Skip to content

CONTRIBUTING.md

Latest commit

 

History

History
355 lines (250 loc) · 8.09 KB

CONTRIBUTING.md

File metadata and controls

355 lines (250 loc) · 8.09 KB
Raw

🤝 Contributing to Stellar Security Scanner

Thank you for your interest in contributing to the Stellar Security Scanner! This guide will help you get started and understand our contribution process.

🎯 Mission

Our mission is to create the most comprehensive security scanning tool for Stellar smart contracts, helping developers build secure and reliable applications on the Stellar network.

🚀 Getting Started

Prerequisites

  • Rust 1.70+ installed
  • Git configured
  • GitHub account
  • Discord account (for community communication)

Step 1: Setup Development Environment

# Clone the repository
git clone https://github.com/your-org/stellar-security-scanner.git
cd stellar-security-scanner

# Install dependencies
cargo build

# Run tests to verify setup
cargo test

# Install development tools
cargo install cargo-watch cargo-tarpaulin

Step 2: Join the Community

  1. Discord: Join our Discord server
  2. Introductions: Post in #introductions channel
  3. Contributors: Join #contributors for project discussions

Step 3: Choose Your Contribution Type

📋 Contribution Types

🔒 Security Research (High Priority)

What: Discover and document new vulnerability patterns for Stellar contracts

Reward: 200-500 USDC per vulnerability pattern

Requirements:

  • Detailed vulnerability analysis
  • Proof of concept exploit
  • Test cases demonstrating the issue
  • Recommended mitigation strategies

Example Issues:

  • feat: Add detection for flash loan attacks
  • feat: Implement oracle manipulation pattern detection
  • feat: Add cross-contract reentrancy detection

Process:

  1. Research Stellar contract vulnerabilities
  2. Create detailed issue with findings
  3. Develop detection pattern
  4. Write comprehensive tests
  5. Submit pull request with documentation

🧪 Development Tasks (Medium Priority)

What: Implement new features and improvements

Reward: 100-300 USDC per feature

Requirements:

  • Working implementation
  • Comprehensive test suite
  • Documentation updates
  • Performance benchmarks (if applicable)

Example Issues:

  • feat: Add JSON output format support
  • feat: Implement parallel scanning for large projects
  • feat: Add VS Code extension integration
  • feat: Create web-based reporting dashboard

Process:

  1. Claim an issue from the project board
  2. Create feature branch
  3. Implement solution
  4. Add tests and documentation
  5. Submit pull request

📚 Documentation (Low Priority)

What: Improve project documentation and examples

Reward: 50-150 USDC per contribution

Requirements:

  • Clear, accurate content
  • Code examples
  • Screenshots/diagrams (if applicable)
  • User testing feedback

Example Issues:

  • docs: Add tutorial for custom vulnerability patterns
  • docs: Create integration guide for CI/CD pipelines
  • docs: Write best practices guide
  • docs: Add video tutorials

Process:

  1. Identify documentation gaps
  2. Create content outline
  3. Write comprehensive documentation
  4. Get community feedback
  5. Submit improvements

🐛 Bug Fixes (Variable Priority)

What: Fix reported bugs and issues

Reward: 50-400 USDC per fix

Based on: Severity, impact, and complexity

Requirements:

  • Bug reproduction steps
  • Root cause analysis
  • Fix implementation
  • Regression tests

Example Issues:

  • fix: Handle edge case in integer overflow detection
  • fix: Resolve memory leak in large file scanning
  • fix: Correct false positive in access control detection

🔄 Development Workflow

1. Claim an Issue

# Check available issues
gh issue list --label "help wanted"

# Comment on issue to claim it
# "I'd like to work on this issue. I have experience with..."

2. Create Branch

# Create feature branch
git checkout -b feat/your-feature-name

# Or for bug fixes
git checkout -b fix/issue-number-description

3. Development

# Watch for changes and run tests
cargo watch -x test

# Check code coverage
cargo tarpaulin --out Html

# Format code
cargo fmt

# Run lints
cargo clippy -- -D warnings

4. Testing

# Run all tests
cargo test

# Run specific test module
cargo test vulnerabilities

# Run integration tests
cargo test --test integration_tests

# Check performance
cargo bench

5. Submit Pull Request

# Push changes
git push origin feat/your-feature-name

# Create pull request
gh pr create --title "Brief description" --body "Detailed description"

📝 Pull Request Guidelines

PR Template

## Description
Brief description of changes

## Type of Change
- [ ] Bug fix
- [ ] New feature
- [ ] Documentation update
- [ ] Security improvement
- [ ] Performance optimization

## Testing
- [ ] All tests pass
- [ ] New tests added
- [ ] Manual testing completed

## Checklist
- [ ] Code follows style guidelines
- [ ] Self-review completed
- [ ] Documentation updated
- [ ] Performance impact considered

## Funding Request
- Amount: XXX USDC
- Hours spent: XX hours
- Complexity: Low/Medium/High

Code Quality Standards

  • Test Coverage: Minimum 90%
  • Documentation: All public functions documented
  • Performance: No significant performance regressions
  • Security: Follow security best practices

💰 Funding Process

Step 1: Submit Proposal

  1. Create detailed issue description
  2. Estimate time and complexity
  3. Specify funding amount
  4. Wait for maintainer approval

Step 2: Get Approved

  • Maintainers review proposal
  • Community feedback considered
  • Funding amount confirmed
  • Issue assigned to contributor

Step 3: Development

  • Receive 50% upfront payment
  • Start development work
  • Provide regular updates
  • Meet agreed timeline

Step 4: Completion

  • Submit pull request
  • Code review and approval
  • Documentation updated
  • Tests passing

Step 5: Final Payment

  • PR merged to main branch
  • Remaining 50% payment released
  • Contributor badge awarded
  • Impact metrics recorded

🏅 Recognition System

Contributor Badges

  • 🥉 Bronze: 0-500 USDC contributed
  • 🥈 Silver: 500-2,000 USDC contributed
  • 🥇 Gold: 2,000-5,000 USDC contributed
  • 💎 Platinum: 5,000+ USDC contributed

Monthly Recognition

  • Top Contributor: Highest impact contribution
  • Security Champion: Best security research
  • Innovation Award: Most creative solution
  • Community Hero: Helpful and supportive

Annual Awards

  • Contributor of the Year: Overall excellence
  • Security Researcher: Outstanding vulnerability research
  • Community Builder: Fostering community growth

📞 Getting Help

Resources

Community Support

  • Discord: #help channel for technical questions
  • GitHub Discussions: Feature discussions and ideas
  • Issues: Bug reports and feature requests

Maintainer Contact

  • Technical Issues: Create GitHub issue
  • Funding Questions: Drips Network platform
  • Community Matters: Discord #moderators

🎯 Success Metrics

Quality Metrics

  • Code coverage > 90%
  • Zero critical security issues
  • Performance benchmarks met
  • User satisfaction > 4.5/5

Community Metrics

  • Active contributors per month
  • Issues resolved per month
  • Documentation completeness
  • Community engagement rate

Impact Metrics

  • Vulnerabilities prevented
  • Contracts secured
  • Developer adoption
  • Security awareness raised

🚀 Next Steps

  1. Join our Discord and introduce yourself
  2. Browse available issues on GitHub
  3. Start with a good first issue to get familiar
  4. Apply for funding through Drips Network
  5. Make your mark on Stellar security!

Thank you for contributing to Stellar security! 🌟

Your work helps make the entire Stellar ecosystem safer and more reliable for everyone.