v5.0.0 - RC 0

🚀 Features

• Disputable: Implement disputable base app (#581, #595, #604, #605, #607, #610) @facuspagnuolo @bingen @sohkai
• Forwarder: Extend interfaces (#583) @sohkai @facuspagnuolo
• Apps: Add IAragonApp interface (#597) @sohkai @bingen

🕵️ Security

• Internal Audit: aragonOS 5 (#612) @sohkai

🧹 Housekeeping

• Chore: Use buidler (#615 and #616) @facuspagnuolo
• Chore: Fix coverage task (#614) @facuspagnuolo
• Chore: Move CI to GH actions (#609) @facuspagnuolo
• Tests: Use test helpers (#608 and #611) @bingen @facuspagnuolo
• Chore: Clean up exports and dependencies (#601) @facuspagnuolo
• APM: Remove from repo (#600) @facuspagnuolo

📖 Documentation

• Docs: Update READMEs (#613) @sohkai
• Docs: Update branding, add security policy (#596) @sohkai
• Chore: Update Aragon chat links (#576) @macor161

v5.0.0-beta.6

• Disputable: Add submitter fees to Agreement challenges (#604) @bingen

v5.0.0-beta.5

• Apps: Add IAragonApp interface (#597) @bingen

v5.0.0-beta.1

• Disputable App: Add missing pieces for transaction fees module (#586) @bingen

v5.0.0-beta.0

• Disputable: Implement disputable base app (#581) @facuspagnuolo
• ACL: Fix inline doc and functions indentation (#579) @facuspagnuolo
• chore: update Aragon chat links (#576) @macor161

Backported ACL hotfix from v4.4.0 to reduce contract changes between the old and hotfixed ACLs deployed on mainnet.

See notes in v4.4.0.

Special thanks to @haythem96 for helping make this release possible 🎉

This is a patch release to include a new forwarding interface, IForwarderFee.

IForwarderFee: allowing forwarders to declare they require fees

IForwarderFee is an optional interface that can be implemented by Forwarders (IForwarder) to declare that their forwarding action requires a fee be paid.

This is used by frontends to assess whether a forwarding path has additional requirements to succeed:

• A "pretransaction" to approve tokens for the first forwarder requiring fees
• An ETH transfer to the first forwarder

Changes:

• Interfaces:
  • Add IForwarderFee (#536) @sohkai
• Testing improvements:
  • Tests: Refactors and enhancements (#525) @facuspagnuolo
  • Tests: Add DAO factory unit tests (#524) @facuspagnuolo
  • Helpers: Fix assert revert helper (#522) @facuspagnuolo
  • cosmetic: re-organize some library tests (#519) @sohkai
  • Organize mocks and test files (#517) @facuspagnuolo
  • Testing improvements (#513) @sohkai
• Project maintenance:
  • Add development network to truffle config (#529) @haythem96
  • Added probot bots (#530) @luisivan

Special thanks to @gregzaitsev for helping make this release possible 🎉

ReentrancyGuard: making sure your function can't re-enter

This release includes a generic ReentrancyGuard that comes available with AragonApp. You can safely upgrade to using it, because it utilizes unstructured storage under the hood.

Using the new reentrancy guard is as simple as:

contract App is AragonApp {
    function appLogic() external nonReentrant {
    }
}

ConversionHelpers: know when you live dangerously

ConversionHelpers has been exposed as a generic utility for some of the more dangerous casts you may perform. Most of the time you don't want these, or they're already handled internally by aragonOS, but maybe you just want to live on the edge.

It currently exposes two conversions: uint256[] memory to bytes memory and back. These modify the memory in-place, so you should never re-use the old variable once you've done the cast. They're named dangerously (dangerouslyCastUintArrayToBytes() and dangerouslyCastBytesToUintArray()), to help you spot these!

Changes:

• Stronger sanity checking for arguments of type bytes, and ensuring all returned bytes are in allocated memory (d92e53f, 446653d, b6823b5, 009e0f5)
• Modify radspec strings (9cce83c, 2bfd50a, thanks @gregzaitsev!)
• A few other testing related or clean up chores

🎊 Special thanks to @ianbrt and @gregzaitsev for helping make this release possible 🎉

SafeERC20: helping you work with tokens, even when Solidity doesn't want to

Interacting with token contracts can be a tricky process when you can't trust their implementation. A number of buggy tokens have been identified on the Ethereum mainnet, with especially high-profile ones deployed having the "no return" bug.

SafeERC20 smooths out interactions with these buggy or otherwise potentially malicious tokens.

