Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@gnosis.pm/dx-contracts
Advanced tools
DutchX - Gnosis Dutch Auction Trading Platform. This npm package provides all smartcontracts used in the project
The DutchX is a fully decentralized trading protocol ("the Protocol"), which allows anyone to add any token pair. The only requirement is for tokens to be ERC20 compliant.
It uses the Dutch auction principle to prevent the problems prevalent at other exchanges (e.g. front running) to facilitate the development of a fairer Web3 ecosystem for everyone.
Please note that depending on how you use this Program, you may be required to satisfy additional local law requirements, which may include but are not limited to instating KYC/AML procedures and gaining legal authorisations from applicable regulators.
Checkout the DutchX Documentation.
Check out the addresses for the deployed contracts in rinkeby
and mainnet
in
:
For developer we recommend to read the documentation and guides in DutchX Documentation.
# Install dependencies
yarn install
# Compile and restore the network addresses
yarn restore
# Show current network addresses
yarn networks
# Make sure ganache cli is installed globally
npm install -g ganache-cli
# Run ganache
yarn rpc
# Execute the migrations
yarn migrate
Some migrations allow you to specify some parameter so you can change some values at deploy time:
ETH_USD_PRICE
: Allows to set the price of the ETH-USD oracle feed. Just for
local ganache-cli. It's 500 USD/ETH
by default.FEED_EXPIRE_PERIOD_DAYS
: Allows to set the expiration date for the feed.
It's 365 days
by defaultThe migration that setup the DutchX contract is parametrized, so you can change the default value of the thresholds:
THRESHOLD_NEW_TOKEN_PAIR_USD
: Minimum USD worth of a token that the contract
requires in order to add a new token pair in the DutchX. It's 10.000 USD
by
default.THRESHOLD_AUCTION_START_USD
: Liquidity in USD required for the auction to
start. It's 1.000 USD
by default.yarn test -s
The flag -s runs the tests in a silence mode. Additionally the flag -g can be added to plot the gas costs per test.
# In a release branch (i.e. release/vX.Y.X)
# Migrate the version to the testnets, at least rinkeby, and possibly mainnet
# You can optionally change the gas price using the GAS_PRICE_GWEI env variable
yarn restore
MNEMONIC=$MNEMONIC_DX yarn migrate --network rinkeby
# Extract the network file
yarn networks-extract
# Verify the contract in Etherscan
# Folow the steps in "Verify contract"
# Commit the network file
git add network.json
git commit -m 'Update the networks file'
# Generate version using Semantic Version: https://semver.org/
# For example, for a minor version
npm version minor
git push && git push --tags
# Deploy npm package
npm publish --access=public
# Merge tag into develop, to deploy it to production, also merge it into master
git checkout develop
git merge vX.Y.X
Flatten the smart contract:
npx truffle-flattener contracts/DutchExchangeProxy.sol > build/DutchExchangeProxy-EtherScan.sol
npx truffle-flattener contracts/DutchExchange.sol > build/DutchExchange-EtherScan.sol
npx truffle-flattener contracts/TokenFRT.sol > build/TokenFRT-EtherScan.sol
npx truffle-flattener contracts/Oracle/PriceOracleInterface.sol > build/PriceOracleInterface-EtherScan.sol
Go to Etherscan validation page:
v0.4.24+commit.e67f0147
Yes
yarn get-abi-encoded-params --network rinkeby
This Program (as defined by the GNU Lesser General Public License) is made available on an as-is basis open source under the GNU Lesser General Public License and by doing so, no personal data is collected, used, stored, disclosed or secured by the creators. Depending on how you use this Program, you may be required to provide and apply an appropriate privacy policy to comply with law.
An API gathers publicly available data from the Ethereum blockchain on the usage of this Program.
Please note that where you use the Program to auction off a token and no one participates on the bid side of the auction within a 24 hour period, the token to be sold will be valued at zero. Therefore, we recommend that you also ensure liquidity for the bid-side.
FAQs
DutchX - Gnosis Dutch Auction Trading Platform. This npm package provides all smartcontracts used in the project
The npm package @gnosis.pm/dx-contracts receives a total of 5 weekly downloads. As such, @gnosis.pm/dx-contracts popularity was classified as not popular.
We found that @gnosis.pm/dx-contracts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 13 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.