe. I guess I wouldn't be here. Giving this talk if I believe this in particular, despite the fact that I I do think this is a hard problem.

B

I believe there are ways we can meet the challenge right. So today, I'm going to talk about one of those ways which is Vanguard a tool that we're developing to address this challenge. So, in particular, Vanguard is a static analysis tool which is capable of detecting common vulnerabilities in smart contracts.

B

So here's a high level overview of the Vanguard Pipeline on the left. You can see that the user provides the blockchain being used like near, for example, as well as the source code of the program to be checked, so that'll be something like rust or solidity. That information is then sent to the Vanguard front end, which produces an uh instrumented code in a shared intermediate representation right. So in our case, that's llvmir, which is the intermediate representation used by llvm, which is a popular open source, compiler infrastructure.

B

The instrumenting code is then fed to our back end, which runs the IR against a number of what we call detectors, which each check for a different kind of common vulnerability in smart contracts uh to reduce the overhead of adding new detectors. Vanguard provides access to Common static analysis techniques from the research Community, including things like abstract interpretation and taint analysis.

B

Currently, Vanguard supports a number of detectors, including a re-entrancy detector, a flash loan detector and many others. And finally, once all of the detectors are run in Vanguard, a report is produced which describes the vulnerabilities discovered in the code and the layer location.

B

So overall, the kind of the high level picture to keep in mind Vanguard takes in the code. It runs a bunch of detectors and it produces a report of the issues that it found right.

B

So now that, hopefully we have like a very high level understanding of what Vanguard is supposed to do. uh Let me describe where I'm going to go with the rest of the talk, so first I'm going to introduce a near smart contract that we're going to look at as an example, then I'm going to actually run Vanguard live on that contract and show you what the output looks like and then finally I'll talk about some of the other things we're doing at Paradise to go beyond just static analysis in Vanguard.

B

So with that, let's first explain the example. We're going to be looking at So today, we're going to be looking at a raffle contract written in Rust for near, and it enables users to purchase lottery tickets in exchange for a chance at winning a prize right. So it operates pretty much as you would expect a raffle to operate on the right.

B

You can see the code which actually initializes the contracts it's contained in this lib.rs folder file and the raffle is initialized with the total number of tickets to be had in the raffle, as well as the account ID of what we're calling the prize distributor, which essentially, is the account that's in charge of actually sending the prize to the winner of the raffle when the raffle ends right.

B

So to give an example of how it would work on the left, I pictured our three resident gamblers, who are Charlie, Lucy and Snoopy, and in this case each of them buy a single raffle ticket right and they they pay for it in near which you can actually see on. The right is calculated by calling this self.ticketprice function in the buy tickets function.

B

um So now, because there are no remaining tickets, all the tickets have been purchased, the raffle is closed and a winner is chosen at random. As you can see in the highlighted portion on the of the close function on the right here, the Rand range function chooses one of the tickets at random from the sold tickets database. uh In this case, Lucy has chosen as the lucky winner and Snoopy and Charlie are sad right.

B

So note that when Lucy is chosen as the winner, the raffle contract actually makes an external call to the prize distributor contract telling it to send Lucy her prize right, and you can see I've emphasized that part with the red box on the right.

B

So this call will actually be resolved in a future transaction, which means that Lucy will be Center prize only after the distributor receives the message from the raffle contract right and in particular, once the distributor receives this request, they're going to attempt to send Lucy a prize and then the Raffles callback function is going to be executed, which I'm now showing on the right here. The Callback function uh first checks to make sure the distributor actually successfully sent the prize right.

B

So if there was some error sending the prize, the portion of code highlighted on red or highlighted in red on the right is executed right, which refunds everyone for their tickets. This is a bit conservative, but essentially we're saying if there was some error and we couldn't choose a winner, let's just give everyone back the money for their tickets and then after this, regardless of whether or not we refunded um we reset the raffle, so we can run it again in the future.

B

So this is kind of like a high level overview of how the raffle contract is supposed to function. So um now that we've had a chance to kind of get a at least shallow understanding of that I'm going to actually run Vanguard on this example and show what happens so hope.

B

This works Let's uh run over here, so to run Vanguard we're just going to run this script, it's going to build the contracts very quickly, and then we can see that the output here Vanguard raises three different warnings right and we're going to focus on the first warning here, which tells us that this callback function that we've been looking at. The called clean price callback has public visibility. Okay, so let's actually look at the code to see why this is a potential issue. So here's our claim price callback function. This is the same function.

B

We were looking at in the slides and we were warned that it's public right, and indeed it is public, which means any user can execute this code. It actually looks like our developer knew what they were doing right. They used this hashtag private annotation that they're supposed to which would make this ostensibly a private function. However, they made one mistake, which is that they included it in a comment by accident.

B

So actually, this is going to be completely ignored, which means anyone can execute the Callback function right, that's pretty dangerous because it means anyone at any time they want, can reset the raffle and they can also refund everyone right. So probably not what you want, certainly if you're the raffle owner. So luckily, here the fix is actually quite simple: we're just going to remove the comment and let's rerun Vanguard, and so it's going to recompile the contracts and we'll see that we're down to only two warnings and that warning has disappeared.

B

So here's our two remaining warnings and you'll actually notice that both of them uh mentioned flash loan attacks so they're both related to a potential flashlight. So before I jump into this one I'll just say at a high level, you can think of a flash loan attack as being when an attacker can manipulate the price of an asset right and obviously that could be really bad right. If you have a lot of investors who are invested in an asset and an attacker can tank the price of that asset at any time, they want.

B

That's obviously not going to be a a good quality that the investors are looking for right. So let's actually look at what Vanguard says in particular, so here it tells us there's a potential flash Loan in the claim price callback function that we've been looking at and in particular it tells us that after this transfer it can be manipulated by some call, that's going to occur on line 91 of our contract. So let's hop back to the code and see how there can actually be an attack here.

B

So this is the transfer it's referring to in the Callback function. So recall. This is where users are refunded uh in the event that something went wrong and the winner wasn't sent their prize right and it we were told that the attack can occur through the the call on line 91 and on line 91.

B

You can see that we compute the ticket price right, so the bug is actually going to be in the ticket price function which we have defined down here, and so, if you look at how we Define the ticket price, we take the total number of tickets in the whole raffle.

B

We multiply it by some big number right, 10 000 in this case, and then we get oops. Sorry, we get the current uh account balance of this contract right and it's actually, this very last part that's going to be exploitable here in particular. This is something that an attacker can change right. They can send near to this contract, for instance, and if they do that the denominator here, so this is divided by right. So if they make this value very large, then the total ticket price will be very small right.

