Final round of changes and latest audit

.env.sample

@@ -0,0 +1,11 @@
+MNEMONIC=
+ACCOUNT_PK=
+INFURA_API_KEY=
+ETHERSCAN_API_KEY=
+GNOSISSCAN_API_KEY=
+POLYGONSCAN_API-KEY=
+OPTIMISTICSCAN_API_KEY=
+ARBISCAN_API_KEY=
+BASESCAN_API_KEY=
+REPORT_GAS=false
+COINMARKETCAP_API_KEY=

.github/workflows/publish.yml

@@ -12,25 +12,25 @@ jobs:
         uses: actions/checkout@v2
       - uses: actions/setup-node@v2
         with:
-          node-version: 16.x
+          node-version: 18.x
           registry-url: https://registry.npmjs.org/
       - run: yarn global add npm
-      - name: Compare package version to published version
+      - name: Check package version
+        id: cpv
+        uses: PostHog/check-package-version@v2
+      - name: Echo package vs published versions
         run: |
-          echo "::set-output name=npm_version::$(npm view @daohaus/baal-contracts version)"
-          echo "::set-output name=package_version::$(cat package.json | grep version | head -1 | awk -F= "{ print $2 }" | sed 's/[version:,"]//g' | tr -d '[[:space:]]')"
-        id: get-versions
-      - name: print outpouts package vs published versions
-        run: |
-          echo ${{steps.get-versions.outputs.npm_version}}
-          echo ${{steps.get-versions.outputs.package_version}}
-          echo ${{steps.get-versions.outputs.package_version > steps.get-versions.outputs.npm_version}}
+            echo "Committed version: ${{ steps.cpv.outputs.committed-version }}"
+            echo "Published version: ${{ steps.cpv.outputs.published-version }}"
+            echo "Is new version: ${{ steps.cpv.outputs.is-new-version }}"
       - run: yarn install
-        if: steps.get-versions.outputs.package_version > steps.get-versions.outputs.npm_version
+        if: steps.cpv.outputs.is-new-version == 'true'
       - run: yarn build
-        if: steps.get-versions.outputs.package_version > steps.get-versions.outputs.npm_version
+        if: steps.cpv.outputs.is-new-version == 'true'
+      - run: yarn test
+        if: steps.cpv.outputs.is-new-version == 'true'
       - name: publishing
-        if: steps.get-versions.outputs.package_version > steps.get-versions.outputs.npm_version
+        if: steps.cpv.outputs.is-new-version == 'true'
         run: |
           echo '//registry.npmjs.org/:_authToken=${{secrets.NPM_TOKEN}}' > .npmrc
           npm publish --access public --scope daohaus --otp ${{ secrets.NPM_TOKEN }}

.gitignore

@@ -4,8 +4,17 @@ cache/
 .DS_Store
 *.swp
 *.txt
-
+yarn-error.log
 
 dist/
 src/types/
 abi/
+export/
+.openzeppelin/
+
+.env
+.env.production
+.env.staging
+
+coverage.json
+coverage/

.vscode/settings.json

@@ -0,0 +1,6 @@
+{
+  "solidity.defaultCompiler": "localNodeModule",
+  "solidity.compileUsingRemoteVersion": "v0.8.7+commit.e28d00a7",
+  "solidity.enableLocalNodeCompiler": false
+
+}

README.md

@@ -16,12 +16,20 @@ If you are going to just use this project feel free to clone it.  If you would l
 
 `yarn install` - to install all of the components for the project
 
+`.env.sample` containes the all required environment variables that need to be set to build, deploy & publish the smart contracts on the blockchain. These should be added to a `.env[.*]` file.
+
 ### Building
 
 This project uses the [hardhat](https://hardhat.org/) ethereum tools for solidity compiling and running a virtual ethereum environment for testing.
 
 `yarn build` - will compile the solidity code and generate your contract artifacts (in the /artifacts directory), and generate all of the necessary types.
 
+### Testing
+
+If you are looking to work on unit tests for this project be sure to read the README file in the test directory.
+
+`yarn hardhat test` - run the unit tests
+
 ## Publishing
 
 the Baal contracts, types, and abis are published through the CI process, after making changes to the repo, and when you are ready to publish the packages, do the following:
@@ -31,69 +39,178 @@ the Baal contracts, types, and abis are published through the CI process, after
 
 running the CI process will trigger on `merges to feat/baalZodiac branch` build the dist folder and publish it to `@daohaus/baal-contracts` package to npm if the package.json version is different than the current latest on npm.
 
