We’re on a mission to prevent leaking credentials

Truffle Security

Organizations now recognize the significant role of integrating security in the software development lifecycle. DevSecOps is a powerful approach that has emerged to achieve this goal. By incorporating security practices at the earliest stages of development, DevSecOps helps organizations identify and reduce vulnerabilities more effectively, minimize the risk of security breaches, and build more secure applications. This article will discuss the fundamental principles of DevSecOps and provide key steps for securing your organization’s CI/CD Pipeline. DevSecOps Principles : Organizational principles It is important to involve Security teams right from the beginning of a project to make sure that security requirements are given serious thought and attention early on. This step can prevent the discovery of security problems later in the development phase, which could be more expensive and time-consuming to fix. Involve Security Teams Early: In DevSecOps, it is important for Development, Security, and Operations teams to work together. By promoting a culture of shared responsibility for security, organizations can ensure that all team members play a part in creating secure applications and in identifying and solving security issues faster. Collaboration and Transparency: DevSecOps incorporates security practices early in the development process, also known as "shifting left." It helps organizations to detect vulnerabilities in the codebase before they escalate into expensive and time-consuming issues. Shift-Left: DevSecOps advocates for the inclusion of security procedures throughout the entire software development process, ensuring continuous security. This involves implementing automated security testing, constant monitoring, and regular security evaluations. Continuous Security: The concept of security chaos engineering involves deliberately introducing security-related problems and disruptions into a system to verify its ability to withstand them and reveal weaknesses. Security Chaos Engineering: By replicating actual security incidents, organizations can obtain significant insights into their system's performance during challenging conditions. This enables them to take proactive measures to address vulnerabilities and enhance their overall security position. Security Awareness/Training principles: To make security a top priority of your organization, provide your team members with security training and resources, encourage collaboration, and recognize that everyone is responsible for security. By doing this, you can cultivate a culture that prioritizes and integrates security throughout your organization. Foster a Security Culture: Developers should be encouraged to adopt secure coding practices like input validation, output encoding, and proper error handling. These practices will help mitigate security vulnerabilities in the code and reduce the risk of potential attacks. Adopt Secure Coding Practices: Gamification techniques can be adopted by organizations to encourage a security-focused culture and educate team members on security best practices. Gamification of Security Training: By transforming security training into an enjoyable and competitive experience, engagement and knowledge retention can be enhanced, ultimately promoting better security practices throughout the organization. Technical principles: Automating security processes can bring various benefits to organizations. These include increased efficiency, reduced human error, and the consistent application of security best practices. Automation: To maintain security during the development process, it is important to regularly run security checks and tests within the continuous integration and continuous deployment pipeline. This will ensure that security concerns are constantly evaluated and addressed. Integrate Security into the CI/CD Pipeline: Use tools like static application security testing (SAST) and dynamic application security testing (DAST) to check for weaknesses and potential security threats in your codebase. These automated security testing tools should be added to your organization's CI/CD pipeline to provide real-time security feedback. Implement Automated Security Testing: Securing the CI/CD Pipeline: Key Steps and Solutions To secure your CI/CD pipeline, protecting the Build environment is the first essential step. Only authorized personnel should access Build servers and infrastructure. To prevent unauthorized access, implement robust authentication methods, such as multi-factor authentication (MFA) with hardware keys. Additionally, keep the Build environment up to date with the latest security patches, and configure it according to the best industry practices. Secure the Build Environment: To safeguard your code repository, implement robust access controls that permit only the necessary access to authorized personnel, and monitor it frequently to identify any suspicious activities. Also, keep reviewing and updating user permissions and use encryption to protect sensitive data stored in the repository. Secure Code Repository: Hardcoded credentials, such as passwords or secret keys within the code, is a serious security risk as they can provide unauthorized access if the code is exposed. Hardcoded Credentials Scanner Solutions: Open-source solutions: TruffleHog - https://github.com/trufflesecurity/trufflehog - GitLeaks https://github.com/gitleaks/gitleaks - GitSecrets https://github.com/awslabs/git-secrets Enterprise solutions: GitGuardian - https://www.gitguardian.com/ SpectralOps - https://spectralops.io/ Bridgecrew - https://bridgecrew.io/secrets-scanning/ To automatically detect any potential security weaknesses in your code during the build process, integrate SAST tools into the CI pipeline. These tools can help you find problems such as insecure coding practices, input validation errors, and potential code injection vulnerabilities. Static Application Security Testing (SAST): Open-source solutions: SonarQube - https://www.sonarsource.com/products/sonarqube/ Semgrep CLI - https://github.com/returntocorp/semgrep Enterprise solutions: Veracode - https://www.veracode.com/products/binary-static-analysis-sast Checkmarx - https://checkmarx.com/cxsast-source-code-scanning/ - Coverity https://www.synopsys.com/software-integrity/security-testing/static-analysis-sast.html To ensure the security of your application, you can use SCA tools to track third-party libraries and open-source components that you use. SCA tools can check for potential security risks such as outdated components, known vulnerabilities, and licensing issues. Software Composition Analysis (SCA): Open-source solutions: OWASP Dependency-Check - https://owasp.org/www-project-dependency-check/ - Nancy (GoLang) https://gonancy.dev/ - RetireJS (JavaScript) https://retirejs.github.io/retire.js/ - Safety (Python) https://github.com/pyupio/safety Enterprise solutions: - Black Duck Hub https://www.synopsys.com/software-integrity/security-testing/software-composition-analysis.html Mend - https://www.mend.io/sca/ Snyk - https://snyk.io/ In case your software uses containers, make sure to follow container security best practices, which include implementing minimal base images, scanning for vulnerabilities, and enforcing strict access controls. Additionally, it would be best if you used specialized container security tools, like container vulnerability scanners and runtime security monitoring solutions. Container Security: Open-source solutions: Trivy - https://github.com/aquasecurity/trivy - Grype https://github.com/anchore/grype - Clair https://github.com/quay/clair Enterprise solutions: Aqua Security - https://www.aquasec.com/products/software-supply-chain-security/ Sysdig Secure - https://sysdig.com/products/secure/ Snyk - https://snyk.io/product/container-vulnerability-management/ Incorporate security checks into your use of IAC tools like Terraform, CloudFormation, or Ansible. This is to ensure that the configuration of your infrastructure is indeed secure and free from potential security misconfiguration. Infrastructure as Code (IaC) Security: Open-source solutions: Checkov - https://github.com/bridgecrewio/checkov Tfsec - https://github.com/aquasecurity/tfsec KICS - https://kics.io/ Enterprise solutions: Bridgecrew - https://bridgecrew.io/infrastructure-as-code-security/ Prisma Cloud - https://www.paloaltonetworks.com/prisma/cloud/infrastructure-as-code-security - Snyk https://snyk.io/product/infrastructure-as-code-security/ To test your application in a real-time environment, add DAST tools to your CI/CD pipeline. These tools can uncover vulnerabilities that may only become visible when the application is executing, such as configuration issues, authentication problems, and access control concerns. Automated DAST tools should be used for thorough security testing. Dynamic Application Security Testing (DAST): Open-source solutions: OWASP Zed Attack Proxy (ZAP) - https://www.zaproxy.org/ - Nikto https://github.com/sullo/nikto - GoLismero https://github.com/golismero/golismero Enterprise solutions: Fortify WebInspect - https://www.microfocus.com/en-us/cyberres/application-security/webinspect Rapid7 InsightAppSec - https://www.rapid7.com/products/insightappsec/ - Checkmarx https://checkmarx.com/checkmarx-dast/ To enhance the security of your application and infrastructure, it is essential to continuously track and analyze their behavior. This can be achieved by implementing solutions for constant monitoring and logging. By doing so, you can quickly identify and respond to any potential security incidents that might occur. Continuous Monitoring and Logging: To facilitate this process, tools like SIEM (Security Information and Event Management) systems, intrusion detection systems, and log analyzers can be used to detect and alert you on security events. Open-source solution: ELK Stack (Elasticsearch, Logstash, and Kibana) - https://www.elastic.co/ Enterprise solutions: Splunk - https://www.splunk.com/en_us/products/enterprise-security.html Datadog - https://www.datadoghq.com/ To maintain the security and adherence of your CI/CD pipeline to industry standards and regulations, it is essential to conduct regular security audits and assessments. This includes examining the code, testing for potential vulnerabilities, and assessing the infrastructure. By implementing these measures, you can ensure that your pipeline is secure and compliant. Regular Security Audits and Assessments: Open-source solutions: OpenVAS - https://github.com/greenbone/ - BurpSuite Community https://portswigger.net/burp/communitydownload Enterprise solutions: Tenable Nessus - https://www.tenable.com/products/nessus QualysGuard - https://www.qualys.com/cloud-platform/ - BurpSuite Professional https://portswigger.net/burp/pro To be well-prepared for any security breach or incident, it is essential to create a clear incident response plan that lists the necessary steps to take. To ensure the safety of your application, your CI/CD pipeline must have the ability to roll back any deployments, patch any vulnerabilities, and immediately redeploy secure versions of your application. Incident Response Planning: Open-source solution: TheHive Project - https://thehive-project.org/ Enterprise solutions: IBM Resilient - https://www.ibm.com/products/qradar-soar Cortex XSOAR - https://www.paloaltonetworks.com/cortex/cortex-xsoar - D3Security SOAR https://d3security.com/enterprise-soar/ is a beneficial tool for DevSecOps teams. It's an open-source vulnerability management tool created by the OWASP community. Vulnerability Management and Reporting: DefectDojo This tool helps manage security vulnerabilities in the development process. One central space for all the information regarding defects is provided by DefectDojo. It makes it easier for teams to generate detailed reports and keep track of their progress over time. DefectDojo promotes clear communication about vulnerabilities, which ensures that security issues are resolved efficiently and promptly. As you can see, it is crucial to secure the CI/CD pipeline to implement a successful DevSecOps process. To achieve this, organizations need to incorporate security checks and tools throughout the pipeline. By doing so, they can identify vulnerabilities in advance and address them before they can cause security breaches. This helps to ensure that their applications are secure and comply with regulations. With the steps and practices outlined in this article, you can establish a robust and secure CI/CD pipeline for delivering software quickly and safely.

