compound-finance / compound-money-market

Compound v1 Protocol [Copyright 2018 Compound]
https://legacy.compound.finance
Other
104 stars 49 forks source link

Update code in repository and website to latest deployed code #8

Closed fulldecent closed 4 years ago

fulldecent commented 5 years ago

Issue & work plan

As per the 2018-12-09 blog post and 2018-12-15 update, new contracts were deployed to the blockchain and are used in production:

  • An updated rate model, 0xcdaf8cb1839952cbe6d98d248e593b782a2419c7 and stablecoin rate model, 0x8ac03df808efae9397a9d95888230ee022b997f4
  • An updated price oracle, 0x9e77ad51e5c0825d6e440f49e49ef1a1bca37b5d
  • A liquidation contract, 0x1055be4bf7338c7606d9efdcf80593f180ba043e— To participate in the liquidation process, you must first ERC-20 approve the liquidation contract to use your token balances, and submit transactions through the contract

This is the latest blog post so I understand this information to be current.

Several sources of information in Compound Finance repositories and websites now contain outdated information:

Impact

Inaccurate information will continue to propagate. Somebody may find the old deployment addresses or ABI listed on the the Compound Finance website and build something around it, it might cause something to break.

Also, not having a place to read the preferred editable (i.e. not compiled) contract source code makes analysis more difficult. Lack of analysis leads to unrecognized bugs.

Discussion

Nobody likes re-deploying code they previously thought was final. But may I recommend as insurance against similar issues as this occurring on future re-deployments (if any), a new DEPLOY.md file be added to this repository. The scope of this file would be to explain the exact process for re-deploying any code. You may use https://github.com/su-squares/ethereum-contract/blob/master/DEPLOY.md as a starting point.

Of course during re-deployment the first thought is always "prevent customer loss of funds" and "call the lawyers", but it does help to have that DEPLOY.md file staring you in the face rather than waiting a month later and somebody remembers "hey, we should go look up that issue @fulldecent opened last time this happened."

fulldecent commented 4 years ago

Closing. It seems this repo is unmaintained.