-### Testing
+----
+## Folder Structure
+- ./abi - generated abis
+- ./contracts - main solidity contracts, interfaces, tools and utils
+- ./deploy - deploy scripts and helpers)
+- ./scripts - deploy scripts and helpers (**soon to be deprecated**)
+- ./tasks - hard hat cli tasks
+- ./tests - test files
 
-If you are looking to work on unit tests for this project be sure to read the README file in the test directory.
+----
+
+## Coverage
+
+currently, coverage is turned off for test efficiency purposes. In order to switch coverage on, add `yul` to the hardhat config:
+
+```
+{
+  ...
+  compilers: [
+    {
+      version: "0.8.7",
+      settings: {
+        optimizer: {
+          enabled: true,
+          runs: 200,
+          details: {
+            yul: true
+          }
+        },
+      },
+    }
+  ]
+}
+```
+
+then run the coverage command:
+
+```
+npx hardhat coverage
+```
+----
+## Verify Contracts
+
+Run the following command:
 
-`npx hardhat test` - run the unit tests
+```
+yarn hardhat etherscan-verify
+```
+
+----
+## Importing the package on your own project
+
+You can `yarn add @daohaus/baal-contracts` on your own project and get access to Baal smart contracts, ABIs & deployment scripts for local testing your contract integrations:
+
+* *Smart contracts*: you can import Baal smart contract on your Hardhat /Foundry / Truffle project at `@daohaus/baal-contracts/contracts/*`
+* *ABIs*: if your custom frontend needs to interact with Baal contracts, you can find contract ABIs at `@daohaus/baal-contracts/abi/*`
+* *Local testing*: if you're using [hardhat-deploy](https://www.npmjs.com/package/hardhat-deploy), you can reuse our scripts to deploy all Baal + infrastructure contracts locally to perform integration testing with your implementation. You just need to follow these steps:
+
+  1. Add these lines on your `hardhat.config.ts` config file to allow `hardhat-deploy` to find Baal artifacts & deployment scripts:
+  ```
+  ...
+  external: {
+    contracts: [
+      {
+        artifacts: 'node_modules/@daohaus/baal-contracts/export/artifacts',
+        deploy: 'node_modules/@daohaus/baal-contracts/export/deploy'
+      }
+    ]
+  },
+  ...
+  ```
+
+  2. On your test scripts, you can call `await deployments.fixture([tag1, tag2, ...])` (e.g. under `beforeEach()`) and specify the deployment tags you need. For example, `await deployments.fixture(['Infra', 'BaalSummoner'])` will deploy both Safe & Baal contracts.
+
+
+  3. You can also use the [`baalSetup`](test/utils/fixtures.ts) fixture to setup your tests with factory contracts, baal settings, members, loot/shares/token distributions, etc. Moreover, you can also customize it to cover new use cases such as custom summoner contracts, shamans and other setup needs by implementing the`setupBaalOverride` and/or `setupUsersOverride` fixture function parameters. You can take a look at a few example implementations of ([baalSetup](test/utils/baal.ts) and [setupUsersDefault](test/utils/fixtures.ts)) for inspiration. You can find and import all the available scripts/fixtures available for hardhat testing as follows:
+
+  ```js
+  import { baalSetup, ... } from "@daohaus/baal-contracts/hardhat";
+  ```
+
+  Below, there's the list of parameters can be customized when calling the hardhat fixture:
+
+  ```js
+    type BaalSetupOpts = {
+      fixtureTags?: Array<string>; // additional deployment tags
+      daoSettings?: Partial<DAOSettings>;
+      summonSetupOpts?: Partial<SummonSetup>;
+      safeAddress?: `0x${string}`;
+      forwarderAddress?: `0x${string}`;
+      lootAddress?: `0x${string}`;
+      sharesAddress?: `0x${string}`;
+      setupBaalOverride?: (params: NewBaalParams) => Promise<NewBaalAddresses>;
+      setupUsersOverride?: (params: SetupUsersParams) => Promise<UsersSetup>;
+  }
+  ```
+
+To learn more about using `fixtures` on hardhat visit [link1](https://github.com/wighawag/hardhat-deploy#creating-fixtures) and [link2](https://www.npmjs.com/package/hardhat-deploy#testing-deployed-contracts). It is also recommended to check out the [Baal shamans](https://github.com/HausDAO/baal-shamans) repository for examples.
 
 ----
 ## Contracts
+
 ### **Baal (contracts/Baal.sol)**
-is a minimal yet composable DAO template continuing work from
+
+It is a minimal yet composable DAO template continuing work from
 the Moloch, Minion and Compound frameworks to make it easier for
 people to combine and command crypto assets with intuitive membership
 games.
 
 #### Interfaces
-EIP721
-OZ Minimal Clone Factoy [EIP 1167 Clones](https://docs.openzeppelin.com/contracts/4.x/api/proxy#Clones)
+
+* EIP721
+* OZ Minimal Clone Factoy [EIP 1167 Clones](https://docs.openzeppelin.com/contracts/4.x/api/proxy#Clones)
 Gnosis Safe Module [Zodiac](https://github.com/gnosis/zodiac)
 
 ### **Shares (contracts/SharesERC20.sol)**
-have direct execution, voting, and exit rights around actions
+
+Have direct execution, voting, and exit rights around actions
 taken by the main DAO contract. Shareholders are the collective DAO
 admins.
 
