Skip to content

Hats Protocol v1

Pre-release
Pre-release
Compare
Choose a tag to compare
@spengrah spengrah released this 20 Mar 21:56
· 7 commits to main since this release
v1-beta.2
b4cdfbd
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.

This is a pre-release for Hats Protocol.

Hats Protocol v1 is a fully permissionless and immutable contract, with no upgradeability, adjustable parameters, or owner of any kind.

What's New

This version fixes a number of bugs and vulnerabilities surfaced in two audits: a private audit by Trust Security, and a Sherlock auditing contest.

New Features

  • Linked top hats can now have Eligibility and Toggle modules — #113

Bug Fixes, Vulnerability Patches, and Smaller Changes

  • Fix bug where hats created before their admin (ie skip-level hats) could be overwritten if/when their admin is later created — #109
  • Prevent hats from being created with null levels, eg with hatId 0x00000001.0000.0002... — #108
  • Prevent unlinked top hats from being "stolen" by admins in their previous parent tree — #113
  • Prevent middle admins from "stealing" linked top hats via a relinking attack — #113
  • Hat minting and transferring is now restricted to active hats and eligible recipients who do not already wear (or even have a static balance* of) the hat — #96 (also applies to the following 5 items) and #107
  • Wearers with a static balance of a given hat can now renounce it via renounceHat()
  • Fix an issue with imageURI fallback logic
  • Eligibility and Toggle modules must not be set to the zero address (with an exception is for top hats)
  • More robust validation of data returned from IHatsEligibility.getWearerStatus() and IHatsToggle.getHatStatus()
  • isAdminOfHat() is now more gas efficient
  • balanceOfBatch() is now supported for hats #118
  • buildHatId() now correctly prevents callers from building hats after level 14 — #106
  • Current hat status is now stored prior to changing a Toggle module — #116
  • details and imageURI strings are now capped at 7000 characters to prevent a minor DOS vector — #114

*Note: "static balance" refers to the scenario where balanceOf() for a given wearer returns 0 but the hat token has not yet been fully burned.

Deployments

Network Address
Goerli (testnet) 0x850f3384829D7bab6224D141AFeD9A559d745E3D
Sepolia (testnet) 0x850f3384829D7bab6224D141AFeD9A559d745E3D
Ethereum (mainnet) 0x850f3384829D7bab6224D141AFeD9A559d745E3D
Polygon 0x850f3384829D7bab6224D141AFeD9A559d745E3D
Gnosis Chain 0x850f3384829D7bab6224D141AFeD9A559d745E3D
Arbitrum 0x850f3384829D7bab6224D141AFeD9A559d745E3D
Optimism 0x850f3384829D7bab6224D141AFeD9A559d745E3D

All deployments are made to the same address using a CREATE2 factory, with the following parameters (also viewable in the DeployHats script):

  • salt: 0x0000000000000000000000000000000000000000000000000000000000004a75
  • name: "Hats Protocol v1"
  • baseImageURI: "ipfs://bafybeigcimbqwfajsnhoq7fqnbdllz7kye7cpdy3adj2sob3wku2llu5bi"

Along with the deployments, top hat 0x0000001 was minted on each network to hatsprotocol.eth. This top hat has no authorities connected to the protocol.

Assets 2
Loading