Do tradeoff study for erc721 contracts

[jasonrhaas]

The two erc721 contracts that we are considering using right now are:

• EIP721 Consensys/Tokens#130
• https://github.com/OpenZeppelin/openzeppelin-solidity/tree/master/contracts/token/ERC721

This task is to do a high level analysis of the pros and cons of using each one and document in the Wiki at:

https://github.com/mbeacom/gitcoin-erc721/wiki/erc721-contract-tradeoffs

[owocki]

i agree this is needed, but hopefully it doesnt suck up too many hours and the answer is obvoius after a first or second pass!

[jasonrhaas]

Not planning to spend much time on this, just want to organize my thoughts a bit. I would like to just get a simple implementation up and running to get a better idea of how we can integrate it down the road 👍

[jasonrhaas]

going with open zeppelin seems like the most prudent choice right now. Most of the examples I've seen online make it look easy to use, and also its regularly maintained.

[owocki]

any official word on whether its audited or will be audited by when we launch?

[jasonrhaas]

@owocki I found this -- https://github.com/OpenZeppelin/openzeppelin-solidity/blob/master/audit/ZeppelinAudit.md

But in terms of auditing, definitely will want my Kudos code to get audited and reviewed before going live with it of course 👍

[owocki]

That doc covers the ERC20 tokens not the 721.

In your file structure, is it clear which of the .sol files are OZ ones and which are developed by you? It'll make the audit have much less surface area if we can only have to audit the ones that were modified by us.

[jasonrhaas]

Yes, true I saw that. I have a question out on Slack, I'll dig into it more. Only the Kudos.sol file is mine. The other .sol files are inherited from open zepplin, and you won't see them until you do truffle compile.

[jasonrhaas]

Update on the security Audit from the Open Zeppelin #general channel.

shrugs [4:19 PM]
They have not been audited yet, no. The master branch also includes some fixes to update the contract to the latest spec, so it would be beneficial to either use the master branch or wait for the next release 🙂

(that said, I'm using them in production, but I like to live on the edge, so ¯_(ツ)_/¯ )