
Security News
Socket Security Analysis Is Now One Click Away on npm
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.
@iexec/poco
Advanced tools
[](https://codecov.io/github/iExecBlockchainComputing/PoCo)
This repository contains the smart contract implementation of iExec's PoCo protocol.
All contract audit files can be found in audit/ folder.
Starting from version 5, the PoCo uses a modular design based on ERC-2535. The migration scripts and tests will use different modules (facets) and deployment process depending on the required configuration. In particular, the configuration can use a create2 factory for the deployment, and enable native token or ERC20 token based escrow depending on the targeted blockchain. This means that the codebase is the same on public blockchains (ERC20 based RLC) and dedicated sidechains (Native token based RLC).
The configuration file is located in ./config/config.json.
It contains:
createCategory function.bytes32(0) will be used by default.If you want to deploy the iExec PoCo V5 smart contracts on a new blockchain, the recommended process is to:
./config/config.json file as follows:"asset": "Token", provide the address of the token you want to use;"v3" resources to Null;Environment variable can be used to alter the configuration of a deployment:
SALT env var will overwrite the salt parameter from the config. This can be useful to distinguish different deployments without modifying the config.Additionally, the migration process will look for some smart contracts before deploying new instances. This is true of the application, dataset and workerpool registries. Thus, if different marketplaces are deployed to the same network, they will share these registries.
The PoCo smart contracts are in the contracts/ folder. Json artifacts, containing the contracts bytecode and ABI can be found in the artifacts/ folder. In case you need to regenerate them, you can use the following command:
npm install
npm run build
PoCo smart contracts come with a test suite in the ./test folder. You can startup a sandbox blockchain and run the tests using the following command:
npm install
npm run test
Additionally, you can produce a coverage report using the following command:
npm run coverage
The automatic testing command uses the Hardhat network by default to run the tests.
Start a blockchain
npx hardhat node [<any additional arguments>]
[Optional] Update the configuration
If your blockchain listen to a port that is not 8545, or if the blockchain is on a different node, update the hardhat.config.ts configuration (network ports, accounts with mnemonic, ..) accordingly to the Hardhat Configuration documentation.
Run tests
npm run test -- --network <networkUrl>
The iExec PoCo contracts support automated deployment through both command-line interface and GitHub Actions workflows.
You can deploy the smart contracts according to the deploy/0_deploy.ts content. This will automatically save addresses of the deployed artifacts to deployments/ folder.
To deploy using the CLI:
hardhat.config.tsnpm run deploy -- --network <your network name>
Example with custom salt:
SALT=0x0000000000000000000000000000000000000000000000000000000000000001 npx hardhat deploy --network hardhat
To verify contracts:
npm run verify:all -- --network <your network name> # e.g. arbitrum
This script automatically reads all deployed contract addresses and their constructor arguments from the deployment artifacts and verifies them on the relevant block explorer.
Format a specific file or files in a directory:
npm run format <filePath|folderPath>
To render all UML diagrams:
npm run uml
To render only class diagrams:
npm run sol-to-uml
To render only .puml files:
npm run puml-to-links
To render only storage diagrams:
npm run storage-to-diagrams
FAQs
iExec Proof of Contribution protocol smart contracts
The npm package @iexec/poco receives a total of 202 weekly downloads. As such, @iexec/poco popularity was classified as not popular.
We found that @iexec/poco demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.

Security News
A compromised npm publish token was used to push a malicious postinstall script in cline@2.3.0, affecting the popular AI coding agent CLI with 90k weekly downloads.

Product
Socket is now scanning AI agent skills across multiple languages and ecosystems, detecting malicious behavior before developers install, starting with skills.sh's 60,000+ skills.