DevSecOps Principles and Key Steps for Securing the CI/CD Pipeline

Introduction Working with any new technology can be both an exciting and scary experience. On one hand, you might feel excited about building with a new set of tools. But knowing how to choose the right ones, amongst all the tools available, can also be overwhelming. Whether you're just starting to learn Web3 or are an experienced builder, you will understand this daunting experience well. Developers need to have knowledge not only of Web3-specific concepts like blockchains and smart contracts but also of an entirely new tool stack to develop on these concepts. However, with the right steps and proper tools, developers can build on Web3 technologies relatively quickly and efficiently. In this article, we’ll give a brief overview of the steps needed to create a Web3 smart contract. At the same time, we’ll look at how you can navigate those steps successfully by writing, deploying, and testing smart contracts using a tool you already know — Visual Studio Code (VS Code) — and the . Truffle for VS Code extension Choosing the Right Tools After learning the foundations of blockchain and Ethereum, you probably became inspired to start applying your knowledge to build your own Web3 projects. Along the way, you may have collected a long list of tools from various projects and tutorials. Instead of getting lost in that list, let's focus on exploring the steps needed to start a new smart contract project by using one of those tools—the extension—and exploring how it can help through some of the steps of your smart contract’s development, such as: creation, debugging, deploying, and security. Truffle for VS Code Project Creation First, let’s look at creating your initial project. . Since many problems can arise from not properly setting up your project, making sure your file structure is consistent and intuitive in its naming is crucial. A successful project often starts with a good setup and file structure A nice benefit of using the Truffle for VS Code extension is that you can quickly build a new project with the correct structure from the beginning, either by creating a new folder with a templated file structure and starter files, or by simply creating a project from a . Truffle Box To see what a proper file structure looks like, let’s start a new project. First, you’ll need to install the Truffle for VS Code extension. For detailed installation instructions and to get even more info about its capabilities, . check out this post Once the extension is installed, press the keys to open up the command palette. Next, type in the command and select the option . After choosing the project path, a new project will be created with the proper file structure. SHIFT + CTRL/CMD + P Truffle New Solidity Project Create basic project As you can see, the template project has a folder containing smart , another for to blockchain environments, a third folder for , and yet another folder for . The project also includes a for storing information you don’t want to push to a repository, an open source agreement, and a . contracts migrations scripts tests .gitignore license truffle-config.js file This file structure keeps everything neat and organized, so importing from one file to the other or running is straightforward and less prone to errors. Truffle commands Debugging Your Contract Unfortunately, we don't live in a perfect world where there are no errors in our code. And when building your smart contract, you will encounter error messages you may not have seen before. Debugging these transactions can be tricky if you always need to reference a blockchain explorer like for information. Etherscan One solution is to use the feature via the Truffle for VS Code extension. To work with the debugger, open the command palette again and type . From there, you can view transaction messages and work through them step by step. This is important for developers as oftentimes, there can be errors in a certain transaction that would cause the next transaction attempts to fail (like funds being unavailable in a specific wallet). Debug Transaction Truffle Debug Transaction After selecting a transaction, the debugger will become available. Here you can perform typical debugging functions such as step in/out/over, view the call stack, watch windows, and so on. Deploying Your Contract After you have a working smart contract, it’s time to deploy. There are three avenues to approach here. The best practice is to first deploy to a local blockchain instance for testing, such as . Afterward, you would want to deploy to a testnet to verify it’s working correctly in a live environment. Then, only after all the testing is complete would you launch your project to the mainnet. All this testing will help you avoid costly and sometimes irreversible errors in your smart contracts. Ganache Within the Truffle extension, you can deploy to all three types of networks without needing to leave VS Code. You can do this by right-clicking on the .SOL file you would like to deploy and selecting . Deploy Contracts : Using the Ganache Service is a simple way to create a local blockchain with multiple wallet addresses and test Eth that you can use to interact with your smart contract. From the extension, you can create a new Ganache network under the pane in VS Code. After creating a network, you can start/stop and restart the server as needed. Local Blockchain Truffle - Networks : Testnets are designed to work in a similar way to the Ethereum mainnet without the financial costs and risks of deploying directly to the mainnet. Using a testnet is a great way to get a better understanding of how your contract will function once deployed to mainnet. Testnets There are several Ethereum testnets to choose from and they can all be connected to by using a node provider service, such as . After setting up your Infura account within the extension, you have access to your existing Infura projects or you can easily create new ones. Infura : If testnets are like staging servers for your smart contract code, deploying to mainnet is like pushing the code to production. The importance of testing your smart contract code cannot be stressed enough. If there are any errors or loopholes, they can and will be exploited by attackers. These mistakes can be costly for both organizations and users alike. Mainnet Let’s look at how we can secure our contract using the right tools and best practices before we deploy to mainnet. Securing Your Contract Security should be a major priority when developing smart contracts. on what seems like a regular basis. As a Web3 developer, you need to continuously stay up to date on the latest . always Millions of dollars are lost to hackers security best practices Running your smart contracts through tools like or their open-source alternative, , can help you catch many common security vulnerabilities. However, if your project aims to handle the funds of millions of users, it’s best practice to . Diligence Fuzzing Scribble professionally audit your smart contracts Still, developers should be aware of common vulnerabilities while building their projects. One frequent attack vector in Web3 is when hackers use bots to scan deployed contracts for potential vulnerabilities and secret information, such as wallet private keys left in the code from testing. Using a tool like is one way to avoid losing funds and assets from development mistakes. Truffle Dashboard Truffle Dashboard removes the need for developers to store private keys within a config file in the Solidity project. Developers can do a one-time setup process of connecting their Metamask wallet to a locally hosted dashboard on the browser. After this is done, using the keyword instead of copying and pasting keys into a config file is enough. It is compatible with other development frameworks as well, such as Hardhat. dashboard To use the Truffle Dashboard, install the and enter the command in your terminal. Now, any actions that would have required your private keys can get routed through the dashboard instead. For example, to deploy your contract, ensure the proper port is specified in your file (by default this is ), then just right-click your contract to deploy it and select : latest version of Truffle truffle dashboard truffle-config.js 24012 dashboard: 24012 The Right Tools, The Right Way Forward Building a Web3 project doesn’t have to be complicated. With the right tools, the path forward becomes clear. There are many ways to improve your workflow, but having the Truffle for VS Code Extension at your disposal will help you work efficiently from an environment you may already be familiar with. This space moves pretty fast, and new tools are created all the time. So hopefully, this article gave you an idea of an easy way to streamline the development process while navigating the Web3 tool stack. Also Published Here

