Beyond CREATE2: Smart Contract Multi-chain Deployments with CREATEX, YAC3F, and Foundry

Transcript

[Music] welcome everyone uh last session of the lift stage today we're going to end with amazing session going Beyond crate 2 smart Contra multi chain deployments with crate X yacc 3F and Foundry our speaker going to be radc who is system architect uh he is also the organizer of the Beery so if you love beer perhaps you want to talk to him so please welcome rodic to the stage with appuse hey I have my mind okay thanks a lot thanks for the intro uh it's awesome

right the E now all and all the side events which are here that that that's really you know energizing I would say but um I hope that I will not make you asleep because we will go like quite technical for some of the people you know I was showing this they said okay I'll not come to this session so I hope that you guys are Technical and that you will enjoy it because we'll talk about the the multi-chain deployments and the necessity of doing that and how it is being done what are the risks and what are the issues and and what are the ways on how to do that and what was like the progress since last year uh a little bit more about me uh as I was introduced I'm like architecting the things I am highly

involved in like smart contract development I uh create check stable coin and I organize that py Meetup for the developers which is like the monthly one uh I'm also listening to the mass Market that's what the leico mentioned here uh because I want to hear about the users you know what are their troubles and most speciically their fears like the blind signing for instance um and I'm also involved in some sort of the decentralized science like non funural brain which will introduce this Sunday so you are uh really welcome to come on Sunday on the lighting talks we will talk about the brains and and and some things like that I've been coding since ' 80s since late 80s and I very enjoy the ERC discussions on The etherum

Magicians because I feel that we are like forming the what will be like impacting the solutions that would be uh in the future um for this case I am the creator of the public good which is called yet another create three Factory and I also created the creatics for package and we will talk about that a little bit later um one of the issues when you think about the fun tokens for instance and not only that but any interaction which is there with the contracts there are many many attack vectors and and the ideal outcome is well ideal for for the attack is that they can do the uh they can forge the recipient for instance uh

which is very common you know when you are sending out like some usds or something and they will try to to fish you and and and basically Forge the recipe and it's a certain moment that you will send those usds uh to as the address or they can try to forge a contract or they can try to forge the allowance that's very common with the approvals right um this we discussed um last year on some of these sessions and and events which were mostly focused on the blind signing which I'm highly also uh involved into that how to mitigate all things and there was a conclusion at DC expra regarding this topic it was that any minor Improvement in any of those

steps uh that would mitigate some of those particular attack vectors where you can see that there are many attack vectors over here so any minor step which can be here that could like mitigate some of those uh or avoid some of those attack vectors that helps um and by the way with introducing the account obstruction we are like enlarging this scope of the attack vectors because there will be many more the larger surface for that um and speciically with a very new one with 7702 uh that people will be able to like execute a bite code on on their eoa uh so this is about one minor Improvement which we concluded that it's

necessary um just imagine the stable coins when you have a major stable coins like here is usdc um it's hard to guess which address is correct if it's for instance forged by the attacker because the circle deploy that on these addresses here on ethereum anding like this and on test address is also different then on the optimism it's very different address very different address the same for the arbit room again different addresses so you as a user and neither technically the wallet wallet could know that but as a user you cannot say that this is usdc contract um so if the attacker just

gives you some other address you just go there because you don't care about those addresses even if you're like num number file and and you know and you feel the numbers you cannot guess whether the whether the contact address is correct or not so uh this is easy uh attack vector and should be easy to fix because it's only about deployment to the same addresses right and that's what we concluded with a check stable coin that that to deploy those check stable coin contracts that it will be necessary to deploy them on the same address on any vum chain so whether it's on the etherum layer one whether it's on arbitrum optimism uh polygon nosis any other evm chain where it's possible to do it so we

can forget about some ZK uh ZK special rollups that's not possible to do that there but but on the others on most of the EM Chains It's it's possible to deploy it on the same evm address and it helps not only to avoid and and mitigate this that that attack Vector but it also helps devops so those like Mups that the devop just in the configuration just you you know something is wrongly typed there because there are different addresses and they forget that that was for the test net and not for the production if you have the same address to deploy to on each chain on the production on the Des net and you don't need then you don't know um you don't do that mistake as devops right in the

