[feature] Move avatar code to separate package

.gitignore

@@ -1,3 +1,4 @@
+package-lock.json 
 .env
 yarn.error.log
 yarn-error.log

.nxignore

@@ -7,3 +7,7 @@ secret/
 # We don't want the CI to run over all the packages, we decided to ignore it for now
 yarn.lock
 .yarn/*
+
+# We don't do anything with docs right now, specifically we don't want to run over the core package.
+/**/documentation
+/**/docs

README.md

@@ -1,20 +1,65 @@
-# TSB contracts
+<p align="center"><a href="https://sandbox.game"><img width="300" title="TSB" src='brand-assets/tsb_pride.png' /></a></p>
 
-This workspace uses [Nx, a Smart, fast and extensible build system.](https://nx.dev) 
+<h1 align="center">The Sandbox Smart Contracts</h1>
 
-## Understand this workspace
+<a href="https://github.com/thesandboxgame/sandbox-smart-contracts/actions"><img alt="Build Status" src="https://github.com/thesandboxgame/sandbox-smart-contracts/actions/workflows/main.yml/badge.svg"/></a>
+![Node Version](https://img.shields.io/badge/node-18.x-green)
+[![Discord](https://img.shields.io/discord/497312527093334036.svg?label=Discord&logo=discord)](<https://discord.gg/vAe4zvY>)
 
+[The Sandbox](https://sandbox.game) is a user-generated content (UGC) gaming platform, that will empower creators through digital ownership and monetization of 3D voxel creations made and shared by users around the world.
+
+This mono-repo contains The Sandbox smart contracts, underpinning The Sandbox metaverse. Our key token contracts were conceived inside the core package. You can find out more about some of our early blockchain features in [this article](https://medium.com/sandbox-game/blockchain-features-in-the-sandbox-7db91fcc615c). Since core was created, we have added new contracts and updates via new packages - see the below Architecture Overview for more information.
+
+## Learn more
+
+- [Website](www.sandbox.game)
+- [Discord](https://discordapp.com/invite/vAe4zvY)
+- [Telegram](https://t.me/sandboxgame)
+- [Medium](https://medium.com/sandbox-game)
+
+## Prerequisites
+
+- ⚙️ [NodeJS](https://nodejs.org/)
+- 🧰 [Yarn](https://yarnpkg.com/)
+
+## Tech stack and getting started
+
+This workspace uses [Nx: a smart, fast and extensible build system.](https://nx.dev)
 Run `nx graph` to see a diagram of the dependencies of the projects.
 
-To add a package simply add it inside the packages directory, optionally every package can implement
-the following targets that will be run by the root `package.json` scripts and on the CI:
+To add a package simply add it inside the packages directory. Every package can implement the following targets that will be run by the root `package.json` scripts and on the CI:
+
+- `test`: run unit tests inside your new package.
+- `coverage`: run coverage. Note: CI expects to have at least 80% coverage.
+- `lint`: lint your code.
+- `format`: format the code with prettier.
+
+See [`packages/example-hardhat`](./packages/example-hardhat) for an example template package for smart contract development with Hardhat.
+
+Refer to each package's readme for more information about that package. Note that deployment for all new packages is carried out via `packages/deploy`.
+Each package should follow the [audit best practices](./audit-best-practices.md) where applicable.
+
+### Developer quickstart
+
+```bash
+yarn install
+```
+
+## Architecture Overview
+
+- 📦 This mono-repository contains a suite of smart contract packages.
+- ⚖️ The mono-repository is released under [MIT license](./LICENSE). Note, that the packages may contain their own licenses.
+
+| Package                                                                               | Version                                                                                                                                            | License                                                                                                  | Description                              |
+|---------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------|------------------------------------------|
+| [`@sandbox-smart-contracts/packages/core`](./packages/core)                           | [![npm](https://img.shields.io/npm/v/@sandbox-smart-contracts/core)](https://www.npmjs.com/package/@sandbox-smart-contracts/core)                  | [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://spdx.org/licenses/MIT.html) | 🗝️ Core smart contracts (pre 2023)        |
+| [`@sandbox-smart-contracts/packages/deploy`](./packages/deploy)                       | N/A                                                                                                                                                | [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://spdx.org/licenses/MIT.html) | 🚀 Deploy all packages (except core)      |
+| [`@sandbox-smart-contracts/packages/example-hardhat`](./packages/example-hardhat)     | N/A                                                                                                                                                | [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://spdx.org/licenses/MIT.html) | 👷 Development template using Hardhat     |
+| [`@sandbox-smart-contracts/packages/giveaway`](./packages/giveaway)                   | [![npm](https://img.shields.io/npm/v/@sandbox-smart-contracts/giveaway)](https://www.npmjs.com/package/@sandbox-smart-contracts/giveaway)          | [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://spdx.org/licenses/MIT.html) | 🎁 Instant Giveaway smart contract claims |
+| [`@sandbox-smart-contracts/packages/dependency-metatx`](./packages/dependency-metatx) | [![npm](https://img.shields.io/npm/v/@sandbox-smart-contracts/dependency-metatx)](https://www.npmjs.com/package/@sandbox-smart-contracts/giveaway) | [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://spdx.org/licenses/MIT.html) | 🌐 Dependency: ERC2771 handler            |
 
