Issue 927 security monitor

.env.example

@@ -0,0 +1,5 @@
+# infura key created at infura.io
+INFURA_ID=XXXXXX
+NEXT_PUBLIC_JSON_RPC_URL=XXXXXX
+NEXT_PUBLIC_WALLET_CONNECT_ID=XXXXXX
+NEXT_PUBLIC_DEBUG=

.eslintignore

@@ -1,3 +1,4 @@
 dist/
 .next/
 dist/_next/
+!.solhint.json

.eslintrc → .eslintrc.json

@@ -6,7 +6,12 @@
   "rules": {
     "@typescript-eslint/explicit-module-boundary-types": "off",
     "@typescript-eslint/no-empty-function": "off",
-    "prettier/prettier": "warn"
+    "prettier/prettier": [
+      "warn",
+      {
+        "endOfLine": "auto"
+      }
+    ]
   },
   "env": {
     "browser": true,

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @rndquu

.github/CONTRIBUTING.md

@@ -0,0 +1,23 @@
+# Contributing
+- We welcome everybody to participate in improving the codebase.
+- We offer financial incentives for solved issues.
+- Please learn how to contribute via the DevPool [here](https://dao.ubq.fi/devpool).
+
+### Coding Styleguide
+
+- We use camelCase for identifiers (variable, function, method names) do not use snake_case
+- `NFT` should be `Nft` in identifers e.g. `creditNft`
+- Do not refer to token symbols directly in identifiers, instead write the intent of the token. We have the ability to update the names of the tokens (as we already have done on Ethereum mainnet) which leads to confusion.
+  - `uAD` ⮕ `dollar`
+  - `uCR` ⮕ `credit`
+  - `uCR-NFT` ⮕ `creditNft`
+  - `UBQ` ⮕ `governance`
+
+- We generally should not use "Ubiquity" in identifers and filenames. This is the Ubiquity Dollar repository so Ubiquity is implied.
+  - The exception is when we are working in third party contexts, for example the Curve (3pool) metapool related code, it is good to write ubiquityDollar because the other assets in the pool are USDC, USDT and DAI (other types of dollars!)
+
+#### Contract Renames
+
+- We rebranded "Bonding" to "Staking" to disambiguate our bonds (e.g. Chicken Bonds) branding.
+- We rebranded "Debts" to "Credits" because it has a positive connotation for the users.
+- We rebranded "Ubiquity Algorithmic Dollar" to "Ubiquity Dollar" because the term "algorithmic" is contentious in this context after Luna.

.github/pull_request_template.md

@@ -0,0 +1,6 @@
+Resolves #
+
+<!--
+- You must link the issue number e.g. "Resolves #1234"
+- Please do not replace the keyword "Resolves" https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword
+-->

.github/ubiquibot-config.yml

@@ -0,0 +1,5 @@
+payments:
+  evmNetworkId: 100
+  basePriceMultiplier: 3
+  issueCreatorMultiplier: 3
+  maxPermitPrice: 1000

.github/workflows/build-and-test.yml

@@ -0,0 +1,51 @@
+name: Build & Test
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-test:
+    name: Build & Test
+    runs-on: ubuntu-22.04
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: "20.10.0"
+
+      - name: Install dependencies
+        run: sudo apt -y update && sudo apt -y install libusb-1.0-0-dev libudev-dev
+
+      - name: Setup Foundry
+        uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: nightly-5be158ba6dc7c798a6f032026fe60fc01686b33b
+
+      - name: Yarn Install
+        run: yarn install --mode=skip-build && yarn allow-scripts
+
+      - name: Setup Forge
+        run: yarn workspace @ubiquity/contracts forge:install
+
+      - name: Build All
+        env:
+          FOUNDRY_DENY_WARNINGS: true
+        run: yarn build
+
+      - name: Test All
+        run: yarn test:all
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: static
+          path: packages/dapp/dist

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,35 @@
+name: CodeQL Analysis
+
+on:
+  pull_request:
+  push:
+   branches:
+     - development
+
+jobs:
+  code-ql-analysis:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["javascript", "typescript"]
+        # CodeQL currently supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Modified to support codebase. Currently no support for Solidity Language
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Init CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2

.github/workflows/conventional-commits.yml

@@ -0,0 +1,14 @@
+name: Conventional Commits
+
+on:
+  pull_request:
+  push:
+    branches: [development]
+
+jobs:
+  conventional-commits:
+    name: Conventional Commits
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: ubiquity/action-conventional-commits@master

.github/workflows/core-contracts-storage-check.yml

@@ -0,0 +1,71 @@
+name: Check For Core Contracts Storage Changes
+
+on:
+  push:
+    branches:
+      - development
+  pull_request:
+
+jobs:
+  provide_contracts:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          submodules: recursive
+
+      - name: Install Foundry
+        uses: onbjerg/foundry-toolchain@v1
+        with:
+          version: nightly
+
+      - name: Narrow down test matrix scope to changed contracts to limit API requests
+        id: changed-contracts
+        uses: tj-actions/changed-files@v42
+        with:
+          files_yaml: |
+            contracts:
+              - packages/contracts/src/dollar/core/*.sol
+
+      - name: Set contracts matrix
+        id: set-matrix
+        working-directory: packages/contracts
+        if: steps.changed-contracts.outputs.contracts_any_changed == 'true'
+        env:
+          CHANGED_CONTRACTS: ${{ steps.changed-contracts.outputs.contracts_all_changed_files }}
+        run: |
+          for CONTRACT in "$CHANGED_CONTRACTS"; do
+            echo ${CONTRACT} | xargs basename -a | cut -d'.' -f1 | xargs -I{} echo src/dollar/core/{}.sol:{} >> contracts.txt
+          done
+          echo "matrix=$(cat contracts.txt | jq -R -s -c 'split("\n")[:-1]')" >> $GITHUB_OUTPUT
+
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+
+  check_storage_layout:
+    needs: provide_contracts
+    runs-on: ubuntu-latest
+    if: ${{ needs.provide_contracts.outputs.matrix != '[]' && needs.provide_contracts.outputs.matrix != '' }}
+
+    strategy:
+      matrix:
+        contract: ${{ fromJSON(needs.provide_contracts.outputs.matrix) }}
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          submodules: recursive
+
+      - name: Install Foundry
+        uses: onbjerg/foundry-toolchain@v1
+        with:
+          version: nightly
+
+      - name: Check For Core Contracts Storage Changes
+        uses: Rubilmax/foundry-storage-check@main
+        with:
+          workingDirectory: packages/contracts
+          contract: ${{ matrix.contract }}
+          failOnRemoval: true
+

