Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@enabledao/enable-contracts
Advanced tools
Borderless peer-to-peer loans with social attestation
Enable is a open source stablecoin loan kit that enables anyone to deploy a fullly functional peer-to-peer stablecoin loan with the following features:
We built Enable with the vision to expand opportunity to emerging market borrowers through access to credit, to fund value-creating activities like education and starting a business.
The Enable stablecoin loan kit is standalone, and designed with minimum viable complexity in mind.
It is heavily inspired by the OpenZeppelin Crowdfund contracts and Dharma's loan contracts.
The Crowdloan functionality has been decomposed into the following categories:
Crowdloan: Track state of crowdfund, collect funds from lenders, and issue debt tokens. Once the funding is complete the borrower can withdraw funds. If the loan fails to get fully funded, lenders can withdraw their contribution.
RepaymentRouter: Handle repayments, and track withdrawal allowances for debt token holders.
TermsContract: Get information about the terms of the loan and it's current status.
We believe parts of this project could morph into generic standards useful to theEthereum community. We'll be expanding, modularizing, and genercizing as appropriate when the initial implementation is finished.
https://circleci.com/gh/enabledao/enable-contracts
zos
workflow for local developmentWe use ZeppelinOS to develop, deploy and operate the Enable loan kit packages. The ZeppelinOS Documentation is a good start.
npm install
to install all zeppelinOS related dependenciesganache-cli
(or ganache-cli --deterministic
) to run a local blockchain.env
file based on .env.sample
. These are the process.env
variables that will be used for deployment / application. As of Aug 2019 this is the Infura API key and mnemonic"development
networkFor background: read Publishing an EVM package.
zos publish --network development
. This publishes the project's app, package and provider. This updates the zos config file with "app.address" field that is needed for tests to run.zos push --network development
. This deploys the contracts in the project. This has the same effect as running zos create
on every contract. See Quickstart for context.npm run deploy:contracts -- --network kovan
from bash; change the network to the desired networkRun npx truffle exec scripts/deploy/paymentToken-deploy.js --network development --{args}
from node/terminal; change the network to the desired network
scripts/deploy/paymentToken-deploy.js
: Arguments --name
, --symbol
, --decimals
.npx truffle exec scripts/deploy/paymentToken-deploy.js --network development --name 'EnableDao Dai' --symbol EDAI --decimals 18
scripts/deploy/tokenFaucet-deploy.js
: No arguments.npx truffle exec scripts/deploy/tokenFaucet-deploy.js --network development
npm run test
. This also runs zos push
, which updates the contracts with the latest vrsionsFor background: read Upgrading contracts
zos upgrade <contract name>
or zos upgrade --all
based on contract changed. This should upgrade the contracts.We use ESLint and Prettier to format our code. Please make sure you have the following setting turned on in VSCode (or equivalent editor).
editor.formatOnSave: true
We use Solidity Coverage.
$(npm bin)/solidity-coverage
address
// Example
> npm t
TypeError: Cannot read property 'address' of undefined
This happens because zos needs contracts to be published
. To resolve, run:
zos publish
zos publish --network development
npm install
This is usually because of the websocket
module which web3
depends on. Remove all .git
submodules using the command below
# Finds all instances of .git folders in node_modules
find ./node_modules -name ".git"
# Deletes them
find ./node_modules -name ".git" -delete
principalRequested
from the borrower's point of viewWe need a set of (Mutually Exclusive, Collectively Exhaustive)[https://www.caseinterview.com/mece] stages and outcomes, that are used for our require
checks.
Some possible scenarios we will need to 'describe':
Scenario 1:
Crowdfund has ended, but borrower
does not withdraw funds. If they do not start
loan within a certain period of time (e.g. 48 hours), lenders should be able to refund
.
Stage: crowdfund ended
Crowdfund Outcome: no outcome yet
-> crowdfund refunded
Scenario 2:
Crowdfund has ended, and borrower
decides they do not want the loan and wants to refund the money.
Stage: crowdfund ended
Crowdfund Outcome: crowdfund refunded
Scenario 3:
During crowdfund, borrower
decides to pause the crowdfund. The crowdloan
:fund
should be suspended.
Stage: crowdfund started
Crowdfund Outcome: no outcome yet
-> crowdfund paused
These steps are sequential. require
statements can use <
of <=
to test for stages
FAQs
Borderless peer-to-peer loans with social attestation
The npm package @enabledao/enable-contracts receives a total of 8 weekly downloads. As such, @enabledao/enable-contracts popularity was classified as not popular.
We found that @enabledao/enable-contracts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.