ethers.js: A Compact Ethereum Library

Transcript

sounds good okay I'm running a few minutes late I think but it's a similar talk then I've given it before so if you've seen me before you've priced in a very similar talk I usually give this talk in ten minutes I have 20 ish today I'm hoping to open the floor to more like Q&A at the end because I feel like usually girls no time for questions and I've also focus a little more on the CLI for this but we'll just go through quickly the slides that most have probably seen before either online or in person when you guess Green nope red nope left left right there we go okay so right so features of ethers Jas so I mean it's basically it should be

like do everything you need to do for ethers whether you're writing the wallet whether you're creating adapt more importantly for creating a framework so supports all the type of accounts oh all the things on the screen I have to stop point the screen you can't see me point there the bold things are going to be things we kind of like dive deeper into the great things are kind of things that exist if you have questions feel free to ask both them so I'll just run through those quickly but basically so accounts you can deal with private keys mnemonics any Jason wallet json-rpc it's complete it works for any type of thing you want to build I recover but ready so enter is ready for no js' browser is fully type scripts written

type scripted all compiles down very well tested 20,000 test cases I think it's closer it's just over maybe like 99 kilobytes is so close to crossing that that thing it's kind of depressing inna support does it uh or discover things in the next slides how's that again please anybody those questions like just jump up and yell out a very reactive type of presenter presenter yes so right so one of the key features is different again forgive me allow you for hours before it like it I really want to drill this into people's minds I think we need to make a division between what a provider is and what a signer is like a provider is connected to the network it has access

to the Internet people might have access to it is a very different from a signer a signer has your private key you want that like sequestered really well and that sort of thing also I talk fast so if I'm going too fast just tell me to slow down I will try so I mean again it's all the basic things you're used to json-rpc providers the web three providers if you currently have a web 3 app and you just want to wrap your existing provider and make it compatible with ethers fallback provider we'll go into because I owe actually us on this light yes a bunch of third-party providers I think note Smith does not exist anymore but other than that everything's still running fine so the key thing is the default provider default providers are exciting because so a default

provider is actually a fallback provider which connects to all these things on the right-hand side and the exciting thing about how it works is there's a quorum so it's connecting to those four backends and when you make a request to the provider it's picking a random subset of the back-end providers and sending the requests in a semi intelligent way to multiple backends to get a response back once enough of the backends have agreed that that is the correct response then that's when you get the answer so if you ask the current block number and inferior says it's 35 and note Smith says it's 40 and help me says it's 40 well it's gonna drop the inferior one and go with the obviously

it's 40 something's out of sync you don't care who somebody's wrong quorum is nice as well cuz it also means that if if Elka me was hijacked if somebody like became malicious and was returning wrong results who's ever attacking the network has to co-opt half of the network half of the different API is to actually affect the results the example I like to give of the dangers of this is you can imagine resolving ENS names if I wanted to if I was able to hijack like a woman's services and I wanted to make lots of money I would just make them all return my address for any query to ENS yes anyways we can go more into that later if you have questions where you

have a button and so signers signers this is where your private key lives this is a very different thing altogether one thing that's being his cleft support which is some up there but ledger support works again for anybody who was using ledger nanos you can just use it it works in the browser works in the like a no js' that's our thing so BIP 39 I do not this is nothing updated there's also check now so all BIP 39 official mnemonics are supported um that's kind of enough for the oh um I also one point this out when you have a UI and you accept a Java like a JSON wallet or something if it takes like right it's important that using a wallet

takes time to decrypt if it's fast to decrypt that means it's fast for me to try guessing your password if it takes 15 seconds for me to try one password if I want to try a million passwords turn the brute force or thing that's 15 million seconds it takes it's important that it takes time there's everyone wants but can you make it take time just for the bad guys no you can't has take time for everyone but you can really mitigate this by putting a progress bar in your DAP if you are trying to use your wallet there's a little bar tick tick ticking across and it says decrypting for your protection the user doesn't usually mine as much if it's your UI just halts for 15 seconds sure don't don't do that and so that's one of the reasons why there's a progress

callback and it's all like a secure fun yes do do do yes so E&S so I'm sure everybody not by now knows ens this was a bigger deal like three years ago when the way herd had heard of it but es is a first-class citizen anywhere you can use an address or anywhere you put an address in you can use an ENS name so I mean for me I use this for a lot of my things so new takoyaki eath this just connects to the takoyaki contract which is nice because it means if I upgrade it the code out the universe does not need to change if you were using my npm library it's connecting using this everything just

