maurelian

Initial Registrar for the Ethereum Name Service

EIP: Draft 
Title: Initial Registrar for the Ethereum Name Service 
Author: J. Maurelian and Nick Johnson
Status: Draft
Type: Informational
Created: <date created on, in ISO 8601 (yyyy-mm-dd) format>

maurelian

Questions to answer

1. Should funds be donated to the Foundation instead of burned?

• maybe just the 0.1% bidding cost?

2. Nameprep isn't enforced anywhere within the contracts, placing the onus on the client to properly implement it. This seems like a security/spoofing/phishing concern.
3. Who will own the ENS rootnode?
4. How can I be sure that person won't just

maurelian

OK, so here's what it looks like happens when the value of the bid is higher than the amount submitted.

1. When you submit a new bid, a deed contract is created. The full amount of ether you submitted (let's say 3 ETH) is sent to that Deed.

2. When you then unseal your bid, revealing the value of your actual bid (let's say 3 ETH) one of two things can happen:

   1. The current highest bid for foobarbaz.eth is 4 ETH. You do not win. The registrar thus closes the deed, refunding 99.9% of the amount submitted.

3. The current highest bid for foobarbaz.eth is 2 ETH. You are the highest bidder so far! In this case, the registrar will try to update the balance held by the deed, a

maurelian

Nameprep search

Issue

Cannot find a maintained implementation of name prep for the registrar package

Options

1. Use existing libraries:

maurelian

Keybase proof

I hereby claim:

• I am maurelian on github.
• I am maurelian (https://keybase.io/maurelian) on keybase.
• I have a public key ASBOCUDTU4hXdwiBl_h5gATEt6ww55bTIYHvdaRcSvYjqQo

To claim this, I am signing this object:

maurelian

pragma solidity ^0.4.10;

// Update: Just use HardHat's: https://github.com/nomiclabs/hardhat/blob/master/packages/hardhat-core/console.sol

// Enables event logging of the format `console.log('descriptive string', variable)`, 
// without having to worry about the variable type (as long as an event has been declared for that type in the 
// Console contract.

contract Console {
    event LogUint(string, uint);

maurelian

Independent Audit of the ENS Registrar

• Section 1 - Overview
• Section 2 - General discussion
  • 2.1 Lack of bounty participation
  • 2.2 Usage of the LLL implementation of the Registry
• Section 3 - Solidity Contracts Analysis
  • 3.1 Unanticipated behavior for unrevealed bids on unowned auctions [medium]

maurelian

A rough outline from my ENS walkthrough.

scenarios:

Every hash in the registrar is in one of 5 modes:

• Open
• Auction
• Owned
• Reveal
• NotYetAvailable

maurelian

#! /bin/bash

# Simpler version of https://github.com/OpenZeppelin/zeppelin-solidity/master/scripts/test.sh

  echo "Starting our own testrpc-sc node instance"
  # we give each account 1M ether, needed for high-value tests
  ./node_modules/ethereumjs-testrpc-sc/bin/testrpc --gasLimit 0xfffffffffff --port 8555 \
    --account="0x2bdd21761a483f71054e14f5b827213567971c676928d9a1808cbfa4b7501200,1000000000000000000000000"  \
    --account="0x2bdd21761a483f71054e14f5b827213567971c676928d9a1808cbfa4b7501201,1000000000000000000000000"  \
    --account="0x2bdd21761a483f71054e14f5b827213567971c676928d9a1808cbfa4b7501202,1000000000000000000000000"  \

maurelian

This is an informal... you might even say adhoc review of the SimpleMultisig contract, found here:

https://github.com/christianlundkvist/simple-multisig/tree/9d486cb280c1b0108a64a0e1c4bc0c636919c2d7

This review makes no legally binding guarantees whatsoever. Use at your own risk.

Summary

The two findings listed under Major and Medium should be fixed. The Minor and Note issues don't pose a security risk, but should be fixed to adhere to best practices.