-- test
-- coverage: run coverate, CI expect to have at least 80% coverage on packages.
-- lint
-- format: format the code with prettier.
-- deploy: to test hardhat deployments.
+## Contributing
 
-## Further help
+### Bug bounties
 
-Visit the [Nx Documentation](https://nx.dev) to learn more.
+Submit a bug at [Immunefi](https://immunefi.com/bounty/thesandbox/) to help secure our smart contracts!

audit-best-practices.md

@@ -0,0 +1,63 @@
+# Audit best practices
+
+Here a non-exhaustive list of best practices to check before sending a contract to an audit:
+
+## Smart Contracts
+- fixed pragma version on all smart contracts
+- natspec at least on external functions, public functions, variables, beginning of contract
+- linebreaks between code (imports, contract, within functions, etc) to improve readability
+- consistent indentation
+- contract size under 24kb
+- check gas usage and optimise where it is sensible to do so 
+- generate a gas report
+- events on every non view functions
+- DRTW: use OZ when possible (Access Control)
+- use constants instead of strings or duplicate numbers
+- disable initializer in the constructor for upgradeable contracts
+- when upgrading a contract, check for storage consistency
+- check who's owning the contract, the deployer should not own the contract
+- when using ERC2771, only use msgSender()
+- avoid loops on arrays that are not limited in size
+- check for centralization issues: changing variables, transfering assets from the contract, upgrades, forwarder, centralized metadata, etc
+- use recent solidity version but a stable one
+- logic issues: go back to the specs and compare
+- avoid fake random 
+- use uint256 over any other uint
+- check your inputs (address it no 0, size is correct, limit size of arrays)
+- think about how the user/dApp will interact with your contract (am i missing a getter ?)
+- think about how to make your contract as generic as possible, that helps us build an open protocol
+- when using OZ upgradeable contracts, don't forget to call the init functions
+- check if your `supportsInterface` matchs what your contract uses
+- check for the usual attacks: reentrancy, front running, etc
+- challenge your naming
+- only use named imports
+- order your code (variables, constructor, public, etc)
+- @notice on every external / public function; @dev to help developers understand
+- licence on every contract
+- @author on every contract
+- check for typographical Errors
+- unused named variable
+- when dealing with ERC20, keep in mind deflationary tokens
+- one condition per require for readability
+- check for duplicate code
+- clean debug / TODO comments
+- put constants in upper case
+- consider to block renouncing ownership
+- consider using immutable on variables
+
+## Unit Tests
+- 100% coverage
+- fuzzy testing
+
+## Reports
+- generate documentation from natspec
+
+## Deployment
+- tests deploy the contracts inside the fixture; no deploy scripts in package
+- verify your contract to improve trust
+- open source your contracts
+- integration tests
+
+## Security
+- run slither but be selective about the issues
+- deploy on a testnet & test manually