B

So a motivated attacker can tank the price of a raffle ticket here, probably not desirable, so we're just going to fix this bye see making the ticket price constant right. So hopefully this should remove the flash loan right, because now all tickets just cost a hundred right. So, let's see, if that solves the problem, and now so contracts are compiled and we can see there's no more warnings from Vanguard.

B

So let's hop back to the presentation now cool, so I hope that gave you like a taste of how I think Vanguard can be really powerful for making blockchain development safer right, follow like finding these common vulnerabilities that are easy to have in the code, but can have very serious consequences right. But now I'm, going to kind of like take a step back and say that well, Vanguard, I, think, is a really important step towards a safe, blockchain ecosystem.

B

It's not a silver bullet right, so in particular, Vanguard focuses on finding what we've been calling common vulnerabilities right like flash loans and re-entrances. um But it's important to note that actually, not all vulnerabilities are common right. So, for instance, um some errors are actually specific to a given blockchain. So this scary warning is from the near documentation and you don't need to read it all.

B

But essentially, it's saying that, unlike many other smart contract languages near resolves, external calls asynchronously right, and this means that the result of an external call won't be known until some transaction after the current one.

B

um This means that callback functions are necessary to update the contract state in the event of a failed external call right, and this is actually exactly like the example I was just showing with the raffle and that callback function uh that helped us handle the case where the prize distributor did not send the prize to the winner right, and this means that we need a new suite of techniques for reasoning, about callback functions and vulnerabilities in general, caused by external calls in near because of the way that near is handling these differently than most other languages.

B

So, for instance, this affects the way that bugs like re-entrencies are actually even going to occur in something like near versus the language.

B

um You know like solidity operating for uh ethereum right, so some errors are actually specific to a given blockchain or language, and actually some errors aren't even specific to a blockchain or language, but they're actually specific to a particular contract right. So this is actually the same callback code that we've been looking at the whole talk right and here pay close attention to the part that I've highlighted in Red.

B

So here the developer accidentally negated the condition of this if statement, meaning that everyone's going to be refunded only if sending the prize succeeded right, in other words after the prize is successfully sent, all of the ticket buyers will also be refunded right.

B

um This is definitely not the intended behavior and you would certainly be very unhappy about this bug if you were the owner of the raffle ticket right where you've sent out the the prize and then you've also refunded everyone for the tickets they've bought, um but actually catching a logical bug like this goes beyond common vulnerability detection right, because this isn't a common vulnerability, it actually needs to reason about the intended behavior of the contract.

B

um So, in this case, users should only be the the property that we're interested in is that users should only be refunded if the prize isn't sent right. Otherwise, uh no one should be refunded because the winner successfully got their prize okay. So um to address these concerns, Paradise is actually developing a suite of tools um that are focused on addressing all the security concerns that we can have in blockchain.

B

Development um I could probably go on quite a while about these, but because I'm super excited about them and we're super excited about them at Paradise. But, given time constraints, I'll just mention a few here to wet your appetite. So one really interesting effort we have going on is our V specification language which allows users to write custom logical specifications like the one we were talking about for the raffle contract?

B

um Another really cool project that we have is Magi, which is, is a symbolic executor for Cairo, um and another cool project is Euros, which is a attack synthesis tool for solidity.

B

um So if you're learning or if you're interested in learning more about any of these projects or Veritas more generally give us a follow on Twitter check out our website, we have a medium where we post blog posts about what we're up to so definitely check that out. uh Thank you so much. That's the end of my talk.

B

Do we take questions or no.

A

Unless you want it to unless you wanted.

B

I I'm happy to take a question: if there are any questions.

A

Are there any questions, maybe for Benjamin.

A

If I guess your.

C

Presentation was amazing.

D

B

A

Everyone thank you Benjamin yeah. Thank you. So much.

A

Thank you once again for the amazing talk. The next speaker is Igor from kalimero, and the title of his talk is building the near building the near to kalimera bridge. Please welcome Igor to the stage foreign.

D

And I'm the core developer at calimero. Can everybody hear me great I'm, the core developer at calimero and today I'll be talking about how we've built the bridge from near to calimero. But first of all in case you don't know what calimero is I'll tell a sentence or fuel, so the kalimero is a near side chain which allows you to have a private sharding. So what? What does this mean? Is that if you're a government or an Enterprise, you probably don't want to put all of your sensitive data on a public chain?

D

But still you want to have you have some use cases for you want to use the properties of a blockchain. So we we try to come up with a solution so that your data is not siled in a private chain, but that you can somehow communicate to have some interoperability with a public mainnet. So that's why we built the calimero bridge and what we?

D

What we did here is not only transferring FTS nfts, but also we've built the ability to call any contract if it's programmed that way, so that you can read some state from a public chain into the private and you can execute all kinds of um logic right.

D

So what the kalimero bridge does it allows you to bridge fungible tokens, non-fungible tokens and you can do cross-shard contract calls between near and the calamera private shards.

D

So some of the properties of the Calimera bridge is that it's trustless. So what the? What does this mean? It means that anybody provided that you have the access to the kalimero network can run a little relayer and they can relay light climb blocks from kalimero to near and back it's automated. What does this mean? It means that all the as I like to call it the magic, as there are many calls being executed around it's it's all being done by the kalimero bridge service.

D

For you, it's very easy to use, since you only need to to send one signed transaction with the intent. What you want to do transfer either from kalimero to near or back and it's fast. We we we're able to bridge assets and do crushard contract calls in 5 to 15 seconds, depending on the on your use case.

D

So this will be a fairly technical presentation, so um I assume that the audience knows some of these terms, but I can quickly tell a sentence or two: what what are these uh components? So relayer is the simplest component of of them all for the bridge to work. So what a real layer does? It's? It reads: latest light clients block on a source chain and sends it to the destination chain.

D

So in in order to have a bi-directional bridge, you need to run a real layer from kalimero to near and from near to kalimerum what the light client contract is. It's it's uh it's a contract that will verify whether a light client block is actually valid. The and you can read about this on a Nomicon like the near blocks- are valid. If there's there's actually six rules, probably the most important one is if at least two-thirds of the staked validators have signed the the block.

D

If the signatures are valid, then the added light client block to the contract is valid and, of course we have the prover contract when you provide with some proof data which is which is essentially Merkel pets uh and the height for which you want to prove some transaction or receipts.

