Merge pull request #59 from horuslabsio/feat/audit-fixes

feat: tokenbound v3

.github/workflows/test_contracts.yml

@@ -11,6 +11,6 @@ jobs:
       - uses: software-mansion/setup-scarb@v1
       - uses: foundry-rs/setup-snfoundry@v3
         with:
-          starknet-foundry-version: 0.20.1
+          starknet-foundry-version: 0.31.0
       - name: Run cairo tests
         run: snforge test

.gitignore

@@ -1 +1,2 @@
 target
+.DS_Store

.tool-versions

@@ -1,2 +1,2 @@
-scarb 2.6.0
-starknet-foundry 0.20.1
+scarb 2.8.2
+starknet-foundry 0.31.0

README.md

@@ -1,15 +1,15 @@
-# ERC-6551 Reference Implementation on Starknet
+# ERC-6551 Implementation on Starknet (SNIP-14)
 
 This repository contains the reference implementation of ERC-6551 on Starknet.
 
-**NB:** This project is under active development and may undergo changes until SNIP-72 is finalized. 
+**NB:** This project is under active development and may undergo changes until [SNIP-14](https://github.com/starknet-io/SNIPs/blob/main/SNIPS/snip-14.md) is finalized. 
 
 ## The Tokenbound Standard
 This proposal defines a system which assigns contract accounts to Non-fungible tokens (ERC-721s).
 
 These accounts are referred to as token bound accounts and they allow NFTs to own assets and interact with applications, without requiring changes to existing smart contracts or infrastructure.
 
-For more information, you could reference the [original EIP](https://eips.ethereum.org/EIPS/eip-6551) proposed by Jayden Windle, Benny Giang and a few others.
+For more information, you could reference the [original EIP](https://eips.ethereum.org/EIPS/eip-6551) proposed by Jayden Windle and Benny Giang.
 
 ## Repository Structure
 <img width='100%' src="https://eips.ethereum.org/assets/eip-6551/diagram.png" />
@@ -19,18 +19,14 @@ This Repository contains reference implementation of:
 2. An account contract
 
 ### The Registry Contract
-The registry serves as a single entry point for all token bound account address queries. It has three functions:
+The registry serves as a single entry point for all token bound account address queries. It has two key functions:
 
-1. **create_account** - creates the token bound account for an NFT given an `implementation_hash`, `public_key`, `token_contract`, `token_id` and `salt`.
+1. **create_account** - creates the token bound account for an NFT given an `implementation_hash`, `token_contract`, `token_id`, `salt` and `chain_id`.
 
-2. **get_account** - computes the token bound account address for an NFT given an `implementation_hash`, `public_key`, `token_contract`, `token_id` and `salt`.
-
-3. **total_deployed_accounts** - returns the number of deployed token bound accounts for a particular NFT using the registry.
+2. **get_account** - computes the token bound account address for an NFT given an `implementation_hash`, `token_contract`, `token_id`, `salt` and `chain_id`.
 
 ### The Account Contract
-The Account Contract provides a minimal reference implementation for a TBA. Thanks to native account abstraction on Starknet, it can be easily tweaked to contain as much use case as needed.
-
-All token bound accounts must at least implement all functions contained within the reference account.
+The `accountV3` Contract provides a reference implementation for a TBA. Thanks to native account abstraction on Starknet, It's made up of different plug'n'play components. You can build your own account implementation using the available components.
 
 ## Development Setup
 You will need to have Scarb and Starknet Foundry installed on your system. Refer to the documentations below:
@@ -40,7 +36,7 @@ You will need to have Scarb and Starknet Foundry installed on your system. Refer
 
 To use this repository, first clone it:
 ```
-git clone [email protected]:Starknet-Africa-Edu/TBA.git
+git clone [email protected]:horuslabsio/TBA.git
 cd TBA
 ```
 

SECURITY.md

@@ -0,0 +1,10 @@
+# Security policy
+
+If you believe you have found a security vulnerability in our code, we encourage you to report it to us as soon as possible.
+We ask that you do not publicly disclose any details of the vulnerability until we have had an opportunity to investigate and address it. 
+
+## Reporting a vulnerability
+
+To report a security vulnerability, go to [Report a vulnerability]([email protected]). This will create a draft advisory. Please provide as much detail as possible including steps to reproduce the issue and any potential impact it may have.
+
+Alternatively, you can also send an email to [email protected]. We will work to acknowledge your report within 24 hours and will keep you informed throughout our investigation and resolution process. 

