Improve your development & security using VS Code extensions - Stepan Sonsky, Lukas Rajnoha

Transcript

[Music] thank you uh hello everyone uh thank you for coming and uh today we will uh show you how to improve your smart contract development and Security in vs code my name is chipan and I'm a team lead an ethical hacker and developer in Aki blockchain security we are based uh in Prague Czech Republic and we are mainly focused to security audits uh development of open source security tools and also we are teaching uh evm and uh solidity at uh

CCH Technical University well uh these are some of uh our clients uh we work for example with Lio safe Axel or 1 inch and we also received some uh grants for our open source development well uh are there any developers here hands up okay cool uh so let's dive in and uh we will show you how to improve uh your development and Security in vs code so uh what features do we need to achieve this so for the development M

syntax highlighting of course uh we want to easily navigate through the code uh we need to compile our code and deploy it to some local chain and interact with our contracts uh using some convenient way uh or using tests and debug of course because developers don't like bugs but hackers do and that's why uh we should measure the security even during the development process uh so we need uh at least good static analyzer uh which can detect some

vulnerability patterns in your code and show them in the code and sometimes it's useful to see the code from the different perspective more visualized so uh graphs can be useful and uh yeah we wanted to have all these features in one tool and that's why we developed uh solidity vscode extension powered by wake you can easily install it uh from the marketplace uh into the vs code or cursor IDE and you will get all of these features uh for free

so uh let's dive uh a little bit more deeper into the features so here's the static analysis uh we show the detections directly in the vs code UI uh we are using uh many different vulnerability detectors uh to do this and uh the detectors uh there are uh um evaluating the impact and confidence of these issues uh and also in the UI you can uh group them and filter them by uh many criteria so yeah this can be really

useful for uh early State security yeah you can see uh the vulnerabilities uh highlighted directly in a code and yeah uh let's see the graphs uh espe when you are inheriting from uh many uh external dependencies you have U sometimes no idea uh what you are inheriting so here's the example of uh contract which is inheriting from uh for parents but the actual uh call um the actual inheritance graph is uh not that simple so uh you can inherit some uh features which you don't uh

want uh the next type of graph is control throw graph uh which uh transforms this uh is a transfer function uh into this graph so you can see all the execution branches of your uh code so it can be uh useful sometimes as well uh yeah and uh last year uh at ethereum prag we've announced uh convenient UI for deploying and interacting with your contracts directly in the vs code so uh today I'm really excited to say that we have it released and uh please warm welcome to Lucas and

he will say you more thank [Applause] you so hello everyone uh oh thank you uh thanks for the introduction um as said I'm Lucas I'm also uh an auditor and developer at Aki and I'll be talking to you about U the newest addition to the extension uh in order to do that I first have to take a step back and talk a little bit more about uh the different testing approaches we can take then I will Circle back to the extension and um talk about the new features so I believe

we can take two different approaches when testing our applications firstly you have the comprehensive testing Suites these are your Foundry hard hat brownie complex tests you implement and then use them to test your uh test them against your code however this can take quite some time to implement and often you only just want to peek or inside your code if it works and looks as intended to illustrate what I mean Let's uh take an example from web 2 let's say you you are developing some backend you can just open Postman insomnia any similar software click a few buttons and you can immediately see if the app is

behaving as it should I mean front end is even easier you just open the browser right and can immediately see if the code looks as intended transferring this to remix how can we um to Smart contracts how can we actually uh test our contracts in a s chain um way uh I would argue that this is where Something Like Remix comes in for those unfamiliar remix is a uh code editor it has all the basic uh functionalities you would expect however it also packs a few solidity uh specific features mainly this nice interactive UI which allows you to compile interact and deploy your

smart contracts on a local chain um remix thanks to this nice functionality has become one of the most well-known toolings in solidity development however I would argue that it has quite a few limitations which hinder it from becoming a professional grade uh tooling firstly I mean it's only web based although there have been efforts to bring it as a stand loone desktop application all of these were deprecated over the years secondly I would argue that the user experience could be vastly improved uh it can feel quite cluttered uh for example to give you some specific pain points when you're compiling and deploying your contracts you can only do