package.json

@@ -10,16 +10,16 @@
     "description": "The Sandbox smart contracts",
     "scripts": {
         "test": "nx run-many --target=test",
-        "coverage": "nx run-many --target=coverage && istanbul-combine -r lcov -r html packages/*/coverage.json",
+        "coverage": "nx run-many --target=coverage && istanbul-combine -r lcov -r html 'packages/*/coverage.json'",
         "lint": "nx run-many --target=lint",
         "format": "nx run-many --target=format",
         "deploy": "nx run-many --target=deploy",
         "all": "nx run-many --all --parallel --targets=lint,format,test,deploy && nx run-many --all --targets=coverage",
-        "test:ci": "nx affected --target=test",
-        "coverage:ci": "nx affected --target=coverage && istanbul-combine -r lcov -r html packages/*/coverage.json",
+        "test:ci": "nx affected --target=test --parallel=1",
+        "coverage:ci": "nx affected --target=coverage --parallel=1 && istanbul-combine -r lcov -r html 'packages/*/coverage.json'",
         "lint:ci": "nx affected --target=lint",
         "format:ci": "nx affected --target=format",
-        "deploy:ci": "nx affected --target=deploy",
+        "deploy:ci": "nx affected --target=deploy --parallel=1",
         "clean": "rimraf coverage/* && nx run-many --target=clean"
     },
     "repository": "https://github.com/thesandboxgame/sandbox-smart-contracts",

packages/avatar/.eslintignore

@@ -0,0 +1,16 @@
+node_modules
+.env
+coverage
+coverage.json
+typechain
+typechain-types
+
+# Hardhat files
+cache
+artifacts
+
+# generated docs
+generated-markups
+
+# editors
+.idea

packages/avatar/.eslintrc.js

@@ -0,0 +1,41 @@
+const path = require('path');
+const tsconfigPath = path.join(__dirname, 'tsconfig.json');
+module.exports = {
+  root: true,
+  extends: [
+    'eslint:recommended',
+    'plugin:mocha/recommended',
+    'plugin:prettier/recommended',
+  ],
+  parserOptions: {
+    ecmaVersion: 2020,
+  },
+  plugins: ['mocha'],
+  env: {
+    commonjs: true,
+    node: true,
+    mocha: true,
+  },
+  overrides: [
+    {
+      files: ['*.ts'],
+      parser: '@typescript-eslint/parser',
+      parserOptions: {
+        project: [tsconfigPath],
+        ecmaVersion: 2020,
+        sourceType: 'module',
+      },
+      plugins: ['mocha', '@typescript-eslint'],
+      extends: [
+        'eslint:recommended',
+        'plugin:@typescript-eslint/recommended',
+        'plugin:mocha/recommended',
+        'plugin:prettier/recommended',
+      ],
+      rules: {
+        '@typescript-eslint/no-misused-promises': 'error',
+        '@typescript-eslint/no-floating-promises': 'error',
+      },
+    },
+  ],
+};

packages/avatar/.gitignore

@@ -0,0 +1,16 @@
+node_modules
+.env
+coverage
+coverage.json
+typechain
+typechain-types
+
+# Hardhat files
+cache
+artifacts
+
+# generated docs
+generated-markups
+
+# editors
+.idea

packages/avatar/.prettierignore

@@ -0,0 +1,16 @@
+node_modules
+.env
+coverage
+coverage.json
+typechain
+typechain-types
+
+# Hardhat files
+cache
+artifacts
+
+# generated docs
+generated-markups
+
+# editors
+.idea

packages/avatar/.prettierrc.js

@@ -0,0 +1,15 @@
+module.exports = {
+  singleQuote: true,
+  bracketSpacing: false,
+  plugins: ['prettier-plugin-solidity'],
+  overrides: [
+    {
+      files: '*.sol',
+      options: {
+        printWidth: 120,
+        tabWidth: 4,
+        singleQuote: false,
+      },
+    },
+  ],
+};

packages/avatar/.solcover.js

@@ -0,0 +1,7 @@
+module.exports = {
+  mocha: {
+    grep: '@skip-on-coverage', // Find everything with this tag
+    invert: true, // Run the grep's inverse set.
+  },
+  skipFiles: ['/contracts/mock'],
+};

