
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@axelar-network/axelar-cgp-solidity
Advanced tools
Axelar is a decentralized interoperability network connecting all blockchains, assets and apps through a universal set of protocols and APIs. It is built on top of the Cosmos SDK. Users/Applications can use Axelar network to send tokens between any Cosmos and EVM chains. They can also send arbitrary messages between EVM chains.
Axelar network's decentralized validators confirm events emitted on EVM chains (such as deposit confirmation and message send), and sign off on commands submitted (by automated services) to the gateway smart contracts (such as minting token, and approving message on the destination).
See this doc for more design info.
We recommend using the latest Node.js LTS version.
npm ci
npm run build
npm run test
Pre-compiled bytecodes can be found under Releases. Furthermore, pre-compiled bytecodes and ABI are shipped in the npm package and can be imported via:
npm i @axelar-network/axelar-cgp-solidity
const IAxelarGateway = require('@axelar-network/axelar-cgp-solidity/artifacts/interfaces/IAxelarGateway.json');
const AxelarGateway = require('@axelar-network/axelar-cgp-solidity/artifacts/contracts/AxelarGateway.sol/AxelarGateway.json');
{
"chains": {
"example": {
"name": "Example",
"id": "example",
"chainId": 123,
"rpc": "PROVIDER_RPC",
"tokenSymbol": "EXM",
"gasOptions": {
"gasLimit": 8000000
}
}
}
}
hardhat.config.js
file and modify the chains import line as shown below:const chains = require(`/path/to/axelar-contract-deployments/axelar-chains-config/info/${env}.json`);
keys.json
file in this repo that contains the private keys for your accounts that will be used for testing. For some tests, such as the Axelar gateway tests, you may need to provide at least two private keys (you can refer the test to find the number of accounts needed). At this point the keys.json
file should resemble the example file below (chains
can be left empty):{
"chains": {},
"accounts": ["PRIVATE_KEY1", "PRIVATE_KEY2"]
}
npm ci
npx hardhat test --network example
.only
to describe
and/or it
blocks as shown below or grep the specific test names:describe.only();
it.only();
npx hardhat test --network example --grep 'AxelarGateway'
See Axelar examples for concrete examples.
A
is deployed (AxelarGateway.deployToken()
)
on each non-native EVM chain as an ERC-20 token (BurnableMintableCappedERC20.sol
).DepositHandler.sol
is deployed,
BurnableMintableCappedERC20.depositAddress()
) on source EVM chain.A
at that address, and the deposit contract locks the token at the gateway (or burns them for wrapped tokens).Transfer
event using their RPC nodes for the source chain (using majority voting).AxelarGateway.execute()
.mint
's the specified amount of the wrapped Token A
to the destination address.AxelarDepositService.addressForNativeUnwrap()
.AxelarDepositService.addressForTokenDeposit()
with using the un-wrap address as a destination.AxelarDepositService.sendTokenDeposit()
.AxelarDepositService
deploys DepositReceiver
to that generated address which will call AxelarGateway.sendToken()
.AxelarDepositService.nativeUnwrap()
.AxelarDepositService
deploys DepositReceiver
which will call IWETH9.withdraw()
and transfer native currency to the recipient address.IAxelarExecutable.sol
interface to receive the message.ERC20.approve()
beforehand to allow the gateway contract
to transfer the specified amount
on behalf of the sender/source contract.AxelarGateway.callContractWithToken()
with the destination chain/address, payload
and token.payload
in a regular database, keyed by the hash(payload)
, that anyone can query by.ContractCallWithToken
event.AxelarGateway.approveContractCallWithMint()
command, signed by the validators.payload hash
and emits the event ContractCallApprovedWithMint
.IAxelarExecutable.executeWithToken()
on the destination contract, with the payload
and other data as params.executeWithToken
of the destination contract verifies that the contract call was indeed approved by calling AxelarGateway.validateContractCallAndMint()
on the gateway contract.payload
for its own application.Network resources: https://docs.axelar.dev/resources
Deployed contracts: https://docs.axelar.dev/resources/mainnet
General Message Passing Usage: https://docs.axelar.dev/dev/gmp
Example cross-chain token swap app: https://app.squidrouter.com
EVM module of the Axelar network that prepares commands for the gateway: https://github.com/axelarnetwork/axelar-core/blob/main/x/evm/keeper/msg_server.go
FAQs
EVM Smart Contracts for Axelar Network
The npm package @axelar-network/axelar-cgp-solidity receives a total of 196,837 weekly downloads. As such, @axelar-network/axelar-cgp-solidity popularity was classified as popular.
We found that @axelar-network/axelar-cgp-solidity demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.