KuberIDE 2.0 [Audit readiness module]: Preparing your smart contracts for audit

[GENERAL] Name and surname of main applicant

Kuber Team (Sandip Pandey)

[GENERAL] Are you delivering this project as an individual or as an entity (whether formally incorporated or not)

Entity (Incorporated)

[GENERAL] Please specify how many months you expect your project to last (from 2-12 months)

4

[GENERAL] Please indicate if your proposal has been auto-translated into English from another language

No

[GENERAL] Summarize your solution to the problem (200-character limit including spaces)

This proposal is about making some of the audit checks that can be done automatically more accessible to average developer. We plan to enable that on KuberIDE for FREE for all.

[GENERAL] Does your project have any dependencies on other organizations, technical or otherwise?

No

[GENERAL] If YES, please describe what the dependency is and why you believe it is essential for your project’s delivery. If NO, please write “No dependencies.”

The project depends on KuberIDE core compilers used in the browser code compiling and execution.

[GENERAL] Will your project’s output/s be fully open source?

No

[GENERAL] Please provide here more information on the open source status of your project outputs

The outputs produced under this proposal will be open source. However, the project itself considering the complete IDE which depends on some closed sourced modules cannot be made open source.

[SOLUTION] Please describe your proposed solution

Getting started with writing smart contracts on Cardano with Plutus is hard because of the dependencies baggage. It can easily take days for developers to have a working and productive system setup for Plutus smart contract development. It does not have to be that way. Look how easy it is to get started on Ethereum.

There are several awesome people, projects and proposals on Cardano trying to address this problem by offering easy infrastructure setup for Cardano node, vscode like editors, and tools. This is great to see. However, we believe we can do better. How about no setup at all? All you need is a browser and a good internet. How does that sound? As a developer, if you can start writing smart contracts directly on the browser, compile the contract by clicking a button and deploy/interact with your contract by directly interacting with your favourite wallet. Wouldn't that be awesome? We believe so.

KuberIDE is our solution to the problem. It is a fully browser based IDE for a complete Plutus smart contracts development experience. No setup required. Just writing Plutus contracts, compile them on demand with a button and create transactions, sign them, interact with your favorite wallet, all within the browser. It may sound like selling a dream, it is not. In fact, KuberIDE is already live and you can start using it for free here: https://kuberide.com

This proposal is here to ask for your support so we can develop KuberIDE v2.0 with the features that further enhances the developer experience on Cardano and production readiness:

1. Audit checklist for your contract about what you need to prepare to submit for auditing your contract code.

[IMPACT] Please define the positive impact your project will have on the wider Cardano community

The proposed solution lies under 'Developer Tools' proposal type based on the challenge brief. The proposal is essentially an IDE for Plutus smart contract development that improve the lives of smart contract developers releasing them from the hassle of maintaining the infrastructure themselves.

In the last two years, we have trained several developers on Plutus/Haskell and we know the pain. We know first hand, getting somebody trained and make them productive on Cardano smart contract development is expensive. Having done smart contracts development on EVM chains ourselves before, we can feel how big the gap is. So, it was in our interest to make the process of training efficient and getting developers productive as quickly as possible. Exactly for that, we have made a significat personal investment to get KuberIDE to what it is now. With KuberIDE, it has become so much productive to get a developer onboard. We use the IDE for our own contract development and testing and constantly improve with perf improvement and bug fixes.

We believe so many Cardano developers can benefit from KuberIDE. Especially new developers just trying to join the journey of developing smart contracts on Cardano. KuberIDE hides the complexity of the infrastructure and lets developers focus on what is important - contract code.

We have participated and helped organize Hackathons where we have majority of the participants struggle at the first step of getting the environment setup. At the end they get a feeling of not-so-productive hackathons. That is sad. Imagine now organizing Hackathon with KuberIDE. The participants can get directly into writing smart contracts, compile the code with a button and deploy their contracts by interacting with the wallet. They will get a sense of achievement at the end of the session. Wouldn't that improve the Cardano developers experience?

