Code Monkey home page Code Monkey logo

meta-pool's Introduction

Note: last source version moved to https://github.com/Meta-Pool/liquid-staking-contract

Meta Staking Pool

Overview

What is Meta-Pool and other non-Technical Documentation

Audits

Technical Documentation

Repositories

This is the Smart Contract repository. The Web App UI is at https://github.com/Narwallets/metastaking-webapp

Change Log

1.2.1 - May 2022

  • NEAR gas computation will change, fix gas computation on dao upgrade instruction

1.2.0 - March 2022

  • All audit recommendations implemented
  • set all staking pools weights in a single call

1.1.0 - Dec 2021

  • new fn Realize_meta_massive to auto farm $META

1.0.0 - Apr 2021

0.1.0 - Nov 2020

  • Initial version based on core-contracts/lockup and core-contracts/staking-pool
  • Deposit, withdraw
  • Distributed stake/unstake
  • NEAR/stNEAR liquidity pool, Add/Remove liquidity
  • META Minting with rewards

TO DO & Help needed

Smart Contract

  • Deposit/withdraw
  • Buy stNEAR/Stake
  • Sell stNEAR/immediate unstake
  • Classic unstake-wait-finish-unstake
  • User trip-meter, measure rewards
  • distribute staking/unstaking
  • retrieve unstaked and ready
  • NEAR/stNEAR Liquidity Pool, Add/Remove liquidity
  • clearing mechanism on stake to restore liquidity in the NSLP
  • act as a NEP-xxx MULTI-FUN-TOK (multi-token contract). Implement for NEAR, stNEAR and META
  • Dividends-pool stNEAR/META
  • Staking-loans to whitelisted validators
  • Emergency Staking (from the nslp) to whitelisted validators

Test

  • Simulation tests
  • Fuzzy Testing

Staking pool list

  • List selected staking pools, getting weight, staked & unstaked
  • add a staking pool, set weight

Governing

  • Mint and distribute META with rewards
  • Phase II - Governing DAO

Infrastructure

  • External cron to call distribute()
  • compute remaining epoch time
  • whitelist pools before adding them

Expansions

  • USDNEAR MVP: Create a collateral-based stablecoin similar to Compound's DAI, using NEAR & stNEAR as collateral

Testing

Besides We are doing a simple ad-hoc fuzzy test for metapool. The test generates random operations. We have a list of "invariants" the contract must satisfy to guarantee the internal accounting is consistent. We use a seeded random generator to create "operations" against the metapool (deposit, liquid-unstake, delayed-unstake, add-liquidity, remove-liquidity, end-of-epoch, compute-rewards, retrieve-funds-from-pools) in any order and amount. After each successful operation we check the contract invariants again. This is our way to tests unprepared operations combinations and make sure the internal accounting remains consistent

This is he core .rs fuzzy source https://github.com/Narwallets/meta-pool/blob/master/metapool/tests/sim/simulation_fuzzy.rs, you can navigate up from there to see what it is doing.

meta-pool's People

Contributors

al-dyor-al avatar fercargo avatar htafolla avatar lau-bin avatar luciotato avatar the-preem-palver avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar

meta-pool's Issues

Displaying the number of NEAR during Unstake

The number of NEAR that a person will receive when Unstaked his stNEAR tockens is not displayed if you press the "max" button.
In order for it to be displayed, you must enter quantity manually. After this it it will displayed.

Few observation

NB:
OB = OBSERVATION
EXP = EXPECTATION

  1. OB:
  • Wallet automatic lock time seems very short.

EXP: Wallet lockout time should persist some time longer (maybe 30 mins or till system shut down)

  1. OB:

EXP: On page reload of https://www.narwallets.com/dapp/testnet/meta; the Dapp should remain connected and Wallet not automatically locked out

  1. OB:
  • Liquidity Providers: when the LPs button is clicked; the asynchronous request has no feedback

EXP: Liquidity Providers: when the LPs button is clicked; the asynchronous request should show user a visual processing feedback upon loading

  1. OB:
  • The label for the adding liquidity Input field specifies a Max number of Near (with a reference to total Near balance in account)

EXP: The label for the adding liquidity Input field could specify a Minimum requirements so User is aware in order to avoid showing 'Add at least {Near #} errors message' upon submission

  1. OB:
  • When I passed in 100.-1 as quantity to Liquidity; I get error as "panicked at: 'Failed to deserialize input from JSON.: Error(\invalid digit found in string, line: 1, column: 36)'"

EXP: I expect a simple error message as : "Input value not valid' instead of a stacktrace - (line: 1, column: 36)

  1. OB:
  • Validator Stake Loan Request: Validator Stake Loan button when clicked has no visual feedback for async call

EXP: Validator Stake Loan button should show user a visual processing feedback upon loading

  1. OB: The Request Draft
  • Modify Request Data form should specify minimum committed fee.
  • Modify Request Data form should define the a unit of Epoch is and also specify minimum committed fee Duration.
  • Modify Request Data form should explain the what Information URL refers to.
  1. OB: Unstacking
  2. When I unstacked any amount of stacked NEAR; I get a feedback without a timeline

EXP: I want to see the specified hours (eg 50hrs) count down feedback

Two feedback about user experience

Two feedback about user experience โ‘  after adding mobility, it will automatically jump to the main page, which will not be the case for other operations. If I want to add mobility again, I need to click this page again. โ‘ก I click the wallet without any response. I can't copy the wallet address or disconnect the link of the wallet. It's very inconvenient.

