
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@cardinal/staking-components
Advanced tools
This repository hosts the UI inteface that powers https://stake.cardinal.so for staking NFTs on Solana.
Use this repo to create and deploy stake pools with built-in reward distribution, or build your own custom interface with our underlying staking protocol.
For questions or technical help, join our Discord.
To get started, clone the repo and run:
yarn install
Next, run the development server:
yarn run dev
Open http://localhost:3000 with your browser to see the staking interface running locally.
To access different clusters in the scaffold, set the cluster query parameter in the URL:
The default cluster set is mainnet. It's recommended to ensure you have ?cluster=devnet while testing out functionality.
To create a stake pool, navigate to the admin page located at http://localhost:3000/admin. This page hosts a form to create a stake pool with various configurations.
Note: All configurations in the admin page are optional. Also, filters in the stake pool configuration are union-based, if any one of the conditions is met, then the NFT will be allowed to stake in the pool.
After creating your stake pool, you will receive a Stake Pool Id. View your stake pool at http://localhost:3000/[stakePoolId]
Pool Creation Parameters:
export type StakePoolParams {
requiresCollections?: PublicKey[];
requiresCreators?: PublicKey[];
requiresAuthorization?: boolean;
overlayText?: string;
imageUri?: string;
resetOnStake?: boolean;
}
Reward Distribution Parameters
export type RewardDistributionParams {
stakePoolId: PublicKey;
rewardMintId: PublicKey;
rewardAmount?: BN;
rewardDurationSeconds?: BN;
kind?: RewardDistributorKind;
maxSupply?: BN;
supply?: BN;
}
There are two types of reward distribution (RewardDistributionKind) with Cardinal Staking.
In order to easily access your stake pool, airdrop NFTs on devnet for your specific collection and get a stake.cardinal.so/[projectName] url, you'll need to create a Stake Pool metadata object. NOTE if you specified a verified creator in a devnet pool, airdropped NFTs will not be allowed into that pool because your creator will not be verified.
export type StakePoolMetadata = {
// Name of this stake pool used as an id. Should be in lower-case kebab-case since it is used in the URL as /{name}
// https://www.theserverside.com/blog/Coffee-Talk-Java-News-Stories-and-Opinions/Why-you-should-make-kebab-case-a-URL-naming-convention-best-practice
name: string
// Display name to be displayed in the header. Often the same as name but with capital letters and spaces
displayName: string
// Publickey for this stake pool
stakePoolAddress: PublicKey
// Default receipt type. Setting this will remove the option for the user to choose which receipt type to use
receiptType?: ReceiptType
// Colors object to style the stake page
colors?: {
primary: string
secondary: string
accent?: string
fontColor?: string
}
// Image url to be used as the icon in the pool selector and the header
imageUrl?: string
// Website url if specified will be navigated to when the image in the header is clicked
websiteUrl?: string
// Max staked is used to compute percentage of total staked
maxStaked?: number
// Links to show at the top right of the page
links?: { text: string; value: string }[]
// On devnet when you click the airdrop button on this page it will clone NFTs with this metadata and airdrop to the user
airdrops?: AirdropMetadata[]
}
In api/mapping.ts, add your own object to the stakePoolMetadatas array. You'll now be able to access your project at http://localhost:3000/[name].
In order to get a custom Cardinal URL, deploy your pool on mainnet and then make a PR to our api/mapping.ts file in this repo with updates containing your pool's metadata.
Now that you've made and deployed your Cardinal stake pool, you can either stick with Cardinal's UX for the stake pool experience or build your own.
Simply modify pages/[stakePoolId]/index.tsx with your own react styling, and host the stake pool on your own domain.
Join our Discord to get technical support as you build on Cardinal.
FAQs
Cardinal staking ui
We found that @cardinal/staking-components demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.