Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Actions and Reducer production warning. #1011

Merged
merged 5 commits into from
Jul 2, 2024
Merged

Add Actions and Reducer production warning. #1011

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
24caedc
feat(actions-and-reducers.mdx): add warning against production use
ymekuria Jun 27, 2024
b4873e5
feat(actions-and-reducer.mdx): specify o1js reducer api in production…
ymekuria Jul 1, 2024
1b18d41
feat(actions-and-reducer.mdx): add reducer caveat description to warning
ymekuria Jul 2, 2024
c0ce98b
Merge branch 'main' into feature/actions-reducers-warning
ymekuria Jul 2, 2024
c7ec943
adding a space
mitschabaude Jul 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/zkapps/writing-a-zkapp/feature-overview/actions-and-reducer.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ keywords:
---

:::caution Warning
Actions and Reducers are still in development and currently are not safe to use in production applications.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd prefer if this caveat refered to the Reducer API from o1js in particular, and not to the general concept of actions and reducers.

At the protocol level, safe use of actions is very possible, if you implement a better reducer (the upcoming BatchReducer being an example).

Also, we should say why Reducer is not safe to use: Because the reduce() method breaks (completely) if more than a hard-coded number of actions are pending (default: 32).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd prefer if this caveat refered to the Reducer API from o1js in particular, and not to the general concept of actions and reducers.

Good idea. Do you think this location is still an appropriate place to add the caveat?

Also, we should say why Reducer is not safe to use: Because the reduce() method breaks (completely) if more than a hard-coded number of actions are pending (default: 32).

This was the plan. I was deciding if it made sense to either have a short description in this location with the caveat or to link to a longer description somewhere else, and where a long description would live in the docs if we went that direction.

@mitschabaude I was also working on adding similar warnings to some of the examples in the o1js repo. Maybe it makes sense to add the caveat(temporary until we completely update the reducer) to the o1js reducer doc comments.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you think this location is still an appropriate place to add the caveat?

Yes definitely, it's the right place!

This was the plan. I was deciding if it made sense to either have a short description in this location with the caveat or to link to a longer description somewhere else, and where a long description would live in the docs if we went that direction.

Gotcha, both works. A longer description could live as a new "security best practice" (subsection on the zkapp security docs) here: https://docs.minaprotocol.com/zkapps/writing-a-zkapp/introduction-to-zkapps/secure-zkapps#best-practices-for-zkapp-security


When creating updates to unknown accounts in a reducer function, care should be taken to avoid introducing security vulnerabilities.

Expand Down
Loading