 #### Interfaces
-ERC20,  Initializable [OpenZeplin v4](https://docs.openzeppelin.com/contracts/4.x/)
+
+* ERC20,  Initializable [OpenZeplin v4](https://docs.openzeppelin.com/contracts/4.x/)
 
 
 ### **BaalVotes (contracts/utils/BaalVotes.sol)**
-abstract with a similar Implimentation of ERC20VOTES with the main
+
+Abstract with a similar Implimentation of ERC20VOTES with the main
 difference being auto self-delegation and the use of timestmap instead of block.number.
+
 #### Interfaces
-ERC20Permit
+
+* ERC20Permit
 
 ### **Loot (contracts/LootERC20.sol)**
-has only exit rights against the DAO treasury, so loot does
+
+Has only exit rights against the DAO treasury, so loot does
 not have the ability to admin the DAO config. However, because it has
 exit rights, it is still a powerful unit, and because it is an ERC-20
 can be used in many composable ways.
 
 #### Interfaces
-ERC20, ERC20Snapshot, ERC20Permit, Initializable [OpenZeplin v4](https://docs.openzeppelin.com/contracts/4.x/)
+
+* ERC20, ERC20Snapshot, ERC20Permit, Initializable [OpenZeplin v4](https://docs.openzeppelin.com/contracts/4.x/)
 
 ### **TributeMinion (contracts/tools/TributeMinion.sol)**
-is a helper contract for making tribute proposals.
+
+It is a helper contract for making tribute proposals.
 Provides contract to approve ERC-20 transfers. Provides a simple
 function/interface to make a single proposal type.
 
 ### **BaalSummoner (contracts/BaalSummoner.sol)**
-Factory to summon new dao contracts. It has 2 main functions one to deploy
-the dao contracts and the Safe treasury and one to use an existing Safe treasury.
 
-----
+Factory to summon new dao contracts. 
+It can take an existing safe or exsiting tokens
 
-## Folder Structure
-- ./abi - generated abis
-- ./contracts - main solidity contracts, interfaces, tools and utils
-- ./scripts - deploy scripts and helpers
-- ./tasks - hard hat cli tasks
-- ./tests - test files
+### **Higher Order BaalAndVaultSummoner (contracts/higherOrderFactories/BaalAndVaultSummoner.sol)**
+
+Factory to summon new dao contracts with an extra 'sidecar' non-ragequitable vault. 
+A registry is used to save safe addresses for use in UI.
+It can also add a external safe to an existing DAO as owner
+
+### **Higher Order BaalAdvTokenSummoner (contracts/higherOrderFactories/BaalAdvTokenSummoner.sol)**
+
+Factory to summon new dao contracts with custom loot token name and symbol 
+Minting and pausing of token happen upfront before Baal is setup
 
 ----
+
 ## Privileged roles
+
 - Shamans - are specific addresses that have more granular control
 outside the standard governance proposal flow. These addresses should
 always be contracts that have been explicitly given these rights
@@ -106,6 +223,7 @@ length of proposals, if there is a required quorum, etc.).
 changes to its configuration at any time.
 
 ## Risks
+
 - In case of Shaman keys leak, an attacker can get access to Baal
 (admin) functionalities, burn, mint, give shaman roles etc.
 Because of this Shamans are ment to be external contracts and not EOAs
@@ -121,20 +239,10 @@ More docs for [Functions](https://baal-docs.vercel.app/functions) and [Events](h
 See audit notes in ./audits
 
 ## Addresses Beta Factories and Templates
-beta release of the factories. These factories may change until we get to final stable release.
-
-**Goerli**
-- lootSingleton: 0xd867ACaaDB7B8930EcA709c470B872185698F0EA
-- sharesSingleton: 0x25D6d13fD0a8071E1AA0f4b8978c706e715fDd3A
-- baalSingleton: 0xB70A2cd3f672cB06e577378578a7AcbF1b68Df56
-- Transaction Hash: 0xd0ae2a78716ded1febbf6d37ce98865a20e4233b733ee7aa41097ecd8e79cbaa
-- Factory Contract Address: **0xEd6AA9879Ed6ba07411C3224F748Dc65D3f8e685**
-- Tribute Minion: 0x9C6f6e6E461FB1dB9761c960900A0Ae05B9786A7
-
-**Gnosis Chain**
-- lootSingleton: 0x39bDc48E7b15C63FE54779E93b2ce46555A37609
-- sharesSingleton: 0x678f62F2d9dE2e196B79ca853f811E6D0A47460B
-- baalSingleton: 0xDb3e9Ded9843358fbbe758c4e73cCfEb9061d4Ed
-- Transaction Hash: 0x703acad6f005fa793e9041acc711a3d1ac4c8b632898c08598552d024687bc06
-- Factory Contract Address: **0x3Bd3fDf6db732F8548638Cd35B98d624c77FB351**
-- Tribute Minion: 0x9391b6A7c55832a6802484dE054d81496D56545A
+ Would you like to deploy to another chain? Use scripts/deployFactories and scripts/deployTribute. Please reach out for more info on deploys
+
+see current deploys at: src/addresses/deployed.js
+
+## License
+
+[MIT]()