A set of "safe" functions, safeTransfer(), safeTransferFrom(), safeApprove(), are available that handle the "no return" bug and enforce boolean returns (such that no reverts are ever thrown).

A further set of staticcall utilities, staticBalanceOf() and staticAllowance(), are available to enforce the view guarantees of these interfaces on Solidity pragmas pre-0.5.

Using SafeERC20 is as simple as:

contract TokenInteraction {
    using SafeERC20 for ERC20;

    function transferTo(ERC20 _token, address _to, uint256 _amount) external {
        require(_token.safeTransfer(_to, _amount));
    }
}

Changes:

• KernelProxy: emit SetApp event on construction (8982e33a281f5af39ff7bfd5f40080b67bdec734): Allows frontends to verify the chain of Kernel upgrades from their creation
• feat: Add SafeERC20 (e94109f76f993b456806394a4b1f78cc1bfe16bd)
• VaultRecoverable: emit event on successful recovery (ac4e4a3f5b31d46fb9f468e383233aea74d1d332): Makes it easier for frontends to detect when the token recovery functionality was used
• Modify radspec strings (47cc48a49b14232a5d61a0aacf42c49ba4e1ef4d, 3ad9a79c00ab498b26aa13e1b205b57d782abb0b, thanks @gregzaitsev!)
• Create CONTRIBUTING.md (8e2ab291cd9f179fe35d5aeb1c2bc7647a702000, thanks @ianbrt!)
• A few other testing related or clean up chores

🦅 aragonOS 4.0.0 has been released into the wild!

aragonOS 4.0.0 has completed audits from two independent security firms and is now being used by hundreds of Aragon organizations on the Ethereum mainnet.

See the release blog post and migration guide for all the new features and concepts.

🚨aragonOS 4.0 introduces several breaking changes in storage from aragonOS 3.0, so deployed contracts cannot be safely upgraded.

Inject web3 to deploy scripts so they can be used from outside.

The first release candidate of aragonOS 4.0!

Several changes have been made since beta.2, related to findings from audits, deployments, and improvements from general use.

We do not anticipate any further changes to the contracts.

🚨aragonOS 4.0 introduces several breaking changes in storage from aragonOS 3.0, so deployed contracts cannot be safely upgraded.

Second beta release of aragonOS 4.0.

This is a candidate for audits.

🚨aragonOS 4.0 introduces several breaking changes in storage from aragonOS 3.0, so deployed contracts cannot be safely upgraded.

First beta release of aragonOS 4.0.

This is a candidate for audits (see beta.2 instead)

🚨aragonOS 4.0 introduces several breaking changes in storage from aragonOS 3.0, so deployed contracts cannot be safely upgraded.

Second alpha release of aragonOS 4.0.

🚨aragonOS 4.0 introduces several breaking changes in storage from aragonOS 3.0, so deployed contracts cannot be safely upgraded.

Initial alpha release of aragonOS 4.0.

🚨aragonOS 4.0 introduces several breaking changes in storage from aragonOS 3.0, so deployed contracts cannot be safely upgraded.

🚨 This is the last feature release of aragonOS 3. Future features will continue in aragonOS 4. 🎉

Improvements:

• Update SafeMath to their most recent, gas-optimized versions from OpenZeppelin (https://github.com/aragon/aragonOS/pull/353)
• ACL: add an extra event log when permissions are set with parameters (https://github.com/aragon/aragonOS/pull/362)
• Add a TimeHelpers contract to simplify time operations and conversions (https://github.com/aragon/aragonOS/pull/375)
• EVMScriptRegistry: emit events when adding and removing executors (https://github.com/aragon/aragonOS/pull/390)
• EVMScriptExecutor: require that all Script Executors declare their type to allow for off-chain checking (https://github.com/aragon/aragonOS/pull/391)

Failed publish to NPM, use v3.1.12 instead.

This release includes the relicensing of aragonOS' interfaces and extendible contracts to MIT. This means that, from this release on, most users of aragonOS should be free to choose their own license, rather than being locked to a GPL.

Also, a number of safety improvements, as suggested by our auditors:

• Remove delegate executors
• Add SafeMath lib for uint8
• Explicitly state state visibility
• Remove kernelIntegrity modifier
• Make fallbacks external
• EVMScriptRunner: add ScriptResult log
• Add more static contract types to state and function parameters

Finally, we've tweaked some truffle and CI configuration files.

Numerous changes based on the WHG's audit findings.

Breaking change: Proxies now conform to the ERC897 standard.