Using the Truffle for VS Code Extension to Create Web3 Projects

Open Source Intelligence is about turning data and information from public sources into intelligence that gives you actionable answers to your research questions. And while people new to the field of often need to be reminded that OSINT is not just data collection, without sufficient data, your research questions will be answered wrongly or not at all. OSINT As I said: “data and information for OSINT come from public SOURCES”, this statement obviously leads to a couple of questions: What are these sources? Where do I find sources? How can I find new sources? What are the right sources for my investigation? Let’s start with answering the first one: Existing collections of sources Luckily the OSINT community is amazing and there are so many people out there sharing OSINT sources. So probably you will find the sources you need for your investigation in the following list of links: https://github.com/jivoi/awesome-osint https://github.com/sinwindie/OSINT https://github.com/lockfale/OSINT-Framework http://osintframework.com https://start.me/p/DPYPMz/the-ultimate-osint-collection https://inteltechniques.com/tools/index.html https://github.com/cipher387/osint_stuff_tool_collection And the list could go on and on and on. If you think I should add some more, just shoot me a DM on Twitter @secbyaccident and I will add them. If you want to search for more of these repositories, good places to look are GitHub and start.me. Pivoting from existing information Pivoting is essential during every step of OSINT (and probably in the entire field of cybersecurity). Therefore, it should also be applied when searching for sources. For instance, if you know that a account is related to a group you're investigating, their tweets, followers, hashtags, and links could lead to other, less-known sources. Look for patterns or recurring themes, and follow those trails. A website they often link to could lead to another platform they use for communication. Likewise, a hashtag could lead you to other individuals or groups related to your investigation. But Pivoting can also help you discover new sources. Twitter Discovering new sources When conventional methods don't yield enough results, this is where creative problem-solving and critical thinking come into play. With the information you have in hand, ask yourself questions like: "Could my target be active on niche forums related to their hobbies or interests?”, “Are there certain certificates or licenses they possess which might be listed in a specific database?" For example, if your subject is interested in model trains, perhaps they frequent forums such as modeltrainforum.com, sharing insights or asking questions. Similarly, if you know that an individual has an airmen license, you could potentially access more information from the FAA's database https://amsrvs.registry.faa.gov/airmeninquiry/. Remember, people often feel more secure in niche forums and may reveal information they wouldn't elsewhere. In conclusion, when it feels like you've exhausted all your sources, take a step back and go through this thought process. It might help you discover new sources you can add to your OSINT repository and possibly share with the community. In fact, you might discover a whole bunch of new information that restarts the iterative cycle of information gathering. Selecting the right source By now you have plenty of sources you can use in your investigation and the problem is not how you get enough data, but rather getting the right data. And where does the right data come from? From the right sources. But how do we find them? During the initial stage of your information-gathering process, it is generally a good idea to look at as many sources as possible, to see what information they can give you. But most of the time you do not do OSINT like a Pokemon trainer, it is almost never “gotta catch ’em all”, but more “gotta catch the ones that answer the specific question that led me to start my OSINT process” (not great for a theme song, I know). Since my background is in Offensive Security, let’s look at a research question from this field. Imagine you are tasked to craft a phishing email for Chad the Domain Administrator. The investigation could look like this: We know that Chad uses the username ChAdmin. This tells which social media profiles he owns and that he has a great sense of humor. We find ChAdmin on Twitter. He is very active there, but sadly he interacts a lot with members of an extremist group. So we can collect the hashtags he uses, map out the people he frequently interacts with, and do some graph-based analysis to see, if there is one central account, they all interact with. I remember I saw a great tool on GitHub to do this. …WAIT… This does not help my research question at all. Oh, he has an Instagram as well. Look at that, his cute cousin and him playing with model trains. And here he is at a model train convention. Oh, look ChAdmin is also on modeltrainforum.com and he seems to be frequently shopping at themodeltrainshop.co.uk. And his company frequently sends out discount offers from companies they partner with. So now we send out a look-alike email with an offer for his favorite shop aaaaaand we are in. As you can see critical thinking is important while doing OSINT and what really separates advanced practitioners from beginners, is not only having all the amazing tools and sources but knowing when to use which one. (If you are a doctor, please do not remove an appendix with a lawn mower, even tho it might be a new and shiny one) Conclusion Nowadays the amazing OSINT community has mapped out a big part of the internet and has stored all the interesting stuff in nice collections. This presents us with the new problem of selecting the sources valuable to our investigation. And from time to time the right source, might not be known to the OSINT community yet and we need to have the skills to find it on our own. I hope this article has given you some ideas on how to do this. Also published . here If you enjoyed this article, you can follow me on Twitter @secbyaccident, I will post stuff about OSINT and cybersecurity.

The Truffle Pig's Guide to Source Discovery in OSINT

Ethereum has a well-known problem: Transactions are slow, expensive, and don’t scale well. L2s (layer twos) are a new generation of blockchains built on top of Ethereum to solve this problem. Among these new layer two solutions, , a (or zk rollup) is one of the most promising. Linea zero-knowledge rollup In this article, we’ll look at and why it could be the future of L2s. We’ll walk through a tutorial that creates and deploys a smart contract to Linea. And we’ll do so by using all the industry-standard tools you probably already know for building on the Ethereum network: Infura, MetaMask, Solidity, OpenZeppelin, and Truffle. Linea Let’s get started! Linea: A new zkEVM zkEVMs are one the most talked about technologies in web3. They solve many of the most critical problems of public blockchains: cost, speed, and scalability. zkEVMs do so by using a clever piece of cryptography and scaling technology known as the ZK rollup. use zero-knowledge proofs to allow for higher throughput and lower costs by moving heavy computations off-chain in a manner that is secure and easily verifiable. ZK-rollups What makes zkEVMs especially exciting is that they are EVM-compatible by default. This means you can use all the tools, contracts, and libraries created for Ethereum to work on zkEVMs as well with little to no modification. These features of low cost, high speeds, and easy use make zkEVMs web3 technology to master in 2023. the Linea is a zkEVM that is , meaning it was built with to existing tools. If you know the common Ethereum developer tools (MetaMask, Solidity, Infura, Truffle, etc), then you already know how to work with Linea! developer-first native integrations Let’s walk through how to create and deploy a smart contract on Linea. Deploy a Contract on Linea Step 1: Install a Wallet and acquire lineaETH In order to deploy contracts to Linea, we will need to sign off on transactions and pay for gas fees. To do so, we will require a crypto wallet that is capable of holding the gas currency. MetaMask is the most popular self-custodial wallet solution available in the market today. It is free, safe, and easy to use. You can download MetaMask as an extension for your browser. If this is your first time using MetaMask, it will prompt you through a series of steps to set up your wallet. Toward the end, MetaMask will give you the option to . Make sure you do that and save your wallet’s secret recovery phrase. We will need this in a future step. secure your wallet On the top right of your MetaMask window, click on the dropdown and toggle test networks. Once you’ve chosen to view test networks, you should see in the dropdown. This is the test network for Linea (we’ll use the testnet instead of the mainnet—which isn’t yet live as of the time of this article—so that we don’t have to spend real funds on our transaction fees). Network Show/Hide Linea Goerli As you may have already guessed, MetaMask comes automatically configured with the Linea testnet. We don’t have to do any additional configuration. If this is your first time using Linea, you’ll see a balance of 0 lineaETH. Let’s change this by acquiring some free ETH from the . Linea Faucet Once you have your lineaETH, you should see a balance that looks something like this: Step 2: Acquire an Infura Linea RPC endpoint In order to deploy contracts to Linea, we need an endpoint. Recently, Infura added support for Linea, so by creating a free account with Infura, we’ll automatically get access to Linea RPC endpoints. RPC After creating an Infura account, create a new API key from the dashboard. For the network, choose . You can name the project anything you like. Web3 API Once you’ve created a key, you will be navigated to the project’s dashboard which contains a section named . Here, you will find an RPC for Linea. It will be of the form <>. Endpoints Keep this URL safe. We’ll need this in a future step. Step 3: Install NPM and Node In order to create a Truffle project, we need NPM and Node on our local machine. You can download both for free. Once you’ve done so, check that they’ve been properly configured by running the commands below. If all goes well, you should see a version number output for each command. $ node -v
$ npm -v Step 4: Create a Truffle project After installing NPM and Node, we’re ready to create a Truffle project and install all necessary packages and libraries. We will run a series of commands on the Terminal that will do the following things in sequence: Create an empty node repository Install Truffle Initialize a bare-bones Truffle project Install necessary packages such as dotenv, openzeppelin, and HD wallet provider. $ mkdir linea-nft && cd linea-nft
$ npm init -y
$ npm install -g truffle
$ truffle init
$ npm install @openzeppelin/contracts @truffle/hdwallet-provider dotenv In step 4, we install OpenZeppelin to get access to base implementations of the ERC-721 standard (that powers non-fungible tokens or NFTs). Dotenv is a package that helps with secret management. It will ensure that sensitive information such as our wallet’s recovery phrase is not exposed publicly. Finally, the HD wallet provider is a handy package that will allow us to integrate our MetaMask wallet into our Truffle project, and pay for gas/sign transactions seamlessly. Step 5: Configure the Truffle project Before we start writing our contract, let’s configure our project to make sure it can use the MetaMask wallet we set up in an earlier step, and also make requests to the Linea testnet using the Infura RPC. In the root folder of the project, create a new file called and add the following contents: .env MNEMONIC = "< YOUR METAMASK WALLET RECOVERY PHRASE >"
INFURA_RPC = “< INFURA LINEA RPC URL >” This is information that we don’t want to be exposed publicly. The dotenv package will ensure this is the case with the aforementioned file. Let’s now import these values into and configure it to work with Linea. truffle.config.js require('dotenv').config();
const HDWalletProvider = require('@truffle/hdwallet-provider');
const { MNEMONIC, INFURA_RPC } = process.env;

