Please describe your proposed solution.
The first version of our platform has already been built. You can view it at https://auditocean.com/, create an account, play around with the features, and get an idea for what it is all about. We have also created this brief walk through video that demonstrates the platforms main functionality.
<https://youtu.be/oW81ig1fHH8>We hope by providing this MVP it demonstrates our concept makes sense and we are able to deliver on it. But there are several aspects of the platform that are still centralized. The main goals and purpose for this proposal is to fully decentralize the platform. We are providing a breakdown below of those centralized functional requirements that the platform needs to perform the audits and that could be replaced with decentralized alternatives using a smart contract on the Cardano network.
1 Introduction:
By using a decentralized audit system it is possible to eliminate potential corruption points that may exist in a centralized audit system such as the choice of auditors or the interest of third parties to influence the outcome of an audit report. AuditOcean is a blockchain community space designed for research and project auditing. The community decides through its voting power which projects should be audited. Users can add the projects they want through the public repository https://dyortool.io. Once the user adds a project a dedicated page is created where users can select it as a project to be audited in the active audit round. The main mission of the platform is to create fundamental analysis reports following a scheme of advanced research questions and technical vulnerability analysis reports
for Plutus smart contracts.
2 Transitional Features
The transitional features are all functional requirements necessary to perform an audit round that could be replaced with decentralized alternatives using a smart contract on the Cardano network. Governance, Audit round administration, Assignment of auditors and Report minting are the most important.
2.1 Round administration
An audit round is a synchronous four-stage process and its purpose is to conduct audits of projects chosen by the community. Each audit round has a unique name or index characterized by having the letter R + a consecutive number, e.g. R5, R7, R10.
When an audit round is created the administrator can start its stages synchronously by executing an endpoint on the backend with the desired parameters. The service-audits pod receives the http request and sends an event to the Bull-MQ queuing system which controls when a stage finishes according to the assigned time.
In this centralized configuration the administrator and the queuing system control the states of the active audit round. The states of an audit round are the Pending, Selection, Governance, and Auditing stages. A stage cannot start if the previous stage has not finished, the transitions are sequential not parallel.
In computer science the concepts of state and machine of states are common. A state machine it is a mathematical model to describe the behavior of the different states of a system and their transitions based on conditions, events or triggers. Each state in a state machine represents a specific configuration of the system. It has an initial state that can transition to other states following the rules of the system. Each state within a state machine can execute actions, change variables and produce outputs according to the conditions specifically established for it. There are two types of state machines, the deterministic ones that for a given combination of state and input there is only one possible transition to the next state. And the non-deterministic ones that there can be multiple possible transitions from a given state for a particular input.
Figure 3 shows the deterministic state machine concepts applied to the stages of an audit round. The initial stage is a passive state that does not execute any logic necessary for the audit round in order for the initial state to transition to the first state a trigger is needed. Contracts in Cardano’s EUTXO model need at least one initial transaction to trigger their design logic and configure its initial state. In this case the DAO operational wallet interacts with a smart contract endpoint called startRound designed to start an audit round that receives the necessary parameters so that a round can start.
initialStateMachine represents the initial state of the smart contract variables. These variables will remain in the default state indefinitely until the DAO wallet interacts with the startRound endpoint which initiates an audit round. This is the trigger that makes the contract transition to the first state, that is, the governance stage.
Once the DAO wallet has interacted with the startRound endpoint the contract will transition to the first state by assigning the new parameters to the contract variables. The duration parameters represent the time measured in Slots on the blockchain. The Plutus.Contract module has functions for dealing with time such as waiting for a certain amount of Slots to pass before proceeding with the execution of the contract. It is commonly used when implementing time-based behaviors or waiting for a specific deadline to be reached. It is possible to create a time-based trigger to transition to the second state and also to transition to the initial state without the need for external intervention managed by the time Slots of the blockchain.
2.2 Governance
During the Selection stage AuditOcean users select the project they want by pressing a button on the UI. The list of projects as the final result of this selection stage is submitted to a poll in an external governance platform called the summon platform.
This hybrid configuration (off-chain/on-chain) implies that the selection votes are created as documents within a centralized Mongo database. It is not possible for the community to directly audit the correct behavior of this process.
Once the selection stage is over, a poll is created on the summon platform where it is possible for the community to directly audit the transactions on the blockchain. The level of auditability of a decentralized governance system is not the same if there is a previous process that cannot be audited directly because it is carried out within private servers.
The way to get the best auditability is to remove the Selection stage and have users vote with their wallets in the AuditOcean UI. It is not necessary to use an external service for governance, users will be able 4 to log in from their wallets and vote for the project they want on the AuditOcean platform in a single stage.
