[REDACTED] 2024| Best Practices for NEAR Smart Contract Development

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:01

   so exciting to be here uh my name is lot also known as frol and uh oh hold on we are moving on yeah and uh I'm working on building the dev tools for you developers building on year so hopefully we will have a lot of uh insights today that some of you may not have learned before but I hope every s single developer on here should know um so we'll have it all done in 20 minutes um I was near for

2. 0:33

   over four four years and I love near Love Russ Love Open Source uh I'm also confounder yay uh also confounder of the near Dev Hub and this is our Community Driven initiative and we want developers to feel home feel uh excited and feel um that there is a space for them to innovate to share the the just the best tag and their excitement uh among like like-minded people uh I'm also number 13

3. 1:05

   on the race of Sloss check out what it actually means on the internet not number one but I'm getting slowly there you know uh I'm also actively helping our community in Dev chat so I know your pains I know the common pitfalls and I want you to not follow the steps any longer you want to be productive itive day one minute one um and uh today I want to say that near is not crypto near

4. 1:38

   is not web near is not web 3 The Singularity is nearer so that's where it all started right AI um and the what it all means will it talk about Ai No near protocol is the blockchain and that is the tech that powers the neari and today and my expertise is on the on that side of things and we had a lot of other talks uh covering all other parts so I will not repeat uh myself on other

5. 2:13

   talks so today we will briefly start immediately from the landing page of dev. n.org which gets you up to speed in no time one scen like one pager you understand it all uh you can get started uh immediately uh JavaScript rust uh there are also examples for solidity you can build in solidity for near thanks to Aurora uh we are also exploring different paths with other languages

6. 2:42

   like Zig python uh Swift we'll see how that plays um so check out to dev. new.org if you just start it but we'll run through it and uh learn how to how what what what near can offer what we can do there and today uh we'll talk about the best practices um and I want every single developer on year to learn just four host functions before we dive in so those are storage read storage right value return and

7. 3:20

   input with those four host functions you can build um this simple contracts and that will build and help you to develop the foundation understanding of what the um what what the like what's the source of Truth what do you actually store in the contract uh this is a uh minimum contract in JavaScript uh with just simple get greeting set greeting methods available from your contract which interacts using the lowlevel API

8. 3:56

   uh the host functions of the blockchain exposed uh you don't write the code this way uh usually you usually want to use higher level API and we will talk about it uh in a bit but I encourage you to learn more about the uh available host functions and what's the blockchain offers to you in in the environment you execute your programs uh one of the main biggest security Pitfall that people I see uh fall often into is the difference between predecessor account ID versus

9. 4:33

   signer account ID so predecessor account is the uh account that called the uh the the contract that we are implementing and signer accounted is who initiated the transaction transaction could be initiated by one person then cross contracts could have uh been in the in the chain and then the uh some contract called our contract and we need to distinguish it to ID especially if you want to check who was the owner who was

10. 5:03

    the like initiator of the uh action and we did not pass that uh ownership from this uh from the uh who signed the transaction we want to actually get it from the who who who called us because if you skip the step you can suddenly allow um a some a link drop uh contract uh withdraw usdt tokens uh over a user um because they checked for signer count to as an owner of the token versus predecessor um second you have to use

11. 5:40

    the latest uh death tools the uh near IRS and caran are there it's admired in the near Community you have to try it even outside of near uh Community I talked to rust con to people they just enjoy the the way they we construct the um uh complex commands of CLI so you have to uh check it out and uh play with it just so much joy working with those um so this is carger experience you do carger new and you immediately have your full setup with cicd with tests uh and

12. 6:20

    basic uh example ready for you if you are building in in Rust uh you can use car uh oh no car car near uh create app uh to create your JavaScript contract which has pretty much similar experience you type one command npx uh create your app and select that you want to have a GS contract and boom you are also all set so you have to use that uh to be on the safe side and also it's very productive to do so um obviously well it's it could be hard but I like

13. 6:56

    especially for contracts you want to use tests use tests write tests to uh speed up your development flow with tests you can immediately check all the conditions and avoid repetitive work uh scripting it outside of your um um testing environment through CLI or other tools is not productive and near workspaces GSN RS are the Frameworks that help you to uh achieve this so this is the minimum uh or like not minimum but pre

14. 7:30

    extensive test actually which uh test the state migration so whenever you upgrade your contract the state the data of the contract remains to be there and you want to have a test that takes the contract of a current version from the chain from mainnet in this case uh initiates the initiates from that point uh add some dummy data you can also pick some uh uh snapshot of the data from your real

15. 8:02

    smart contract on on Main as well that could be also an option and then you try to upgrade it in a test so the test would uh try to upgrade your contract and then try to execute and check that it actually is still operational so this is very good example and actually I will refer to uh many examples that we built as part of devhub uh development so we for devhub uh port portal we do have a contract we do have uh boss components

16. 8:34

    so we do we do experience the Pains of all the developers uh on a daily basis and we try to solve them and we provide this best practices and I often R refer to pieces of code from our Reapers uh cicd is also pretty uh standard and fun and also once you scripted once it's so much joy to work with a project because you don't know know you don't need to worry about oh is it actually a working change or not you just have a test for

17. 9:05

    it and c will take care of checking that it compiles the state migration will not fail and uh um many other aspects of it and then you can also script even like deployment for example for devhub on every push to main we deploy the contract uh with cicd and we do this like thanks to the tests we can do that safely and we are pretty confident that we will arrive to the working version of the contract um once you're ready uh you

