A Review of Smart Contract Upgrades Since 0.6

Aragon -

In the year since Aragon 0.6 was released to Ethereum Mainnet, the underlying smart contracts powering Aragon organizations have continued to improve. Both Aragon 0.7 and 0.8 were launched with contract changes relevant for all Aragon users.

From day one, aragonOS was designed with the assumption that software will not only be imperfect but also deployed to a constantly changing environment. It's why the framework emphasized smart contract upgradeability as well as the governance mechanisms behind upgrades—ultimately, whoever has the ability to upgrade software will be in control of that software.

2019 validated our assumptions. Whilst we weren't able to fix everything with an upgrade, as immutability must exist somewhere for applications built on top of Ethereum, our smart contracts and their users did have to contend with, and overcome, several issues found or introduced after their deployment:

All other code changes could be described as new features or quality of life improvements, including:

  • More efficient gas usage
  • Code logic simplifications to lower future chances of introducing bugs, or
  • Fixes to small, un-exploitable bugs, primarily with small memory leaks

Both the 0.7 and 0.8 smart contract releases were accompanied with re-audits of the codebase. 0.7's changes were audited in tandem by Authio and ConsenSys Diligence, as part of AGP-18. 0.8 and its new templates were audited by ConsenSys Diligence, commissioned with processes deriving from AGP-43.

If you're interested in auditing these deployments yourself, we've logged every on-chain deployment to Mainnet, as well as other test networks, in our deployments log. An ongoing bug bounty is also available for all Mainnet-deployed smart contracts, including unreported bugs in older versions.

Aragon 0.7

The 0.7 release in April 2019 marked the first time, to my knowledge, that end users of an upgradeable smart contract—which they themselves owned!—were able to opt into an upgrade. Each individual default application—Finance, Tokens, Vault, and Voting—was available for upgrade.

This is a powerful feature baked into the design of aragonOS and is the underlying bedrock that enables our vision of a flourishing app ecosystem on the Aragon client. To date, over 100 organizations, or one-fifth of those eligible and most of the currently active organizations, have chosen to upgrade. This includes the Aragon Governance organization, which did so only after polling the entire Aragon community.

Upgrade highlights from each app:

Small additional changes were released to the core contracts powering organizations, however, these are not available for upgrade in older organizations. Only organizations created after April 17, 2019 received these changes:

  • Kernel: log an additional event during an organization's creation to act as the root of a full provenance chain of installed Kernel code in an organization's history. This allows off-chain tools to prove and verify that an organization had not previously installed untrusted code.
  • EVMScripts: quality-of-life changes to reduce possibility of future bugs.

New organization templates, automatically selected during the Aragon client's organization onboarding flow, were deployed to facilitate the release of these core changes. These templates were otherwise functionally the same as 0.6's templates.

Changelog

For the full changelog and code diffs between 0.6 and 0.7, you may refer to the following resources.

aragonOS:

DAO templates:

Finance:

Tokens:

Vault:

Voting:

Worth mentioning

Since the 0.7 release, we have lost the ability to upgrade the frontends of these older app versions. This is working as designed by our on-chain package manager, which prohibits automatic upgrades for upgrades involving smart contract changes.

However, this also means that we cannot fix any unforeseen frontend issues due to later changes from browsers or the overall Ethereum environment. For example, the 0.6 Finance app now does not load on Firefox due to a backwards-incompatible change (or bug) made in Firefox after April.

Aragon 0.8

Although 0.8's release introduced many frontend improvements to the apps, including their conformance to aragonDS, the release itself included no contract upgrades for any app. This was an explicit choice made to minimize the friction and fragmentation imposed from such upgrades on the overall Aragon ecosystem. We are playing the long game—there is monitoring in place and we will consider decreasing the length of the upgrade cycle as more and more users get accustomed to and comfortable with these upgrades.

As this release involved no contract changes for any app, users of 0.7 were automatically upgraded to 0.8's frontend interfaces.

The contract changes from the 0.8 release were focused solely on the infrastructure supporting new organizations:

  • Templates: What were previously called DAO kits are now named DAO templates. 0.8 deprecated the old, and often confusing, Democracy and Multisig templates, and introduced new and hopefully more approachable templates that are structured around their intended use cases.
  • App Proxies: Each AppProxy contract, used by default when an organization installs an application, was optimized for gas efficiency. This was not done out of a desire to improve the user experience, but to mitigate the effects of EIP-1884. For more details on how EIP-1884 impacts Aragon organizations created before Sept. 11, 2019, please read our announcement.

Neither of these infrastructural changes are available for organizations created before Sept. 11, 2019. They are only in effect for new organizations.

In addition to the improved infrastructure, we also officially launched the Agent app after a six month beta. If you would like to take part in future beta programs for apps like Agent, please contact us!

🚨 EIP-1884, now live with the Istanbul hard fork, introduces complications for using the Agent app with organizations created before Sept. 11, 2019.

Our recommendation for affected organizations is to create a new organization from the Aragon client and migrate any users, token holders, and funds over to the new organization. Please contact support@aragon.org if you need help with this migration.

For more information, please read our announcement on the impacts of Istanbul for older organizations.

Change log

For the full changelog and code diffs between 0.7 and 0.8, you may refer to the following resources.

aragonOS:

DAO Templates:

Agent:

Current state and future plans

As mentioned earlier, we have held back from releasing new contract (raw functionality!) upgrades to the default suite of apps since 0.7. That does not mean we haven't been working on them, though!

The next major upgrade of the Aragon client, planned for Q2 2020, will include contract upgrades for most, if not all, existing apps. We have already implemented a number of improvements, with more lined up, so stay tuned!

In the meantime, huge new sets of installable functionality are coming online for organizations. Between last month and next month, apps like Open Enterprise from Autark, Aragon Fundraising, Dandelion from 1Hive, and Empower the DAO's applications, have either launched or are in the final phases ahead of a Mainnet launch. Exciting experiments, such as daonuts on Reddit, are also being rolled out, so take a moment and try them out! Or maybe, you'd like to build an app yourself and would find the developer documentation interesting.

Finally, as a hurrah to the state of the network of Aragon organizations live on Mainnet, I am pleased to announce that we have finally passed the flippening point of non-upgraded 0.6 organizations against new, 0.8 organizations. It took us almost six months since the contract upgrades were released, but our Scout dashboards are now showing that the majority of organizations are operating with the latest, and of course greatest, smart contracts.