
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@balancer-labs/v2-pool-weighted
Advanced tools
This package contains the source code for Balancer V2 Weighted Pools, that is, Pools that swap tokens by enforcing a Constant Weighted Product invariant.
The two basic flavors currently in existence are WeightedPool (basic twenty token version) and WeightedPool2Tokens (limited to two tokens, but supporting price oracles).
The smart directory contains a number of 'smart' variants, which automatically update some of their attributes to support more complex use cases. Examples are LiquidityBootstrappingPool for auction-like mechanisms, and InvestmentPool for managed portfolios.
| :warning: | Investment Pools are still undergoing development and may contain bugs and/or change significantly. |
|---|
Other useful contracts include WeightedMath, which implements the low level calculations required for swaps, joins, exits and price calculations, and IPriceOracle, used to make price oracle queries.
$ npm install @balancer-labs/v2-pool-weighted
This package can be used in multiple ways, including interacting with already deployed Pools, performing local testing, or even creating new Pool types that also use the Constant Weighted Product invariant.
To get the address of deployed contracts in both mainnet and various test networks, see v2-deployments.
Sample contract that performs an action conditionally using a Pool as a price oracle:
pragma solidity ^0.7.0;
import "@balancer-labs/v2-pool-weighted/contracts/IPriceOracle.sol";
contract SimpleOracleQuery {
IPriceOracle private constant oracle = "0x0b09deA16768f0799065C475bE02919503cB2a35"; // WETH-DAI Pool
function performAction() external {
IPriceOracle.OracleAverageQuery[] memory queries = new IPriceOracle.OracleAverageQuery[](1);
// Average price over the last hour - note that the oracle must be fully initialized
queries[0] = IPriceOracle.OracleAverageQuery({
variable: IPriceOracle.Variable.PAIR_PRICE,
secs: 3600,
ago: 0
});
uint256[] memory results = oracle.getTimeWeightedAverage(queries);
if (results[0] >= 4000) {
...
} else {
...
}
}
}
Sample Weighted Pool that computes weights dynamically on every swap, join and exit:
pragma solidity ^0.7.0;
import '@balancer-labs/v2-pool-weighted/contracts/BaseWeightedPool.sol';
contract DynamicWeightedPool is BaseWeightedPool {
uint256 private immutable _creationTime;
constructor() {
_creationTime = block.timestamp;
}
function _getNormalizedWeightsAndMaxWeightIndex() internal view override returns (uint256[] memory) {
uint256[] memory weights = new uint256[](2);
// Change weights from 50-50 to 30-70 one month after deployment
if (block.timestamp < (_creationTime + 1 month)) {
weights[0] = 0.5e18;
weights[1] = 0.5e18;
} else {
weights[0] = 0.3e18;
weights[1] = 0.7e18;
}
return (weights, 1);
}
...
}
FAQs
Balancer V2 Weighted Pools
The npm package @balancer-labs/v2-pool-weighted receives a total of 6 weekly downloads. As such, @balancer-labs/v2-pool-weighted popularity was classified as not popular.
We found that @balancer-labs/v2-pool-weighted demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.