it one by one selecting uh each and every one from a drop down this just creates unnecessary friction right it it takes too much time whenever you are interacting with these contracts you deployed uh the results get displayed within the console locks you don't have to scroll up and down because I mean they get buried there with within all the other information that gets displayed so it can feel a bit too much and then the third reason the third limitation is that quite a few developers already have their workspaces set up the way they want them to look and behave most solidity developers use vs code so they install all the themes they want all the extension Etc and it's kind of a hard cell to actually persuade

these developers to uh transition to a completely different application um at Aki we realized this was an issue uh ourselves and uh in order to solve it we decided to implement all of this functionality within vs C natively firstly in the initial version which we released I think in September we included all the basic functionality so you could deploy um compile deploy and interact with your contracts um we didn't want to really um reinvent the wheel here uh although I may have criticized the remix user experience a little bit I do believe the core princip Les are actually correct so we really just polished the areas uh which I

previously mentioned uh but we didn't want to stop here and now I would like to show you what we've been working on for the past few months so firstly it can be quite annoying to have to uh reset your chain each time you want to try something different so we added multiple chain support you can think of this as sessions let's say uh so instead of resetting the chain you can just create a new chain where you can start with a blank slate and try something different with this it made total sense to be able to uh add some Advanced configurability to these chains so you can set your number of accounts you can set some gas specific settings what I would like like to highlight here is

that you can also set a for qrl which allows you to uh put like a URL from Alchemy and this way you can Fork any evm compartible chain into your local chain uh then lastly within the advance Advanced config you can also connect to already running chains locally uh with this Advanced configuration it also made sense to be able to save all of the states since it can take a bit of time to configure all of this so we added chain stay saving all of this happens automatically so you don't have to really worry about it so you can close vs code reopen it back later and start where you left off unless of course you disable it on your own

uh since I mentioned Fork testing um uh forking uh AVM compartible chains uh it also made sense to be able to integrate all of these contracts on these chains uh with your smart contracts you're developing so we added a way uh to fetch onchain contract just by clicking a single button you can provide the address uh of the contracts you want to uh Fetch and it gets displayed within the UI and as a cherry on top we also realized during our testing that the proxy pattern is extremely common and it was kind of annoying that you couldn't access the implementation functions on the proxies so we added a quite nice little button where you can just uh

select the API of a different contract to add to your proxy to be able to access the implementation functions as well to summarize all this uh in the new version you can run multiple chains at once you can uh set your Advanced configurations for these chains specifically you can Fork an evm compartible chain and you can connect to already running local chain instances all of this configuration and your work can be Autos saved uh between vs code sessions and then as the two cherries on top you can also fetch on chain contracts and uh you have native proxy support uh within DUI um to give you a little hint uh a sneak peek on what

we're trying to uh achieve this year uh we would like to add also deployment on chain because uh that's where all of your code lifes so yeah fingers crossed that uh we'll be able to achieve this as well um all right all of this is open source and free uh so you can either um scan the QR code or just search for solidity wake on your uh on vs Mark Marketplace and uh yeah I will give you a sec if you want to scan it or take a picture okay uh and yeah that's the end of the presentation uh thanks everyone for coming and see you at the bar if you have any questions uh last thing I would like to highlight that uh we have two

other presentations coming today uh we have one about static analysis at the sepolia stage and tomorrow about fast shrinking so if this sounds interesting to you please of course you're welcome uh thank you [Applause] thank you very much Lucas and Stefan do you have any questions we can take two questions hi um thanks a lot it looks like a some extension I will definitely be using it uh are there is there any

plan to bring as the debugger from remix uh which is the quite handy feature and I was wondering if there was any plans for that uh yeah we also have yeah we also have this on our road map however that uh requires quite a bit of time to implement uh I mean uh you can understand probably that it's quite of quite a complex task so uh yeah definitely on our road map but currently we we are focusing on the onchain deployment hopefully after that we can also include the debugger yeah thanks a lot and thanks lot for the tooling it is it's great thanks a lot thank you yeah any other questions if this is not the case we

thank you again Lucas and Stefan for your amazing talk thank everyone yeah [Music]