module.exports = {
  networks: {
    development: {
      host: "127.0.0.1",
      port: 8545,
      network_id: "*"
    },
    linea: {
      provider: () => new HDWalletProvider(MNEMONIC, INFURA_RPC),
      network_id: '59140',
    }
  },
  compilers: {
    solc: {
      version: "0.8.19",
    }
  }
}; Step 6: Create the contract We’re now in a great place to write our contract. Our contract is extremely simple. When deployed, it mints a single NFT and assigns ownership to the wallet that deploys the contract. Our NFT will require some metadata to be associated with it. For the sake of this tutorial, we’ll use the following metadata that represents a cute panda: ipfs://QmUyZoK21qb8YknXGfDB34RTY8vMqPb6Bsj9U9iLEnyrZR Here’s what you’ll see when you view the NFT in a wallet or marketplace that supports Linea NFTs): Feel free to replace this with the NFT metadata of your choice. If you’re interested in understanding how to format NFT metadata, . check out the documentation In your project’s contracts folder, create a new Solidity file called and add the following code: LineaNft.sol // SPDX-License-Identifier: MIT

pragma solidity ^0.8.0;

import "@openzeppelin/contracts/token/ERC721/extensions/ERC721URIStorage.sol";
import "@openzeppelin/contracts/utils/Counters.sol";

contract LineaNft is ERC721URIStorage {
    using Counters for Counters.Counter;
    Counters.Counter private _tokenIds;
    string private _metadataUrl;

    constructor() ERC721("Linea NFT", "LNFT") {

        // Set metadata of the NFT
        _metadataUrl = "ipfs://QmUyZoK21qb8YknXGfDB34RTY8vMqPb6Bsj9U9iLEnyrZR";

        // Mint NFT
        _mintNFT();
    }

    function _mintNFT() private {
        _tokenIds.increment();

        uint256 newItemId = _tokenIds.current();
        _mint(msg.sender, newItemId);
        _setTokenURI(newItemId, _metadataUrl);
    }
} Let’s make sure everything is working by compiling our contract. $ truffle compile Step 7: Deploy the Contract to Linea Testnet After compiling our contract and configuring our Truffle project, we’re ready to write a deployment script that launches our contract on the Linea testnet. In the folder of your project, create a new file called and add the following code: migrations 1_deploy_contract.js // Get instance of the Linea NFT contract
const lineaNftContract = artifacts.require("LineaNft");

module.exports = function (deployer) {
    // Deploy the contract to Linea
    deployer.deploy(lineaNftContract);
}; We’re all set! Deploy the contract to Linea and mint an NFT by running the following single command: $ truffle migrate -–network linea If all goes well, you should see an output that looks something like this: Starting migrations...
======================
> Network name:    'linea'
> Network id:      59140
> Block gas limit: 61000000 (0x3a2c940)


1_deploy_contract.js
====================

   Deploying 'LineaNft'
   --------------------
   > transaction hash:    0x528016684927c412b1761e2029e5e7d39862f3ac3716e6b214ab8c105dd144fc
   > Blocks: 2            Seconds: 17
   > contract address:    0xD5B63A037FfF90ca3a73506e9856E543dE42CAA1
   > block number:        849147
   > block timestamp:     1685960558
   > account:             0xc361Fc33b99F88612257ac8cC2d852A5CEe0E217
   > balance:             0.180090609510837606
   > gas used:            2245875 (0x2244f3)
   > gas price:           2.500000008 gwei
   > value sent:          0 ETH
   > total cost:          0.005614687517967 ETH

   > Saving artifacts
   -------------------------------------
   > Total cost:     0.005614687517967 ETH

Summary
=======
> Total deployments:   1
> Final cost:          0.005614687517967 ETH Step 8: Check out contract on Linea Block Explorer We can check out our contract on the Linea Block Explorer. All you have to do is search for your contract’s address. Once you’ve done that, you should be able to see details about your contract, including NFT name, symbol, transaction data, etc. You can check out the contract I deployed when creating this project . here Conclusion Congratulations! You’ve successfully deployed an ERC-721 contract to Linea. If you have experience building on the Ethereum blockchain and other EVM-compatible blockchains, you probably noticed that what we did in this tutorial was identical to what you would’ve done in your normal workflow. You can access Linea’s speed, low transaction costs, and security with your current skill set. If you can build on Ethereum, you can build on Linea. To learn more about Linea and start building dApps, check out . the documentation Also published here. The lead image for this article was generated by HackerNoon's AI Image Generator via the prompt "Contract"

Deploying ERC-721 Contracts on Linea with Truffle and Infura

It’s well known that many blockchains have scalability and congestion problems. These issues have wide-ranging effects from slow transaction times to increased transaction fees and degraded user experience. One solution is for web3 to be using (layer two) chains. Ethereum L2s, such as , , and , build on top of the Ethereum network but are faster and cheaper than Ethereum. multi-chain L2 Optimism Arbitrum Polygon As a tradeoff, however, they are often less secure than Ethereum. That’s why L2s handle the day-to-day user activities while still relying on Ethereum L1 as a behind-the-scenes foundation for a secure and decentralized settlement and data availability layer. This is a great solution — however, there are many L2s on Ethereum alone; each one a standalone network with its own nuances and experiences. Building and using dapps that interoperate and move between these networks and Ethereum L1 can be tedious, difficult, and a poor experience for users and developers. What we need is for web3 to become a experience, where consumers don’t need to know which chain they are using (and frankly, don’t care) and where developers can rely on whatever network best supports their dapps’ needs. multi-chain By moving to this multi-chain , web3 becomes a better experience for everyone involved. internet of blockchains Unfortunately, allowing dapps to move between chains is a difficult technical challenge. In this article, we’ll look at one solution — using Infura RPC endpoints and Truffle Boxes to build on, and bridge these networks seamlessly. Specifically, we’ll use the to create a project on the Ethereum Goerli testnet and bridge to Optimism Goerli. Optimism Bridge Truffle Box Running a Multi-chain Dapp Using Infura and Truffle Boxes Truffle Boxes As the core of our example solution, we’ll rely on — “shortcut” boilerplates (such as contracts, libraries, modules, and even fully-functional dapps) from ConsenSys that you can use to build your dapp. Truffle Boxes For multichain solutions, they build on top of for many of the L2 networks. Infura RPC Nodes As mentioned above, we’ll specifically rely on the . This box has all the contracts needed to interact with the Optimism bridge from both L1 and L2, and a set of migrations for deploying, calling functions, and passing messages/values between the layers. Optimism Bridge Truffle Box It even has a helper script that does everything we need to see this all in action. We simply need to unbox it to get everything we need! According to Trufflesuite.com, the box includes: “An L1 contract that sends a message over the Optimism bridge A migration that sends a message from Ethereum to Optimism An L2 contract that sends a message over the Optimism bridge A migration that sends a message from Optimism to Ethereum A script to automate compiling contracts, running migrations, and sending messages A script to automate sending ETH and DAO across the bridge” Note: a is a tool that allows independent blockchains to communicate with each other, send tokens, NFTs, etc. bridge Prerequisites Before getting started, we need the following prerequisites: and its package manager NPM. Node.js Verify we have Node.js installed by using the following terminal command: node -v && npm -v An Infura account A account MetaMask Basic understanding of JavaScript and Solidity Step 1 — Create an Infura Account to Access The Network Once you have the prerequisites taken care of, visit the Infura website to (or for a new account). log in sign up After successfully signing up, the page redirects to the Infura dashboard where we can create a new API key, as shown below. Click the “Create a New Key” button and fill in the required information. After creating your API key, your project ID will be visible on your dashboard under the API KEY section, as shown below. Copy and keep it somewhere; you will need it later in this tutorial. Step 2 — Setup and Installation Next, we’ll set up a . We can run the unbox command in any directory of your choice using the following command. Truffle Optimism Bridge Box npx truffle unbox optimism-bridge <DIRECTORY_NAME> Replace <DIRECTORY_NAME> with the directory name of your choice. Alternatively, you can install Truffle globally and run the unbox command. npm install -g truffle
truffle unbox optimism-bridge <DIRECTORY_NAME> The command should download and run npm install as part of the unboxing process. Now, run the following command to change the directory to the new one we just created. cd truffle-bridge-demo Note: truffle-bridge-demo is the name of our directory that was created. We should have something similar to what appears below. The . npm package has been installed, but we’ll need to add some information to the .env file created after unboxing. dotenv The file expects a GOERLI_MNEMONIC value to exist in the .env file for running commands on the Ethereum Goerli and Optimism Goerli testnets and an INFURA_KEY to connect to the network. truffle-config.ovm.js GOERLI_MNEMONIC="<your-wallet-mnemonic>"
INFURA_KEY="<your-infura-key>" Replace <your-infura-key> with the information we got earlier from our Infura dashboard. ( : Never share your private keys (mnemonic) with anyone, and keep them secure). And replace <your-wallet-mnemonic> with your mnemonic as seen below: Note To retrieve the mnemonic from Metamask, click the icon shown below on your Metamask. Next, click the button to copy the mnemonic. Export Private Key Git ignores the .env file in this project to help protect your private data. It is good security practice to avoid disclosing your private keys to GitHub. Step 3 — Bridging Using Truffle L2 Boxes When we unboxed the project, all our project’s requisite contracts and scripts were created for us. In this next step, let’s walk through the individual contracts and the migrations to understand how bridging and interactions happen between the networks. The contract shows you how to send a message over the Optimism bridge from L1 to L2. contract/ethereum/GreeterL1.sol //SPDX-License-Identifier: Unlicense
// This contract runs on L1, and controls a Greeter on L2.
pragma solidity ^0.8.0;

