Giter Club home page Giter Club logo

fats's Introduction

Fair and Transparent Salaries (FaTS)

FaTS is an open-source repository for a smart contract development in the KTH course DD2485. The protocol utilizes blockchain technology to make salary information more visible (transparent). The protocol are written in Solidity and contains two contracts: CompanyFactory.sol and Company.sol

Motivation and Background

The motivation behind this development is to allow employees to gain more information about the salaries of their peers in the company they are employed at, specific salary details of connected companies, and the average salary of employees within specific sectors. There are existing initiatives for making salary information more public, transparent and available (e.g., glassdoor https://www.glassdoor.com/) but the goal here is to motivate companies (employers) to deploy FaTS as a way to be transparent about their salaries. Specific employee information is anonymized besides their employment title and their salary. To increase trust, each employee can verify that their reported salary is correct. By putting this on the blockchain, nothing will be hidden, meaning that changes within an organization (layoffs or salary changes) will be visible for everyone. The protocol aims to give employees more information when negotiating their compensation and to create more trust for specific organizations by holding them more accountable.

CompanyFactory.sol

Features

  • Users can register a new company within a specified sector.
  • The contract ensures unique company registration per cryptographic identity (e.g. digital wallet address).
  • Companies can be removed by their administrators.

Sector Management

  • Sectors are defined as string identifiers.
  • Users can add and remove sectors dynamically.

Event Logging

  • Events are emitted to log significant contract activities, such as adding companies and modifying sectors.

Query Functions

  • Retrieve details about a specific company, including its sector, total employees, and average salary.
  • Obtain the average salary within a specific sector.
  • Get the addresses of companies within a given sector.

Usage (CompanyFactory.sol)

Deployment

  • Deploy the CompanyFactory smart contract to the Sepolia blockchain.

Granting and Revoking registration rights (onlyOwner)

Granting: Call the grantRegistryRight function to grant a company within a specific sector registration right. Revoking: Call the revokeRegistryRight function with the company key as parameter input to remove that company's registration right.

Registering or Removing company (requires company specific key) Registering: Call the registerCompany function with your company key as input to register the company's name within the specified sector. Removing: Call the removeCompany function with your company key as input to remove the company's details.

Query Functions

  • Retrieve company details using getCompanyDetails.
  • Calculate the average salary in a sector with getAverageSalaryInSector.
  • Obtain addresses of companies within a sector using getCompanyAddressesInSector.

Sector Management

  • Dynamically add sectors with the addSector function.
  • Remove sectors with the removeSector function.

Events

  • CompanyAdded: Logged when a new company is successfully registered.
  • SectorAdded: Logged when a new sector is added.
  • SectorRemoved: Logged when a sector is removed.

Company.sol

Features

Employee Management

  • Employers can add new employees to the company, specifying their title and salary.
  • Registered employees can be removed from the company by the employer.
  • Employers can update the title and salary of existing employees.

Employee Verification

  • Employees can verify their own salary, providing transparency and accountability.

Average Salary Calculation

  • The contract provides a function to calculate the average salary of all employees within the company.

Events

  • Events are emitted for significant activities, such as adding, removing, updating employees, and verifying salaries.

Access Control

  • The contract includes access control to ensure that only the employer/administrator can perform certain operations.

Usage (Company.sol)

Deployment

  • Deploy the EmployeeManagement smart contract after deploying the CompanyFactory contract.
  • CompanyFactory.sol will give a specific address for the created company's contract.

Employee Management

  • Use the addEmployee function to register a new employee, providing their address, title, and salary.
  • Remove existing employees with the removeEmployee function.
  • Update employee details with the updateEmployee function.

Verification

  • Employees can verify their own salary using the verifySalary function.

Average Salary

  • Retrieve the average salary of all employees in the company using the getAverageSalary function.

Events

  • EmployeeAdded: Logged when a new employee is successfully added.
  • EmployeeRemoved: Logged when an employee is removed from the company.
  • EmployeeUpdated: Logged when an employee's details are updated.
  • SalaryVerified: Logged when an employee verifies their salary.

Access Control

  • The onlyEmployer modifier ensures that only the employer/administrator can execute certain functions.

Unit Test

The protocol can be automatically executed from the test suite and is done through Hardhat. The prerequisites include having Node.js installed on the machine, which can be downloaded on https://nodejs.org.