2.2.1 State-Snapshot governance system.
In the blockchain industry new projects are created daily and AuditOcean’s list of projects will inevitably grow over time. It is possible for the community to add 1000 or 10000 projects if they wish. The consequence of this is the large number of indexes in the database. Managing such a number of indexes in a smart contract can be challenging because the limit of Kb per Tx is limited and it is not scalable. However, we can simplify the notion of long-length indices such as those used in databases by using consecutive natural numbers.
A 32-bit unsigned integer can be represented as 0 to 2147483647. A positive integer can be assigned as a unique index to each project added by the community in AuditOcean. In this way a smart contract could reference a large number of projects using only 32 Bits. For example, an user wants to vote for the project called SCATDAO which has the index 547 assigned, no other project has this index. The user connects their wallet containing the AUDIT utility token to the UI and performs the vote. The request goes to the backend and contract integration calling the endpoint createVote that receives a 32-bit positive integer as a parameter. The contract verifies if the parameter is valid and if the UTxO associated with that wallet address contains the AUDIT token. The contract finally checks if the index given as a parameter is less than or equal to totalNumProjects variable of the contract which refer to the total number of projects that have been added to AuditOcean. If these conditions are correct the contract validates the Tx and adds a small mark in the metadata.
Once the governance stage is finished a snapshot is taken at the exact moment or Slot in which the stage ends. By making a query to the blockchain API it is possible to get the transactions associated with the address of the contract to validate the status of the transactions, verify if the transactions have been validated by the contract and verify the metadata of the transaction that provides the context resulting from the interaction with the contract. The metadata can help in identifying the purpose and status of the transaction. The information about the snapshot and governance stage is displayed in the platform UI for all users. This configuration for the governance system guarantees speed, minimum computing time and the ability to validate millions of indexes using a simple condition:
indexParam ≤ totalNumProjects ⇒ True. Where indexParam is the parameter sent by the user and totalNumProjects is the total number of project indexes listed by the community.
The parameter totalNumProjects can be added by the DAO operational wallet when calling the startRound endpoint. This parameter within the smart contract corresponds to a positive integer number. For example, in case there are 742 projects listed by the community totalNumProjects will be 742. In the initial state of the contract this variable value is 0.
At the end of the governance stage this variable will also be 0. In the hypothetical case that the contract itself was designed to store the project indices in the form of assets or NFTs to later be consulted in the governance stage, this would add more logic to the contract and therefore computation time. For this reason it is a disadvantage to use the contract as a form of storage.
However, it is possible to assign a simple time-locked plutus script that allows to store the indices with project names in the form of small metadata using assets (1 asset per project) or simply stamping valid transactions without using assets. The DAO’s operational wallet is the only one that will be able to interact with this plutus script. The address of the script on the blockchain will need to be included in the metadata when deploying the AuditOcean contract for the first time for auditability. This solution is scalable since multiple scripts can be used for this purpose. In this way there is complete audability with respect to the indices.
Another form of index auditability is public code repositories like Github or distributed storage systems like IPFS.
2.3 Assignment of auditors
Assigning auditors to auditable projects can be a point of low auditability if it is done centrally on private servers. For that reason the best option is a decentralized assignment algorithm. There is not much complexity in the logic required for an equal assignment for all auditors. The main requirements are randomness and uniform distribution of the probability of being chosen as an auditor of a project. The fisher-yates algorithm is a great candidate because it ensures that each element has an equal probability of being placed in any position of the resulting permutation. This is useful since it can shuffle a finite list of indices. For example, A = [0, 50] where A is the list of indices from auditor 0 to auditor 50. Each index represent a specific auditor and they are ordered consecutively [0,1,2,3,4 .. 50]. When the algorithm is applied to the list the positions of the indices will change randomly. If AuditOcean needs 12 auditors for an audit round the first 12 indices from the shuffled list will be selected.
auditorPool = [0,1,2,3,4 .. 50]
auditorPoolShuffled = [30, 13, 10, 19, 21, 45, 23, 47, 31, 50, 4, 28, .. 34]
selectedAuditors = [30, 13, 10, 19, 21, 45, 23, 47, 31, 50, 4, 28]
auditorGroups = [ [30, 13], [10, 19], [21, 45], [23, 47], [31, 50], [4, 28] ]
The auditors are randomly selected using the Fisher-Yates algorithm and finally grouped. AuditOcean requires 2 auditors per project so in this example there are 6 groups for the first 6 projects chosen by the community through governance. The permutations occur on all indexes so there is no need to perform new permutations for role assignment or grouping.
This Fisher-Yates haskell version can be used as a reference to create a plutus implementation. The code inside a plutus contract is deterministic it is necessary to use an oracle that generates a random number for the random variable or use a pseudo random number generator (PRNG) that takes the hash of the last block generated by the blockchain as a seed of entropy.