18. 9:38

    should use and consider using uh strict types uh rather than JavaScript uh dyamic types but I encourage you to explore the space as fast as possible with the tools that are um most productive to you so if you are more more productive with JavaScript go with near SDK GS it is feature complete it's nice obviously it's not as performant as rust SDK but it's like in even in web to world it's obvious to anyone that

19. 10:11

    JavaScript apps versus thrust apps will have a performance difference but performance of execution is not the all you need sometimes the most valuable metric is actually time to Market so in that case pick the tools that are the most productive to you um uh but when you are evolving and you want to be more sure in the um like in the security of your application consider using strict types Define Dedicated types like for example on this slide uh near token is a

20. 10:45

    simple wrap around U 128 so just uh integer type um but it it only allows you to sum only like near tokens you cannot sum just random numbers you cannot multiply it by random number so it's very nice to have such wrapper abstractions for you to have a safeguards and r is a very good language to do so uh in typescript there are more challenges I wouldn't say that ecosystem in typescript is that heavy on leveraging custom types but still like

21. 11:18

    it's up to you to define those um also uh worst mentioning the uh difference between uh various approaches to store collections of data like uh dictionaries Maps we lists uh and sets so there is a standard so in case of rust for example uh JavaScript is actually the same there are built in uh collections hashmap hash Set uh and vector or list right and you can use those you can uh use those Collections and just serialize them and put into the storage as Json as borch uh

22. 11:58

    in any way you you put it and then you will be able to read it from there but you need to be aware of the fact that you cannot put like millions of Records uh under a single key there so you need to uh have a solution to actually be able to store more elements and uh if it's up to 100 elements we have a benchmark um then it's actually totally fine to just caliz it uh as a like standard uh collections into single key the the problem is uh you need to make

23. 12:31

    sure that your collection is either bounded like say so you know that it cannot hold more like for example 10 elements anyway then it's perfect example if your collection like nft for example uh collection could could have uh millions of nfts um then you should consider using the SDK provided uh types that just makes it easy to manipulate to it under under the hood it's still uses store storage read and storage

24. 13:03

    right um but it's just a nice wrapper so you don't need to worry about it and what it does it stores each individual uh element item of the collection as individual uh lowlevel uh near provided local storage um U database element um for security aspects uh I strongly recommend uh we we all commit to building reproducible contracts going forward it's been a journey for near for

25. 13:35

    a long time to not be able to Pro to to ensure that the contract that you see on chain uh is matching the source code that you see on GitHub even if as a developer I say that yeah this is the repo this is a source code you you had no way to prove it uh unless you had a like a clear instructions in your de how to actually reproduce it or where to uh to see it um now we have carger build

26. 14:05

    command that does it automatically for you so it actually uh provides you a Docker environment uh that is Frozen with all the like environment uh setup um for the future to be able to just recompile the same source code in that environment and receive exactly the same bite uh basm file uh as as an output and then you can confirm locally that it is the same contract and this is how you verify that the contract matches the

27. 14:38

    source code um this is the way how you see it on the um um on the CLI if you go to and call um uh contract Source metadata uh uh function uh on the contract you you will see how we arve to this whole like uh contract including the link to the specific commit of the source code and all that information needed for reproducible builds uh and we all humans so I would prefer some UI and

28. 15:18

    hope like I'm very happy that meor blocks team is very supportive of all such initiatives for developers so they actually integrated this piece of tech already and they LW the code for you to inspect right from their UI so you this is like a collaboration of uh several teams Source can devhub and near blogs to arrive to this uh whole experience so it's amazing uh and very useful for um uh for all us and I encourage you very strongly to

29. 15:59

    resolve all the warnings that your compiler and uh clippy linters are actually uh providing you so this is an article from last year from Aurora team and how they had to pay this amount to the security researcher who found the bug that was highlighted there by the linter all the time facing like like every compilation was just screaming at them fix it but they had to fix it for a

30. 16:28

    little bit of money after all um so and I also encourage you to never stop learning uh there are a lot of useful uh sources and uh um examples that you can take inspiration from and learn um this is just four that I often refer people to they are not by no means are the only available in system uh but that's where you can find uh techniques like uh factories cicd setup um use of latest tooling and uh all that

31. 17:09

    stuff um web four you have to be ready you have to be ready for this new era uh it's actually been been live for for how many probably three years now uh but it's not very widely known inica system I still believe uh it's a very simple idea of uh a small Gateway um that sits and listens for HTTP traffic and turns that those HTTP get request into a get function call web for get function call to your contract so for example Dev hub.

32. 17:46

    near. page is a website that is served by a by the small Gateway but uh actually powered by the blockchain contract uh so so this is just a very good example of what near technology allows us to build um if you are still new and lost a bit in my talk I encourage you to start with uh dev. n.org website find all the resources connect with the communities and get support in the various Dev chats and uh subscribe for the newsletter to

33. 18:26

    be up toate um uh we have it weekly collection of all the latest greatest uh de news uh uh in the ecosystem um if you want to help open source and uh play a bit with like near future how we will see uh the um open source and near interacting uh race of Sloss is a great project to to play around you can gamify your day-to-day uh boring uh development with contributions and uh uh create a PR mention the race

34. 19:08

    of sloth uh user on GitHub and you will be greeted by the bot and you will and then you will get scores on the way you don't need to leave GitHub at all that's all integrated in into the GitHub and this is a under the hood it's powered by near and this is the example of apps that I believe should be out there more and more uh not trying to build just web 3 or like blockchain app but actually

35. 19:40

    leverage blockchain to and to to to solve specific problems that blockchain can help you solving and use the all the available web to tooling for everything else uh to be productive and uh uh that's it so be updated uh go check out uh devhub uh social media and uh happy to have you talking to me in any corner of this reducted event and have a great uh event