Installing Hardhat

  1. Open a terminal/command prompt.
  2. Navigate to the project directory:
cd path/to/this/project
  1. Initialize a new Node.js project:
npm init -y
  1. Install Hardhat:
npm install --save-dev hardhat
  1. Run the tests:
npx hardhat test
  1. Coverage testing:
npx hardhat coverage

Related work

Similar initiatives to make salaries more transparent exist but mostly exist off-chain. Most on-chain efforts in this field focus on payroll management, for instance Bitwage (https://www.bitwage.com/) that allows employees and freelancers to choose if they would like to be paid in a cryptocurrency etc. Future work on this project could include contracts to be formed between the employer and the employee where currency options would be available and automated through smart contracts. OpenPayrolls (https://openpayrolls.com/) and GlassDoor (https://www.glassdoor.com/) are off-chain initiatives to make salaries more transparent.

fats's People

Contributors

vivi365 avatar christofervikstroem avatar

Stargazers

Bastian Fredriksson avatar

Watchers

 avatar

fats's Issues

Presentation

  • The presentation focuses on the technical aspects of the protocol
  • The structure of the presentation is announced and graphically visible
  • The presentation contains valuable and readable code snippets
  • The presentation contains a reflective part
  • There is one good slide positioning the presentation in the state of the art
  • The last slide contains a good and concise take-home message
  • The speakers engage with the audience
  • The speakers are fun, have humour or the protocol contains an Easter egg
  • The slides do not have too much text

Project Specification ๐Ÿฉป

Project Overview

Problem Space

The goal is to increase salary transparency between employees and the employer. If all financial details regarding salaries are disclosed by the employer monthly, the employees have the opportunity to address details that they deem unfair. Ensuring a fair and transparent salary system can be critical for the longevity of a company as employees can feel correctly compensated. The benefits for the employer are, hopefully, trust from the employees, which can increase loyalty to the company, which is key in a competitive industry. Companies telling their employees to not disclose their salary is not unheard of, which is what motivated this idea as the employees will not only be able to validate that their salary is correct and gain data regarding the salaries of the other employees for future salary interviews.

Flow Graphs ๐ŸŒŠ

Scenario: Monthly/bi-monthly/recurring submission of employee salaries.
Who: Employer

Key questions:

  • Format to submit
  • Anonymous submissions linked to employees

step 1 -> ..

Lab Feedback

Employee struct:
Implement more information (gender and other potentially relevant information)

Less gas:
Don't write; RegistryRight storage r = registryRights[companyKey];
Instead, use registryRights[companyKey] on each r-invokation.
Implement this for all cases where this is relevant.

Protocol Design

New Protocol Design

After consulting with Mojtaba, we have decided to change the design of the protocol. To enhance privacy without involving zk solutions (which Mojtaba through would be a whole another project), we will move the view from one company and individual "comparison" of salaries within the company, to a more sector-wide view. In this model, a company submits its data, and an assumption is that this data is already "verified".

We will use two contracts for this:

Company contract

  • The contract owner is the person who created it using company factory contract.

  • Modifies the company's list of employees, including their digital wallet, title and salary (add, remove, contains)

  • Allows employees to verify the authenticity of their stated salary

  • Functionality of the company contract:

  1. Add, remove and update employee data
  2. Verify the salary
  3. A lookup function:
    a. Query digital wallet
    b. Returns Title, Salary and if salary is verified by employee.

Company factory contract

  • Built on Company Contract
  • Creates a company contract, tied to the wallet of the person who invokes it
  • Can be used to query other contracts to get details about salaries
  • Requirements for creating a company contract:
  1. Digital Wallet to connect the company to
  2. Writing what sector the company operates in
  • Functionality of the company factory contract:
  1. Company Contract creation
  2. Storing companies based on sector
  3. Allowing queries for look-ups
    a. Specific companies in a sector
    b. Bigger picture queries (average salary of the sector)
  4. See total number of verified salaries for specific companies and the entire sector.

Thursday Agenda

  • Changes to contracts
    • Company
      • Average salary functionality
      • How to interact with it
      • Read in several employee data at once
    • CompanyFactory
      • remove/update stuff
  • Finish chai tests
    • Company
    • CompanyFactory
  • Implement access control using Openzeppelin
  • Bonus: some front end

Brainstorm and Questions ๐Ÿงช ๐Ÿงซ

Reporting salaries

We want to display salaries, and when a salary is updated or added it should be reflected in the state of the contract.

Q: How should the salaries be added? How do we know this is correct?
In the real world, a salary is set when you sign a contract between the employer and the employee. Perhaps we should adopt this approach on the blockchain as well, with contracts for an employment being signed on-chain.

GUI ๐Ÿผ

From #1

  • Bonus: the protocol contains user interface application

Record of static analysis

Static Analysis

2023-12-14 using slither.
pip3 install slither-analyzer
slither .