D

The prover contract will tell you whether the the transaction is valid or not, and for the bridge to work. We have three more contracts, we have the fungible token non-fungible token connector and the cross shard uh calls connector contracts, but the ft and nft are pretty much similar. So the only difference with ft and nft is actually in one method in the Ft transfer call with nfts, it's nft transfer call, and you say which token ID you transfer, while in the FTS you specify the amount you're transferring so this.

D

This is the same and I'll show you both boat connectors, all three of them. So first, let's see how to bridge some fds or nfts from near to kalimero.

D

So these are all the components that are needed to make the bridge work. So, on the left side, let's see if the laser works it doesn't, but okay yeah, it's not seen. On the left side. We have the calimero shards, which is a private Network. On the right side, we have the near blockchain, so we have already deployed the light client contract on kalimero, the prover contract and all three of the connector contracts.

D

Also, we have the validators, the archival node and the indexer, which are all needed for the network to work and to communicate with it, and we have the same thing on near side as well. In the middle we have the relayers, the bridge service and the message Cube they're not on on either chain their their services ran separately independently of of the blockchain.

D

So the first use case is that the user or adap wants to transfer some fungible tokens from near to kalimero.

D

So what happens is that the user will find a transaction where they say I want to transfer some usdns usns in on testnet is called usdn for some reason: I guess the usn was taken that account ID, so the user will call ft transfer call on the usdn fungible token, with the arguments that the receiver ID is the fungible token contract on near, and he specifies how what's the amount of fungible tokens that the user wants to to transfer.

D

So what will happen next is that the Callback FD on transfer will be triggered on the connector contracts on near and it will emit the kalimero event that we call calimero event lock, which says this FD usdn.testnet from ige.testnet account ID that account wanted to send 400 usdns.

D

So what will happen next is that the events indexer will pick up this event propagated to the message. Queue and message queue will immediately send this event to the near to kalimero relayer.

D

So what is this? This clicker is not working anymore, oh, okay, so the real layer, what it does next it'll go and fetch the light client block from the archival node. On near and immediately when it's, when it fetches, it it'll, try to add the light client block onto the light client contract on kalimerum.

D

Just to to recall what I said three slides ago, if the height of that block is higher than the previously stored, if it's in the same Epoch or the the next one and the most important. If, if two-thirds of the stake of the validators that signed it is valid, then it will be added to the Lite client contract that block. Actually, the most important information is the block Miracle root hash for that height that will be stored in the Lite client contract on kalimerum simultaneously. The bridge service also receives this event from the message queue.

D

What it then does it fetches the latest known height from the light client contracts, and if this height is at least high as the block Heights, as in the receipt where the lock, where the where the Ft was locked on an ear, it will go and fetch the light. Client proof data with this. The bridge service will call the prove methods. It will call proven mint on the Ft connector contract.

D

On kalimero and it will try to prove through the prover whether this proof is valid for that receipt, that we're trying to prove, and that is that the events that the Ft was actually locked on near if the prover calculates the same hash as the block Merkel root hash, that's stored in the light client contracts. This means that the user locked FD sonir and we proved it on kalimerum.

D

So now, when all of this passes, a new ft is minted on calimero sides, and if this is the first time the bridge Services transferring that specific ft, the bridge service will also deploy that bridge the token. So the first transaction can take a bit longer, maybe 30-35 seconds, but all the other transactions for that specific ft will be much faster, um also, the account that sent from near to kalimero they're being mapped one to one.

D

So if it's name dots near or near that sent FTS on kalimero, it will also be name dot near okay. Let's now see how to withdraw FTS or nfts from kalimero back to near so the user or adapt calls directly. On the fungible token, that's deployed on kalimero that he wants to withdraw some amount of tokens on that ft.

D

What happens is that essentially, that ft is the amount that the user specified they will be burnt and what happens then on FD on on transfer the the Callback it will on the Ft connector, the calimero burn event will be emitted, and now we want to prove that this event happened on kalimero. We want to prove it on near so again the event the events indexer on kalimero will put this data into the message queue and the message queue will send it to all the subscribed parties, which is the kalimero tunir relayer.

D

The relayer will then read. What's the latest light client block on kalimero, it will try to add this light plant block on near if it's valid it will be added simultaneously. The bridge service also receives this event.

D

Fetches, the latest known height, if this height is higher than the height where the FTS were burned on kalimero, it will go and fetch the light, client proof. Data you'll then go try to prove and unlock on near. So now the FTS are burnt on kalimero. We just need to prove that this actually happened so to the original user on nearsight the FTS can be unlocked, so we we try to prove called the prover. If you calculate the same hash, it's proven and the ft is unlocked on near side, so we've successfully withdrawn.

D

The ft is back from kalimero to near now. Let's see how we do the cross Shard calls from near to kalimero and back so here we actually have a depth, and this depth is already deployed on here, but I put it here in the middle.

D

So it's easier to follow the arrows, so somebody, some user, called a method on adapt that will do a cross call to the connector or near so what this means is when we execute such method on the depth on near this event will be emitted and it has a bunch of arguments. The first of them, let me see if the laser will work. Yeah, it's not okay. You should look at the lower right corner, so you see this kalimero event cross call. The first argument is the what's the contract ID on kalimero.

D

What's the method name start game on kalimero on that contract that we want to call on kalimero, then we have the input arguments that are in in Json that are actually base64 encoded. We have how we specify how much gas we want to pay on calimero's side, how much we want to deposit to that contract. What should be the Callback contracts on near when the when that method is executed on kalimero and what uh what method should be?

D

The Callback methods on an ear which is here, game started and this event gets picked up by the events. Indexer gets sent to the message queue the real layer from near to kalimero receives. You have some interesting event: try to uh let's, let's, let's do all the next steps oops, so the relayer then fetches the light client block.

D

It adds the lights, client yeah, it's ah yeah. It adds the light client block to the light client contract on kalimero Bridge service simultaneously receives this event as well.

D

It fetches the latest known height from the calimero Lite client contracts, and if this height is higher than the height where, where we executed the, where we started the cross call on near, we can try and go and prove it so we'll fetch the Litecoin proof, data from the archival node on an ear.

D

We call prove on the cross, Shard connector on kalimero, if it's proven we'll execute that methods on the depth on the contract on kalimero, the connector after after it's executed will emit this kalimero event cross response event, which is which is seen in the lower left corner with the arguments.

D

What's the depth that should be called back on near was the Callback method and what was the execution result of that method that was called on kalimero and, of course, if that method fails, you'll also get that it failed back as an execution result, you'll get it in your callback methods, and now we need to prove this event that it happened actually on calimero. We need to prove it to near, so we just need to flip everything.

