Using SafeCast for all downcasting

[bh2smith]

Closes #212 - by using specific commit hash of OpenZeppelin dependency and using its new SafeCast security tool!

TestPlan: checkout this branch, run npm install followed by truffle test (with an instance of ganache–cli running).

[josojo]

I would prefer a concrete commit, instead of a changing reference such as master

[bh2smith]

If you check one commit behind, you'll see that neither of these options are working.

[fleupold]

We don't seem to be running npm install on travis for some weird reason. I think that's why it is failing.

Also, is SafeCast included in a branch or tagged version (e.g. v2.5rc or such). Then we could make it explicit that we are waiting on a specific version.

[bh2smith]

We don't seem to be running npm install on travis for some weird reason.

I thought this might be the case, but second guessed myself, cuz I thought "How could anything be working if we don't run npm install?"

Is SafeCast included in a branch or tagged version

I'll check it out.

[bh2smith]

Unfortunately, at this time, there are no branch tags on OZ since their most recent release (which did not yet include these changes)

https://github.com/OpenZeppelin/openzeppelin-contracts/tags

[bh2smith]

@nlordell - I like the idea of using the shorter hash. Do we know if this works?

[nlordell]

@bh2smith absolutely none, I just imagine it would as it probably uses git under the hood to resolve refs

[bh2smith]

How does one know the exact number of characters that constitute a legit "short-hash"?

[bh2smith]

This works, thanks @nlordell -

"OpenZeppelin/openzeppelin-contracts#2c11ed59"

[nlordell]

Also, there is no need for npm install in the travis file as the install script section was not overloaded. Note that travis calls npm ci instead of npm install which is usually better but uses your project-lock.json file - which explains why SafeCast.sol was missing. What surprises me is that npm ci should fail if package-lock.json and package.json don't match but didn't in this case.

[fleupold]

[josojo]

A Beauty!