  • Contract locking ether found:
    Contract Company (contracts/Company.sol#12-154) has payable functions:
    - Company.constructor(address,string,string) (contracts/Company.sol#50-58)
    But does not have a function to withdraw the ether

  • Contract locking ether found:ยด
    Contract CompanyFactory (contracts/CompanyFactory.sol#7-185) has payable functions:
    - CompanyFactory.constructor() (contracts/CompanyFactory.sol#41-43)
    But does not have a function to withdraw the ether

  • Company.constructor(address,string,string)._companyKey (contracts/Company.sol#51) lacks a zero-check on :
    - companyKey = _companyKey (contracts/Company.sol#55)
    Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#missing-zero-address-validation

  • CompanyFactory.getAverageSalaryInSector(string) (contracts/CompanyFactory.sol#165-184) has external calls inside a loop: totalSalaries += company.getAverageSalary() * company.totalEmployees() (contracts/CompanyFactory.sol#173-175)

  • CompanyFactory.getAverageSalaryInSector(string) (contracts/CompanyFactory.sol#165-184) has external calls inside a loop: totalEmployees += company.totalEmployees() (contracts/CompanyFactory.sol#176)
    Reference: https://github.com/crytic/slither/wiki/Detector-Documentation/#calls-inside-a-loop

  • Pragma version>=0.5.0<0.9.0 (contracts/Company.sol#2) is too complex

  • Pragma version>=0.5.0<0.9.0 (contracts/CompanyFactory.sol#2) is too complex
    solc-0.8.19 is not recommended for deployment
    Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-versions-of-solidity

  • Parameter Company.addEmployee(address,string,uint256)._title (contracts/Company.sol#64) is not in mixedCase

  • Parameter Company.addEmployee(address,string,uint256)._salary (contracts/Company.sol#65) is not in mixedCase

  • Parameter CompanyFactory.grantRegistryRight(address,string,string)._companyName (contracts/CompanyFactory.sol#49) is not in mixedCase

  • Parameter CompanyFactory.grantRegistryRight(address,string,string)._sector (contracts/CompanyFactory.sol#50) is not in mixedCase
    Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#conformance-to-solidity-naming-conventions

  • Company.companyKey (contracts/Company.sol#14) should be immutable

  • CompanyFactory.owner (contracts/CompanyFactory.sol#9) should be immutable
    Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#state-variables-that-could-be-declared-immutable

INFO:Slither:. analyzed (2 contracts with 93 detectors), 14 result(s) found

Automatic testing โ˜•

Testing using chai.

From #1

  • The protocol can be automatically executed from a test suite
  • 100% test coverage

Tasks (misc)

// ethers.js example
abi = [
  "function decimals() view returns (string)",
  "function symbol() view returns (string)",
  "function balanceOf(address addr) view returns (uint)"
]

// Create a contract
contract = new Contract("dai.tokens.ethers.eth", abi, provider)

Documentation ๐Ÿธ

From #1

  • The usage of the protocol is well documented
  • The README gives enough background
  • The protocol is clearly motivated
  • The README discusses closely related work

General Solution Idea(s)

  1. A contract is agreed on off-chain, retrieved from an API on-chain, and signed there. This verifies the salary. Salary can after that be displayed. Issue: Anonimity
  2. Just report a salary and verify. Issue: Adds another step to signing a contract, seems unnecessary if contract can be signed on chain per default.
  3. The Employer proposes some salary for some employee, on chain. Employee accepts this on chain. Retrieve info of employee based on public key via API. Issue: what does the employee really sign if they are not signing the contract itself. Alternative: whole contract goes in a transaction, issue: too much data -> ipfs.

Grading Criterion ๐Ÿ†

Mandatory

  • The protocol is hosted on GitHub, publicly available.
  • The GitHub repository must have a root README file.
  • The protocol can be automatically executed from a test suite
  • The usage of the protocol is well documented
  • The length of the presentation is 15 minutes (hard limit)

Optional

Need 9 checked to pass.

Protocol and Documentation

  • The protocol is clearly motivated
  • The README gives enough background
  • The protocol is original & the README discusses closely related work

Presentation

  • The presentation focuses on the technical aspects of the protocol
  • The structure of the presentation is announced and graphically visible
  • The presentation contains valuable and readable code snippets
  • The presentation contains a reflective part
  • There is one good slide positioning the presentation in the state of the art
  • The last slide contains a good and concise take-home message
  • The speakers engage with the audience
  • The speakers are fun, have humour or the protocol contains an Easter egg
  • The slides do not have too much text

Bonus

  • Bonus: Verification beyond testing (mutation testing with Gambit, formal verification)
  • Bonus: The protocol has 100% statement coverage <-- statement coverage via hardhat
  • Bonus: Fuzzing/symbolic execution: the protocol has a harness for fuzzing or symbolic execution <-- Echidna
  • Bonus: Protocol is deployed on mainnet and IPFS
  • Bonus the protocol contains user interface application <-- with react/or template stuff

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.