My observation and suggestion

  1. You guys can change the word below, just "Not enough balance". It will make UX much better https://prnt.sc/10rntu2
  2. You should add some features to let users know how much fee they will gonna cost. Just a simple method but very useful to make a better experience for users https://prnt.sc/10rnxku
  3. Available https://prnt.sc/10rnxku
  4. I expect to see the stNEAR to be shown on near wallet, it might need in some situation https://prnt.sc/10roqld
  5. It should have some kind of feature or number that let users know how much $META token is minted, for example using APY like others blockchain. It just a suggestion. https://prnt.sc/10rot9s

Cross-contract liquid unstake

I have implemented ability for my contract to manage staking with metapool.
It is actually quite cumbersome, so I propose an easy fix to make this straightforward for others to integrate.

Problem:

  1. You need to get your stake balance to know what your balance is to liquid unstake (not a problem IMO)
  2. You need to understand what amount is available so you can compute min_expected_near as it is required here: https://github.com/Narwallets/meta-pool/blob/master/metapool/src/lib.rs#L553-L557, for now I am using: https://github.com/Narwallets/meta-pool/blob/master/metapool/src/lib.rs#L534 but more callbacks makes expensive
  3. Once I know both balance and min_expected_near I can do the final call to liquid_unstake

My problem is more with efficiency, if I was able to get the min_expected_near of the total staked during the balance call, id be able to compute a ratio to calculate all other liquid unstake amounts.

Solution:

  1. Add min_expected_near_total to the response of https://github.com/Narwallets/meta-pool/blob/master/metapool/src/owner.rs#L163
  2. Add liquid_unstake_fee to the same response ^^, which allows for any other amount of st_near to be computed for accurate NEAR transfer (I want 5 NEAR, how much st_near does that actually mean?)

[BUG] - 0.0 NAN

Connect on with a account with nothing
Click on "Max" Button
image

Metapool contract update needed due to increased deployment cost

Deployment costs per byte of code are going to be increased by a factor of ~5 with this change to NEAR protocol: near/nearcore#6397

Probably this will happen with protocol version 53, which would be released on testnet by March 23 and on mainnet by April 20.

I listed all the indirect deployments from the past that would fail with the new cost. Deployments of meta-pool.near have showed up 10 times in this list, for example this transaction. Meaning that your current setup for redeploying might break with the planned increase of deployment cost.

It looks like migration currently reserves exactly 20Tgas, as defined here.

const GAS_FOR_UPGRADE: u64 = 20 * TGAS; //gas occupied by this fn

Now, I don't know how large your contract is exactly, which is the key factor. 20Tgas is only enough to cover deployment of a 274kB contract under the new costs. And not all 20Tgas is actually available, some will be used for executing the function. So the real maximum contract size will be smaller.

Please check if my understanding is correct that this will break you remote-update mechanism and if you can update your deployed contract before the protocol version 53 is released. I am not familiar with all the details of your contract but I am happy to assist in solving any problems caused by this. I am also available to answer any questions you might have, for example on Zulip

Handling a Malicious Operator Adding / Overweighting Malicious Staking Pools

How does meta-pool prevent a malicious operator / owner from setaling coins via a malicious staking pool? A attack vector i'm thinking of:

  1. A malicious actor gets voted in as an operator
  2. The owner creates malicious contract that implements the staking pool NEP. The malicious bit is deposit simply increases their balance in the staking pool, regardless of the sender. And withdraw only ever withdraws to the attacker's address
  3. The owner adds the staking pool to the list of staking pools in metapool, and overweights it in the following line:

pub fn set_staking_pool_weight(&mut self, inx: u16, weight_basis_points: u16) {

  1. When people run ping or stake, then coins are "stolen" into the malicious staking pool that implements the NEP, but is otherwise malicious

I feel like I'm missing something - or is such attacks simply possible?

META: ensure user|operator|treasury|developer are all DIFFERENT ACCOUNTS

There's a point where all those accounts are read into memory, updated (sell, fees, etc) and then stored again.
IF any one of those accounts is the same as another, the latest account to be stored will write-over other changes.
Solution: Ensure user|operator|treasury|developer are all DIFFERENT ACCOUNTS

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.