ZeppelinOS and OpenZeppelin compatible versions

Hi, I was trying to use ZeppelinOS v. 2.2.0 with the open zeppelin-solidity v.2.1.2 and I got compiling error because contract UpgradeabilityProxy.sol imports AddressUtils.sol which in the newest version of OpenZeppelin was moved to contracts/util/Address.sol
Error: Could not find openzeppelin-solidity/contracts/AddressUtils.sol from any sources; imported from zos-lib/contracts/upgradeability/UpgradeabilityProxy.sol

Does it mean that at the moment I should downgrade openzeppelin-solidity to make those two working correctly together?

Hey Paulina!

Hmm, I’m not entirely sure about this. I’ll tag @spalladino so he can provide some insight.

Hey @paulinablaszk! It’s a good question: even if we pinned the version of OpenZeppelin we’re using at zOS at 1.x, truffle compile doesn’t play nice with multiple versions of the same framework installed, and will pick up the one you are using directly on your project.

@nventuro @frangio what are your thoughts about this? The easiest option is to just upgrade to OZ 2.x and release a new version of zOS that depends on it, breaking compatibility for all users who were relying on an older OZ. Another option, given that we are just using Ownable and AddressUtils, would be to just copy those contracts into zOS and be done with it - I know that this is not the suggested option, but it is the most flexible in terms of compatibility given the current state of the tooling.

@paulinablaszk one question for you: why are you importing the Proxy contract in your own contracts? You should not need to do so in order to use zOS. Mind sharing your use case? Thanks!


Hi @spalladino, I do not import the Proxy directly, I just use App contract (which imports Proxy). It works only if I downgrade openzeppelin-solidity to 1.12.0 (with ver. 2.X.X contracts do not compile during above error). It is just a simple token factory, you can find it here:

A workaround for now, if you are working with upgradeable contracts in your project, would be to import not openzeppelin-solidity but openzeppelin-eth, which is the fork of openzeppelin that has upgradeable contracts (ie uses initializers instead of constructors). This way, since both are actually different packages, you can have different versions of the two (the latest for -eth that you use in your code, the legacy one for -solidity used within the zOS contracts) and the compiler won’t mix them up.

Meanwhile, I’d like to hear @nventuro’s thoughts about the options listed above!

That may work, but I'd recommend against doing this, since it can get tricky real fast: for example, I believe truffle doesn't support having multiple contracts with the same name (since there is only one directory for the built artifacts).

@spalladino I am not sure if I do everything in the right way, but I get this error when (step by step):

  1. I init my zos project
  2. I install zos-lib because I want to use App.sol (it installs openzeppelin-solidity in version 2.1.2 as a dependency) and I import App it in MyContract
  3. I try to run add MyContract but it doesn’t compile and I get those error above

I do not directly use ‘openzeppelin-solidity’ but I am importing App which imports UpgradeabilityProxy, which (as I understand) try to import AddressUtil that doesnt exist in this location in 2.1.2openzeppellin-solidity. So I have to downgradeopenzeppelin-solidity` (to v. 1.12.0) to make contract compile

@paulinablaszk I’ve just created this PR to remove the openzeppelin-solidity dependency from zos-lib to prevent this issue. In the meantime, as a workaround, I’d suggest creating an App interface within your code, and interact with it, to avoid importing App.sol until this PR is released:

interface IApp {
  function create(string packageName, string contractName, address admin, bytes data) payable public returns (address);

@spalladino Thank you very much!

1 Like

@paulinablaszk zos and zos-lib 2.2.1 are out, which remove the dependency on openzeppelin - you should now be able to use a newer version. Just keep in mind that zos-lib contracts still are on Solidity 0.4, which means you’ll need to use openzeppelin 2.0 (not 2.1) to keep everything on Solidity 0.4.