import { ICrossDomainMessenger } from
    "@eth-optimism/contracts/libraries/bridge/ICrossDomainMessenger.sol";

contract GreeterL1 {
    address crossDomainMessengerAddr = 0x5086d1eEF304eb5284A0f6720f79403b4e9bE294;


    address greeterL2Addr = 0xC0836cCc8FBa87637e782Dde6e6572aD624fb984;


    function setGreeting(string calldata _greeting) public {
        bytes memory message;


        message = abi.encodeWithSignature("setGreeting(string)",
            _greeting);


        ICrossDomainMessenger(crossDomainMessengerAddr).sendMessage(
            greeterL2Addr,
            message,
            1000000   // within the free gas limit amount
        );
    }      // function setGreeting


}          // contract GreeterL1 The migration uses the above contract to send a message from Ethereum to Optimism. migrations/3_set_L2_greeting.js var Greeter = artifacts.require("GreeterL1");


/**
 * Set L2 Greeting
 * Run this migration on L1 to update the L1 greeting.
 */
module.exports = async function (deployer) {
  console.log("Updating the L2 Greetings contract from L1! 👋👋");


  const instance = await Greeter.deployed();
  const tx = await instance.setGreeting("👋 Greetings from Truffle!");


  console.log(`🙌 Greeter txn confirmed on L1! ${tx.receipt.transactionHash}`);
  console.log(`🛣️  Bridging message to L2 Greeter contract...`);
  console.log(
    `🕐 In about 1 minute, check the Greeter contract "read" function: https://goerli-optimism.etherscan.io/address/0xC0836cCc8FBa87637e782Dde6e6572aD624fb984#readContract`
  );
}; Next, the contract sends a message in the other direction (L2->L1) over the Optimism bridge. contracts/optimism/GreeterL2.sol //SPDX-License-Identifier: Unlicense
// This contract runs on L2, and controls a Greeter on L1.
pragma solidity ^0.8.0;


import { ICrossDomainMessenger } from
    "@eth-optimism/contracts/libraries/bridge/ICrossDomainMessenger.sol";


contract GreeterL2 {
    address crossDomainMessengerAddr = 0x4200000000000000000000000000000000000007;

    address greeterL1Addr = 0x7fA4D972bB15B71358da2D937E4A830A9084cf2e;


    function setGreeting(string calldata _greeting) public {
        bytes memory message;



        message = abi.encodeWithSignature("setGreeting(string)",
            _greeting);


        ICrossDomainMessenger(crossDomainMessengerAddr).sendMessage(
            greeterL1Addr,
            message,
            1000000   // irrelevant here
        );
    }      // function setGreeting


}          // contract GreeterL2 The migration uses the above contract to send a message from Optimism to Ethereum. migrations/4_set_L1_greeting.js require("dotenv").config();
const sdk = require("@eth-optimism/sdk");
const ethers = require("ethers");
const Greeter = artifacts.require("GreeterL2");
const goerliMnemonic = process.env["GOERLI_MNEMONIC"];
const infuraKey = process.env["INFURA_KEY"];

const sleep = (milliseconds) => {
  return new Promise((resolve) => setTimeout(resolve, milliseconds));
};


/**
 * Set L1 Greeting
 * Run this migration on L1 to update the L1 greeting.
 */
module.exports = async function (deployer) {
  const newGreeting = "👋 Greetings from Truffle!"; //<---- CHANGE THIS VALUE TO YOUR NAME!!!
  const instance = await Greeter.deployed();


  console.log("Updating the L1 Greetings contract from L2! 👋");

  const tx = await instance.setGreeting(newGreeting);
  const txHash = tx.receipt.transactionHash;



  console.log(`🙌🙌 Greeter txn confirmed on L2! ${txHash}`);
  console.log(
    `🛣️  Bridging message to L1 Greeter contract.\n 🕐 This will take at least 1-5 min...`
  );


  // Set providers for Optimism sdk
  const l1Provider = new ethers.providers.JsonRpcProvider(
    "https://goerli.infura.io/v3/" + infuraKey
  );
  const l2Provider = new ethers.providers.JsonRpcProvider(
    "https://optimism-goerli.infura.io/v3/" + infuraKey
  );


  // Connect an L1 signer
  const wallet = ethers.Wallet.fromMnemonic(goerliMnemonic);
  const l1Signer = wallet.connect(l1Provider);


  // Initialize sdk messenger
  const crossChainMessenger = new sdk.CrossChainMessenger({
    l1ChainId: 5,
    l2ChainId: 420,
    l1SignerOrProvider: l1Signer,
    l2SignerOrProvider: l2Provider,
  });

  let statusReady = false;

  // Sleep for 1 min during L2 -> L1 bridging
  await sleep(60000); // 60 seconds

  // Poll the L1 msg status
  while (!statusReady) {
    let status = null;
    status = await crossChainMessenger.getMessageStatus(txHash);
    statusReady = status == sdk.MessageStatus.READY_FOR_RELAY;
    if (!statusReady) {
      console.log(
        "Message not yet received on L1.\n 🕐 Retrying in 10 seconds..."
      );
      await sleep(10000); // 10 seconds
    }
  }



  console.log("📬 Message received! Finalizing...");

  // Open the message on L1
  finalize = await crossChainMessenger.finalizeMessage(txHash);
  console.log(
    `🎉 Message finalized. Check the L1 Greeter contract "read" function: https://goerli.etherscan.io/address/0x7fA4D972bB15B71358da2D937E4A830A9084cf2e#readContract`
  );
}; In the scripts directory, we also have and to automate the process of compiling contracts, running migrations, and sending messages. goerli_bridge_message.mjs goerli_bridge_value.js Step 4 — Complete Compilation, Migration, and Bridging of a Contract Between Ethereum Goerli and Optimism Goerli Next, we’ll actually deploy our contract out to Goerli. The helper facilitates the compilation, migration, and bridging of messages between Ethereum Goerli and Optimism Goerli. script On those networks, we’ll need testnet ETH to use it. To receive some, use . We will also need to to your Infura account. a faucet add the Optimism add-on Next, we will run the following command to start the project. npm run deploy Below is a URL to confirm (through Etherscan) the bridged message after the complete migration. A link to confirm the bridged message via Etherscan will be provided upon completion of the 4th migration. Step 5 — Verify Project Is Successfully on the Goerli Testnet With Block Explore We have successfully set up, installed, built, deployed, and walked through the project we unboxed earlier. Next, we will verify the project on the Goerli Ethereum testnet. Head to the block explorer and paste the txn address 0xbcc1746a9ebbfcfb71665225c1a353a8c8dc9a1aa528a3babcb5b046d615a353 that showed on our CLI when deploying. Goerli Etherscan https://goerli-optimism.etherscan.io/tx/0xbcc1746a9ebbfcfb71665225c1a353a8c8dc9a1aa528a3babcb5b046d615a353 Conclusion A multi-chain web3 world is crucial if we want the user and developer experience to continue to improve. And to achieve that, we need ways for dapps to communicate between chains quickly and seamlessly. Hopefully, the example we walked through using the Optimism Bridge Truffle Box showed you a relatively easy and fast way to get started. To learn more, check out . the official documentation Have a really great day!