Scarb.lock

@@ -1,14 +1,125 @@
 # Code generated by scarb DO NOT EDIT.
 version = 1
 
+[[package]]
+name = "openzeppelin"
+version = "0.17.0"
+source = "git+https://github.com/OpenZeppelin/cairo-contracts.git?tag=v0.17.0#bf5d02c25c989ccc24f3ab42ec649617d3f21289"
+dependencies = [
+ "openzeppelin_access",
+ "openzeppelin_account",
+ "openzeppelin_finance",
+ "openzeppelin_governance",
+ "openzeppelin_introspection",
+ "openzeppelin_merkle_tree",
+ "openzeppelin_presets",
+ "openzeppelin_security",
+ "openzeppelin_token",
+ "openzeppelin_upgrades",
+ "openzeppelin_utils",
+]
+
+[[package]]
+name = "openzeppelin_access"
+version = "0.17.0"
+source = "git+https://github.com/OpenZeppelin/cairo-contracts.git?tag=v0.17.0#bf5d02c25c989ccc24f3ab42ec649617d3f21289"
+dependencies = [
+ "openzeppelin_introspection",
+ "openzeppelin_utils",
+]
+
+[[package]]
+name = "openzeppelin_account"
+version = "0.17.0"
+source = "git+https://github.com/OpenZeppelin/cairo-contracts.git?tag=v0.17.0#bf5d02c25c989ccc24f3ab42ec649617d3f21289"
+dependencies = [
+ "openzeppelin_introspection",
+ "openzeppelin_utils",
+]
+
+[[package]]
+name = "openzeppelin_finance"
+version = "0.17.0"
+source = "git+https://github.com/OpenZeppelin/cairo-contracts.git?tag=v0.17.0#bf5d02c25c989ccc24f3ab42ec649617d3f21289"
+dependencies = [
+ "openzeppelin_access",
+ "openzeppelin_token",
+]
+
+[[package]]
+name = "openzeppelin_governance"
+version = "0.17.0"
+source = "git+https://github.com/OpenZeppelin/cairo-contracts.git?tag=v0.17.0#bf5d02c25c989ccc24f3ab42ec649617d3f21289"
+dependencies = [
+ "openzeppelin_access",
+ "openzeppelin_introspection",
+]
+
+[[package]]
+name = "openzeppelin_introspection"
+version = "0.17.0"
+source = "git+https://github.com/OpenZeppelin/cairo-contracts.git?tag=v0.17.0#bf5d02c25c989ccc24f3ab42ec649617d3f21289"
+
+[[package]]
+name = "openzeppelin_merkle_tree"
+version = "0.17.0"
+source = "git+https://github.com/OpenZeppelin/cairo-contracts.git?tag=v0.17.0#bf5d02c25c989ccc24f3ab42ec649617d3f21289"
+
+[[package]]
+name = "openzeppelin_presets"
+version = "0.17.0"
+source = "git+https://github.com/OpenZeppelin/cairo-contracts.git?tag=v0.17.0#bf5d02c25c989ccc24f3ab42ec649617d3f21289"
+dependencies = [
+ "openzeppelin_access",
+ "openzeppelin_account",
+ "openzeppelin_finance",
+ "openzeppelin_introspection",
+ "openzeppelin_token",
+ "openzeppelin_upgrades",
+]
+
+[[package]]
+name = "openzeppelin_security"
+version = "0.17.0"
+source = "git+https://github.com/OpenZeppelin/cairo-contracts.git?tag=v0.17.0#bf5d02c25c989ccc24f3ab42ec649617d3f21289"
+
+[[package]]
+name = "openzeppelin_token"
+version = "0.17.0"
+source = "git+https://github.com/OpenZeppelin/cairo-contracts.git?tag=v0.17.0#bf5d02c25c989ccc24f3ab42ec649617d3f21289"
+dependencies = [
+ "openzeppelin_account",
+ "openzeppelin_governance",
+ "openzeppelin_introspection",
+]
+
+[[package]]
+name = "openzeppelin_upgrades"
+version = "0.17.0"
+source = "git+https://github.com/OpenZeppelin/cairo-contracts.git?tag=v0.17.0#bf5d02c25c989ccc24f3ab42ec649617d3f21289"
+
+[[package]]
+name = "openzeppelin_utils"
+version = "0.17.0"
+source = "git+https://github.com/OpenZeppelin/cairo-contracts.git?tag=v0.17.0#bf5d02c25c989ccc24f3ab42ec649617d3f21289"
+
+[[package]]
+name = "snforge_scarb_plugin"
+version = "0.31.0"
+source = "git+https://github.com/foundry-rs/starknet-foundry.git?tag=v0.31.0#72ea785ca354e9e506de3e5d687da9fb2c1b3c67"
+
 [[package]]
 name = "snforge_std"
-version = "0.20.1"
-source = "git+https://github.com/foundry-rs/starknet-foundry.git?tag=v0.20.1#fea2db8f2b20148cc15ee34b08de12028eb42942"
+version = "0.31.0"
+source = "git+https://github.com/foundry-rs/starknet-foundry.git?tag=v0.31.0#72ea785ca354e9e506de3e5d687da9fb2c1b3c67"
+dependencies = [
+ "snforge_scarb_plugin",
+]
 
