Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/energicryptocurrency/energi3
Official golang implementation of the Energi Core based on Ethereum protocol.
make all
A consistent build environment can be provided with Docker. Release builds are produced through this process.
docker build -t energi3 .
The Energi Core project comes with several wrappers/executables found in the cmd
directory.
Command | Description |
---|---|
energi3 | Our main Energi CLI client. It is the entry point into the Energi network (main-, test- or private net), capable of running as a full node (default), archive node (retaining all historical state) or a light node (retrieving data live). It can be used by other processes as a gateway into the Energi network via JSON RPC endpoints exposed on top of HTTP, WebSocket and/or IPC transports. energi3 --help and the CLI Wiki page for command line options. |
abigen | Source code generator to convert Energi contract definitions into easy to use, compile-time type-safe Go packages. It operates on plain Ethereum contract ABIs with expanded functionality if the contract bytecode is also available. However it also accepts Solidity source files, making development much more streamlined. Please see our Native DApps wiki page for details. |
bootnode | Stripped down version of our Energi client implementation that only takes part in the network node discovery protocol, but does not run any of the higher level application protocols. It can be used as a lightweight bootstrap node to aid in finding peers in private networks. |
evm | Developer utility version of the EVM (Ethereum Virtual Machine) that is capable of running bytecode snippets within a configurable environment and execution mode. Its purpose is to allow isolated, fine-grained debugging of EVM opcodes (e.g. evm --code 60ff60ff --debug ). |
energi3rpctest | Developer utility tool to support our ethereum/rpc-test test suite which validates baseline conformity to the Ethereum JSON RPC specs. Please see the test suite's readme for details. |
rlpdump | Developer utility tool to convert binary RLP (Recursive Length Prefix) dumps (data encoding used by the Energi protocol both network as well as consensus wise) to user friendlier hierarchical representation (e.g. rlpdump --hex CE0183FFFFFFC4C304050583616263 ). |
swarm | Swarm daemon and tools. This is the entrypoint for the Swarm network. swarm --help for command line options and subcommands. See Swarm README for more information. |
puppeth | a CLI wizard that aids in creating a new Energi network. |
Going through all the possible command line flags is out of scope here (please consult upstream CLI Wiki page), but we've enumerated a few common parameter combos to get you up to speed quickly on how you can run your own Energi Core instance.
By far the most common scenario is people wanting to simply interact with the Energi network: create accounts; transfer funds; deploy and interact with contracts. For this particular use-case the user doesn't care about years-old historical data, so we can fast-sync quickly to the current state of the network. To do so:
$ energi3 console
This command will:
--syncmode
flag), causing it to
download more data in exchange for avoiding processing the entire history of the Energi network,
which is very CPU intensive.console
subcommand) through which you can invoke all official web3
methods
as well as Energi Core's own management APIs.
This tool is optional and if you leave it out you can always attach to an already running Energi Core instance
with energi3 attach
.Transitioning towards developers, if you'd like to play around with creating Energi contracts, you almost certainly would like to do that without any real money involved until you get the hang of the entire system. In other words, instead of attaching to the main network, you want to join the test network with your node, which is fully equivalent to the main network, but with play-Ether only.
$ energi3 --testnet console
The console
subcommand have the exact same meaning as above and they are equally useful on the
testnet too. Please see above for their explanations if you've skipped to here.
Specifying the --testnet
flag however will reconfigure your Energi Core instance a bit:
~/.ethereum
on Linux for example), Energi Core will nest
itself one level deeper into a testnet
subfolder (~/.ethereum/testnet
on Linux). Note, on OSX
and Linux this also means that attaching to a running testnet node requires the use of a custom
endpoint since energi3 attach
will try to attach to a production node endpoint by default. E.g.
energi3 attach <datadir>/testnet/energi3.ipc
. Windows users are not affected by this.Note: Although there are some internal protective measures to prevent transactions from crossing over between the main network and test network, you should make sure to always use separate accounts for play-money and real-money. Unless you manually move accounts, Energi Core will by default correctly separate the two networks and will not make any accounts available between them. `
As an alternative to passing the numerous flags to the energi3
binary, you can also pass a configuration file via:
$ energi3 --config /path/to/your_config.toml
To get an idea how the file should look like you can use the dumpconfig
subcommand to export your existing configuration:
$ energi3 --your-favourite-flags dumpconfig
Note: This works only with energi3 v1.6.0 and above.
One of the quickest ways to get Energi up and running on your machine is by using Docker:
docker run -d --name ethereum-node -v /Users/alice/ethereum:/root \
-p 39796:39796 -p 39797:39797 \
ethereum/client-go
This will start energi3 in fast-sync mode with a DB memory allowance of 1GB just as the above command does. It will also create a persistent volume in your home directory for saving your blockchain as well as map the default ports. There is also an alpine
tag available for a slim version of the image.
Do not forget --rpcaddr 0.0.0.0
, if you want to access RPC from other containers and/or hosts. By default, energi3
binds to the local interface and RPC endpoints is not accessible from the outside.