Using Truffle L2 Boxes to Bridge Blockchain Networks 

Uso de Truffle L2 Boxes para unir redes Blockchain

Utilisation des boîtiers Truffle L2 pour relier les réseaux Blockchain

ब्लॉकचैन नेटवर्क को पाटने के लिए Truffle L2 बॉक्स का उपयोग करना

Truffle L2 ボックスを使用してブロックチェーン ネットワークをブリッジする

Usando caixas L2 de trufas para conectar redes Blockchain

Sử dụng hộp Truffle L2 để kết nối mạng chuỗi khối

使用 Truffle L2 Boxes 桥接区块链网络

Introduction One of the promises of Web3 is openness, composability, and interoperability at the application layer. A paradigm where open source software and tooling enables others to contribute to projects they find valuable, while the projects offer transparency by publicly hosting their codebases. Another Web3 initiative is providing on-chain proof of contributions—the ability to prove that you can do the things you say you’ve done. One company that embodies these Web3 principles is Truffle. Not only is most of its tooling open source so anyone can contribute, but they also provide POAPs for those who do. This article will explore Truffle’s suite of open source tools, what POAPs are, and teach you how to make your first contribution so you can prove that you’re a Web3 builder with Truffle. What is Truffle? As the image above suggests, Truffle is a suite of tools for smart contract development. Additionally, it was one of the first devnets created for Ethereum. From writing to deployment and everything in between, the Truffle suite makes the process easier and safer. And the best part? Most of the tools are open source. So you can alter these tools to suit your needs better and share your changes with the wider Web3 community. The includes the following: Truffle Suite Truffle Ganache The Truffle For VS Code Extension The Truffle Dashboard Truffle Boxes Let’s take a look at each of these tools to understand them better. Truffle , the flagship tool in the kit, is a development environment that makes building smart contract projects easier. This tool includes automated testing, configurable build pipelines, scriptable deployment, built-in network management, and more. Truffle Getting started with Truffle is easy. Type the following commands in your terminal to install the tool and then initialize a new project: $ npm install -g truffle
$ truffle init The command creates a blank project with the required folder structure and a configuration file so you can start building quickly. truffle init Ganache Once you have a smart contract underway, you’ll need to test it on a blockchain. This is where comes in. Ganache is a locally hosted blockchain that simulates Ethereum on your machine. It allows you to use in solidity, fork mainnet (or any other Ethereum network), set mining options, and impersonate real accounts, among other things. Ganache console.log Ganache is essential for testing smart contracts to understand how they will behave when you deploy to a testnet or mainnet. Install Ganache and then run it with the following commands: $ npm install ganache --global
$ ganache Note: You can by using the following format: start Ganache with various options $ ganache --namespace.option="value" Additionally, you can run Ganache in your browser by including the following in your HTML code, replacing with your installed version of Ganache: {VERSION} <script src="https://cdn.jsdelivr.net/npm/ganache@{VERSION}/dist/web/ganache.min.js"></script> Truffle for VS Code If Visual Studio Code is your editor of choice, that enables you to create, build, debug, and deploy your projects without leaving the editor. It also includes direct integration with , so you can easily deploy your projects using custom RPC endpoints, and all the observability Infura facilitates. Truffle has a useful extension your Infura account After installing the Truffle for VS Code extension, you can start a new project or run other commands by opening the command palette with and typing . ctrl + shift + P truffle Truffle Dashboard One of the riskiest aspects of developing smart contract projects is accidentally exposing your wallet’s private keys or mnemonic phrases. eliminates this risk by abstracting that portion of the process while providing a GUI to interact with instead. The Truffle Dashboard After installing the latest version of Truffle, all you have to do is configure your file to include the following inside of the object: truffle-config.js networks networks: {
    dashboard: {
        port: 24012,
    }
  }, Then starting the dashboard with the command will display the GUI at in your browser. From there, you can connect your wallet and select the network you wish to deploy to. When you are ready to deploy your smart contract, type the following command to initiate deployment to the connected network: truffle dashboard http://localhost:24012/rpcs MetaMask $ truffle migrate --network dashboard Truffle Boxes are boilerplates or starters that set your project in a specific direction. They consist of code to get you going quickly, so you don’t have to reinvent the wheel every time. Some useful boxes include the , , , , and . You can even ! Truffle Boxes nft-box optimism arbitrum react polygon create your Truffle Boxes Simply select a box from the and run the command: list of available Truffle Boxes $ truffle unbox <box_name> This creates a new Truffle project with all the boilerplate from the selected Truffle Box. Contributing to Truffle Now that you’re familiar with the Truffle Suite of tools, let's learn how we might contribute to their documentation and earn a POAP in the process. What is a POAP? A Proof of Attendance Protocol (POAP) is a platform and infrastructure in Web3 for issuing tokens to prove that someone did something. That could be attending an event, voting in a community, or contributing to a project. POAPs are NFTs minted under the Proof of Attendance Protocol smart contract and are digital records held by collectors, usually to prove they attended a virtual or physical event. In our case, we’ll earn a POAP for contributing to Truffle’s documentation. Your First Documentation Contribution In the next portion of this article, we will walk through the steps to earn an Annual Contributor POAP and become a 2022 Truffle Contributor. Truffle is collaborating with to issue POAPs to contributors. GitPOAP is a contributor recognition platform that easily integrates POAP issuance into GitHub. Once we meaningfully contribute to Truffle’s documentation, we can submit a pull request (PR) to Truffle’s repository (repo) to merge our contribution. Afterward, we can sign into GitPOAP via GitHub, claim our POAP, and view the collectible on our profile page. GitPOAP How to Submit Your Contribution Open up a new tab and head to Truffle’s . GitHub page We will review the documentation to see where we can contribute. I immediately see where we might be of use. The opening sentence in Truffle’s readme file outlines three distinct value propositions of the Truffle software. However, it is missing something grammatically critical to emphasize that: the lovely Oxford comma. Oxford commas allow for each item in an array to have a namespace. While they’re stylistic (such as, AP-style writing, which you see in magazines and newspapers), they are entirely useful in technical documentation. Truffle’s opening sentence reads: “Truffle is a development environment, testing framework and asset pipeline for Ethereum, aiming to make life as an Ethereum developer easier.” In my opinion, this sentence would read better if it said, “Truffle is a development environment, testing framework, and asset pipeline for Ethereum, aiming to make life as an Ethereum developer easier.” The testing framework and the asset pipeline are distinct offerings, so a comma would be helpful to add a degree of separation. Let’s submit a PR to the team at Truffle. The process is the same, no matter your operating system. First, let’s “fork” Truffle’s repo on GitHub. A fork is a separate yet identical version of Truffle’s repo we can use to submit our PR. We can work in this fork without affecting the main repo. From here, we can create our fork of Truffle. I already made one, as you can see below: Next, we can “clone” our new repo to our own machine. This will allow us to work on the repo in our own chosen IDE, which for me, will be VSCode. Making sure we’re in the correct (our own) repository fork, let’s copy the URL, such as and paste it into our terminal window. git@github.com:daviddoswell/truffle.git Once we do that, we can open the project in our chosen IDE. Inside VSCode, I go to the file and find the first sentence I want to update. I change it and then push the changes from my local copy to my remote (upstream) copy. You can see my Oxford comma on line 11: README.md Let’s push these changes: The software is now telling us to create a pull request (PR). We can navigate back to our repo and inspect the changes. Sometimes you can contact the repo maintainer in advance and let them know you’re working on the project, especially if it’s open source. In our case, a Truffle maintainer saw our PR and approved it instantly. Most projects require two or more approvals for accountability. No worries. We got that, too. After a few checks to ensure my repo passes all security, programmatic, and other assurances, they can merge my PR. This usually takes about two hours for large projects, but it could be sooner or later. Now, we can head over to to see if Truffle issued us a POAP for our contribution. First, we’ll need to connect our MetaMask wallet. Click on the button and then select MetaMask. GitPOAP Sign In Next, we have the option to connect our Github account. Unfortunately, we can’t yet mint anything. We must first submit our contribution to GitPOAP. So let’s start the onboarding process. Follow the prompts to successfully submit a contribution. Now, we wait. Once our POAP appears, we can mint it. BOOM! Now, we can go back to our profile on the GitPOAP website and check to see that we’re an official POAP holder. And we are! Conclusion In this article, you learned about the Truffle suite of tools, what a POAP is, and how to earn one by contributing to Truffle’s documentation. As you can see, earning proof of contribution through a POAP can be useful for proving your capabilities. In addition, companies like ConsenSys, who make some of their tools open source and reward participants for contributing, are helping create an ecosystem built on trust and openness. Although Web3 is still in its infancy, its direction looks promising for both developers and users. To learn more about the Truffle Suite or start building with their tools, or . check out their docs Github repo

