funded
TripHut: DAO Open Source Code Audit & Bug Bounty
Current Project Status
In Progress
Amount
Received
₳136,000
Amount
Requested
₳160,000
Percentage
Received
85.00%
Solution

We will hire a recognized third party to conduct an audit on the open sourced upgradeable DAO smart contract we’ve created, to ensure its safe and works as intended, for the benefit of the ecosystem.

Problem

TripHut_Full-Logo-f287df.png

Hello all! Cardano needs more audited open source code, if it’s to be the go-to-choice for building DAO’s. We’ve already developed an upgradeable DAO smart contract, we just need to ensure it’s safe!

Feasibility
Value for money
Impact / Alignment

Team

1 member

TripHut: DAO Open Source Code Audit & Bug Bounty

Please describe your proposed solution.

There are great examples of DAO's and DAO's-as-a-service in the Cardano ecosystem but not everything is open source (understandably so); and not everyone wants a cookie-cutter solution, as they may want or need more flexibility, as well as a greater sense of control. Our code, when audited, would provide a reasonably safe alternative for developers and project owners to leverage for their own DAO's, without having to commit the same amount of time and dollar expenditure as we have. This would reduce new entrant friction and allow for projects to ship faster, cheaper, safer & with more directional flexibility. It would also help compound ecosystem growth, as developers would have the bandwidth to tackle other problems facing DAOs on Cardano.

Additionally, our smart contract system is unique, as it spins up an upgradeable DAO responsive to more than one policy IDs, with:

A configuration NFT minter

A configuration validator

A vote minter

A vote validator

A treasury contract

A tally NFT minter

A tally validator

A specific proposal contract

A general purpose disbursement proposal

A upgrade proposal type

We see more audited open source smart contract code as a win for the ecosystem and believe its the best approach to help developers and project owners with the heavy lifting associated with running a DAO. The impact for which can be measured by the code's efficacy and usage. It would also be keen to note, that our intention is to use the code ourselves to start a travel club (TripHut) - one for which relies on this code and stands a really good chance of onboarding "real world users".

How does your proposed solution address the challenge and what benefits will this bring to the Cardano ecosystem?

As is the desire of the challenge, Cardano can become the go-to-choice for builders if it has both the successful reference points, as well as the open source code and tooling needed to attract them. Our project will provide both (TripHut & its audited open source code). And as previously stated, more audited open source DAO contracts on Cardano can only benefit the ecosystem, as it provides a reasonably safe alternative for developers and project owners to leverage without having to commit the same amount of time and dollar expenditure.

For our own project (TripHut), we believe we can get to 1000 users at launch (in the short term) and grow towards hundreds of thousands, possibly a million users over the long term (7 years + operating). But importantly too, we strengthen the eco system with more audited open sourced alternatives to building DAO's on Cardano.

That is "Number of DAO toolset/frameworks available for DAO Ops (>1)".

How do you intend to measure the success of your project?

We intend to measure the success of our project (TripHut) by how many users we attract and the success of this proposal by how many developers use our code.

We believe our aim of 1000 users in the short term is realistic based on the amount of interest we see present projects attract on Cardano; and we believe our long term goal of 1 million users is also achievable based on what we've seen in the "real world equivalent" of what we are tying to build - which is a Travel Club.

And again, as previously stated, audited open source code improves the productivity of the ecosystem which is also a good qualitative measure for the projects success.

Please describe your plans to share the outputs and results of your project?

The code and any updates to same can be found on Yaad Labs' Github. Outputs, including the auditors report and findings ascertained from the bug bounty will also be shared through Catalyst's reporting mechanisms - which rests in the public domain. We expect the audit to take three weeks and are also intent on running the bug bounty for another three weeks. To account for any mishaps, we are budgeting a total of 12 weeks to complete the project instead of 6.

What is your capability to deliver your project with high levels of trust and accountability?

We have very experienced developers working on the project - Randy Burrell & Jonathan Fischoff of Cannonical. We've already completed the code which anyone can reference in the links we included as part of this proposal; and the third parties we intend to use are also recognized and capable - M Labs, Vacuum Labs & the wider Cardano Dev community.

