
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@cartesi/rollups
Advanced tools
The Cartesi Rollups Contracts are a set of Solidity smart contracts that provide Data Availability, Consensus and Settlement to Cartesi Rollups applications. They are completely permissionless, and can be deployed by anyone to any EVM-compatible chain. Ne
The Cartesi Rollups Contracts are a set of Solidity smart contracts that provide Data Availability, Consensus and Settlement to Cartesi Rollups applications. They are completely permissionless, and can be deployed by anyone to any EVM-compatible chain. Nevertheless, the Cartesi Foundation, as a form of public good, kindly deploys them to Ethereum, Arbitrum, Optimism, Base, and their respective testnets.
Data Availability of user transactions and Consensus over their order is provided by the InputBox contract,
while Settlement is provided by the Application contract in conjunction with a settlement module.
Currently, we have implemented an authority-based module (Authority) and a quorum-based module (Quorum).
In the near future, we plan to support our very own fraud proof system, Dave.
The Cartesi Rollups Contracts are an integral part of the Cartesi Rollups SDK, and are used by the Cartesi Rollups Node, the Cartesi Rollups Explorer, and, of course, by Cartesi Rollups applications. Through simple Solidity interfaces, one can easily send and list user transactions, deposit assets, submit claims, execute asset withdrawal orders, and more.
CALL and DELEGATECALL vouchersFirst, please ensure the following dependencies are installed:
Then, you may clone the repository...
git clone https://github.com/cartesi/rollups-contracts.git
... and install the Node.js and Solidity packages.
pnpm install
forge soldeer install
Having done that, you can build a local devnet.
The following Bash script dumps the Anvil state into a state.json file
and the deployment addresses into the deployments/31337 directory.
./script/build-devnet.sh
Once built, you can run the local devnet with Anvil.
anvil --load-state state.json
You can then interact with the contracts with Cast.
The following command, for example,
calls the getDeploymentBlockNumber function
of the InputBox contract
deployed to the local devnet.
cast call $(jq -r .address deployments/31337/InputBox.json) 'getDeploymentBlockNumber()(uint256)'
If you wish to deploy the contracts to a live network, we may suggest our deployment guide.
A more in-depth documentation on the contracts can be found here.
The Cartesi Rollups Contracts are used by the Cartesi Rollups SDK. They offer an extensible framework for input relays and output execution. Here are some examples of use cases:
The contracts are used by several other projects in the Cartesi ecosystem:
The project is licensed under Apache-2.0.
FAQs
The Cartesi Rollups Contracts are a set of Solidity smart contracts that provide Data Availability, Consensus and Settlement to Cartesi Rollups applications. They are completely permissionless, and can be deployed by anyone to any EVM-compatible chain. Ne
The npm package @cartesi/rollups receives a total of 940 weekly downloads. As such, @cartesi/rollups popularity was classified as not popular.
We found that @cartesi/rollups demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.