Use the Truffle Suite for Easy Web3 - and Earn your Proof of Contribution POAP

Minting an NFT on the Polygon Network With Truffle and Infura

In this tutorial, we will show you step-by-step how to create a new blockchain project, using the Truffle framework and Open Zeppelin smart contracts library, connected to an RSK local node or RSK testnet. is an open-source platform for Ethereum compatible smart contracts based on the Bitcoin network. RSK It does not matter whether you are an experienced developer, or just learning to code, you do not need to be a blockchain expert to follow along. Overview Here is a summary of the steps to be taken to build our project: Installation requirements; Run a RSK local node; Initialize a project using Truffle; Install Open Zeppelin smart contracts in our project; Install HD wallet provider; Create a wallet mnemonic; Configure Truffle to connect to RSK networks; Use Truffle console; Get some testnet R-BTCs from the RSK faucet; Requirements POSIX compliant shell Curl Java Node.js and NPM (Node Package Manager) Code editor: Visual Studio Code (VSCode) or any other editor of your choice Truffle POSIX compliant shell The Portable Operating System Interface (POSIX) is a family of standards specified by the IEEE Computer Society for maintaining compatibility between operating systems. POSIX defines the application programming interface (API), along with command-line shells and utility interfaces, for software compatibility with variants of Unix and other operating systems. Source: Wikipidia Mac OSX and Linux distributions: Use the standard terminal Windows: If you use the standard cmd terminal or PowerShell, the commands here may not work. Consider installing , which comes with Git Bash bundled. Here is a . Git for Windows tutorial on installing and using Git Bash cURL This is a system command that is likely already installed on your system, which allows you to make network requests, such as HTTP requests, from your command line. If curl --version displays an error, . download curl Java You will need Java 8 in order to run RSKj. Check if you already have Java installed: java -version If the above command displays an error or displays a version other than 1.8, you will need to install it. Go to the official page, download, and run the installer from there. Java download Node.js and NPM Node.js and NPM are needed, though both are usually installed at once. NB: To check if Node.js and NPM are already installed, input the following commands in the terminal: node --version
npm --version If you got an error, go to to install it. Node.js Note that NPM is usually installed together with Node.js, so after installing Node.js, there’s no need to install it separately. If you want to have more than one version installed, the most fuss-free way to install and manage multiple versions of the node on your computer is . nvm Code editor We need some software that is able to edit text files. Preferably one that has support for syntax highlighting for both Solidity and Javascript. In this tutorial, we will use to create our project, you can . VS Code download it here Verify if your VS Code installation was successful by typing the following command into the terminal: code -v Truffle is a popular development framework with a mission to make smart contract development easier for developers. Amongst its features, it has a smart contract lifecycle management, scriptable deployment & migrations, automated contract testing, and simple network management. Truffle It also makes developing on RSK easier, with the ability to configure custom networks for RSK. To install Truffle, input the command below into the terminal and press enter at your project location: npm install -g truffle When the installation is finished, close the terminal, open it again and check the Truffle version: truffle version RSK regtest (Local node) When we develop a project using Truffle Framework, we need a blockchain node running locally. This is better for development and running tests. We’ll connect to the RSK network via this local node. There are several ways to set up an RSK local node. Here, we will download a JAR file and run it using the Java SDK that has been installed. Download Go to the and click on the most recent to download it. releases page You need to click on the JAR file, at the end of the post about the latest release. Its name should be rskj-core-*.jar Verify authenticity When installing and running the RSKj node, it is always a good idea to verify that your copy is legitimate. In the folder where you download the JAR file, go to a POSIX terminal and run this command: sha256sum rskj-core -PAPYRUS-all.jar -2.0 .1 For this version, it looked like this: Note that if you are using Windows, you will need a POSIX compliant shell for this. See instructions above. about using Git Bash For more information about verifying that your copy is legitimate, including signature verification, check out the on how to do this. full instructions Run To run the node: java -cp <PATH-TO-THE-RSKJ-JAR> -
Drpc.providers.web.cors=* co.rsk.Start --regtest (Replace with your path to the JAR file). I am using a Windows OS and I saved the file at C:\RSK\node, so for me the full path is C:\RSK\node\rskj-core-2.0.1-PAPYRUS-all.jar. The commands required to run the RSK node are: On Windows terminal java -cp C:\RSK\node\rskj-core -PAPYRUS-all.jar -
Drpc.providers.web.cors=* co.rsk.Start --regtest -2.0 .1 Using Git Bash java -cp C: node/rskj-core -PAPYRUS-all.jar -
Drpc.providers.web.cors=* co.rsk.Start --regtest /RSK/ -2.0 .1 On Linux and Mac java -cp ~ node/rskj-core -PAPYRUS-all.jar -
Drpc.providers.web.cors=* co.rsk.Start --regtest /RSK/ -2.0 .1 If you see no output - that is a good thing: Its output is directed to a log file. Note the flag provided above: -Drpc.providers.web.cors=* This disables cross-origin resource sharing protection, effectively allowing any web page to access it. As we want to make JSON-RPC requests from a browser, such as a DApp, we need this flag. This is the result in the terminal in Windows OS: Important Do not close this terminal/console window, if closed the local node will stop running. Check if the node is running using cURL Open a new terminal window. Issue a JSON-RPC request to the RSK node’s HTTP server. This is an example using cURL: curl localhost: / / -X POST -H --data 4444 1.1 .0 "Content-Type: application/json" '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}' The response should look similar to this: { : , : , : } "jsonrpc" "2.0" "id" 1 "result" "0x2991b" The result property is the number of the latest block that has been synced. Note that this value (0x2991b) is the block number in hexadecimal (base 16), so the output above indicates that the current block number is 170267 in decimal (base 10). To get more information about this process: Check out . set up RSKj with Java If you encounter any problems, check if your system meets the . minimum requirements There are other ways to install an RSK node, in other supported platforms: Check out . installing RSKj RSK Testnet - verify the connection In addition to using the local node, we want to publish smart contracts to the testnet. Before it, let’s check if the connection is working. This is an example using cURL. Enter the following command into your terminal. curl https: application/json jsonrpc method eth_blockNumber params id //public-node.testnet.rsk.co/2.0.1/ -X POST -H "Content-Type: " --data
'{" ":" 2.0 "," ":" "," ":[]," ":1}' This is a very simple query that simply asks what the latest block number is. You should receive a response similar to the following: { : , : , : } "jsonrpc" "2.0" "id" 1 "result" "0xc3f9b" The result field is presented in hexadecimal. 0xc3f9b is the block number, and it’s decimal equivalent is: 802715. You can consult the and verify that it is the same result for block number. testnet explorer Initialize a Truffle project We have two options for initializing a project: An empty project A project based in a Truffle Box 1 - Initialize an empty Truffle project Create a new folder. For example, myproject, and navigate to the folder in the terminal. mkdir myproject
cd myproject For example, I will create a folder at this location: C:\RSK\ (I’m using Windows). My project can be located in the folder C:\RSK\myproject. In your project folder, start an Truffle project by typing the command below into the terminal: truffle init Open the folder in VS Code to view the file structure like this: ./contracts: All our smart contracts will be stored in this folder. ./migrations: Deployment scripts will be stored in this folder. ./test: Test scripts will be stored in this folder. ./truffle-config.js: This is Truffle’s configuration file used to configure networks, including RSK networks. Note that the following files were also created: Migrations.sol: Keeps track of which migrations were done on the current network. 