Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
@cruna/cruna-protocol
Advanced tools
A platform that implements the DS-protocol to manage NaaA (NFT-as-an-app), born from the collaboration between Everdragons2, Nduja Labs and The Round Table.
The Cruna Core Protocol establishes a unique hierarchy between two distinct NFTs – the Protector and the Protected – operating on EVM-compatible blockchains to facilitate the management of utility-driven NFTs. The Protected NFT, subordinate in nature, does not possess the capability to alter token ownership; rather, it derives its ownership from the dominant Protector NFT. Simply put, the wallet owning the Protector NFT inherently owns the corresponding Protected NFT.
While the Protector NFT functions as a conventional NFT, complete with rarity distribution and other standard attributes, the Protected NFT diverges by focusing on providing tangible utility. In the Cruna MVP, the inaugural utility NFT takes the form of a Transparent Vault.
The Protector NFT carries significant responsibility, as its ownership can imply control over hundreds of additional assets. To enhance security, certain limitations have been implemented.
Interaction with Marketplaces:
Ownership Transfer:
A Transparent Vault is a protected NFT designed to store and safeguard assets (ERC20, ERC721, ERC1155). Its ownership is derived from the associated Protector NFT, meaning that transferring the Protector NFT's ownership will also transfer the ownership of the Transparent Vault.
The Transparent Vault inherits security features from its Protector NFT. If the Protector's owner has designated an initiator, any movement within the Transparent Vault must be initiated by the initiator and confirmed by the owner. This added security layer helps prevent scammers from transferring or withdrawing assets in the event of phishing. Typically, an initiator is a wallet stored in a cold wallet, reserved for crucial operations and not used for daily transactions.
Assets can be deposited into the Transparent Vault by the Protector's owner or other wallets. To prevent abuse, the owner can establish rules to permit deposits from everyone, specific wallets, or exclusively from the owner. It's also possible to implement a confirmation-based system requiring the owner's approval for deposits not originating from whitelisted wallets or the owner themselves.
Asset transfers between Protectors can be executed by the owner, even if an initiator is set, as long as the destination Protector is owned by the same individual. If the destination Protector has a different owner, the initiator must be utilized.
The simple concept of a Transparent Vault dramatically enhances the security of an NFT collection.
Consolidate all assets of a collection into a single Transparent Vault, allowing a seamless transfer of ownership without needing to move each asset individually. This offers significant improvements in security and user experience.
Create asset bundles and list them for sale as a single NFT on popular marketplaces like OpenSea.
Deposit vested assets into a Transparent Vault for scheduled distribution to investors, team members, etc. Note that for this to work, the asset must be capable of managing the vesting schedule. In a future version of the Cruna Core Protocol, a Transparent Distributor will be introduced to handle the vesting of any assets.
The Cruna Core Protocol establishes a framework that enables any NFT collection to integrate a Transparent Vault. Everdragons2 is the first project to implement this protocol.
Contracts will be deployed and upgraded by the Cruna DAO, but ownership will be transferred to the Everdragons2 DAO. This arrangement allows the Everdragons2 project to receive royalties from sales, manage parameters, tokenURI, and more, while Cruna maintains the ability to upgrade contracts as needed.
This separation of functions between the project launching the Protector and the DAO is essential to prevent hostile projects from upgrading the Protector contract in a way that scams users.
Implementation Process
A project wishing to deploy a new Protector contract must create a proposal by opening a PR in the /projects folder of this repo. The Cruna DAO will audit the proposal, and if approved, the project and DAO will determine when to deploy the contracts for the Protector and Protected. Although it is theoretically possible to associate multiple Protected NFTs with a single Protector, initially, only one Protected NFT per Protector will be supported.
Upgrades
When a new feature is ready for deployment, the Cruna DAO will open an improvement proposal. If approved, the DAO will upgrade the Protector, Protected, or both contracts as needed – for instance, if a bug is found or a vulnerability is discovered.
Implementing the Cruna Core Protocol necessitates a sophisticated UI to manage both Protector and Protected NFTs. Cruna, in collaboration with ndujaLabs and The Round Table, will develop this UI, which will be freely accessible to all projects looking to integrate the Cruna Core Protocol. To offset costs, a 5% royalty fee will be applied to the initial sale of each Protector NFT.
To streamline the process for projects, Cruna will develop an app designed to manage the initial sales of Protector NFTs. This white-label app will be provided to projects free of charge and will evolve over time, incorporating features requested by projects and those associated with new Protected NFTs released through the protocol.
1.0.0-beta.3
1.0.0-beta.2
1.0.0-beta.1
0.1.5
0.1.4
0.1.3
protected
folder0.1.2
0.1.1
0.1.0
Copyright (C) 2023 Cruna
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You may have received a copy of the GNU General Public License along with this program. If not, see https://www.gnu.org/licenses/gpl-3.0.en.html.
FAQs
The Cruna protocol
The npm package @cruna/cruna-protocol receives a total of 0 weekly downloads. As such, @cruna/cruna-protocol popularity was classified as not popular.
We found that @cruna/cruna-protocol demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.