D

I didn't draw it draw this to not prolong it, so we have some time for Q a So This, Is How, We Do, the cross Shard calls. If you have any questions, we have few minutes left yeah go ahead.

E

One two: three hello, hello,.

E

Is it not the same like part.

D

um Yeah it it could have been the same, but you can have redundancy you can you can run multiple relayers? Maybe some real layer is down yeah, okay,.

E

D

We also have a boat there and we can show you a demo if anybody is interested.

D

Okay, if that's it, thank you and see you at the boots. Thank you. Thank.

A

A

Thank you once again, Igor for the Lucid presentation on kalimero. Next, on stage we have Italy from hoppy and his type. His talk is entitled: scam, fairy guide hoppy on tracking hackers. Please welcome Vitale to the stage.

A

I will try that again. Please welcome Vitaly to the stage.

F

Hello, everyone, so it's kind of my private ASMR session today, but uh yeah, it's just a joke. So instead of ASMR you'll get me rambling about this cyber security today. So today, I want to talk to you about the copy protocol. So what we work on is basically an on-chain cyber security protocol uh bearing the kind of pretentious slogan we are actually doing something valuable I suppose. So, let's move to the what we are doing exactly so. The idea of happy is to be the AML compliance and kyt kind of uh on chain solution.

F

So right now the only compliance and AML you have is basically centralized entities pushing their agenda onto the D5 protocol. So what we want to do is basically to have the equivalent of the centralized uh compliance that is basically on chain, so how we are doing that. uh Basically, we have on-chain database. We store malicious addresses on that database. uh We store a lot of addresses there, so we cover nearest near blockchain. We cover ethereum, we cover being B chain.

F

So uh the idea is to provide the D5 space with the ability to connect to our on-chain database and to have them use our own chain database to prevent money laundering to prevent terrorist financing to prevent any kind of malicious activity. So you might ask how it helps the ordinary user. So for that we have a b2c solution which is business to customer. We offer people uh Private Investigations, so you can basically go to our website and have us investigate cases of malicious activity that you personally encountered.

F

On top of that we offer prize pool for the submission of malicious addresses, so we have a kind of solution, side solution of ours that basically allows people to uh upload and submit addresses malicious addresses and get in return uh price Rewards. So uh we our goal. Our objective is to create self-sufficient on-chain database that is basically supplied by users. uh That is basically is free of charge. uh You can use our copy uh protocol for free. You don't need to pay, you can use it either via API or by using smart contracts.

F

So how does it work? How does it work so.

F

So normally you have, uh for example, you have decks. uh Dex is uh dexes, usually connect via Smart contracts, so what we offer to Dexys is basically the ability to cross-call uh Happy smart contract when you are doing that, you are basically having the ability to vet addresses uh on chain. So where do we get the data? uh As you can see, we have data provider. What it means is basically that we have a several sources of data, so those sources are basically uh our data providers.

F

They are chain analysis, for example our main data provider. They are basically the leading ml compliance and crypto intelligence provider right now, so we get data from several sources, including our data providers, but we also have our own happy Labs Department, which is basically a investigative Department which investigates cases of malicious activity around the blockchain.

F

So we aggregate all of the data we aggregate data from chain analysis from other data providers uh that is open, source or not so open source. Sometimes we have to pay them, that's how it goes, but our idea is to create uh the aggregated data, around malicious activity, aggregate the data and, basically to dish out the most accurate uh information and data on the malicious addresses.

F

So with that data, you can basically uh prevent some of the cases of money laundering. How we do that so in order to prevent money laundering uh in terms of sex, centralized exchanges, you basically need to connect to them directly. So for that reason we are partnered with several of them, not all of them. Unfortunately, but we have already partnered with cookware ascendex bitmart. We work closely with them.

F

uh We are trying to establish uh the copy framework which basically will allow to everyone who who is connected to happy the entities connected to help you to to basically instantaneously get the data about malicious, malicious addresses, malicious activity in general, so they will get uh that data instantaneously. They will be notified about any malicious activity and in in the case of any exploits hacks or any of that stuff, they will get notification and they can basically stop the transaction. Blacklist transaction Blacklist addresses all of that stuff.

F

So, however, our main objective is to guard defy. Our main goal is to guardify and we are trying to do that uh by keeping the decentralized ideals intact. So we are not trying to bridge the you know: blockchain ideals, any of that sort. We are trying to create a solution that is basically equivalent of the centralized entities that push compliance that push uh kyc and so on. What we are trying to do. We are trying to push new uh kind of meta.

F

We are trying to push kyt, which is know your transaction and based on the transactions. You can act on that address. You can add it to blackly. You can Blacklist it. You can decline transactions in case of dexes, for example. If uh if a certain address is considered malicious, we can basically decline the transaction from that address. uh Again, we are a protocol, we are we as we are called happy protocol. We are not a decision maker, so our protocol is highly configurable. You can configure a risk score. You can configure risk threshold.

F

You can configure anything from. You know how what kind of category of risk you want to allow or disallow Everything is configurable. Everything is up to you at your own discretion. So uh the slogan kind of identify, notify and prevent is uh our slogan. We are trying to trust and foremost, to identify whether the given address is malicious or or not. We, our goal is to notify again notification and not the decision making on our part and prevention, which is in the case of uh adoption of hobby.

F

The prevention will come itself since uh hackers will kind of you know, see the happy logo and uh they will. They will have less of a incentive to actually go and do their dirty stuff.

F

So, as I mentioned briefly before, uh we also want to push uh and have users contribute to our data directly. So how do we incentivize users so recently we launched scamfari, which is which basically allows you or ordinary users to contribute malicious data to contribute addresses directly to our smart contract.

F

So by doing so, you get rewards uh the last time we had that we had a price full of thousand five thousands usdt uh right now. uh The second season will be 10, 000, usdt prize pool. So we expect people to provide us with valuable data and we give them in return rewards. So last time we had a scamfari season, one we had around 20 000 addresses uh submitted. So that's a huge success for us and I hope. You guys can also get to share the success and we also are rewarding you for that.

F

So uh that's! Basically what I wanted to talk about uh today, so our main goal, you can basically separate it between B2B solution and b2c solution. Our main objective is, of course, to guard defy from the potential malicious acts that can happen in the D5 and uh I hope that user engagement can be a lot more active in this Regard in the cyber security space in general, because you know right now, we are kind of uh resorting to centralized entities pushing their agenda in terms of compliance, but I think in D5.