1_initial_migration.js: Deployment instructions for Migrations.sol. Initialize an npm project When we initialize an empty Truffle project, we also need to initialize an npm project. Start an npm project in the myproject folder by typing the following commands below into the terminal: npm init -y 2 - Initialize a project based in a Truffle Box Note: Only do this if you have not done option 1. Truffle Boxes are templates. In addition to Truffle, Truffle Boxes can contain other helpful modules, such as Solidity smart contracts, libraries, front-end views, and more. In option 1, when we use truffle init, we used a special kind of truffle box. Check out other . boxes Also we have some of them already configured for RSK, . check it out here Install Open Zeppelin is a set of libraries of Solidity smart contracts for Ethereum and other blockchains. These libraries will install not only the main libraries required for our token, but also libraries for ownership, safe math, and many other utilities. It’s worth mentioning that these libraries have been reviewed and audited to accomplish high standards of security, so contracts that depend on them are less susceptible to hacking when used correctly. Open Zeppelin Contracts In the terminal, inside myproject folder, install Open Zeppelin libraries using this command: npm install -E @openzeppelin/contracts@ 2.5 .0 The option -E is to save dependencies with an exact version rather than the latest version published on npm. Some contracts may change over time, so it is important to set the version. This tutorial was written using this specific version. Install HD wallet provider To connect to the RSK network, we are going to use a provider that allows us to connect to any network by unlocking an account locally. We are going to use @truffle/hdwallet-provider. This can be used to sign transactions for addresses derived from a 12 or 24 word mnemonic. You need to have Node >= 7.6 installed. In the terminal, inside the myproject folder, install the HD wallet provider with this command: npm install -E @truffle/hdwallet-provider@ 1.0 .34 This truffle package comes with many dependencies, and so can take a long time to complete. A successful installation message is shown if everything works fine. Create a wallet To use testnet, we need tR-BTC and an address to store them. The best way is to create a wallet from a mnemonic, using the pattern defined at BIP39 There are a few ways to do this. One is to create using a web wallet, such as or wallet. These wallets generate the mnemonic for you. If you wanted to create using Metamask, you can get the instructions here: Metamask Nifty using Remix and Metamask with RSK testnet iancoleman.io/bip39 Another way is using this web app: iancoleman.io/bip39 Note: In this tutorial, the method used to store the mnemonic is not recommended to be used for any ‘real’ wallet because it’s not secure enough to generate a private key in a website, however we will use this here for learning purposes, and because we’re using the Testnet, so no real amounts are at stake. In the Generate a random mnemonic field, select 12 words and click on the generate button. The result appears in the BIP39 Mnemonic field. They should be 12 random words like the words in the image: My mnemonic is: energy knife ice mouse merge track cram brown decorate atom rule virus Copy these 12 words, we’ll use it later in this tutorial. mnemonics module Another alternative is using package , which is a simple utility that can be used to generate mnemonics. mnemonics BIP39 To install mnemonics globally, input the command below into the terminal and press enter at your project location: npm install -g mnemonics@ 1.1 .3 Use this to generate a 12-word BIP39 mnemonic, by entering this command: mnemonics > .secret This saves a new mnemonic in the file named .secret, which is the next step. Create .secret file In the terminal, inside the myproject folder, create a file named .secret. Do you remember your mnemonic? Paste your mnemonic in this file and save it. Configure Truffle to connect to RSK networks Open file in your Truffle project and overwrite it with the following code: truffle-config.js HDWalletProvider = ( ); fs = ( ); mnemonic = fs.readFileSync( ).toString().trim(); (!mnemonic || mnemonic.split( ).length !== ) { ( );
} const require '@truffle/hdwallet-provider' const require 'fs' const ".secret" if ' ' 12 throw new Error 'unable to retrieve mnemonic from .secret' .exports = { : {
  }, : { : {
    }
  }
} module networks compilers solc The hdwallet-provider allows us to connect to any network by unlocking an account locally, including the RSK networks. Also, we are loading the mnemonic stored in file .secret, and saving it at variable mnemonic. Configure Truffle to connect to RSK regtest (local node) In the truffle-config.js file, include this configuration at network section: development: { : , : , : }, host "127.0.0.1" port 4444 network_id "*" This is the result: Get the current gas price of testnet Get the current gas price of the testnet network, and save to .gas-price-testnet.json. In your project folder, run this cURL command: curl https: application/json jsonrpc method eth_gasPrice params id //public-node.testnet.rsk.co/2.0.1/ -X POST -H "Content-Type: " --data
'{" ":" 2.0 "," ":" "," ":[]," ":1}' >
.gas-price-testnet.json You should receive a response similar to the following in the file: {"jsonrpc":"2.0","id":1,"result":"0x3938700"} The result value is presented in hexadecimal. Modify the truffle-config file again to use the updated gas price. After mnemonic part, include this: gasPriceTestnetRaw = 
fs.readFileSync( ).toString().trim(); gasPriceTestnet = ( .parse(gasPriceTestnetRaw).result, ); ( gasPriceTestnet !== || (gasPriceTestnet)) { ( );
} const ".gas-price-testnet.json" const parseInt JSON 16 if typeof 'number' isNaN throw new Error 'unable to retrieve network gas price from
.gas-price-testnet.json' .log( + gasPriceTestnet); console "Gas price Testnet: " Configure Truffle to connect to RSK testnet In the truffle-config.js file, include this configuration at network section: testnet: { : HDWalletProvider(mnemonic, ), : , : .floor(gasPriceTestnet * ), : }, provider => () new 'https://public-node.testnet.rsk.co/2.0.1/' network_id 31 gasPrice Math 1.1 networkCheckTimeout 1e9 Truffle config with local and testnet RSK networks This is the final truffle-config.js file with configurations for both networks: HDWalletProvider = ( ); fs = ( ); mnemonic = fs.readFileSync( ).toString().trim(); (!mnemonic || mnemonic.split( ).length !== ) { ( );
} gasPriceTestnetRaw = fs.readFileSync( ).toString().trim(); gasPriceTestnet = ( .parse(gasPriceTestnetRaw).result, ); ( gasPriceTestnet !== || (gasPriceTestnet)) { ( );
} .log( + gasPriceTestnet); .exports = { : { : { : , : , : }, : { : HDWalletProvider(mnemonic, ), : , : .floor(gasPriceTestnet * ), : },
  }, : { : {
    }
  }
} const require '@truffle/hdwallet-provider' const require 'fs' const ".secret" if ' ' 12 throw new Error 'unable to retrieve mnemonic from .secret' const ".gas-price-testnet.json" const parseInt JSON 16 if typeof 'number' isNaN throw new Error 'unable to retrieve network gas price from .gas-price-testnet.json' console "Gas price Testnet: " module networks development host "127.0.0.1" port 4444 network_id "*" testnet provider => () new 'https://public-node.testnet.rsk.co/2.0.1/' network_id 31 gasPrice Math 1.1 networkCheckTimeout 1e9 compilers solc Truffle Console connected to RSK network Truffle has its own console to run commands and can be connected on any network previously configured in truffle-config.js file. Connect to RSK regtest (local node) Let’s open a Truffle console to connect to our local node. In the terminal, inside the myproject folder, run this command: truffle console Any network defined with the name development is considered the default network. Connect to RSK testnet Thus far we have only connected to a blockchain that runs using just 1 node, that runs on your own computer. Let’s now switch to interacting with a “real” blockchain, which is running on multiple nodes distributed across multiple computers! To connect Truffle console in another network, you need to specify the network: In a new terminal, inside the myproject folder, run this command: truffle --network testnet console It takes a little longer to establish this connection when compared to the local node. This will open a new console. Test the connection to RSK network On any of the networks, run this commands in the Truffle console: Block number Shows the last block number. ( web3.eth.getBlockNumber()).toString() await Network ID To get the network ID, run this command: ( web3.eth.net.getId()).toString() await For the local node, the network ID is 33. And for testnet, it is 31. Exit Truffle console In the Truffle console, enter this command to exit the terminal: .exit Get addresses We will use a special instruction in Truffle console to get the first 10 addresses in our hierarchical deterministic wallet for the RSK Testnet network, that are generated from our mnemonic. In the terminal, inside the myproject folder, go to the Truffle console connected to testnet: truffle --network testnet console And run this command to save the addresses at variable : accounts accounts = .keys(web3.currentProvider.wallets) const Object See the addresses after it by entering the command below: accounts Now we will write them to a file named .accounts ( ).promises.writeFile( , accounts.join( )) await require 'fs' '.accounts' '\n' Check balance To check the balance of an account, for example, the first account of our list (account[0]), run this command in Truffle console: ( web3.eth.getBalance(accounts[ ])).toString() await 0 The balance is 0 and we need some tR-BTC to pay gas fees, which will be used to publish smart contracts and interact with them. We shall obtain some in the next step. TestNet Faucet You can get some tR-BTC from the . RSK Testnet faucet Copy the first address from .accounts file. In my case, it is 0xe16f6abdd5815f3d24b4e5c29138f863933b000a Enter your wallet address and pass the CAPTCHA. Wait a few seconds… You can see my transaction hash: 0x4a2bf1f65c525219020c3a1215a29453c20f4ced90575d9a7d13f8fe666d05b4 Now I have 0.05 R-BTC! Recheck balance To check balance again, run this command in the Truffle console: ( web3.eth.getBalance(accounts[ ])).toString() await 0 Great! Now I have 50000000000000000, which means that I have 0.05 tR-BTC with 18 decimal places of precision. Where to go from here At this point, we have installed all requirements and created an empty project using Truffle framework and Open Zeppelin smart contracts library, connected to both an RSK local node (Regtest) and the RSK Testnet. We have not developed anything yet, but you are now ready to move on to the next tutorials, where we will develop some very cool projects! : Solange Gueiros | Brendan Graetz and Owanate Amachree Author Reviewers:

Truffle Security

trufflesecurity.com

-- employees

Since n.d.

COMPANY RANKING

TRUFFLE SECURITY

EVERGREEN INDEX #332

Truffle Security WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

Truffle Security

trufflesecurity.com

-- employees

Since n.d.

COMPANY RANKING

TRUFFLE SECURITY

EVERGREEN INDEX #332

RELATED COMPANIESRANK

STORIES ABOUT TRUFFLE SECURITY

Truffle Security WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!