Merge branch 'master' into account-names

.editorconfig

@@ -0,0 +1,12 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 2
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true

.eslintrc

@@ -28,7 +28,7 @@
     "comma-dangle": ["warn", "always-multiline"],
     "comma-spacing": ["error", {"before": false, "after": true}],
     "dot-notation": ["error", {"allowKeywords": true, "allowPattern": ""}],
-    "eol-last": "warn",
+    "eol-last": ["error", "always"],
     "eqeqeq": ["error", "smart"],
     "generator-star-spacing": ["error", "before"],
     "indent": ["error", 2],
@@ -38,7 +38,7 @@
     "no-dupe-keys": "error",
     "no-mixed-spaces-and-tabs": ["error", "smart-tabs"],
     "no-redeclare": ["error", {"builtinGlobals": true}],
-    "no-trailing-spaces": ["error", { "skipBlankLines": true }],
+    "no-trailing-spaces": ["error", { "skipBlankLines": false }],
     "no-undef": "error",
     "no-use-before-define": "off",
     "no-var": "error",

.soliumrc.json

@@ -4,6 +4,7 @@
   "rules": {
     "quotes": ["error", "double"],
     "no-empty-blocks": "off",
+    "uppercase": "off",
     "indentation": ["error", 2],
     "max-len": ["warning", 79],
     "no-constant": ["error"],

README.md

@@ -15,7 +15,7 @@ With OpenZeppelin, you can build distributed applications, protocols and organiz
 
 OpenZeppelin integrates with [Truffle](https://github.com/ConsenSys/truffle) and [Embark](https://github.com/embark-framework/embark/).
 
-## Truffle
+## truffle
 
 To use with Truffle, first install it and initialize your project with `truffle init`.
 