Quantifying the impact, we would consider KuberIDE a success if we can improve the developer experience of 100 developers in a year, realistically speaking.

[CAPABILITY & FEASIBILITY] What is your capability to deliver your project with high levels of trust and accountability? How do you intend to validate if your approach is feasible?

In terms of capability, we believe we're the best team to deliver the project for these reasons:

1. We're the same team who built the first version of KuberIDE which is already a complex system under the hood. We built the IDE based on our own experience working on Haskell and writing Plutus contracts. So, we know the problem we're solving first hand.
2. We're a trusted team who have worked (and is still working with IOG) on different projects and assignments.
3. Our team consists of experienced Haskell/Plutus developers, engineers and devops to deliver a great working software product.

To demonstrate that we can manage the funds properly, we plan to show how employ the agile software development methodology as we have always done ourselves internally.

1. Build in sprints: We follow a short sprint cycle of 1 week where we ship at the end of sprint. The cycle goes as plan for the sprint, work on the sprint tickets, sprint review and deploy at the end of sprint.
2. Release at the end of the sprint: Progress can be made if we maintain the cadence of shipping something usable at the end of the sprint.
3. Get feedback from the users either directly on GitHub or via Discord and incorporate that on the sprint planning.
4. Welcome the interested communities members to join our sprint review meetings and the release.

[PROJECT MILESTONES] What are the key milestones you need to achieve in order to complete your project successfully?

Milestone 1: Preparing the checklist

Deliverables:

• Document outlining what vulnerabilities will be checked

Output:

• Documented the vulnerabilities that will be checked automatically
• Implemented code analysers for common pattern detections.
• Tried tracers for execution flow

Intended Outcome:

• Vulnerabilities document is published publicly either on Github or a blog post
• Initial contract scanning for vulnerabilities on the contract is implemented
• Integration on the IDE has started

Milestone 2: Integration on the IDE

Deliverables:

• Audit checklist feature is available on kuberide.com for beta testing

Output:

• Used AI to train on known vulerabilities and issues. Added consent request mechanism for it.
• Prepared the audit readiness checklist template
• Customized the audit readiness checklist based on the user contract.
• Open the feature to beta users

Intended Outcome:

• Beta users can check the common issues and vulnerabilities on their contract
• Beta Users can see a list of checklist specific to their contract to prepare for audit of the contract.

Final Milestone: Project completion

Deliverables:

• Project close out report and video

Output:

• Make the feature available to public
• Prepare the project close out report and video for Catalyst

Intended Outcome:

• Feature is available on the IDE publicly

[RESOURCES] Who is in the project team and what are their roles?

Sandip Pandey, Project Manager

Sudip Bhattarai, Lead engineer

Nabin Pokharel, Plutus/backend developer

Bibishan Pandey, frontend developer

Ankit Sapkota, frontend developer

This is the same team that built the current version of KuberIDE.

[BUDGET & COSTS] Please provide a cost breakdown of the proposed work and resources

Development

Resources: 2 backend Plutus/Haskell developer, 1 frontend developer

Timeline: 4 months

Budget: 130,000 Ada

Project Management (1)

Timeline: 4 months

Budget: 20,000 Ada

Total budget: 150,000 Ada

[VALUE FOR MONEY] How does the cost of the project represent value for money for the Cardano ecosystem?

First and foremost, we have been doing the development of the IDE ourselves for over a year without any external investment. This is a significant commitment and investment from our side. We believe that investing in developers productivity will pay off over time. Preventing the waste of developers time struggling to get the infrastructure working in itself is a very satisfying feeling. Hope the community agrees with me.

While we made the investment building the first version of the IDE which is available for free for everybody to use, we would like your support in building the next release with features like audit checklist as presented here which will help to improve the security of the contracts deployed on cardano and help developers who cannot afford to pay for security audits.

The costs are reflective of the time required to build the features mentioned in this proposal.