
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
@divvi/referral-sdk
Advanced tools
The Divvi referral ecosystem enables decentralized applications to implement and track referral systems on blockchain networks. This SDK simplifies the process of integrating with Divvi's referral attribution system by providing tools to tag transactions with referral metadata and report them to Divvi's tracking API.
With this SDK, dApps can:
For more information about the Divvi ecosystem, visit our documentation.
yarn add @divvi/referral-sdk
The SDK provides two main functions:
getReferralTag
- Generates a hex string tag containing referral metadatasubmitReferral
- Reports referral events to the attribution tracking APIDivvi supports two referral submission methods:
Include the referral tag in transaction calldata, then submit the transaction hash to the API for tracking.
Submit referrals without requiring on-chain transactions - perfect for cash-in flows, airdrops, or other off-chain activities.
This is the traditional method where referral data is embedded in transaction calldata.
import { getReferralTag, submitReferral } from '@divvi/referral-sdk'
import { createWalletClient, custom } from 'viem'
import { mainnet } from 'viem/chains'
// Step 1: Create a wallet client and get the account
export const walletClient = createWalletClient({
chain: mainnet,
transport: custom(window.ethereum),
})
const [account] = await walletClient.getAddresses()
// Step 2: Execute an existing transaction within your codebase with the referral tag
const txHash = await walletClient.writeContract({
address: contractAddress,
account,
abi: contractABI,
functionName: 'yourFunction',
args: [...yourArgs],
dataSuffix: `0x${getReferralTag({
user: account, // The user address making the transaction (required)
consumer: consumerAddress, // The address of the consumer making the call
})}`, // Using dataSuffix appends the tag (recommended)
})
// Step 3: Get the current chain ID
const chainId = await walletClient.getChainId()
// Step 4: Report the transaction to the attribution tracking API
await submitReferral({
txHash,
chainId,
})
This method enables referral attribution without requiring on-chain transactions, perfect for cash-in flows, airdrops, or other off-chain activities.
⚠️ IMPORTANT PRIVACY NOTICE
The clear text of signed messages will be recorded on the Optimism blockchain when registered in the DivviRegistry contract and will be publicly visible. Never include private information, personal data, or sensitive details in signed messages. Only include information that you're comfortable being publicly accessible.
import { getReferralTag, submitReferral } from '@divvi/referral-sdk'
import { createWalletClient, custom } from 'viem'
import { mainnet } from 'viem/chains'
const walletClient = createWalletClient({
chain: mainnet,
transport: custom(window.ethereum),
})
const [account] = await walletClient.getAddresses()
// Step 1: Generate the referral tag
const referralTag = getReferralTag({
user: account, // The user address consenting to the referral (required)
consumer: consumerAddress, // The address of the consumer
})
// Step 2: Create a message containing the referral data
// RECOMMENDED: Reuse existing signed messages from your app (e.g., SIWE authentication)
// and embed the referral tag. You can use any message format - the referral tag just needs to be embedded.
// Example: Creating a new message with referral data
const message = `Divvi Referral Attribution
Referral Tag: ${referralTag}
Timestamp: ${Date.now()}`
// Alternative: Embed in existing authentication message (SIWE, etc.)
// const message = `${yourExistingAuthMessage}\nReferral Tag: ${referralTag}`
// Step 3: Sign the message
const signature = await walletClient.signMessage({
message,
})
// Step 4: Get the current chain ID
const chainId = await walletClient.getChainId()
// Step 5: Submit the signed message referral
await submitReferral({
message, // Can be a string or hex
signature, // The signature from step 3
chainId,
})
import { getReferralTag, submitReferral } from '@divvi/referral-sdk'
import { createWalletClient, custom } from 'viem'
import { mainnet } from 'viem/chains'
const walletClient = createWalletClient({
chain: mainnet,
transport: custom(window.ethereum),
})
const [account] = await walletClient.getAddresses()
// Example transaction with referral data
const txHash = await walletClient.sendTransaction({
account,
to: contractAddress,
data:
contractData +
getReferralTag({
user: account, // The user address making the transaction (required)
consumer: consumerAddress, // The address of the consumer making the call
}), // Appending to existing data (recommended)
value: transactionValue,
// ... other transaction parameters
})
// Alternative: You can also include the tag anywhere in the transaction data
// const referralTag = getReferralTag({ user: account, consumer: consumerAddress })
// data: someCustomData + referralTag + moreData
For off-chain signed message referrals, the Divvi tracking API supports comprehensive signature verification:
user
Parameter MattersThe user
parameter is crucial because Divvi cryptographically verifies that the user you specify is actually the one who consented to the transaction or signed the message. This prevents fake referrals and ensures accurate attribution.
Here's how it works:
For on-chain transactions:
user
matches who actually sent the transaction (tx.from
).For off-chain signed messages:
user
address actually signed the message containing the referral tag.This means you get accurate referral tracking regardless of whether your users have simple wallets or more advanced smart account setups, and whether they're making on-chain transactions or off-chain commitments.
Note: If you're using a custom smart account architecture and verification fails, reach out to us - we can add support for additional patterns as needed.
Bottom line: Set the user
parameter to the actual person making the transaction or signing the message, and Divvi will cryptographically ensure they're the one who really consented to it. No fake referrals, no attribution errors.
This is a breaking change. The SDK has been updated from v1 to v2 with the following changes:
getDataSuffix
has been replaced with getReferralTag
user
parameter is now required in getReferralTag
to ensure proper referral attribution of the right userUpdate function imports: Replace getDataSuffix
with getReferralTag
in your imports:
// v1 (OLD)
import { getDataSuffix, submitReferral } from '@divvi/referral-sdk'
// v2 (NEW)
import { getReferralTag, submitReferral } from '@divvi/referral-sdk'
Update function calls: Replace all instances of getDataSuffix
with getReferralTag
and add the new required user
parameter for proper attribution:
// v1 (OLD)
dataSuffix: `0x${getDataSuffix({ consumer })}`
// v2 (NEW)
dataSuffix: `0x${getReferralTag({ user, consumer })}`
The user
parameter should be the address of the user making the transaction to ensure accurate referral attribution.
// v1 Implementation (OLD)
import { getDataSuffix, submitReferral } from '@divvi/referral-sdk'
const txHash = await walletClient.writeContract({
// ... other parameters
dataSuffix: `0x${getDataSuffix({ consumer })}`,
})
// v2 Implementation (NEW)
import { getReferralTag, submitReferral } from '@divvi/referral-sdk'
const txHash = await walletClient.writeContract({
// ... other parameters
dataSuffix: `0x${getReferralTag({ user, consumer })}`,
})
Clone the repository
Install dependencies:
yarn install
Run tests:
yarn test
MIT
FAQs
SDK for managing referrals in the Divvi ecosystem
The npm package @divvi/referral-sdk receives a total of 774 weekly downloads. As such, @divvi/referral-sdk popularity was classified as not popular.
We found that @divvi/referral-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.