F

We can make our own mind on how we want to structure our security, how we want to structure our cyber security and so on. On top of that, right now in D5 we have only one layer of security. Basically, it is smart contract orders. What you do after that, if a hack or exploit happens and, as we all know, the uh smart contract over these are in no way uh the 100 proof that it won't happen. So what do you do next, for example, when it happens?

F

This is why coffee is basically exists to help the uh post factum of the case of the case of exploit, so we are trying to help defy protocols again for free. We are not charging anything. uh You might ask how we make our Revenue, that is yeah. That is a question we make our Revenue based on the Private Investigations, as I mentioned mentioned briefly mentioned before, so uh we basically tackle Private Investigations from users also from businesses. uh We work again with a sandex, coupon bookmark.

F

We help them to trace, identify and track the activity within the blockchain. We also get a lot of cases of malicious activity from our partners like analysis.

F

They provide us cases that we jointly work on so uh I think that's, basically it what I wanted to talk to you about and I hope that as many people as possible can cooperate together on creating this cyber security Hub, not only within the new record system, but also outside, because happy is cross-chain protocol and we hope to cover all of the chains and- and we need your help in this regard, because the community around blockchain, the community within the blockchain space, is basically what makes it uh great.

F

So, thank you any questions you have please uh yeah.

E

Hello, and so you said that you wanna prevent the hacks to happen on defy So. You you're gonna, like have a list of Bad actors.

F

So we don't have a list of Bad actors. The only thing we have is a list of addresses. Our goal is to not de-anonymize the users. Our goal is to have a list of addresses, have their rescore respective rescore respective risk category, and that's it that's all. We do.

E

Okay, so you you track respective like good addresses, not better addresses or sorry so, which kind of addresses do.

F

You track with track or we try to track all of the addresses. However, it's impossible, because we need a lot of uh processing for that. We try to re react on the cases that happen, so the most important thing in the cyber security space within the blockchain is to react promptly. So, if you are to react promptly, you can basically help to Stave off the laundering of assets.

F

For example, if a hack happens, the perpetrator tries to launder their assets on centralized exchanges within this time frame that he has to launder their assets to get there to to the sex. We act on that time frame. We notify sex, we notify decks automatically because we have it in our database, uh given that we already have it reported to our database. So we react to that. We notify them. They freeze, freeze or block the transaction block the funds in case of sexes and in case of taxes they can just decline. The transaction.

A

If there, if there aren't any more questions, please think Vitali once again for the great talk. Thank you.

A

Since we are running about 10 minutes early, we'll give everyone a break, get some drinks get some Donut from the donut wall and we'll be back in 10 minutes with pavel's talk from pagoda hello. We are ready to get started again for the doomsluck stage sessions. We are back with the near data stack, easier and faster with Pagoda and as our speaker, we have Pavel from progoda. Please welcome Pavel to the stage.

G

Hi everyone you hear me: okay, oh there's a bit of echo, awesome, how's everybody doing it's! The last day of the conference, tired excited learning a lot, I'm, definitely learning a lot. Let's uh I need to learn how to use this clicker. Now uh today we wanted to present you some uh uh uh some data stack achievements that we made with the team. I wanted to first say they present Tiffany.

G

She could make it today for the conference, but she joined near two years ago and most of this work she continued contributed to most of this work. She now is based in the US and I hope you can chat with her in Twitter and other platforms leave feedback on our Pagoda platform as well.

G

She reads it, but I'm Pavel I joined Pagoda this year, I'm excited about data I spent 15 years in the industry, working on different data products, I'm a blockchain user since 2017, and this year, I decided to make it my career and I live in Vancouver Canada. So if you're ever in Vancouver want to chat about crypto and near make sure to message me, um what is what is Pagoda? So Pagoda is the easiest web3 startup platform to build your dabs on near. You may have used many of our open source tools already.

G

You may know about them already. They power our devs over there, where the largest contributor to the near protocol as well, and now we're adding even more tools to make it easier for you to build devs on near and some of these tools I want to talk about today.

G

uh So what's data stack, uh we set ourselves on the mission to make it easier and faster for you to unlock, to build adapts to unlock the full power of data and to accelerate your build essentially to get to Market much faster, to understand your smart contracts better and to empower your growth.

G

So, as a builder, you want a better user experience right for your adapts and obviously you spend a lot of time, building indexers and getting data from the blockchain. So we want to make it easier and faster. You want to understand, what's going on with your smart contracts faster, and you also build indexers to do that, so we're gonna just give you some tools for that, and once you get to the draw stage, your product owners want to see the insights to the the usage of the app the adoption.

G

So we give you these insights out of the box as well. Let's talk a little bit more about that. Actually Beyond indexers anybody used indexer framework before anybody knows what it is. uh No great. Okay, so I need to introduce indexer framework. Basically, if you want to quickly query historical data from the blockchain, you need something called indexer and uh for uh many I would say more than a year, maybe more than two years we're offering uh something called indexer framework.

G

You can spin off your own near node and you can rest uh run it in a with a flag to index blockchain, and you can run some custom rust code to aggregate the data and put it in some database and then build an API and and serve it to your users, and many of our divs on near are actually using just that.

G

But, as I mentioned, uh you actually need to maintain a node, which means you need to have a developer, and you also need to have a rust developer and you need to scale it and you need to make sure it always works. Otherwise, your users won't see the updated data right. So a few months ago we introduced something called near Lake. Anybody heard of near Lake awesome: okay! Well, that's great! You heard about your league, but you didn't hear about index service and that's awesome.

G

But the good thing about near lake is that you can build your indexer without running a node. You don't have a node anymore and you don't have to maintain this node in the cloud and you don't need to know rust. We essentially stream Json files from the cloud right to your server with a very small delay. This reduces your monthly cost. By up to 25 times you can get started much faster, it's very low maintenance. You can use JavaScript, Python and rust out of the box.

G

We have sdks and actually you can use any language you want. You can write your own SDK very easily, it's a very small piece of code and with stream data right from AWS. But if you don't like AWS, you can run your own near Lake indexer and run your own AWS S3 compatible storage in the cloud.

G

So how do you get started? You log into Pagoda, and you navigate to indexers tab on the left bottom and you go through the tutorials there. It literally takes you well, six. Six minutes is probably exaggeration. It takes you less than six minutes to start streaming blocks from the blockchain with JavaScript. You spend more time setting up typescript project than setting up near League, uh and uh there is a great tutorial on the nft indexer over there with typescript.