The community can also reference the delivery of our last proposal "Driving Adoption via Travel D'Apps". This proposal is actually the natural follow up to our last submission.

In terms of steps:

Step 1 - First set of funds will be released immediately to vendor

Step 2 - Second set of funds will be released on completion of audit

Step 3 - Third set of funds will be put up for a bug bounty

Step 4 - Only after having completed steps 1-3 will any funds be released to the team

It would be keen to note that a part from the first tranche, catalyst doesn't release funds unless specific milestones are met, which should help alleviate concerns over mismanagement of ADA.

What are the main goals for the project and how will you validate if your approach is feasible?

The two main goals are as follows:

To complete the code audit within 6 weeks of the first disbursement - evidenced by a third party report

To complete the bounty within 6 weeks of the completed audit - evidenced by findings & bounty distributions

Between these two activities, we will know if our approach is both feasible and safe.

Please provide a detailed breakdown of your project’s milestones and each of the main tasks or activities to reach the milestone plus the expected timeline for the delivery.

Milestone 1 - Code Audit

Tasks: Vendor Selection, Agreement, "Code Handover", Review, Adjustments if needed, Review & Report

Timeline: 6 Weeks

Cost: 116,000 ADA

Milestone 2 - Bug Bounty

Tasks: Publicize the bounty, get feedback, review & correct if necessary, disburse based on terms

Timeline: 6 Weeks

Cost: 23,200 ADA

Please describe the deliverables, outputs and intended outcomes of each milestone.

Our first milestone will produce an auditors report and our second milestone will produce bug fixes. The ultimate outcome being, reliable, production ready, open source DAO code.

All documentation and outputs will be shared publicly. The code will be used for our own project (TripHut) and will be available for other developers use.

Please provide a detailed budget breakdown of the proposed work and resources.

Budget Breakdown

Audit - 116,000 ADA

Bounty - 23,200 ADA

Miscellaneous - 20,800 ADA

NB. The intention is to pay the auditor the quoted $33,000 USD in the ADA equivalent and to set a bounty of 20% of the auditors fee. The ADA balance quoted in miscellaneous is to cover any fluctuation in the price of ADA at todays price (.28 cents at the time of writing), fees associated with conversion if needed & the administrative & dev cost that comes with updating the code and managing the admin needs of the project.

Who is in the project team and what are their roles?

Jaymeon Jones - Project Manager - https://jm.linkedin.com/in/jaymeon-jones-8a55968b

Randy Burrell - Inhouse Developer - https://jm.linkedin.com/in/randyburrell

Jonathan Fischoff - Contracted Developer - https://www.canonicalllc.com/

M Labs OR Vacuum Labs - Auditor - https://mlabs.city/ - https://vacuumlabs.com/

How does the cost of the project represent value for money for the Cardano ecosystem?

We represent value for money as we strengthen the ecosystem with audited open sourced smart contract code. The code will also be used in the implementation of a DAO called TripHut - a decentralised travel club that sends its members on free or discounted vacations. This is a novel implementation that we believe can attract 1000 users in the short term and as much as a million users over the long term.

The figures quoted are industry standard for the audit given our code base ($33,000 USD), the bounty (20% of the audit amount) and in house admin & dev time for what we expect to be simple-enough fixes (capped at 20,800 ADA).

close

Playlist

  • EP2: epoch_length

    Authored by: Darlington Kofa

    3m 24s
    Darlington Kofa
  • EP1: 'd' parameter

    Authored by: Darlington Kofa

    4m 3s
    Darlington Kofa
  • EP3: key_deposit

    Authored by: Darlington Kofa

    3m 48s
    Darlington Kofa
  • EP4: epoch_no

    Authored by: Darlington Kofa

    2m 16s
    Darlington Kofa
  • EP5: max_block_size

    Authored by: Darlington Kofa

    3m 14s
    Darlington Kofa
  • EP6: pool_deposit

    Authored by: Darlington Kofa

    3m 19s
    Darlington Kofa
  • EP7: max_tx_size

    Authored by: Darlington Kofa

    4m 59s
    Darlington Kofa
0:00
/
~0:00