configurations so there are a few more things why to have the same address so no configuration issues uh people are not confusing the test net addresses and production addresses with sending funds that happened that they that they knew well when we had those um those addresses of the usdc they they they had the information about the address from the test net and they use that address on the production and they s send their their production money or triy tried to interact with that and it was you know um somewhat stupidly um misused uh better fishing spam recognition because the fishing contracts would have to be deployed on the different addresses so when you have

one address which is clear uh then it's uh much more easy to recognize right and uh there are a few more thing this is mostly for user facing contracts like ERC 20s so from fible tokens and it's very important for the Registries so like eap1 1820 which is used by 777 so the other technical Norm for the uh for the fible token but also for the Eon obstruction registry it needs to be on the same address on each chain otherwise you know it has a problems so for the regist is very important to have this capability um how it is being done now

um now it's uh deploying that normally is that you need to manually take care about synchronizing nonis and that's what explained here I don't know how many how many of you are here like solidity developers or that they would somehow know you know what what what this means yeah um for the rest of the guys over here we will go in you know more deep now um but anyway this is the most common way and the point is that from the devel perspective you you need to carefully manage the nuns on each chain so once you make the the the once you make the wrong transaction you make the mistake it's gone you you can never

deploy it onto the same address once you have a different nuns you lose so for that particular chain you lost um and also the private key from that deploying uh account you you must not lose it you know it's once it got lost you do not have a chance chance to deploy it on the same address because it's derived from the center address and the center nons uh and it's happening projects often fail to maintain the same address on different blockchains that they support um so in 2017 18 I think the create2 of cod was was created or or proposed so that should have Sol it

right because creating a new Newan with Associated code uh at predictable address so you can have like deterministic deployments well um it's important to understand that actually op codes can only be called VI a smart contract so you cannot directly do the same as what you did with the creation of the contract that you would say ah okay create two and create it on this particular address so that's not possible and in that case um the create two Factory was born that's the Nyx Factory which is used mostly that's the you know the ens guy and you can see the URL down there the the it's also easy in The Foundry uh I I don't know how many

guys over here know The Foundry framework or somehow use that yeah hardhead almost no one hard so it's already shifted to Foundry yes uh anyway so in The Foundry you can use it like this because it's like uh they support it a lot the NES are not reflected so that's good that n risk is mitigated uh however it has some more ISS some other issues the first issue is whether the factory itself the NY Factory is Deployable on on each chain and whether it already exists there it exists on most of the chains but at the moment when I was researching that last year I realized that there are a few chains where it is not deployed and even

some chains where it is not possible to deploy it why because uh the deployment of the Nyx Factory is being done by the transaction which is uh pre-signed so you replay the transaction on each chain where you want to deploy it that factory and if that chain has uh has denies actually uh replaying of the transactions from you know presign transactions from the different chain then you cannot do that so it uh it disallows the um Legacy Legacy transactions basically and those chains are there and and there was um quite a real example on that that the

Eon obstruction uh colleagues over here they had to convince some of the chains to predeployment [Music] problematic right I create a smart contract so there's a bite Cod and it's the same all the time it's not true because once you once you compile it with the with the higher solidity version then the bite code changes the very recent well recent was last year the the significant change was uh jump from 0.8 19 towards the 20 something that was that uh 19 LS did not have the

push zero code and 20 and higher or they compiled into P zero codes so your bite code changes quite significantly and also when you change the commands in your code then your bite code changes well not the whole one but the but the metadata part so in fact the bite code changes um so you you the changes are normal there of the bite code and since the address is derived from the bite code and you lose um then there is a a third issue and that's the of gas situation or some you know problems when you execute a transaction there is again example living example on the

chain and that's nosis safe you will not be able to deploy that common address of the nosis safe on nosis chain because they tried it they fell out of gas done so you lose for that so basically as the uh to to remedy these issues there was like a enormous wave of creating the factories that that that would mitigate that and those are called create three factories uh some of them are like in the soulmate for instance I'm not sure about open Zin but definitely on soulmate and solidity they are there um and and some common projects which work cross chain like layer zero AEL and the

others they do have uh create three factories for themselves but then you depend on them if you use their factories and when I was searching when we want where we want to deploy our things I realize okay cross cheing the chains they are here here here ah they are not there I was asking are you planning to deploy the factory there yeah you know our support Engineers blah blah blah and so on three months left nothing so you are depending on this third party basically um so so the last year was not that much about creating this mechanism but about having this mechanism available for for anyone for on on almost any chain and but anyway here's described how this Factory Works

basically when you have eoa and you you call the deploy method of the factory the the factory itself it's always on the same address so that's why it's crucial to have this Factory on the same address on on each chain uh that that Factory calls the create two um which means that that nuns risk is mitigated because it doesn't depend on your nones from from eoa and and and creates the temporary secondary Factory with the always the same bite code because that's that's actually written here in the in this Factory contract so this this mitigates that issue of changing the bite code because it's always the same So based on the salt which you provide this temporary

