Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@ercref/contracts
Advanced tools
An open source repository for smart contract reference implementations of ERCs.
A repository for Ethereum builders to build ERC reference implementations.
Here is how you can start using this repo.
npm i -D @ercref/contracts
Import the contracts like you would from OpenZeppelin's contract. e.g.
import "@ercref/contracts/drafts/IERC5732.sol";
import "@ercref/contracts/drafts/BlocknumGapCommit.sol";
Here is a full example:
pragma solidity ^0.8.17;
import "@ercref/contracts/drafts/IERC5732.sol";
import "@ercref/contracts/drafts/BlocknumGapCommit.sol";
import "@openzeppelin/contracts/utils/introspection/ERC165.sol";
import "@openzeppelin/contracts/token/ERC721/ERC721.sol";
contract CommitableERC721 is ERC721, BlocknumGapCommit {
constructor(uint256 _version) ERC721("CommitToMintImpl", "CTMI") {
}
function safeMint(
address _to,
uint256 _tokenId,
bytes calldata _extraData
) onlyCommited(
abi.encodePacked(_to, _tokenId),
bytes32(_extraData[0:32]),
6 // number of blocks required to reveal
)
external {
_safeMint(_to, _tokenId); // ignoring _extraData in this simple reference implementation.
}
function supportsInterface(bytes4 interfaceId)
public
view
virtual
override(ERC721, BlocknumGapCommit)
returns (bool)
{
return super.supportsInterface(interfaceId);
}
}
npm
yarn publish --access public
WARNING: This repository is meant to be cutting (bleeding) edge and pioneer. Please make sure to conduct security audit before using in production.
FAQs
An open source repository for smart contract reference implementations of ERCs.
We found that @ercref/contracts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.