continues working and no one has to like upgrade anything obviously it comes with caveats as well it means that I could change things on you if you were depending on weird functionality or a bug if you're depending on a bug in my contract and I update my contract rate for that bug well the s your stuff break so there's a static versus dynamic linking choose your poison again get balancing it basically yeah yeah anywhere you can put a thing you can put a thing yes do-do-do-do-do deploying a contracts right so when the key things with ethers signers is when you send a transaction you don't get back a transaction hash you get back the actual transaction the biggest advantage of

this is for deploying contracts the moment that you get that caught the knot it has not been mined yet before your contracts been mined you get back a contract a contract object which has its contract address and so even before your contract has been deployed to the network while still sitting out the transaction pool waiting to get mind you have access to the address which means you can write it to a database or you can start configuring the next part of some chain of a multi-sig wallet or whatever you need to do but it's important to have the knots that was used for this that sort of purposes so yes that's my order for that so this is new and b5 as well so this feature everyone wanted and I always provided

the very simple like 12 lines of code that was ridiculous to do it so it's now built into contract objects so if you have a function called transfer there's a bucket called populate transaction all the functions on your contract exists there as well except instead of returning the it's actually saying the transaction it just returns the transaction object which would result in that transaction happening this is great if you're trying to offline signing if you want to send it to a ledger nano and and give it to like a watch tower or for counterfactual that sort of thing similar a lot of people like using eath call on things that are non-static just to kind of like preflight there's still of consistency issues but it's useful feature in some cases and so yeah

there's bucket called static call with all the functions on there and that just returns to you like what would happen each call basic would eat call for not static estimate actually quick pull in this room I'm contemplating 4v5 changing it because v5 is still beta it'll be coming betta over the next week or so do people like the word estimate or estimate gas for this part here more all in favor of estimate all up here for estimate gas okay gas has it I will make that change tonight and then obviously transaction execution this is what everyone's used to it just works and does stuff so application

binary interfaces so one that you how much time do I have so much timings okay I'll just assume that I'll get a notification of some sort so application binary interface so we're all used like that this JSON clump that gets knocked out by solidity it's been very useful thus far but it's large it's very very large especially once you have a yeah like an A or C some number token contract so a human readable a B is are also nice because basically it is the solidity function the same information encoded on the left is encoded on the right here at the top and as you see it's much more concise but more importantly if you have that line in your source code in the constructor for

the contract it's much more obvious what function even exists on that weird metaclass object that just got created so let's go for that it turns out I think the maths I did says but one-fifth the size on average of a JSON ABI as well so that's nice the one downfall of that of course is now you're embedding the ABI into your source code which means if you change them in your contract and recompile it your that artifact file is often not being indexed ingested by your contract so again pros cons the world's your oyster and obviously you have so v5 has complete access to all these solidity parser ABI

stuff that's going on in there so you can convert from JSON into human readable or you can convert from human readable into JSON or so the one caveat is you can never really convert from say cash sig hash it's kind of like a black hole as you can see it throws information away first of all it doesn't indicate whether that's a function or an if but more importantly if it's an event it just through a like index but this is what you would hatch if you're trying to figure out what's a cash use it what topic cash to use Oh see a div - I feel like this is no longer news I should I remove this slide for those who don't know API v2 is awesome it basically lets you do anything no matter what type of structure or thing or structure of

structures or array of structures or array of structures or whatever you want to pass in it just works and so this slides like three years old so it's not interesting anymore I will remove it utilities there's tons of utility classes if you need to do anything weird important class I think people need start using as strings so a lot of people I see don't realize how incredibly complex utf-8 is and they they use like a classic example if you have a string a lot of people do dot split thinking that this is going to give them each character it gives you each like utf-16 code unit which is very different

like as for example the the poop emoji if you try to make it out split will give you two characters but it's one one character right so yeah use this it has a function now that actually will split code units out for you so if you want freaking a little count for the length of the length of a string you shouldn't be doing dot split dot length because this is giving you very wrong data especially in the world today where people like including emojis and everything most the emoji space is going to corrupt your program if you're expecting that length to me something did it also has like if you have like legacy solidity strings flooded maybe is legacy web three strings that were kind of like a weird hacked encoding if this string was