Factory is always on the same address depending on your salt and then it calls create normal create op code which is then creating your final contract and there the nun is always one because once you create the contract in solidity it it receives the NS as one so and and at that time that bite code of this becomes irrelevant so that's like a two-step or three-step process but basically it looks like this when you run it so try to find like 10 differences there um it's like some ZK game right anyway uh the point to show over here is that basically what you see the numbers

those those are the C of the you know the bite code of the final contract which you want to deploy and it's being called twice that's one of the disadvantages of that uh mechanism uh so for these cre three factories I created one which is called yet another create three Factory right a funny name because I was like any additional one and I was and and I realize that we need to create something that would be available for anyone what is good for we already discussed right uh for those issues to mitigate it's very good for the singlet tone contracts you can see on this URL so you can if you are interested in it uh you can go

ahead into and and see on the GitHub anyway it's written in half uh how many people over here knows half W silent one ah okay op codes awesome op codes you know the point about half is that that you are actually working very tangibly with evm so what you write there is ex exactly done as you know what what what you designed that's very very different to solidity because one when you write the solidity sometimes you are starting to fight about the gas optimization you know and and and some security practices on there so you basically fight with the

comp compiler of the solidity when you go on the deeper level and you use the op codes or have then you are really exactly what you design is exactly executed and so that's why that that's the advantage of course that is there is the disadvantage if you have some um more complicated business logic than it's like um not that much readable right in the in the op codes but for the factories for registries for something you know that just stores the things and and and you know uh just executes on things uh I would say I would prepare the H because you would be much more certain what it does and how it does it and so that's the reason why I created

for the for the factory because for your contract when you want to deploy it you want to make sure that that factory that is deploying just does what it's supposed to do that it doesn't like add any additional fishing scamming you know some extra Cod there towards your final contract uh which is on on chain ah someone is like uh that it couldn't be possible yes it could but yeah anyway um so that's one of the reason the second reason is that it's very light because you just need like 100 bytes uh so if if if anyone wants to deploy this Factory on any chain even if it is very expensive chain to deploy 100 bytes is much cheaper than to deploy

like 20K and and the factory itself um uh has the feature that in fact it either deploys that provided contract your your contract or uh or revers so that issue of the of the nosis safe is mitigated basically uh there are still issues and the deployment of the factory itself because uh I was researching the keyless deployments there we have those problems with those chains where you cannot replay those transactions and uh the consequence is that some factories would not be able to exist everywhere so we need to find some other way and I was desperately looking for some MPC or some some other like

cryptographic solution where the community uh would just uh somehow align on on deployment on on on on the different chains uh so since basically it's public goods so I thought that we could find something as a large community and then it could work there uh I was researching that and and meanwhile I was discussing with the other create fre Factory uh uh creators and and finally during Christmas time last year 2023 uh create X was was deployed and uh this is a contract deployer which has like features like create 2 and create three it's uh done

by Pascal and mat so very I would say I would say um very representative people of the ethereum community and values uh and where where we are able to discuss some some key risks like the risk of loss of the deployer private key and so on so all those issues which you mentioned and the risk uh at the beginning we were like discussing you know how they mitigate it and whether they have a fallback so basically what they do is that they do have um preci transactions which you can replay on those chains where it is allowed and for the cases where it is not allowed they have their private keys and so they

serve as some sort of the fallback so basically for these like I don't know 5% 3% of the chains you are depending on them if it is not already deployed so it's like a little bit like lesser risk than the other cases um but still yeah the the overall question is when you're at the project and you think I want to deploy any and even in the future and you really need to think about that risk will I be able to deploy it there onto the same address as I did it on 60 other chains and behave accordingly uh so that create X is already deployed on 7 chains on the production chains and and some additional test Network chains so on