As a developer, sooner rather than later you'll want to start interacting with Energi Core and the Energi network via your own programs and not manually through the console. To aid this, Energi Core has built-in support for a JSON-RPC based APIs (standard APIs and Energi Core specific APIs). These can be exposed via HTTP, WebSockets and IPC (unix sockets on unix based platforms, and named pipes on Windows).
The IPC interface is enabled by default and exposes all the APIs supported by Energi Core, whereas the HTTP and WS interfaces need to manually be enabled and only expose a subset of APIs due to security reasons. These can be turned on/off and configured as you'd expect.
HTTP based JSON-RPC API options:
--rpc
Enable the HTTP-RPC server--rpcaddr
HTTP-RPC server listening interface (default: "localhost")--rpcport
HTTP-RPC server listening port (default: 39796)--rpcapi
API's offered over the HTTP-RPC interface (default: "eth,net,web3")--rpccorsdomain
Comma separated list of domains from which to accept cross origin requests (browser enforced)--ws
Enable the WS-RPC server--wsaddr
WS-RPC server listening interface (default: "localhost")--wsport
WS-RPC server listening port (default: 39795)--wsapi
API's offered over the WS-RPC interface (default: "eth,net,web3")--wsorigins
Origins from which to accept websockets requests--ipcdisable
Disable the IPC-RPC server--ipcapi
API's offered over the IPC-RPC interface (default: "admin,debug,eth,miner,net,personal,shh,txpool,web3")--ipcpath
Filename for IPC socket/pipe within the datadir (explicit paths escape it)You'll need to use your own programming environments' capabilities (libraries, tools, etc) to connect via HTTP, WS or IPC to a Energi Core node configured with the above flags and you'll need to speak JSON-RPC on all transports. You can reuse the same connection for multiple requests!
Note: Please understand the security implications of opening up an HTTP/WS based transport before doing so! Hackers on the internet are actively trying to subvert Ethereum nodes with exposed APIs! Further, all browser tabs can access locally running webservers, so malicious webpages could try to subvert locally available APIs!
Maintaining your own private network is more involved as a lot of configurations taken for granted in the official networks need to be manually set up.
First, you'll need to create the genesis state of your networks, which all nodes need to be aware of
and agree upon. This consists of a small JSON file (e.g. call it genesis.json
):
{
"config": {
"chainId": 0,
"homesteadBlock": 0,
"eip155Block": 0,
"eip158Block": 0
},
"alloc" : {},
"coinbase" : "0x0000000000000000000000000000000000000000",
"difficulty" : "0x20000",
"extraData" : "",
"gasLimit" : "0x2fefd8",
"nonce" : "0x0000000000000042",
"mixhash" : "0x0000000000000000000000000000000000000000000000000000000000000000",
"parentHash" : "0x0000000000000000000000000000000000000000000000000000000000000000",
"timestamp" : "0x00"
}
The above fields should be fine for most purposes, although we'd recommend changing the nonce
to
some random value so you prevent unknown remote nodes from being able to connect to you. If you'd
like to pre-fund some accounts for easier testing, you can populate the alloc
field with account
configs:
"alloc": {
"0x0000000000000000000000000000000000000001": {"balance": "111111111"},
"0x0000000000000000000000000000000000000002": {"balance": "222222222"}
}
With the genesis state defined in the above JSON file, you'll need to initialize every Energi Core node with it prior to starting it up to ensure all blockchain parameters are correctly set:
$ energi3 init path/to/genesis.json
With all nodes that you want to run initialized to the desired genesis state, you'll need to start a bootstrap node that others can use to find each other in your network and/or over the internet. The clean way is to configure and run a dedicated bootnode:
$ bootnode --genkey=boot.key
$ bootnode --nodekey=boot.key
With the bootnode online, it will display an enode
URL
that other nodes can use to connect to it and exchange peer information. Make sure to replace the
displayed IP address information (most probably [::]
) with your externally accessible IP to get the
actual enode
URL.
Note: You could also use a full fledged Energi Core node as a bootnode, but it's the less recommended way.
With the bootnode operational and externally reachable (you can try telnet <ip> <port>
to ensure
it's indeed reachable), start every subsequent Energi Core node pointed to the bootnode for peer discovery
via the --bootnodes
flag. It will probably also be desirable to keep the data directory of your
private network separated, so do also specify a custom --datadir
flag.
$ energi3 --datadir=path/to/custom/data/folder --bootnodes=<bootnode-enode-url-from-above>
Note: Since your network will be completely cut off from the main and test networks, you'll also need to configure a miner to process transactions and create new blocks for you.
truffle build
issuesThere is an apparent bug in truffle that causes it to clear the build
directory (delete all it's contents), before building the contracts. Please do not use truffle build
without a way to restore the contents of the build directory (e.g. git restore
) as needed.
The Energi Core library (i.e. all code outside of the cmd
directory) is licensed under the
GNU Lesser General Public License v3.0, also
included in our repository in the COPYING.LESSER
file.
The Energi Core binaries (i.e. all code inside of the cmd
directory) is licensed under the
GNU General Public License v3.0, also included
in our repository in the COPYING
file.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.