
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
@axelar-network/axelar-cgp-solidity
Advanced tools
Axelar is a decentralized interoperability network connecting all blockchains, assets and apps through a universal set of protocols and APIs. It is built on top of the Cosmos SDK. Users/Applications can use Axelar network to send tokens between any Cosmos and EVM chains. They can also send arbitrary messages between EVM chains.
Axelar network's decentralized validators confirm events emitted on EVM chains (such as deposit confirmation and message send), and sign off on commands submitted (by automated services) to the gateway smart contracts (such as minting token, and approving message on the destination).
See this doc for more design info.
We recommend using the latest Node.js LTS version.
npm ci
npm run build
npm run test
Pre-compiled bytecodes can be found under Releases. Furthermore, pre-compiled bytecodes and ABI are shipped in the npm package and can be imported via:
npm i @axelar-network/axelar-cgp-solidity
const IAxelarGateway = require('@axelar-network/axelar-cgp-solidity/artifacts/interfaces/IAxelarGateway.json');
const AxelarGateway = require('@axelar-network/axelar-cgp-solidity/artifacts/contracts/AxelarGateway.sol/AxelarGateway.json');
See the Axelar contract deployments repository for relevant deployment/upgrade scripts:
axelar-chains-config/info folder to add the chain you'll be testing. The following values need to be provided:{
"chains": {
"example": {
"name": "Example",
"axelarId": "example",
"chainId": 123,
"rpc": "PROVIDER_RPC",
"tokenSymbol": "EXM",
"gasOptions": {
"gasLimit": 8000000
},
"confirmations": 1
}
}
}
gasLimit override will skip auto gas estimation (which might be unreliable on certain chains for certain txs). confirmations indicates the number of block confirmations to wait for. axelarId is the unique id used to reference the chain on Axelar.
axelar-cgp-solidity repository. Once there, in the root directory of this repository, navigate to the hardhat.config.js file and modify the chains import line as shown below:const chains = require(`/path/to/axelar-contract-deployments/axelar-chains-config/info/${env}.json`);
keys.json file in this repo that contains the private keys for your accounts that will be used for testing. For some tests, such as the Axelar gateway tests, you may need to provide at least two private keys (you can refer the test to find the number of accounts needed). At this point the keys.json file should resemble the example file below (chains can be left empty):{
"chains": {},
"accounts": ["PRIVATE_KEY1", "PRIVATE_KEY2"]
}
npm ci
npx hardhat test --network example
.only to describe and/or it blocks as shown below or grep the specific test names:describe.only();
it.only();
npx hardhat test --network example --grep 'AxelarGateway'
getGasOptions() using utils.js file for some spceific transactions. See the code below for exampleawait sourceChainGateway
.execute(
await getSignedWeightedExecuteInput(await getTokenDeployData(false), [operatorWallet], [1], 1, [operatorWallet]),
getGasOptions()
)
.then((tx) => tx.wait(network.config.confirmations));
Using the most up to date and fast rpc can help in tests execution runtime. Make sure the rate limit for the rpc is not exceeded.
Make sure that the account being used to broadcast transactions has enough native balance. The maximum gasLimit for a chain should be fetched from an explorer and set it in config file. You may also need to update the confirmations required for a transaction to be successfully included in a block in the config here depending on the network.
Note that certain tests can require upto 3 accounts.
Transactions can fail if previous transactions are not mined and picked up by the provide, therefore wait for a transaction to be mined after broadcasting. See the code below for example
await testToken.mint(userWallet.address, 1e9).then((tx) => tx.wait(network.config.confirmations));
// Or
const txExecute = await interchainGovernance.execute(commandIdGateway, governanceChain, governanceAddress, payload, getGasOptions());
const receiptExecute = await txExecute.wait(network.config.confirmations);
changeEtherBalance check expects one tx in a block so change in balances might need to be tested explicitly for unit tests using changeEtherBalance.See Axelar examples for concrete examples.
A is deployed (AxelarGateway.deployToken())
on each non-native EVM chain as an ERC-20 token (BurnableMintableCappedERC20.sol).DepositHandler.sol is deployed,
BurnableMintableCappedERC20.depositAddress()) on source EVM chain.A at that address, and the deposit contract locks the token at the gateway (or burns them for wrapped tokens).Transfer event using their RPC nodes for the source chain (using majority voting).AxelarGateway.execute().mint's the specified amount of the wrapped Token A to the destination address.AxelarDepositService.addressForNativeUnwrap().AxelarDepositService.addressForTokenDeposit() with using the un-wrap address as a destination.AxelarDepositService.sendTokenDeposit().AxelarDepositService deploys DepositReceiver to that generated address which will call AxelarGateway.sendToken().AxelarDepositService.nativeUnwrap().AxelarDepositService deploys DepositReceiver which will call IWETH9.withdraw() and transfer native currency to the recipient address.IAxelarExecutable.sol interface to receive the message.ERC20.approve() beforehand to allow the gateway contract
to transfer the specified amount on behalf of the sender/source contract.AxelarGateway.callContractWithToken() with the destination chain/address, payload and token.payload in a regular database, keyed by the hash(payload), that anyone can query by.ContractCallWithToken event.AxelarGateway.approveContractCallWithMint() command, signed by the validators.payload hash and emits the event ContractCallApprovedWithMint.IAxelarExecutable.executeWithToken()
on the destination contract, with the payload and other data as params.executeWithToken of the destination contract verifies that the contract call was indeed approved by calling AxelarGateway.validateContractCallAndMint()
on the gateway contract.payload for its own application.Network resources: https://docs.axelar.dev/resources
Deployed contracts: https://docs.axelar.dev/resources/mainnet
General Message Passing Usage: https://docs.axelar.dev/dev/gmp
Example cross-chain token swap app: https://app.squidrouter.com
EVM module of the Axelar network that prepares commands for the gateway: https://github.com/axelarnetwork/axelar-core/blob/main/x/evm/keeper/msg_server.go
FAQs
EVM Smart Contracts for Axelar Network
The npm package @axelar-network/axelar-cgp-solidity receives a total of 3,723 weekly downloads. As such, @axelar-network/axelar-cgp-solidity popularity was classified as popular.
We found that @axelar-network/axelar-cgp-solidity demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.