Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
@gooddollar/goodprotocol
Advanced tools
SuperGoodDollar is an implementation of the GoodDollar token which adds functionality implemented by the Superfluid protocol, making it a Super Token.
SuperGoodDollar is implemented as a Pure Super Token - it has no underlying ERC20.
This is possible because Super Tokens are themselves ERC20 tokens.
The SuperGoodDollar contract is composed like this:
GoodDollarProxy is a minimal base contract. It's responsible for state storage and for dispatching calls to the appropriate logic contract via delegatecall.
Its initialize
method connects the proxy to 2 logic contracts:
initialize
then invokes the initializer methods of both connected logic contracts.
The contract GoodDollarCustom
overrides some of the method already implemented by the SuperToken
contract.
Such overriding across different logic contracts can be done by making external calls to the base implementation.
For convenience, this is handled by the base contract SuperTokenBase
which wraps SuperToken methods to be overrided.Dual upgradeability of the 2 connected logic contracts is achieved this way:
The tests in SuperGoodDollar.ts
aren't comprehensive (not ready for production), but sufficient to prove that the mechanism with 2 logic contracts works.
FAQs
GoodDollar Protocol
The npm package @gooddollar/goodprotocol receives a total of 312 weekly downloads. As such, @gooddollar/goodprotocol popularity was classified as not popular.
We found that @gooddollar/goodprotocol demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.