G

So you can just start indexing nfts right away with that example, um and if you find yourself indexing, fungible tokens, uh non-fungible tokens balances of different accounts, uh and you want to show it to your users if you find yourself building indexers for that, you don't have to do it anymore. At this conference we announced enhanced API it's available in Pagoda. You grab your API key and you just start using it right away. We indexed over 1000 fungible tokens and we're indexing them as they appear so every time.

G

Somebody creates a new token it immediately and if it follows the standard, it immediately appears in the enhanced API. So you can just hook it up to your front end and see it right there. You can see the balance history, you can see the metadata of all the tokens, the icon and everything. There are interactive documents on Pagoda. You can just log into Pagoda dot.

G

Consolepagoda.Co get your own API key for the enhanced API, navigate to document annotation that you see on the screen here and just try it out, and you can see the curl requests over there. You can integrate it directly to your front end and then, if you find yourself writing indexers to alert yourself or your product managers about something or just just to integrate to web 2 world with HTTP requests or some other way.

G

You also don't have to do it anymore because we are into we have introduced alerts um you log into Pagoda, you go to alerts section in the alerts section you can create, uh you can input the smart contract name and it doesn't have to be a specific smart contract. It supports Factory pattern as well, and then what we will do is in the back. In the background, we will start listening to uh everything that happens with that smart contract.

G

Essentially, we spin off our own listener, our own uh indexer, and then we execute a rule that you specify and the rules are successful actions, failed actions, events and other important things. So you put the balance drains. You set up this uh this Rule and then, with this rule you can Target all the actions to let's say a web hook and this with this web hook. You actually have unlimited possibilities of integration to any app and you can create your own.

G

Lambda function, your own server, whatever you want, or if you just want to know when something fails. It's a great observability tool because, with this tool, you can be alerted on all the failures in your Telegram and if some of your product owners doesn't use telegram, which is a bit weird, but you you can do it with email right right away as well with some distribution lists, let's say so log into pagoda.co console.co! Try it out.

G

It's super easy less than one minute to set up and you can get reminded of, let's say all the errors that happen in your smart contracts inside of your Telegram well yeah, and if you miss this alert, you can always log in back and see the history. Great, so alerts is a great observability tool for on-chain data. Now what about the RPC usage?

G

If you get an API key for the RPC service that we have, you can log into Pagoda, go to RPC stats page and you can get almost real-time insights to all the requests that are being made to RPC nodes. Basically, all the view calls all the transaction requests everything you will see right on the page. You will see in the number of field requests, you will see the latency and you know with alerts and RPC stats. You actually feel more in control of what's going on under the hood of your app that's great.

G

What happens with you know, uh with the users with the usage as a product owner as a builder I'm, always interested uh to see the adoption of my software. You know it feels great to see new users, and you know you launch an app and uh today and uh you you need to build some sort of analytics.

G

Maybe you have Google analytics, but you don't know what's going on on chain right, you want to see what's going on with your smart contracts on chain, so with uh background analytics, you can get it out of the box. Actually, every time you add a contract to Pagoda project you can navigate to analytics and analytics is ready there right away. You can filter by all the smart contracts that that are of your interest and you can filter by time.

G

You can see 21 important, metrics there, basically daily weekly monthly, active users, transactions and volumes transacted gas spend balances, basically all the important things about your smart smart contracts. So what did I show you today? I spoke about near Lake. Now you can build your own custom, indexers 25 times cheaper and much faster, and not only in rest. I showed you enhanced API, where uh with with which you don't have to build indexers for tokens and nfts with alerts and RPC stats.

G

You get Fantastic, observability, Tools and Integrations with alerts and with analytics you get great Observer a great uh overview of what users are doing, so you can grow your apps faster. Let me talk very quickly about what's next and what is what is our vision? Here? We spoke about a lot of our open source tools.

G

Many of these tools are actually these features are powered by open source tools and we see hundreds of projects using them today to deliver all the dabs that we all are using that everybody is talking about on this conference, but we want to bring It Forward.

G

um You know it still takes time for Builders to show aggregated and historical data on the uis. So, on the left, you see that you, you need to have an RPC node or a lake indexer. You need to use some public Cloud. You need to use some database, probably an SQL database.

G

You need to use all these tools together, build a custom, API host it in the cloud scale it if it doesn't work react to the errors. You basically need to have a software engineer that does just that.

G

What if we offered something that just works from day one we want to bring data infrastructure to you through Pagoda, apis, right away and with Bugatti apis. You can get all the key data. You need query historical data. Build aggregations shape it in the way you want and get it right to your front through a simple API that scales that doesn't work that does work without any extra maintenance uh and and very much less engineering effort.

G

um If you want to chat more about it, I'm very excited to talk about it. You see how excited I am. Please come to the our booth. uh We. We can chat more about your use case if you're struggling with building indexers I I'm I want to do some user research. So please come and talk.

G

um Oh, there was an animation here we go. uh Pagoda API will replace all that um so subscribe to our Twitter uh get Pagoda account if you haven't gotten it yet try out all these features, uh I'm excited to see what you build with them. uh So how how I will know when you log in there is a small button on the button on the bottom right. The feedback uh don't only leave feedback but leave uh something some information about your project.

G

So we know what they're rebuilding with that, because we really want to see how it helps and where we can make it better. We're really looking forward for that and, um of course, come to our booth. As I said, we will be there if you want to have a walk through a demo of these features or if we can even set it up for you over there. So we're looking forward to seeing you there.

G

uh Thank you so much I have a little time for questions, but I'm not sure this audience doesn't ask me any questions but I'm ready. Thank you.

G

All right so see you at the booth.

A

uh Thank you Pavel for the excellent presentation. Next up, we have Dennis from the near foundation and they will be talking about test driven design for near smart contracts. Please welcome Dennis to the stage.

C

Great. Thank you.

C

Hello tests yeah just gonna, set myself up here for a moment. I will uh be screen sharing so.

C

I was scheduled for 120. shall I wait until that time before I start or.

C

I, go yeah all right. Well, uh welcome everybody uh to this uh short presentation on tdd of near smart contracts uh before I kick off, I want to do a quick show of hands who here already implements tdd and their uh depths or applications.

C

Okay, oh wow! This is great. This is great. Okay, so I've got a treat for all of you, um so let's go um yeah I'm Dennis, um oh yeah, that's a key Palm on my face right there. This is uh Benji's laptop colleague of mine and keep on this is Project's mascot uh yeah by the looks of it hey hijacked, my presentation and I.

C

Think there's like a finding Waldo of this logo, everybody everywhere, um but yeah I started my uh my career in data and analytics making dashboards for corporations and then I went into uh fintech API development and uh January.