 [[package]]
 name = "token_bound_accounts"
-version = "0.2.1"
+version = "0.3.0"
 dependencies = [
+ "openzeppelin",
  "snforge_std",
 ]

Scarb.toml

@@ -1,14 +1,14 @@
 [package]
 name = "token_bound_accounts"
-version = "0.2.1"
-edition = "2023_10"
+version = "0.3.0"
+edition = "2024_07"
 authors = ["Horus Labs <[email protected]>"]
 description = "A port of ERC6551 to Starknet"
 repository = "https://github.com/horuslabsio/TBA/blob/main/Scarb.toml"
 license-file = "LICENSE"
 keywords = ["ERC6551", "tokenbound", "cairo", "contracts", "starknet", "standards"]
 readme = "README.md"
-cairo_version = "2.6.0"
+cairo_version = "2.8.2"
 homepage = "https://www.tbaexplorer.com/"
 documentation = "https://github.com/horuslabsio/TBA-SDK"
 
@@ -22,10 +22,11 @@ casm = true
 [lib]
 
 [dependencies]
-starknet = "2.6.0"
+starknet = "2.8.2"
+openzeppelin = { git = "https://github.com/OpenZeppelin/cairo-contracts.git", tag = "v0.17.0" }
 
 [dev-dependencies]
-snforge_std = { git = "https://github.com/foundry-rs/starknet-foundry.git", tag = "v0.20.1" }
+snforge_std = { git = "https://github.com/foundry-rs/starknet-foundry.git", tag = "v0.31.0" }
 
 [tool.snforge]
 # exit_first = true

addresses.txt

@@ -27,3 +27,13 @@ Registry:
 
 Account:
     - ClassHash: 0x45d67b8590561c9b54e14dd309c9f38c4e2c554dd59414021f9d079811621bd
+
+---------------------------------------------------------------------------------------------------
+SEPOLIA v3 :
+
+Registry:
+    - ClassHash: 0x7bf0cad6d569f43780ab5d3a50aa874050ac45192f471e3c88f2ce9ae0b3d75
+    - Contract: 0x23a6d289a1e5067d905e195056c322381a78a3bc9ab3b0480f542fad87cc580
+
+Account:
+    - ClassHash: 0x29d2a1b11dd97289e18042502f11356133a2201dd19e716813fb01fbee9e9a4