packages/avatar/.solhint.json

@@ -0,0 +1,21 @@
+{
+  "extends": "solhint:recommended",
+  "plugins": ["prettier"],
+  "rules": {
+    "prettier/prettier": [
+      "error",
+      {
+        "endOfLine": "auto"
+      }
+    ],
+    "code-complexity": ["error", 7],
+    "compiler-version": ["error", "^0.8.0"],
+    "const-name-snakecase": "off",
+    "func-name-mixedcase": "off",
+    "constructor-syntax": "error",
+    "func-visibility": ["error", {"ignoreConstructors": true}],
+    "not-rely-on-time": "off",
+    "no-inline-assembly": "off",
+    "reason-string": ["warn", {"maxLength": 64}]
+  }
+}

packages/avatar/README.md

@@ -0,0 +1,75 @@
+# <PACKAGE>
+
+*Include a high level description of your package here*
+
+This example project is based on the template generated by hardhat when run in an empty directory.
+
+This project demonstrates a basic Hardhat use case. It comes with a sample contract, a sample test fixture for that contract,
+and tests.
+
+## Creating a new package
+
+You can copy-paste this example package: `cp -a packages/example-hardhat packages/<package>`
+
+## Running the project locally
+
+Install dependencies with `yarn`
+
+Testing: Use `yarn test` inside `packages/<package>` to run tests locally inside this package
+
+For testing from root (with workspace feature) use: `yarn workspace @sandbox-smart-contracts/<package> test`
+
+Coverage: Run `yarn coverage`
+
+Formatting: Run `yarn prettier` to check and `yarn prettier:fix` to fix formatting errors
+
+Linting: Run `yarn lint` to check and `yarn lint:fix` to fix static analysis errors
+
+## Package structure and minimum standards
+
+#### A NOTE ON DEPENDENCIES
+
+1. Add whatever dependencies you like inside your package; this template is for hardhat usage. OpenZeppelin contracts
+   are highly recommended and should be installed as a dev dependency
+2. For most Pull Requests there should be minimum changes to `yarn.lock` at root level
+3. Changes to root-level dependencies are permissible, however they should not be downgraded
+4. Take care to run `yarn` before pushing your changes
+5. You shouldn't need to install dotenv since you won't be deploying inside this package (see below)
+
+#### UNIT TESTING
+
+1. Unit tests are to be added in `packages/<package>/test`
+2. Coverage must meet minimum requirements for CI to pass
+3. `getSigners` return an array of addresses, the first one is the default `deployer` for contracts, under no
+   circumstances should tests be written as `deployer`
+4. It's permissible to create mock contracts at `packages/<package>/contracts/mock` e.g. for third-party contracts
+5. Tests must not rely on any deploy scripts from the `deploy` package; your contracts must be deployed inside the test
+   fixture. See `test/fixtures.ts`
+
+# Deployment
+
+Each package must unit-test the contracts by running everything inside the `hardhat node`. Deployment to "real"
+networks, configuration of our environment and integration tests must be done inside the `deploy` package.
+
+The `deploy` package only imports `.sol` files. The idea is to recompile everything inside it and manage the entire
+deploy strategy from one place.
+
+1. Your deploy scripts should not be included inside `packages/<package>`: deploy scripts live inside `packages/deploy/`
+2. The `deploy` package doesn't use the hardhat config file from the specific package. Instead, it
+   uses `packages/deploy/hardhat.config.ts`
+3. You will need to review `packages/deploy/hardhat.config.ts` and update it as needed for any new namedAccounts you
+   added to your package
+4. When it comes to deploy time, it is preferred to include deploy scripts and end-to-end tests as a separate PR
+5. The named accounts inside the `deploy` package must use the "real-life" values
+6. Refer to the readme at `packages/deploy` to learn more about importing your package
+
+#### INTEGRATION TESTING
+
+1. End-to-end tests live at `packages/deploy/`
+2. You must add end-to-end tests ahead of deploying your package. Importantly, these tests should verify deployment and
+   initialization configuration
+
+# A NOTE ON MAKING PULL REQUESTS
+
+1. Follow the PR template checklist
+2. Your PR will not be approved if the above criteria are not met