less than 31 bytes it would stick it into a word it has things for parsing that I think that everything else is like fairly low-level you probably don't need it unless you're writing Wallace or like doing weird counterfactual things so yes so I want to talk more about today is getting more into the command lines so there's a command line tool called ethers there's a whole bunch of them recently added ethers ASM which is an assemble so you can write pure assembly and it'll spit out this big blob of a deployable thing for you so again you can see you can use ENS names where ever you would otherwise so a a few slides you'll see what options there are for accounts but you can send either sign a message wrap

ether unwrap there's a there's actually like 30 things in there now the one thing I'll be adding very soon because the feature I want is and I don't know what to call yeah but move font moved I into DSR move DSR into die I'll think of a better name than those but basically I want you to be able to manage everything from the from the pan line I personally have a offline Chromebook that I've removed all the antennas and all the cards that connect to the network from and I use my own custom signer that exports everything over a terminal QR code so it's nice because I can put this why I want sign into that it pops up a QR code I can scan it and that completely offline computer can actually get like science transactions the

network through the CLI ah sweet is very useful if you are a hacker and you find someone's key you can use sweep that's not the real purpose for it the main reason to have sweep sweep will if you give it a private key will take all the funds at that incentive to whatever address you give it the main reasons for this is because we've all maybe done this but worried about one day hitting get push and you realize fraca doodle you like included that private key and I think this gives you that quick emergency hatch do you like sweep the funds out of that thing before anyone else figures out is there so it's a very useful feature sign of tokens as well ddddd also if you're scripting things

the eval command is awesome if you want to do all your if you want do everything you do in aetherium in bash eval is your friend you can pass it in like these strings and it basically runs it against the ethers library so you can convert 0.123 the string into way if you're doing again crazy bash stuff or z shell resolving names I mean basically anything that exists in ethers exists in this in virtualized environment if you want to experiment with it there's actually repple if you type ethers by itself you get the entire yeah everyone knows raffle it gives you a repla environment so you just experiment I use it a lot for debugging especially when I get an issue someone's like my transaction doesn't work what's

going on it's nice that I can just type ethers paste the transaction and their parse it and be like oh your gas price is zero that's your problem so it's very quick for debugging eagerness name service migrate register he needs to go away because I doesn't exist anymore but basically I also manage all my ENS names for the command line I'm a command line person I really don't like you I I don't want to put private keys that are valuable in meta mask it's a browser it's with yeah so yes enos do stuff es is awesome by the way Frankie doesn't know I'm a big eNOS fan using an S ok accounts this is I think I'm almost done this is an example of

the type of accounts you can use so if you have a text file with a mnemonic in it you can just use it if you want to put a password on it this is using the the BIP 39:39 style password there's also a feature which is experimental which is why it's got the xxx stash whatever in front of it what this will do is it'll take your password it'll run it through s script for about a minute and then use that as the password into your mnemonic so if anybody see my article and squirreling basically I'll go into quickly if you have a mnemonic it makes a private key if you choose a password it gives you another private key if you choose a different password it gets you a different private key any password is a valid development private key for a mnemonic so what I actually

I'm suggesting most people do is make your mnemonic put $200 we took ether sitting on that that bear mnemonic and then what you're really going to do is whenever you use your mnemonic enter a password so anyone who fine and so you can put all your ether and like I say fubar as your password don't use fubar find a better password but if you put all your all your real stuff with the password fubar anybody who finds your mnemonic who's gonna be there either hold it be confused they won't know what it is but they'll show their science their computer science you friends look oh that's quit that's a mnemonic they'll type in their wallet and they'll see the funds and they're gonna steal those funds so fast which is awesome because now you've just been notified that your mnemonic is

in the wild you are possibly compromised you load up that mnemonic right away you type in fubar to get your real funds and move them somewhere else because that into a new protected mnemonic so that's what I'm really trying to get people to do these days and the nice thing about using the the hardened method is if people start using squirreling a lot people are gonna maybe start thinking oh if I find this demonic I'm gonna try a bunch of common passwords first if it takes them a minute per password they're probably off stealing your two hundred youth rather than spending the next five years to compute time trying to like find that password fubar don't use for they'd find it in less than that but it's still a lot of work so so yes new monix work you can specify a wallet JSON