2.4 Report Minting
The auditor report and its respective review are two different but necessarily related resources they make up a complete audit report. To ensure the immutability of its content it is necessary mint them as non-fungible assets. This can be done automatically from the backend integration at the end of the Auditing stage. The latest version of the .json documents sent by the auditor and the reviewer will be hashed to subsequently mint 3 copies. 1 NFT will be sent to the wallet provided by the auditor. Another will be sent to the reviewer’s wallet and another will be stored in a wallet of the DAO. They will be stored in IFPS and Github.This mechanism can be implemented in the smart contract for its operation during the Auditing stage. For example, supplying the contract with the list of wallets that have authorization to mint and some status variables to indicate if they have already minted their report or not. Or use identity tokens as a form of authorization to mint. However this will
be the subject of investigation for future versions of the smart contract.
Platform Growth and Promotion
We hope we have adequately outlined and explained our plan to decentralize the platform that we have built. We feel this is the most important part of the proposal so have made this the primary focus. But there is also a secondary focus which is to promote the platform and encourage the community to utilize it. The first version has been built and delivered. And while the decentralized version is what we are working toward, the current version is still very useful and provides some great benefits to the Cardano Community. So we are also requesting funding to continue to build out those non-technical aspects of the platform. To create content for the platform, to moderate it, and to promote it.
How does your proposed solution address the challenge and what benefits will this bring to the Cardano ecosystem?
Our project addresses the challenge because we believe it will be a commercially viable product that the community actually utilizes and benefits from, while also contributing back to the Cardano community by releasing everything we develop Open Source. To fully cover how our project addresses this challenge we have taken the guidelines provided by the challenge and have written in our responses to each below.
How does success looks like?
• More open-source projects, developers, and users
This project and everything else we have built is Open Source and available for the community to leverage. So just from that alone, we have more open source projects and developers which addresses this point.
• Improved visibility and quality of open-source projects
The platform we have built and would like to fully decentralize through this proposal (https://auditocean.com/) serves as a place to coordinate community driven audits and research as well as a type of social media where people can discuss Cardano projects, share red flags or strengths they have found, stay on top of recent news and developments within the Cardano ecosystem, and more. So we believe that this platform will improve visibility and quality of all Cardano projects, including those that are open source. In addition, since we are building a project in the open source challenge, we will be posting about it and others regularly on the platform, increasing visibility.
• Improved open-source infrastructure
We believe that this project is unique. Not just in our Cardano ecosystem but in crypto as a whole. We do not see a lot of projects pushing for decentralized audits, research, and social media, so it provides something new and unique to our open source infrastructure. Also, by releasing everything open source, we give any community the option to create their own similar community hub that we have with https://auditocean.com/. If any DAO, NFT, Dapp, or etc wanted to create their own decentralized community instead of relying on discord, they could be able to utilize our code and easily deploy it to create their own. We feel this alone is a very valuable and worthwhile contribution to the Cardano ecosystem.
Key Metrics to measure
• Increase the number and quality of open-source projects
As mentioned above, this project and everything else we have built is Open Source and available for the community to leverage. So just from that alone, we have more open source projects and developers which addresses this point.
• increase the number of open-source tools and frameworks
As mentioned above, by releasing everything open source, we give any community the option to create their own similar community hub that we have with https://auditocean.com/. If any DAO, NFT, Dapp, or etc wanted to create their own decentralized community instead of relying on discord, they could be able to utilize our code and easily deploy it to create their own.
• Increase the number of open-source contributions and maintainers
As this project is open source, by building it we are increasing the number of open-source contributions.
• Increase the visibility of open-source projects
As mentioned above, we believe that this platform will improve visibility and quality of all Cardano projects, including those that are open source. In addition, since we are building a project in the open source challenge, we will be posting about it and others regularly on the platform, increasing visibility.
• Increase in collaboration in and out of the ecosystem
The platform serves as a way of performing decentralized community audits and research, as well as the social aspects that have bene highlighted throughout. Practically every single use or purpose of this platform is to increase collaboration. We collaborate on the site when we determine which projects we would like to have expert research performed on. We collaborate on the site when someone shares a red flag that was found and we debate and discuss it to determine if we feel it is credible or not. We collaborate on the site when someone submits a research report and someone reads through to find errors that should be corrected. I don’t want to keep repeating myself, but collaboration is what this is created for. And because it is open source, people or projects outside of our ecosystem, such as Ergo, could use our code and create their own versions for their own communities as well.
