
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
@dorgtech/arc-experimental
Advanced tools
Arc is the base layer of the DAO stack. It consists of a set of smart contracts deployed on the Ethereum blockchain that define the basic building blocks and standard components that can be used to implement any DAO.
Arc is a modular, upgradeable platform that allows for a rapid natural selection of governance systems.
Figure 1: Arc's structure
Every box in Figure 1 represents a smart contract.
The Token contract probably does not require an explanation, being the most popular use-case of the Ethereum network.
The Avatar contract is the face of an organization on the blockchain, e.g. if the organization is to hold ownership of anything, like ownership over a contract or asset, the owner address will be the Avatar.
The Reputation contract stores a DAO's reputation data. In Arc, Reputation represents a user's decision power in a given DAO. It is very similar to a token, with two main differences: one, it is non-transferable, and two, it can be granted or taken away by the DAO.
On the right side of the figure we have the schemes. Schemes are simple pieces of logic describing the different actions a DAO can take. One example is a scheme for funding proposals, in which everyone can suggest and vote on proposals, and if a proposal is approved, it is automatically funded.
At the bottom are the global constraints. Global constraints prevent current and future modules from breaking certain overarching rules, e.g. a cap on an organization’s total possible reputation.
The Controller is an access control module that keeps a record of all the registered schemes in a DAO and the permissions for each scheme. It also records all global constraints and enforces them by reverting transactions that violate them.
Go here for a full primer on Arc.
DAOstack Arc is still in its alpha version. Arc is intended to provide secure, tested, and community-audited code, but please use common sense when doing anything that deals with real money! We take no responsibility for your implementation decisions and any security problem you might experience.
@daostack/arc
package: npm install @daostack/arc
.
.sol
Source code is found under node_modules/@daostack/arc/contracts
.json
Compiled contracts are found under node_modules/@daostack/arc/build/contracts
import '@daostack/arc/contracts/universalSchemes/UniversalScheme.sol';
contract MyContract is UniversalScheme {
...
}
You should be able to find the @daostack/arc
contracts (.json) already built and ready for deployment in the node_modules/@daostack/arc/build/contracts/
folder.PRs are welcome, but please first consult with the Contribution guide.
Join us on Discord!
To contribute to Arc development start by cloning the repo and installing the dependencies:
git clone https://github.com/daostack/arc
cd arc
npm install
Available commands while developing:
npm run build
- Compile all contracts to the build/
folder.npm run test
- This will run ganache-cli, compile, migrate and run all tests.npm run lint
- Check all JavaScript code for style & good practices.npm run solhint
- Check all Solidity code for style & good practices.npm run docs:<update|build|deploy|preview>
- See this for details.Arc has a prebuilt Docker image that makes development environments consistent and cross-platform. To start developing inside this environment:
docker run --rm -it -v <path to repo>:/home/arc daostack/arc
(*May require Admin/root permissions).git clone
or git fetch
depending on if <path to repo>
is empty, and will install any dependencies.This is an open-source project (GPL license).
FAQs
A platform for building DAOs
We found that @dorgtech/arc-experimental demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.