
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
arc-experimental
Advanced tools
Arc is the base layer of the DAO stack. It consists of a set of smart contracts deployed on the Ethereum blockchain that define the basic building blocks and standard components that can be used to implement any DAO.
Arc is a modular, upgradeable platform that allows for a rapid natural selection of governance systems.
Figure 1: Arc's structure
Every box in Figure 1 represents a smart contract.
The Token contract probably does not require an explanation, being the most popular use-case of the Ethereum network.
The Avatar contract is the face of an organization on the blockchain, e.g. if the organization is to hold ownership of anything, like ownership over a contract or asset, the owner address will be the Avatar.
The Reputation contract stores a DAO's reputation data. In Arc, Reputation represents a user's decision power in a given DAO. It is very similar to a token, with two main differences: one, it is non-transferable, and two, it can be granted or taken away by the DAO.
On the right side of the figure we have the schemes. Schemes are simple pieces of logic describing the different actions a DAO can take. One example is a scheme for funding proposals, in which everyone can suggest and vote on proposals, and if a proposal is approved, it is automatically funded.
At the bottom are the global constraints. Global constraints prevent current and future modules from breaking certain overarching rules, e.g. a cap on an organization’s total possible reputation.
The Controller is an access control module that keeps a record of all the registered schemes in a DAO and the permissions for each scheme. It also records all global constraints and enforces them by reverting transactions that violate them.
Go here for a full primer on Arc.
DAOstack Arc is still in its alpha version. Arc is intended to provide secure, tested, and community-audited code, but please use common sense when doing anything that deals with real money! We take no responsibility for your implementation decisions and any security problem you might experience.
truffle init.
npm install -g truffle
mkdir myproject && cd myproject
truffle init
@daostack/arc package: npm install @daostack/arc.
.sol Source code is found under node_modules/@daostack/arc/contracts.json Compiled contracts are found under node_modules/@daostack/arc/build/contractsimport '@daostack/arc/contracts/universalSchemes/UniversalScheme.sol';
contract MyContract is UniversalScheme {
...
}
You should be able to find the @daostack/arc contracts (.json) already built and ready for deployment in the node_modules/@daostack/arc/build/contracts/ folder.PRs are welcome, but please first consult with the Contribution guide.
Join us on Discord!
To contribute to Arc development start by cloning the repo and installing the dependencies:
git clone https://github.com/daostack/arc
cd arc
npm install
Available commands while developing:
npm run build - Compile all contracts to the build/ folder.npm run test - This will run ganache-cli, compile, migrate and run all tests.npm run lint - Check all JavaScript code for style & good practices.npm run solhint - Check all Solidity code for style & good practices.npm run docs:<update|build|deploy|preview> - See this for details.Arc has a prebuilt Docker image that makes development environments consistent and cross-platform. To start developing inside this environment:
docker run --rm -it -v <path to repo>:/home/arc daostack/arc (*May require Admin/root permissions).git clone or git fetch depending on if <path to repo> is empty, and will install any dependencies.This is an open-source project (GPL license).
FAQs
A platform for building DAOs
We found that arc-experimental demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.