quite large Network so that was say the end of the year and and since it was that that I would say it it gets such momentum I created a Foundry package uh for easier deployment and testing with these create X factories um which is easy like this as you can see you just import it in your script uh for those guys who work with the pH right there is a script the fer script to make the deployments so you just import this this create X script and then you use it in in the Run Part uh and and it's setup that you say is create X and in the Run Part you use it that you want to comp compu the address of the deployment and then then you just just say deploy it here and and you just

add like that you want to sorry you don't see it it's above me uh that you want to design some salt which is like protecting that for the front running and so on so all these features are there and you just execute um and it has that feature that if if uh you are trying to test it and it's not deployed on that test so basically locally when you do the loal testing and you run the NL um then it just like edges that that create X Factory there so it detects edges so it's easier to test and easier to deploy uh some issues remain so there is still dependency for those few cases of

of of some chains I would say um and then the other case is that the factory bite code is solidity um even though in solidity you you write that that you want to have it optimized I would consider any any output of the solidity is highly unoptimized you know what you see there how the solidity compared what it does it's unbelievably unoptimized so it's very heavy uh I don't know it might have like 20K the factory itself so compare it like 20K to R 100 bytes you know and it does almost the same for the user so uh for me as the check stable coin designer I need yet to perfectly analyze the this create X

Factory you know what it does and what are the outcomes I started to do that I cannot show it now because I haven't finished yet uh and the key one though is that create three is call it a heavy that's what I was showing before that it's like twice sending that bite Cod on chain so you are paying more of course during the deployment but that's one time you know but overall for the whole like community and the ecosystem we are just doing this and and and and putting more you know data on on on the storage or I mean the call data storage so not really good so my question at the time

was uh what if we could have like pre-compile that would enable like stateless runtime code etching onto the address which is derived from the uh from the runtime bite code why it would help just imagine that you had some sort of a registry or something like that or or some sort of the other kind of factories ideally the stateless factories right in that case it doesn't matter who deploys that it might be me it might be you it might be somewhere else in the middle of this room it just would not matter so why not to allow that and and do it like without any conditions that someone could deploy uh partical contracts which we like carefully mentioned that make clear

that this is like stateless that there is no like initialization or ownership you know uh just by etching that would enable us to like even like um clone the contracts from the different chains towards the other chains when you want to just like copy paste the whole whole solution from one chain to the other chain so I I realize that I'm pretty much missing the sort of the quote yes I'm at the end um so um one one more conclusion is do not use create three in in in eips of the eof which was mentioned there but since we are already using the Creed Three terminology then it's like clashing then the other announcement is

effective starting June 30 for your guys who are from uh Europe the MAA is you know becoming effective and we already discussed that a few times somewhere and thank you and on the next beer fight June 25 you are welcome to come and discuss some coat and beer nice okay so given that we are running out of the time perhaps only one question will be received otherwise you would have a chance to mingle outside and asking more questions uh anybody have a question come on at least you guys who who cot you know you can ask what is half at least the half

guy or you here go oh I'll say I know Huff in the sense that I'm familiar with it not that I've used Huff before so what I'm familiar with Huff but I haven't used it personally before yeah um what do you think of Viper for example when compared to solidity um I haven't researched the Viper that much even though I was among some people over here in this in this country who were like setting up the python community so uh I I didn't tend to you know go that road I I would rather see some like compiler there and making sure that at least on the compilation level we can like throw away some some

mistakes and I I'm not sure where the Viper is really you know how it is being done there so I cannot really literally answer on that um yeah at the end there is also a question it could be fast question fast answers two two minutes three minutes so uh one last question perhaps who where is how how does Huff compar to U sorry what how does Huff compare to Ule ah yeah um uh U is is much more abstract and and espeically oh and there are two differences when when you use U just itself and when you use u in solidity when you use u in solidity then

you have limitations and you cannot you cannot manipulate stack uh in when you have it in solidity in the in in the uh in the methods when when you when you use it uh itself then you have many more options but still half is uh literally it's just like when you use the macros on on the op codes and with u it still tries to optimize some things so you need to think on how how it compiles while who you just write it as it is so I would I would say when you think about the op codes then then half is that it just gives you some convenience of the macros and you is above from the obstruction

perspective very interesting so if you have more questions uh R can be around and then you can easily find them obviously with a mask so please like bother him asking more questions and give big Applause to radic okay thanks [Music]