@@ -66,9 +66,50 @@ contract MyContract is Ownable {
 }
 ```
 
+## Architecture
+The following provides visibility into how OpenZeppelin's contracts are organized:
+
+- **access** - Smart contracts that enable functionality that can be used for selective restrictions and basic authorization control functions. Includes address whitelisting and signature-based permissions management.
+	- **rbac** - A library used to manage addresses assigned to different user roles and an example Role-Based Access Control (RBAC) interface that demonstrates how to handle setters and getters for roles and addresses.
+- **crowdsale** - A collection of smart contracts used to manage token crowdsales that allow investors to purchase tokens with ETH. Includes a base contract which implements fundamental crowdsale functionality in its simplest form. The base contract can be extended in order to satisfy your crowdsale’s specific requirements.
+	- **distribution** - Includes extensions of the base crowdsale contract which can be used to customize the completion of a crowdsale.
+	- **emission** - Includes extensions of the base crowdsale contract which can be used to mint and manage how tokens are issued to purchasers.
+	- **price** - Includes extensions of the crowdsale contract that can be used to manage changes in token prices.
+	- **validation**  - Includes extensions of the crowdsale contract that can be used to enforce restraints and limit access to token purchases.
+- **examples** - A collection of simple smart contracts that demonstrate how to add new features to base contracts through multiple inheritance.
+- **introspection**  - An interface that can be used to make a contract comply with the ERC-165 standard as well as a contract that implements ERC-165 using a lookup table.
+- **lifecycle** - A collection of base contracts used to manage the existence and behavior of your contracts and their funds.
+- **math** - Libraries with safety checks on operations that throw on errors.
+- **mocks** - A collection of abstract contracts that are primarily used for unit testing. They also serve as good usage examples and demonstrate how to combine contracts with inheritence when developing your own custom applciations.
+- **ownership** - A collection of smart contracts that can be used to manage contract and token ownership
+- **payment** - A collection of smart contracts that can be used to manage payments through escrow arrangements, withdrawals, and claims. Includes support for both single payees and multiple payees.
+- **proposals** - A collection of smart contracts that reflect community Ethereum Improvement Proposals (EIPs). These contracts are under development and standardization. They are not recommended for production, but they are useful for experimentation with pending EIP standards. Go [here](https://github.com/OpenZeppelin/openzeppelin-solidity/wiki/ERC-Process) for more information.
+
+- **token** - A collection of approved ERC standard tokens -- their interfaces and implementations.
+	- **ERC20** - A standard interface for fungible tokens:
+		- *Interfaces* - Includes the ERC-20 token standard basic interface. I.e., what the contract’s ABI can represent.
+		- *Implementations* - Includes ERC-20 token implementations that include all required and some optional ERC-20 functionality.
+	- **ERC721** - A standard interface for non-fungible tokens 
+		- *Interfaces* - Includes the ERC-721 token standard basic interface. I.e., what the contract’s ABI can represent.
+		- *Implementations* - Includes ERC-721 token implementations that include all required and some optional ERC-721 functionality.
+
+## Tests
+Unit test are critical to the OpenZeppelin framework. They help ensure code quality and mitigate against security vulnerabilities. The directory structure within the `/tests` directory corresponds to the `/contracts` directory. OpenZeppelin uses Mocha’s JavaScript testing framework and Chai’s assertion library. To learn more about how to tests are structured, please reference OpenZeppelin’s Testing Guide.
+
+## How To Use And Modify OpenZeppelin Contracts
+When using OpenZeppelin to build your own distributed applications, for security reasons we encourage you NOT to modify the framework’s base contracts, libraries, and interfaces. In order to leverage and extend their functionality, we encourage you to inherit from them or compose them together with your own contracts.
+
+The Solidity programming language supports multiple inheritance. This is very powerful yet it can also be confusing: the more complexity you introduce to your distributed applications through multiple inheritance, the greater your application’s attack surface is.
+
+You’ll notice in the `/mocks` directory there are a collection of abstract contracts used primarily for unit testing purposes that can also be used as the foundation for your own custom implementations. These mock contracts demonstrate how OpenZeppelin’s secure base contracts can be used with multiple inheritance.
+
+To learn more about combining OpenZeppelin contracts with your own custom contracts using multiple inheritance we encourage you to read the following: [On crowdsales and multiple inheritance](https://blog.zeppelin.solutions/on-crowdsales-and-multiple-inheritance-af90c694e35f)