.github/workflows/coverage-check.yml

@@ -0,0 +1,119 @@
+name: Compare Test Coverage
+# This compares test coverage and throws an error if test coverage is lower than the previous run.
+
+on:
+  push:
+    branches: [development]
+  pull_request:
+    branches: [development]
+
+jobs:
+  test-coverage:
+    name: Compare Test Coverage
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout development branch
+        uses: actions/checkout@v3
+        with:
+          ref: development
+          path: development
+
+      - name: Setup Foundry
+        uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: nightly-5be158ba6dc7c798a6f032026fe60fc01686b33b
+
+      - name: Install dependencies
+        run: sudo apt-get install lcov
+
+      - name: Get development branch coverage
+        id: coverage-development
+        working-directory: development/packages/contracts
+        run: |
+          # generates lcov.info
+          forge build && forge coverage --report lcov
+
+          # Merge lcov files
+          lcov \
+              --rc lcov_branch_coverage=1 \
+              --add-tracefile lcov.info \
+              --output-file merged-lcov.info
+
+          # Filter out node_modules, test, and mock files
+          lcov \
+              --rc lcov_branch_coverage=1 \
+              --remove merged-lcov.info \
+              --output-file filtered-lcov.info \
+                  "*node_modules*" \
+                  "*test*" \
+                  "*mock*" \
+                  "*scripts*" \
+                  "src/dollar/mocks/*" \
+                  "src/dollar/utils/*" \
+                  "src/deprecated/*" \
+                  "test/*" \
+
+          # Generate summary
+          COVERAGE_DEVELOPMENT_OUTPUT=$(lcov \
+              --rc lcov_branch_coverage=1 \
+              --list filtered-lcov.info)
+
+          echo COVERAGE=$(echo "${COVERAGE_DEVELOPMENT_OUTPUT}" | tail -n 1 | cut -d % -f 1 | cut -d \| -f 2) >> $GITHUB_OUTPUT
+
+      - name: Delete development branch folder
+        run: rm -rf development
+
+      - name: Checkout code in PR branch
+        uses: actions/checkout@v3
+
+      - name: Get PR branch coverage
+        id: coverage-pr
+        working-directory: packages/contracts
+        run: |
+          # generates lcov.info
+          forge build && forge coverage --report lcov
+
+          # Merge lcov files
+          lcov \
+              --rc lcov_branch_coverage=1 \
+              --add-tracefile lcov.info \
+              --output-file merged-lcov.info
+
+          # Filter out node_modules, test, and mock files
+          lcov \
+              --rc lcov_branch_coverage=1 \
+              --remove merged-lcov.info \
+              --output-file filtered-lcov.info \
+                  "*node_modules*" \
+                  "*test*" \
+                  "*mock*" \
+                  "*scripts*" \
+                  "src/dollar/mocks/*" \
+                  "src/dollar/utils/*" \
+                  "src/deprecated/*" \
+                  "test/*" \
+
+          # Generate summary
+          COVERAGE_DEVELOPMENT_OUTPUT=$(lcov \
+              --rc lcov_branch_coverage=1 \
+              --list filtered-lcov.info)
+          echo COVERAGE=$(echo "${COVERAGE_DEVELOPMENT_OUTPUT}" | tail -n 1 | cut -d % -f 1 | cut -d \| -f 2) >> $GITHUB_OUTPUT
+
+      - name: Print coverages
+        run: |
+          echo Development branch coverage: ${{ steps.coverage-development.outputs.COVERAGE }}
+          echo PR branch coverage: ${{ steps.coverage-pr.outputs.COVERAGE }}
+
+      - name: Compare coverages
+        if: ${{ steps.coverage-development.outputs.COVERAGE > steps.coverage-pr.outputs.COVERAGE }}
+        run: |
+          echo "Error: test coverage decreased"
+          exit 1
+
+      - name: Upload test coverage report to coveralls.io
+        uses: coverallsapp/github-action@v2
+        with:
+          file: packages/contracts/filtered-lcov.info

.github/workflows/create-diagram.yml

@@ -0,0 +1,27 @@
+name: Create Diagram
+on:
+  workflow_dispatch: {}
+  push:
+    branches:
+      - main
+jobs:
+  create-diagram:
+    name: Create Diagram
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@master
+      - name: Update Diagram (Contracts)
+        uses: githubocto/repo-visualizer@main
+        with:
+          excluded_paths: "ignore,.github"
+          output_file: "utils/diagram-contracts.svg"
+          root_path: "packages/contracts/"
+          commit_message: "docs(diagram): contracts"
+      - name: Update Diagram (User Interface)
+        uses: githubocto/repo-visualizer@main
+        with:
+          excluded_paths: "ignore,.github"
+          output_file: "utils/diagram-ui.svg"
+          root_path: "packages/dapp/"
+          commit_message: "docs(diagram): ui"