a crowd sale wallet you can just give it a raw private key please keep in mind our mnemonic on the command line these two need big asterisk is because like your command line is visible to all processes on the computer which means you just gave your private key way to anything that's happy on your system running so don't use those ones instead you can use this - and the - will then prompt you and once the prompt comes up this is a secure entry you can control the whatever you need to do to put your private key in there and it's off the races or you can use like a JSON RPC node you have and the nice thing is if you're running just ethers you get your your repla environment and there's an accounts object and this just so if you

did like - - account one like a crowd sale JSON and then - - account wallet dot JSON a - I should count mnemonic then you're gonna have an accounts object which has three objects in it three different signers each of which represents each of those three accounts so it's also useful for creating deployment scripts yes I think that's haha I'm done so questions oh yes thank you for presentation and thank you for the evil command it will save me a lot of time when trying to hash something know I've got some feature

requests one of the thing that is really hyped right now is deploying your smart contractor or blockchain using the same address ens has done that for our new registry eunice WEP is doing that for version 2 and the cleanest way to do that is to sign a transaction with an empty signature find which address it correspond to given your code and just fund this account if you want that to work on all all blockchain you need to use pre e IP 155 signature before there wasn't an ID in the signature so the question is can I do that using a 30 GS and if not can you add it you can and I've actually got a medium post on how to do it

check out blog record calm it's not a link up there oh no it's not the word out the word blog in front of Ricky calm I'll add it to my slides for next time but yes basically just pass in 0 when you're signing your transaction and you will get a signed transaction that has disabled the IP 155 oh okay this is amazing another question is a one of the only features that I need an extra GS library on top of I searched GS is the signing er C 712 order yes will you be adding that at some point E I P 712 there's a issue to create it it's I think maybe even you have asked for this before I know you anything anyways it is something that's on the list

I was really hoping a IP 712 would die and we have a better solution by now but yes enough people are now using it I'll be adding it soon but for now there is a implementation by meta mass or something something consensus e oh sorry I can't hear you meta mess is using an implementation that works really well the thing is you need a private key and the private key is hidden inside a signer so oh there are some things I thought you could maybe just get the hash that you need to design no because you don't sign it the same way as you would sign them message hash so if you write just ask your private keeps a sign or to sign a message you won't get the good one so at the very least I will add a helper method that produces the hash

you need to from that library yes yes yes it is definitely coming soon WebSocket supports the other thing that'll be so I'll put that on par with WebSockets so yeah IP 7 12 and WebSockets first of all good for your project I use it a lot so another future request as you as you do with a CGSA for the keys would be it would be good if you have a prop shinto you know encrypt and decrypt data using you know public keys and private keys it would be helpful you feel within the

actors it's going to be used a lot because nowadays I use it easier in the end and I use it and you choose one of our belief from parity that in JavaScript to do this but as you have a awesome library have this will be a very good know so I have read it and it's in the experimental package but I haven't published it yet there's so it's you're right absolutely trivial to write all the libraries are already built in it does support it gives you V CDH so it's a lot of it's very easy to get that shared symmetric secret the biggest issue is it's very important that people understand how to encrypt and decrypt things before they try a classic example imagine if there's a vote and I need a

yes or no answer from you and what you're going to do is you're going to encrypt whether you said yes or no and publish that to the blockchain it's important to realize that the length of it it'll be encrypted but it'll either be three letters long for guess or two letters long for no so you need some way to really get through to people like even though you're encrypting stuff you could very easily be leaking really important information I mean in this case there's literally no value to encrypting you've just made an expensive like public announcement whether you said yes or no maybe you could use French so we or not are both the same length that's the trick find a better language but but it's so I mean that's the main reason I don't offer that because I know I'll be

dealing with people who think encryption is so easy there's a dot encrypt function I put data in and data came out so it's more about I mean and I can solve these I mean I can for example choose a random number and pad a bunch of random bytes on the end so that now everything is sixteen bytes long you can't tell what it was but there's other ways secrets can be leaked and I agree with you that's why they will probably on the experimental package it's a useful feature to have it's one that I've written for myself to use but it's because I know that and I might say no all of them but I know some of the the pitfalls that people go through and so yes anybody else oh yes I think your last one

have you considered adding elliptic curve integrated encryption system yeah is that the scheme that you were planning to use for encryption or yeah so basically what it does is it uses a ephemeral key generating ephemeral key from the private key you mix it with the product with the public key and then you staple the public key to the front of the payload and it's just it's just normally CDH I look in elliptic curve diffie-hellman thank you awesome thank you thank you [Applause] for punch

sebastian was my name