+
 ## Security
 OpenZeppelin is meant to provide secure, tested and community-audited code, but please use common sense when doing anything that deals with real money! We take no responsibility for your implementation decisions and any security problem you might experience.
 
+The core development principles and strategies that OpenZeppelin is based on include: security in depth, simple and modular code, clarity-driven naming conventions, comprehensive unit testing, pre-and-post-condition sanity checks, code consistency, and regular audits.
+
 If you find a security issue, please email [[email protected]](mailto:[email protected]).
 
 ## Developer Resources
@@ -87,4 +128,4 @@ Interested in contributing to OpenZeppelin?
 - Wiki: https://github.com/OpenZeppelin/openzeppelin-solidity/wiki
 
 ## License
-Code released under the [MIT License](https://github.com/OpenZeppelin/openzeppelin-solidity/blob/master/LICENSE).
+Code released under the [MIT License](https://github.com/OpenZeppelin/openzeppelin-solidity/blob/master/LICENSE).

contracts/AddressUtils.sol

@@ -10,10 +10,10 @@ library AddressUtils {
    * Returns whether the target address is a contract
    * @dev This function will return false if invoked during the constructor of a contract,
    * as the code is not actually created until after the constructor finishes.
-   * @param addr address to check
+   * @param _addr address to check
    * @return whether the target address is a contract
    */
-  function isContract(address addr) internal view returns (bool) {
+  function isContract(address _addr) internal view returns (bool) {
     uint256 size;
     // XXX Currently there is no better way to check if there is a contract in an address
     // than to check the size of the code at that address.
@@ -22,7 +22,7 @@ library AddressUtils {
     // TODO Check this again before the Serenity release, because all addresses will be
     // contracts then.
     // solium-disable-next-line security/no-inline-assembly
-    assembly { size := extcodesize(addr) }
+    assembly { size := extcodesize(_addr) }
     return size > 0;
   }
 

contracts/Bounty.sol

@@ -36,13 +36,13 @@ contract Bounty is PullPayment, Destructible {
 
   /**
    * @dev Transfers the contract funds to the researcher that proved the contract is broken.
-   * @param target contract
+   * @param _target contract
    */
-  function claim(Target target) public {
-    address researcher = researchers[target];
+  function claim(Target _target) public {
+    address researcher = researchers[_target];
     require(researcher != address(0));
     // Check Target contract invariants
-    require(!target.checkInvariant());
+    require(!_target.checkInvariant());
     asyncTransfer(researcher, address(this).balance);
     claimed = true;
   }

contracts/ECRecovery.sol

@@ -12,10 +12,10 @@ library ECRecovery {
 
   /**
    * @dev Recover signer address from a message by using their signature
-   * @param hash bytes32 message, the hash is the signed message. What is recovered is the signer address.
-   * @param sig bytes signature, the signature is generated using web3.eth.sign()
+   * @param _hash bytes32 message, the hash is the signed message. What is recovered is the signer address.
+   * @param _sig bytes signature, the signature is generated using web3.eth.sign()
    */
-  function recover(bytes32 hash, bytes sig)
+  function recover(bytes32 _hash, bytes _sig)
     internal
     pure
     returns (address)
@@ -25,7 +25,7 @@ library ECRecovery {
     uint8 v;
 
     // Check the signature length
-    if (sig.length != 65) {
+    if (_sig.length != 65) {
       return (address(0));
     }
 
@@ -34,9 +34,9 @@ library ECRecovery {
     // currently is to use assembly.
     // solium-disable-next-line security/no-inline-assembly
     assembly {
-      r := mload(add(sig, 32))
-      s := mload(add(sig, 64))
-      v := byte(0, mload(add(sig, 96)))
+      r := mload(add(_sig, 32))
+      s := mload(add(_sig, 64))
+      v := byte(0, mload(add(_sig, 96)))
     }
 
     // Version of signature should be 27 or 28, but 0 and 1 are also possible versions
@@ -49,7 +49,7 @@ library ECRecovery {
       return (address(0));
     } else {
       // solium-disable-next-line arg-overflow
-      return ecrecover(hash, v, r, s);
+      return ecrecover(_hash, v, r, s);
     }
   }
 
@@ -58,15 +58,15 @@ library ECRecovery {
    * @dev prefix a bytes32 value with "\x19Ethereum Signed Message:"
    * and hash the result
    */
-  function toEthSignedMessageHash(bytes32 hash)
+  function toEthSignedMessageHash(bytes32 _hash)
     internal
     pure
     returns (bytes32)
   {
     // 32 is the length in bytes of hash,
     // enforced by the type signature above
     return keccak256(
-      abi.encodePacked("\x19Ethereum Signed Message:\n32", hash)
+      abi.encodePacked("\x19Ethereum Signed Message:\n32", _hash)
     );
   }
 }

contracts/ReentrancyGuard.sol

@@ -3,16 +3,23 @@ pragma solidity ^0.4.24;
 
 /**
  * @title Helps contracts guard against reentrancy attacks.
- * @author Remco Bloemen <remco@2π.com>
