Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@gnosis.pm/dx-price-oracle
Advanced tools
Contract to get an onchain reliable price from DutchX protocol.
The oracle exposes a simple function that will return the price for any ERC20 traded on the DutchX (See implementation).
function getPrice(address token)
public
view
returns (uint num, uint den)
This function will return a fraction (num
/den
), using the following logic:
0/0
:
0/0
if there is less than 9 auctions in the last 4.5 days.num/den
: Median of the last 9 auctions. In other words, if we order the
last 9 auctions by price, we take the 5th value.In the following example, we get the price for RDN (0x255Aa6DF07540Cb5d3d297f0D0D4D84cb52bc8e6
):
It provides also a parametrized function, to allow to change the behaviour of the price oracle (See implementation):
function getPriceCustom(
address token,
uint time,
bool requireWhitelisted,
uint maximumTimePeriod,
uint numberOfAuctions
)
public
view
returns (uint num, uint den)
Note: the contract is only safe for odd numbers of auctions. See here.
The next image shows an example, on how to get the price using:
token = 0x255Aa6DF07540Cb5d3d297f0D0D4D84cb52bc8e6
time = 0
requireWhitelisted = true
maximumTimePeriod = 1296000
numberOfAuctions = 3
Rinkeby:
Mainnet:
# Install dependencies
yarn install
# Compile contracts and inject network info
yarn restore
# Print the network info for every contract
yarn networks
For a local ganache:
# Run ganache
npx ganache-cli
# Migrate
yarn migrate
For other networks:
# Rinkeby
PK=<private_key> yarn migrate --network rinkeby
# Mainnet
PK=<private_key> yarn migrate --network mainnet
# Generate version and tag it
npm version <new-version-number>
# Publish version into git
git push && git push --tags
# Publish version into npm
npm publish --access=public
# Flatten contract
npx truffle-flattener contracts/DutchXPriceOracle.sol > build/DutchXPriceOracle-EtherScan.sol
npx truffle-flattener contracts/WhitelistPriceOracle.sol > build/WhitelistPriceOracle-EtherScan.sol
Validate the contract:
Tests use a mock contract to imitate the behavior of the DutchX. We generate 50 auctions with random prices and clearing times, and then test each contract fn on that model.
The recommended ways to run the tests is:
npx truffle test
or
npx truffle test --log
(to get console logs)
Have fun!
FAQs
A reliable price oracle based on the DutchX protocol
We found that @gnosis.pm/dx-price-oracle demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 12 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.