Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@axelar-network/axelar-cgp-solidity
Advanced tools
Axelar is a decentralized interoperability network connecting all blockchains, assets and apps through a universal set of protocols and APIs. It is built on top of the Cosmos SDK. Users/Applications can use Axelar network to send tokens between any Cosmos and EVM chains. They can also send arbitrary messages between EVM chains.
Axelar network's decentralized validators confirm events emitted on EVM chains (such as deposit confirmation and message send), and sign off on commands submitted (by automated services) to the gateway smart contracts (such as minting token, and approving message on the destination).
See this doc for more design info.
We recommend using the latest Node.js LTS version.
npm ci
npm run build
npm run test
Pre-compiled bytecodes can be found under Releases. Furthermore, pre-compiled bytecodes and ABI are shipped in the npm package and can be imported via:
npm i @axelar-network/axelar-cgp-solidity
const IAxelarGateway = require('@axelar-network/axelar-cgp-solidity/artifacts/interfaces/IAxelarGateway.json');
const AxelarGateway = require('@axelar-network/axelar-cgp-solidity/artifacts/contracts/AxelarGateway.sol/AxelarGateway.json');
See the Axelar contract deployments repository for relevant deployment/upgrade scripts:
axelar-chains-config/info
folder to add the chain you'll be testing. The following values need to be provided:{
"chains": {
"example": {
"name": "Example",
"axelarId": "example",
"chainId": 123,
"rpc": "PROVIDER_RPC",
"tokenSymbol": "EXM",
"gasOptions": {
"gasLimit": 8000000
},
"confirmations": 1
}
}
}
gasLimit
override will skip auto gas estimation (which might be unreliable on certain chains for certain txs). confirmations
indicates the number of block confirmations to wait for. axelarId
is the unique id used to reference the chain on Axelar.
axelar-cgp-solidity
repository. Once there, in the root directory of this repository, navigate to the hardhat.config.js
file and modify the chains import line as shown below:const chains = require(`/path/to/axelar-contract-deployments/axelar-chains-config/info/${env}.json`);
keys.json
file in this repo that contains the private keys for your accounts that will be used for testing. For some tests, such as the Axelar gateway tests, you may need to provide at least two private keys (you can refer the test to find the number of accounts needed). At this point the keys.json
file should resemble the example file below (chains
can be left empty):{
"chains": {},
"accounts": ["PRIVATE_KEY1", "PRIVATE_KEY2"]
}
npm ci
npx hardhat test --network example
.only
to describe
and/or it
blocks as shown below or grep the specific test names:describe.only();
it.only();
npx hardhat test --network example --grep 'AxelarGateway'
getGasOptions()
using utils.js file for some spceific transactions. See the code below for exampleawait sourceChainGateway
.execute(
await getSignedWeightedExecuteInput(await getTokenDeployData(false), [operatorWallet], [1], 1, [operatorWallet]),
getGasOptions()
)
.then((tx) => tx.wait(network.config.confirmations));
Using the most up to date and fast rpc can help in tests execution runtime. Make sure the rate limit for the rpc is not exceeded.
Make sure that the account being used to broadcast transactions has enough native balance. The maximum gasLimit
for a chain should be fetched from an explorer and set it in config file. You may also need to update the confirmations
required for a transaction to be successfully included in a block in the config here depending on the network.
Note that certain tests can require upto 3 accounts.
Transactions can fail if previous transactions are not mined and picked up by the provide, therefore wait for a transaction to be mined after broadcasting. See the code below for example
await testToken.mint(userWallet.address, 1e9).then((tx) => tx.wait(network.config.confirmations));
// Or
const txExecute = await interchainGovernance.execute(commandIdGateway, governanceChain, governanceAddress, payload, getGasOptions());
const receiptExecute = await txExecute.wait(network.config.confirmations);
changeEtherBalance
check expects one tx in a block so change in balances might need to be tested explicitly for unit tests using changeEtherBalance
.See Axelar examples for concrete examples.
A
is deployed (AxelarGateway.deployToken()
)
on each non-native EVM chain as an ERC-20 token (BurnableMintableCappedERC20.sol
).DepositHandler.sol
is deployed,
BurnableMintableCappedERC20.depositAddress()
) on source EVM chain.A
at that address, and the deposit contract locks the token at the gateway (or burns them for wrapped tokens).Transfer
event using their RPC nodes for the source chain (using majority voting).AxelarGateway.execute()
.mint
's the specified amount of the wrapped Token A
to the destination address.AxelarDepositService.addressForNativeUnwrap()
.AxelarDepositService.addressForTokenDeposit()
with using the un-wrap address as a destination.AxelarDepositService.sendTokenDeposit()
.AxelarDepositService
deploys DepositReceiver
to that generated address which will call AxelarGateway.sendToken()
.AxelarDepositService.nativeUnwrap()
.AxelarDepositService
deploys DepositReceiver
which will call IWETH9.withdraw()
and transfer native currency to the recipient address.IAxelarExecutable.sol
interface to receive the message.ERC20.approve()
beforehand to allow the gateway contract
to transfer the specified amount
on behalf of the sender/source contract.AxelarGateway.callContractWithToken()
with the destination chain/address, payload
and token.payload
in a regular database, keyed by the hash(payload)
, that anyone can query by.ContractCallWithToken
event.AxelarGateway.approveContractCallWithMint()
command, signed by the validators.payload hash
and emits the event ContractCallApprovedWithMint
.IAxelarExecutable.executeWithToken()
on the destination contract, with the payload
and other data as params.executeWithToken
of the destination contract verifies that the contract call was indeed approved by calling AxelarGateway.validateContractCallAndMint()
on the gateway contract.payload
for its own application.Network resources: https://docs.axelar.dev/resources
Deployed contracts: https://docs.axelar.dev/resources/mainnet
General Message Passing Usage: https://docs.axelar.dev/dev/gmp
Example cross-chain token swap app: https://app.squidrouter.com
EVM module of the Axelar network that prepares commands for the gateway: https://github.com/axelarnetwork/axelar-core/blob/main/x/evm/keeper/msg_server.go
FAQs
EVM Smart Contracts for Axelar Network
The npm package @axelar-network/axelar-cgp-solidity receives a total of 22,339 weekly downloads. As such, @axelar-network/axelar-cgp-solidity popularity was classified as popular.
We found that @axelar-network/axelar-cgp-solidity demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.