C

This year, I came across the year and um uh yeah got to know a little bit more about it and uh quickly fell in love with it and then I uh I wanted to choose a starting date, and I chose uh well appropriately, February 14th to start uh to start a year, and ever since then it's been, uh it's been a a very passionate Romance uh yeah. Who are we here at Pagoda?

C

um Well, if you guys haven't heard the previous chat, uh it's uh we make sdks we make uh the docs for near. We met we're uh the main contributors to the core protocol um yeah, you name. It uh CLI tools, these kinds of things to make uh uh yeah the life easier for developers on on web3 and uh near protocol, so yeah, let's get to the Jews. So um what STD? Our contents will be.

C

uh Yeah, we'll go by the definition run through uh the costs and benefits I'll be asking some questions see if some people have some input there uh and then uh I'll get coding, so I'll show you guys how it really looks like um yeah. So what are the costs and benefits of tdd um yeah I'll start by the costs? uh Nothing comes for free, so uh yeah, it's gonna.

C

Take you some time to learn it uh whatever framework you're doing, uh if you want to automate that that's also going to take you time to learn and get used to um yeah the CI CD overhead as well you're going to have to implement that too. uh It's all a little bit of extra time at the start, until you really get used to how to do it, and uh it's it's a mind shift uh it really.

C

um Yeah ux may fall behind the scenes if you're focused too much on learning. I expect, if you haven't done this so far, that at the beginning, you'll probably be so much so focused on testing that you'll, let some things go, perhaps uh so yeah that will take just more time and as such requires a coding strategy. It's a different way of approaching your your application development. uh First thinking about how you're going to test it and then yeah building that out and the pros uh things. I love, I, love about it.

C

Is you get to automate your QA so forget about you, uh booting up stuff and uh testing. It yourself doing repetitive tasks. uh No, please! uh A developer should automate everything. I I believe you should focus on design and uh not uh doing repetitive, repetitive tasks on a computer. That's a waste of your time and that's what machines are for um yeah, it's less iterations! It makes your code intentional. It really makes you think about. Okay. How exactly is this going going to be?

C

Is this going to work and you set it in stone or even better in code, makes your code less error prone as such creates a standard for the repo yeah? You might not feel it if you're just doing it yourself, but uh if you have you're working on a team or you want to welcome new people that have never seen your project your tests.

C

Are your dogs uh devs read your test first and if you wrote them well, they know exactly what it's about so uh great, that's the first thing: I look for if I go in a new repo, where are the tests? I read them? Oh no I know how it works. Now it's a it's a it's developer: magic um yeah yeah as I said easier for newcomers uh yeah, but I'm wondering these are the things I could think of when I was making these slides. uh Does anybody have any other ideas for pros or cons.

C

C

No I couldn't think of anything else myself either I mean I'm I'm in a Reddit group and uh in this Reddit uh page and often I see memes about how painful tdd is. But of course, it's a funny thing, but uh at the start it is funny, but uh once you do it, it's like uh it's like being a deaf 2.0. It really is it's like super saiyan version of yourself.

C

um Okay, I think I skipped the the definition yeah, oh yeah. So what is it yeah? Sorry about this I think I, clicked too quick, uh but yeah for those that don't know it. It's uh as I said before shortly. It's a way of thinking, I. Think in my experience first comes to mind. Then comes the code. If you wrap your hand about a head around something, then writing the code, for it just takes a few minutes.

C

You don't even feel that time at least for what cost me a lot of time is thinking what exactly it's supposed to do and how exactly it's supposed to do that um yeah. The rest we've covered I think in the in the last few points. Oh yeah, the definition by the book is that you're supposed to First, write the tests and then write your app. That's a little bit contradictory because you start thinking about the functionality and then how you're going to test it. And then you keep in the test.

C

It's like Abba, instead of a b a b. So that's a little bit counter-intuitive but um and we'll do I'll. Do it in a moment? That's not how I do it myself when I start thinking about an app I, usually think about the functionality. I comment, all my tests and before I run my app I write my test code and then I run the app so, but that's not really how it's supposed to go and we'll do it? How it's supposed to go in a moment: yeah, no manual Q8!

C

So uh we're not going to do that. So, let's get going so what I'm going to do here is um I'm gonna SSH into my machine that is compatible with all the dependencies. This has quite strict compatibility checks uh and we are going to go to my coding, folder and we're going to use this uh nice.

C

um This nice uh Pagoda little uh CLI tool create new app and what it does is it's like a scaffolding solution, so it will set up the project structure. For me, let's call it my demo Oh My Demo, yes, do that it will set up the project structure for me without uh me having to do that so uh yeah. That's also nice right, yet again, less wasted time and more time for design.

C

So in the meantime, um what what it's doing right now, it's it's grab a bunch of template, folders and template files, and it's now uh gonna going to put all that in a in the folder, my demo that I just named and um what else does it do? Oh yeah, it's going to install all the dependencies already, so I don't have to do that in a moment as well. uh This is two gigabits per second, so this should be done quite quick, yeah there we go great.

C

So let's go to vs code and open My Demo, no, not postgres.

C

C

uh Great okay, I think it's open now.

C

Yes, code, My Demo.

C

I, don't like this get started screen, but it's not my computer um great. So here we go. This is what npx create in your app did for us right. So we have our installed packages and node modules or Contracting contract and the tests and integration tests.

C

um What I'm going to do right now is I'm going to delete the contents of the contract and delete the test from tests and then I'm gonna explain a little bit what we're gonna do.

C

So, let's just delete what this does and let's delete what that does, and uh we can comment this out machine. Maybe uh yeah I'm, not a native Mac guy, but let's just delete that like this yeah.

C

Okay, let's go to the tests. I hope this is. uh This is legible for for everybody right, not too small, okay, good, okay, so uh I will delete the contents of both tests and I will explain what this is doing so before I go into the tests and then we'll think about how to write this app.

C

So um our key dependency here is in JS. It's called near workspaces it uh and the key dependency of that is called near sandbox and that's that's the one that has the strict uh environment uh dependencies and that's why I SSH into this machine, because it does not accept m2s, it does not accept n1s, it does not accept windows, but it it does accept uh Linux or Ubuntu. So yeah, that's that's what we need in this case we're using Ava.

C

That's uh that's a testing library and JS that uh runs all tests in async by default. That's very nice because these um these uh are near workspaces, Library. What it does is. It creates a local uh virtualized um near blockchain on your machine and then uh yeah that takes a while to to boot up and it takes a while to run those tests too. So if you can run them in async, it's again saves you time. So you know, and the interface is nice and the colors are syntax, highlighting, looks cool too um great.

