
Research
/Security News
Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40+ Packages
Malicious update to @ctrl/tinycolor on npm is part of a supply-chain attack hitting 40+ packages across maintainers
@aragon/apps-token-request
Advanced tools
[](https://circleci.com/gh/1Hive/token-request-app) [](https://co
1Hive's Token Request app allows users to create a vote which requests an Organization's tokens in exchange for payment. For example a user may request minting 100 organization tokens in exchange for 100 DAI. The request would require a vote to approve, if the vote is rejected the user would receive their payment back and if it is approved the payment would be deposited in the organization's vault.
The Token Request App should be granted the Create Votes
permission on an instance of the Aragon Voting
app. When a user makes a request they should transfer the payment to the Token Request app which will hold them in escrow while the vote is created and executed. If the vote duration passes and the payment is still in the Token Request app, the user should be able to claim their tokens. If the vote passes then executing the vote should transfer the users tokens from the Token Request app to the organizations vault, and mint tokens from the token manager for the user.
The token request app is initialized by passing the address of a token manager
instance, the address of a _vault
instance, and an array of addresses _acceptedDepositTokens
. The _acceptedDepositTokens
array MUST be less than the MAX_ACCEPTED_DEPOSIT_TOKENS
variable which is set to 100 and must be in ascending order (otherwise the installation will fail).
The Token Request application should implement the following roles:
We do not need to provide an interface for changing parameters as this can be done by power users using the aragonCLI.
The interface allows users to request tokens, where they would specify the amount and the associated payment. It also allows for withdrawing their requests at any time.
For a detailed view of the flow of the app check out our user-guide
First make sure that you have node, npm, and the aragonCLI installed and working. Instructions on how to set that up can be found here. You'll also need to have Metamask or some kind of web wallet enabled to sign transactions in the browser.
Git clone this repo.
git clone https://github.com/1Hive/token-request-app.git
Navigate into the token-request-app
directory.
cd token-request-app
Install npm dependencies.
npm i
Deploy a dao with Lock app installed on your local environment.
npm run start:template
Token Request app has been published to APM on Mainnet and Rinkeby at token-request.aragonpm.eth
To deploy to an Aragon DAO you can use the Aragon CLI.
aragon dao install <dao-address> token-request.aragonpm.eth --app-init-args <vault-address> <token-manager-address>
We welcome community contributions!
Please check out our open Issues to get started.
If you discover something that could potentially impact security, please notify us immediately. The quickest way to reach us is via the #dev channel in our team Keybase chat. Just say hi and that you discovered a potential security vulnerability and we'll DM you to discuss details.
FAQs
[](https://circleci.com/gh/1Hive/token-request-app) [](https://co
We found that @aragon/apps-token-request demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 10 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Malicious update to @ctrl/tinycolor on npm is part of a supply-chain attack hitting 40+ packages across maintainers
Security News
pnpm's new minimumReleaseAge setting delays package updates to prevent supply chain attacks, with other tools like Taze and NCU following suit.
Security News
The Rust Security Response WG is warning of phishing emails from rustfoundation.dev targeting crates.io users.