
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@aave/core-v3
Advanced tools
.///. .///. //. .// `/////////////-
`++:++` .++:++` :++` `++: `++:......---.`
`/+: -+/` `++- :+/` /+/ `/+/ `++.
/+/ :+/ /+: /+/ `/+/ /+/` `++.
-::/++::` /+: -::/++::` `/+: `++: :++` `++/:::::::::.
-:+++::-` `/+: --++/---` `++- .++- -++. `++/:::::::::.
-++. .++- -++` .++. .++. .++- `++.
.++- -++. .++. -++. -++``++- `++.
`++: :++` .++- :++` :+//+: `++:----------`
-/: :/- -/: :/. ://: `/////////////-
This repository contains the smart contracts source code and markets configuration for Aave Protocol V3. The repository uses Docker Compose and Hardhat as development environment for compilation, testing and deployment tasks.
Aave is a decentralized non-custodial liquidity markets protocol where users can participate as suppliers or borrowers. Suppliers provide liquidity to the market to earn a passive income, while borrowers are able to borrow in an overcollateralized (perpetually) or undercollateralized (one-block liquidity) fashion.
See the link to the technical paper or visit the Aave Developer docs
You can find all audit reports under the audits folder
Round 1 - October 2021
Round 2 - December 2021
Formal Verification
You can join the Discord channel or the Governance Forum to ask questions about the protocol or talk about Aave with other peers.
You can install @aave/core-v3
as an NPM package in your Hardhat or Truffle project to import the contracts and interfaces:
npm install @aave/core-v3
Import at Solidity files:
import {IPool} from "@aave/core-v3/contracts/interfaces/IPool.sol";
contract Misc {
function supply(address pool, address token, address user, uint256 amount) public {
IPool(pool).supply(token, amount, user, 0);
{...}
}
}
The JSON artifacts with the ABI and Bytecode are also included in the bundled NPM package at artifacts/
directory.
Import JSON file via Node JS require
:
const PoolV3Artifact = require('@aave/core-v3/artifacts/contracts/protocol/pool/Pool.sol/Pool.json');
// Log the ABI into console
console.log(PoolV3Artifact.abi)
The repository uses Docker Compose to manage sensitive keys and load the configuration. Prior to any action like test or deploy, you must run docker-compose up
to start the contracts-env
container, and then connect to the container console via docker-compose exec contracts-env bash
.
Follow the next steps to setup the repository:
docker
and docker-compose
.env
and fill the next environment variables# Add Alchemy or Infura provider keys, alchemy takes preference at the config level
ALCHEMY_KEY=""
INFURA_KEY=""
# Optional, if you plan to use Tenderly scripts
TENDERLY_PROJECT=""
TENDERLY_USERNAME=""
You can run the full test suite with the following commands:
# In one terminal
docker-compose up
# Open another tab or terminal
docker-compose exec contracts-env bash
# A new Bash terminal is prompted, connected to the container
npm run test
FAQs
Aave Protocol V3 core smart contracts
The npm package @aave/core-v3 receives a total of 7,173 weekly downloads. As such, @aave/core-v3 popularity was classified as popular.
We found that @aave/core-v3 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.