
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@balancer-labs/v2-pool-weighted
Advanced tools
This package contains the source code for Balancer V2 Weighted Pools, that is, Pools that swap tokens by enforcing a Constant Weighted Product invariant.
The two basic flavors currently in existence are WeightedPool
(basic twenty token version) and WeightedPool2Tokens
(limited to two tokens, but supporting price oracles).
The smart
directory contains a number of 'smart' variants, which automatically update some of their attributes to support more complex use cases. Examples are LiquidityBootstrappingPool
for auction-like mechanisms, and InvestmentPool
for managed portfolios.
:warning: | Investment Pools are still undergoing development and may contain bugs and/or change significantly. |
---|
Other useful contracts include WeightedMath
, which implements the low level calculations required for swaps, joins, exits and price calculations, and IPriceOracle
, used to make price oracle queries.
$ npm install @balancer-labs/v2-pool-weighted
This package can be used in multiple ways, including interacting with already deployed Pools, performing local testing, or even creating new Pool types that also use the Constant Weighted Product invariant.
To get the address of deployed contracts in both mainnet and various test networks, see v2-deployments
.
Sample contract that performs an action conditionally using a Pool as a price oracle:
pragma solidity ^0.7.0;
import "@balancer-labs/v2-pool-weighted/contracts/IPriceOracle.sol";
contract SimpleOracleQuery {
IPriceOracle private constant oracle = "0x0b09deA16768f0799065C475bE02919503cB2a35"; // WETH-DAI Pool
function performAction() external {
IPriceOracle.OracleAverageQuery[] memory queries = new IPriceOracle.OracleAverageQuery[](1);
// Average price over the last hour - note that the oracle must be fully initialized
queries[0] = IPriceOracle.OracleAverageQuery({
variable: IPriceOracle.Variable.PAIR_PRICE,
secs: 3600,
ago: 0
});
uint256[] memory results = oracle.getTimeWeightedAverage(queries);
if (results[0] >= 4000) {
...
} else {
...
}
}
}
Sample Weighted Pool that computes weights dynamically on every swap, join and exit:
pragma solidity ^0.7.0;
import '@balancer-labs/v2-pool-weighted/contracts/BaseWeightedPool.sol';
contract DynamicWeightedPool is BaseWeightedPool {
uint256 private immutable _creationTime;
constructor() {
_creationTime = block.timestamp;
}
function _getNormalizedWeightsAndMaxWeightIndex() internal view override returns (uint256[] memory) {
uint256[] memory weights = new uint256[](2);
// Change weights from 50-50 to 30-70 one month after deployment
if (block.timestamp < (_creationTime + 1 month)) {
weights[0] = 0.5e18;
weights[1] = 0.5e18;
} else {
weights[0] = 0.3e18;
weights[1] = 0.7e18;
}
return (weights, 1);
}
...
}
FAQs
Balancer V2 Weighted Pools
We found that @balancer-labs/v2-pool-weighted demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.