C

So what happens here? Is we initiate wow? The comments are very useful now, but it initiate it initiates the sandbox server so that that localized environment, uh then you get a you get the root account. You create an account and you deploy the wasm file of your smart contract, so a smart contract that lives up there in in contracts and source is compiled into a wasn't file and that wasn't file is deployed into your local virtualized near blockchain, so and then you're all set up pretty much.

C

What I want to do right now is because I always like to do. This is I like to make a user account so.

C

I love, GitHub copilot. It does all the work for me, but that's wrong right, create sub account, that's what I want. Otherwise it creates another root account uh create sub, oh hold on.

C

There and we want root, to call this great and we can return Alice as an output great. So now we have a user um and now we're all set up. You can either do this for all your tests with uh before look here, we're using a before each hook. So that means this sequence of commands, from line 10 to 26 runs before every single test case so um be mindful of that think about how you want to do that. Sometimes you want some tests to have shared state. I.

C

Don't do that personally, but some people might like that um yeah and then it tears it down after each test. So now we get to the juice. What do we want to build? um I was thinking.

C

We would build a guest book like the one in the example, but everyone can ride on it and it fetches the uh messages for every account ID, because it's indexed by a county, so it will just keep an object and then we'll save the strings by account ID as the index, so very simple, so I'm thinking it should definitely do that and if there is no account ID, it should return. Some kind of message so should uh return not found, if account ID,.

C

Not found, and the second test is our happy path, so should um save message and return by account ID.

C

So, let's see, if get a copilot is smart for this smart enough. For this, let's see a tab, it's doing magic. Let's see, does this make sense, we have Alice. We want that contract view. That makes sense, yeah and Alice hasn't written to it. Yet because we're using the before each right- and we have nothing yet there with our current setup, no state and then it should say not found great. So that makes sense should save the message very good. So let's look at this.

C

We have uh yeah uh that's wrong, so Alice should call the contract set me. Yes, hello, I am Alice.

C

And that's wrong and this syntax what it's actually doing and it's wrong right now too I'm gonna explain it in a second okay.

C

So what what that line is doing right now, it's it's performing Alice is performing a call to that smart contract saying I want to call that function, and these are my parameters: I'm, not providing the gas or the storage uh parameters. You could also do that yourself, optionally, but uh if I do this, it just I think it provides some default ones, but not like Max gas. Max gas is right now, I, believe 300, Terra, gas, I think I. Think the default parameter is something like 30 Tera gas. So you can always increase that.

C

If you see in the famous the infamous exceeded prepaid gas error um so yeah, uh then we get uh then we're gonna query the contract, uh that's something the contract itself can do, uh can do so get greeting. We pass a count ID from LS, and then it should say hello, I am Alice, so I mean. If, if we were to be pedantic, we would make a a variable and put the string in there and just pass the variable to the test. I mean that would be much better right, but um I'm.

C

A little lazy right now and I got a little bit of a hurry. So I'm gonna do this. So we called get greeting and set greeting and get greeting requires on yeah account ID, and this is because we're in typescript we have to tell it what it is a string and we have our greetings.

C

And no I don't want to use I just want to use the native types yeah. Thank you thank you and uh set greeting is the same thing. Okay, very well! So let's, uh let's see what this does.

C

I love Copilot! That's great! That's really great! uh Okay! Sure! Let's accept that! uh That's wrong! Let's, let's do something! Free, the assessor account, ID and I believe this is a function.

C

Looks right! Right! Yeah I see some nods okay, so let's go for it npm test. So what what this is? Oh, oh I'm in the wrong file, CD My Demo in the wrong folder yeah. Now, let's go great! So what's going on right now, it looks like it's doing a lot, but uh in essence it does what I shortly explained previously. So it creates that wasn't file and that takes a long, a long time with JS now and rust. That happens very quickly, but in JS that takes a very long time.

C

It does a four different five different things. That's another another chat for another time uh but uh yeah it won't create that was on file and then it will deploy it on your local version of your uh of near blockchain and then it will run your test. So now we got to the test part. Now it's running Ava and uh hopefully I did this right and we get no failing tests yeah it works. So uh that's it yeah yeah! Thank you. Thank you.

C

um Awesome uh yeah, uh so I think some yeah you can. You can see this in uh in GitHub. uh There's a workspace there's the workspaces repo is there. Of course. uh If you want to do some test logging, you could do uh I think. uh Where is it uh you could? But this is. uh This is of course Ava specific. You could do like a t, DOT log, and let's see what uh what co-pilot says yeah.

C

You could do that and if you want to do uh this too, you could do D, DOT log results and we can. We can even run it again. I see I got a couple minutes, so uh so yeah I don't know if anyone has any questions or remarks in the meantime, no no great great cool yeah. This is uh this is a thingy, but uh I could have just run Ava this time and skipped the whole uh awesome filing file building stuff. But uh let's see what else do I have in the presentation?

C

I think I've pretty much done, yeah yeah! Now it's got to the test. So now we can see the logs.

C

Here come the logs.

C

No I didn't log, it I think it misses the verbose parameter, but that's an Ava thing. So uh if you, if you run Ava with dash dash for both you'll, get to see the the logs I think oh yeah I got just one minute left. So I'll continue with the presentation now um yeah. You can see more of these examples. We have a yeah, like example, depths very simple depths like the guest book, like uh I, think of uh fungible token one, an nft one.

C

uh You can see all those examples in this URL um yeah. They all have tests too. It's actually I've done myself. uh So yeah I actually have improvements on that I'd love to hear that as well um yeah. So please check it out and uh yeah we're looking for people for for some research. If you want to help out and maybe earn some veneer, you can scan that we're also looking for new devs.

C

So uh if you like this kind of stuff and you like Pagoda, then yeah come by the booth and uh yeah say hi, that's it uh any questions. Otherwise, I'll conclude question yeah. We got a question.

E

C

E

Do you compile JavaScript to webassembly, oh.

C

That's a question.

E

C

um uh I think they of they use quickjs and um I, think they send it to nah I'd, be guessing I'd, be guessing. It's it's two less two less concrete I can come back to you about this. So uh uh if you come by the booth, uh we'll exchange contact info and I'll give you a proper answer, because otherwise I'll say something crap right now uh anything else.

C

Okay, great! That's it! Thank you guys! Yeah.

A

um Thank you, everyone for joining the doomslog stage today. That was indeed our last session. Thank you to all our speakers and people in the audience please go out, enjoy drinks, food and everything available at the last day of nircon. Thank you.

A