• Improve adoption of Cardano technology
In order to have Cardano technology (primarily the products built on top of Cardano) we need to have a decentralized and trusted system to evaluate, audit, and discuss these products. It is no secret that scams are rampant in our industry and it ends up keeping a ton of people away. By having this transparent and decentralized service that can be used to audit, perform research, and share and discuss information, we send a clear message to users that we value safety and security on Cardano and that we are actively vetting these products to ensure they are safe for consumers to use. When consumers feel confident this is being done, we believe it will massively increase and improve adoption of Cardano technology.
• Improve integrations and interoperability between projects
Do to the social nature of the site, it creates a place for projects to be discussed, including different ideas and hopes that the community has for them. Based on the ideas and suggestions that people submit through the site, projects can see what people are interested in, what they like, what they don’t like, and what kind of integrations or collaborations they would like to see. It is a way for projects to keep their finger on the pulse and adapt based on what their customers are saying and asking for.
• Improve the documentation of open-source projects
We take our documentation pretty seriously. Here you can see the different documentation that we currently have for the site below. By building this project and sharing it open source, we are improving the documentation of open source projects.
scatdao.gitbook.io
https://github.com/SCATDAO/DAO-AuditOcean/blob/main/z/latex/SCAT1.pdf
What value does this bring to the ecosystem?
As mentioned in our problem statement, decentralized systems like Cardano require decentralized research, audits, and social media to realize its true potential. The points of failure that we try to solve with decentralization are just as relevant with our research, audits, and social media as they are with our blockchains. By having unbiased audits and research that cannot be impacted by one person or a small handful of people, people will be able to trust and believe that research and those audits. And by having this trustworthy source of information on our projects and ecosystem, it can cause an increase in investment and participation because people know that it is fair. Same thoughts apply to our social media and interactions. If we have a place where information is being freely shared and discussed, we can all be confident that it is free from bias, which will increase our participation and ultimately bring more people into Cardano.
How do you intend to measure the success of your project?
List of Key Performance Indicators (KPIs)
We have designed these KPIs to measure the success of our project. We feel these cover the main areas that we are trying to achieve and if we hit these marks, the project will have been a success. Again, these are all for the first 6 months that this proposal covers.
Number of on time Catalyst monthly progress reports
The goal for this will be to submit it on time each month. 6 on time progress reports over a 6 month period.
Number of met Milestones on Schedule
We have listed out 3 key milestones for this project. Our goal is to meet each of them on time. This will ensure the product development stays on track and is ultimately successful.
Number of Audit Ocean Accounts Created
The primary goal of this proposal is decentralizing the platform, but we are also trying to utilize the current version of the platform. A platform like this is much more effective with a larger number of people using it. So we hope to promote the site and encourage people to use it. Therefore, the number of accounts created will be a key milestone is judging the project’s success.
Our goal will be 200 accounts in first 6 months
Number of Expert reports voted on by community and created
This one is difficult to define. We have not started doing this yet so understanding how long the process will take and how much we leave ourselves. So we are going to set this low and plan to run our first one during the time period. If we do additional that is a bonus
Number of posts created on Audit Ocean
Our goal will be to have at least one post created per day on the platform. This would equal 30 a month and 180 for the entire proposal period.
Number of Medium Articles Written
Our goal will be to write at least 1 article per week. This would equal 4 a month, 18 total for the proposal.
Number of Youtube Videos created
Our goal will be to create at least 1 video per week. This would equal 4 a month, 18 total for the proposal.
Please describe your plans to share the outputs and results of your project?
Our organization has been around for almost 2 full years now. In that time we have built a solid organic following in our main social media channels. We currently have 4,871 followers on Twitter (@SCATDAO), 500+ members in our Discord (https://discord.gg/SbfHZBPpVA), 94 followers on YouTube with 37 different videos (@smartcontractaudittoken434), and 182 followers on Medium with 39 different articles published and several with thousands of views (@SCATDAO). And again, these are real organic numbers. We never purchase followers or engagement as we feel that is cheating and provides no real benefit since instead of supporters you have bots.
Since we have spent the time and effort to build this passionate and organic following, we now have several excellent vehicles to share the outputs and results of our project. We plan to make regular updates through the channels mentioned above to keep the entire community updated and aware of what we are doing, our progress, and our end results.
We also have our platform Audit Ocean https://auditocean.com/ that we have built and would like to improve and fully decentralize (which is the subject of this proposal). One of the main features of Audit Ocean is it is a type of social media where the Cardano community can share information, perform research, and learn about different Cardano projects. We plan to utilize the platform while we are making our improvements to keep the community informed of what is going on as well as to drive traffic and interest towards the platform.
Finally, we have a long history of joining Twitter spaces to discuss our project, recent developments, and answer and questions people might have. We plan to continue doing this to reach new audiences that might not be familiar with us and share our outputs and results.