+ * @author Remco Bloemen <remco@2π.com>, Eenae <[email protected]>
  * @dev If you mark a function `nonReentrant`, you should also
  * mark it `external`.
  */
 contract ReentrancyGuard {
 
+  /// @dev Constant for unlocked guard state - non-zero to prevent extra gas costs.
+  /// See: https://github.com/OpenZeppelin/openzeppelin-solidity/issues/1056
+  uint private constant REENTRANCY_GUARD_FREE = 1;
+
+  /// @dev Constant for locked guard state
+  uint private constant REENTRANCY_GUARD_LOCKED = 2;
+
   /**
    * @dev We use a single lock for the whole contract.
    */
-  bool private reentrancyLock = false;
+  uint private reentrancyLock = REENTRANCY_GUARD_FREE;
 
   /**
    * @dev Prevents a contract from calling itself, directly or indirectly.
@@ -23,10 +30,10 @@ contract ReentrancyGuard {
    * wrapper marked as `nonReentrant`.
    */
   modifier nonReentrant() {
-    require(!reentrancyLock);
-    reentrancyLock = true;
+    require(reentrancyLock == REENTRANCY_GUARD_FREE);
+    reentrancyLock = REENTRANCY_GUARD_LOCKED;
     _;
-    reentrancyLock = false;
+    reentrancyLock = REENTRANCY_GUARD_FREE;
   }
 
 }

contracts/access/SignatureBouncer.sol

@@ -68,8 +68,8 @@ contract SignatureBouncer is Ownable, RBAC {
    * @dev allows the owner to add additional bouncer addresses
    */
   function addBouncer(address _bouncer)
-    onlyOwner
     public
+    onlyOwner
   {
     require(_bouncer != address(0));
     addRole(_bouncer, ROLE_BOUNCER);
@@ -79,8 +79,8 @@ contract SignatureBouncer is Ownable, RBAC {
    * @dev allows the owner to remove bouncer addresses
    */
   function removeBouncer(address _bouncer)
-    onlyOwner
     public
+    onlyOwner
   {
     require(_bouncer != address(0));
     removeRole(_bouncer, ROLE_BOUNCER);
@@ -146,12 +146,12 @@ contract SignatureBouncer is Ownable, RBAC {
    * and then recover the signature and check it against the bouncer role
    * @return bool
    */
-  function isValidDataHash(bytes32 hash, bytes _sig)
+  function isValidDataHash(bytes32 _hash, bytes _sig)
     internal
     view
     returns (bool)
   {
-    address signer = hash
+    address signer = _hash
       .toEthSignedMessageHash()
       .recover(_sig);
     return hasRole(signer, ROLE_BOUNCER);

contracts/access/Whitelist.sol

@@ -28,8 +28,8 @@ contract Whitelist is Ownable, RBAC {
    * @return true if the address was added to the whitelist, false if the address was already in the whitelist
    */
   function addAddressToWhitelist(address _operator)
-    onlyOwner
     public
+    onlyOwner
   {
     addRole(_operator, ROLE_WHITELISTED);
   }
@@ -52,8 +52,8 @@ contract Whitelist is Ownable, RBAC {
    * false if all addresses were already in the whitelist
    */
   function addAddressesToWhitelist(address[] _operators)
-    onlyOwner
     public
+    onlyOwner
   {
     for (uint256 i = 0; i < _operators.length; i++) {
       addAddressToWhitelist(_operators[i]);
@@ -67,8 +67,8 @@ contract Whitelist is Ownable, RBAC {
    * false if the address wasn't in the whitelist in the first place
    */
   function removeAddressFromWhitelist(address _operator)
-    onlyOwner
     public
+    onlyOwner
   {
     removeRole(_operator, ROLE_WHITELISTED);
   }
@@ -80,8 +80,8 @@ contract Whitelist is Ownable, RBAC {
    * false if all addresses weren't in the whitelist in the first place
    */
   function removeAddressesFromWhitelist(address[] _operators)
-    onlyOwner
     public
+    onlyOwner
   {
     for (uint256 i = 0; i < _operators.length; i++) {
       removeAddressFromWhitelist(_operators[i]);

contracts/access/rbac/RBAC.sol

@@ -27,8 +27,8 @@ contract RBAC {
    * // reverts
    */
   function checkRole(address _operator, string _role)
-    view
     public
+    view
   {
     roles[_role].check(_operator);
   }
@@ -40,8 +40,8 @@ contract RBAC {
    * @return bool
    */
   function hasRole(address _operator, string _role)
-    view
     public
+    view
     returns (bool)
   {
     return roles[_role].has(_operator);

contracts/access/rbac/Roles.sol

@@ -15,41 +15,41 @@ library Roles {
   /**
    * @dev give an address access to this role
    */
-  function add(Role storage role, address addr)
+  function add(Role storage _role, address _addr)
     internal
   {
-    role.bearer[addr] = true;
+    _role.bearer[_addr] = true;
   }
 
   /**
    * @dev remove an address' access to this role
    */
-  function remove(Role storage role, address addr)
+  function remove(Role storage _role, address _addr)
     internal
   {
-    role.bearer[addr] = false;
+    _role.bearer[_addr] = false;
   }
 
   /**
    * @dev check if an address has this role
    * // reverts
    */
-  function check(Role storage role, address addr)
-    view
+  function check(Role storage _role, address _addr)
     internal
+    view
   {
-    require(has(role, addr));
+    require(has(_role, _addr));
   }
 
   /**
    * @dev check if an address has this role
    * @return bool
    */
-  function has(Role storage role, address addr)
-    view
+  function has(Role storage _role, address _addr)
     internal
+    view
     returns (bool)
   {
-    return role.bearer[addr];
+    return _role.bearer[_addr];
   }
 }